botmux 3.4.3 → 3.5.2

package/dist/adapters/cli/read-isolation.js

@@ -19,7 +19,6 @@
  * multi-bot cred file; each bot's lark-cli config holds its app secret in
  * plaintext). See the design doc for the two-layer rationale.
  */
-import { managedOriginCapabilityPath } from '../../core/managed-origin-capability.js';
 import { DEVICE_AUTHORITY_DIRECTORY, DEVICE_CREDENTIAL_FILE, DEVICE_ENROLLMENT_JOURNAL_FILE, } from '../../platform/device-paths.js';
 /** Normalize a path for the deny/allow lists: require ABSOLUTE, strip trailing
  *  slashes, reject `..` traversal. Returns null for anything unusable so the
@@ -94,15 +93,11 @@ export function buildCliExecutableReadCarveOuts(input) {
         return [];
     return [standaloneRoot];
 }
-/** Root-level host authority files retained for machine binding/back-compat.
- * They live outside every per-bot BOT_HOME, so no chat-driven CLI may read or
- * rotate them. New device secrets live below DEVICE_AUTHORITY_DIRECTORY and
- * are masked by directory, so future filenames/atomic sidecars need no policy
- * update. */
+/** Host device-authority files must never be visible to a chat-driven CLI.
+ * New credentials live below DEVICE_AUTHORITY_DIRECTORY; the exact legacy
+ * files remain covered for upgrades from older layouts. */
 export const HOST_DEVICE_CREDENTIAL_FILES = [
     'platform.json',
-    // Pre-dedicated-directory builds. Keep exact + sidecar policy so an upgrade
-    // never exposes a legacy credential left at BOTMUX_HOME root.
     DEVICE_CREDENTIAL_FILE,
     DEVICE_ENROLLMENT_JOURNAL_FILE,
 ];
@@ -113,15 +108,12 @@ function hostDeviceAuthorityPaths(root) {
         ...HOST_DEVICE_CREDENTIAL_FILES.map(file => `${root}/${file}`),
     ];
 }
-/** Fixed authority marker. It deliberately ignores SESSION_DATA_DIR and every
- * child-controlled env value: enrollment writes this under the real user home
- * before credentials exist, then workers treat it as a one-way security gate. */
+/** Fixed host marker; deliberately independent of SESSION_DATA_DIR and child env. */
 export function deviceCredentialIsolationMarkerPath(homeDir) {
     return `${homeDir.replace(/\/+$/, '')}/.botmux/${DEVICE_CREDENTIAL_ISOLATION_MARKER_BASENAME}`;
 }
-/** A root entry hidden by credential-only isolation. Prefix matching lets the
- * worker include current atomic-write sidecars and legacy backups; arbitrary
- * future device files are covered wholesale by DEVICE_AUTHORITY_DIRECTORY. */
+/** Match current atomic-write sidecars and legacy backups as well as the
+ * dedicated authority directory. */
 export function isCredentialIsolationReservedBasename(name) {
     return name === DEVICE_AUTHORITY_DIRECTORY
         || name === DEVICE_CREDENTIAL_ISOLATION_MARKER_BASENAME
@@ -131,12 +123,8 @@ export function isCredentialIsolationReservedBasename(name) {
 export function credentialIsolationRequired(input) {
     return input.markerExists || input.deviceCredentialExists;
 }
-/**
- * Resolve the mandatory credential boundary independently of optional/full
- * read isolation. There is intentionally no adapter capability or bot sandbox
- * toggle input: once the marker/device exists, every locally spawned CLI must
- * be covered even when `supportsReadIsolation=false` and `sandbox=false`.
- */
+/** Mandatory device-credential isolation is independent of the optional bot
+ * sandbox toggle: once enrolled, every local child must be confined. */
 export function evaluateCredentialOnlyIsolationGate(input) {
     const required = credentialIsolationRequired(input);
     if (!required)
@@ -163,6 +151,11 @@ export function evaluateCredentialOnlyIsolationGate(input) {
     }
     return { required: true, mode: input.platform === 'darwin' ? 'seatbelt' : 'bwrap' };
 }
+function escapeForRegex(p) {
+    return p.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** Legacy credential-only Seatbelt/bwrap rule shape. Full fs-policy sessions
+ * consume the same authority paths through buildFsPolicy instead. */
 export function buildCredentialIsolationRules(ctx) {
     const h = ctx.homeDir.replace(/\/+$/, '');
     const bh = ctx.botmuxHome.replace(/\/+$/, '');
@@ -178,423 +171,9 @@ export function buildCredentialIsolationRules(ctx) {
         denyRegexes: dedupe(denyRegexes),
         denyWritePaths: dedupe([...credentialPaths, markerPath]),
         denyWriteRegexes: dedupe(denyRegexes),
-        // Prevent replacing a credential root symlink/directory to escape the
-        // canonical path rules. Literal does not deny unrelated descendants.
         denyWriteLiterals: roots,
     };
 }
-/** v2 DENY set (HYBRID). The F1 fix is a WHOLE-deny of the CLI data dirs `~/.claude`
- *  (+ `~/.claude.json`) and `~/.codex`: this bot's OWN CLI data is redirected into its
- *  BOT_HOME (readable) via CLAUDE_CONFIG_DIR/CODEX_HOME, so whole-denying the globals
- *  blocks the admin/other/pre-migration data + kills the per-cwd carve-out + /cd hole,
- *  while own resume/memory keep working from BOT_HOME. `~/.botmux` is NOT whole-denied
- *  (the agent's botmux CLI needs its config/registry/pm2/data structure) — instead its
- *  cross-bot-SENSITIVE parts are denied surgically: bots.json, logs, other bots' lark
- *  configs / session files / send-creds / BOT_HOMEs, and the shared conversation-content
- *  dirs (frozen-cards, queues, attachments, whiteboards, …). Own BOT_HOME + own
- *  session/cred + own attachments bucket + config/registry stay readable by default.
- *  Plus the system-credential stores. Everything else (code/repos/runtime) stays open.
- *
- *  NOTE: per-bot session stores (`sessions-<appId>.json`) are denied by PATTERN — see
- *  {@link buildV2DenyRegexes} — so no sibling-appId enumeration is needed anywhere. */
-export function buildV2DenyPaths(ctx) {
-    const h = ctx.homeDir.replace(/\/+$/, '');
-    const bh = ctx.botmuxHome.replace(/\/+$/, '');
-    const sd = ctx.sessionDataDir.replace(/\/+$/, '');
-    const defaultBh = (ctx.defaultBotmuxHome ?? `${h}/.botmux`).replace(/\/+$/, '');
-    return dedupe([
-        // ── F1: whole-deny the CLI data dirs (own is redirected to BOT_HOME) ──
-        `${h}/.claude`,
-        `${h}/.claude.json`,
-        `${h}/.codex`,
-        // ── System credential / secret stores (broad, since outside is open by default) ──
-        `${h}/.ssh`,
-        `${h}/.aws`,
-        `${h}/.azure`,
-        `${h}/.gnupg`,
-        `${h}/.netrc`,
-        `${h}/.config/gh`,
-        `${h}/.config/glab-cli`,
-        `${h}/.config/gcloud`,
-        `${h}/.config/op`,
-        `${h}/.config/1Password`,
-        `${h}/.1password`,
-        `${h}/.password-store`,
-        `${h}/.git-credentials`,
-        `${h}/.npmrc`,
-        `${h}/.pypirc`,
-        `${h}/.docker/config.json`,
-        `${h}/.kube`,
-        `${h}/Library/Keychains`,
-        // ── botmux SENSITIVE (surgical — leave config/registry/pm2/data structure readable) ──
-        `${bh}/bots.json`, // ALL bots' secrets
-        `${bh}/logs`, // daemon logs (cross-bot content)
-        `${h}/.lark-cli`, // default lark config (may hold creds)
-        // WHOLESALE-deny the per-bot lark config dir (same rationale as bots/ below): a
-        // newly-added bot is covered without cold-restart, and `ls .lark-cli-bots/` can't
-        // enumerate siblings. Own is re-allowed via buildV2CarveOuts (+ traverse shim).
-        `${h}/.lark-cli-bots`,
-        // WHOLESALE-deny the bots/ dir (every sibling BOT_HOME + their send-cred). Own is
-        // re-allowed via buildV2CarveOuts (allow subpath own + file-read-metadata traverse
-        // shim so the CLI can realpath its redirected config). Denying the DIR (not each
-        // sibling appId) means a NEWLY-ADDED bot is covered WITHOUT cold-restarting this
-        // one, and `ls bots/` can't enumerate siblings.
-        `${bh}/bots`,
-        `${sd}/sessions.json`, // legacy shared store
-        `${sd}/frozen-cards`, // conversation content (all bots')
-        `${sd}/turn-sends`, // CLI only APPENDS markers here — read-deny is safe
-        `${sd}/crash-diagnostics`,
-        // Long Pi first prompts may contain the full hidden routing/identity
-        // context. Deny the shared root, then the worker carves back only this
-        // session's private subdirectory.
-        `${sd}/pi-initial-prompts`,
-        // All bots' Feishu-uploaded files. Own per-appId bucket (attachments/<self>/) is
-        // re-allowed via buildV2CarveOuts; siblings' buckets + the legacy flat
-        // per-messageId layout stay denied.
-        `${sd}/attachments`,
-        // whiteboards/ is deliberately NOT denied (owner decision): whiteboards are
-        // shared content, meant to be visible across the bots that collaborate on
-        // them. NOTE the store is currently GLOBAL (no per-chat scoping), so a
-        // sandboxed bot can `whiteboard list`/`read` boards from other chats too —
-        // an accepted tradeoff until whiteboards are bucketed by chat/appId. Also
-        // un-denying the read avoids the read-modify-write clobber a deny would cause.
-        // Queued inbound messages (queues/<rootMessageId>.jsonl = full LarkMessage
-        // content for EVERY bot). Daemon-side only — the CLI never reads it.
-        `${sd}/queues`,
-        // Seatbelt profiles + reattach markers: filenames/rules enumerate sibling
-        // session ids and appIds. sandbox-exec parses the profile BEFORE applying it,
-        // and the markers are read by the daemon — the sandboxed CLI never reads these.
-        `${sd}/read-isolation`,
-        // Worker PID markers contain every live session/turn/attempt tuple. They
-        // are routing metadata, never a credential, and isolated CLIs now use an
-        // exact per-session capability carve-out for fresh turn context.
-        `${sd}/.botmux-cli-pids`,
-        // NOTE: schedules.json is deliberately NOT denied. It's a read-modify-write
-        // store: denying the read makes a sandboxed `botmux schedule` load an empty
-        // map and then overwrite the shared file, silently wiping EVERY bot's tasks
-        // (read-modify-write degraded to write-only). We accept the minor leak
-        // (isolated bots can read others' scheduled prompts) until schedule-store
-        // fail-closes on read errors (ENOENT vs EPERM). See PR #387 review.
-        `${bh}/feishu-session.json`, // Feishu web login session (setup automation) — can mint bots
-        // Machine + device bearer/refresh credentials belong to the trusted host.
-        // Deny both the fixed ~/.botmux location used by platform binding and the
-        // configured BOTMUX_HOME so a custom SESSION_DATA_DIR cannot create a gap.
-        ...[defaultBh, bh].flatMap(hostDeviceAuthorityPaths),
-        `${defaultBh}/${DEVICE_CREDENTIAL_ISOLATION_MARKER_BASENAME}`,
-        // The dashboard admin credentials. `.dashboard-secret` signs the loopback-HMAC
-        // that gates `/__cli/rotate` AND the daemon-IPC write-link routes — the ipc-server
-        // comment (dashboard-ipc-server.ts) explicitly relies on the sandbox hiding it to
-        // "keep a sandboxed worker from minting write tokens" for sessions it doesn't own
-        // (a cross-bot escalation reachable by a semi-trusted conversant driving the agent).
-        // Only owner-facing admin verbs (`botmux dashboard`/`term-link`) sign with it — the
-        // agent's send/list/status never do, so denying it costs the agent nothing. Its
-        // sibling `.dashboard-token` (dashboard bearer) is denied for the same reason;
-        // `.dashboard-port` is just a port number (no credential value) → left readable.
-        // The dashboard IPC secret/token live at the fixed default home even
-        // when SESSION_DATA_DIR points at a custom BOTMUX_HOME. Deny both roots:
-        // the fixed real credential location and the custom runtime root.
-        `${defaultBh}/.dashboard-secret`,
-        `${defaultBh}/.dashboard-token`,
-        `${bh}/.dashboard-secret`,
-        `${bh}/.dashboard-token`,
-        // NOTE: extraDenyPaths (readDenyExtraPaths) are NOT here — they go to
-        // buildV2CarveOuts().finalDenyPaths so they win over the own-BOT_HOME allow.
-    ]
-        .map(normalizeIsolationPath)
-        .filter((p) => !!p));
-}
-/** Escape a literal path for embedding in a Seatbelt regex filter. */
-function escapeForRegex(p) {
-    return p.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-/** v2 PATTERN denies — Seatbelt `regex` filters that deny a whole FILENAME CLASS
- *  instead of enumerating sibling app ids. Covers:
- *   - per-bot session stores (`<sd>/sessions-<appId>.json`, routing metadata): a
- *     newly-added bot's store is denied WITHOUT cold-restarting the ones already
- *     running, and no caller needs to know the sibling app ids. The bot's OWN store
- *     is re-allowed by carve-out (Seatbelt last-match).
- *   - EVERY `bots.json.*` sidecar (`.bak` written by setup/migration, `.tmp`, ad-hoc
- *     `.bak.<suffix>` copies): the exact `bots.json` is subpath-denied in
- *     {@link buildV2DenyPaths}, but its backups carry the SAME plaintext
- *     larkAppSecret for every bot under a DIFFERENT basename, which `subpath` does
- *     not match — so without this an isolated bot could `cat bots.json.bak` and
- *     recover all siblings' credentials, defeating the whole isolation. */
-export function buildV2DenyRegexes(ctx) {
-    const sd = ctx.sessionDataDir.replace(/\/+$/, '');
-    const bh = ctx.botmuxHome.replace(/\/+$/, '');
-    const h = ctx.homeDir.replace(/\/+$/, '');
-    const defaultBh = (ctx.defaultBotmuxHome ?? `${h}/.botmux`).replace(/\/+$/, '');
-    const botmuxRoots = dedupe([defaultBh, bh]);
-    return dedupe([
-        `^${escapeForRegex(sd)}/sessions-[^/]+\\.json$`,
-        // Any `bots.json.` sidecar (backups/temp) — trailing dot so it matches
-        // bots.json.bak / .tmp / .bak.<suffix> but NOT the exact bots.json (that is
-        // the subpath deny's job) and NOT an unrelated `bots.jsonx`.
-        `^${escapeForRegex(bh)}/bots\\.json\\.`,
-        // LEGACY pre-BOT_HOME send-cred files (`<sd>/.send-cred-<appId>`): current
-        // builds write send-cred.json inside BOT_HOME, but leftovers from older
-        // builds still carry live per-bot send credentials at the data root.
-        `^${escapeForRegex(sd)}/\\.send-cred-`,
-        // Per-bot user display-name caches (`identities-<appId>.json`): open_id→name
-        // PII of every bot's interlocutors. The CLI never reads them (daemon-side
-        // prompt injection only), so the OWN file gets NO carve-out — the whole
-        // filename class is denied.
-        `^${escapeForRegex(sd)}/identities-[^/]+\\.json$`,
-        // Secret/token creation and atomic rotation use sibling temp files. Deny
-        // the whole basename class at both the fixed and custom roots so a live
-        // isolated process cannot race-read a fully populated temp inode.
-        ...botmuxRoots.flatMap(root => [
-            ...HOST_DEVICE_CREDENTIAL_FILES.map(file => `^${escapeForRegex(root)}/${escapeForRegex(file)}(?:\\.|$)`),
-            `^${escapeForRegex(root)}/\\.dashboard-secret(?:\\.|$)`,
-            `^${escapeForRegex(root)}/\\.dashboard-token(?:\\.|$)`,
-            `^${escapeForRegex(root)}/plugins/[^/]+/private(?:/|$)`,
-            `^${escapeForRegex(root)}/plugins/[^/]+/dist/mcp/index\\.json$`,
-        ]),
-        `^${escapeForRegex(defaultBh)}/${escapeForRegex(DEVICE_CREDENTIAL_ISOLATION_MARKER_BASENAME)}(?:\\.|$)`,
-        `^${escapeForRegex(sd)}/sessions/[^/]+/plugin-mcp-runtime\\.json$`,
-    ]);
-}
-/** Host-owned authority files that a read-isolated child must not mutate.
- * Read isolation otherwise keeps normal write access for backwards
- * compatibility, so these rules are emitted after every other write allow. */
-export function buildReadIsolationProtectedWriteRules(ctx, extraRoots = {}) {
-    const h = ctx.homeDir.replace(/\/+$/, '');
-    const bh = ctx.botmuxHome.replace(/\/+$/, '');
-    const sd = ctx.sessionDataDir.replace(/\/+$/, '');
-    const defaultBh = (ctx.defaultBotmuxHome ?? `${h}/.botmux`).replace(/\/+$/, '');
-    const dashboardRoots = dedupe([
-        defaultBh,
-        bh,
-        ...(extraRoots.dashboardRoots ?? []).map(root => root.replace(/\/+$/, '')),
-    ]);
-    const sessionDataDirs = dedupe([
-        sd,
-        ...(extraRoots.sessionDataDirs ?? []).map(root => root.replace(/\/+$/, '')),
-    ]);
-    return {
-        denyWritePaths: dedupe([
-            ...dashboardRoots.flatMap(root => [
-                `${root}/.dashboard-secret`,
-                `${root}/.dashboard-token`,
-                ...hostDeviceAuthorityPaths(root),
-            ]),
-            `${defaultBh}/${DEVICE_CREDENTIAL_ISOLATION_MARKER_BASENAME}`,
-            ...sessionDataDirs.flatMap(root => [
-                `${root}/.botmux-cli-pids`,
-                `${root}/read-isolation`,
-            ]),
-        ]),
-        denyWriteRegexes: dedupe([
-            ...dashboardRoots.flatMap(root => [
-                ...HOST_DEVICE_CREDENTIAL_FILES.map(file => `^${escapeForRegex(root)}/${escapeForRegex(file)}(?:\\.|$)`),
-                `^${escapeForRegex(root)}/\\.dashboard-secret(?:\\.|$)`,
-                `^${escapeForRegex(root)}/\\.dashboard-token(?:\\.|$)`,
-                `^${escapeForRegex(root)}/plugins/[^/]+/private(?:/|$)`,
-                `^${escapeForRegex(root)}/plugins/[^/]+/dist/mcp/index\\.json$`,
-            ]),
-            ...sessionDataDirs.map(root => `^${escapeForRegex(root)}/sessions/[^/]+/plugin-mcp-runtime\\.json$`),
-            `^${escapeForRegex(defaultBh)}/${escapeForRegex(DEVICE_CREDENTIAL_ISOLATION_MARKER_BASENAME)}(?:\\.|$)`,
-        ]),
-        // Prevent replacing an entire authority-bearing root to sidestep the
-        // exact/regex child rules. `literal` protects only the directory entry;
-        // ordinary writes to unrelated descendants remain available.
-        denyWriteLiterals: dedupe([...dashboardRoots, ...sessionDataDirs]),
-    };
-}
-/** The v2 Seatbelt carve-outs that accompany {@link buildV2DenyPaths} +
- *  {@link buildV2DenyRegexes}. They re-open the bot's OWN slice of each denied class:
- *   - allowPaths: the own BOT_HOME subpath (redirected CLI data + creds + send-cred),
- *     the own lark-cli config dir, and the own session store file.
- *   - traverseDirs: `bots/` etc., as file-read-metadata ONLY — lets the CLI realpath()
- *     its config dir THROUGH the denied parent WITHOUT allowing `ls bots/` (enumeration).
- *   - finalDenyPaths: admin `readDenyExtraPaths`, emitted AFTER the allows so an admin
- *     deny UNDER the own BOT_HOME still wins (Seatbelt last-match). */
-export function buildV2CarveOuts(ctx) {
-    const bh = ctx.botmuxHome.replace(/\/+$/, '');
-    const sd = ctx.sessionDataDir.replace(/\/+$/, '');
-    const h = ctx.homeDir.replace(/\/+$/, '');
-    const self = assertSafeAppId(ctx.currentAppId);
-    return {
-        // Re-open the bot's OWN slice of each wholesale/pattern-denied per-bot class.
-        allowPaths: [
-            botHomePath(bh, self),
-            `${h}/.lark-cli-bots/${self}`,
-            // Own routing metadata (`botmux send` reads it to route replies); siblings'
-            // stay denied by the buildV2DenyRegexes filename pattern.
-            `${sd}/sessions-${self}.json`,
-            // Own Feishu-upload bucket (attachments/<appId>/<messageId>/…) — the agent must
-            // read files the user uploads in chat. getAttachmentsDir keys the bucket on the
-            // appId precisely so this spawn-time-static carve-out can exist.
-            `${sd}/attachments/${self}`,
-            // Parent read-isolation/ stays wholesale-denied; only this session's
-            // rotating origin capability is visible to the confined CLI.
-            managedOriginCapabilityPath(sd, ctx.currentSessionId),
-        ],
-        // file-read-metadata on the wholesale-denied parents so the CLI/skill can realpath()
-        // through them WITHOUT `ls` (enumeration) leaking.
-        traverseDirs: [
-            `${bh}/bots`, `${h}/.lark-cli-bots`, `${sd}/attachments`, `${sd}/read-isolation`,
-        ],
-        finalDenyPaths: (ctx.extraDenyPaths ?? [])
-            .map(normalizeIsolationPath)
-            .filter((p) => !!p),
-    };
-}
-/**
- * Write-isolation rules for the macOS file sandbox — the FUNCTIONAL twin of the
- * Linux bwrap overlay (which lets the agent read the whole real FS but confines
- * WRITES). Seatbelt has no copy-on-write overlay, so we approximate the same
- * guarantee with a deny-all-writes + allow-list: the agent can write its project
- * and the ephemeral scratch/cache the CLI needs, but CANNOT tamper the rest of
- * your real disk (home dotfiles, other projects, other bots' data, system dirs).
- * Reads stay wide open (like Linux) — this is orthogonal to read isolation, which
- * layers its own read-deny set into the SAME profile when also enabled.
- *
- * `allowWritePaths` re-open the writable zones AFTER the profile's `(deny
- * file-write* (subpath "/"))`; `denyWritePaths` are crown jewels re-denied AFTER
- * the allows (Seatbelt last-match), so they stay protected even if the project or
- * an allowed zone nests them. The allow-list is intentionally generous toward
- * CLI scratch/cache — the exact set is empirically tuned on real macOS (a missing
- * cache path makes the CLI fail, an over-broad one weakens the sandbox). Pure: the
- * worker realpath's every path (symlink-safe) before emitting.
- */
-export function buildWriteSandboxRules(ctx) {
-    const h = ctx.homeDir.replace(/\/+$/, '');
-    const bh = ctx.botmuxHome.replace(/\/+$/, '');
-    const sd = ctx.sessionDataDir.replace(/\/+$/, '');
-    const defaultBh = (ctx.defaultBotmuxHome ?? `${h}/.botmux`).replace(/\/+$/, '');
-    const wd = ctx.workingDir.replace(/\/+$/, '');
-    const keep = (arr) => dedupe(arr.map(normalizeIsolationPath).filter((p) => !!p));
-    return {
-        allowWritePaths: keep([
-            // The project — writes here PERSIST (no overlay/landing step; direct like a
-            // non-sandboxed run would, only nothing OUTSIDE the allow-list can be touched).
-            wd,
-            // Own BOT_HOME — where read isolation redirects the CLI's data when co-enabled;
-            // harmless to allow when write-sandbox is standalone (dir just won't exist).
-            botHomePath(bh, ctx.currentAppId),
-            // CLI data dirs (write-sandbox standalone leaves them at the real path).
-            `${h}/.claude`, `${h}/.claude.json`, `${h}/.codex`,
-            // Claude Code's updater/OAuth refresh uses sibling lock directories rather
-            // than placing every state file under ~/.claude. Without these, a valid
-            // login can fail to refresh because lock acquisition returns EPERM.
-            `${h}/.claude.lock`, `${h}/.claude.json.lock`,
-            `${h}/.local/state/claude`,
-            // Ephemeral scratch / caches every CLI + spawned tool (git, npm, node) needs.
-            `${h}/Library/Caches`,
-            `${h}/Library/Application Support`,
-            `${h}/.cache`,
-            `${h}/.npm`,
-            '/private/var/folders', // macOS per-user TMPDIR / DARWIN_USER_TEMP_DIR root
-            '/private/tmp', '/tmp', '/var/tmp',
-            '/dev', // ptys, /dev/null, /dev/tty — required to run at all
-            ...(ctx.extraWritePaths ?? []),
-        ]),
-        allowWriteRegexes: [
-            // Claude Code saves ~/.claude.json atomically through a PID/random-suffixed
-            // sibling (e.g. .claude.json.tmp.1234.abcd). A subpath rule for the exact
-            // state file cannot match those siblings, so allow only that basename class
-            // at the home root — not arbitrary home dotfiles.
-            `^${escapeForRegex(h)}/\\.claude\\.json\\.tmp\\.[^/]+$`,
-        ],
-        denyWritePaths: keep([
-            // Crown jewels — re-denied AFTER the allows so a semi-trusted operator can't
-            // plant an ssh key or tamper another bot's creds even if the project/home
-            // nests these. (Most already fall under deny-by-default; this is the guard for
-            // a broad workingDir and defence-in-depth.)
-            `${h}/.ssh`, `${h}/.aws`, `${h}/.gnupg`,
-            `${bh}/bots.json`,
-            `${bh}/feishu-session.json`,
-            `${defaultBh}/.dashboard-secret`, `${defaultBh}/.dashboard-token`,
-            `${bh}/.dashboard-secret`, `${bh}/.dashboard-token`,
-            ...[defaultBh, bh].flatMap(hostDeviceAuthorityPaths),
-            `${defaultBh}/${DEVICE_CREDENTIAL_ISOLATION_MARKER_BASENAME}`,
-            `${sd}/.botmux-cli-pids`, `${sd}/read-isolation`,
-        ]),
-        // Atomic credential writes use `<name>.<pid>.<random>.tmp` beside the
-        // target. Protect the whole basename class so a broad project/home allow
-        // cannot stage and rename a replacement around the exact-file deny.
-        denyWriteRegexes: dedupe([defaultBh, bh].flatMap(root => HOST_DEVICE_CREDENTIAL_FILES.map(file => `^${escapeForRegex(root)}/${escapeForRegex(file)}(?:\\.|$)`)).concat(`^${escapeForRegex(defaultBh)}/${escapeForRegex(DEVICE_CREDENTIAL_ISOLATION_MARKER_BASENAME)}(?:\\.|$)`)),
-    };
-}
-/**
- * The bwrap MASK set for Linux read isolation — the functional twin of the macOS
- * Seatbelt read-deny profile ({@link buildV2DenyPaths} + regexes + carve-outs),
- * expressed for bwrap (which blanks paths with tmpfs/empty-binds and has no regex).
- *
- * SAME cross-bot-sensitive set as macOS, but the per-bot classes (other bots'
- * BOT_HOMEs / lark configs / session stores / identities / send-creds / attachment
- * buckets) are enumerated PER SIBLING instead of wholesale-denied + regex-matched.
- * The read-isolation-specific set does not mask the bot's OWN slice. The file
- * sandbox still masks BOTMUX_HOME wholesale as its mandatory credential
- * boundary, so `ownReadWritePaths` re-opens only this bot's BOT_HOME after that
- * parent mask; the worker separately re-masks send-cred.json.
- *
- * Pure: the worker resolves the impure inputs (sibling list, sidecar glob, realpath).
- * NOTE: keep the `shared` set in lock-step with {@link buildV2DenyPaths} — the
- * `read-isolation.test.ts` parity test fails if a sensitive path is added to one
- * platform but not the other.
- */
-export function buildLinuxReadIsolationMasks(input) {
-    const { ctx } = input;
-    const h = ctx.homeDir.replace(/\/+$/, '');
-    const bh = ctx.botmuxHome.replace(/\/+$/, '');
-    const sd = ctx.sessionDataDir.replace(/\/+$/, '');
-    const defaultBh = (ctx.defaultBotmuxHome ?? `${h}/.botmux`).replace(/\/+$/, '');
-    const self = assertSafeAppId(ctx.currentAppId);
-    const keep = (arr) => dedupe(arr.map(normalizeIsolationPath).filter((p) => !!p));
-    // Cross-bot-sensitive paths handled WHOLESALE (not per-bot, OR a per-bot dir with
-    // a non-enumerable layout) — MUST mirror the same entries in buildV2DenyPaths.
-    const shared = [
-        `${h}/.claude`, `${h}/.claude.json`, `${h}/.codex`,
-        `${h}/.ssh`, `${h}/.aws`, `${h}/.azure`, `${h}/.gnupg`, `${h}/.netrc`,
-        `${h}/.config/gh`, `${h}/.config/glab-cli`, `${h}/.config/gcloud`, `${h}/.config/op`,
-        `${h}/.config/1Password`, `${h}/.1password`, `${h}/.password-store`,
-        `${h}/.git-credentials`, `${h}/.npmrc`, `${h}/.pypirc`, `${h}/.docker/config.json`, `${h}/.kube`,
-        `${h}/Library/Keychains`,
-        `${bh}/bots.json`, `${bh}/logs`, `${h}/.lark-cli`,
-        `${bh}/feishu-session.json`,
-        `${defaultBh}/.dashboard-secret`, `${defaultBh}/.dashboard-token`,
-        `${bh}/.dashboard-secret`, `${bh}/.dashboard-token`,
-        ...[defaultBh, bh].flatMap(hostDeviceAuthorityPaths),
-        `${defaultBh}/${DEVICE_CREDENTIAL_ISOLATION_MARKER_BASENAME}`,
-        `${sd}/sessions.json`, `${sd}/frozen-cards`, `${sd}/turn-sends`,
-        `${sd}/crash-diagnostics`, `${sd}/queues`, `${sd}/read-isolation`,
-        `${sd}/pi-initial-prompts`,
-        `${sd}/.botmux-cli-pids`,
-        // attachments/ is masked WHOLESALE (like macOS) — covers every sibling bucket
-        // AND the legacy flat per-messageId layout (which per-sibling enumeration can't
-        // reach); the OWN bucket is re-exposed read-only via ownReadOnlyPaths below.
-        `${sd}/attachments`,
-        // schedules.json + whiteboards deliberately NOT masked (same owner decision as
-        // macOS: RMW-clobber / shared content).
-    ];
-    // Per-sibling enumeration for the classes macOS covers by REGEX (bwrap has none):
-    // other bots' BOT_HOMEs, lark configs, session stores, identities, send-creds. Own
-    // BOT_HOME + lark + session stay UNMASKED by this per-bot set (the outer file
-    // sandbox still masks BOTMUX_HOME wholesale and re-opens only own BOT_HOME).
-    // identities/send-cred get NO own carve-out — the
-    // CLI never reads them (daemon-side) — so the own ones are masked too.
-    const perBot = [];
-    for (const raw of input.siblingAppIds) {
-        let sib;
-        try {
-            sib = assertSafeAppId(raw);
-        }
-        catch {
-            continue;
-        }
-        if (sib === self)
-            continue;
-        perBot.push(`${bh}/bots/${sib}`, `${h}/.lark-cli-bots/${sib}`, `${sd}/sessions-${sib}.json`, `${sd}/identities-${sib}.json`, `${sd}/.send-cred-${sib}`);
-    }
-    perBot.push(`${sd}/identities-${self}.json`, `${sd}/.send-cred-${self}`);
-    return {
-        hidePaths: keep([...shared, ...perBot, ...(input.botsJsonSidecars ?? [])]),
-        ownReadWritePaths: keep([botHomePath(bh, self)]),
-        ownReadOnlyPaths: keep([`${sd}/attachments/${self}`]),
-    };
-}
 /**
  * Decide whether read isolation is enabled for a session, or fail-closed.
  * Pure: the caller resolves the impure inputs. This is the SINGLE decision
@@ -618,55 +197,22 @@ export function evaluateReadIsolationGate(opts) {
         return { enabled: false, failClosedReason: 'missing SESSION_DATA_DIR' };
     return { enabled: true };
 }
-/**
- * macOS Seatbelt (sandbox-exec) profile for the whole-process isolation wrapper.
- * Blocklist: allow everything, deny reads of the sensitive paths/patterns, THEN
- * re-allow the carve-outs — `subpath` covers a file or a whole subtree. Rule ORDER
- * matters: Seatbelt applies the LAST matching rule, so an allow listed AFTER a
- * broader deny re-opens that subpath, and the final denies win over the allows.
- * Verified: reads of denied paths fail EPERM; carved-out subpaths read normally; the
- * wrapped CLI (which bypasses its OWN sandbox — nested Seatbelt would hang) runs fine.
- */
-export function buildSeatbeltProfile(denyPaths, allowPaths = [], finalDenyPaths = [], traverseDirs = [], denyRegexes = [], 
-/** When set, layer the macOS file-sandbox WRITE isolation (Linux-bwrap twin) into
- *  the SAME profile: deny all writes, re-allow the writable zones, then final-deny
- *  the crown jewels. Reads are unaffected. Omit for read-isolation-only sessions. */
-writeSandbox, 
-/** Host-owned files that must remain immutable even for legacy read-only
- * isolation (where writes are otherwise unrestricted). Emitted last so they
- * also win over a broad write-sandbox allow. */
-protectedWrites) {
+/** Legacy allow-default profile retained only for mandatory credential-only
+ * confinement when the full fs-policy sandbox is disabled. */
+export function buildSeatbeltProfile(denyPaths, allowPaths = [], finalDenyPaths = [], traverseDirs = [], denyRegexes = [], writeSandbox, protectedWrites) {
     const esc = (p) => p.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
-    // Regex literals (#"…") pass backslashes RAW to the regex engine — do NOT
-    // double-escape them. A `"` would terminate the literal; swap it for `.`
-    // (single-char wildcard that still matches the quote) instead of breaking syntax.
     const escRe = (r) => r.replace(/"/g, '.');
     const lines = ['(version 1)', '(allow default)'];
     for (const p of denyPaths)
         lines.push(`(deny file-read* (subpath "${esc(p)}"))`);
-    // Filename-pattern denies (e.g. every bot's sessions-<appId>.json) — no sibling
-    // enumeration; the own file is re-opened by an allow below (last-match).
     for (const r of denyRegexes)
         lines.push(`(deny file-read* (regex #"${escRe(r)}"))`);
-    // Traversal metadata-allows: a carve-out under a DENIED parent (e.g. BOT_HOME under
-    // ~/.botmux) is reachable for a plain open (Seatbelt matches the final path), but a
-    // realpath()/stat of an INTERMEDIATE dir is denied — which crashes CLIs that
-    // canonicalize their config dir (Codex: "failed to canonicalize CODEX_HOME"). Allow
-    // read-METADATA (stat/traverse) on those specific ancestor DIRS only (literal, not
-    // subpath) — dir LISTING (read-data) stays denied, so no enumeration leak.
     for (const p of traverseDirs)
         lines.push(`(allow file-read-metadata (literal "${esc(p)}"))`);
-    // Carve-outs override the broad denies above (Seatbelt applies the LAST match).
     for (const p of allowPaths)
         lines.push(`(allow file-read* (subpath "${esc(p)}"))`);
-    // FINAL denies win over the carve-outs — admin `readDenyExtraPaths` must hold even
-    // for a path that falls under the bot's own re-allowed BOT_HOME.
     for (const p of finalDenyPaths)
         lines.push(`(deny file-read* (subpath "${esc(p)}"))`);
-    // ── Write isolation (macOS file sandbox): deny ALL writes, re-allow the writable
-    // zones, then re-deny the crown jewels. Ordered AFTER the read rules but they are
-    // an independent operation class (file-write* vs file-read*), so they never
-    // interact with the read allow/deny above. Emitted only when write-sandbox is on.
     if (writeSandbox) {
         lines.push('(deny file-write* (subpath "/"))');
         for (const p of writeSandbox.allowWritePaths)
@@ -689,12 +235,8 @@ protectedWrites) {
     }
     return lines.join('\n') + '\n';
 }
-// Version 7 records the exact confinement capabilities attached to a live
-// process. A credential-only pane is safe to reattach while the bot remains in
-// credential-only mode, but must cold-spawn if full read/write isolation is
-// enabled later. A version alone cannot express that strengthening transition.
-// Version 6 was intentionally skipped to avoid colliding with an experimental
-// marker layout that briefly shipped in intermediate device-isolation branches.
+// A marker records which confinement capabilities are attached to the live
+// process. Credential-only panes must cold-spawn when a full sandbox is enabled.
 export const ISOLATION_PANE_MARKER_VERSION = 7;
 const ALL_ISOLATION_CAPABILITIES = [
     'credential',
@@ -705,7 +247,6 @@ function normalizeIsolationCapabilities(capabilities) {
     const requested = new Set(capabilities);
     return ALL_ISOLATION_CAPABILITIES.filter(capability => requested.has(capability));
 }
-/** Versioned marker written beside a freshly spawned persistent sandbox. */
 export function isolationPaneMarkerContent(bootId, capabilities) {
     return JSON.stringify({
         version: ISOLATION_PANE_MARKER_VERSION,

package/dist/adapters/cli/read-isolation.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-isolation.js","sourceRoot":"","sources":["../../../src/adapters/cli/read-isolation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AAExC;;;8EAG8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,CAAS;IAC9C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;wBAawB;AACxB,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,KAAa;IACpE,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9E,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,iBAAiB,CAAC;AAC5D,CAAC;AAED;;;uFAGuF;AACvF,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,wFAAwF;IACxF,wFAAwF;IACxF,8CAA8C;IAC9C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;+EAE+E;AAC/E,MAAM,UAAU,WAAW,CAAC,UAAkB,EAAE,KAAa;IAC3D,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAI/C;IACC,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,GAAG,CAAC,6BAA6B,CAAC;IACzD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,cAAc,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACzF,OAAO,CAAC,cAAc,CAAC,CAAC;AAC1B,CAAC;AAyBD;;;;aAIa;AACb,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,eAAe;IACf,4EAA4E;IAC5E,8DAA8D;IAC9D,sBAAsB;IACtB,8BAA8B;CACtB,CAAC;AACX,MAAM,CAAC,MAAM,2CAA2C,GAAG,8BAA8B,CAAC;AAE1F,SAAS,wBAAwB,CAAC,IAAY;IAC5C,OAAO;QACL,GAAG,IAAI,IAAI,0BAA0B,EAAE;QACvC,GAAG,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,2CAA2C,EAAE,CAAC;AACjG,CAAC;AAED;;8EAE8E;AAC9E,MAAM,UAAU,qCAAqC,CAAC,IAAY;IAChE,OAAO,IAAI,KAAK,0BAA0B;WACrC,IAAI,KAAK,2CAA2C;WACpD,IAAI,CAAC,UAAU,CAAC,GAAG,2CAA2C,GAAG,CAAC;WAClE,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACC,OAAO,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,sBAAsB,CAAC;AAC5D,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,KAQnD;IACC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC1E,IAAI,KAAK,CAAC,8BAA8B;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACrF,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9D,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,SAAS;YACf,gBAAgB,EAAE,uCAAuC,KAAK,CAAC,QAAQ,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC9B,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,SAAS;YACf,gBAAgB,EAAE,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAC3C,CAAC,CAAC,6BAA6B;gBAC/B,CAAC,CAAC,2BAA2B;SAChC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AACtF,CAAC;AAQD,MAAM,UAAU,6BAA6B,CAAC,GAA+B;IAQ3E,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,2CAA2C,EAAE,CAAC;IACjF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CACvC,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACtC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,WAAW,CAAC,IAAI,CACd,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,2CAA2C,CAAC,WAAW,CACxG,CAAC;IACF,OAAO;QACL,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,CAAC,GAAG,eAAe,EAAE,UAAU,CAAC,CAAC;QACnD,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC;QAChC,cAAc,EAAE,MAAM,CAAC,CAAC,GAAG,eAAe,EAAE,UAAU,CAAC,CAAC;QACxD,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC;QACrC,sEAAsE;QACtE,qEAAqE;QACrE,iBAAiB,EAAE,KAAK;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;uFAauF;AACvF,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,MAAM,CACX;QACE,yEAAyE;QACzE,GAAG,CAAC,UAAU;QACd,GAAG,CAAC,eAAe;QACnB,GAAG,CAAC,SAAS;QACb,oFAAoF;QACpF,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,aAAa;QACjB,GAAG,CAAC,mBAAmB;QACvB,GAAG,CAAC,iBAAiB;QACrB,GAAG,CAAC,aAAa;QACjB,GAAG,CAAC,oBAAoB;QACxB,GAAG,CAAC,aAAa;QACjB,GAAG,CAAC,kBAAkB;QACtB,GAAG,CAAC,mBAAmB;QACvB,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,UAAU;QACd,GAAG,CAAC,sBAAsB;QAC1B,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,oBAAoB;QACxB,wFAAwF;QACxF,GAAG,EAAE,YAAY,EAAgB,oBAAoB;QACrD,GAAG,EAAE,OAAO,EAAqB,kCAAkC;QACnE,GAAG,CAAC,YAAY,EAAiB,uCAAuC;QACxE,gFAAgF;QAChF,kFAAkF;QAClF,gFAAgF;QAChF,GAAG,CAAC,iBAAiB;QACrB,kFAAkF;QAClF,mFAAmF;QACnF,iFAAiF;QACjF,iFAAiF;QACjF,gDAAgD;QAChD,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,gBAAgB,EAAY,sBAAsB;QACvD,GAAG,EAAE,eAAe,EAAa,mCAAmC;QACpE,GAAG,EAAE,aAAa,EAAe,oDAAoD;QACrF,GAAG,EAAE,oBAAoB;QACzB,qEAAqE;QACrE,uEAAuE;QACvE,kCAAkC;QAClC,GAAG,EAAE,qBAAqB;QAC1B,iFAAiF;QACjF,uEAAuE;QACvE,oCAAoC;QACpC,GAAG,EAAE,cAAc;QACnB,4EAA4E;QAC5E,0EAA0E;QAC1E,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,+EAA+E;QAC/E,2EAA2E;QAC3E,qEAAqE;QACrE,GAAG,EAAE,SAAS;QACd,0EAA0E;QAC1E,8EAA8E;QAC9E,gFAAgF;QAChF,GAAG,EAAE,iBAAiB;QACtB,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,GAAG,EAAE,mBAAmB;QACxB,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,oEAAoE;QACpE,GAAG,EAAE,sBAAsB,EAAM,8DAA8D;QAC/F,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;QACpD,GAAG,SAAS,IAAI,2CAA2C,EAAE;QAC7D,+EAA+E;QAC/E,mFAAmF;QACnF,kFAAkF;QAClF,kFAAkF;QAClF,qFAAqF;QACrF,oFAAoF;QACpF,gFAAgF;QAChF,+EAA+E;QAC/E,iFAAiF;QACjF,qEAAqE;QACrE,yEAAyE;QACzE,kEAAkE;QAClE,GAAG,SAAS,oBAAoB;QAChC,GAAG,SAAS,mBAAmB;QAC/B,GAAG,EAAE,oBAAoB;QACzB,GAAG,EAAE,mBAAmB;QACxB,sEAAsE;QACtE,6EAA6E;KAC9E;SACE,GAAG,CAAC,sBAAsB,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;2EAW2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC;QACZ,IAAI,cAAc,CAAC,EAAE,CAAC,yBAAyB;QAC/C,uEAAuE;QACvE,4EAA4E;QAC5E,6DAA6D;QAC7D,IAAI,cAAc,CAAC,EAAE,CAAC,iBAAiB;QACvC,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,cAAc,CAAC,EAAE,CAAC,gBAAgB;QACtC,6EAA6E;QAC7E,0EAA0E;QAC1E,wEAAwE;QACxE,4BAA4B;QAC5B,IAAI,cAAc,CAAC,EAAE,CAAC,2BAA2B;QACjD,yEAAyE;QACzE,wEAAwE;QACxE,kEAAkE;QAClE,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,GAAG,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACzC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9D,IAAI,cAAc,CAAC,IAAI,CAAC,+BAA+B;YACvD,IAAI,cAAc,CAAC,IAAI,CAAC,8BAA8B;YACtD,IAAI,cAAc,CAAC,IAAI,CAAC,+BAA+B;YACvD,IAAI,cAAc,CAAC,IAAI,CAAC,uCAAuC;SAChE,CAAC;QACF,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,2CAA2C,CAAC,WAAW;QACvG,IAAI,cAAc,CAAC,EAAE,CAAC,4CAA4C;KACnE,CAAC,CAAC;AACL,CAAC;AAED;;8EAE8E;AAC9E,MAAM,UAAU,qCAAqC,CACnD,GAAuB,EACvB,aAAwE,EAAE;IAM1E,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,SAAS;QACT,EAAE;QACF,GAAG,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;KAC3E,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,EAAE;QACF,GAAG,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;KAC5E,CAAC,CAAC;IACH,OAAO;QACL,cAAc,EAAE,MAAM,CAAC;YACrB,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,GAAG,IAAI,oBAAoB;gBAC3B,GAAG,IAAI,mBAAmB;gBAC1B,GAAG,wBAAwB,CAAC,IAAI,CAAC;aAClC,CAAC;YACF,GAAG,SAAS,IAAI,2CAA2C,EAAE;YAC7D,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,GAAG,IAAI,mBAAmB;gBAC1B,GAAG,IAAI,iBAAiB;aACzB,CAAC;SACH,CAAC;QACF,gBAAgB,EAAE,MAAM,CAAC;YACvB,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,GAAG,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACzC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC9D,IAAI,cAAc,CAAC,IAAI,CAAC,+BAA+B;gBACvD,IAAI,cAAc,CAAC,IAAI,CAAC,8BAA8B;gBACtD,IAAI,cAAc,CAAC,IAAI,CAAC,+BAA+B;gBACvD,IAAI,cAAc,CAAC,IAAI,CAAC,uCAAuC;aAChE,CAAC;YACF,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAC5B,IAAI,cAAc,CAAC,IAAI,CAAC,4CAA4C,CAAC;YACvE,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,2CAA2C,CAAC,WAAW;SACxG,CAAC;QACF,qEAAqE;QACrE,wEAAwE;QACxE,6DAA6D;QAC7D,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,eAAe,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;;;;;;uEAOuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IAKtD,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/C,OAAO;QACL,8EAA8E;QAC9E,UAAU,EAAE;YACV,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC;YACrB,GAAG,CAAC,mBAAmB,IAAI,EAAE;YAC7B,4EAA4E;YAC5E,0DAA0D;YAC1D,GAAG,EAAE,aAAa,IAAI,OAAO;YAC7B,gFAAgF;YAChF,gFAAgF;YAChF,iEAAiE;YACjE,GAAG,EAAE,gBAAgB,IAAI,EAAE;YAC3B,qEAAqE;YACrE,6DAA6D;YAC7D,2BAA2B,CAAC,EAAE,EAAE,GAAG,CAAC,gBAAgB,CAAC;SACtD;QACD,qFAAqF;QACrF,mDAAmD;QACnD,YAAY,EAAE;YACZ,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,iBAAiB;SACjF;QACD,cAAc,EAAE,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;aACvC,GAAG,CAAC,sBAAsB,CAAC;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;KACnC,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAwB;IAM7D,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,GAAa,EAAE,EAAE,CAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO;QACL,eAAe,EAAE,IAAI,CAAC;YACpB,4EAA4E;YAC5E,gFAAgF;YAChF,EAAE;YACF,gFAAgF;YAChF,6EAA6E;YAC7E,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC;YACjC,yEAAyE;YACzE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,SAAS;YAClD,2EAA2E;YAC3E,wEAAwE;YACxE,oEAAoE;YACpE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,oBAAoB;YAC7C,GAAG,CAAC,sBAAsB;YAC1B,8EAA8E;YAC9E,GAAG,CAAC,iBAAiB;YACrB,GAAG,CAAC,8BAA8B;YAClC,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,OAAO;YACX,sBAAsB,EAAI,oDAAoD;YAC9E,cAAc,EAAE,MAAM,EAAE,UAAU;YAClC,MAAM,EAAoB,qDAAqD;YAC/E,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;SAC/B,CAAC;QACF,iBAAiB,EAAE;YACjB,4EAA4E;YAC5E,0EAA0E;YAC1E,4EAA4E;YAC5E,kDAAkD;YAClD,IAAI,cAAc,CAAC,CAAC,CAAC,kCAAkC;SACxD;QACD,cAAc,EAAE,IAAI,CAAC;YACnB,6EAA6E;YAC7E,0EAA0E;YAC1E,+EAA+E;YAC/E,4CAA4C;YAC5C,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS;YACvC,GAAG,EAAE,YAAY;YACjB,GAAG,EAAE,sBAAsB;YAC3B,GAAG,SAAS,oBAAoB,EAAE,GAAG,SAAS,mBAAmB;YACjE,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,mBAAmB;YACnD,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACpD,GAAG,SAAS,IAAI,2CAA2C,EAAE;YAC7D,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB;SACjD,CAAC;QACF,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,gBAAgB,EAAE,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CACtD,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACtC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CACtE,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,2CAA2C,CAAC,WAAW,CACxG,CAAC;KACH,CAAC;AACJ,CAAC;AAkBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAA8B;IAgBzE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtB,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,GAAa,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAExG,kFAAkF;IAClF,+EAA+E;IAC/E,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,SAAS;QAClD,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS;QACrE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,aAAa;QACpF,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,kBAAkB;QACnE,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,QAAQ;QAChG,GAAG,CAAC,oBAAoB;QACxB,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY;QACjD,GAAG,EAAE,sBAAsB;QAC3B,GAAG,SAAS,oBAAoB,EAAE,GAAG,SAAS,mBAAmB;QACjE,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,mBAAmB;QACnD,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;QACpD,GAAG,SAAS,IAAI,2CAA2C,EAAE;QAC7D,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa;QAC/D,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB;QACjE,GAAG,EAAE,qBAAqB;QAC1B,GAAG,EAAE,mBAAmB;QACxB,8EAA8E;QAC9E,gFAAgF;QAChF,6EAA6E;QAC7E,GAAG,EAAE,cAAc;QACnB,+EAA+E;QAC/E,wCAAwC;KACzC,CAAC;IAEF,kFAAkF;IAClF,mFAAmF;IACnF,8EAA8E;IAC9E,6EAA6E;IAC7E,kDAAkD;IAClD,uEAAuE;IACvE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YAAC,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QACvD,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,MAAM,CAAC,IAAI,CACT,GAAG,EAAE,SAAS,GAAG,EAAE,EACnB,GAAG,CAAC,mBAAmB,GAAG,EAAE,EAC5B,GAAG,EAAE,aAAa,GAAG,OAAO,EAC5B,GAAG,EAAE,eAAe,GAAG,OAAO,EAC9B,GAAG,EAAE,eAAe,GAAG,EAAE,CAC1B,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI,OAAO,EAAE,GAAG,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;IAEzE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1E,iBAAiB,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,gBAAgB,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAWzC;IACC,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,eAAe;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,iDAAiD,EAAE,CAAC;IACjG,IAAI,IAAI,CAAC,aAAa;QACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,yEAAyE,EAAE,CAAC;IACzH,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;QACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,iCAAiC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IAChG,IAAI,CAAC,IAAI,CAAC,iBAAiB;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,CAAC;IAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAmB,EACnB,aAAuB,EAAE,EACzB,iBAA2B,EAAE,EAC7B,eAAyB,EAAE,EAC3B,cAAwB,EAAE;AAC1B;;qFAEqF;AACrF,YAKC;AACD;;gDAEgD;AAChD,eAIC;IAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,kFAAkF;IAClF,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,8BAA8B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjF,gFAAgF;IAChF,yEAAyE;IACzE,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpF,oFAAoF;IACpF,oFAAoF;IACpF,6EAA6E;IAC7E,oFAAoF;IACpF,mFAAmF;IACnF,2EAA2E;IAC3E,KAAK,MAAM,CAAC,IAAI,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,uCAAuC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7F,gFAAgF;IAChF,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnF,mFAAmF;IACnF,iEAAiE;IACjE,KAAK,MAAM,CAAC,IAAI,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,8BAA8B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtF,kFAAkF;IAClF,kFAAkF;IAClF,4EAA4E;IAC5E,kFAAkF;IAClF,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,eAAe;YAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtG,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,iBAAiB,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/G,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,cAAc;YAAE,KAAK,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpG,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,gBAAgB,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,8BAA8B,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/G,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,cAAc,IAAI,EAAE,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,8BAA8B,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAI/C,MAAM,0BAA0B,GAAmC;IACjE,YAAY;IACZ,MAAM;IACN,OAAO;CACC,CAAC;AAEX,SAAS,8BAA8B,CACrC,YAA4C;IAE5C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B,CACxC,MAAc,EACd,YAA4C;IAE5C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,6BAA6B;QACtC,MAAM;QACN,YAAY,EAAE,8BAA8B,CAAC,YAAY,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAwC,EACxC,uBAAuD,EAAE;IAEzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAI5C,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;eAClC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CACvC,OAAO,UAAU,KAAK,QAAQ;mBAC3B,CAAC,0BAA0B,CAAC,QAAQ,CAAC,UAAiC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAqC,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,OAAO,KAAK,6BAA6B;eAClD,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;eACjC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;eAC/B,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,EAAY;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"read-isolation.js","sourceRoot":"","sources":["../../../src/adapters/cli/read-isolation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AAExC;;;8EAG8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,CAAS;IAC9C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;wBAawB;AACxB,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,KAAa;IACpE,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9E,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,iBAAiB,CAAC;AAC5D,CAAC;AAED;;;uFAGuF;AACvF,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,wFAAwF;IACxF,wFAAwF;IACxF,8CAA8C;IAC9C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;+EAE+E;AAC/E,MAAM,UAAU,WAAW,CAAC,UAAkB,EAAE,KAAa;IAC3D,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAI/C;IACC,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,GAAG,CAAC,6BAA6B,CAAC;IACzD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,cAAc,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACzF,OAAO,CAAC,cAAc,CAAC,CAAC;AAC1B,CAAC;AAED;;2DAE2D;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,eAAe;IACf,sBAAsB;IACtB,8BAA8B;CACtB,CAAC;AACX,MAAM,CAAC,MAAM,2CAA2C,GAAG,8BAA8B,CAAC;AAE1F,SAAS,wBAAwB,CAAC,IAAY;IAC5C,OAAO;QACL,GAAG,IAAI,IAAI,0BAA0B,EAAE;QACvC,GAAG,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,2CAA2C,EAAE,CAAC;AACjG,CAAC;AAED;oCACoC;AACpC,MAAM,UAAU,qCAAqC,CAAC,IAAY;IAChE,OAAO,IAAI,KAAK,0BAA0B;WACrC,IAAI,KAAK,2CAA2C;WACpD,IAAI,CAAC,UAAU,CAAC,GAAG,2CAA2C,GAAG,CAAC;WAClE,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACC,OAAO,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,sBAAsB,CAAC;AAC5D,CAAC;AASD;wEACwE;AACxE,MAAM,UAAU,mCAAmC,CAAC,KAOnD;IACC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC1E,IAAI,KAAK,CAAC,8BAA8B;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACrF,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9D,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,SAAS;YACf,gBAAgB,EAAE,uCAAuC,KAAK,CAAC,QAAQ,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC9B,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,SAAS;YACf,gBAAgB,EAAE,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAC3C,CAAC,CAAC,6BAA6B;gBAC/B,CAAC,CAAC,2BAA2B;SAChC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AACtF,CAAC;AAQD,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,6BAA6B,CAAC,GAA+B;IAQ3E,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,2CAA2C,EAAE,CAAC;IACjF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CACvC,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACtC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,WAAW,CAAC,IAAI,CACd,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,2CAA2C,CAAC,WAAW,CACxG,CAAC;IACF,OAAO;QACL,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,CAAC,GAAG,eAAe,EAAE,UAAU,CAAC,CAAC;QACnD,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC;QAChC,cAAc,EAAE,MAAM,CAAC,CAAC,GAAG,eAAe,EAAE,UAAU,CAAC,CAAC;QACxD,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,KAAK;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAWzC;IACC,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,eAAe;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,iDAAiD,EAAE,CAAC;IACjG,IAAI,IAAI,CAAC,aAAa;QACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,yEAAyE,EAAE,CAAC;IACzH,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;QACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,iCAAiC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IAChG,IAAI,CAAC,IAAI,CAAC,iBAAiB;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,CAAC;IAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;8DAC8D;AAC9D,MAAM,UAAU,oBAAoB,CAClC,SAAmB,EACnB,aAAuB,EAAE,EACzB,iBAA2B,EAAE,EAC7B,eAAyB,EAAE,EAC3B,cAAwB,EAAE,EAC1B,YAKC,EACD,eAIC;IAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,8BAA8B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpF,KAAK,MAAM,CAAC,IAAI,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,uCAAuC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7F,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnF,KAAK,MAAM,CAAC,IAAI,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,8BAA8B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtF,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,eAAe;YAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtG,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,iBAAiB,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/G,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,cAAc;YAAE,KAAK,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpG,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,gBAAgB,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,8BAA8B,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/G,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,cAAc,IAAI,EAAE,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,8BAA8B,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,2EAA2E;AAC3E,iFAAiF;AACjF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAI/C,MAAM,0BAA0B,GAAmC;IACjE,YAAY;IACZ,MAAM;IACN,OAAO;CACC,CAAC;AAEX,SAAS,8BAA8B,CACrC,YAA4C;IAE5C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAc,EACd,YAA4C;IAE5C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,6BAA6B;QACtC,MAAM;QACN,YAAY,EAAE,8BAA8B,CAAC,YAAY,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAwC,EACxC,uBAAuD,EAAE;IAEzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAI5C,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;eAClC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CACvC,OAAO,UAAU,KAAK,QAAQ;mBAC3B,CAAC,0BAA0B,CAAC,QAAQ,CAAC,UAAiC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAqC,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,OAAO,KAAK,6BAA6B;eAClD,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;eACjC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;eAC/B,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,EAAY;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC"}