@tinycloud/courier 0.2.0-beta.37 → 0.2.0-beta.39

package/dist/guard/install.js

@@ -0,0 +1,193 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { installBinaryCensus } from './binaries.js';
+import { programName } from '../program.js';
+import { isRecord } from '../a2a.js';
+import { installRoots, realpathBest } from './paths.js';
+import { createHash } from 'node:crypto';
+/** Where this OS user keeps credentials that a woken agent can read through the Read tool (and a shell) unless HOME differs. */
+export const CREDENTIAL_FILES = ['.config/gh/**', '.npmrc', '.netrc', '.ssh/**', '.aws/**', '.config/gcloud/**', '.docker/config.json', '.config/wrangler/**', '.config/.wrangler/**', '.git-credentials'];
+/**
+ * The guard's Claude Code settings and the environment woken agents get (spec §7).
+ *
+ * Settings = a `PreToolUse` hook that runs `courier guard` on every tool call, plus deny rules for what no approval can
+ * unlock (pairing and revoking, Secret Bridge), direct gated actions, and the files the guard lives in.
+ * Approved PR merges go through the broker, never through a hook allow decision.
+ */
+/** Command prefixes a woken agent may not run directly (the broker runs the merge). */
+const GATED_DENY = [
+    'gh pr merge', 'gh workflow run', 'gh release create', 'gh release edit', 'gh release delete', 'gh release upload', 'gh run rerun', 'gh secret', 'gh repo sync',
+    'npm publish', 'npm unpublish', 'npm dist-tag', 'pnpm publish', 'bun publish', 'yarn npm publish', 'changeset publish', 'npx changeset publish', 'bunx changeset publish',
+    'wrangler deploy', 'wrangler publish', 'wrangler delete', 'wrangler rollback', 'wrangler secret', 'npx wrangler deploy', 'phala deploy', 'phala cvms',
+    'git push', 'git push origin main', 'git push origin master', 'git push --force', 'git push -f', 'git push --mirror', 'git push --all', 'git push --tags',
+].map((prefix) => `Bash(${prefix}:*)`);
+/** Programs that change user, outlive the call or reach credentials. */
+const PRIVILEGE_DENY = ['sudo', 'su', 'doas', 'pkexec', 'tmux', 'screen', 'crontab', 'systemctl', 'ssh', 'gh auth', 'git credential', 'secret-tool'].map((prefix) => `Bash(${prefix}:*)`);
+const shq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+/** The command Claude Code runs for the hook. `|| exit 2` turns any crash into a blocking error (exit 1 would fail open). */
+export function hookCommand(argv, home, realHome = os.homedir()) {
+    // COURIER_REAL_HOME: the hook runs with the agent's clean HOME, and still has to protect the owner's real one.
+    return `COURIER_HOME=${shq(home)} COURIER_REAL_HOME=${shq(realHome)} ${argv.map(shq).join(' ')} || exit 2`;
+}
+/** Everything the guard keeps for a profile lives here; no tool call may write it. */
+export const guardDir = (home) => path.join(home, 'guard');
+export const guardSettingsFile = (home) => path.join(guardDir(home), 'settings.json');
+/** `TC_HOME` for woken agents: an empty directory, so the owner's `tc` profile is not found. */
+export const profileId = (home) => createHash('sha256').update(realpathBest(home)).digest('hex').slice(0, 24);
+export const agentHome = (home) => path.join(path.dirname(path.resolve(home)), `courier-agent-home-${profileId(home)}`);
+export const noOwnerProfileDir = (home) => path.join(agentHome(home), 'no-owner-profile');
+/** Paths no tool call may write: the courier profile (keys, grant, state), the guard files, the hook program and what it imports. */
+export function protectedPaths(home, entry) {
+    return [path.resolve(home), ...installRoots(entry)];
+}
+/** Claude Code permission paths: `//abs/path` is absolute. */
+const rulePath = (p) => `/${path.resolve(p)}`;
+export function guardSettings(options) {
+    const { argv, home, entry } = options;
+    const programs = [...new Set(['courier', 'tc courier', 'tinycloud courier', programName()])];
+    const deny = [];
+    for (const p of protectedPaths(home, entry)) {
+        for (const tool of ['Edit', 'Write', 'MultiEdit', 'NotebookEdit'])
+            deny.push(`${tool}(${rulePath(p)}/**)`);
+    }
+    for (const f of ['key.json', 'grant.json'])
+        deny.push(`Read(${rulePath(path.join(home, f))})`);
+    // Credential-file Read rules supplement the hook policy.
+    for (const rel of CREDENTIAL_FILES)
+        deny.push(`Read(${rulePath(path.join(os.homedir(), rel))})`);
+    for (const prog of programs)
+        for (const sub of ['pair', 'revoke', 'init', 'pause', 'resume', 'watch'])
+            deny.push(`Bash(${prog} ${sub}:*)`);
+    deny.push('Bash(secret-bridge:*)', 'Bash(secret_bridge:*)', 'mcp__paseo', 'mcp__paseo__*');
+    // Gated actions are refused by the hook; these rules make them hold even if the hook does not start. Merges go through
+    // `courier run-approved`, which is not on this list. Rules use only the prefix forms Claude Code documents.
+    deny.push(...GATED_DENY, ...PRIVILEGE_DENY);
+    return {
+        disableAllHooks: false,
+        hooks: { PreToolUse: [{ matcher: '*', hooks: [{ type: 'command', command: hookCommand(argv, home), timeout: 60 }] }] },
+        permissions: { deny },
+    };
+}
+/** The guard's own hook command, as {@link hookCommand} writes it. */
+export const GUARD_HOOK_RE = /^COURIER_HOME=.* 'guard' \|\| exit 2$/;
+const isGuardHook = (entry) => isRecord(entry) && Array.isArray(entry.hooks) && entry.hooks.some((h) => isRecord(h) && typeof h.command === 'string' && GUARD_HOOK_RE.test(h.command));
+/**
+ * `ours` merged over a user's settings: the guard's hook goes first, its deny rules are added, `disableAllHooks` is
+ * forced to false, and an older copy of the guard's hook in `theirs` is replaced, not duplicated.
+ */
+export function mergeGuardSettings(ours, theirs) {
+    if (theirs === undefined)
+        return { ...ours };
+    if (!isRecord(theirs))
+        throw new Error('settings are not a JSON object');
+    const theirHooks = isRecord(theirs.hooks) ? theirs.hooks : {};
+    const theirPre = (Array.isArray(theirHooks.PreToolUse) ? theirHooks.PreToolUse : []).filter((entry) => !isGuardHook(entry));
+    const theirPerms = isRecord(theirs.permissions) ? theirs.permissions : {};
+    const theirDeny = Array.isArray(theirPerms.deny) ? theirPerms.deny : [];
+    return {
+        ...theirs,
+        disableAllHooks: false,
+        hooks: { ...theirHooks, PreToolUse: [...ours.hooks.PreToolUse, ...theirPre] },
+        permissions: { ...theirPerms, deny: [...new Set([...ours.permissions.deny, ...theirDeny])] },
+    };
+}
+/**
+ * The settings the guard installs in a woken agent's project directory. The file is the guard's: only the guard's hook
+ * (as the one PreToolUse entry, with no other hook event) and the union of deny rules survive. Everything else in it
+ * (other hooks, `env`, `apiKeyHelper`, `statusLine`, MCP servers, allow rules) is replaced, because any of it can run a
+ * command or widen what the agent may do (B1).
+ */
+export function projectSettings(ours, theirs) {
+    if (theirs !== undefined && !isRecord(theirs))
+        throw new Error('settings are not a JSON object');
+    const perms = isRecord(theirs) && isRecord(theirs.permissions) ? theirs.permissions : {};
+    const theirDeny = Array.isArray(perms.deny) ? perms.deny.filter((rule) => typeof rule === 'string') : [];
+    return { disableAllHooks: false, hooks: ours.hooks, permissions: { deny: [...new Set([...ours.permissions.deny, ...theirDeny])] } };
+}
+/**
+ * Write the guard settings for `home`. A settings file the owner passed with `--claude-settings` is merged in, with the
+ * guard's hook and deny rules added to (never replacing) whatever it holds. Returns the path to give `claude --settings`.
+ */
+export function writeGuardSettings(options) {
+    const dir = guardDir(options.home);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.mkdirSync(noOwnerProfileDir(options.home), { recursive: true, mode: 0o700 });
+    installBinaryCensus(path.join(guardDir(options.home), 'binaries.json'), options.entry, options.argv, process.cwd());
+    const theirs = options.userSettings ? JSON.parse(fs.readFileSync(options.userSettings, 'utf8')) : undefined;
+    if (options.userSettings && !isRecord(theirs))
+        throw new Error(`${options.userSettings} is not a JSON object`);
+    const merged = mergeGuardSettings(guardSettings(options), theirs);
+    const file = guardSettingsFile(options.home);
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify(merged, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+    return file;
+}
+/**
+ * The only variables a woken agent inherits (claude and exec adapters build the environment from this list; nothing else
+ * is passed on): paths and locale, proxy and CA settings, what Claude Code itself needs. No inherited `COURIER_*` paths are passed. No tokens:
+ * not `GH_TOKEN`/`GITHUB_TOKEN`, `NPM_TOKEN`, `CLOUDFLARE_*`, `WRANGLER_*`, `PHALA_*`, `LINEAR_*`, `AWS_*`, cloud or
+ * `TC_*` credentials, nor `SSH_AUTH_SOCK`. An operator who really needs one names it with `--env-pass`.
+ */
+const ALLOWED_ENV = [
+    /^(PATH|HOME|USER|LOGNAME|SHELL|LANG|LANGUAGE|TZ|TERM|COLORTERM|NO_COLOR|FORCE_COLOR|TMPDIR|TMP|TEMP|HOSTNAME)$/,
+    /^LC_[A-Z_]+$/,
+    /^(HTTPS?_PROXY|NO_PROXY|ALL_PROXY)$/i,
+    /^(SSL_CERT_FILE|SSL_CERT_DIR|CURL_CA_BUNDLE|REQUESTS_CA_BUNDLE|NODE_EXTRA_CA_CERTS)$/,
+    /^CLAUDE_CODE_ENTRYPOINT$/,
+    /^CLAUDECODE$/,
+    /^TC_BIN$/,
+];
+/** Credential variables explicitly blanked by the Paseo adapter. */
+const BLANKED_ENV = [
+    'COURIER_HOME', 'COURIER_REAL_HOME', 'COURIER_BROKER_DIR',
+    'GH_TOKEN', 'GITHUB_TOKEN', 'GH_ENTERPRISE_TOKEN', 'GITHUB_ENTERPRISE_TOKEN', 'GITHUB_PAT', 'NPM_TOKEN', 'NODE_AUTH_TOKEN', 'YARN_NPM_AUTH_TOKEN', 'NPM_CONFIG_TOKEN',
+    'CLOUDFLARE_API_TOKEN', 'CLOUDFLARE_API_KEY', 'CLOUDFLARE_ACCOUNT_ID', 'CLOUDFLARE_EMAIL', 'CF_API_TOKEN', 'CF_ACCOUNT_ID', 'WRANGLER_API_TOKEN',
+    'PHALA_CLOUD_API_KEY', 'PHALA_API_KEY', 'LINEAR_API_KEY', 'LINEAR_ACCESS_TOKEN', 'TYPESAFE_API_KEY',
+    'AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_SESSION_TOKEN', 'AWS_PROFILE', 'GOOGLE_APPLICATION_CREDENTIALS', 'GOOGLE_API_KEY', 'AZURE_CLIENT_SECRET',
+    'OPENAI_API_KEY', 'SLACK_BOT_TOKEN', 'SLACK_TOKEN', 'DOCKER_PASSWORD', 'SSH_AUTH_SOCK', 'SSH_ASKPASS', 'GIT_ASKPASS',
+    'GIT_CONFIG_PARAMETERS', 'GIT_CONFIG_SYSTEM', 'GIT_CONFIG', 'GIT_EXEC_PATH', 'GIT_SSH_COMMAND', 'GIT_SSH', 'GIT_PROXY_COMMAND', 'GIT_EDITOR', 'GIT_SEQUENCE_EDITOR', 'GIT_PAGER', 'GIT_EXTERNAL_DIFF',
+    'BASH_ENV', 'ENV', 'NODE_OPTIONS', 'NODE_PATH', 'LD_PRELOAD', 'LD_LIBRARY_PATH', 'DYLD_INSERT_LIBRARIES', 'ZDOTDIR', 'GH_CONFIG_DIR',
+    'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN', 'CLAUDE_CODE_MESSAGING_TOKEN',
+    'TC_PRIVATE_KEY', 'TC_PROFILE', 'TC_OWNER_DID', 'TC_API_KEY', 'TC_TOKEN', 'TC_OPENKEY_HOST', 'TC_OPENKEY_API_HOST', 'TC_AUTH_NO_POPUP', 'TC_NO_POPUP',
+];
+const allowed = (name, extra) => !/^COURIER_/.test(name) && (extra.includes(name) || ALLOWED_ENV.some((re) => re.test(name)));
+/** Private shell/config roots shared by the direct adapters and stock Paseo overrides. */
+export function agentHomeEnv(home) {
+    const clean = agentHome(home);
+    return {
+        HOME: clean, CLAUDE_CONFIG_DIR: path.join(clean, '.claude'), ZDOTDIR: clean,
+        XDG_CONFIG_HOME: path.join(clean, '.config'), XDG_DATA_HOME: path.join(clean, '.local/share'),
+        XDG_CACHE_HOME: path.join(clean, '.cache'), XDG_STATE_HOME: path.join(clean, '.local/state'),
+        XDG_RUNTIME_DIR: path.join(clean, '.runtime'),
+        TMPDIR: path.join(clean, 'tmp'), TMP: path.join(clean, 'tmp'), TEMP: path.join(clean, 'tmp'),
+        TC_HOME: noOwnerProfileDir(home),
+        GIT_CONFIG_COUNT: '1', GIT_CONFIG_KEY_0: 'core.hooksPath', GIT_CONFIG_VALUE_0: '/dev/null',
+        GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: path.join(clean, '.gitconfig'),
+    };
+}
+/**
+ * Environment for a woken agent: an allowlist (see {@link ALLOWED_ENV}) plus `extra` names the operator passed with
+ * `--env-pass`. The owner's `tc` profile is hidden by pointing `TC_HOME` at an empty directory.
+ */
+export function courierOnlyEnv(base, home, extra = []) {
+    const env = {};
+    for (const [name, value] of Object.entries(base))
+        if (value !== undefined && allowed(name, extra))
+            env[name] = value;
+    Object.assign(env, agentHomeEnv(home));
+    return env;
+}
+const CREDENTIAL_LIKE = /(TOKEN|SECRET|PASSW|API_?KEY|ACCESS_KEY|PRIVATE_KEY|CREDENTIAL|AUTH)|^(TC|CLOUDFLARE|CF|WRANGLER|PHALA|LINEAR|AWS|GOOGLE|AZURE|GH|GITHUB|NPM|SSH)_/i;
+/** Environment overrides for Paseo: blank credential names and set the clean agent HOME. */
+export function courierEnvOverrides(base, home, extra = []) {
+    const out = {};
+    for (const name of [...Object.keys(base).filter((n) => CREDENTIAL_LIKE.test(n) || /^(XDG_|GIT_|COURIER_)/.test(n)), ...BLANKED_ENV]) {
+        if (!allowed(name, extra) && !name.startsWith('PASEO_') && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+            out[name] = '';
+    }
+    Object.assign(out, agentHomeEnv(home));
+    return out;
+}
+//# sourceMappingURL=install.js.map

package/dist/guard/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/guard/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,gIAAgI;AAChI,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;AAC3M;;;;;;GAMG;AAEH,uFAAuF;AACvF,MAAM,UAAU,GAAG;IACjB,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc;IAC/J,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,wBAAwB;IACzK,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,cAAc,EAAE,YAAY;IACrJ,UAAU,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB;CAC1J,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,MAAM,KAAK,CAAC,CAAC;AAEvC,wEAAwE;AACxE,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,MAAM,KAAK,CAAC,CAAC;AAE1L,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAE3D,6HAA6H;AAC7H,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,IAAY,EAAE,WAAmB,EAAE,CAAC,OAAO,EAAE;IACvF,+GAA+G;IAC/G,OAAO,gBAAgB,GAAG,CAAC,IAAI,CAAC,sBAAsB,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;AAC7G,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;AAC9F,gGAAgG;AAChG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,sBAAsB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChI,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAElG,qIAAqI;AACrI,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAa;IACxD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACtD,CAAC;AAQD,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AAEtD,MAAM,UAAU,aAAa,CAAC,OAAwD;IACpF,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACtC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7G,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/F,yDAAyD;IACzD,KAAK,MAAM,GAAG,IAAI,gBAAgB;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACjG,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC;IAC3I,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IAC3F,uHAAuH;IACvH,4GAA4G;IAC5G,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,EAAE,GAAG,cAAc,CAAC,CAAC;IAC5C,OAAO;QACL,eAAe,EAAE,KAAK;QACtB,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE;QACtH,WAAW,EAAE,EAAE,IAAI,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAErE,MAAM,WAAW,GAAG,CAAC,KAAc,EAAW,EAAE,CAC9C,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAE1J;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAmB,EAAE,MAAe;IACrE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,OAAO;QACL,GAAG,MAAM;QACT,eAAe,EAAE,KAAK;QACtB,KAAK,EAAE,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,EAAE;QAC7E,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE;KAC7F,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAmB,EAAE,MAAe;IAClE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzH,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACtI,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA+E;IAChH,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpH,MAAM,MAAM,GAAY,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,YAAY,uBAAuB,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAa;IAC5B,gHAAgH;IAChH,cAAc;IACd,sCAAsC;IACtC,sFAAsF;IACtF,0BAA0B;IAC1B,cAAc;IAEd,UAAU;CACX,CAAC;AAEF,oEAAoE;AACpE,MAAM,WAAW,GAAG;IAClB,cAAc,EAAE,mBAAmB,EAAE,oBAAoB;IACzD,UAAU,EAAE,cAAc,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,kBAAkB;IACrK,sBAAsB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,oBAAoB;IAChJ,qBAAqB,EAAE,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB;IACnG,mBAAmB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,aAAa,EAAE,gCAAgC,EAAE,gBAAgB,EAAE,qBAAqB;IAC3J,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa;IACpH,uBAAuB,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,SAAS,EAAE,mBAAmB,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAE,mBAAmB;IACrM,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,SAAS,EAAE,eAAe;IACpI,mBAAmB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,6BAA6B;IACrG,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,aAAa;CACtJ,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,KAAwB,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEzJ,0FAA0F;AAC1F,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK;QAC3E,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC;QAC7F,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC;QAC5F,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC;QAC7C,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;QAC5F,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC;QAChC,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,WAAW;QAC1F,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuB,EAAE,IAAY,EAAE,QAA2B,EAAE;IACjG,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACrH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,eAAe,GAAG,qJAAqJ,CAAC;AAE9K,4FAA4F;AAC5F,MAAM,UAAU,mBAAmB,CAAC,IAAuB,EAAE,IAAY,EAAE,QAA2B,EAAE;IACtG,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC;QACpI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACnH,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/guard/network.d.ts

@@ -0,0 +1,7 @@
+/** WHATWG URL parsing canonicalises short, decimal, octal and hex IPv4 forms. Numeric hosts are refused conservatively. */
+export declare function blockedDestination(value: string): boolean;
+/** Literal addresses inside argv and interpreted HTTP/net client code, including headers and --resolve. */
+export declare function networkTextRefusal(text: string): boolean;
+export type ResolveHost = (host: string) => Promise<string[]>;
+/** DNS check before the tool executes. Errors fail closed. */
+export declare function dnsRefusal(text: string, resolve?: ResolveHost): Promise<boolean>;

package/dist/guard/network.js

@@ -0,0 +1,78 @@
+import { isIP } from 'node:net';
+import { lookup } from 'node:dns/promises';
+/** WHATWG URL parsing canonicalises short, decimal, octal and hex IPv4 forms. Numeric hosts are refused conservatively. */
+export function blockedDestination(value) {
+    const input = value.trim().replace(/^["']|["',;)]$/g, '');
+    if (/^(?:\[?::1\]?|\[?::ffff:)/i.test(input))
+        return true;
+    let url;
+    try {
+        url = new URL(input.includes('://') ? input : `http://${input}`);
+    }
+    catch {
+        return /(?:localhost|\b127\.|\b0x7f|\[::)/i.test(input);
+    }
+    const host = url.hostname.toLowerCase().replace(/\.$/, '').replace(/^\[|\]$/g, '');
+    return url.port === '6767' || url.port === '6768' || host === 'localhost' || host.endsWith('.localhost') ||
+        isIP(host) !== 0 || /^[0-9]+$/.test(host) || /(?:^|[.-])(?:127|0x7f[0-9a-f]*)(?:[.-]|$)/i.test(host) || /\.(nip|sslip)\.io$/.test(host);
+}
+/** Literal addresses inside argv and interpreted HTTP/net client code, including headers and --resolve. */
+export function networkTextRefusal(text) {
+    if (/\/dev\/(tcp|udp)\//i.test(text))
+        return true;
+    const networkCode = /\b(curl|wget|net|http|https|fetch|connect|urlopen|requests?|socket)\b/.test(text);
+    const tokens = text.split(/[\s"'`,(){};=]+/).filter(Boolean);
+    for (const token of tokens) {
+        if (isIP(token.replace(/^\[|\]$/g, '')) !== 0)
+            return true;
+        if (networkCode && /^(?:[0-9]{7,}|0x[0-9a-f]+)$/i.test(token) && blockedDestination(token))
+            return true;
+        if (/^https?:\/\//i.test(token) && blockedDestination(token))
+            return true;
+        if (/(?:localhost|\[?::|^127\.|^0177\.|^0x7f|^2130706433|^0\.0\.0\.0)/i.test(token) && blockedDestination(token))
+            return true;
+        if (/(?:^|:)676[78](?:\/|$)/.test(token))
+            return true;
+    }
+    return /\b(?:connect|urlopen|request|fetch)\b/.test(text) && /\b676[78]\b/.test(text);
+}
+const resolveHost = async (host) => (await lookup(host, { all: true, verbatim: true })).map(r => r.address);
+/** DNS check before the tool executes. Errors fail closed. */
+export async function dnsRefusal(text, resolve = resolveHost) {
+    const hosts = new Set();
+    for (const token of text.match(/(?:https?:\/\/)[^\s"'`,)]+|\b[a-z0-9.-]+:\d+(?:\/[^\s"']*)?/gi) ?? []) {
+        try {
+            hosts.add(new URL(token.includes('://') ? token : `http://${token}`).hostname);
+        }
+        catch {
+            return true;
+        }
+    }
+    if (/\b(curl|wget|http|https|httpie|xh|xhs|aria2c|fetch|urlopen|connect)\b/.test(text)) {
+        for (const host of text.match(/\b(?:[a-z0-9-]+\.)+[a-z]{2,}\b/gi) ?? [])
+            hosts.add(host);
+    }
+    if (hosts.size > 20)
+        return true;
+    for (const host of hosts) {
+        if (blockedDestination(host))
+            return true;
+        let timer;
+        try {
+            const addresses = await Promise.race([resolve(host), new Promise((_, reject) => { timer = setTimeout(() => reject(Error('DNS timeout')), 1500); })]);
+            if (!addresses.length || addresses.some(a => {
+                const ip = a.replace(/^::ffff:/i, '');
+                return /^(127\.|0\.)/.test(ip) || ip === '::1' || ip === '::' || /^::ffff:7f/i.test(a);
+            }))
+                return true;
+        }
+        catch {
+            return true;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=network.js.map

package/dist/guard/network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../../src/guard/network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,2HAA2H;AAC3H,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAC5I,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACnF,OAAO,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5I,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,WAAW,GAAG,uEAAuE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,WAAW,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,mEAAmE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9H,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxF,CAAC;AAGD,MAAM,WAAW,GAAgB,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAEvH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,UAAuB,WAAW;IAC/E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,+DAA+D,CAAC,IAAI,EAAE,EAAE,CAAC;QACtG,IAAI,CAAC;YAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAChH,CAAC;IACD,IAAI,uEAAuE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,kBAAkB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,KAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5J,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC1C,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBACtC,OAAO,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/guard/normalize.d.ts

@@ -0,0 +1,28 @@
+import { type Verb } from './target.js';
+import type { PolicyEnv, Word } from './policy.js';
+/** A gated command reduced to what an approval names, or the reason it cannot be (the guard then refuses it). */
+export type Norm = {
+    verb: Verb;
+    target: string;
+} | string;
+export interface NormCtx {
+    env: PolicyEnv;
+    cwds: string[];
+    cwdUnknown: boolean;
+    /** `NAME=value` prefix assignments of the command. */
+    assigns: string[];
+}
+/** `owner/repo` of a git remote (name or URL), identical across every directory the command may run in. */
+export declare function repoOfRemote(ctx: NormCtx, remote: string | undefined): string | undefined;
+export declare function normGhPrMerge(rest: Word[], ctx: NormCtx, all?: Word[]): Norm;
+export declare function normGhWorkflowRun(rest: Word[], ctx: NormCtx, all?: Word[]): Norm;
+export declare const releaseIsReadOnly: (sub: string | undefined) => boolean;
+export declare function normGhRelease(rest: Word[], ctx: NormCtx, all?: Word[]): Norm;
+export declare function normApi(text: string): Norm;
+export declare function normPublish(prog: string, rest: Word[], ctx: NormCtx): Norm;
+export declare function normChangeset(ctx: NormCtx): Norm;
+export declare function normScript(prog: string, script: string, ctx: NormCtx): Norm;
+export declare function normWrangler(rest: Word[], ctx: NormCtx): Norm;
+export declare function normPhala(rest: Word[]): Norm;
+export declare function normSecrets(rest: Word[]): Norm;
+export declare function normPush(remote: string | undefined, branches: string[], ctx: NormCtx): Norm;

package/dist/guard/normalize.js

@@ -0,0 +1,257 @@
+import path from 'node:path';
+import { canonicalTarget } from './target.js';
+const fail = (why) => why;
+const lits = (args) => args.map((a) => a.value);
+function ok(verb, target) {
+    try {
+        return { verb, target: canonicalTarget(verb, target) };
+    }
+    catch {
+        return fail(`cannot name the target (${target.slice(0, 80)})`);
+    }
+}
+/** Value of `--flag v`, `--flag=v` or `-f v` (first occurrence), or undefined. */
+function flagValue(args, names) {
+    for (let i = 0; i < args.length; i++) {
+        const v = args[i].value;
+        for (const n of names) {
+            if (v === n)
+                return args[i + 1]?.value;
+            if (n.startsWith('--') && v.startsWith(`${n}=`))
+                return v.slice(n.length + 1);
+        }
+    }
+    return undefined;
+}
+const GITHUB_REMOTE = /github\.com[:/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?\/?$/;
+/** `owner/repo` of a git remote (name or URL), identical across every directory the command may run in. */
+export function repoOfRemote(ctx, remote) {
+    const direct = remote ? GITHUB_REMOTE.exec(remote) : null;
+    if (direct)
+        return `${direct[1]}/${direct[2]}`.toLowerCase();
+    if (ctx.cwdUnknown)
+        return undefined;
+    const found = new Set();
+    for (const dir of ctx.cwds) {
+        const r = ctx.env.git(dir, ['remote', 'get-url', remote ?? 'origin']);
+        if (!r.ok)
+            continue;
+        const m = GITHUB_REMOTE.exec(r.out.trim());
+        if (m)
+            found.add(`${m[1]}/${m[2]}`.toLowerCase());
+        else
+            return undefined;
+    }
+    return found.size === 1 ? [...found][0] : undefined;
+}
+/** The repo `gh` will act on: -R/--repo, then GH_REPO (assigned here or in the environment), then the origin remote. */
+function ghRepo(args, ctx) {
+    const fromFlag = flagValue(args, ['-R', '--repo']);
+    const assigned = ctx.assigns.find((a) => a.startsWith('GH_REPO='))?.slice(8) ?? ctx.env.getenv('GH_REPO');
+    const raw = fromFlag ?? assigned;
+    if (raw) {
+        const m = /^(?:[^/\s]+\/)?([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(raw);
+        return m ? `${m[1]}/${m[2]}`.toLowerCase() : undefined;
+    }
+    return repoOfRemote(ctx, undefined);
+}
+const MERGE_VALUE_FLAGS = new Set(['-R', '--repo', '-b', '--body', '-F', '--body-file', '-t', '--subject', '-A', '--author-email', '--match-head-commit']);
+/** Positionals of `rest`, skipping flags and the values of `valueFlags`. */
+function positionals(rest, valueFlags) {
+    const out = [];
+    for (let i = 0; i < rest.length; i++) {
+        const v = rest[i].value;
+        if (v === '--') {
+            out.push(...lits(rest.slice(i + 1)));
+            break;
+        }
+        if (v.startsWith('-')) {
+            if (valueFlags.has(v))
+                i++;
+            continue;
+        }
+        out.push(v);
+    }
+    return out;
+}
+export function normGhPrMerge(rest, ctx, all = rest) {
+    const [selector] = positionals(rest, MERGE_VALUE_FLAGS);
+    if (!selector)
+        return fail('name the PR by number or URL (gh pr merge <number> --repo owner/repo); the current branch is not a target');
+    const url = /^https?:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/pull\/(\d+)/i.exec(selector);
+    const repo = url ? `${url[1]}/${url[2]}`.toLowerCase() : /^#?\d+$/.test(selector) ? ghRepo(all, ctx) : undefined;
+    const number = url ? url[3] : /^#?(\d+)$/.exec(selector)?.[1];
+    if (!number)
+        return fail('name the PR by number or URL, not by branch');
+    if (!repo)
+        return fail('could not tell which repository (add --repo owner/repo)');
+    return ok('merge', `${repo}#${number}`);
+}
+export function normGhWorkflowRun(rest, ctx, all = rest) {
+    const [workflow] = positionals(rest, new Set(['-R', '--repo', '-r', '--ref', '-f', '--raw-field', '-F', '--field', '--json']));
+    const repo = ghRepo(all, ctx);
+    if (!workflow)
+        return fail('name the workflow (gh workflow run <file or name> --repo owner/repo)');
+    if (!repo)
+        return fail('could not tell which repository (add --repo owner/repo)');
+    return ok('other', `workflow:${repo}:${workflow}`);
+}
+const RELEASE_READ_ONLY = new Set(['list', 'view', 'download', 'verify', 'verify-asset']);
+export const releaseIsReadOnly = (sub) => sub !== undefined && RELEASE_READ_ONLY.has(sub);
+export function normGhRelease(rest, ctx, all = rest) {
+    const [tag] = positionals(rest, new Set(['-R', '--repo', '-t', '--title', '-n', '--notes', '-F', '--notes-file', '--target', '--discussion-category', '--notes-start-tag']));
+    const repo = ghRepo(all, ctx);
+    if (!tag)
+        return fail('name the release tag (gh release <create|edit|delete|upload> <tag> --repo owner/repo)');
+    if (!repo)
+        return fail('could not tell which repository (add --repo owner/repo)');
+    return ok('publish', `release:${repo}@${tag}`);
+}
+// ---- GitHub API ----
+export function normApi(text) {
+    const targets = new Set();
+    const clean = text.replace(/\u0001/g, '\u0001');
+    if (clean.includes('\u0001') && /merge|refs|graphql/i.test(clean)) {
+        // A placeholder inside the endpoint (e.g. pulls/$N/merge) means the target is decided at run time.
+        if (/\/pulls\/[^\/\s]*\u0001[^\/\s]*\/merge|repos\/[^\s]*\u0001/i.test(clean))
+            return fail('the API endpoint contains a variable; write it out literally');
+    }
+    // Every target goes through the same canonicalTarget as an approval's: exact PR digits, lower-cased repo, and a
+    // number it cannot name (0, or more than 9 digits) becomes 'unknown', which refuses the call.
+    const addAll = (re, build) => {
+        for (const m of clean.matchAll(re)) {
+            const raw = build(m);
+            let canonical;
+            try {
+                canonical = raw === undefined ? undefined : canonicalTarget('merge', raw);
+            }
+            catch {
+                canonical = undefined;
+            }
+            targets.add(canonical ?? 'unknown');
+        }
+    };
+    addAll(/repos\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/pulls\/(\d+)\/merge\b/gi, (m) => `${m[1]}/${m[2]}#${m[3]}`);
+    addAll(/repos\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/git\/refs\/heads\/(main|master)\b/gi, (m) => `${m[1]}/${m[2]}`.toLowerCase() + `@${m[3].toLowerCase()}`);
+    addAll(/repos\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/merges\b/gi, (m) => {
+        const base = /(?:^|\n)(?:base=|"base"\s*:\s*")([A-Za-z0-9_./-]+)/.exec(clean)?.[1];
+        return base ? `${m[1]}/${m[2]}`.toLowerCase() + `@${base}` : undefined;
+    });
+    const merged = /\/pulls\/[^\/\s]*\/merge\b|\/merges\b|\/git\/refs\/(heads\/)?(main|master)\b/i.test(clean);
+    const graphql = /\bmergePullRequest\b|\benablePullRequestAutoMerge\b|\bmergeBranch\b|\bupdateRef\b|\bcreateCommitOnBranch\b/i.test(clean);
+    if (graphql)
+        return fail('GraphQL merges and ref writes cannot be tied to a target; use `gh pr merge <number> --repo owner/repo`');
+    if (!merged || targets.size !== 1 || targets.has('unknown'))
+        return fail('could not tie the API call to a single repository and PR or branch');
+    const [t] = [...targets];
+    return ok('merge', t);
+}
+// ---- package publish / deploy ----
+function readJson(ctx, rel) {
+    if (ctx.cwdUnknown)
+        return undefined;
+    const dirs = new Set();
+    for (const dir of ctx.cwds) {
+        const r = ctx.env.readFile(path.resolve(dir, rel));
+        if (r.state !== 'text')
+            continue;
+        try {
+            dirs.add(r.text);
+        }
+        catch { /* skip */ }
+    }
+    if (dirs.size !== 1)
+        return undefined;
+    try {
+        return JSON.parse([...dirs][0]);
+    }
+    catch {
+        return undefined;
+    }
+}
+function readText(ctx, rel) {
+    if (ctx.cwdUnknown)
+        return undefined;
+    const found = new Set();
+    for (const dir of ctx.cwds) {
+        const r = ctx.env.readFile(path.resolve(dir, rel));
+        if (r.state === 'text')
+            found.add(r.text);
+    }
+    return found.size === 1 ? [...found][0] : undefined;
+}
+const PUBLISH_VALUE_FLAGS = new Set(['--tag', '--access', '--otp', '--registry', '--prefix', '--userconfig', '--cache', '--provenance-file', '--auth-type', '--tolerate-republish', '--gzip-level']);
+export function normPublish(prog, rest, ctx) {
+    const flags = lits(rest);
+    if (flags.some((f) => /^(-w|--workspace(=.*)?|-ws|--workspaces|--recursive|-r|--filter(=.*)?)$/.test(f))) {
+        return fail('publishing several workspaces at once cannot be tied to one target; publish one package directory at a time');
+    }
+    const pos = positionals(rest, PUBLISH_VALUE_FLAGS);
+    if (pos.length > 1)
+        return fail('give at most one package directory');
+    const arg = pos[0];
+    if (arg && /\.(tgz|tar\.gz)$/i.test(arg))
+        return fail('publishing a tarball cannot be tied to a package; publish from the package directory');
+    const dir = arg && !/^(\w+:|[^./~][^/]*\/[^/]*@)/.test(arg) ? arg : undefined;
+    const pkg = readJson(ctx, path.join(dir ?? '.', 'package.json'));
+    if (!pkg)
+        return fail(`could not read ${prog}'s package.json (name and version) to name the target`);
+    if (typeof pkg.name !== 'string' || typeof pkg.version !== 'string')
+        return fail('package.json has no name and version');
+    return ok('publish', `npm:${pkg.name}@${pkg.version}`);
+}
+export function normChangeset(ctx) {
+    const pkg = readJson(ctx, 'package.json');
+    if (!pkg || typeof pkg.name !== 'string')
+        return fail('could not read the root package.json to name `changeset publish` (it publishes every pending package)');
+    return ok('publish', `changeset:${pkg.name}`);
+}
+export function normScript(prog, script, ctx) {
+    const pkg = readJson(ctx, 'package.json');
+    if (!pkg || typeof pkg.name !== 'string')
+        return fail('could not read package.json to name the script');
+    const verb = /^deploy/i.test(script) ? 'deploy' : 'publish';
+    return ok(verb, `script:${pkg.name}:${script}`);
+}
+function configName(ctx, configFlag) {
+    const toml = readText(ctx, configFlag ?? 'wrangler.toml');
+    if (toml !== undefined)
+        return /^name\s*=\s*"([^"]+)"/m.exec(toml)?.[1];
+    for (const file of configFlag ? [] : ['wrangler.jsonc', 'wrangler.json']) {
+        const text = readText(ctx, file);
+        if (text !== undefined)
+            return /"name"\s*:\s*"([^"]+)"/.exec(text)?.[1];
+    }
+    return undefined;
+}
+export function normWrangler(rest, ctx) {
+    const pos = positionals(rest, new Set(['-n', '--name', '-e', '--env', '-c', '--config', '--project-name', '--branch', '--commit-hash', '--commit-message', '--compatibility-date', '--message', '--tag']));
+    if (pos[0] === 'pages') {
+        const project = flagValue(rest, ['--project-name']);
+        return project ? ok('deploy', `pages:${project}`) : fail('name the Pages project (--project-name)');
+    }
+    const name = flagValue(rest, ['-n', '--name']) ?? configName(ctx, flagValue(rest, ['-c', '--config']));
+    const env = flagValue(rest, ['-e', '--env']);
+    if (!name)
+        return fail('could not tell which worker (add --name or run from a directory with a wrangler config that has a name)');
+    return ok('deploy', `wrangler:${name}${env ? `:${env}` : ''}`);
+}
+export function normPhala(rest) {
+    const name = flagValue(rest, ['-n', '--name']) ?? flagValue(rest, ['--cvm-id', '--uuid']);
+    return name ? ok('deploy', `phala:${name}`) : fail('name the CVM (phala deploy --name <name>)');
+}
+export function normSecrets(rest) {
+    const words = lits(rest);
+    return ok('other', `secrets:${words.join(' ')}`);
+}
+// ---- git push ----
+export function normPush(remote, branches, ctx) {
+    const repo = repoOfRemote(ctx, remote);
+    if (!repo)
+        return fail('could not tell which GitHub repository the push goes to');
+    const names = new Set(branches.map((b) => (/^(main|master)$/i.test(b) ? b.toLowerCase() : b)));
+    if (names.size !== 1)
+        return fail('a push to several branches cannot be tied to one target');
+    return ok('merge', `${repo}@${[...names][0]}`);
+}
+//# sourceMappingURL=normalize.js.map

package/dist/guard/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/guard/normalize.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAa,MAAM,aAAa,CAAC;AAczD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC;AAC1C,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAExD,SAAS,EAAE,CAAC,IAAU,EAAE,MAAc;IACpC,IAAI,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;AAC3I,CAAC;AAED,kFAAkF;AAClF,SAAS,SAAS,CAAC,IAAY,EAAE,KAAe;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC;YACvC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,aAAa,GAAG,oEAAoE,CAAC;AAE3F,2GAA2G;AAC3G,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,MAA0B;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,IAAI,MAAM;QAAE,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7D,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,SAAS;QACpB,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;;YAC7C,OAAO,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,wHAAwH;AACxH,SAAS,MAAM,CAAC,IAAY,EAAE,GAAY;IACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,QAAQ,IAAI,QAAQ,CAAC;IACjC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,CAAC,GAAG,sDAAsD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IACD,OAAO,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAE3J,4EAA4E;AAC5E,SAAS,WAAW,CAAC,IAAY,EAAE,UAAuB;IACxD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;QAChE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAY,EAAE,MAAc,IAAI;IAC1E,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,2GAA2G,CAAC,CAAC;IACxI,MAAM,GAAG,GAAG,6EAA6E,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzG,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAClF,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,GAAY,EAAE,MAAc,IAAI;IAC9E,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/H,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACnG,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAClF,OAAO,EAAE,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAuB,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE9G,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAY,EAAE,MAAc,IAAI;IAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAC7K,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,uFAAuF,CAAC,CAAC;IAC/G,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAClF,OAAO,EAAE,CAAC,SAAS,EAAE,WAAW,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,uBAAuB;AAEvB,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,mGAAmG;QACnG,IAAI,6DAA6D,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC7J,CAAC;IACD,gHAAgH;IAChH,8FAA8F;IAC9F,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,KAAiD,EAAE,EAAE;QAC/E,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,SAA6B,CAAC;YAClC,IAAI,CAAC;gBAAC,SAAS,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS,GAAG,SAAS,CAAC;YAAC,CAAC;YACnH,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,CAAC,sEAAsE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjH,MAAM,CAAC,kFAAkF,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9J,MAAM,CAAC,yDAAyD,EAAE,CAAC,CAAC,EAAE,EAAE;QACtE,MAAM,IAAI,GAAG,oDAAoD,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,+EAA+E,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,6GAA6G,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1I,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,wGAAwG,CAAC,CAAC;IACnI,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,oEAAoE,CAAC,CAAC;IAC/I,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,qCAAqC;AAErC,SAAS,QAAQ,CAAC,GAAY,EAAE,GAAW;IACzC,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;YAAE,SAAS;QACjC,IAAI,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AACtE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY,EAAE,GAAW;IACzC,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,mBAAmB,EAAE,aAAa,EAAE,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC;AAErM,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,GAAY;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yEAAyE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,OAAO,IAAI,CAAC,6GAA6G,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,sFAAsF,CAAC,CAAC;IAC9I,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,kBAAkB,IAAI,uDAAuD,CAAC,CAAC;IACrG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACzH,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,uGAAuG,CAAC,CAAC;IAC/J,OAAO,EAAE,CAAC,SAAS,EAAE,aAAa,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAc,EAAE,GAAY;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACxG,MAAM,IAAI,GAAS,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,UAA8B;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,IAAI,eAAe,CAAC,CAAC;IAC1D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,GAAY;IACrD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3M,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,yGAAyG,CAAC,CAAC;IAClI,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1F,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,qBAAqB;AAErB,MAAM,UAAU,QAAQ,CAAC,MAA0B,EAAE,QAAkB,EAAE,GAAY;IACnF,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC7F,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC"}