aec-agent 1.0.0

package/dist/components/sandbox-hub/host/host-sandbox.js

@@ -0,0 +1,508 @@
+import { spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { promises as fs } from "node:fs";
+import * as path from "node:path";
+import { posix } from "node:path";
+import { SandboxError } from "../../../kernel/errors/sandbox-error.js";
+import { agentLayout, AGENTS_DIR, isWithinRoots, resolveLogicalPath, WORKSPACE_ROOT } from "../logical-path.js";
+// ---------------------------------------------------------------------------
+// Host sandbox — a real folder on the server machine, Claude Code-style.
+//
+//   logical /workspace/...  →  <base>/...   (base = <root>/<agentId> for own,
+//                                            <root>/.shared for the shared one)
+//
+// NOT isolated: file operations are confined to the agent's roots (logical checks
+// plus a real-path check after symlinks), but commands run as the server's user
+// with full access to the machine. That is why traits.isolated is false — the
+// approval policy then asks the user before writes and commands.
+// ---------------------------------------------------------------------------
+const SEARCH_MAX_FILE_BYTES = 8 * 1024 * 1024;
+const SEARCH_TIME_BUDGET_MS = 30_000;
+/** Folders search never descends into — huge and never what the model is looking for. */
+const SEARCH_SKIP_DIRS = new Set([".git", "node_modules"]);
+/** Whole-file reads above this fail — readFile hashes the whole file. */
+const MAX_FILE_BYTES = 64 * 1024 * 1024;
+const WINDOWS = process.platform === "win32";
+/** Server variables a command gets besides the ones it asks for — just enough for programs to start. */
+const PASSTHROUGH_ENV = WINDOWS
+    ? ["SystemRoot", "windir", "ComSpec", "PATHEXT", "PATH", "Path", "TEMP", "TMP", "USERPROFILE", "APPDATA", "LOCALAPPDATA", "ProgramFiles", "ProgramData", "NUMBER_OF_PROCESSORS", "PROCESSOR_ARCHITECTURE"]
+    : ["PATH", "HOME", "LANG", "TMPDIR", "USER", "SHELL"];
+const ALL_CAPABILITIES = ["fs.read", "fs.write", "fs.search", "exec", "exec.shell"];
+const sha256 = (data) => createHash("sha256").update(data).digest("hex");
+const byteLength = (text) => Buffer.byteLength(text, "utf8");
+function sliceBytes(text, maxBytes) {
+    const buf = Buffer.from(text, "utf8");
+    return buf.length <= maxBytes ? text : buf.subarray(0, maxBytes).toString("utf8");
+}
+function clamp(value, fallback, max) {
+    if (typeof value !== "number" || !Number.isFinite(value) || value <= 0)
+        return Math.min(fallback, max);
+    return Math.min(Math.floor(value), max);
+}
+function globToRegExp(glob) {
+    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+    return new RegExp(`^${escaped}$`, WINDOWS ? "i" : "");
+}
+function entryType(st) {
+    if (st.isSymbolicLink())
+        return "symlink";
+    if (st.isDirectory())
+        return "directory";
+    if (st.isFile())
+        return "file";
+    return "other";
+}
+/** Host paths compare case-insensitively on Windows. */
+function hostWithin(child, parent) {
+    const c = WINDOWS ? child.toLowerCase() : child;
+    const p = WINDOWS ? parent.toLowerCase() : parent;
+    return c === p || c.startsWith(p.endsWith(path.sep) ? p : p + path.sep);
+}
+function fsError(error, label, sandboxId) {
+    if (error instanceof SandboxError)
+        return error;
+    const code = error?.code;
+    const map = {
+        ENOENT: ["not_found", "does not exist"],
+        ENOTDIR: ["invalid_path", "a parent is not a directory"],
+        EISDIR: ["invalid_path", "is a directory"],
+        ELOOP: ["invalid_path", "too many symlinks"],
+        ENAMETOOLONG: ["invalid_path", "name too long"],
+        EACCES: ["policy_denied", "permission denied"],
+        EPERM: ["policy_denied", "permission denied"],
+        EROFS: ["policy_denied", "read-only file system"],
+        ENOSPC: ["too_large", "no space left on the disk"],
+    };
+    const hit = code ? map[code] : undefined;
+    if (hit)
+        return new SandboxError(`"${label}" ${hit[1]}`, hit[0], sandboxId);
+    const message = error instanceof Error ? error.message : String(error);
+    return new SandboxError(`"${label}": ${message}`, "environment_unavailable", sandboxId);
+}
+/** Kill a command and everything it started. */
+function killTree(child) {
+    if (child.pid === undefined || child.exitCode !== null)
+        return;
+    try {
+        if (WINDOWS)
+            spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { windowsHide: true });
+        else
+            process.kill(-child.pid, "SIGKILL");
+    }
+    catch {
+        child.kill("SIGKILL");
+    }
+}
+export class HostSandbox {
+    id;
+    traits;
+    limits;
+    base;
+    capabilities = new Set(ALL_CAPABILITIES);
+    disposed = false;
+    constructor(id, traits, limits, 
+    /** Host folder that logical /workspace maps to. */
+    base) {
+        this.id = id;
+        this.traits = traits;
+        this.limits = limits;
+        this.base = base;
+    }
+    /** Logical path (already checked against roots) → host path. */
+    toHost(logical) {
+        const rel = posix.relative(WORKSPACE_ROOT, logical);
+        return rel ? path.join(this.base, ...rel.split("/")) : this.base;
+    }
+    async forAgent(agentId) {
+        if (this.disposed)
+            throw new SandboxError(`Sandbox "${this.id}" was disposed`, "environment_unavailable", this.id);
+        const { workingDir, roots } = agentLayout(this.traits.tenancy, agentId);
+        try {
+            await fs.mkdir(this.toHost(workingDir), { recursive: true });
+        }
+        catch (error) {
+            throw fsError(error, workingDir, this.id);
+        }
+        return new HostSandboxView(this, workingDir, roots);
+    }
+    async health() {
+        if (this.disposed)
+            return "unavailable";
+        return fs.stat(this.base).then((st) => (st.isDirectory() ? "ready" : "unavailable"), () => "unavailable");
+    }
+    async removeAgentData(agentId) {
+        await fs.rm(this.toHost(`${AGENTS_DIR}/${agentId}`), { recursive: true, force: true });
+    }
+    async dispose(opts) {
+        this.disposed = true;
+        if (opts?.removeData)
+            await fs.rm(this.base, { recursive: true, force: true });
+    }
+}
+class HostSandboxView {
+    managed;
+    workingDir;
+    roots;
+    id;
+    traits;
+    capabilities;
+    limits;
+    constructor(managed, workingDir, roots) {
+        this.managed = managed;
+        this.workingDir = workingDir;
+        this.roots = roots;
+        this.id = managed.id;
+        this.traits = managed.traits;
+        this.capabilities = managed.capabilities;
+        this.limits = managed.limits;
+    }
+    // ── Guards ──
+    fail(message, code) {
+        throw new SandboxError(message, code, this.id);
+    }
+    begin(capability, opts) {
+        if (this.managed.disposed)
+            this.fail(`Sandbox "${this.id}" was disposed`, "environment_unavailable");
+        if (!this.capabilities.has(capability))
+            this.fail(`This sandbox does not support ${capability}`, "capability_unsupported");
+        if (opts?.signal?.aborted)
+            this.fail("Operation cancelled", "cancelled");
+    }
+    /**
+     * Logical path → { logical, host }. Checked twice: the logical path against the roots,
+     * then the REAL host location (after symlinks, through missing tails) against the
+     * real host folders of those roots.
+     */
+    async resolve(input) {
+        const logical = resolveLogicalPath(input, this.workingDir, this.roots, this.id);
+        const host = this.managed.toHost(logical);
+        const real = await realPathThroughMissing(host);
+        const allowed = await Promise.all(this.roots.map((root) => realPathThroughMissing(this.managed.toHost(root))));
+        if (!allowed.some((root) => hostWithin(real, root))) {
+            this.fail(`"${input}" resolves through a symlink to a location outside the workspace`, "path_escape");
+        }
+        return { logical, host: real };
+    }
+    /** Host path (inside the base) → logical path, for listing and search results. */
+    toLogical(host, fallback) {
+        const rel = path.relative(this.managed.base, host);
+        if (rel.startsWith("..") || path.isAbsolute(rel))
+            return fallback;
+        const logical = rel ? posix.join(WORKSPACE_ROOT, ...rel.split(path.sep)) : WORKSPACE_ROOT;
+        return isWithinRoots(logical, this.roots) ? logical : fallback;
+    }
+    // ── Files ──
+    async readFile(input, opts) {
+        this.begin("fs.read", opts);
+        const { logical, host } = await this.resolve(input);
+        let st;
+        try {
+            st = await fs.stat(host);
+        }
+        catch (error) {
+            throw fsError(error, input, this.id);
+        }
+        if (!st.isFile())
+            this.fail(`"${input}" is a ${entryType(st)}, not a file`, "invalid_path");
+        if (st.size > MAX_FILE_BYTES)
+            this.fail(`"${input}" is ${st.size} bytes — too large to read`, "too_large");
+        const raw = await fs.readFile(host).catch((error) => { throw fsError(error, input, this.id); });
+        const whole = raw.toString("utf8");
+        let content = whole;
+        let truncated = false;
+        if (opts?.startLine !== undefined || opts?.endLine !== undefined) {
+            const lines = content.split("\n");
+            const start = Math.max(1, opts.startLine ?? 1);
+            const end = Math.min(lines.length, opts.endLine ?? lines.length);
+            content = lines.slice(start - 1, end).join("\n");
+            truncated = start > 1 || end < lines.length;
+        }
+        const maxBytes = clamp(opts?.maxBytes, this.limits.maxReadBytes, this.limits.maxReadBytes);
+        if (byteLength(content) > maxBytes) {
+            content = sliceBytes(content, maxBytes);
+            truncated = true;
+        }
+        return { path: logical, content, size: raw.length, truncated, sha256: sha256(raw) };
+    }
+    async writeFile(input, content, opts) {
+        this.begin("fs.write", opts);
+        if (typeof content !== "string")
+            this.fail("Content must be a string", "invalid_argument");
+        const bytes = byteLength(content);
+        if (bytes > this.limits.maxWriteBytes) {
+            this.fail(`Content is ${bytes} bytes (limit ${this.limits.maxWriteBytes})`, "too_large");
+        }
+        const { logical, host } = await this.resolve(input);
+        const existing = await fs.lstat(host).catch(() => null);
+        if (existing && !existing.isFile())
+            this.fail(`"${input}" is a ${entryType(existing)}`, "invalid_path");
+        if (opts?.expectedSha256 !== undefined) {
+            const current = existing ? sha256(await fs.readFile(host)) : null;
+            if (current !== opts.expectedSha256)
+                this.fail(`"${input}" changed since it was read (hash mismatch)`, "conflict");
+        }
+        const parent = path.dirname(host);
+        const parentStat = await fs.stat(parent).catch(() => null);
+        if (!parentStat) {
+            if (opts?.createDirs === false)
+                this.fail(`Directory "${posix.dirname(logical)}" does not exist`, "not_found");
+            await fs.mkdir(parent, { recursive: true }).catch((error) => { throw fsError(error, input, this.id); });
+        }
+        else if (!parentStat.isDirectory()) {
+            this.fail(`"${posix.dirname(logical)}" is not a directory`, "invalid_path");
+        }
+        await fs.writeFile(host, content, "utf8").catch((error) => { throw fsError(error, input, this.id); });
+        return { path: logical, bytes, sha256: sha256(content), created: !existing };
+    }
+    async stat(input, opts) {
+        this.begin("fs.read", opts);
+        const { logical, host } = await this.resolve(input);
+        const st = await fs.stat(host).catch(() => null);
+        if (!st)
+            return null;
+        return { path: logical, type: entryType(st), size: st.isFile() ? st.size : 0, modifiedAt: st.mtimeMs };
+    }
+    async list(input, opts) {
+        this.begin("fs.read", opts);
+        const { logical, host } = await this.resolve(input);
+        const st = await fs.stat(host).catch((error) => { throw fsError(error, input, this.id); });
+        if (!st.isDirectory())
+            this.fail(`"${input}" is not a directory`, "invalid_path");
+        const max = clamp(opts?.maxEntries, this.limits.maxListEntries, this.limits.maxListEntries);
+        const entries = [];
+        let truncated = false;
+        const walk = async (dirHost, dirLogical) => {
+            const children = (await fs.readdir(dirHost, { withFileTypes: true }).catch(() => []))
+                .sort((a, b) => a.name.localeCompare(b.name));
+            for (const child of children) {
+                if (!opts?.includeHidden && child.name.startsWith("."))
+                    continue;
+                if (entries.length >= max) {
+                    truncated = true;
+                    return;
+                }
+                const childHost = path.join(dirHost, child.name);
+                const childLogical = posix.join(dirLogical, child.name);
+                const type = entryType(child);
+                const size = type === "file" ? (await fs.lstat(childHost).catch(() => null))?.size ?? 0 : 0;
+                entries.push({ path: childLogical, name: child.name, type, size });
+                // Symlinks are listed, never followed.
+                if (opts?.recursive && type === "directory")
+                    await walk(childHost, childLogical);
+                if (truncated)
+                    return;
+            }
+        };
+        await walk(host, logical);
+        return { entries, truncated };
+    }
+    async search(query, opts) {
+        this.begin("fs.search", opts);
+        if (typeof query.pattern !== "string" || query.pattern === "")
+            this.fail("Search pattern must be a non-empty string", "invalid_argument");
+        const { logical: baseLogical, host: baseHost } = await this.resolve(query.path ?? this.workingDir);
+        const max = clamp(query.maxMatches, this.limits.maxSearchMatches, this.limits.maxSearchMatches);
+        let matcher;
+        if (query.literal === false) {
+            let re;
+            try {
+                re = new RegExp(query.pattern, query.caseSensitive === false ? "i" : "");
+            }
+            catch (error) {
+                this.fail(`Invalid regular expression: ${error instanceof Error ? error.message : String(error)}`, "invalid_argument");
+            }
+            matcher = (line) => re.test(line);
+        }
+        else {
+            const needle = query.caseSensitive === false ? query.pattern.toLowerCase() : query.pattern;
+            matcher = (line) => (query.caseSensitive === false ? line.toLowerCase() : line).includes(needle);
+        }
+        const nameFilter = query.glob ? globToRegExp(query.glob) : null;
+        const deadline = Date.now() + SEARCH_TIME_BUDGET_MS;
+        const matches = [];
+        const scanFile = async (fileHost, fileLogical) => {
+            if (nameFilter && !nameFilter.test(path.basename(fileHost)))
+                return false;
+            const st = await fs.stat(fileHost).catch(() => null);
+            if (!st || !st.isFile() || st.size > SEARCH_MAX_FILE_BYTES)
+                return false;
+            const raw = await fs.readFile(fileHost).catch(() => null);
+            if (!raw || raw.includes(0))
+                return false; // unreadable or binary
+            const lines = raw.toString("utf8").split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                if (!matcher(lines[i]))
+                    continue;
+                if (matches.length >= max)
+                    return true;
+                matches.push({ path: fileLogical, line: i + 1, text: lines[i] });
+            }
+            return false;
+        };
+        const walk = async (dirHost, dirLogical) => {
+            const children = (await fs.readdir(dirHost, { withFileTypes: true }).catch(() => []))
+                .sort((a, b) => a.name.localeCompare(b.name));
+            for (const child of children) {
+                if (opts?.signal?.aborted)
+                    this.fail("Operation cancelled", "cancelled");
+                if (Date.now() > deadline)
+                    return true;
+                const childHost = path.join(dirHost, child.name);
+                const childLogical = posix.join(dirLogical, child.name);
+                // Symlinks are never followed (they could lead outside the roots).
+                if (child.isDirectory()) {
+                    if (!SEARCH_SKIP_DIRS.has(child.name) && (await walk(childHost, childLogical)))
+                        return true;
+                }
+                else if (child.isFile() && (await scanFile(childHost, childLogical))) {
+                    return true;
+                }
+            }
+            return false;
+        };
+        const baseStat = await fs.stat(baseHost).catch((error) => { throw fsError(error, query.path ?? ".", this.id); });
+        const truncated = baseStat.isDirectory()
+            ? await walk(baseHost, baseLogical)
+            : await scanFile(baseHost, this.toLogical(baseHost, baseLogical));
+        return { matches, truncated };
+    }
+    // ── Commands ──
+    async exec(request, opts) {
+        if (this.managed.disposed)
+            this.fail(`Sandbox "${this.id}" was disposed`, "environment_unavailable");
+        if (!this.capabilities.has("exec"))
+            this.fail("This sandbox does not support exec", "capability_unsupported");
+        if (request.shell && !this.capabilities.has("exec.shell"))
+            this.fail("This sandbox does not support shell commands", "capability_unsupported");
+        if (!Array.isArray(request.command) || request.command.length === 0 || typeof request.command[0] !== "string") {
+            this.fail("command must be a non-empty argv array", "invalid_argument");
+        }
+        if (!(request.timeoutMs > 0) || !(request.maxOutputBytes > 0)) {
+            this.fail("timeoutMs and maxOutputBytes must be positive", "invalid_argument");
+        }
+        const { host: cwd } = await this.resolve(request.cwd ?? this.workingDir);
+        const cwdStat = await fs.stat(cwd).catch(() => null);
+        if (!cwdStat)
+            this.fail(`Working directory "${request.cwd}" does not exist`, "not_found");
+        if (!cwdStat.isDirectory())
+            this.fail(`"${request.cwd}" is not a directory`, "invalid_path");
+        const env = {};
+        for (const key of PASSTHROUGH_ENV) {
+            const value = process.env[key];
+            if (value !== undefined)
+                env[key] = value;
+        }
+        Object.assign(env, request.env);
+        const timeoutMs = Math.min(request.timeoutMs, this.limits.maxExecTimeoutMs);
+        const maxOutput = Math.min(request.maxOutputBytes, this.limits.maxExecOutputBytes);
+        const started = Date.now();
+        const result = {
+            exitCode: null, stdout: "", stderr: "", truncated: false, timedOut: false, cancelled: false, durationMs: 0,
+        };
+        const [program, ...args] = request.command;
+        let child;
+        try {
+            child = request.shell
+                ? spawn(request.command.join(" "), { cwd, env, shell: true, windowsHide: true, detached: !WINDOWS })
+                : spawn(program, args, { cwd, env, shell: false, windowsHide: true, detached: !WINDOWS });
+        }
+        catch (error) {
+            this.fail(`Could not start "${program}": ${error instanceof Error ? error.message : String(error)}`, "invalid_argument");
+        }
+        let killed = false;
+        const stop = () => {
+            if (killed)
+                return;
+            killed = true;
+            killTree(child);
+        };
+        const timer = setTimeout(() => {
+            result.timedOut = true;
+            stop();
+        }, timeoutMs);
+        const onAbort = () => {
+            result.cancelled = true;
+            stop();
+        };
+        if (opts?.signal?.aborted)
+            onAbort();
+        else
+            opts?.signal?.addEventListener("abort", onAbort, { once: true });
+        let written = 0;
+        const out = (stream) => (data) => {
+            if (killed)
+                return;
+            const text = data.toString("utf8");
+            const room = maxOutput - written;
+            const piece = byteLength(text) > room ? sliceBytes(text, room) : text;
+            written += byteLength(piece);
+            result[stream] += piece;
+            if (piece)
+                opts?.onOutput?.({ stream, data: piece });
+            if (piece !== text) {
+                result.truncated = true;
+                stop();
+            }
+        };
+        child.stdout?.on("data", out("stdout"));
+        child.stderr?.on("data", out("stderr"));
+        child.stdin?.on("error", () => { });
+        child.stdin?.end(request.stdin ?? "");
+        try {
+            const code = await new Promise((resolve, reject) => {
+                child.once("error", reject);
+                child.once("close", (exitCode) => resolve(exitCode));
+            });
+            if (!killed)
+                result.exitCode = code;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOENT") {
+                // Like a shell: an unknown program is exit 127, not an exception.
+                result.stderr += `${program}: command not found\n`;
+                result.exitCode = 127;
+            }
+            else {
+                this.fail(`Could not start "${program}": ${error instanceof Error ? error.message : String(error)}`, "environment_unavailable");
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            opts?.signal?.removeEventListener("abort", onAbort);
+        }
+        result.durationMs = Date.now() - started;
+        return result;
+    }
+}
+/**
+ * realpath() that also works for paths that do not exist yet: resolve the deepest
+ * existing ancestor, then append the missing tail — so a write through a symlinked
+ * parent is checked where it would really land.
+ */
+async function realPathThroughMissing(target) {
+    const tail = [];
+    let current = path.resolve(target);
+    let hops = 0;
+    for (;;) {
+        try {
+            const real = await fs.realpath(current);
+            return tail.length ? path.join(real, ...tail.reverse()) : real;
+        }
+        catch {
+            // A dangling symlink: follow it to where a write would really land.
+            const link = await fs.lstat(current).catch(() => null);
+            if (link?.isSymbolicLink() && ++hops <= 40) {
+                const to = await fs.readlink(current);
+                current = path.resolve(path.dirname(current), to);
+                continue;
+            }
+            const parent = path.dirname(current);
+            if (parent === current)
+                return path.resolve(target);
+            tail.push(path.basename(current));
+            current = parent;
+        }
+    }
+}
+//# sourceMappingURL=host-sandbox.js.map

package/dist/components/sandbox-hub/host/host-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-sandbox.js","sourceRoot":"","sources":["../../../../src/components/sandbox-hub/host/host-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AAEvE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAwBhH,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,yFAAyF;AACzF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAC3D,yEAAyE;AACzE,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAC7C,wGAAwG;AACxG,MAAM,eAAe,GAAG,OAAO;IAC7B,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,sBAAsB,EAAE,wBAAwB,CAAC;IAC1M,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAExD,MAAM,gBAAgB,GAAwB,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAEzG,MAAM,MAAM,GAAG,CAAC,IAAqB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1F,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAErE,SAAS,UAAU,CAAC,IAAY,EAAE,QAAgB;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,KAAK,CAAC,KAAyB,EAAE,QAAgB,EAAE,GAAW;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACvG,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnG,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,EAAkB;IACnC,IAAI,EAAE,CAAC,cAAc,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO,WAAW,CAAC;IACzC,IAAI,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,MAAM,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wDAAwD;AACxD,SAAS,UAAU,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAChD,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa,EAAE,SAAiB;IAC/D,IAAI,KAAK,YAAY,YAAY;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,IAAI,GAAI,KAA2C,EAAE,IAAI,CAAC;IAChE,MAAM,GAAG,GAA+C;QACtD,MAAM,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC,OAAO,EAAE,CAAC,cAAc,EAAE,6BAA6B,CAAC;QACxD,MAAM,EAAE,CAAC,cAAc,EAAE,gBAAgB,CAAC;QAC1C,KAAK,EAAE,CAAC,cAAc,EAAE,mBAAmB,CAAC;QAC5C,YAAY,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;QAC/C,MAAM,EAAE,CAAC,eAAe,EAAE,mBAAmB,CAAC;QAC9C,KAAK,EAAE,CAAC,eAAe,EAAE,mBAAmB,CAAC;QAC7C,KAAK,EAAE,CAAC,eAAe,EAAE,uBAAuB,CAAC;QACjD,MAAM,EAAE,CAAC,WAAW,EAAE,2BAA2B,CAAC;KACnD,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,IAAI,GAAG;QAAE,OAAO,IAAI,YAAY,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,IAAI,YAAY,CAAC,IAAI,KAAK,MAAM,OAAO,EAAE,EAAE,yBAAyB,EAAE,SAAS,CAAC,CAAC;AAC1F,CAAC;AAED,gDAAgD;AAChD,SAAS,QAAQ,CAAC,KAAmB;IACnC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO;IAC/D,IAAI,CAAC;QACH,IAAI,OAAO;YAAE,SAAS,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;;YAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,WAAW;IAKX,EAAE;IACF,MAAM;IACN,MAAM;IAEN,IAAI;IARN,YAAY,GAAmC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAClF,QAAQ,GAAG,KAAK,CAAC;IAEjB,YACW,EAAU,EACV,MAAqB,EACrB,MAAqB;IAC9B,mDAAmD;IAC1C,IAAY;kBAJZ,EAAE;sBACF,MAAM;sBACN,MAAM;oBAEN,IAAI;IACZ,CAAC;IAEJ,gEAAgE;IAChE,MAAM,CAAC,OAAe;QACpB,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,YAAY,CAAC,YAAY,IAAI,CAAC,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnH,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,aAAa,CAAC;QACxC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAA+B;QAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,EAAE,UAAU;YAAE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;CACF;AAED,MAAM,eAAe;IAOT,OAAO;IACN,UAAU;IACV,KAAK;IARP,EAAE,CAAS;IACX,MAAM,CAAgB;IACtB,YAAY,CAAiC;IAC7C,MAAM,CAAgB;IAE/B,YACU,OAAoB,EACnB,UAAkB,EAClB,KAAwB;uBAFzB,OAAO;0BACN,UAAU;qBACV,KAAK;QAEd,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,eAAe;IAEP,IAAI,CAAC,OAAe,EAAE,IAAsB;QAClD,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,UAA6B,EAAE,IAAgB;QAC3D,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;QACrG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,iCAAiC,UAAU,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAC3H,IAAI,IAAI,EAAE,MAAM,EAAE,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO,CAAC,KAAa;QACjC,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/G,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,kEAAkE,EAAE,aAAa,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,kFAAkF;IAC1E,SAAS,CAAC,IAAY,EAAE,QAAgB;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QAClE,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAC1F,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjE,CAAC;IAED,cAAc;IAEd,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,IAAkB;QAC9C,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,EAAS,CAAC;QACd,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,SAAS,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QAC5F,IAAI,EAAE,CAAC,IAAI,GAAG,cAAc;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC,IAAI,4BAA4B,EAAE,WAAW,CAAC,CAAC;QAC3G,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEnC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,IAAI,EAAE,SAAS,KAAK,SAAS,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,SAAS,GAAG,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3F,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,QAAQ,EAAE,CAAC;YACnC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACxC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,IAAmB;QACjE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,kBAAkB,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,iBAAiB,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,EAAE,WAAW,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QACxG,IAAI,IAAI,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,IAAI,OAAO,KAAK,IAAI,CAAC,cAAc;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,6CAA6C,EAAE,UAAU,CAAC,CAAC;QACrH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,IAAI,EAAE,UAAU,KAAK,KAAK;gBAAE,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;YAC/G,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnH,CAAC;aAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/G,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,IAAgB;QACxC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,IAAkB;QAC1C,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,cAAc,CAAC,CAAC;QAElF,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAe,EAAE,CAAC;QAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAAE,UAAkB,EAAiB,EAAE;YACxE,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;iBAClF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,EAAE,aAAa,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACjE,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;oBAC1B,SAAS,GAAG,IAAI,CAAC;oBACjB,OAAO;gBACT,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,uCAAuC;gBACvC,IAAI,IAAI,EAAE,SAAS,IAAI,IAAI,KAAK,WAAW;oBAAE,MAAM,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;gBACjF,IAAI,SAAS;oBAAE,OAAO;YACxB,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB,EAAE,IAAgB;QAC/C,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,2CAA2C,EAAE,kBAAkB,CAAC,CAAC;QAC1I,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;QACnG,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEhG,IAAI,OAAkC,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5B,IAAI,EAAU,CAAC;YACf,IAAI,CAAC;gBACH,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;YACzH,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3F,OAAO,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC;QAEpD,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAgB,EAAE,WAAmB,EAAoB,EAAE;YACjF,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1E,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,qBAAqB;gBAAE,OAAO,KAAK,CAAC;YACzE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,uBAAuB;YAClE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;oBAAE,SAAS;gBAClC,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAAE,UAAkB,EAAoB,EAAE;YAC3E,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;iBAClF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,IAAI,IAAI,EAAE,MAAM,EAAE,OAAO;oBAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;gBACzE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxD,mEAAmE;gBACnE,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC;gBAC9F,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;oBACvE,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1H,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE;YACtC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;YACnC,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,iBAAiB;IAEjB,KAAK,CAAC,IAAI,CAAC,OAAoB,EAAE,IAAkB;QACjD,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;QACrG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,oCAAoC,EAAE,wBAAwB,CAAC,CAAC;QAC9G,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,8CAA8C,EAAE,wBAAwB,CAAC,CAAC;QAC/I,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC9G,IAAI,CAAC,IAAI,CAAC,wCAAwC,EAAE,kBAAkB,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,+CAA+C,EAAE,kBAAkB,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,GAAG,kBAAkB,EAAE,WAAW,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,sBAAsB,EAAE,cAAc,CAAC,CAAC;QAE7F,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5C,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAe;YACzB,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;SAC3G,CAAC;QAEF,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,OAAgC,CAAC;QACpE,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,KAAK;gBACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;gBACpG,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,oBAAoB,OAAO,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAC3H,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,IAAI,EAAE,CAAC;QACT,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,IAAI,IAAI,EAAE,MAAM,EAAE,OAAO;YAAE,OAAO,EAAE,CAAC;;YAChC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,MAA2B,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,EAAE;YAC5D,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YACxB,IAAI,KAAK;gBAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;gBACxB,IAAI,EAAE,CAAC;YACT,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAChE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,kEAAkE;gBAClE,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,uBAAuB,CAAC;gBACnD,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,oBAAoB,OAAO,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;YAClI,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CAAC,MAAc;IAClD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC3C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACtC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAClC,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/components/sandbox-hub/logical-path.d.ts

@@ -0,0 +1,28 @@
+import type { SandboxTraits } from "./types/sandbox.js";
+export declare const WORKSPACE_ROOT = "/workspace";
+export declare const AGENTS_DIR = "/workspace/agents";
+/** Agent ids become folder names — only plain identifiers are accepted. */
+export declare function assertSafeAgentId(agentId: string): void;
+/**
+ * Default layout for an agent's view of a sandbox:
+ *  - shared tenancy: works in /workspace/agents/<id>, may also use /workspace/shared
+ *    (other agents' folders are off-limits to file operations — accident prevention,
+ *    not a security boundary: exec in a shared container can still reach them)
+ *  - own tenancy: the whole /workspace belongs to the agent
+ */
+export declare function agentLayout(tenancy: SandboxTraits["tenancy"], agentId: string): {
+    workingDir: string;
+    roots: string[];
+};
+export declare function isWithinRoots(path: string, roots: readonly string[]): boolean;
+/**
+ * Validator to make sure tool execute in a right place,
+ * in somecase tool may execute with wrong sandbox path, this validator will help to prevent that
+ * @param input
+ * @param workingDir
+ * @param roots
+ * @param sandboxId
+ * @returns
+ */
+export declare function resolveLogicalPath(input: string, workingDir: string, roots: readonly string[], sandboxId?: string): string;
+//# sourceMappingURL=logical-path.d.ts.map

package/dist/components/sandbox-hub/logical-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logical-path.d.ts","sourceRoot":"","sources":["../../../src/components/sandbox-hub/logical-path.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAcxD,eAAO,MAAM,cAAc,eAAe,CAAC;AAG3C,eAAO,MAAM,UAAU,sBAA6B,CAAC;AAIrD,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAIvD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACd;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAMzC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CA6BR"}

package/dist/components/sandbox-hub/logical-path.js

@@ -0,0 +1,73 @@
+import { posix } from "node:path";
+import { SandboxError } from "../../kernel/errors/sandbox-error.js";
+// ---------------------------------------------------------------------------
+// Logical paths — the POSIX paths tools use inside every sandbox.
+//
+//   /workspace/
+//     shared/              ← every agent of the shared sandbox (collaboration space)
+//     agents/<agentId>/    ← one agent's default working directory
+//
+// Providers resolve every incoming path through resolveLogicalPath() before
+// mapping it to real storage, then re-check the REAL location (after symlinks)
+// with isWithinRoots() — both layers are needed to stop escapes.
+// ---------------------------------------------------------------------------
+export const WORKSPACE_ROOT = "/workspace";
+//will skip it for now, each agent has it own folder is enough
+// export const SHARED_DIR = `${WORKSPACE_ROOT}/shared`;
+export const AGENTS_DIR = `${WORKSPACE_ROOT}/agents`;
+const SAFE_AGENT_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+/** Agent ids become folder names — only plain identifiers are accepted. */
+export function assertSafeAgentId(agentId) {
+    if (!SAFE_AGENT_ID.test(agentId) || agentId.includes("..")) {
+        throw new SandboxError(`Agent id "${agentId}" cannot be used as a sandbox folder name`, "policy_denied");
+    }
+}
+/**
+ * Default layout for an agent's view of a sandbox:
+ *  - shared tenancy: works in /workspace/agents/<id>, may also use /workspace/shared
+ *    (other agents' folders are off-limits to file operations — accident prevention,
+ *    not a security boundary: exec in a shared container can still reach them)
+ *  - own tenancy: the whole /workspace belongs to the agent
+ */
+export function agentLayout(tenancy, agentId) {
+    if (tenancy === "own")
+        return { workingDir: WORKSPACE_ROOT, roots: [WORKSPACE_ROOT] };
+    assertSafeAgentId(agentId);
+    const own = `${AGENTS_DIR}/${agentId}`;
+    // return { workingDir: own, roots: [own, SHARED_DIR] };
+    return { workingDir: own, roots: [own] };
+}
+export function isWithinRoots(path, roots) {
+    return roots.some((root) => path === root || path.startsWith(root === "/" ? "/" : `${root}/`));
+}
+/**
+ * Validator to make sure tool execute in a right place,
+ * in somecase tool may execute with wrong sandbox path, this validator will help to prevent that
+ * @param input
+ * @param workingDir
+ * @param roots
+ * @param sandboxId
+ * @returns
+ */
+export function resolveLogicalPath(input, workingDir, roots, sandboxId) {
+    if (typeof input !== "string") {
+        throw new SandboxError("Path must be a string", "invalid_path", sandboxId);
+    }
+    if (input.includes("\0")) {
+        throw new SandboxError("Path contains a NUL byte", "invalid_path", sandboxId);
+    }
+    // Windows-style separators are normalised so "src\\a.ts" means "src/a.ts".
+    const slashed = input.trim().replace(/\\/g, "/");
+    if (/^[A-Za-z]:(\/|$)/.test(slashed) || slashed.startsWith("//")) {
+        throw new SandboxError(`"${input}" is a host path — use a workspace path like "src/app.ts" or "${WORKSPACE_ROOT}/shared/file"`, "path_escape", sandboxId);
+    }
+    const joined = slashed === "" || slashed === "." ? workingDir : slashed.startsWith("/") ? slashed : posix.join(workingDir, slashed);
+    let normalized = posix.normalize(joined);
+    if (normalized.length > 1 && normalized.endsWith("/"))
+        normalized = normalized.slice(0, -1);
+    if (!isWithinRoots(normalized, roots)) {
+        throw new SandboxError(`"${input}" is outside the workspace this agent may use (${roots.join(", ")})`, "path_escape", sandboxId);
+    }
+    return normalized;
+}
+//# sourceMappingURL=logical-path.js.map