agy-worker-mcp 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +141 -0
- package/LICENSE +21 -0
- package/README.md +309 -0
- package/commands/agy-ceiling.md +31 -0
- package/dist/broker/blockers.d.ts +86 -0
- package/dist/broker/blockers.d.ts.map +1 -0
- package/dist/broker/blockers.js +390 -0
- package/dist/broker/blockers.js.map +1 -0
- package/dist/broker/outcome.d.ts +85 -0
- package/dist/broker/outcome.d.ts.map +1 -0
- package/dist/broker/outcome.js +147 -0
- package/dist/broker/outcome.js.map +1 -0
- package/dist/broker/reconcile.d.ts +74 -0
- package/dist/broker/reconcile.d.ts.map +1 -0
- package/dist/broker/reconcile.js +415 -0
- package/dist/broker/reconcile.js.map +1 -0
- package/dist/broker/result.d.ts +88 -0
- package/dist/broker/result.d.ts.map +1 -0
- package/dist/broker/result.js +234 -0
- package/dist/broker/result.js.map +1 -0
- package/dist/broker/verify.d.ts +52 -0
- package/dist/broker/verify.d.ts.map +1 -0
- package/dist/broker/verify.js +174 -0
- package/dist/broker/verify.js.map +1 -0
- package/dist/contract/errors.d.ts +119 -0
- package/dist/contract/errors.d.ts.map +1 -0
- package/dist/contract/errors.js +99 -0
- package/dist/contract/errors.js.map +1 -0
- package/dist/contract/index.d.ts +10 -0
- package/dist/contract/index.d.ts.map +1 -0
- package/dist/contract/index.js +10 -0
- package/dist/contract/index.js.map +1 -0
- package/dist/contract/paths.d.ts +139 -0
- package/dist/contract/paths.d.ts.map +1 -0
- package/dist/contract/paths.js +359 -0
- package/dist/contract/paths.js.map +1 -0
- package/dist/contract/schema.sql +64 -0
- package/dist/contract/types.d.ts +1113 -0
- package/dist/contract/types.d.ts.map +1 -0
- package/dist/contract/types.js +114 -0
- package/dist/contract/types.js.map +1 -0
- package/dist/events/cursor.d.ts +65 -0
- package/dist/events/cursor.d.ts.map +1 -0
- package/dist/events/cursor.js +286 -0
- package/dist/events/cursor.js.map +1 -0
- package/dist/events/detect.d.ts +58 -0
- package/dist/events/detect.d.ts.map +1 -0
- package/dist/events/detect.js +183 -0
- package/dist/events/detect.js.map +1 -0
- package/dist/events/normalize.d.ts +30 -0
- package/dist/events/normalize.d.ts.map +1 -0
- package/dist/events/normalize.js +158 -0
- package/dist/events/normalize.js.map +1 -0
- package/dist/events/parse.d.ts +41 -0
- package/dist/events/parse.d.ts.map +1 -0
- package/dist/events/parse.js +89 -0
- package/dist/events/parse.js.map +1 -0
- package/dist/gate/bind.d.ts +28 -0
- package/dist/gate/bind.d.ts.map +1 -0
- package/dist/gate/bind.js +154 -0
- package/dist/gate/bind.js.map +1 -0
- package/dist/gate/gate.d.ts +139 -0
- package/dist/gate/gate.d.ts.map +1 -0
- package/dist/gate/gate.js +488 -0
- package/dist/gate/gate.js.map +1 -0
- package/dist/gate/hooks-file.d.ts +55 -0
- package/dist/gate/hooks-file.d.ts.map +1 -0
- package/dist/gate/hooks-file.js +104 -0
- package/dist/gate/hooks-file.js.map +1 -0
- package/dist/gate.d.ts +3 -0
- package/dist/gate.d.ts.map +1 -0
- package/dist/gate.js +20 -0
- package/dist/gate.js.map +1 -0
- package/dist/policy/ceiling-review.d.ts +22 -0
- package/dist/policy/ceiling-review.d.ts.map +1 -0
- package/dist/policy/ceiling-review.js +170 -0
- package/dist/policy/ceiling-review.js.map +1 -0
- package/dist/policy/ceiling.d.ts +128 -0
- package/dist/policy/ceiling.d.ts.map +1 -0
- package/dist/policy/ceiling.js +273 -0
- package/dist/policy/ceiling.js.map +1 -0
- package/dist/policy/containment.d.ts +100 -0
- package/dist/policy/containment.d.ts.map +1 -0
- package/dist/policy/containment.js +1071 -0
- package/dist/policy/containment.js.map +1 -0
- package/dist/policy/hard-deny.d.ts +28 -0
- package/dist/policy/hard-deny.d.ts.map +1 -0
- package/dist/policy/hard-deny.js +78 -0
- package/dist/policy/hard-deny.js.map +1 -0
- package/dist/policy/profiles.d.ts +82 -0
- package/dist/policy/profiles.d.ts.map +1 -0
- package/dist/policy/profiles.js +317 -0
- package/dist/policy/profiles.js.map +1 -0
- package/dist/policy/rules.d.ts +138 -0
- package/dist/policy/rules.d.ts.map +1 -0
- package/dist/policy/rules.js +1180 -0
- package/dist/policy/rules.js.map +1 -0
- package/dist/policy/seatbelt.d.ts +32 -0
- package/dist/policy/seatbelt.d.ts.map +1 -0
- package/dist/policy/seatbelt.js +59 -0
- package/dist/policy/seatbelt.js.map +1 -0
- package/dist/policy/tools.d.ts +36 -0
- package/dist/policy/tools.d.ts.map +1 -0
- package/dist/policy/tools.js +94 -0
- package/dist/policy/tools.js.map +1 -0
- package/dist/runner/gate-watchdog.d.ts +93 -0
- package/dist/runner/gate-watchdog.d.ts.map +1 -0
- package/dist/runner/gate-watchdog.js +153 -0
- package/dist/runner/gate-watchdog.js.map +1 -0
- package/dist/runner/idle.d.ts +51 -0
- package/dist/runner/idle.d.ts.map +1 -0
- package/dist/runner/idle.js +81 -0
- package/dist/runner/idle.js.map +1 -0
- package/dist/runner/inbox.d.ts +56 -0
- package/dist/runner/inbox.d.ts.map +1 -0
- package/dist/runner/inbox.js +134 -0
- package/dist/runner/inbox.js.map +1 -0
- package/dist/runner/reap.d.ts +65 -0
- package/dist/runner/reap.d.ts.map +1 -0
- package/dist/runner/reap.js +168 -0
- package/dist/runner/reap.js.map +1 -0
- package/dist/runner/runner.d.ts +51 -0
- package/dist/runner/runner.d.ts.map +1 -0
- package/dist/runner/runner.js +289 -0
- package/dist/runner/runner.js.map +1 -0
- package/dist/runner/spawn.d.ts +98 -0
- package/dist/runner/spawn.d.ts.map +1 -0
- package/dist/runner/spawn.js +230 -0
- package/dist/runner/spawn.js.map +1 -0
- package/dist/runner/verify.d.ts +24 -0
- package/dist/runner/verify.d.ts.map +1 -0
- package/dist/runner/verify.js +108 -0
- package/dist/runner/verify.js.map +1 -0
- package/dist/runner.d.ts +3 -0
- package/dist/runner.d.ts.map +1 -0
- package/dist/runner.js +15 -0
- package/dist/runner.js.map +1 -0
- package/dist/server/context.d.ts +41 -0
- package/dist/server/context.d.ts.map +1 -0
- package/dist/server/context.js +59 -0
- package/dist/server/context.js.map +1 -0
- package/dist/server/instructions.d.ts +13 -0
- package/dist/server/instructions.d.ts.map +1 -0
- package/dist/server/instructions.js +121 -0
- package/dist/server/instructions.js.map +1 -0
- package/dist/server/server.d.ts +20 -0
- package/dist/server/server.d.ts.map +1 -0
- package/dist/server/server.js +55 -0
- package/dist/server/server.js.map +1 -0
- package/dist/server/tools/cancel.d.ts +24 -0
- package/dist/server/tools/cancel.d.ts.map +1 -0
- package/dist/server/tools/cancel.js +59 -0
- package/dist/server/tools/cancel.js.map +1 -0
- package/dist/server/tools/capabilities.d.ts +36 -0
- package/dist/server/tools/capabilities.d.ts.map +1 -0
- package/dist/server/tools/capabilities.js +116 -0
- package/dist/server/tools/capabilities.js.map +1 -0
- package/dist/server/tools/ceiling.d.ts +31 -0
- package/dist/server/tools/ceiling.d.ts.map +1 -0
- package/dist/server/tools/ceiling.js +121 -0
- package/dist/server/tools/ceiling.js.map +1 -0
- package/dist/server/tools/index.d.ts +38 -0
- package/dist/server/tools/index.d.ts.map +1 -0
- package/dist/server/tools/index.js +115 -0
- package/dist/server/tools/index.js.map +1 -0
- package/dist/server/tools/listJobs.d.ts +30 -0
- package/dist/server/tools/listJobs.d.ts.map +1 -0
- package/dist/server/tools/listJobs.js +37 -0
- package/dist/server/tools/listJobs.js.map +1 -0
- package/dist/server/tools/logs.d.ts +31 -0
- package/dist/server/tools/logs.d.ts.map +1 -0
- package/dist/server/tools/logs.js +96 -0
- package/dist/server/tools/logs.js.map +1 -0
- package/dist/server/tools/result.d.ts +32 -0
- package/dist/server/tools/result.d.ts.map +1 -0
- package/dist/server/tools/result.js +95 -0
- package/dist/server/tools/result.js.map +1 -0
- package/dist/server/tools/send.d.ts +37 -0
- package/dist/server/tools/send.d.ts.map +1 -0
- package/dist/server/tools/send.js +71 -0
- package/dist/server/tools/send.js.map +1 -0
- package/dist/server/tools/sessions.d.ts +28 -0
- package/dist/server/tools/sessions.d.ts.map +1 -0
- package/dist/server/tools/sessions.js +54 -0
- package/dist/server/tools/sessions.js.map +1 -0
- package/dist/server/tools/start.d.ts +107 -0
- package/dist/server/tools/start.d.ts.map +1 -0
- package/dist/server/tools/start.js +482 -0
- package/dist/server/tools/start.js.map +1 -0
- package/dist/server/tools/wait.d.ts +29 -0
- package/dist/server/tools/wait.d.ts.map +1 -0
- package/dist/server/tools/wait.js +120 -0
- package/dist/server/tools/wait.js.map +1 -0
- package/dist/server.d.ts +3 -0
- package/dist/server.d.ts.map +1 -0
- package/dist/server.js +17 -0
- package/dist/server.js.map +1 -0
- package/dist/setup/install.d.ts +52 -0
- package/dist/setup/install.d.ts.map +1 -0
- package/dist/setup/install.js +108 -0
- package/dist/setup/install.js.map +1 -0
- package/dist/setup.d.ts +3 -0
- package/dist/setup.d.ts.map +1 -0
- package/dist/setup.js +24 -0
- package/dist/setup.js.map +1 -0
- package/dist/store/db.d.ts +49 -0
- package/dist/store/db.d.ts.map +1 -0
- package/dist/store/db.js +101 -0
- package/dist/store/db.js.map +1 -0
- package/dist/store/jobs.d.ts +45 -0
- package/dist/store/jobs.d.ts.map +1 -0
- package/dist/store/jobs.js +150 -0
- package/dist/store/jobs.js.map +1 -0
- package/dist/store/locks.d.ts +60 -0
- package/dist/store/locks.d.ts.map +1 -0
- package/dist/store/locks.js +172 -0
- package/dist/store/locks.js.map +1 -0
- package/dist/store/sessions.d.ts +37 -0
- package/dist/store/sessions.d.ts.map +1 -0
- package/dist/store/sessions.js +117 -0
- package/dist/store/sessions.js.map +1 -0
- package/dist/trace/digest.d.ts +77 -0
- package/dist/trace/digest.d.ts.map +1 -0
- package/dist/trace/digest.js +481 -0
- package/dist/trace/digest.js.map +1 -0
- package/package.json +68 -0
- package/skills/agy-ceiling/SKILL.md +72 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"containment.js","sourceRoot":"","sources":["../../src/policy/containment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,IAAI,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEzE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAC1G,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAetG;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,SAAoB;IAChE,MAAM,kBAAkB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IACzE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAuB;IAC7D,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAClD,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAuB;IAC9D,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;AACpD,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,cAAc,GAAG,sDAAsD,CAAA;AAEpF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,WAAW;IACX,YAAY;IACZ,aAAa;IACb,aAAa;CACd,CAAC,CAAA;AAEF,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,EAAE,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAA;IAC/B,IAAI,CAAC,GAAG,KAAK,CAAA;IACb,IAAI,CAAC,KAAK,GAAG;QAAE,CAAC,GAAG,IAAI,CAAA;SAClB,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACvD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC9B,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,SAAkB;IAC1D,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3D,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACxD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3D,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,OAAO;IACP,SAAS;IACT,IAAI;IACJ,UAAU;IACV,OAAO;IACP,KAAK;CACN,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IACpC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,IAAI;IACJ,KAAK;IACL,KAAK;IACL,IAAI;IACJ,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,IAAI;IACJ,KAAK;IACL,SAAS;IACT,SAAS;CACV,CAAC,CAAA;AAEF,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAClC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAgB;IAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAC7F,CAAA;IACD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAA;IAE1B,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACxB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAE,CAAC,CAAA;YACpD,MAAK;QACP,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,CAAC,EAAE,CAAA;YACH,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;gBACvB,IAAI,IAAI,KAAK,EAAE,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnD,CAAC,EAAE,CAAA;gBACL,CAAC;YACH,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7D,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;YAC/C,CAAC,IAAI,CAAC,CAAA;YACN,SAAS,GAAG,IAAI,CAAA;YAChB,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAChE,CAAC,EAAE,CAAA;YACH,SAAS,GAAG,IAAI,CAAA;YAChB,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACzC,CAAC,IAAI,CAAC,CAAA;YACN,SAAS,GAAG,IAAI,CAAA;YAChB,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,CAAC,EAAE,CAAA;YACH,SAAS,GAAG,IAAI,CAAA;YAChB,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,IAAI,CAAA;YAChB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC,EAAE,CAAA;IACL,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAgB;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACxB,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAE,CAAC,CAAA;QAC5B,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;aAAM,IAAI,KAAK,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAE,CAAC,CAAA;QAC5B,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAgB;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,eAAe,GAAG,KAAK,CAAA;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACxB,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,eAAe,GAAG,IAAI,CAAA;gBACtB,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAQ;QACrC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAgB,EAAE,GAAmB;IACnE,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,OAAO,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,SAAS,EAAE,CAAA;IACb,CAAC;IACD,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAE,CAAA;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IAExC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;YAClB,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC,CAAA;YAC1B,CAAC;iBAAM,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;YAC3C,CAAC;iBAAM,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1D,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAA;QAC/B,CAAC;aAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YACvE,IAAI,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1D,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAA;QAC/B,CAAC;aAAM,IAAI,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;YACnE,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAgB;IAC7C,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACpB,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAgB;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAEpD,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;YACpB,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAE,CAAC,CAAA;YAC5B,CAAC;iBAAM,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;YACpB,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC5D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAE,CAAC,CAAA;YAC5B,CAAC;iBAAM,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;YACzC,CAAC;iBAAM,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAE,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAgB;IAChD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACpB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAE,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAgB;IAChD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACpB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAE,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAgB;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,aAAa,CAAC,CAAA;IAClE,IAAI,IAAI;QAAE,OAAO,WAAW,CAAA;IAC5B,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,oBAAoB,CAAC,CAAA;IACtF,IAAI,YAAY,KAAK,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAE,CAAC,CAAA;IACpC,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAgB;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACrE,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,oBAAoB,CAAC,CAAA;IACtF,IAAI,YAAY,KAAK,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAE,CAAC,CAAA;IACpC,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAS,2BAA2B,CAAC,MAAgB;IACnD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACpB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjC,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACf,CAAC,EAAE,CAAA;IACL,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAgB;IAChD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACrE,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB,EAAE,GAAmB;IAChF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACjE,MAAM,UAAU,GAAa,EAAE,CAAA;IAE/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAEjC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;QAC7C,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAEnD,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAW,CAAC,CAAA;QACnE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACnD,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;gBAC9D,UAAU,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAW,EAAE,GAAG,CAAC,CAAC,CAAA;YAClG,CAAC;YACD,SAAQ;QACV,CAAC;QAED,IAAI,UAAU,GAAa,EAAE,CAAA;QAE7B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC/D,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,UAAU,GAAG,uBAAuB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAChE,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC/D,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC9D,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC/D,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QACjE,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QACjE,CAAC;aAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,UAAU,GAAG,0BAA0B,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QACnE,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC9D,CAAC;aAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,UAAU,GAAG,2BAA2B,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QACpE,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QACjE,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;YACvF,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC5B,UAAU,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAA;YACrD,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClF,IAAI,eAAe,GAAG,KAAK,CAAA;YAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAW,CAAA;gBACnD,IAAI,CAAC,KAAK;oBAAE,SAAQ;gBACpB,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBACnB,eAAe,GAAG,IAAI,CAAA;wBACtB,SAAQ;oBACV,CAAC;oBACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC1B,SAAQ;oBACV,CAAC;gBACH,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAChD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;gBACnC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACtB,CAAC;qBAAM,IAAI,GAAG,EAAE,CAAC;oBACf,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;gBACpC,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAgB;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACpB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,UAAU,GAAG,IAAI,CAAA;gBACnB,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAA;gBACxB,CAAC;gBACD,CAAC,EAAE,CAAA;YACL,CAAC;YACD,MAAK;QACP,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACnC,UAAU,GAAG,IAAI,CAAA;YACjB,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,UAAU,GAAG,IAAI,CAAA;YACjB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAA;YACrD,UAAU,GAAG,IAAI,CAAA;YACjB,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;YACvE,UAAU,GAAG,IAAI,CAAA;YACjB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,IAAI,CAAA;YACjB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC,EAAE,CAAA;IACL,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAgB;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACpB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7D,MAAK;QACP,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACf,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAgB;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACpB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAA;YACrD,UAAU,GAAG,IAAI,CAAA;YACjB,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACtB,UAAU,GAAG,IAAI,CAAA;YACjB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM;gBAAE,CAAC,IAAI,CAAC,CAAA;;gBAC1D,CAAC,EAAE,CAAA;YACR,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,IAAI,CAAA;YACjB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC,EAAE,CAAA;IACL,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAgB;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAC7F,CAAA;IACD,IAAI,UAAU;QAAE,OAAO,EAAE,CAAA;IAEzB,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACpB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAE,CAAC,CAAA;YAClD,MAAK;QACP,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;YACvC,SAAS,GAAG,IAAI,CAAA;YAChB,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACxD,SAAS,GAAG,IAAI,CAAA;YAChB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAA;YACrD,SAAS,GAAG,IAAI,CAAA;YAChB,CAAC,IAAI,CAAC,CAAA;YACN,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;YACvE,SAAS,GAAG,IAAI,CAAA;YAChB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,IAAI,CAAA;YAChB,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC,EAAE,CAAA;IACL,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAgB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,eAAe,GAAG,KAAK,CAAA;IAC3B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,eAAe,GAAG,IAAI,CAAA;gBACtB,CAAC,EAAE,CAAA;gBACH,SAAQ;YACV,CAAC;YACD,IACE,CAAC,KAAK,IAAI;gBACV,CAAC,KAAK,IAAI;gBACV,CAAC,KAAK,IAAI;gBACV,CAAC,KAAK,IAAI;gBACV,CAAC,KAAK,IAAI;gBACV,CAAC,KAAK,IAAI;gBACV,CAAC,KAAK,IAAI;gBACV,CAAC,KAAK,IAAI;gBACV,CAAC,KAAK,UAAU,EAChB,CAAC;gBACD,CAAC,IAAI,CAAC,CAAA;gBACN,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvC,CAAC,EAAE,CAAA;gBACH,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9B,CAAC,EAAE,CAAA;gBACH,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,CAAC,EAAE,CAAA;gBACH,SAAQ;YACV,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC,EAAE,CAAA;IACL,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,MAAgB;IAC5D,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,CAAA;QACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;YACpB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAA;YACvC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAA;YACvD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,CAAC,EAAE,CAAA;gBACH,SAAQ;YACV,CAAC;YACD,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,CAAA;QACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;YACpB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAA;YAC5E,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,CAAC,EAAE,CAAA;gBACH,SAAQ;YACV,CAAC;YACD,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAA;QACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;YACpB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC1C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAA;gBAC1B,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzF,CAAC,IAAI,CAAC,CAAA;gBACN,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,CAAC,EAAE,CAAA;gBACH,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACf,CAAC;YACD,MAAK;QACP,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB,EAAE,SAAiB;IAC9E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACjE,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,IAAI,cAAc,GAAkB,IAAI,CAAA;IACxC,MAAM,cAAc,GAAa,EAAE,CAAA;IAEnC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAQ,EAAE;QAChD,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClD,OAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QACrC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/E,CAAC,CAAA;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAEjC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;QAC7C,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAEnD,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAW,CAAC,CAAA;QACnE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACnD,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;gBAC9D,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAW,EAAE,SAAS,CAAC,CAAA;gBAChG,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAA;gBACpC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;gBAClC,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc;oBAAE,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;gBAClF,cAAc,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAA;YAC9C,CAAC;YACD,SAAQ;QACV,CAAC;QAED,kCAAkC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAW,CAAA;YACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,CAAC,CAAC;gBAAE,SAAQ;YAEhB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,EAAE,CAAC,CAAwB,IAAI,EAAE,CAAC,CAAA;YACrF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAQ;YAEjE,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,cAAc;oBAAE,cAAc,GAAG,MAAM,CAAA;YAC9C,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;gBACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;gBACzE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACzB,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC3D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,cAAc;oBAAE,cAAc,GAAG,GAAG,CAAA;YAC3C,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;gBACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;gBACzE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACzB,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,IAAI,iBAAiB,GAAa,EAAE,CAAA;QACpC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC7E,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;YACpE,CAAC;iBAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC3B,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;YACpE,CAAC;iBAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC1B,iBAAiB,GAAG,mBAAmB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;YACnE,CAAC;iBAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC1B,iBAAiB,GAAG,mBAAmB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;YACnE,CAAC;iBAAM,CAAC;gBACN,iBAAiB,GAAG,uBAAuB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;YACvF,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC5B,iBAAiB,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACzF,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC5E,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAQ;YAC5E,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,cAAc;oBAAE,cAAc,GAAG,IAAI,CAAA;YAC5C,CAAC;iBAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;gBACpC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;gBACzE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACxB,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;QAED,oFAAoF;QACpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAE,CAAA;YACtC,IAAI,CAAC,CAAC;gBAAE,SAAQ;YAChB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACvE,IAAI,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,GAAG,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,cAAc;QACd,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;KACpD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,IAA6B;IAE7B,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1D,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC;IAED,IAAI,QAAQ,KAAK,aAAa,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACvE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAChC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;oBACrC,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC5B,SAAQ;oBACV,CAAC;gBACH,CAAC;gBACD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;wBAClD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,yBAAyB,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QACnE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACf,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC;AAED,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,mDAAmD,CAAA;AAE/E,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAW,CAAA;QACjC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;YAChG,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzC,MAAM,eAAe,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC9D,IAAI,CAAC,eAAe;YAAE,MAAK;QAC3B,CAAC,EAAE,CAAA;QACH,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,SAAQ;QAClC,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,SAAQ;QAClC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,KAAuB,EACvB,IAAsB;IAEtB,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;IACxE,OAAO,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAA;AAChD,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,MAAM,QAAQ,GAAG,sBAAsB,CAAA;AACvC,MAAM,eAAe,GAAG,yDAAyD,CAAA;AAEjF,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,SAAiB;IACvE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACjE,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAW,CAAA;YACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,CAAC,CAAC;gBAAE,SAAQ;YAEhB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;YACtC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,EAAE,CAAC,CAAwB,IAAI,EAAE,CAAC,CAAA;YACrF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YACjC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAQ;YAE1C,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;YACtC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,WAAmB,EAAE,SAAiB;IAC3E,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA;IACvC,KAAK,MAAM,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,MAAM,CAAA;QACjE,IAAI,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAA;QAC1D,IAAI,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC;YAAE,OAAO,MAAM,CAAA;IACpD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAoB,EAAE,QAAiB;IACxE,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,CAAA;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAEtD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAA;QACpC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACtC,MAAM,IAAI,eAAe,CAAC;gBACxB,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,qDAAqD;aAChE,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC;gBACxB,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,iDAAiD;aAC5D,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC;gBACxB,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,kEAAkE;aAC7E,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,eAAe,CAAC;gBACxB,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,mDAAmD;aAC9D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Rules nothing can remove — not a client request, not the human ceiling's
|
|
3
|
+
* `exceptions` (see docs/permissions.md).
|
|
4
|
+
*
|
|
5
|
+
* 0.3.0 narrowed this list to what protects the gate itself. `rm -rf`,
|
|
6
|
+
* `git push`, `sudo`, `curl` moved to `general_worker`'s own deny list, where a
|
|
7
|
+
* project ceiling can lift them one by one: those are policy, and policy is
|
|
8
|
+
* the human's call. What stays here is integrity, not policy:
|
|
9
|
+
*
|
|
10
|
+
* - the credential paths are standard, non-agy-specific credential locations —
|
|
11
|
+
* not a guess about agy's own behaviour;
|
|
12
|
+
* - `write_file({workspace}/.agents/**)` is I6: the gate's own hook wiring
|
|
13
|
+
* must stay write-protected even under a
|
|
14
|
+
* hand-crafted `permissions.allow`. It is also enforced structurally in
|
|
15
|
+
* `decide()`'s containment stage (so it holds even if this entry were ever
|
|
16
|
+
* dropped), but belongs on the hard-deny list too since deny is checked
|
|
17
|
+
* ahead of allow;
|
|
18
|
+
* - subagent tools are refused structurally (`unsupported`, M2), so they need
|
|
19
|
+
* no rule string here.
|
|
20
|
+
*
|
|
21
|
+
* Lives in its own module because `policy/ceiling.ts` must consult it (an
|
|
22
|
+
* `exceptions` entry naming one of these is a file error) while
|
|
23
|
+
* `policy/profiles.ts` imports `ceiling.ts` — a single home avoids the cycle.
|
|
24
|
+
*/
|
|
25
|
+
export declare const HARD_DENY: readonly string[];
|
|
26
|
+
export declare const COMMAND_CREDENTIAL_ROOTS: readonly string[];
|
|
27
|
+
export declare function isCredentialPath(target: string): boolean;
|
|
28
|
+
//# sourceMappingURL=hard-deny.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"hard-deny.d.ts","sourceRoot":"","sources":["../../src/policy/hard-deny.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAYtC,CAAA;AAED,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAcrD,CAAA;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAYxD"}
|
|
@@ -0,0 +1,78 @@
|
|
|
1
|
+
import { realpathSync } from 'node:fs';
|
|
2
|
+
import { homedir } from 'node:os';
|
|
3
|
+
import { canonicalize, isWithin, stateHome } from '../contract/paths.js';
|
|
4
|
+
function canonicalHome() {
|
|
5
|
+
try {
|
|
6
|
+
return realpathSync.native(homedir());
|
|
7
|
+
}
|
|
8
|
+
catch {
|
|
9
|
+
return homedir();
|
|
10
|
+
}
|
|
11
|
+
}
|
|
12
|
+
const HOME = canonicalHome();
|
|
13
|
+
/**
|
|
14
|
+
* Rules nothing can remove — not a client request, not the human ceiling's
|
|
15
|
+
* `exceptions` (see docs/permissions.md).
|
|
16
|
+
*
|
|
17
|
+
* 0.3.0 narrowed this list to what protects the gate itself. `rm -rf`,
|
|
18
|
+
* `git push`, `sudo`, `curl` moved to `general_worker`'s own deny list, where a
|
|
19
|
+
* project ceiling can lift them one by one: those are policy, and policy is
|
|
20
|
+
* the human's call. What stays here is integrity, not policy:
|
|
21
|
+
*
|
|
22
|
+
* - the credential paths are standard, non-agy-specific credential locations —
|
|
23
|
+
* not a guess about agy's own behaviour;
|
|
24
|
+
* - `write_file({workspace}/.agents/**)` is I6: the gate's own hook wiring
|
|
25
|
+
* must stay write-protected even under a
|
|
26
|
+
* hand-crafted `permissions.allow`. It is also enforced structurally in
|
|
27
|
+
* `decide()`'s containment stage (so it holds even if this entry were ever
|
|
28
|
+
* dropped), but belongs on the hard-deny list too since deny is checked
|
|
29
|
+
* ahead of allow;
|
|
30
|
+
* - subagent tools are refused structurally (`unsupported`, M2), so they need
|
|
31
|
+
* no rule string here.
|
|
32
|
+
*
|
|
33
|
+
* Lives in its own module because `policy/ceiling.ts` must consult it (an
|
|
34
|
+
* `exceptions` entry naming one of these is a file error) while
|
|
35
|
+
* `policy/profiles.ts` imports `ceiling.ts` — a single home avoids the cycle.
|
|
36
|
+
*/
|
|
37
|
+
export const HARD_DENY = [
|
|
38
|
+
`read_file(${HOME}/.ssh/**)`,
|
|
39
|
+
`read_file(${HOME}/.aws/**)`,
|
|
40
|
+
`read_file(${HOME}/.gnupg/**)`,
|
|
41
|
+
`read_file(${HOME}/.netrc)`,
|
|
42
|
+
`read_file(${HOME}/.npmrc)`,
|
|
43
|
+
`read_file(${HOME}/.git-credentials)`,
|
|
44
|
+
`read_file(${HOME}/.config/gh/**)`,
|
|
45
|
+
`read_file(${HOME}/.config/gcloud/**)`,
|
|
46
|
+
`read_file(${HOME}/.docker/config.json)`,
|
|
47
|
+
`read_file(${HOME}/.kube/**)`,
|
|
48
|
+
'write_file({workspace}/.agents/**)',
|
|
49
|
+
];
|
|
50
|
+
export const COMMAND_CREDENTIAL_ROOTS = [
|
|
51
|
+
`${HOME}/.ssh`,
|
|
52
|
+
`${HOME}/.aws`,
|
|
53
|
+
`${HOME}/.gnupg`,
|
|
54
|
+
`${HOME}/.config/gh`,
|
|
55
|
+
`${HOME}/.config/gcloud`,
|
|
56
|
+
`${HOME}/.npmrc`,
|
|
57
|
+
`${HOME}/.git-credentials`,
|
|
58
|
+
`${HOME}/.netrc`,
|
|
59
|
+
`${HOME}/.docker/config.json`,
|
|
60
|
+
`${HOME}/.kube`,
|
|
61
|
+
`${HOME}/.gemini`,
|
|
62
|
+
`${HOME}/.antigravity`,
|
|
63
|
+
`${HOME}/.agy-worker`,
|
|
64
|
+
];
|
|
65
|
+
export function isCredentialPath(target) {
|
|
66
|
+
const resolved = canonicalize(target);
|
|
67
|
+
const roots = [
|
|
68
|
+
...COMMAND_CREDENTIAL_ROOTS.map(canonicalize),
|
|
69
|
+
canonicalize(stateHome()),
|
|
70
|
+
];
|
|
71
|
+
for (const root of roots) {
|
|
72
|
+
if (resolved === root || isWithin(resolved, root)) {
|
|
73
|
+
return true;
|
|
74
|
+
}
|
|
75
|
+
}
|
|
76
|
+
return false;
|
|
77
|
+
}
|
|
78
|
+
//# sourceMappingURL=hard-deny.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"hard-deny.js","sourceRoot":"","sources":["../../src/policy/hard-deny.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAExE,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAsB;IAC1C,aAAa,IAAI,WAAW;IAC5B,aAAa,IAAI,WAAW;IAC5B,aAAa,IAAI,aAAa;IAC9B,aAAa,IAAI,UAAU;IAC3B,aAAa,IAAI,UAAU;IAC3B,aAAa,IAAI,oBAAoB;IACrC,aAAa,IAAI,iBAAiB;IAClC,aAAa,IAAI,qBAAqB;IACtC,aAAa,IAAI,uBAAuB;IACxC,aAAa,IAAI,YAAY;IAC7B,oCAAoC;CACrC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,GAAG,IAAI,OAAO;IACd,GAAG,IAAI,OAAO;IACd,GAAG,IAAI,SAAS;IAChB,GAAG,IAAI,aAAa;IACpB,GAAG,IAAI,iBAAiB;IACxB,GAAG,IAAI,SAAS;IAChB,GAAG,IAAI,mBAAmB;IAC1B,GAAG,IAAI,SAAS;IAChB,GAAG,IAAI,sBAAsB;IAC7B,GAAG,IAAI,QAAQ;IACf,GAAG,IAAI,UAAU;IACjB,GAAG,IAAI,eAAe;IACtB,GAAG,IAAI,cAAc;CACtB,CAAA;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG;QACZ,GAAG,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC;QAC7C,YAAY,CAAC,SAAS,EAAE,CAAC;KAC1B,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAClD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
|
|
@@ -0,0 +1,82 @@
|
|
|
1
|
+
import type { EffectivePolicy, OnDenial, Profile, RequestedPermissions } from '../contract/types.js';
|
|
2
|
+
import { type Ceiling } from './ceiling.js';
|
|
3
|
+
export interface ProfileDef {
|
|
4
|
+
name: Profile;
|
|
5
|
+
description: string;
|
|
6
|
+
/** Whether jobs on this profile take the `cwd_write` lock. */
|
|
7
|
+
write: boolean;
|
|
8
|
+
/** Ceiling. A client request can only intersect with this, never extend it.
|
|
9
|
+
* `{workspace}` is substituted with the job's canonical workspace at
|
|
10
|
+
* `resolvePolicy` time. */
|
|
11
|
+
allow: string[];
|
|
12
|
+
/** Always applied, on top of `HARD_DENY`. */
|
|
13
|
+
deny: string[];
|
|
14
|
+
/**
|
|
15
|
+
* Whether allowed run_command calls on this profile emit `BypassSandbox: true` by default (I2).
|
|
16
|
+
* True on general_worker; always false on research_readonly.
|
|
17
|
+
*/
|
|
18
|
+
bypassSandbox: boolean;
|
|
19
|
+
/**
|
|
20
|
+
* Whether a broad interpreter rule (`command(python)`) may be granted at all.
|
|
21
|
+
* That is effectively arbitrary code execution, so `research_readonly` refuses
|
|
22
|
+
* it outright (see docs/permissions.md).
|
|
23
|
+
*/
|
|
24
|
+
allowInterpreters: boolean;
|
|
25
|
+
}
|
|
26
|
+
export { HARD_DENY } from './hard-deny.js';
|
|
27
|
+
/** Built-in profiles (see docs/permissions.md). */
|
|
28
|
+
export declare const PROFILES: Readonly<Record<Profile, ProfileDef>>;
|
|
29
|
+
/** @throws {import('../contract/errors.js').ValidationError} listing the valid profiles. */
|
|
30
|
+
export declare function getProfile(name: string): ProfileDef;
|
|
31
|
+
export interface ResolvePolicyInput {
|
|
32
|
+
profile: Profile;
|
|
33
|
+
/** Canonical workspace. Becomes the read/write root and the forced `Cwd`. */
|
|
34
|
+
workspace: string;
|
|
35
|
+
requested?: RequestedPermissions;
|
|
36
|
+
onDenial?: OnDenial;
|
|
37
|
+
maxDenials?: number | null;
|
|
38
|
+
/**
|
|
39
|
+
* The human-owned ceiling (`policy/ceiling.ts`, see `docs/permissions.md`).
|
|
40
|
+
* Defaults to {@link EMPTY_CEILING} so a caller with no ceiling file — or
|
|
41
|
+
* a unit test exercising `resolvePolicy` on its own — gets exactly PR2/PR3's
|
|
42
|
+
* behaviour: `read_roots` resolves to `[]`, `sandboxed` to false,
|
|
43
|
+
* `allow`/`deny` are unaffected. The gate's own v1-`policy.json` tolerance (a
|
|
44
|
+
* missing `add_dirs` field reads as `[]`) is the same shape of
|
|
45
|
+
* fallback, one layer further out.
|
|
46
|
+
*/
|
|
47
|
+
ceiling?: Ceiling;
|
|
48
|
+
}
|
|
49
|
+
/**
|
|
50
|
+
* Merge profile ceiling, human ceiling, and client request into the policy the
|
|
51
|
+
* gate will read.
|
|
52
|
+
*
|
|
53
|
+
* Direction is fixed throughout: a client only ever narrows within what the
|
|
54
|
+
* human ceiling grants, and the human ceiling only ever narrows within (or
|
|
55
|
+
* adds alongside) what the profile permits — nothing here can widen past
|
|
56
|
+
* `HARD_DENY`. Concretely:
|
|
57
|
+
*
|
|
58
|
+
* - `allow` = intersection of `requested.allow` (or, absent, everything) with
|
|
59
|
+
* `profile.allow ∪ ceiling.allow` (the "allow ceiling"). Rejected
|
|
60
|
+
* entries land in `rejected_allow`.
|
|
61
|
+
* - `deny` = union of `profile.deny`, `HARD_DENY`, `ceiling.deny`, and
|
|
62
|
+
* `requested.deny`. A client can only add to it, never remove from it.
|
|
63
|
+
* - `sandbox` = strictest of profile (`agy` on research_readonly), ceiling
|
|
64
|
+
* `sandbox`, and request `sandbox` / `sandboxed`; `bypass_sandbox` and
|
|
65
|
+
* `sandbox_forced_by` are derived from it.
|
|
66
|
+
* - `add_dirs` = when `requested.read_roots` is absent, all entries
|
|
67
|
+
* from `ceiling.read_roots` resolved via `additionalDirRoot`; when
|
|
68
|
+
* present, the requested list filtered to entries matching some glob in
|
|
69
|
+
* `ceiling.read_roots`. Non-matching entries land in `rejected_read_roots`.
|
|
70
|
+
*
|
|
71
|
+
* An absent `requested.allow` (as opposed to an empty array) means "no
|
|
72
|
+
* narrowing requested" — the caller gets the full allow ceiling.
|
|
73
|
+
*/
|
|
74
|
+
export declare function resolvePolicy(input: ResolvePolicyInput): EffectivePolicy;
|
|
75
|
+
/** Descriptor list for `agy_capabilities`. */
|
|
76
|
+
export declare function describeProfiles(): Array<{
|
|
77
|
+
name: Profile;
|
|
78
|
+
description: string;
|
|
79
|
+
write: boolean;
|
|
80
|
+
bypass_sandbox: boolean;
|
|
81
|
+
}>;
|
|
82
|
+
//# sourceMappingURL=profiles.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/policy/profiles.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,eAAe,EACf,QAAQ,EACR,OAAO,EACP,oBAAoB,EAErB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,cAAc,CAAA;AAQrB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,8DAA8D;IAC9D,KAAK,EAAE,OAAO,CAAA;IACd;;gCAE4B;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,6CAA6C;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAA;IACd;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,mDAAmD;AACnD,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAqHzD,CAAA;AAEF,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAWnD;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,oBAAoB,CAAA;IAChC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,eAAe,CAiJxE;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,IAAI,KAAK,CAAC;IACxC,IAAI,EAAE,OAAO,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,OAAO,CAAA;IACd,cAAc,EAAE,OAAO,CAAA;CACxB,CAAC,CAOD"}
|
|
@@ -0,0 +1,317 @@
|
|
|
1
|
+
import { ValidationError } from '../contract/errors.js';
|
|
2
|
+
import { canonicalize } from '../contract/paths.js';
|
|
3
|
+
import { additionalDirCovered, additionalDirRoot, EMPTY_CEILING, resolveRequestedDir, } from './ceiling.js';
|
|
4
|
+
import { buildRoots } from './containment.js';
|
|
5
|
+
import { HARD_DENY } from './hard-deny.js';
|
|
6
|
+
import { intersectAllow } from './rules.js';
|
|
7
|
+
import { seatbeltAvailable, seatbeltImplicitWriteRoots } from './seatbelt.js';
|
|
8
|
+
const SANDBOX_RANK = { none: 0, seatbelt: 1, agy: 2 };
|
|
9
|
+
export { HARD_DENY } from './hard-deny.js';
|
|
10
|
+
/** Built-in profiles (see docs/permissions.md). */
|
|
11
|
+
export const PROFILES = Object.freeze({
|
|
12
|
+
research_readonly: {
|
|
13
|
+
name: 'research_readonly',
|
|
14
|
+
description: 'Read-only research. Allows reads inside the workspace and shallow git inspection; blocks all writes and interpreter execution. OS sandbox is always enabled (BypassSandbox: false).',
|
|
15
|
+
write: false,
|
|
16
|
+
allow: [
|
|
17
|
+
// `{workspace}/**` covers everything *below* the root; the root itself is
|
|
18
|
+
// what `list_dir`/`find_by_name`/`grep_search` name when they start at
|
|
19
|
+
// the workspace, so it needs its own rule (measured 2026-09-03: without
|
|
20
|
+
// it every top-level listing was denied).
|
|
21
|
+
'read_file({workspace})',
|
|
22
|
+
'read_file({workspace}/**)',
|
|
23
|
+
'command(git status|log|diff)',
|
|
24
|
+
'command(rg)',
|
|
25
|
+
'command(ls)',
|
|
26
|
+
'command(cat)',
|
|
27
|
+
'command(wc)',
|
|
28
|
+
],
|
|
29
|
+
deny: ['write_file(*)', 'command(python)', 'command(node)', 'command(pip)', 'fetch(*)'],
|
|
30
|
+
bypassSandbox: false,
|
|
31
|
+
allowInterpreters: false,
|
|
32
|
+
},
|
|
33
|
+
general_worker: {
|
|
34
|
+
name: 'general_worker',
|
|
35
|
+
description: 'Workspace development worker. Network (curl/wget/ssh/scp), remote git (push), package managers, containers, sudo, and destructive git commands are blocked by default and can only be enabled via exceptions in the project ceiling policy.json (0.3.0). Reads/writes within the workspace, local git operations, common build/test commands (gradle, maven, npm test/run, javac/java, pytest), basic utilities, and python3 -c / node -e / bash -c are allowed. bash -c "<s>" undergoes recursive evaluation, so inner commands must also be allowed to pass. Any shell command not in this list is denied (allowlist; can be switched to ceiling command_policy: denylist) — a bound job\'s gate never issues an "ask" decision (I1). Subagent tools are always denied because they run in a separate conversation and can bypass this job\'s policy (M2). {workspace}/.agents is always write-protected against all writes including shell redirection because it holds the gate\'s own hook configuration (I6). Allowed run_command executions run without agy\'s OS sandbox by default (BypassSandbox: true, I2); sandboxing can be enforced by ceiling (sandboxed: true) or request (permissions.sandboxed: true).',
|
|
36
|
+
write: true,
|
|
37
|
+
// The build commands are here for `intersectAllow`, not just the gate:
|
|
38
|
+
// without them in the ceiling, a client asking for them in
|
|
39
|
+
// `permissions.allow` bounces into `rejected_allow` — which, measured,
|
|
40
|
+
// collapsed the whole effective allow list to [] and silently took the
|
|
41
|
+
// profile's own defaults with it.
|
|
42
|
+
allow: [
|
|
43
|
+
// `{workspace}/**` covers everything *below* the root; the root itself is
|
|
44
|
+
// what `list_dir`/`find_by_name`/`grep_search` name when they start at
|
|
45
|
+
// the workspace, so it needs its own rule (measured 2026-09-03: without
|
|
46
|
+
// it every top-level listing was denied).
|
|
47
|
+
'read_file({workspace})',
|
|
48
|
+
'read_file({workspace}/**)',
|
|
49
|
+
'write_file({workspace}/**)',
|
|
50
|
+
'command(git)',
|
|
51
|
+
'command(ls)',
|
|
52
|
+
'command(cat)',
|
|
53
|
+
'command(head)',
|
|
54
|
+
'command(tail)',
|
|
55
|
+
'command(wc)',
|
|
56
|
+
'command(grep)',
|
|
57
|
+
'command(rg)',
|
|
58
|
+
'command(find)',
|
|
59
|
+
'command(stat)',
|
|
60
|
+
'command(sed)',
|
|
61
|
+
'command(sort)',
|
|
62
|
+
'command(uniq)',
|
|
63
|
+
'command(diff)',
|
|
64
|
+
'command(cut)',
|
|
65
|
+
'command(tr)',
|
|
66
|
+
'command(basename)',
|
|
67
|
+
'command(dirname)',
|
|
68
|
+
'command(realpath)',
|
|
69
|
+
'command(which)',
|
|
70
|
+
'command(echo)',
|
|
71
|
+
'command(printf)',
|
|
72
|
+
'command(test)',
|
|
73
|
+
'command(true)',
|
|
74
|
+
'command(false)',
|
|
75
|
+
'command(mkdir)',
|
|
76
|
+
'command(touch)',
|
|
77
|
+
'command(cp)',
|
|
78
|
+
'command(mv)',
|
|
79
|
+
'command(rm)',
|
|
80
|
+
'command(python3 -c)',
|
|
81
|
+
'command(python -c)',
|
|
82
|
+
'command(node -e)',
|
|
83
|
+
'command(bash -c)',
|
|
84
|
+
'command(sh -c)',
|
|
85
|
+
'command(python -m pytest)',
|
|
86
|
+
'command(./gradlew)',
|
|
87
|
+
'command(gradle)',
|
|
88
|
+
'command(mvn)',
|
|
89
|
+
'command(npm test)',
|
|
90
|
+
'command(npm run)',
|
|
91
|
+
'command(javac)',
|
|
92
|
+
'command(java)',
|
|
93
|
+
],
|
|
94
|
+
// Everything here can be lifted, rule by rule, through the project
|
|
95
|
+
// ceiling's `exceptions` (0.3.0). Grouped by why it is denied by default:
|
|
96
|
+
deny: [
|
|
97
|
+
// network / remote: data can leave the machine
|
|
98
|
+
'command(curl)',
|
|
99
|
+
'command(wget)',
|
|
100
|
+
'command(ssh)',
|
|
101
|
+
'command(scp)',
|
|
102
|
+
'command(git push)',
|
|
103
|
+
// privilege / containers
|
|
104
|
+
'command(sudo)',
|
|
105
|
+
'command(docker)',
|
|
106
|
+
// destructive
|
|
107
|
+
'command(rm -rf)',
|
|
108
|
+
'command(git reset --hard)',
|
|
109
|
+
'command(git clean)',
|
|
110
|
+
'command(git filter-branch)',
|
|
111
|
+
'command(git branch -D)',
|
|
112
|
+
'command(git stash drop)',
|
|
113
|
+
'command(git remote add)',
|
|
114
|
+
'command(git remote set-url)',
|
|
115
|
+
'command(git config --global)',
|
|
116
|
+
'command(git checkout -- .)',
|
|
117
|
+
'command(git restore .)',
|
|
118
|
+
'command(git restore --staged .)',
|
|
119
|
+
// installs
|
|
120
|
+
'command(pip install)',
|
|
121
|
+
'command(npm install)',
|
|
122
|
+
],
|
|
123
|
+
bypassSandbox: true,
|
|
124
|
+
allowInterpreters: true,
|
|
125
|
+
},
|
|
126
|
+
});
|
|
127
|
+
/** @throws {import('../contract/errors.js').ValidationError} listing the valid profiles. */
|
|
128
|
+
export function getProfile(name) {
|
|
129
|
+
const def = PROFILES[name];
|
|
130
|
+
if (!def) {
|
|
131
|
+
throw new ValidationError({
|
|
132
|
+
field: 'profile',
|
|
133
|
+
value: name,
|
|
134
|
+
expected: 'a known profile',
|
|
135
|
+
allowed: Object.keys(PROFILES),
|
|
136
|
+
});
|
|
137
|
+
}
|
|
138
|
+
return def;
|
|
139
|
+
}
|
|
140
|
+
/**
|
|
141
|
+
* Merge profile ceiling, human ceiling, and client request into the policy the
|
|
142
|
+
* gate will read.
|
|
143
|
+
*
|
|
144
|
+
* Direction is fixed throughout: a client only ever narrows within what the
|
|
145
|
+
* human ceiling grants, and the human ceiling only ever narrows within (or
|
|
146
|
+
* adds alongside) what the profile permits — nothing here can widen past
|
|
147
|
+
* `HARD_DENY`. Concretely:
|
|
148
|
+
*
|
|
149
|
+
* - `allow` = intersection of `requested.allow` (or, absent, everything) with
|
|
150
|
+
* `profile.allow ∪ ceiling.allow` (the "allow ceiling"). Rejected
|
|
151
|
+
* entries land in `rejected_allow`.
|
|
152
|
+
* - `deny` = union of `profile.deny`, `HARD_DENY`, `ceiling.deny`, and
|
|
153
|
+
* `requested.deny`. A client can only add to it, never remove from it.
|
|
154
|
+
* - `sandbox` = strictest of profile (`agy` on research_readonly), ceiling
|
|
155
|
+
* `sandbox`, and request `sandbox` / `sandboxed`; `bypass_sandbox` and
|
|
156
|
+
* `sandbox_forced_by` are derived from it.
|
|
157
|
+
* - `add_dirs` = when `requested.read_roots` is absent, all entries
|
|
158
|
+
* from `ceiling.read_roots` resolved via `additionalDirRoot`; when
|
|
159
|
+
* present, the requested list filtered to entries matching some glob in
|
|
160
|
+
* `ceiling.read_roots`. Non-matching entries land in `rejected_read_roots`.
|
|
161
|
+
*
|
|
162
|
+
* An absent `requested.allow` (as opposed to an empty array) means "no
|
|
163
|
+
* narrowing requested" — the caller gets the full allow ceiling.
|
|
164
|
+
*/
|
|
165
|
+
export function resolvePolicy(input) {
|
|
166
|
+
const def = getProfile(input.profile);
|
|
167
|
+
const workspace = canonicalize(input.workspace);
|
|
168
|
+
const substitute = (rule) => rule.replaceAll('{workspace}', workspace);
|
|
169
|
+
const ceiling = input.ceiling ?? EMPTY_CEILING;
|
|
170
|
+
const ceilingAllow = [...def.allow, ...ceiling.allow].map(substitute);
|
|
171
|
+
// HARD_DENY carries `write_file({workspace}/.agents/**)` (I6), so it needs
|
|
172
|
+
// the same substitution the allow ceiling already got — unsubstituted, the
|
|
173
|
+
// literal string `{workspace}` would never match any real path.
|
|
174
|
+
const hardDeny = HARD_DENY.map(substitute);
|
|
175
|
+
let allow;
|
|
176
|
+
let rejectedAllow;
|
|
177
|
+
if (input.requested?.allow === undefined) {
|
|
178
|
+
allow = ceilingAllow;
|
|
179
|
+
rejectedAllow = [];
|
|
180
|
+
}
|
|
181
|
+
else {
|
|
182
|
+
const { allowed, rejected } = intersectAllow(input.requested.allow, ceilingAllow);
|
|
183
|
+
allow = allowed;
|
|
184
|
+
rejectedAllow = rejected;
|
|
185
|
+
}
|
|
186
|
+
// `exceptions` (0.3.0): the human ceiling lifts profile deny rules by exact
|
|
187
|
+
// string match — `command(git)` does not lift `command(git push)`, so no
|
|
188
|
+
// specificity comparison is needed. HARD_DENY is unioned *after* the
|
|
189
|
+
// subtraction and `loadCeiling` already refuses a file naming one of its
|
|
190
|
+
// rules, so nothing here can widen past it. `research_readonly` ignores
|
|
191
|
+
// exceptions entirely: a read-only profile has nothing to lift.
|
|
192
|
+
const exceptions = def.write ? new Set(ceiling.exceptions) : new Set();
|
|
193
|
+
const profileDeny = def.deny.filter((rule) => !exceptions.has(rule));
|
|
194
|
+
const lifted = def.deny.filter((rule) => exceptions.has(rule));
|
|
195
|
+
const ignoredExceptions = ceiling.exceptions.filter((rule) => !def.deny.includes(rule));
|
|
196
|
+
const deny = Array.from(new Set([
|
|
197
|
+
...profileDeny,
|
|
198
|
+
...hardDeny,
|
|
199
|
+
...ceiling.deny.map(substitute),
|
|
200
|
+
...(input.requested?.deny ?? []),
|
|
201
|
+
]));
|
|
202
|
+
// `sandbox` (0.3.0 PR6): the strictest of profile / ceiling / request wins,
|
|
203
|
+
// ordered none < seatbelt < agy. research_readonly is always `agy` (the OS
|
|
204
|
+
// enforces read-only for free, 0.2.1). `bypass_sandbox` / `sandbox_forced_by`
|
|
205
|
+
// are derived views the gate and broker already read (I2).
|
|
206
|
+
const requestedSandbox = input.requested?.sandbox ?? (input.requested?.sandboxed ? 'agy' : null);
|
|
207
|
+
let sandbox;
|
|
208
|
+
let sandboxSource;
|
|
209
|
+
if (!def.write) {
|
|
210
|
+
sandbox = 'agy';
|
|
211
|
+
sandboxSource = 'profile';
|
|
212
|
+
}
|
|
213
|
+
else {
|
|
214
|
+
sandbox = 'none';
|
|
215
|
+
sandboxSource = 'default';
|
|
216
|
+
if (SANDBOX_RANK[ceiling.sandbox] > SANDBOX_RANK[sandbox]) {
|
|
217
|
+
sandbox = ceiling.sandbox;
|
|
218
|
+
sandboxSource = 'ceiling';
|
|
219
|
+
}
|
|
220
|
+
if (requestedSandbox !== null && SANDBOX_RANK[requestedSandbox] > SANDBOX_RANK[sandbox]) {
|
|
221
|
+
sandbox = requestedSandbox;
|
|
222
|
+
sandboxSource = 'request';
|
|
223
|
+
}
|
|
224
|
+
}
|
|
225
|
+
if (sandbox === 'seatbelt' && !seatbeltAvailable()) {
|
|
226
|
+
throw new ValidationError({
|
|
227
|
+
field: 'sandbox',
|
|
228
|
+
value: 'seatbelt',
|
|
229
|
+
expected: `sandbox-exec is macOS only (platform ${process.platform}); set sandbox to "none" or "agy" in ${sandboxSource === 'ceiling' ? 'the project ceiling' : 'permissions.sandbox'}`,
|
|
230
|
+
});
|
|
231
|
+
}
|
|
232
|
+
const bypassSandbox = sandbox !== 'agy';
|
|
233
|
+
const sandboxForcedBy = sandbox === 'agy' && sandboxSource !== 'default' ? sandboxSource : null;
|
|
234
|
+
// `read_roots` (0.2.2 PR4, renamed 0.3.0): applied from ceiling by default when absent.
|
|
235
|
+
// When present, narrows within ceiling globs (subset only).
|
|
236
|
+
const additionalDirs = [];
|
|
237
|
+
const rejectedAdditionalDirs = [];
|
|
238
|
+
const warnings = [...ceiling.warnings];
|
|
239
|
+
if (!def.write && ceiling.exceptions.length > 0) {
|
|
240
|
+
warnings.push(`ceiling exceptions do not apply to ${def.name} (read-only profiles have no deny rules to lift)`);
|
|
241
|
+
}
|
|
242
|
+
for (const rule of ignoredExceptions) {
|
|
243
|
+
if (def.write)
|
|
244
|
+
warnings.push(`ceiling exceptions entry ${rule} is not in ${def.name}'s deny list and was ignored`);
|
|
245
|
+
}
|
|
246
|
+
let additionalDirsSource;
|
|
247
|
+
if (input.requested?.read_roots === undefined) {
|
|
248
|
+
for (const pattern of ceiling.read_roots) {
|
|
249
|
+
const root = additionalDirRoot(pattern);
|
|
250
|
+
if (root !== null) {
|
|
251
|
+
if (!additionalDirs.includes(root)) {
|
|
252
|
+
additionalDirs.push(root);
|
|
253
|
+
}
|
|
254
|
+
}
|
|
255
|
+
else {
|
|
256
|
+
warnings.push(`ceiling read_roots entry ${pattern} does not exist and was skipped`);
|
|
257
|
+
}
|
|
258
|
+
}
|
|
259
|
+
additionalDirsSource = additionalDirs.length > 0 ? 'ceiling' : 'none';
|
|
260
|
+
}
|
|
261
|
+
else {
|
|
262
|
+
for (const raw of input.requested.read_roots) {
|
|
263
|
+
const resolved = resolveRequestedDir(raw);
|
|
264
|
+
if (additionalDirCovered(ceiling, resolved)) {
|
|
265
|
+
if (!additionalDirs.includes(resolved)) {
|
|
266
|
+
additionalDirs.push(resolved);
|
|
267
|
+
}
|
|
268
|
+
}
|
|
269
|
+
else {
|
|
270
|
+
rejectedAdditionalDirs.push(raw);
|
|
271
|
+
}
|
|
272
|
+
}
|
|
273
|
+
additionalDirsSource = 'request';
|
|
274
|
+
}
|
|
275
|
+
const roots = buildRoots(workspace, additionalDirs);
|
|
276
|
+
// Ceiling `write_roots` widen containment (and the seatbelt) beyond the
|
|
277
|
+
// workspace. A write root is also readable — you cannot edit what you
|
|
278
|
+
// cannot see — so it joins read_roots too.
|
|
279
|
+
const writeRoots = Array.from(new Set([...roots.write, ...ceiling.write_roots]));
|
|
280
|
+
const readRoots = Array.from(new Set([...roots.read, ...ceiling.write_roots]));
|
|
281
|
+
const seatbeltWriteRoots = Array.from(new Set([...writeRoots, ...seatbeltImplicitWriteRoots()]));
|
|
282
|
+
return {
|
|
283
|
+
profile: def.name,
|
|
284
|
+
workspace,
|
|
285
|
+
read_roots: readRoots,
|
|
286
|
+
write_roots: writeRoots,
|
|
287
|
+
allow,
|
|
288
|
+
deny,
|
|
289
|
+
sandbox,
|
|
290
|
+
sandbox_source: sandboxSource,
|
|
291
|
+
seatbelt_write_roots: seatbeltWriteRoots,
|
|
292
|
+
bypass_sandbox: bypassSandbox,
|
|
293
|
+
sandbox_forced_by: sandboxForcedBy,
|
|
294
|
+
add_dirs: additionalDirs,
|
|
295
|
+
add_dirs_source: additionalDirsSource,
|
|
296
|
+
command_policy: ceiling.command_policy,
|
|
297
|
+
ceiling_present: ceiling.present,
|
|
298
|
+
ceiling_path: ceiling.path,
|
|
299
|
+
policy_version: 3,
|
|
300
|
+
on_denial: input.onDenial ?? 'continue',
|
|
301
|
+
max_denials: input.maxDenials ?? null,
|
|
302
|
+
lifted: lifted.map(substitute),
|
|
303
|
+
rejected_allow: rejectedAllow,
|
|
304
|
+
rejected_read_roots: rejectedAdditionalDirs,
|
|
305
|
+
warnings: warnings.length > 0 ? warnings : undefined,
|
|
306
|
+
};
|
|
307
|
+
}
|
|
308
|
+
/** Descriptor list for `agy_capabilities`. */
|
|
309
|
+
export function describeProfiles() {
|
|
310
|
+
return Object.values(PROFILES).map((def) => ({
|
|
311
|
+
name: def.name,
|
|
312
|
+
description: def.description,
|
|
313
|
+
write: def.write,
|
|
314
|
+
bypass_sandbox: def.bypassSandbox,
|
|
315
|
+
}));
|
|
316
|
+
}
|
|
317
|
+
//# sourceMappingURL=profiles.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/policy/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAQnD,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,GAEpB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAA;AAE7E,MAAM,YAAY,GAAgC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAA;AA0BlF,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAA0C,MAAM,CAAC,MAAM,CAAC;IAC3E,iBAAiB,EAAE;QACjB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,qLAAqL;QACvL,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE;YACL,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;YACxE,0CAA0C;YAC1C,wBAAwB;YACxB,2BAA2B;YAC3B,8BAA8B;YAC9B,aAAa;YACb,aAAa;YACb,cAAc;YACd,aAAa;SACd;QACD,IAAI,EAAE,CAAC,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU,CAAC;QACvF,aAAa,EAAE,KAAK;QACpB,iBAAiB,EAAE,KAAK;KACzB;IACD,cAAc,EAAE;QACd,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,0pCAA0pC;QAC5pC,KAAK,EAAE,IAAI;QACX,uEAAuE;QACvE,2DAA2D;QAC3D,uEAAuE;QACvE,uEAAuE;QACvE,kCAAkC;QAClC,KAAK,EAAE;YACL,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;YACxE,0CAA0C;YAC1C,wBAAwB;YACxB,2BAA2B;YAC3B,4BAA4B;YAC5B,cAAc;YACd,aAAa;YACb,cAAc;YACd,eAAe;YACf,eAAe;YACf,aAAa;YACb,eAAe;YACf,aAAa;YACb,eAAe;YACf,eAAe;YACf,cAAc;YACd,eAAe;YACf,eAAe;YACf,eAAe;YACf,cAAc;YACd,aAAa;YACb,mBAAmB;YACnB,kBAAkB;YAClB,mBAAmB;YACnB,gBAAgB;YAChB,eAAe;YACf,iBAAiB;YACjB,eAAe;YACf,eAAe;YACf,gBAAgB;YAChB,gBAAgB;YAChB,gBAAgB;YAChB,aAAa;YACb,aAAa;YACb,aAAa;YACb,qBAAqB;YACrB,oBAAoB;YACpB,kBAAkB;YAClB,kBAAkB;YAClB,gBAAgB;YAChB,2BAA2B;YAC3B,oBAAoB;YACpB,iBAAiB;YACjB,cAAc;YACd,mBAAmB;YACnB,kBAAkB;YAClB,gBAAgB;YAChB,eAAe;SAChB;QACD,mEAAmE;QACnE,0EAA0E;QAC1E,IAAI,EAAE;YACJ,+CAA+C;YAC/C,eAAe;YACf,eAAe;YACf,cAAc;YACd,cAAc;YACd,mBAAmB;YACnB,yBAAyB;YACzB,eAAe;YACf,iBAAiB;YACjB,cAAc;YACd,iBAAiB;YACjB,2BAA2B;YAC3B,oBAAoB;YACpB,4BAA4B;YAC5B,wBAAwB;YACxB,yBAAyB;YACzB,yBAAyB;YACzB,6BAA6B;YAC7B,8BAA8B;YAC9B,4BAA4B;YAC5B,wBAAwB;YACxB,iCAAiC;YACjC,WAAW;YACX,sBAAsB;YACtB,sBAAsB;SACvB;QACD,aAAa,EAAE,IAAI;QACnB,iBAAiB,EAAE,IAAI;KACxB;CACF,CAAC,CAAA;AAEF,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,GAAG,GAAI,QAAuC,CAAC,IAAI,CAAC,CAAA;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,eAAe,CAAC;YACxB,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAC/C,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,aAAa,CAAA;IAC9C,MAAM,YAAY,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACrE,2EAA2E;IAC3E,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAE1C,IAAI,KAAe,CAAA;IACnB,IAAI,aAAuB,CAAA;IAC3B,IAAI,KAAK,CAAC,SAAS,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACzC,KAAK,GAAG,YAAY,CAAA;QACpB,aAAa,GAAG,EAAE,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;QACjF,KAAK,GAAG,OAAO,CAAA;QACf,aAAa,GAAG,QAAQ,CAAA;IAC1B,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAA;IAC9E,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9D,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACvF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CACrB,IAAI,GAAG,CAAC;QACN,GAAG,WAAW;QACd,GAAG,QAAQ;QACX,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;KACjC,CAAC,CACH,CAAA;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,2DAA2D;IAC3D,MAAM,gBAAgB,GACpB,KAAK,CAAC,SAAS,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACzE,IAAI,OAAoB,CAAA;IACxB,IAAI,aAA4D,CAAA;IAChE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAA;QACf,aAAa,GAAG,SAAS,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,CAAA;QAChB,aAAa,GAAG,SAAS,CAAA;QACzB,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;YACzB,aAAa,GAAG,SAAS,CAAA;QAC3B,CAAC;QACD,IAAI,gBAAgB,KAAK,IAAI,IAAI,YAAY,CAAC,gBAAgB,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YACxF,OAAO,GAAG,gBAAgB,CAAA;YAC1B,aAAa,GAAG,SAAS,CAAA;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,eAAe,CAAC;YACxB,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,wCAAwC,OAAO,CAAC,QAAQ,wCAAwC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB,EAAE;SACxL,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,KAAK,KAAK,CAAA;IACvC,MAAM,eAAe,GAAG,OAAO,KAAK,KAAK,IAAI,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IAE/F,wFAAwF;IACxF,4DAA4D;IAC5D,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,sBAAsB,GAAa,EAAE,CAAA;IAC3C,MAAM,QAAQ,GAAa,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,sCAAsC,GAAG,CAAC,IAAI,kDAAkD,CAAC,CAAA;IACjH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,4BAA4B,IAAI,cAAc,GAAG,CAAC,IAAI,8BAA8B,CAAC,CAAA;IACpH,CAAC;IACD,IAAI,oBAAoD,CAAA;IAExD,IAAI,KAAK,CAAC,SAAS,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9C,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC3B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,4BAA4B,OAAO,iCAAiC,CAAC,CAAA;YACrF,CAAC;QACH,CAAC;QACD,oBAAoB,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;IACvE,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;YACzC,IAAI,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBAC/B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;QACD,oBAAoB,GAAG,SAAS,CAAA;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IACnD,wEAAwE;IACxE,sEAAsE;IACtE,2CAA2C;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAChF,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAC9E,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,0BAA0B,EAAE,CAAC,CAAC,CAAC,CAAA;IAEhG,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,SAAS;QACT,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,UAAU;QACvB,KAAK;QACL,IAAI;QACJ,OAAO;QACP,cAAc,EAAE,aAAa;QAC7B,oBAAoB,EAAE,kBAAkB;QACxC,cAAc,EAAE,aAAa;QAC7B,iBAAiB,EAAE,eAAe;QAClC,QAAQ,EAAE,cAAc;QACxB,eAAe,EAAE,oBAAoB;QACrC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,OAAO,CAAC,OAAO;QAChC,YAAY,EAAE,OAAO,CAAC,IAAI;QAC1B,cAAc,EAAE,CAAC;QACjB,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,UAAU;QACvC,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACrC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QAC9B,cAAc,EAAE,aAAa;QAC7B,mBAAmB,EAAE,sBAAsB;QAC3C,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACrD,CAAA;AACH,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB;IAM9B,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,cAAc,EAAE,GAAG,CAAC,aAAa;KAClC,CAAC,CAAC,CAAA;AACL,CAAC"}
|