crewly 1.20.153 → 1.20.155

package/dist/cli/backend/src/services/agent/control-plane-guard.service.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Control-plane guard for Claude Code agent sessions.
+ *
+ * Request 72c9427a, spec `specs/2026-09-24-control-plane-isolation.md` Part 3.
+ * The backend writes two files per session under
+ * `~/.crewly/runtime/control-plane/`:
+ *
+ * - `<session>.settings.json` — a Claude Code settings file with
+ *   `permissions.deny` rules for the control-plane paths and a PreToolUse
+ *   hook on the Bash tool. It is passed with `claude --settings <file>`.
+ * - `<session>.paths` — the protected-path list the hook script reads.
+ *
+ * Both files, and the hook script itself, are on their own deny list.
+ *
+ * Coverage (stated in the hook's output as well): this stops an agent editing
+ * the stop/start/config mechanisms with its normal tools, and accidental
+ * edits. It does NOT stop an interpreter one-liner, a runtime-built path, or a
+ * call to the loopback API. That needs OS-level isolation (spec Part 4).
+ */
+/** Roots the protected paths are resolved against. */
+export interface ControlPlaneRoots {
+    /** Crewly home directory (`~/.crewly`, or `$CREWLY_HOME`). */
+    crewlyHome: string;
+    /** Crewly install root (package dir or checkout) that holds `config/` and `dist/`. */
+    installRoot: string;
+    /** The agent's working directory / project path, when known. */
+    projectPath?: string;
+}
+/** Protected paths, split by what is denied. */
+export interface ControlPlanePaths {
+    /** Paths agents may not write. Directories protect their whole subtree. */
+    writeDenied: Array<{
+        path: string;
+        isDirectory: boolean;
+    }>;
+    /** Files agents may not read with the built-in Read/Grep/Glob tools. */
+    readDenied: string[];
+}
+/** One Claude Code hook group: an optional tool matcher and its commands. */
+export interface HookGroup {
+    matcher?: string;
+    hooks: Array<{
+        type: 'command';
+        command: string;
+    }>;
+}
+/** Shape of the generated Claude Code settings file (the subset we write). */
+export interface ControlPlaneSettings {
+    permissions: {
+        deny: string[];
+    };
+    hooks: {
+        /** The control-plane guard's Bash hook. Nothing else is ever added here. */
+        PreToolUse: Array<HookGroup & {
+            matcher: string;
+        }>;
+        /** Agent-status hook events (#815), present only when a status hook is given. */
+        [event: string]: HookGroup[];
+    };
+}
+/** Result of preparing the guard for one session. */
+export type ControlPlaneGuardResult = {
+    enabled: true;
+    settingsPath: string;
+    pathsPath: string;
+    protectedCount: number;
+} | {
+    enabled: false;
+    reason: string;
+};
+/**
+ * Whether the guard is on for sessions launched by this backend.
+ *
+ * Read from the backend's own environment at launch, so an agent session
+ * cannot switch it off: exporting the variable inside a session changes that
+ * shell, not the backend.
+ *
+ * @param env - Environment to read (defaults to the backend's process.env)
+ * @returns false only when `CREWLY_CONTROL_PLANE_GUARD=0`
+ */
+export declare function isControlPlaneGuardEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Resolve every control-plane path (spec Part 2 table) to an absolute path.
+ *
+ * Duplicates are dropped, e.g. when the project path is the install root.
+ *
+ * @param roots - Crewly home, install root and optional project path
+ * @param existingTeamIds - Team directory names to protect `config.json` for
+ *   (spec Part 2 protects `teams/*\/config.json`, not the whole `teams/`
+ *   subtree — a team directory also holds `norms/`, `wiki/`, `prompts/`,
+ *   `sops/` and `cron-tasks.json`, which agents write routinely). Pass the
+ *   ids returned by {@link listExistingTeamIds}; defaults to none, so
+ *   calling this without them protects no team config (documented, not a
+ *   silent gap — `prepareControlPlaneGuard` always supplies them).
+ * @returns Write-denied paths (with a directory flag) and read-denied files
+ *
+ * @example
+ * ```ts
+ * const { writeDenied } = resolveControlPlanePaths(
+ *   { crewlyHome: '/h/.crewly', installRoot: '/opt/crewly' },
+ *   ['team-0001'],
+ * );
+ * // writeDenied includes { path: '/h/.crewly/teams/team-0001/config.json', isDirectory: false }
+ * // writeDenied does NOT include '/h/.crewly/teams' itself — reads and
+ * // writes to team-0001/wiki, norms, prompts, sops, cron-tasks.json stay allowed.
+ * ```
+ */
+export declare function resolveControlPlanePaths(roots: ControlPlaneRoots, existingTeamIds?: readonly string[]): ControlPlanePaths;
+/**
+ * Format an absolute path as a Claude Code permission-rule specifier.
+ *
+ * In Claude Code rules `//x` is an absolute path, while `/x` is relative to
+ * the settings file, so an absolute path gets one extra leading slash.
+ *
+ * @param absPath - Absolute filesystem path
+ * @param isDirectory - Append `/**` to cover the subtree
+ * @returns Specifier such as `//Users/me/.crewly/teams/**`
+ */
+export declare function toRuleSpecifier(absPath: string, isDirectory: boolean): string;
+/**
+ * Build the Claude Code settings object for one session.
+ *
+ * Deny rules use `Edit(...)`, which Claude Code applies to every built-in
+ * file-editing tool (Edit, Write, NotebookEdit), and `Read(...)` for the API
+ * token. Only documented rule forms are emitted: an invalid rule could get
+ * the whole settings file rejected, and the Bash hook with it.
+ *
+ * The agent-status hook (#815) is merged into the same file, because Claude
+ * Code takes one `--settings`. It is registered only on its own events
+ * (Notification, PermissionRequest, Stop, UserPromptSubmit, PostToolUse) and
+ * never on PreToolUse, so the guard's entry and the deny list are identical
+ * with or without it.
+ *
+ * @param paths - Resolved control-plane paths
+ * @param hookCommand - Shell command that runs the PreToolUse Bash hook
+ * @param statusHookCommand - Shell command that runs the agent-status hook; omit to leave it out
+ * @returns Settings object ready to serialise
+ */
+export declare function buildControlPlaneSettings(paths: ControlPlanePaths, hookCommand: string, statusHookCommand?: string): ControlPlaneSettings;
+/**
+ * Make a session name safe to use as a file name.
+ *
+ * @param sessionName - Crewly session name
+ * @returns Name with anything outside `[A-Za-z0-9._-]` replaced by `_`
+ */
+export declare function toSafeFileStem(sessionName: string): string;
+/**
+ * Write the per-session settings file and protected-path list.
+ *
+ * @param sessionName - Crewly session name (used for the file names)
+ * @param roots - Crewly home, install root and optional project path
+ * @param env - Environment holding the kill switch (defaults to process.env)
+ * @returns Where the files were written, or why the guard is off
+ * @throws When the files cannot be written (the caller decides whether to launch unguarded)
+ */
+export declare function prepareControlPlaneGuard(sessionName: string, roots: ControlPlaneRoots, env?: NodeJS.ProcessEnv): Promise<ControlPlaneGuardResult>;
+/**
+ * Append `--settings <file>` to a Claude Code launch command.
+ *
+ * Only commands that carry `--dangerously-skip-permissions` (the Crewly agent
+ * launch line) are changed. A command that already passes `--settings` is
+ * left alone: the owner configured their own, and Claude Code takes one.
+ *
+ * @param cmd - Launch command line
+ * @param settingsPath - Generated settings file
+ * @returns The command with the flag appended, or unchanged
+ */
+export declare function applyControlPlaneSettingsFlag(cmd: string, settingsPath: string): string;
+//# sourceMappingURL=control-plane-guard.service.d.ts.map

package/dist/cli/backend/src/services/agent/control-plane-guard.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane-guard.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/agent/control-plane-guard.service.ts"],"names":[],"mappings":"AA2BA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IACjC,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IACjC,2EAA2E;IAC3E,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC3D,wEAAwE;IACxE,UAAU,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACpC,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChC,KAAK,EAAE;QACN,4EAA4E;QAC5E,UAAU,EAAE,KAAK,CAAC,SAAS,GAAG;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACnD,iFAAiF;QACjF,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC;KAC7B,CAAC;CACF;AAED,qDAAqD;AACrD,MAAM,MAAM,uBAAuB,GAChC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAClF;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAExF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,wBAAwB,CACvC,KAAK,EAAE,iBAAiB,EACxB,eAAe,GAAE,SAAS,MAAM,EAAO,GACrC,iBAAiB,CAwBnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAG7E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,iBAAiB,EACxB,WAAW,EAAE,MAAM,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACxB,oBAAoB,CA4BtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAG1D;AAYD;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC7C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAgClC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAKvF"}

package/dist/cli/backend/src/services/agent/control-plane-guard.service.js

@@ -0,0 +1,231 @@
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import { CONTROL_PLANE_GUARD_CONSTANTS, AGENT_STATUS_HOOK_CONSTANTS } from '../../constants.js';
+/**
+ * List the team directories that exist under `<crewlyHome>/teams` right now.
+ *
+ * The Bash hook needs literal paths, not globs, so protecting exactly
+ * `teams/*\/config.json` (spec Part 2) means resolving the `*` at guard-prep
+ * time against whatever teams already exist. A team created after this
+ * session launched is not yet in the list — out of scope for this fix,
+ * flagged in specs/2026-09-24-control-plane-isolation.md's coverage limits.
+ *
+ * @param crewlyHome - Crewly home directory (`~/.crewly`, or `$CREWLY_HOME`)
+ * @returns Directory names under `teams/` (team ids); empty if the directory
+ *   does not exist yet (a fresh install with no teams) or cannot be read
+ */
+async function listExistingTeamIds(crewlyHome) {
+    const teamsDir = path.join(crewlyHome, CONTROL_PLANE_GUARD_CONSTANTS.TEAMS_DIR_NAME);
+    try {
+        const entries = await fs.readdir(teamsDir, { withFileTypes: true });
+        return entries.filter((e) => e.isDirectory()).map((e) => e.name);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Whether the guard is on for sessions launched by this backend.
+ *
+ * Read from the backend's own environment at launch, so an agent session
+ * cannot switch it off: exporting the variable inside a session changes that
+ * shell, not the backend.
+ *
+ * @param env - Environment to read (defaults to the backend's process.env)
+ * @returns false only when `CREWLY_CONTROL_PLANE_GUARD=0`
+ */
+export function isControlPlaneGuardEnabled(env = process.env) {
+    return env[CONTROL_PLANE_GUARD_CONSTANTS.KILL_SWITCH_ENV] !== CONTROL_PLANE_GUARD_CONSTANTS.KILL_SWITCH_OFF_VALUE;
+}
+/**
+ * Resolve every control-plane path (spec Part 2 table) to an absolute path.
+ *
+ * Duplicates are dropped, e.g. when the project path is the install root.
+ *
+ * @param roots - Crewly home, install root and optional project path
+ * @param existingTeamIds - Team directory names to protect `config.json` for
+ *   (spec Part 2 protects `teams/*\/config.json`, not the whole `teams/`
+ *   subtree — a team directory also holds `norms/`, `wiki/`, `prompts/`,
+ *   `sops/` and `cron-tasks.json`, which agents write routinely). Pass the
+ *   ids returned by {@link listExistingTeamIds}; defaults to none, so
+ *   calling this without them protects no team config (documented, not a
+ *   silent gap — `prepareControlPlaneGuard` always supplies them).
+ * @returns Write-denied paths (with a directory flag) and read-denied files
+ *
+ * @example
+ * ```ts
+ * const { writeDenied } = resolveControlPlanePaths(
+ *   { crewlyHome: '/h/.crewly', installRoot: '/opt/crewly' },
+ *   ['team-0001'],
+ * );
+ * // writeDenied includes { path: '/h/.crewly/teams/team-0001/config.json', isDirectory: false }
+ * // writeDenied does NOT include '/h/.crewly/teams' itself — reads and
+ * // writes to team-0001/wiki, norms, prompts, sops, cron-tasks.json stay allowed.
+ * ```
+ */
+export function resolveControlPlanePaths(roots, existingTeamIds = []) {
+    const C = CONTROL_PLANE_GUARD_CONSTANTS;
+    const seen = new Set();
+    const writeDenied = [];
+    const add = (p, isDirectory) => {
+        const abs = path.resolve(p);
+        if (seen.has(abs))
+            return;
+        seen.add(abs);
+        writeDenied.push({ path: abs, isDirectory });
+    };
+    for (const d of C.CREWLY_HOME_DIRS)
+        add(path.join(roots.crewlyHome, d), true);
+    for (const f of C.CREWLY_HOME_FILES)
+        add(path.join(roots.crewlyHome, f), false);
+    for (const teamId of existingTeamIds) {
+        add(path.join(roots.crewlyHome, C.TEAMS_DIR_NAME, teamId, C.TEAM_CONFIG_FILE_NAME), false);
+    }
+    for (const d of C.INSTALL_DIRS)
+        add(path.join(roots.installRoot, d), true);
+    for (const f of C.INSTALL_FILES)
+        add(path.join(roots.installRoot, f), false);
+    if (roots.projectPath) {
+        for (const d of C.PROJECT_DIRS)
+            add(path.join(roots.projectPath, d), true);
+    }
+    const readDenied = C.CREWLY_HOME_READ_DENIED_FILES.map((f) => path.resolve(roots.crewlyHome, f));
+    return { writeDenied, readDenied };
+}
+/**
+ * Format an absolute path as a Claude Code permission-rule specifier.
+ *
+ * In Claude Code rules `//x` is an absolute path, while `/x` is relative to
+ * the settings file, so an absolute path gets one extra leading slash.
+ *
+ * @param absPath - Absolute filesystem path
+ * @param isDirectory - Append `/**` to cover the subtree
+ * @returns Specifier such as `//Users/me/.crewly/teams/**`
+ */
+export function toRuleSpecifier(absPath, isDirectory) {
+    const base = `/${absPath}`;
+    return isDirectory ? `${base}/**` : base;
+}
+/**
+ * Build the Claude Code settings object for one session.
+ *
+ * Deny rules use `Edit(...)`, which Claude Code applies to every built-in
+ * file-editing tool (Edit, Write, NotebookEdit), and `Read(...)` for the API
+ * token. Only documented rule forms are emitted: an invalid rule could get
+ * the whole settings file rejected, and the Bash hook with it.
+ *
+ * The agent-status hook (#815) is merged into the same file, because Claude
+ * Code takes one `--settings`. It is registered only on its own events
+ * (Notification, PermissionRequest, Stop, UserPromptSubmit, PostToolUse) and
+ * never on PreToolUse, so the guard's entry and the deny list are identical
+ * with or without it.
+ *
+ * @param paths - Resolved control-plane paths
+ * @param hookCommand - Shell command that runs the PreToolUse Bash hook
+ * @param statusHookCommand - Shell command that runs the agent-status hook; omit to leave it out
+ * @returns Settings object ready to serialise
+ */
+export function buildControlPlaneSettings(paths, hookCommand, statusHookCommand) {
+    const deny = [];
+    for (const { path: p, isDirectory } of paths.writeDenied) {
+        deny.push(`Edit(${toRuleSpecifier(p, false)})`);
+        if (isDirectory)
+            deny.push(`Edit(${toRuleSpecifier(p, true)})`);
+    }
+    for (const p of paths.readDenied)
+        deny.push(`Read(${toRuleSpecifier(p, false)})`);
+    const settings = {
+        permissions: { deny },
+        hooks: {
+            PreToolUse: [
+                {
+                    matcher: CONTROL_PLANE_GUARD_CONSTANTS.HOOK_TOOL_MATCHER,
+                    hooks: [{ type: 'command', command: hookCommand }],
+                },
+            ],
+        },
+    };
+    if (statusHookCommand) {
+        const S = AGENT_STATUS_HOOK_CONSTANTS;
+        for (const event of S.EVENTS) {
+            const group = { hooks: [{ type: 'command', command: statusHookCommand }] };
+            if (S.TOOL_EVENTS.includes(event))
+                group.matcher = S.ALL_TOOLS_MATCHER;
+            settings.hooks[event] = [group];
+        }
+    }
+    return settings;
+}
+/**
+ * Make a session name safe to use as a file name.
+ *
+ * @param sessionName - Crewly session name
+ * @returns Name with anything outside `[A-Za-z0-9._-]` replaced by `_`
+ */
+export function toSafeFileStem(sessionName) {
+    const stem = sessionName.replace(/[^A-Za-z0-9._-]/g, '_').replace(/^\.+/, '_');
+    return stem.length > 0 ? stem : '_';
+}
+/**
+ * Quote a value for a POSIX shell command line.
+ *
+ * @param value - Raw string
+ * @returns Single-quoted string with embedded quotes escaped
+ */
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Write the per-session settings file and protected-path list.
+ *
+ * @param sessionName - Crewly session name (used for the file names)
+ * @param roots - Crewly home, install root and optional project path
+ * @param env - Environment holding the kill switch (defaults to process.env)
+ * @returns Where the files were written, or why the guard is off
+ * @throws When the files cannot be written (the caller decides whether to launch unguarded)
+ */
+export async function prepareControlPlaneGuard(sessionName, roots, env = process.env) {
+    const C = CONTROL_PLANE_GUARD_CONSTANTS;
+    if (!isControlPlaneGuardEnabled(env)) {
+        return { enabled: false, reason: `${C.KILL_SWITCH_ENV}=${C.KILL_SWITCH_OFF_VALUE}` };
+    }
+    const existingTeamIds = await listExistingTeamIds(roots.crewlyHome);
+    const paths = resolveControlPlanePaths(roots, existingTeamIds);
+    const dir = path.join(roots.crewlyHome, C.RUNTIME_DIR);
+    const stem = toSafeFileStem(sessionName);
+    const settingsPath = path.join(dir, `${stem}${C.SETTINGS_FILE_SUFFIX}`);
+    const pathsPath = path.join(dir, `${stem}${C.PATHS_FILE_SUFFIX}`);
+    const hookScript = path.join(roots.installRoot, C.HOOK_SCRIPT);
+    const hookCommand = `bash ${shellQuote(hookScript)} ${shellQuote(pathsPath)}`;
+    const statusHookCommand = `bash ${shellQuote(path.join(roots.installRoot, AGENT_STATUS_HOOK_CONSTANTS.HOOK_SCRIPT))}`;
+    const pathsBody = [
+        `# Crewly control-plane guard — protected paths for ${sessionName}`,
+        '# Generated by the backend at launch; one absolute path per line.',
+        ...paths.writeDenied.map((p) => p.path),
+        '',
+    ].join('\n');
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(pathsPath, pathsBody, 'utf-8');
+    await fs.writeFile(settingsPath, `${JSON.stringify(buildControlPlaneSettings(paths, hookCommand, statusHookCommand), null, 2)}\n`, 'utf-8');
+    return { enabled: true, settingsPath, pathsPath, protectedCount: paths.writeDenied.length };
+}
+/**
+ * Append `--settings <file>` to a Claude Code launch command.
+ *
+ * Only commands that carry `--dangerously-skip-permissions` (the Crewly agent
+ * launch line) are changed. A command that already passes `--settings` is
+ * left alone: the owner configured their own, and Claude Code takes one.
+ *
+ * @param cmd - Launch command line
+ * @param settingsPath - Generated settings file
+ * @returns The command with the flag appended, or unchanged
+ */
+export function applyControlPlaneSettingsFlag(cmd, settingsPath) {
+    const flag = CONTROL_PLANE_GUARD_CONSTANTS.SETTINGS_FLAG;
+    if (!cmd.includes('--dangerously-skip-permissions'))
+        return cmd;
+    if (new RegExp(`(^|\\s)${flag}(\\s|=|$)`).test(cmd))
+        return cmd;
+    return `${cmd} ${flag} "${settingsPath.replace(/["`$\\]/g, '')}"`;
+}
+//# sourceMappingURL=control-plane-guard.service.js.map

package/dist/cli/backend/src/services/agent/control-plane-guard.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane-guard.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/agent/control-plane-guard.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEhG;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,6BAA6B,CAAC,cAAc,CAAC,CAAC;IACrF,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AA8DD;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9E,OAAO,GAAG,CAAC,6BAA6B,CAAC,eAAe,CAAC,KAAK,6BAA6B,CAAC,qBAAqB,CAAC;AACnH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,wBAAwB,CACvC,KAAwB,EACxB,kBAAqC,EAAE;IAEvC,MAAM,CAAC,GAAG,6BAA6B,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,WAAW,GAAqC,EAAE,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,WAAoB,EAAQ,EAAE;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChF,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5F,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3E,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,WAAoB;IACpE,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;IAC3B,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CACxC,KAAwB,EACxB,WAAmB,EACnB,iBAA0B;IAE1B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,WAAW;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAElF,MAAM,QAAQ,GAAyB;QACtC,WAAW,EAAE,EAAE,IAAI,EAAE;QACrB,KAAK,EAAE;YACN,UAAU,EAAE;gBACX;oBACC,OAAO,EAAE,6BAA6B,CAAC,iBAAiB;oBACxD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;iBAClD;aACD;SACD;KACD,CAAC;IACF,IAAI,iBAAiB,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,2BAA2B,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACtF,IAAK,CAAC,CAAC,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,iBAAiB,CAAC;YAC9F,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAa;IAChC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,WAAmB,EACnB,KAAwB,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,GAAG,6BAA6B,CAAC;IACxC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,qBAAqB,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,QAAQ,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9E,MAAM,iBAAiB,GAAG,QAAQ,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,2BAA2B,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;IAEtH,MAAM,SAAS,GAAG;QACjB,sDAAsD,WAAW,EAAE;QACnE,mEAAmE;QACnE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,EAAE;KACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,EAAE,CAAC,SAAS,CACjB,YAAY,EACZ,GAAG,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,KAAK,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAChG,OAAO,CACP,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAAW,EAAE,YAAoB;IAC9E,MAAM,IAAI,GAAG,6BAA6B,CAAC,aAAa,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QAAE,OAAO,GAAG,CAAC;IAChE,IAAI,IAAI,MAAM,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAChE,OAAO,GAAG,GAAG,IAAI,IAAI,KAAK,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC;AACnE,CAAC"}