@yadsh/dsh-qa-surface 0.6.1 → 0.7.0

package/lib/access/service.js

@@ -0,0 +1,380 @@
+import { createHash } from "node:crypto";
+import { QaAccountsError } from "../accounts/store.js";
+import { QaAgentToolGrants as Grants } from "../enforcement/tool-grants.js";
+import { enabledSubroles, normalizeCapabilityConfig, normalizeUserAccess, resolveCapabilityPolicy, resolveSkillAccess, } from "./model.js";
+import { QaCapabilityCatalog, withMissingCapabilities, } from "./capability-catalog.js";
+import { QaRoleRepository } from "./role-repository.js";
+/** Attempts recorded per session before the oldest ones are dropped. */
+const MAX_SKILL_ACTIVATIONS = 100;
+function configuredCapabilities(config) {
+    return {
+        tools: [
+            ...new Set([
+                ...config.common.tools.always,
+                ...config.common.tools.skillGrantable,
+                ...config.subroles.flatMap(({ capabilities }) => [
+                    ...capabilities.tools.always,
+                    ...capabilities.tools.skillGrantable,
+                ]),
+            ]),
+        ],
+        skills: [
+            ...new Set([
+                ...config.common.skills,
+                ...config.subroles.flatMap(({ capabilities }) => capabilities.skills),
+            ]),
+        ],
+    };
+}
+/**
+ * Opaque revision of everything that shaped one policy.
+ *
+ * A session records it next to its snapshot so a later review can tell whether
+ * a conversation ran under the policy that is in force now.
+ */
+function policyRevision(config, metadata, tools) {
+    return createHash("sha1")
+        .update(JSON.stringify([
+        config,
+        [...metadata]
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([name, descriptor]) => [
+            name,
+            descriptor.audience,
+            descriptor.requiredTools,
+            descriptor.requireAll,
+        ]),
+        [...tools].sort(),
+    ]))
+        .digest("hex")
+        .slice(0, 16);
+}
+function requireExactAssignment(input, config) {
+    const enabled = new Set(enabledSubroles(config).map(({ id }) => id));
+    const allowed = [...new Set(input.allowedSubroles)];
+    if (allowed.length === 0 ||
+        allowed.some((id) => !enabled.has(id)) ||
+        !allowed.includes(input.defaultSubrole)) {
+        throw new TypeError("assignment must name enabled roles and select one of them as default");
+    }
+    return Object.freeze({
+        allowedSubroles: Object.freeze(allowed),
+        defaultSubrole: input.defaultSubrole,
+    });
+}
+function freezePolicy(policy) {
+    return Object.freeze({
+        subroleId: policy.subroleId,
+        tools: Object.freeze([...policy.tools]),
+        grantableTools: Object.freeze([...policy.grantableTools]),
+        skills: Object.freeze([...policy.skills]),
+        userSkills: Object.freeze([...policy.userSkills]),
+        sources: Object.freeze({
+            systemTools: Object.freeze([...policy.sources.systemTools]),
+            commonTools: Object.freeze([...policy.sources.commonTools]),
+            roleTools: Object.freeze([...policy.sources.roleTools]),
+            commonGrantableTools: Object.freeze([
+                ...policy.sources.commonGrantableTools,
+            ]),
+            roleGrantableTools: Object.freeze([...policy.sources.roleGrantableTools]),
+            systemSkills: Object.freeze([...policy.sources.systemSkills]),
+            commonSkills: Object.freeze([...policy.sources.commonSkills]),
+            roleSkills: Object.freeze([...policy.sources.roleSkills]),
+            declaredSkills: Object.freeze([...policy.sources.declaredSkills]),
+        }),
+        missingTools: Object.freeze([...policy.missingTools]),
+        missingSkills: Object.freeze([...policy.missingSkills]),
+        policyRevision: policy.policyRevision,
+    });
+}
+function retainInstalledSnapshot(stored, catalog) {
+    const tool = (values) => values.filter((id) => catalog.toolIds.has(id));
+    const modelSkill = (values) => values.filter((id) => catalog.skillIds.has(id));
+    const anySkill = (values) => values.filter((id) => catalog.userSkillIds.has(id));
+    return freezePolicy({
+        subroleId: stored.subroleId,
+        tools: tool(stored.tools),
+        grantableTools: tool(stored.grantableTools),
+        skills: modelSkill(stored.skills),
+        userSkills: anySkill(stored.userSkills),
+        sources: {
+            systemTools: tool(stored.sources.systemTools),
+            commonTools: tool(stored.sources.commonTools),
+            roleTools: tool(stored.sources.roleTools),
+            commonGrantableTools: tool(stored.sources.commonGrantableTools),
+            roleGrantableTools: tool(stored.sources.roleGrantableTools),
+            systemSkills: modelSkill(stored.sources.systemSkills),
+            commonSkills: modelSkill(stored.sources.commonSkills),
+            roleSkills: modelSkill(stored.sources.roleSkills),
+            declaredSkills: modelSkill(stored.sources.declaredSkills),
+        },
+        missingTools: [
+            ...new Set([
+                ...stored.missingTools,
+                ...[...stored.tools, ...stored.grantableTools].filter((id) => !catalog.toolIds.has(id)),
+            ]),
+        ],
+        missingSkills: [
+            ...new Set([
+                ...stored.missingSkills,
+                ...stored.skills.filter((id) => !catalog.skillIds.has(id)),
+            ]),
+        ],
+        policyRevision: stored.policyRevision,
+    });
+}
+/** Server-only orchestration of roles, assignments, discovery and snapshots. */
+export class QaAccessService {
+    options;
+    roles;
+    catalog;
+    constructor(ctx, options) {
+        this.options = options;
+        this.roles = options.repository ?? new QaRoleRepository();
+        this.catalog = new QaCapabilityCatalog(ctx, options.dynamicToolNames ?? (() => []), () => this.roles.snapshot().subroles.map(({ id }) => id));
+    }
+    current(token) {
+        const accounts = this.requireAccounts();
+        const user = accounts.currentUser(token);
+        const config = this.roles.snapshot();
+        const access = normalizeUserAccess(accounts.accessOf(user.id), config);
+        const allowed = new Set(access.allowedSubroles);
+        return Object.freeze({
+            subroles: Object.freeze(config.subroles.filter(({ id, enabled }) => enabled && allowed.has(id))),
+            defaultSubrole: access.defaultSubrole,
+        });
+    }
+    session(token, sessionId) {
+        const accounts = this.requireAccounts();
+        const owner = accounts.ensureSessionAccess(token, sessionId);
+        const record = accounts.sessionAccess(sessionId);
+        const config = this.roles.snapshot();
+        const access = normalizeUserAccess(accounts.accessOf(owner.id), config);
+        const subroleId = record?.subroleId ?? access.defaultSubrole;
+        if (record?.subroleId === undefined) {
+            accounts.updateSessionAccess(sessionId, { subroleId });
+        }
+        const role = config.subroles.find(({ id }) => id === subroleId) ??
+            {
+                id: subroleId,
+                name: subroleId,
+                description: "Снимок удалённой саброли",
+                enabled: false,
+                capabilities: {
+                    tools: { always: [], skillGrantable: [] },
+                    skills: [],
+                },
+            };
+        return Object.freeze({
+            subrole: role,
+            adminPreview: record?.adminPreview === true,
+        });
+    }
+    reserveSession(token, sessionId, requestedSubrole, adminPreview) {
+        const accounts = this.requireAccounts();
+        const user = accounts.currentUser(token);
+        const config = this.roles.snapshot();
+        const assignment = normalizeUserAccess(accounts.accessOf(user.id), config);
+        const selected = requestedSubrole ?? assignment.defaultSubrole;
+        const role = config.subroles.find(({ id, enabled }) => id === selected && enabled);
+        if (role === undefined)
+            throw new TypeError("QA subrole is unavailable");
+        if (adminPreview) {
+            if (user.role !== "admin") {
+                throw new QaAccountsError("admin-required", "previewing a QA subrole requires an admin account");
+            }
+        }
+        else if (!assignment.allowedSubroles.includes(selected)) {
+            throw new QaAccountsError("invalid-role", "this QA subrole is not assigned to the account");
+        }
+        return accounts.reserveSession(token, sessionId, {
+            subroleId: selected,
+            ...(adminPreview ? { adminPreview: true } : {}),
+        });
+    }
+    async policyForSession(token, sessionId, agent) {
+        const accounts = this.options.accounts();
+        if (accounts === undefined)
+            return undefined;
+        const owner = accounts.ensureSessionAccess(token, sessionId);
+        let record = accounts.sessionAccess(sessionId);
+        const config = this.roles.snapshot();
+        const assignment = normalizeUserAccess(accounts.accessOf(owner.id), config);
+        const subroleId = record?.subroleId ?? assignment.defaultSubrole;
+        if (record?.subroleId === undefined) {
+            record = accounts.updateSessionAccess(sessionId, { subroleId });
+        }
+        const catalog = await this.catalog.snapshot(agent);
+        const policy = record?.capabilitySnapshot === undefined
+            ? resolveCapabilityPolicy({
+                config,
+                subroleId,
+                systemTools: this.systemRequiredTools(),
+                systemSkills: [],
+                available: {
+                    tools: catalog.toolIds,
+                    skills: catalog.skillIds,
+                    userSkills: catalog.userSkillIds,
+                },
+                skillMetadata: catalog.skillMetadata,
+                revision: policyRevision(config, catalog.skillMetadata, catalog.toolIds),
+            })
+            : retainInstalledSnapshot(record.capabilitySnapshot, catalog);
+        if (record?.capabilitySnapshot === undefined) {
+            accounts.updateSessionAccess(sessionId, { capabilitySnapshot: policy });
+            this.options.logger.info("access.policy-snapshotted", {
+                sessionId,
+                subroleId,
+                tools: policy.tools,
+                grantableTools: policy.grantableTools,
+                skills: policy.skills,
+                revision: policy.policyRevision,
+            });
+        }
+        return {
+            policy,
+            skills: catalog.skills,
+            skillMetadata: catalog.skillMetadata,
+            adminPreview: record?.adminPreview === true,
+            createGrants: () => new Grants({
+                agent,
+                baseTools: policy.tools,
+                grantableTools: policy.grantableTools,
+                descriptors: catalog.skillMetadata,
+                logger: this.options.logger,
+                record: (entry) => this.recordSkillActivation(sessionId, entry),
+            }),
+        };
+    }
+    /** Activation history of one session, for review and quality analysis. */
+    skillActivations(token, sessionId) {
+        const { accounts } = this.requireAdmin(token);
+        return accounts.sessionAccess(sessionId)?.skillActivations ?? [];
+    }
+    /** Append one activation attempt; a lost record never fails the session. */
+    recordSkillActivation(sessionId, entry) {
+        const accounts = this.options.accounts();
+        if (accounts === undefined)
+            return;
+        try {
+            accounts.recordSkillActivation(sessionId, entry, MAX_SKILL_ACTIVATIONS);
+        }
+        catch (error) {
+            this.options.logger.warn("access.skill-activation-record-failed", {
+                sessionId,
+                skill: entry.skillName,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    async adminSnapshot(token) {
+        const { accounts } = this.requireAdmin(token);
+        const config = this.roles.snapshot();
+        const catalog = await this.catalog.snapshot();
+        const configured = configuredCapabilities(config);
+        const systemRequired = Object.freeze({
+            tools: Object.freeze({
+                always: Object.freeze(this.systemRequiredTools()),
+                skillGrantable: Object.freeze([]),
+            }),
+            skills: Object.freeze([]),
+        });
+        const rows = withMissingCapabilities(catalog.descriptors, [...systemRequired.tools.always, ...configured.tools], [...systemRequired.skills, ...configured.skills]);
+        const skills = resolveSkillAccess({
+            config,
+            descriptors: catalog.skillMetadata,
+            rows: rows.filter(({ type }) => type === "skill"),
+            installedTools: catalog.toolIds,
+        });
+        return Object.freeze({
+            config,
+            systemRequired,
+            catalog: rows,
+            skills,
+            users: accounts.listAccessUsers((value) => normalizeUserAccess(value, config)),
+            audit: this.roles.audit(),
+        });
+    }
+    /** Replace or clear one skill's administrator overlay. */
+    updateSkillOverride(token, input) {
+        const { actor } = this.requireAdmin(token);
+        return this.roles.updateSkillOverride(actor.id, input);
+    }
+    createSubrole(token, input) {
+        const { actor } = this.requireAdmin(token);
+        return this.roles.create(actor.id, input);
+    }
+    updateSubrole(token, id, input) {
+        const { actor } = this.requireAdmin(token);
+        return this.roles.update(actor.id, id, input);
+    }
+    deleteSubrole(token, id, replacementId) {
+        const { actor, accounts } = this.requireAdmin(token);
+        const before = this.roles.snapshot();
+        const assigned = accounts
+            .listAccessUsers((value) => normalizeUserAccess(value, before))
+            .filter(({ access }) => access.allowedSubroles.includes(id));
+        if (assigned.length > 0) {
+            const replacement = before.subroles.find(({ id: candidate, enabled }) => candidate === replacementId && candidate !== id && enabled);
+            if (replacement === undefined) {
+                throw new TypeError("deleting an assigned subrole requires an enabled replacement");
+            }
+        }
+        this.roles.delete(actor.id, id);
+        const after = this.roles.snapshot();
+        for (const user of assigned) {
+            const allowed = user.access.allowedSubroles.filter((value) => value !== id);
+            if (replacementId !== null && !allowed.includes(replacementId)) {
+                allowed.push(replacementId);
+            }
+            const next = requireExactAssignment({
+                allowedSubroles: allowed,
+                defaultSubrole: user.access.defaultSubrole === id
+                    ? replacementId
+                    : user.access.defaultSubrole,
+            }, after);
+            accounts.setAccess(user.id, next);
+            this.roles.recordAssignment(actor.id, user.id, user.access, next);
+        }
+    }
+    updateCommon(token, input) {
+        const { actor } = this.requireAdmin(token);
+        return this.roles.updateCommon(actor.id, input);
+    }
+    updateAssignment(token, userId, input) {
+        const { actor, accounts } = this.requireAdmin(token);
+        const access = requireExactAssignment(input, this.roles.snapshot());
+        const before = accounts.accessOf(userId);
+        accounts.setAccess(userId, access);
+        this.roles.recordAssignment(actor.id, userId, before, access);
+        return access;
+    }
+    requireAccounts() {
+        const accounts = this.options.accounts();
+        if (accounts === undefined) {
+            throw new Error("QA accounts are required for subrole management");
+        }
+        return accounts;
+    }
+    /** The activation diagnostic is runtime plumbing, not an administrator grant. */
+    systemRequiredTools() {
+        return [
+            ...new Set([
+                ...this.options.config().lockdown.toolPolicy.allow,
+                ...(this.options.dynamicToolNames?.() ?? []).filter((name) => name === "qa_tools_selfcheck"),
+            ]),
+        ];
+    }
+    requireAdmin(token) {
+        const accounts = this.requireAccounts();
+        const actor = accounts.currentUser(token);
+        if (actor.role !== "admin") {
+            throw new QaAccountsError("admin-required", "QA access administration requires an admin account");
+        }
+        return { accounts, actor };
+    }
+}
+export function validateCapabilityConfig(config) {
+    return normalizeCapabilityConfig(config);
+}
+//# sourceMappingURL=service.js.map

package/lib/access/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/access/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,OAAO,EAAE,iBAAiB,IAAI,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAiB5E,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,GAExB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAgBlC,SAAS,sBAAsB,CAAC,MAA0B;IAIxD,OAAO;QACL,KAAK,EAAE;YACL,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC7B,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc;gBACrC,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;oBAC/C,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM;oBAC5B,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc;iBACrC,CAAC;aACH,CAAC;SACH;QACD,MAAM,EAAE;YACN,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM;gBACvB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;aACtE,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,MAA0B,EAC1B,QAAgD,EAChD,KAA0B;IAE1B,OAAO,UAAU,CAAC,MAAM,CAAC;SACtB,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;QACb,MAAM;QACN,CAAC,GAAG,QAAQ,CAAC;aACV,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI;YACJ,UAAU,CAAC,QAAQ;YACnB,UAAU,CAAC,aAAa;YACxB,UAAU,CAAC,UAAU;SACtB,CAAC;QACJ,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE;KAClB,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAmB,EACnB,MAA0B;IAE1B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IACpD,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACvC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,MAAmC;IAEnC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvD,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC;gBAClC,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAoB;aACvC,CAAC;YACF,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YACzE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7D,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7D,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACzD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SAClE,CAAC;QACF,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACvD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAmC,EACnC,OAAkC;IAElC,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAE,EAAE,CACzC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,CAAC,MAAyB,EAAE,EAAE,CAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,CAAC,MAAyB,EAAE,EAAE,CAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QACzB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAC3C,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QACjC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QACvC,OAAO,EAAE;YACP,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;YAC7C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YACzC,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAC/D,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAC3D,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;YACrD,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;YACrD,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YACjD,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;SAC1D;QACD,YAAY,EAAE;YACZ,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,MAAM,CAAC,YAAY;gBACtB,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CACnD,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CACjC;aACF,CAAC;SACH;QACD,aAAa,EAAE;YACb,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,MAAM,CAAC,aAAa;gBACvB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAC3D,CAAC;SACH;QACD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,OAAO,eAAe;IAMP,OAAO;IALjB,KAAK,CAAmB;IACxB,OAAO,CAAsB;IAEtC,YACE,GAAY,EACK,OAMhB;uBANgB,OAAO;QAQxB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,mBAAmB,CACpC,GAAG,EACH,OAAO,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EACtC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CACrB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CACxE;YACD,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,SAAiB;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC;QAC7D,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GACR,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC;YACjD;gBACC,EAAE,EAAE,SAAS;gBACb,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,0BAA0B;gBACvC,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE;oBACZ,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;oBACzC,MAAM,EAAE,EAAE;iBACX;aACmB,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,MAAM,EAAE,YAAY,KAAK,IAAI;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CACZ,KAAa,EACb,SAAiB,EACjB,gBAA+B,EAC/B,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,gBAAgB,IAAI,UAAU,CAAC,cAAc,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAC/B,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAChD,CAAC;QACF,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACzE,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,mDAAmD,CACpD,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE;YAC/C,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,KAAa,EACb,SAAiB,EACjB,KAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,UAAU,CAAC,cAAc,CAAC;QACjE,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,GAAG,QAAQ,CAAC,mBAAmB,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,MAAM,GACV,MAAM,EAAE,kBAAkB,KAAK,SAAS;YACtC,CAAC,CAAC,uBAAuB,CAAC;gBACtB,MAAM;gBACN,SAAS;gBACT,WAAW,EAAE,IAAI,CAAC,mBAAmB,EAAE;gBACvC,YAAY,EAAE,EAAE;gBAChB,SAAS,EAAE;oBACT,KAAK,EAAE,OAAO,CAAC,OAAO;oBACtB,MAAM,EAAE,OAAO,CAAC,QAAQ;oBACxB,UAAU,EAAE,OAAO,CAAC,YAAY;iBACjC;gBACD,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,QAAQ,EAAE,cAAc,CACtB,MAAM,EACN,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,OAAO,CAChB;aACF,CAAC;YACJ,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,MAAM,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC7C,QAAQ,CAAC,mBAAmB,CAAC,SAAS,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBACpD,SAAS;gBACT,SAAS;gBACT,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,cAAc;aAChC,CAAC,CAAC;QACL,CAAC;QACD,OAAO;YACL,MAAM;YACN,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,YAAY,EAAE,MAAM,EAAE,YAAY,KAAK,IAAI;YAC3C,YAAY,EAAE,GAAG,EAAE,CACjB,IAAI,MAAM,CAAC;gBACT,KAAK;gBACL,SAAS,EAAE,MAAM,CAAC,KAAK;gBACvB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,OAAO,CAAC,aAAa;gBAClC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC;aAChE,CAAC;SACL,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,gBAAgB,CACd,KAAa,EACb,SAAiB;QAEjB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,gBAAgB,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,4EAA4E;IACpE,qBAAqB,CAC3B,SAAiB,EACjB,KAA8B;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,IAAI,CAAC;YACH,QAAQ,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;gBAChE,SAAS;gBACT,KAAK,EAAE,KAAK,CAAC,SAAS;gBACtB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,cAAc,GAA0B,MAAM,CAAC,MAAM,CAAC;YAC1D,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACjD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAsB;aACvD,CAAC;YACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAsB;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,uBAAuB,CAClC,OAAO,CAAC,WAAW,EACnB,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,EACrD,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CACjD,CAAC;QACF,MAAM,MAAM,GAA6B,kBAAkB,CAAC;YAC1D,MAAM;YACN,WAAW,EAAE,OAAO,CAAC,aAAa;YAClC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC;YACjD,cAAc,EAAE,OAAO,CAAC,OAAO;SAChC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM;YACN,cAAc;YACd,OAAO,EAAE,IAAI;YACb,MAAM;YACN,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CACnC;YACD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,0DAA0D;IAC1D,mBAAmB,CACjB,KAAa,EACb,KAAgC;QAEhC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,KAAgB;QAC3C,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,EAAU,EAAE,KAAgB;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,EAAU,EAAE,aAA4B;QACnE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,QAAQ;aACtB,eAAe,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;aAC9D,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CACtC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7B,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,EAAE,IAAI,OAAO,CAC7D,CAAC;YACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,SAAS,CACjB,8DAA8D,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAChD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CACxB,CAAC;YACF,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC9B,CAAC;YACD,MAAM,IAAI,GAAG,sBAAsB,CACjC;gBACE,eAAe,EAAE,OAAO;gBACxB,cAAc,EACZ,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,EAAE;oBAC/B,CAAC,CAAE,aAAwB;oBAC3B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc;aACjC,EACD,KAAK,CACN,CAAC;YACF,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,YAAY,CACV,KAAa,EACb,KAA4B;QAE5B,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,gBAAgB,CACd,KAAa,EACb,MAAc,EACd,KAAmB;QAEnB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,eAAe;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,iFAAiF;IACzE,mBAAmB;QACzB,OAAO;YACL,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK;gBAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CACjD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,oBAAoB,CACxC;aACF,CAAC;SACH,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,KAAa;QAIhC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,oDAAoD,CACrD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CACtC,MAA0B;IAE1B,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC"}

package/lib/access/skill-metadata.js

@@ -0,0 +1,234 @@
+/**
+ * DSH skill frontmatter carries unknown keys in `metadata`. Everything this
+ * plugin understands lives under this one key, so a skill file stays a plain
+ * valid Agent Skill outside a QA deployment and no upstream schema is forked.
+ */
+const QA_METADATA_KEY = "qa-surface";
+/** Metadata schema this build reads. Unknown versions stay unassigned. */
+const SUPPORTED_SCHEMA_VERSION = 1;
+const CAPABILITY_ID = /^[a-zA-Z0-9][a-zA-Z0-9._:/-]{0,199}$/u;
+const SUBROLE_ID = /^[a-z0-9][a-z0-9-]{0,63}$/u;
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function strings(value, label, warnings) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value)) {
+        warnings.push(`${label} must be a list of capability ids`);
+        return [];
+    }
+    const result = [];
+    for (const entry of value) {
+        if (typeof entry !== "string" || !CAPABILITY_ID.test(entry.trim())) {
+            warnings.push(`${label} contains an invalid id: ${JSON.stringify(entry)}`);
+            continue;
+        }
+        result.push(entry.trim());
+    }
+    return [...new Set(result)];
+}
+/** The fail-closed descriptor of a skill that declares nothing. */
+export function unassignedSkill(name) {
+    return Object.freeze({
+        name,
+        audience: Object.freeze({ type: "unassigned" }),
+        requiredTools: Object.freeze([]),
+        requireAll: false,
+        lifecycle: "session",
+        schemaVersion: 0,
+        declared: false,
+        warnings: Object.freeze([]),
+    });
+}
+function audience(value, knownSubroles, warnings) {
+    if (value === undefined)
+        return Object.freeze({ type: "unassigned" });
+    if (!isPlainObject(value)) {
+        warnings.push("audience must be an object");
+        return Object.freeze({ type: "unassigned" });
+    }
+    if (value.type === "common") {
+        return Object.freeze({ type: "common" });
+    }
+    if (value.type !== "subroles") {
+        warnings.push(`unsupported audience type: ${JSON.stringify(value.type)}`);
+        return Object.freeze({ type: "unassigned" });
+    }
+    const requested = strings(value.include, "audience.include", warnings);
+    const include = [];
+    for (const id of requested) {
+        if (knownSubroles.has(id)) {
+            include.push(id);
+            continue;
+        }
+        // An unknown role fails closed for itself and never invalidates the skill.
+        warnings.push(`unknown subrole: ${id}`);
+    }
+    if (include.length === 0) {
+        warnings.push("audience lists no known subrole");
+        return Object.freeze({ type: "unassigned" });
+    }
+    return Object.freeze({
+        type: "subroles",
+        include: Object.freeze(include),
+    });
+}
+/**
+ * Read and normalize one skill's `metadata.qa-surface` block.
+ *
+ * The block is advisory input, never an authority: it decides who may see the
+ * skill and which tools the skill needs, while the role ceiling still decides
+ * whether a tool can ever be granted. Malformed input degrades to the
+ * fail-closed default and is reported instead of throwing, because one broken
+ * skill must not take down discovery for the whole deployment.
+ * @param name - the skill name the registry resolved, not the metadata's.
+ * @param metadata - the raw frontmatter `metadata` object, if any.
+ * @param knownSubroles - role ids that currently exist, for typo reporting.
+ * @returns the normalized descriptor with every complaint in `warnings`.
+ */
+export function parseQaSkillMetadata(name, metadata, knownSubroles) {
+    const raw = metadata?.[QA_METADATA_KEY];
+    if (!isPlainObject(raw))
+        return unassignedSkill(name);
+    const warnings = [];
+    const version = raw.version;
+    if (version !== undefined && version !== SUPPORTED_SCHEMA_VERSION) {
+        warnings.push(`unsupported qa-surface metadata version: ${JSON.stringify(version)}`);
+        return Object.freeze({
+            ...unassignedSkill(name),
+            declared: true,
+            warnings: Object.freeze(warnings),
+        });
+    }
+    const declaredAudience = audience(raw.audience, knownSubroles, warnings);
+    const toolsBlock = isPlainObject(raw.tools) ? raw.tools : undefined;
+    if (raw.tools !== undefined && toolsBlock === undefined) {
+        warnings.push("tools must be an object");
+    }
+    const requiredTools = strings(toolsBlock?.requires, "tools.requires", warnings);
+    const grant = isPlainObject(toolsBlock?.grant) ? toolsBlock.grant : undefined;
+    if (toolsBlock?.grant !== undefined && grant === undefined) {
+        warnings.push("tools.grant must be an object");
+    }
+    let requireAll = false;
+    if (grant?.requireAll !== undefined) {
+        if (typeof grant.requireAll === "boolean") {
+            requireAll = grant.requireAll;
+        }
+        else {
+            warnings.push("tools.grant.requireAll must be a boolean");
+        }
+    }
+    if (grant?.lifecycle !== undefined && grant.lifecycle !== "session") {
+        // `turn`/`task` lifecycles are deliberately unsupported in v1: a grant
+        // that expires before the model acts on the instructions is a trap.
+        warnings.push(`unsupported grant lifecycle: ${JSON.stringify(grant.lifecycle)}; using session`);
+    }
+    return Object.freeze({
+        name,
+        audience: declaredAudience,
+        requiredTools: Object.freeze(requiredTools),
+        requireAll,
+        lifecycle: "session",
+        schemaVersion: SUPPORTED_SCHEMA_VERSION,
+        declared: true,
+        warnings: Object.freeze(warnings),
+    });
+}
+/** Validate one administrator overlay row before it reaches the policy file. */
+export function normalizeSkillOverride(value) {
+    const skillName = String(value.skillName ?? "").trim();
+    if (!CAPABILITY_ID.test(skillName)) {
+        throw new TypeError("skill override must name a skill");
+    }
+    const roles = (input, label) => {
+        const result = [
+            ...new Set((input ?? []).map((entry) => String(entry).trim())),
+        ].filter(Boolean);
+        if (result.some((entry) => !SUBROLE_ID.test(entry))) {
+            throw new TypeError(`${label} must contain subrole ids`);
+        }
+        return result;
+    };
+    const add = roles(value.addToSubroles, "addToSubroles");
+    const remove = roles(value.removeFromSubroles, "removeFromSubroles");
+    const disabled = value.disabled === true;
+    const forceCommon = value.forceCommon === true;
+    return Object.freeze({
+        skillName,
+        ...(add.length === 0 ? {} : { addToSubroles: Object.freeze(add) }),
+        ...(remove.length === 0
+            ? {}
+            : { removeFromSubroles: Object.freeze(remove) }),
+        ...(forceCommon ? { forceCommon: true } : {}),
+        ...(disabled ? { disabled: true } : {}),
+    });
+}
+/**
+ * Merge one skill's declared audience with its administrator overlay.
+ *
+ * The declared list is only a default: an administrator may extend it, force
+ * the skill on for every role, or withdraw it. A withdrawal always wins over
+ * an addition, so a contradictory pair of edits can only narrow access.
+ * @param descriptor - normalized metadata of the skill.
+ * @param override - administrator overlay, when one exists.
+ * @param enabledRoles - ids of subroles that are currently enabled.
+ */
+export function resolveSkillVisibility(descriptor, override, enabledRoles) {
+    const declaredTo = descriptor.audience.type === "common"
+        ? [...enabledRoles]
+        : descriptor.audience.type === "subroles"
+            ? descriptor.audience.include.filter((id) => enabledRoles.includes(id))
+            : [];
+    const enabled = new Set(enabledRoles);
+    const addedByAdmin = (override?.addToSubroles ?? []).filter((id) => enabled.has(id));
+    // Reported as given, not only when it takes something away: a withdrawal must
+    // also beat an administrator's own explicit role list, so the caller has to
+    // see it for every role it names.
+    const removedByAdmin = (override?.removeFromSubroles ?? []).filter((id) => enabled.has(id));
+    const disabled = override?.disabled === true;
+    const visible = new Set(declaredTo);
+    if (override?.forceCommon === true) {
+        for (const role of enabledRoles)
+            visible.add(role);
+    }
+    for (const role of addedByAdmin)
+        visible.add(role);
+    for (const role of removedByAdmin)
+        visible.delete(role);
+    if (disabled)
+        visible.clear();
+    const overridden = disabled ||
+        override?.forceCommon === true ||
+        addedByAdmin.some((id) => !declaredTo.includes(id)) ||
+        removedByAdmin.some((id) => declaredTo.includes(id));
+    return Object.freeze({
+        declaredTo: Object.freeze(declaredTo),
+        visibleTo: Object.freeze(enabledRoles.filter((id) => visible.has(id))),
+        addedByAdmin: Object.freeze(addedByAdmin),
+        removedByAdmin: Object.freeze(removedByAdmin),
+        disabled,
+        overridden,
+    });
+}
+/**
+ * Computed health of one skill for the administration table.
+ *
+ * `blocked` and `degraded` differ only in what `requireAll` promises: a strict
+ * skill refuses to activate at all, a best-effort one activates with a warning.
+ * @param descriptor - normalized metadata carrying the requirement list.
+ * @param available - required tools that are installed and grantable for at
+ *   least one role that can see the skill.
+ * @param missing - required tools no visible role could ever grant.
+ * @param visibleTo - roles that currently see the skill.
+ */
+export function skillHealth(descriptor, available, missing, visibleTo) {
+    if (available + missing === 0) {
+        return visibleTo.length === 0 ? "unassigned" : "healthy";
+    }
+    if (missing === 0)
+        return "healthy";
+    return descriptor.requireAll ? "blocked" : "degraded";
+}
+//# sourceMappingURL=skill-metadata.js.map

package/lib/access/skill-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-metadata.js","sourceRoot":"","sources":["../../src/access/skill-metadata.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,0EAA0E;AAC1E,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAC9D,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAEhD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa,EAAE,QAAkB;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;QAC3D,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC5D,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC;QACxD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAsB;QACrD,UAAU,EAAE,KAAK;QACjB,SAAS,EAAE,SAAkB;QAC7B,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAsB;KACjD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CACf,KAAc,EACd,aAAkC,EAClC,QAAkB;IAElB,IAAI,KAAK,KAAK,SAAS;QACrB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IACvE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,UAAmB;QACzB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,QAAuD,EACvD,aAAkC;IAElC,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CACX,4CAA4C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CACtE,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,eAAe,CAAC,IAAI,CAAC;YACxB,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAC3B,UAAU,EAAE,QAAQ,EACpB,gBAAgB,EAChB,QAAQ,CACT,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,UAAU,EAAE,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1C,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,KAAK,EAAE,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,QAAQ,CAAC,IAAI,CACX,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,iBAAiB,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,QAAQ,EAAE,gBAAgB;QAC1B,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QAC3C,UAAU;QACV,SAAS,EAAE,SAAkB;QAC7B,aAAa,EAAE,wBAAwB;QACvC,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CACpC,KAAgC;IAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,KAAoC,EAAE,KAAa,EAAE,EAAE;QACpE,MAAM,MAAM,GAAG;YACb,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAC/D,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS;QACT,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAA6B,EAC7B,QAA+C,EAC/C,YAA+B;IAE/B,MAAM,UAAU,GACd,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;QACnC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU;YACvC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC,CAAC,EAAE,CAAC;IACX,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CACjE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAChB,CAAC;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CACxE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAChB,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC;IAE7C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,QAAQ,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,YAAY;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,YAAY;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,cAAc;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAE9B,MAAM,UAAU,GACd,QAAQ;QACR,QAAQ,EAAE,WAAW,KAAK,IAAI;QAC9B,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnD,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACtE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QAC7C,QAAQ;QACR,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CACzB,UAA6B,EAC7B,SAAiB,EACjB,OAAe,EACf,SAA4B;IAE5B,IAAI,SAAS,GAAG,OAAO,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AACxD,CAAC"}