agentic-engineering-harness 0.8.7 → 0.8.9

package/dist/releases/release-1790907061787-15660-749049ca/security/toolActionGate.js

@@ -0,0 +1,503 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { sha256Canonical, sha256Utf8 } from "../core/digest.js";
+import { assertExecutionBlueprintV2, assertResolvedOperationPolicyV1 } from "../architecture/executionIdentity.js";
+import { candidateRevisionsEqual, assertCandidateRevisionV1 } from "../operations/v2Contracts.js";
+import { currentOperationContext, controllerEpochFromEnvironment, currentControllerEpoch, loadOperation, resolveOperationStateRoot, assertCurrentControllerOwner, assertControllerEpoch } from "../operations/state.js";
+import { isCanonicalRole, roleProfile } from "../participants/index.js";
+import { assertExecutionAuthority } from "./executionLease.js";
+import { TOOL_ACTION_KINDS_V1 } from "./actionKinds.js";
+import { HumanDecisionLedgerV2 } from "./humanDecision.js";
+export { TOOL_ACTION_KINDS_V1 } from "./actionKinds.js";
+/** Deterministic actor id of the fenced controller that owns an operation. */
+export function controllerActorId(operationId) {
+    return `controller:${sha256Utf8(operationId).slice(0, 24)}`;
+}
+const ACTION_IMPACTS = {
+    "git.branch.create": "LOCAL_REPOSITORY_MUTATION",
+    "git.commit": "LOCAL_REPOSITORY_MUTATION",
+    "git.push": "EXTERNAL_PUBLICATION",
+    "github.issue.create": "EXTERNAL_NON_IDEMPOTENT",
+    "github.branch.create": "EXTERNAL_RECONCILABLE",
+    "github.pull-request.create": "EXTERNAL_RECONCILABLE",
+    "paseo.workspace.create": "LOCAL_RESOURCE_CREATION"
+};
+/** Stable deterministic classification; callers cannot downgrade an action's impact. */
+export function classifyToolActionImpact(action) {
+    return ACTION_IMPACTS[action];
+}
+/**
+ * Persist one stable intent before a side effect. Repeating the same request
+ * returns its receipt or fails closed while the earlier attempt is unresolved.
+ */
+export async function authorizeToolAction(request) {
+    const operation = await loadOperation(resolveOperationStateRoot(request.root), request.operationId);
+    const files = actionFiles(request.root, request.operationId, request.actionKey);
+    assertControllerEpoch(operation, controllerEpochFromEnvironment(), "tool action authorization");
+    const suppliedEpoch = authorityEpoch(request.authority);
+    if (suppliedEpoch !== currentControllerEpoch(operation))
+        throw new Error(`TOOL_ACTION_CONTROLLER_FENCED: action authority cites epoch ${suppliedEpoch}, but the operation is owned by controller epoch ${currentControllerEpoch(operation)}.`);
+    const prior = await readJson(files.intentFile);
+    if (prior) {
+        assertStoredIntent(prior);
+        if (prior.operationId !== request.operationId || prior.action !== request.action || prior.payloadDigest !== sha256Canonical(request.payload) || !candidateRevisionsEqual(prior.candidate, request.candidate)) {
+            throw new Error("TOOL_ACTION_INTENT_CONFLICT: action key is already bound to a different operation, candidate, action, or effect.");
+        }
+        const policy = currentResolvedPolicy(operation, request);
+        if (operation.status !== "RUNNING" || prior.operationExecutionRevision !== operation.operationExecutionRevision
+            || prior.policyDigest !== policy.digest || prior.controllerEpoch !== currentControllerEpoch(operation)) {
+            throw new Error("TOOL_ACTION_POLICY_STALE: prior action intent does not match the current operation, candidate, policy, execution revision, and epoch.");
+        }
+        const receipt = await readJson(files.receiptFile);
+        if (receipt) {
+            assertStoredReceipt(receipt, prior);
+            if (prior.participantId !== request.participantId || prior.role !== request.role)
+                throw new Error("TOOL_ACTION_ACTOR_MISMATCH: completed action receipt is bound to a different actor.");
+            await assertCurrentActionAuthority(request, prior.impact, operation, policy, false);
+            return { decision: "ALREADY_COMPLETED", intent: prior, receipt };
+        }
+        if (request.authority?.kind !== "controller-authority" || request.role !== undefined || request.participantId !== controllerActorId(request.operationId)) {
+            throw new Error("TOOL_ACTION_RECONCILIATION_AUTHORITY_REQUIRED: unresolved effects may be reconciled only by the current controller owner.");
+        }
+        assertCurrentControllerOwner(operation, "tool action reconciliation");
+        if (operation.status !== "RUNNING" || !operation.candidateRevision || !candidateRevisionsEqual(operation.candidateRevision, prior.candidate)
+            || request.authority.operationId !== operation.id || request.authority.controllerEpoch !== currentControllerEpoch(operation)) {
+            throw new Error("TOOL_ACTION_RECONCILIATION_STALE: controller, operation, and candidate must be current to reconcile an unresolved effect.");
+        }
+        throw new Error("TOOL_ACTION_RECONCILIATION_REQUIRED: a prior intent has no receipt; reconcile its external effect before retrying.");
+    }
+    const orphanReceipt = await readJson(files.receiptFile);
+    if (orphanReceipt)
+        throw new Error("TOOL_ACTION_RECEIPT_ORPHANED: a receipt exists without its ActionIntent; reconcile the durable state before retrying.");
+    const policy = currentResolvedPolicy(operation, request);
+    const identity = createActionIdentity(request, policy);
+    await assertCurrentActionAuthority(request, identity.impact, operation, policy);
+    const intent = {
+        version: 2,
+        intentId: identity.intentId,
+        actionKey: request.actionKey,
+        operationId: request.operationId,
+        participantId: request.participantId,
+        role: request.role,
+        candidate: request.candidate,
+        action: request.action,
+        impact: identity.impact,
+        operationExecutionRevision: identity.operationExecutionRevision,
+        policyDigest: identity.policyDigest,
+        controllerEpoch: identity.controllerEpoch,
+        payloadDigest: identity.payloadDigest,
+        authorityBindingDigest: identity.authorityBindingDigest,
+        requestDigest: identity.requestDigest,
+        createdAt: (request.now ?? new Date()).toISOString()
+    };
+    await fs.mkdir(path.dirname(files.intentFile), { recursive: true });
+    try {
+        await fs.writeFile(files.intentFile, `${JSON.stringify(intent, null, 2)}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        return { decision: "EXECUTE_ONCE", intent };
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        const raced = await readJson(files.intentFile);
+        if (!raced)
+            throw new Error("TOOL_ACTION_INTENT_CORRUPT: concurrent intent could not be read.");
+        assertStoredIntent(raced);
+        if (raced.requestDigest !== identity.requestDigest)
+            throw new Error("TOOL_ACTION_INTENT_CONFLICT: action key was concurrently claimed with a different request.");
+        const receipt = await readJson(files.receiptFile);
+        if (receipt) {
+            assertStoredReceipt(receipt, raced);
+            return { decision: "ALREADY_COMPLETED", intent: raced, receipt };
+        }
+        throw new Error("TOOL_ACTION_RECONCILIATION_REQUIRED: a concurrent attempt claimed this action; reconcile before retrying.");
+    }
+}
+/** Load and validate one persisted ActionIntent without authorizing a new action. */
+export async function loadActionIntent(root, operationId, actionKey) {
+    const files = actionFiles(root, operationId, actionKey);
+    const intent = await readJson(files.intentFile);
+    if (!intent)
+        return undefined;
+    assertStoredIntent(intent);
+    return intent;
+}
+/** Load and validate one persisted ActionReceipt without authorizing a new action. */
+export async function loadActionReceipt(root, operationId, actionKey) {
+    const files = actionFiles(root, operationId, actionKey);
+    const intent = await readJson(files.intentFile);
+    const receipt = await readJson(files.receiptFile);
+    if (!receipt)
+        return undefined;
+    if (!intent)
+        throw new Error("TOOL_ACTION_RECEIPT_CORRUPT: receipt exists without its persisted intent.");
+    assertStoredIntent(intent);
+    assertStoredReceipt(receipt, intent);
+    return receipt;
+}
+/** List current operation intents that have no durable or reconciled receipt. */
+export async function listUnresolvedToolActionIntents(root, operationId) {
+    const operationKey = sha256Utf8(operationId).slice(0, 32);
+    const directory = path.resolve(resolveOperationStateRoot(root), ".harness", "security", "tool-actions", operationKey);
+    let names;
+    try {
+        names = await fs.readdir(directory);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    const unresolved = [];
+    for (const name of names.filter((item) => item.endsWith(".intent.json")).sort()) {
+        const intent = await readJson(path.join(directory, name));
+        if (!intent)
+            throw new Error("TOOL_ACTION_INTENT_CORRUPT: action directory contains an unreadable intent.");
+        assertStoredIntent(intent);
+        if (intent.operationId !== operationId)
+            throw new Error("TOOL_ACTION_INTENT_CORRUPT: action directory contains an intent for another operation.");
+        const receipt = await readJson(path.join(directory, name.replace(/\.intent\.json$/, ".receipt.json")));
+        if (!receipt)
+            unresolved.push(intent);
+        else
+            assertStoredReceipt(receipt, intent);
+    }
+    return unresolved;
+}
+/** Record the deterministic outcome after the caller has attempted the side effect. */
+export async function recordToolActionReceipt(root, intent, outcome, resultEvidence, now = new Date()) {
+    assertStoredIntent(intent);
+    const current = currentOperationContext();
+    if (!current.id || current.id !== intent.operationId)
+        throw new Error("TOOL_ACTION_OPERATION_MISMATCH: a receipt must be recorded inside its matching managed operation context.");
+    const files = actionFiles(root, intent.operationId, intent.actionKey);
+    const operation = await loadOperation(resolveOperationStateRoot(root), intent.operationId);
+    assertCurrentControllerOwner(operation, "tool action receipt");
+    const currentPolicy = operation.resolvedOperationPolicy;
+    if (!currentPolicy)
+        throw new Error("TOOL_ACTION_POLICY_REQUIRED: action receipts require the current frozen ResolvedOperationPolicy.");
+    assertResolvedOperationPolicyV1(currentPolicy);
+    if (currentPolicy.digest !== intent.policyDigest || operation.operationExecutionRevision !== intent.operationExecutionRevision || currentControllerEpoch(operation) !== intent.controllerEpoch || !operation.candidateRevision || !candidateRevisionsEqual(operation.candidateRevision, intent.candidate)) {
+        throw new Error("TOOL_ACTION_POLICY_STALE: action receipt no longer matches the current policy, candidate, execution revision, and epoch.");
+    }
+    const stored = await readJson(files.intentFile);
+    if (!stored)
+        throw new Error("TOOL_ACTION_INTENT_REQUIRED: cannot record a receipt without a persisted intent.");
+    assertStoredIntent(stored);
+    if (stored.intentId !== intent.intentId || stored.requestDigest !== intent.requestDigest)
+        throw new Error("TOOL_ACTION_INTENT_MISMATCH: receipt does not match the persisted intent.");
+    return persistActionReceipt(root, stored, outcome, resultEvidence, now);
+}
+/** Record observation-only reconciliation under a newly current controller epoch. */
+export async function recordReconciledToolActionReceipt(root, intent, outcome, resultEvidence, now = new Date()) {
+    assertStoredIntent(intent);
+    const current = currentOperationContext();
+    if (!current.id || current.id !== intent.operationId)
+        throw new Error("TOOL_ACTION_OPERATION_MISMATCH: reconciliation must run inside its matching managed operation context.");
+    const operation = await loadOperation(resolveOperationStateRoot(root), intent.operationId);
+    assertCurrentControllerOwner(operation, "tool action reconciliation receipt");
+    if (operation.status !== "RUNNING" || !operation.candidateRevision || !candidateRevisionsEqual(operation.candidateRevision, intent.candidate)) {
+        throw new Error("TOOL_ACTION_RECONCILIATION_STALE: action reconciliation requires the active operation's same current candidate.");
+    }
+    if (!operation.resolvedOperationPolicy)
+        throw new Error("TOOL_ACTION_POLICY_REQUIRED: action reconciliation requires the current frozen ResolvedOperationPolicy.");
+    assertResolvedOperationPolicyV1(operation.resolvedOperationPolicy);
+    if (operation.resolvedOperationPolicy.operationId !== operation.id
+        || operation.resolvedOperationPolicy.operationExecutionRevision !== operation.operationExecutionRevision
+        || operation.resolvedOperationPolicy.candidateRevision !== operation.candidateRevision.revision
+        || operation.resolvedOperationPolicy.candidateDigest !== operation.candidateRevision.identityDigest
+        || operation.resolvedOperationPolicy.controllerEpoch !== currentControllerEpoch(operation)
+        || (operation.candidateRevision.projectId && operation.resolvedOperationPolicy.projectId !== operation.candidateRevision.projectId)) {
+        throw new Error("TOOL_ACTION_POLICY_STALE: reconciliation policy does not match the current operation, candidate, execution revision, project, and epoch.");
+    }
+    const files = actionFiles(root, intent.operationId, intent.actionKey);
+    const stored = await readJson(files.intentFile);
+    if (!stored)
+        throw new Error("TOOL_ACTION_INTENT_REQUIRED: cannot reconcile without a persisted ActionIntent.");
+    assertStoredIntent(stored);
+    if (stored.intentId !== intent.intentId || stored.requestDigest !== intent.requestDigest)
+        throw new Error("TOOL_ACTION_INTENT_MISMATCH: reconciliation does not match the persisted intent.");
+    return persistActionReceipt(root, stored, outcome, resultEvidence, now, currentControllerEpoch(operation));
+}
+async function persistActionReceipt(root, stored, outcome, resultEvidence, now, reconciledUnderEpoch) {
+    const resultDigest = sha256Canonical(resultEvidence);
+    const receiptIdentity = {
+        version: 2,
+        intentId: stored.intentId,
+        operationId: stored.operationId,
+        participantId: stored.participantId,
+        candidateDigest: stored.candidate.identityDigest,
+        operationExecutionRevision: stored.operationExecutionRevision,
+        policyDigest: stored.policyDigest,
+        action: stored.action,
+        controllerEpoch: stored.controllerEpoch,
+        ...(reconciledUnderEpoch === undefined ? {} : { reconciledUnderEpoch }),
+        outcome,
+        resultDigest
+    };
+    const receiptDigest = sha256Canonical(receiptIdentity);
+    const receipt = { ...receiptIdentity, receiptId: `action-receipt:${receiptDigest}`, receiptDigest, recordedAt: now.toISOString() };
+    const files = actionFiles(root, stored.operationId, stored.actionKey);
+    try {
+        await fs.writeFile(files.receiptFile, `${JSON.stringify(receipt, null, 2)}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        return receipt;
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        const prior = await readJson(files.receiptFile);
+        if (!prior)
+            throw new Error("TOOL_ACTION_RECEIPT_CORRUPT: existing receipt could not be read.");
+        assertStoredReceipt(prior, stored);
+        if (prior.receiptDigest !== receiptDigest)
+            throw new Error("TOOL_ACTION_RECEIPT_CONFLICT: intent already has a different outcome receipt.");
+        return prior;
+    }
+}
+async function assertCurrentActionAuthority(request, impact, operation, policy, consumeHumanDecision = true) {
+    if (!request.operationId.trim() || !request.participantId.trim() || !request.actionKey.trim())
+        throw new Error("TOOL_ACTION_IDENTITY_REQUIRED: operation, participant, and action key are required.");
+    assertCandidateRevisionV1(request.candidate);
+    if (request.candidate.operationId !== request.operationId)
+        throw new Error("TOOL_ACTION_CANDIDATE_MISMATCH: action candidate belongs to another operation.");
+    const current = currentOperationContext();
+    if (!current.id || current.id !== request.operationId)
+        throw new Error("TOOL_ACTION_OPERATION_MISMATCH: action must run inside its matching managed operation context.");
+    if (operation.status !== "RUNNING")
+        throw new Error(`TOOL_ACTION_OPERATION_NOT_ACTIVE: operation status is ${operation.status}.`);
+    if (!operation.candidateRevision || !candidateRevisionsEqual(operation.candidateRevision, request.candidate))
+        throw new Error("TOOL_ACTION_CANDIDATE_STALE: action is not bound to the current candidate revision.");
+    const operationEpoch = currentControllerEpoch(operation);
+    const evidence = request.authority;
+    if (!evidence || typeof evidence !== "object")
+        throw new Error("TOOL_ACTION_AUTHORITY_REQUIRED: blueprint or execution authority lease is required.");
+    const controllerEvidence = evidence.kind === "controller-authority";
+    if (!controllerEvidence) {
+        if (request.action === "git.branch.create" || request.action === "git.commit")
+            throw new Error(`TOOL_ACTION_CONTROLLER_AUTHORITY_REQUIRED: delivery action '${request.action}' is controller-owned and cannot be authorized by a participant.`);
+        if (!request.role || !isCanonicalRole(request.role))
+            throw new Error(`TOOL_ACTION_ROLE_UNREGISTERED: '${String(request.role)}' is not a canonical role.`);
+        const profile = roleProfile(request.role);
+        const leadBound = operation.lead?.agentId === request.participantId;
+        const participant = operation.participants[request.participantId];
+        if (leadBound) {
+            if (request.role !== "Lead/Director")
+                throw new Error("TOOL_ACTION_ROLE_MISMATCH: bound operation lead must use the Lead/Director role.");
+            if (participant?.role && participant.role !== request.role)
+                throw new Error("TOOL_ACTION_ROLE_MISMATCH: bound lead participant role does not match.");
+        }
+        else if (!participant || participant.role !== request.role) {
+            throw new Error("TOOL_ACTION_PARTICIPANT_UNREGISTERED: participant is not registered with this canonical role.");
+        }
+        if (impact.startsWith("EXTERNAL_"))
+            throw new Error("TOOL_ACTION_CONTROLLER_AUTHORITY_REQUIRED: participant role identity cannot authorize an external effect.");
+        if (evidence.kind === "execution-authority") {
+            assertExecutionAuthority(evidence.authority, request.now ?? new Date());
+            const authority = evidence.authority;
+            if (authority.controllerEpoch !== operationEpoch)
+                throw new Error(`TOOL_ACTION_CONTROLLER_FENCED: execution authority was compiled under controller epoch ${authority.controllerEpoch}, but the operation is owned by controller epoch ${operationEpoch}.`);
+            if (authority.operationId !== request.operationId || authority.participantId !== request.participantId || !candidateRevisionsEqual(authority.candidateRevision, request.candidate) || authority.candidateDigest !== request.candidate.identityDigest) {
+                throw new Error("TOOL_ACTION_AUTHORITY_MISMATCH: execution authority is not bound to the operation, participant, and current candidate.");
+            }
+            if (impact === "LOCAL_REPOSITORY_MUTATION" && (!profile.authority.canWrite || !authority.leases.some((lease) => lease.capability === "write"))) {
+                throw new Error("TOOL_ACTION_CAPABILITY_DENIED: local repository mutation requires the role's write ceiling and a write lease.");
+            }
+            if (impact === "LOCAL_RESOURCE_CREATION" && (!profile.authority.canExecute || !authority.leases.some((lease) => lease.capability === "execute"))) {
+                throw new Error("TOOL_ACTION_CAPABILITY_DENIED: local resource creation requires the role's execute ceiling and an execute lease.");
+            }
+        }
+        else if (evidence.kind === "execution-blueprint") {
+            assertBlueprintBinding(evidence.blueprint, request, operationEpoch);
+            if (evidence.blueprint.resolvedOperationPolicy.digest !== policy.digest)
+                throw new Error("TOOL_ACTION_POLICY_STALE: participant blueprint does not bind the current frozen operation policy.");
+            const assignment = evidence.blueprint.plan.assignments.find((item) => item.participantId === request.participantId);
+            if (impact === "LOCAL_REPOSITORY_MUTATION" && (!profile.authority.canWrite || !hasTool(assignment.toolPack, "repository-write"))) {
+                throw new Error("TOOL_ACTION_CAPABILITY_DENIED: blueprint does not grant this role repository-write authority.");
+            }
+            if (impact === "LOCAL_RESOURCE_CREATION" && (!profile.authority.canExecute || !hasTool(assignment.toolPack, "command-execute"))) {
+                throw new Error("TOOL_ACTION_CAPABILITY_DENIED: blueprint does not grant this role command-execute authority.");
+            }
+        }
+        else {
+            throw new Error("TOOL_ACTION_AUTHORITY_INVALID: unsupported authority evidence kind.");
+        }
+        if (consumeHumanDecision)
+            await consumeRequiredHumanDecision(request, operation, policy, operationEpoch);
+        return;
+    }
+    // Deterministic controller authority: the fenced operation owner may perform
+    // policy-authorized delivery effects and controller-owned local resources.
+    // It is not a participant and never inherits a role ceiling.
+    if (request.role !== undefined)
+        throw new Error("TOOL_ACTION_ROLE_MISMATCH: controller authority must not claim a participant role.");
+    if (request.participantId !== controllerActorId(request.operationId))
+        throw new Error("TOOL_ACTION_CONTROLLER_ACTOR_MISMATCH: controller authority requires the deterministic controller actor id.");
+    if (evidence.operationId !== request.operationId)
+        throw new Error("TOOL_ACTION_CONTROLLER_ACTOR_MISMATCH: controller authority belongs to another operation.");
+    if (evidence.controllerEpoch !== operationEpoch)
+        throw new Error(`TOOL_ACTION_CONTROLLER_FENCED: controller authority cites epoch ${evidence.controllerEpoch}, but the operation is owned by controller epoch ${operationEpoch}.`);
+    assertCurrentControllerOwner(operation, "tool action authorization");
+    if (request.action === "git.branch.create" || request.action === "git.commit") {
+        const deliveryPolicy = policy.deliveryPolicy && typeof policy.deliveryPolicy === "object" && !Array.isArray(policy.deliveryPolicy)
+            ? policy.deliveryPolicy
+            : {};
+        const allowedActions = Array.isArray(deliveryPolicy.allowedActions) ? deliveryPolicy.allowedActions : [];
+        if (!allowedActions.includes(request.action)) {
+            throw new Error(`TOOL_ACTION_POLICY_DENIED: frozen project delivery policy does not authorize local delivery action '${request.action}'.`);
+        }
+    }
+    if (impact.startsWith("EXTERNAL_") && !policy.allowedExternalEffects.includes(request.action)) {
+        throw new Error(`TOOL_ACTION_POLICY_DENIED: frozen policy does not authorize external effect '${request.action}'.`);
+    }
+    if (consumeHumanDecision)
+        await consumeRequiredHumanDecision(request, operation, policy, operationEpoch);
+}
+async function consumeRequiredHumanDecision(request, operation, policy, operationEpoch) {
+    const requirement = policy.humanDecisionRequirements.find((item) => item.kind === "ACTION_AUTHORIZATION" && item.action === request.action);
+    if (requirement) {
+        const ledger = new HumanDecisionLedgerV2(path.resolve(resolveOperationStateRoot(request.root), ".harness", "security", "human-decisions.json"));
+        try {
+            const decision = await ledger.consume({
+                operationId: operation.id,
+                candidate: operation.candidateRevision,
+                operationExecutionRevision: operation.operationExecutionRevision,
+                policyDigest: policy.digest,
+                controllerEpoch: operationEpoch
+            }, { kind: "ACTION_AUTHORIZATION", action: request.action, effectDigest: sha256Canonical(request.payload) }, undefined, request.now ?? new Date());
+            if (decision.kind !== "APPROVE")
+                throw new Error("matching HumanDecision rejects this exact action and effect.");
+        }
+        catch (error) {
+            throw new Error(`TOOL_ACTION_HUMAN_DECISION_REQUIRED: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
+function currentResolvedPolicy(operation, request) {
+    if (!operation.resolvedOperationPolicy)
+        throw new Error("TOOL_ACTION_POLICY_REQUIRED: sensitive actions require a frozen ResolvedOperationPolicy.");
+    assertResolvedOperationPolicyV1(operation.resolvedOperationPolicy);
+    const policy = operation.resolvedOperationPolicy;
+    if (!operation.candidateRevision || !Number.isSafeInteger(operation.operationExecutionRevision)
+        || policy.operationId !== operation.id
+        || policy.operationExecutionRevision !== operation.operationExecutionRevision
+        || policy.candidateRevision !== operation.candidateRevision.revision
+        || policy.candidateDigest !== operation.candidateRevision.identityDigest
+        || policy.controllerEpoch !== currentControllerEpoch(operation)
+        || (operation.candidateRevision.projectId && policy.projectId !== operation.candidateRevision.projectId)
+        || !candidateRevisionsEqual(operation.candidateRevision, request.candidate)) {
+        throw new Error("TOOL_ACTION_POLICY_STALE: frozen policy does not bind the current operation, candidate, execution revision, project, and controller epoch.");
+    }
+    return policy;
+}
+function assertBlueprintBinding(blueprint, request, operationEpoch) {
+    if (!blueprint || !blueprint.candidate)
+        throw new Error("TOOL_ACTION_BLUEPRINT_INVALID: blueprint is missing its current candidate binding.");
+    assertExecutionBlueprintV2(blueprint);
+    if (!Number.isSafeInteger(blueprint.controllerEpoch) || blueprint.controllerEpoch < 0)
+        throw new Error("TOOL_ACTION_BLUEPRINT_INVALID: blueprint has no controller epoch.");
+    if (blueprint.controllerEpoch !== operationEpoch)
+        throw new Error(`TOOL_ACTION_CONTROLLER_FENCED: blueprint was compiled under controller epoch ${blueprint.controllerEpoch}, but the operation is owned by controller epoch ${operationEpoch}.`);
+    if (blueprint.taskId !== request.candidate.taskId || blueprint.candidateRevision !== request.candidate.revision || !candidateRevisionsEqual(blueprint.candidate, request.candidate)) {
+        throw new Error("TOOL_ACTION_BLUEPRINT_STALE: blueprint is not bound to the current candidate and task.");
+    }
+    const assignment = blueprint.plan.assignments.find((item) => item.participantId === request.participantId);
+    if (!assignment || assignment.role !== request.role)
+        throw new Error("TOOL_ACTION_BLUEPRINT_PARTICIPANT_MISMATCH: blueprint has no matching participant-role assignment.");
+}
+function hasTool(pack, tool) {
+    return pack.required.includes(tool) || pack.optional.includes(tool);
+}
+function createActionIdentity(request, policy) {
+    assertCandidateRevisionV1(request.candidate);
+    if (!TOOL_ACTION_KINDS_V1.includes(request.action))
+        throw new Error(`TOOL_ACTION_KIND_INVALID: ${String(request.action)} is not registered.`);
+    const impact = classifyToolActionImpact(request.action);
+    const payloadDigest = sha256Canonical(request.payload);
+    const authorityBindingDigest = authorityDigest(request.authority);
+    const intentId = `action-intent:${sha256Canonical({ operationId: request.operationId, actionKey: request.actionKey })}`;
+    const requestIdentity = {
+        version: 2,
+        intentId,
+        actionKey: request.actionKey,
+        operationId: request.operationId,
+        participantId: request.participantId,
+        role: request.role,
+        candidate: request.candidate,
+        action: request.action,
+        impact,
+        operationExecutionRevision: policy.operationExecutionRevision,
+        policyDigest: policy.digest,
+        controllerEpoch: authorityEpoch(request.authority),
+        payloadDigest,
+        authorityBindingDigest
+    };
+    return { ...requestIdentity, requestDigest: sha256Canonical(requestIdentity) };
+}
+function authorityEpoch(evidence) {
+    if (evidence?.kind === "execution-authority") {
+        const epoch = evidence.authority?.controllerEpoch;
+        if (!Number.isSafeInteger(epoch) || epoch < 0)
+            throw new Error("TOOL_ACTION_AUTHORITY_INVALID: execution authority has no controller epoch.");
+        return epoch;
+    }
+    if (evidence?.kind === "execution-blueprint") {
+        const epoch = evidence.blueprint?.controllerEpoch;
+        if (!Number.isSafeInteger(epoch) || epoch < 0)
+            throw new Error("TOOL_ACTION_BLUEPRINT_INVALID: blueprint has no controller epoch.");
+        return epoch;
+    }
+    if (evidence?.kind === "controller-authority") {
+        const epoch = evidence.controllerEpoch;
+        if (!Number.isSafeInteger(epoch) || epoch < 0)
+            throw new Error("TOOL_ACTION_AUTHORITY_INVALID: controller authority has no controller epoch.");
+        return epoch;
+    }
+    throw new Error("TOOL_ACTION_AUTHORITY_REQUIRED: blueprint or execution authority lease is required.");
+}
+function authorityDigest(evidence) {
+    if (evidence?.kind === "execution-authority") {
+        const authority = evidence.authority;
+        return sha256Canonical({ kind: evidence.kind, version: authority.version, operationId: authority.operationId, participantId: authority.participantId, candidateDigest: authority.candidateDigest, controllerEpoch: authority.controllerEpoch, leases: authority.leases.map((lease) => ({ leaseId: lease.leaseId, capability: lease.capability, expiresAt: lease.expiresAt })).sort((a, b) => a.leaseId.localeCompare(b.leaseId)) });
+    }
+    if (evidence?.kind === "execution-blueprint")
+        return sha256Canonical({ kind: evidence.kind, digest: evidence.blueprint?.digest });
+    if (evidence?.kind === "controller-authority")
+        return sha256Canonical({ kind: evidence.kind, operationId: evidence.operationId, controllerEpoch: evidence.controllerEpoch });
+    throw new Error("TOOL_ACTION_AUTHORITY_REQUIRED: blueprint or execution authority lease is required.");
+}
+function assertStoredIntent(value) {
+    if (!value || value.version !== 2 || !value.intentId || !value.actionKey || !value.operationId || !value.participantId || (value.role !== undefined && !isCanonicalRole(value.role)) || !TOOL_ACTION_KINDS_V1.includes(value.action) || value.impact !== classifyToolActionImpact(value.action) || !Number.isSafeInteger(value.controllerEpoch) || value.controllerEpoch < 0 || !Number.isSafeInteger(value.operationExecutionRevision) || value.operationExecutionRevision < 1 || !/^[a-f0-9]{64}$/.test(value.policyDigest)) {
+        throw new Error("UNSUPPORTED_TOOL_ACTION_INTENT_VERSION: persisted ActionIntent is malformed or requires explicit migration.");
+    }
+    assertCandidateRevisionV1(value.candidate);
+    const { createdAt: _createdAt, requestDigest, ...identity } = value;
+    const expectedIntentId = `action-intent:${sha256Canonical({ operationId: value.operationId, actionKey: value.actionKey })}`;
+    if (requestDigest !== sha256Canonical(identity) || value.intentId !== expectedIntentId || value.candidate.operationId !== value.operationId || !/^[a-f0-9]{64}$/.test(value.payloadDigest) || !/^[a-f0-9]{64}$/.test(value.authorityBindingDigest)) {
+        throw new Error("TOOL_ACTION_INTENT_CORRUPT: persisted ActionIntent identity is inconsistent.");
+    }
+}
+function assertStoredReceipt(value, intent) {
+    if (!value || value.version !== 2 || value.intentId !== intent.intentId || value.operationId !== intent.operationId || value.participantId !== intent.participantId || value.candidateDigest !== intent.candidate.identityDigest || value.operationExecutionRevision !== intent.operationExecutionRevision || value.policyDigest !== intent.policyDigest || value.action !== intent.action || value.controllerEpoch !== intent.controllerEpoch || (value.reconciledUnderEpoch !== undefined && (!Number.isSafeInteger(value.reconciledUnderEpoch) || value.reconciledUnderEpoch < intent.controllerEpoch)) || !["SUCCEEDED", "FAILED", "UNKNOWN"].includes(value.outcome)) {
+        throw new Error("TOOL_ACTION_RECEIPT_CORRUPT: persisted ActionReceipt is malformed or not bound to its ActionIntent.");
+    }
+    const { receiptId: _receiptId, receiptDigest, recordedAt: _recordedAt, ...identity } = value;
+    if (receiptDigest !== sha256Canonical(identity) || value.receiptId !== `action-receipt:${receiptDigest}`)
+        throw new Error("TOOL_ACTION_RECEIPT_CORRUPT: persisted ActionReceipt identity is inconsistent.");
+}
+function actionFiles(root, operationId, actionKey) {
+    const operationKey = sha256Utf8(operationId).slice(0, 32);
+    const actionKeyDigest = sha256Canonical({ operationId, actionKey });
+    const directory = path.resolve(resolveOperationStateRoot(root), ".harness", "security", "tool-actions", operationKey);
+    const base = path.join(directory, `${actionKeyDigest}.json`);
+    return { intentFile: base.replace(/\.json$/, ".intent.json"), receiptFile: base.replace(/\.json$/, ".receipt.json") };
+}
+async function readJson(file) {
+    try {
+        return JSON.parse(await fs.readFile(file, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw new Error(`TOOL_ACTION_STATE_UNREADABLE: ${path.basename(file)}: ${String(error)}`);
+    }
+}
+//# sourceMappingURL=toolActionGate.js.map

package/dist/releases/release-1790907061787-15660-749049ca/security/toolActionGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolActionGate.js","sourceRoot":"","sources":["../../src/security/toolActionGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAAE,0BAA0B,EAAE,+BAA+B,EAAmE,MAAM,sCAAsC,CAAC;AACpL,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAA4B,MAAM,8BAA8B,CAAC;AAC5H,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,aAAa,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,qBAAqB,EAA0B,MAAM,wBAAwB,CAAC;AAChP,OAAO,EAAE,eAAe,EAAE,WAAW,EAAsB,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAA6B,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAyB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAwBxD,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,cAAc,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AA2CD,MAAM,cAAc,GAA2D;IAC7E,mBAAmB,EAAE,2BAA2B;IAChD,YAAY,EAAE,2BAA2B;IACzC,UAAU,EAAE,sBAAsB;IAClC,qBAAqB,EAAE,yBAAyB;IAChD,sBAAsB,EAAE,uBAAuB;IAC/C,4BAA4B,EAAE,uBAAuB;IACrD,wBAAwB,EAAE,yBAAyB;CACpD,CAAC;AAEF,wFAAwF;AACxF,MAAM,UAAU,wBAAwB,CAAC,MAAwB;IAC/D,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA4B;IACpE,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACpG,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAChF,qBAAqB,CAAC,SAAS,EAAE,8BAA8B,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,aAAa,KAAK,sBAAsB,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,aAAa,oDAAoD,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE/O,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiB,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,KAAK,EAAE,CAAC;QACV,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7M,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;QACtI,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,0BAA0B,KAAK,SAAS,CAAC,0BAA0B;eAC1G,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,KAAK,CAAC,uIAAuI,CAAC,CAAC;QAC3J,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAkB,KAAK,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,OAAO,EAAE,CAAC;YACZ,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;YACzL,MAAM,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACpF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,EAAE,IAAI,KAAK,sBAAsB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,KAAK,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACzJ,MAAM,IAAI,KAAK,CAAC,2HAA2H,CAAC,CAAC;QAC/I,CAAC;QACD,4BAA4B,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;QACtE,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC;eACvI,OAAO,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,EAAE,IAAI,OAAO,CAAC,SAAS,CAAC,eAAe,KAAK,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/H,MAAM,IAAI,KAAK,CAAC,2HAA2H,CAAC,CAAC;QAC/I,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oHAAoH,CAAC,CAAC;IACxI,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAkB,KAAK,CAAC,WAAW,CAAC,CAAC;IACzE,IAAI,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,uHAAuH,CAAC,CAAC;IAE5J,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAChF,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,CAAU;QACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B;QAC/D,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KACrD,CAAC;IACF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5H,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiB,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAChG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;QAClK,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAkB,KAAK,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,OAAO,EAAE,CAAC;YACZ,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;IAC/H,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,WAAmB,EAAE,SAAiB;IACzF,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAiB,KAAK,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,WAAmB,EAAE,SAAiB;IAC1F,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAiB,KAAK,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAkB,KAAK,CAAC,WAAW,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC1G,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,IAAY,EAAE,WAAmB;IACrF,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IACtH,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QAAC,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACjG,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAiB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC5G,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;QAClJ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAkB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;QACxH,IAAI,CAAC,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YACjC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAG,IAAY,EAC1D,MAAsB,EACtB,OAA4B,EAC5B,cAAuB,EACvB,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;IACnL,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3F,4BAA4B,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,SAAS,CAAC,uBAAuB,CAAC;IACxD,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IACxI,+BAA+B,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,0BAA0B,KAAK,MAAM,CAAC,0BAA0B,IAAI,sBAAsB,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1S,MAAM,IAAI,KAAK,CAAC,0HAA0H,CAAC,CAAC;IAC9I,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAiB,KAAK,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACjH,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IACvL,OAAO,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,IAAY,EAAE,MAAsB,EAAE,OAA4B,EAAE,cAAuB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACnK,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IAChL,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3F,4BAA4B,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;IAC9E,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9I,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,uBAAuB;QAAE,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IACnK,+BAA+B,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,uBAAuB,CAAC,WAAW,KAAK,SAAS,CAAC,EAAE;WAC7D,SAAS,CAAC,uBAAuB,CAAC,0BAA0B,KAAK,SAAS,CAAC,0BAA0B;WACrG,SAAS,CAAC,uBAAuB,CAAC,iBAAiB,KAAK,SAAS,CAAC,iBAAiB,CAAC,QAAQ;WAC5F,SAAS,CAAC,uBAAuB,CAAC,eAAe,KAAK,SAAS,CAAC,iBAAiB,CAAC,cAAc;WAChG,SAAS,CAAC,uBAAuB,CAAC,eAAe,KAAK,sBAAsB,CAAC,SAAS,CAAC;WACvF,CAAC,SAAS,CAAC,iBAAiB,CAAC,SAAS,IAAI,SAAS,CAAC,uBAAuB,CAAC,SAAS,KAAK,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtI,MAAM,IAAI,KAAK,CAAC,0IAA0I,CAAC,CAAC;IAC9J,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAiB,KAAK,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IAChH,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IAC9L,OAAO,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAsB,EAAE,OAA4B,EAAE,cAAuB,EAAE,GAAS,EAAE,oBAA6B;IACvK,MAAM,YAAY,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG;QACtB,OAAO,EAAE,CAAU;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,eAAe,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;QAChD,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;QAC7D,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;QACvE,OAAO;QACP,YAAY;KACb,CAAC;IACF,MAAM,aAAa,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IACvD,MAAM,OAAO,GAAoB,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,kBAAkB,aAAa,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;IACpJ,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9H,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAkB,KAAK,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAChG,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QAC5I,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,OAA4B,EAAE,MAA0B,EAAE,SAA4B,EAAE,MAAiC,EAAE,oBAAoB,GAAG,IAAI;IAChM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACtM,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,SAAS,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAE7J,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACzK,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAClI,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IAErN,MAAM,cAAc,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;IACnC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACtJ,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,KAAK,sBAAsB,CAAC;IACpE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,MAAM,KAAK,mBAAmB,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,OAAO,CAAC,MAAM,kEAAkE,CAAC,CAAC;QAChP,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC1J,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC;QACpE,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YAC1I,IAAI,WAAW,EAAE,IAAI,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QACxJ,CAAC;aAAM,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;QACjK,IAAI,QAAQ,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC5C,wBAAwB,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;YACxE,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YACrC,IAAI,SAAS,CAAC,eAAe,KAAK,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,0FAA0F,SAAS,CAAC,eAAe,oDAAoD,cAAc,GAAG,CAAC,CAAC;YAC5P,IAAI,SAAS,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,eAAe,KAAK,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;gBACrP,MAAM,IAAI,KAAK,CAAC,wHAAwH,CAAC,CAAC;YAC5I,CAAC;YACD,IAAI,MAAM,KAAK,2BAA2B,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/I,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC,CAAC;YACnI,CAAC;YACD,IAAI,MAAM,KAAK,yBAAyB,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;gBACjJ,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;YACtI,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnD,sBAAsB,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;YACpE,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;YAC/L,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAE,CAAC;YACrH,IAAI,MAAM,KAAK,2BAA2B,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC;gBACjI,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;YACnH,CAAC;YACD,IAAI,MAAM,KAAK,yBAAyB,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;gBAChI,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,oBAAoB;YAAE,MAAM,4BAA4B,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QACzG,OAAO;IACT,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IACtI,IAAI,OAAO,CAAC,aAAa,KAAK,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;IACrM,IAAI,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC/J,IAAI,QAAQ,CAAC,eAAe,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,QAAQ,CAAC,eAAe,oDAAoD,cAAc,GAAG,CAAC,CAAC;IACnO,4BAA4B,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,mBAAmB,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAC9E,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;YAChI,CAAC,CAAC,MAAM,CAAC,cAAyC;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,uGAAuG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7I,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,gFAAgF,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,oBAAoB;QAAE,MAAM,4BAA4B,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AAC3G,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,OAA4B,EAAE,SAA4B,EAAE,MAAiC,EAAE,cAAsB;IAC/J,MAAM,WAAW,GAA2C,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,sBAAsB,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpL,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAChJ,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;gBACpC,WAAW,EAAE,SAAS,CAAC,EAAE;gBACzB,SAAS,EAAE,SAAS,CAAC,iBAAkB;gBACvC,0BAA0B,EAAE,SAAS,CAAC,0BAA2B;gBACjE,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,eAAe,EAAE,cAAc;aAChC,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;YACnJ,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACnH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,SAA4B,EAAE,OAA4B;IACvF,IAAI,CAAC,SAAS,CAAC,uBAAuB;QAAE,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IACpJ,+BAA+B,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,SAAS,CAAC,uBAAuB,CAAC;IACjD,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,0BAA0B,CAAC;WAC1F,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,EAAE;WACnC,MAAM,CAAC,0BAA0B,KAAK,SAAS,CAAC,0BAA0B;WAC1E,MAAM,CAAC,iBAAiB,KAAK,SAAS,CAAC,iBAAiB,CAAC,QAAQ;WACjE,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,iBAAiB,CAAC,cAAc;WACrE,MAAM,CAAC,eAAe,KAAK,sBAAsB,CAAC,SAAS,CAAC;WAC5D,CAAC,SAAS,CAAC,iBAAiB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC;WACrG,CAAC,uBAAuB,CAAC,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,4IAA4I,CAAC,CAAC;IAChK,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,SAA6B,EAAE,OAA4B,EAAE,cAAsB;IACjH,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IAC9I,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,eAAe,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC5K,IAAI,SAAS,CAAC,eAAe,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,SAAS,CAAC,eAAe,oDAAoD,cAAc,GAAG,CAAC,CAAC;IAClP,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,iBAAiB,KAAK,OAAO,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpL,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3G,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;AAC7K,CAAC;AAED,SAAS,OAAO,CAAC,IAAkE,EAAE,IAAY;IAC/F,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA4B,EAAE,MAAiC;IAC3F,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC9I,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,sBAAsB,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,iBAAiB,eAAe,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;IACxH,MAAM,eAAe,GAAG;QACtB,OAAO,EAAE,CAAU;QACnB,QAAQ;QACR,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM;QACN,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;QAC7D,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;QAClD,aAAa;QACb,sBAAsB;KACvB,CAAC;IACF,OAAO,EAAE,GAAG,eAAe,EAAE,aAAa,EAAE,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,QAAuC;IAC7D,IAAI,QAAQ,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC9I,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACpI,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,EAAE,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAC/I,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,eAAe,CAAC,QAAuC;IAC9D,IAAI,QAAQ,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACrC,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACta,CAAC;IACD,IAAI,QAAQ,EAAE,IAAI,KAAK,qBAAqB;QAAE,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAClI,IAAI,QAAQ,EAAE,IAAI,KAAK,sBAAsB;QAAE,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7K,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAqB;IAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9f,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;IACjI,CAAC;IACD,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC;IACpE,MAAM,gBAAgB,GAAG,iBAAiB,eAAe,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;IAC5H,IAAI,aAAa,KAAK,eAAe,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,gBAAgB,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACnP,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAsB,EAAE,MAAsB;IACzE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM,CAAC,SAAS,CAAC,cAAc,IAAI,KAAK,CAAC,0BAA0B,KAAK,MAAM,CAAC,0BAA0B,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,KAAK,CAAC,oBAAoB,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1oB,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC7F,IAAI,aAAa,KAAK,eAAe,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,aAAa,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;AAC9M,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,WAAmB,EAAE,SAAiB;IACvE,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,eAAe,OAAO,CAAC,CAAC;IAC7D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;AACxH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,IAAY;IACrC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IAAC,CAAC;IAChE,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}