glirastes 0.3.2 → 0.5.0

package/dist/contracts/tool-policy.js

@@ -0,0 +1,485 @@
+import { z } from 'zod';
+import { FoundationDiagnosticError } from '../diagnostics/index.js';
+import { findSensitiveStringPath } from './content-boundary.js';
+import { parseExcludePattern } from './tool-exclude-pattern.js';
+import { ToolPolicyEntrySchema, ToolRiskClassSchema, } from './tool-policy-entry.js';
+export { ToolOverrideDeltaSchema, ToolPolicyEntrySchema, ToolPolicyPinSchema, } from './tool-policy-entry.js';
+/**
+ * Version of the default table and the policy bounds below. The golden
+ * vectors in `__vectors__/tool-policy.v1.json` pin it; the Platform port
+ * must produce byte-identical results for the same version.
+ */
+export const TOOL_POLICY_RULES_VERSION = 1;
+const RISK_TIERS = {
+    'safe-read': 0,
+    'read-sensitive': 1,
+    write: 2,
+    delete: 3,
+    financial: 3,
+    external: 3,
+    // An unassessed risk class is treated like the highest tier.
+    unknown: 3,
+};
+/**
+ * A value outside the enum (untyped input, an `as` cast) is unassessed. Own
+ * keys only: a prototype key such as 'constructor' must not read as a tier.
+ */
+function knownRiskClass(riskClass) {
+    return Object.hasOwn(RISK_TIERS, riskClass) ? riskClass : 'unknown';
+}
+/** Fails closed: an out-of-enum class is tier 3, like `unknown`. */
+export function riskTier(riskClass) {
+    return RISK_TIERS[knownRiskClass(riskClass)];
+}
+/**
+ * The runtime confirmation floor: tier 3 always asks before it runs,
+ * whatever any policy layer says.
+ */
+export function confirmationFloor(riskClass, requiresApproval) {
+    return requiresApproval || riskTier(riskClass) >= 3;
+}
+/**
+ * The one relaxation rule (spec 4.5, D16), shared by `resolveToolPolicy` and
+ * the runtime overlay: whether a `requiresApproval: false` entry with this pin
+ * takes effect at the effective risk class. A pin for another tool id (an
+ * earlier incarnation) lapses. Tier 0-1 relaxes freely. From tier 2 on the
+ * entry needs a reviewed pin at a tier-2 class the effective class does not
+ * exceed, so the relaxation lapses as soon as the risk rises. Tier 3 never
+ * relaxes, pinned or not.
+ */
+export function confirmationRelaxationOutcome(toolId, pin, riskClass) {
+    if (pin && pin.toolId !== toolId)
+        return 'pin-for-other-tool';
+    const tier = riskTier(riskClass);
+    if (tier <= 1)
+        return 'applies';
+    if (!pin) {
+        return tier >= 3
+            ? 'tier-3-always-requires-approval'
+            : 'relaxation-requires-reviewed-pin';
+    }
+    const pinnedTier = riskTier(pin.atRiskClass);
+    if (pinnedTier >= 3)
+        return 'tier-3-always-requires-approval';
+    if (tier > pinnedTier)
+        return 'override-lapsed-risk-raised';
+    return 'applies';
+}
+/**
+ * D16 local lock: may a signed Platform decision switch off this tool's
+ * confirmation at all? Only a confirmation the local code report attributes
+ * to the code default, on a tool of tier 0-2. Whatever tool-policy.json
+ * decided (an explicit `requiresApproval: true`, or a risk raise that brings
+ * confirmation) and an origin the report does not name are local locks the
+ * Platform never relaxes; tier 3 always confirms.
+ */
+export function platformMayRelaxConfirmation(riskClass, requiresApprovalOrigin) {
+    return requiresApprovalOrigin === 'code-default' && riskTier(riskClass) <= 2;
+}
+/**
+ * Raise-only combination. A candidate replaces the current class only from a
+ * strictly higher tier; a same-tier relabel or a lower class never applies.
+ * An out-of-enum candidate raises as `unknown`, so none enters the result.
+ */
+export function mostRestrictiveRiskClass(current, candidate) {
+    if (candidate === undefined)
+        return current;
+    return riskTier(candidate) > riskTier(current)
+        ? knownRiskClass(candidate)
+        : current;
+}
+export function intersectAllowedRoles(current, restriction) {
+    const left = normalizedRoles(current);
+    const right = normalizedRoles(restriction ?? []);
+    if (left.length === 0)
+        return { roles: right, disjoint: false };
+    if (right.length === 0)
+        return { roles: left, disjoint: false };
+    const roles = left.filter((role) => right.includes(role));
+    return { roles, disjoint: roles.length === 0 };
+}
+function normalizedRoles(roles) {
+    return [...new Set(roles)].sort();
+}
+const METHOD_DEFAULTS = new Map([
+    ['GET', { operationGroup: 'read', riskClass: 'safe-read', requiresApproval: false }],
+    ['HEAD', { operationGroup: 'read', riskClass: 'safe-read', requiresApproval: false }],
+    ['POST', { operationGroup: 'create', riskClass: 'write', requiresApproval: true }],
+    ['PUT', { operationGroup: 'update', riskClass: 'write', requiresApproval: true }],
+    ['PATCH', { operationGroup: 'update', riskClass: 'write', requiresApproval: true }],
+    ['DELETE', { operationGroup: 'delete', riskClass: 'delete', requiresApproval: true }],
+]);
+const UNKNOWN_METHOD_DEFAULTS = {
+    operationGroup: 'update',
+    riskClass: 'write',
+    requiresApproval: true,
+};
+const UI_DEFAULTS = {
+    operationGroup: 'ui',
+    riskClass: 'safe-read',
+    requiresApproval: false,
+};
+const DESTRUCTIVE_WORDS = new Set([
+    'delete',
+    'remove',
+    'destroy',
+    'purge',
+    'erase',
+    'wipe',
+    'permanent',
+    'revoke',
+]);
+/** Multi-word tokens; `hard-delete` is already covered by `delete`. */
+const DESTRUCTIVE_WORD_PAIRS = [
+    ['empty', 'trash'],
+];
+const DECLARED_EFFECT_RISK = {
+    read: 'safe-read',
+    write: 'write',
+    destructive: 'delete',
+    external: 'external',
+    financial: 'financial',
+};
+/**
+ * The risk class a declared effect stands for. `deriveToolPolicyDefaults`
+ * raises to it, and anything that checks an effect against the code's class
+ * (the agent resolution gate) must read it here, never from a copy.
+ */
+export function declaredEffectRiskClass(effect) {
+    return DECLARED_EFFECT_RISK[effect];
+}
+function segmentWords(segment) {
+    return segment
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((word) => word.length > 0);
+}
+/** Whole-word match per path or definitionId segment (camelCase aware). */
+function hasDestructiveToken(...sources) {
+    for (const source of sources) {
+        for (const segment of (source ?? '').split(/[/.]/)) {
+            const words = segmentWords(segment);
+            if (words.some((word) => DESTRUCTIVE_WORDS.has(word)))
+                return true;
+            for (let index = 0; index + 1 < words.length; index += 1) {
+                if (DESTRUCTIVE_WORD_PAIRS.some(([first, second]) => words[index] === first && words[index + 1] === second)) {
+                    return true;
+                }
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Raise-only step on the assessed class set. It delegates to
+ * `mostRestrictiveRiskClass` so the raise rule lives in one place; both inputs
+ * are assessed, so the result is always one of them and never `unknown`.
+ */
+function raiseAssessed(current, candidate) {
+    return mostRestrictiveRiskClass(current, candidate) === candidate
+        ? candidate
+        : current;
+}
+/**
+ * Deterministic stage-1 defaults (spec 4.5). Escalations only ever raise;
+ * `unknown` is never produced. Roles are not part of the defaults: the
+ * endpoint's own authorization applies.
+ */
+export function deriveToolPolicyDefaults(input) {
+    const isUi = input.executionKind === 'ui';
+    const method = input.method?.toUpperCase();
+    const base = isUi
+        ? UI_DEFAULTS
+        : METHOD_DEFAULTS.get(method ?? '') ?? UNKNOWN_METHOD_DEFAULTS;
+    let operationGroup = base.operationGroup;
+    let riskClass = base.riskClass;
+    const readOnlyMethod = !isUi && (method === 'GET' || method === 'HEAD');
+    const tokensApply = isUi
+        ? input.evidence?.uiMutation === true
+        : !readOnlyMethod;
+    if (tokensApply && hasDestructiveToken(input.path, input.definitionId)) {
+        riskClass = raiseAssessed(riskClass, 'delete');
+        if (!isUi)
+            operationGroup = 'delete';
+    }
+    if (input.declaredEffect !== undefined) {
+        riskClass = raiseAssessed(riskClass, DECLARED_EFFECT_RISK[input.declaredEffect]);
+        if (input.declaredEffect === 'destructive' && !isUi) {
+            operationGroup = 'delete';
+        }
+    }
+    if (input.evidence?.externalCall) {
+        riskClass = raiseAssessed(riskClass, 'external');
+    }
+    if (isUi && input.evidence?.uiMutation) {
+        riskClass = raiseAssessed(riskClass, 'write');
+    }
+    return {
+        operationGroup,
+        riskClass,
+        requiresApproval: base.requiresApproval || riskTier(riskClass) >= 2,
+        rulesVersion: TOOL_POLICY_RULES_VERSION,
+    };
+}
+const boundedText = (max) => z.string().trim().min(1).max(max);
+const stableKey = z.string().min(1).max(512);
+/** `src/components/ui-size-provider.tsx#setSize`: the file that declares a control and its setter. */
+export const CONTROL_REF = /^[^#\s]+#[A-Za-z_$][\w$]*$/;
+/**
+ * `.glirastes/tool-policy.json`. Written by the developer or the CLI only,
+ * never by an agent; `tools refresh` never rewrites it.
+ */
+export const ToolPolicyFileSchema = z.object({
+    schemaVersion: z.literal(1),
+    tools: z.record(stableKey, ToolPolicyEntrySchema).default({}),
+    exclude: z.array(z.object({
+        // A pattern outside the grammar would exclude nothing, so it is rejected instead.
+        match: boundedText(2_048).refine((match) => parseExcludePattern(match) !== undefined, {
+            message: 'Expected "[METHOD|*] /path" with * or ** as whole segments',
+        }),
+        reason: boundedText(500),
+    }).strict()).max(500).default([]),
+    acceptedRisk: z.record(stableKey, z.object({
+        riskClass: ToolRiskClassSchema,
+        toolId: z.uuid(),
+    }).strict()).default({}),
+    /** UI controls (`<file>#<setter>`) the developer keeps out of the chat; refresh stops proposing a client action for them. */
+    excludeControls: z.array(z.object({
+        control: z.string().max(1_024).regex(CONTROL_REF, 'Expected "<app file>#<setter>", e.g. "src/theme.tsx#setTheme"'),
+        reason: boundedText(500),
+    }).strict()).max(500).optional(),
+}).strict().superRefine((file, context) => {
+    // Values only: stable keys such as "POST /api/auth/token" are not content.
+    const sensitivePath = findSensitiveStringPath(file);
+    if (sensitivePath) {
+        context.addIssue({
+            code: 'custom',
+            message: 'Tool policy contains secret-like content',
+            path: sensitivePath,
+        });
+    }
+});
+export function parseToolPolicyFile(value) {
+    const parsed = ToolPolicyFileSchema.safeParse(value);
+    if (parsed.success)
+        return parsed.data;
+    // The issue path names the field; the offending value is never echoed.
+    const identifier = parsed.error.issues[0]?.path.map(String).join('.') ?? '';
+    throw new FoundationDiagnosticError({
+        code: 'E-POLICY-001',
+        operation: 'tools.policy',
+        message: 'The tool policy file is invalid.',
+        remediation: 'repair-tool-policy-file',
+        path: '.glirastes/tool-policy.json',
+        ...(identifier ? { identifier } : {}),
+    });
+}
+/**
+ * Pure policy resolution shared with the Platform port via golden vectors.
+ * Code defaults are the base; local and Platform entries restrict, except a
+ * reviewed, pinned relaxation of confirmation up to tier 2. Across all layers
+ * the most restrictive protection value wins.
+ */
+export function resolveToolPolicy(input) {
+    const warnings = [];
+    const errors = [];
+    const { layers, invalidOrigin } = collectPolicyLayers(input, warnings, errors);
+    const risk = resolveRiskClass(input, layers, warnings);
+    const roles = resolveAllowedRoles(layers);
+    const enabled = resolveEnabled(input.codeEnabled, layers, roles.disjointOrigin, invalidOrigin);
+    const approval = resolveApproval(input, layers, risk, warnings, errors);
+    const description = resolveDescription(layers);
+    return {
+        effective: {
+            enabled: enabled.value,
+            requiresApproval: approval.value,
+            riskClass: risk.value,
+            allowedRoles: roles.value,
+            ...(description.value === undefined
+                ? {}
+                : { description: description.value }),
+            origin: {
+                enabled: enabled.origin,
+                requiresApproval: approval.origin,
+                riskClass: risk.origin,
+                allowedRoles: roles.origin,
+                description: description.origin,
+            },
+        },
+        warnings,
+        errors,
+    };
+}
+function collectPolicyLayers(input, warnings, errors) {
+    const layers = [];
+    let invalidOrigin;
+    const candidates = [
+        { name: 'local', origin: 'local-policy', entry: input.local },
+        { name: 'platform', origin: 'platform', entry: input.platform },
+    ];
+    for (const candidate of candidates) {
+        if (candidate.entry === undefined)
+            continue;
+        const parsed = ToolPolicyEntrySchema.safeParse(candidate.entry);
+        if (!parsed.success) {
+            const path = parsed.error.issues[0]?.path.map(String).join('.') ?? '';
+            errors.push({
+                code: 'E-POLICY-001',
+                field: path ? `${candidate.name}.${path}` : candidate.name,
+                reason: 'invalid-entry',
+            });
+            // A layer we cannot read must not silently drop its restrictions.
+            invalidOrigin ??= candidate.origin;
+            continue;
+        }
+        const layer = {
+            name: candidate.name,
+            origin: candidate.origin,
+            entry: parsed.data,
+        };
+        // A pin from an earlier incarnation: relaxations lapse, hardenings stay.
+        if (layer.entry.pin && layer.entry.pin.toolId !== input.toolId) {
+            warnings.push({
+                code: 'policy-entry-orphaned',
+                field: `${layer.name}.pin.toolId`,
+            });
+        }
+        layers.push(layer);
+    }
+    return { layers, ...(invalidOrigin ? { invalidOrigin } : {}) };
+}
+function resolveRiskClass(input, layers, warnings) {
+    let value = input.defaults.riskClass;
+    let origin = 'code-default';
+    for (const layer of layers) {
+        const raised = mostRestrictiveRiskClass(value, layer.entry.riskClass);
+        if (raised !== value) {
+            value = raised;
+            origin = layer.origin;
+        }
+    }
+    // Ratchet: a code-caused decrease is held until `tools policy accept`.
+    // `acceptedRisk.riskClass` is matched against the layered `value` (defaults
+    // plus local/Platform raises), not the class the code alone derives, so the
+    // warning names `value` as the class accept must record.
+    const previous = input.previousEffectiveRiskClass;
+    if (previous !== undefined && riskTier(previous) > riskTier(value)) {
+        const acceptedRisk = input.acceptedRisk;
+        const accepted = acceptedRisk !== undefined
+            && acceptedRisk.toolId === input.toolId
+            && acceptedRisk.riskClass === value;
+        if (!accepted) {
+            warnings.push({
+                code: 'risk-lower-available',
+                field: 'riskClass',
+                riskClass: value,
+            });
+            // An out-of-enum previous class is held as tier-3 `unknown`.
+            return { value: knownRiskClass(previous), origin: 'code-default' };
+        }
+    }
+    return { value, origin };
+}
+function sameRoles(left, right) {
+    return left.length === right.length
+        && left.every((role, index) => role === right[index]);
+}
+function resolveAllowedRoles(layers) {
+    let value = [];
+    let origin = 'code-default';
+    for (const layer of layers) {
+        const restriction = layer.entry.allowedRoles;
+        if (!restriction || restriction.length === 0)
+            continue;
+        const next = intersectAllowedRoles(value, restriction);
+        if (next.disjoint) {
+            // [] would read as "everyone"; a disjoint restriction means nobody.
+            return { value: [], origin: layer.origin, disjointOrigin: layer.origin };
+        }
+        if (!sameRoles(next.roles, value)) {
+            value = next.roles;
+            origin = layer.origin;
+        }
+    }
+    return { value, origin };
+}
+function resolveEnabled(codeEnabled, layers, disjointOrigin, invalidOrigin) {
+    if (!codeEnabled)
+        return { value: false, origin: 'code-default' };
+    if (invalidOrigin)
+        return { value: false, origin: invalidOrigin };
+    const disabledBy = layers.find((layer) => layer.entry.enabled === false);
+    if (disabledBy)
+        return { value: false, origin: disabledBy.origin };
+    if (disjointOrigin)
+        return { value: false, origin: disjointOrigin };
+    return { value: true, origin: 'code-default' };
+}
+function resolveApproval(input, layers, risk, warnings, errors) {
+    const tier = riskTier(risk.value);
+    const raisedIntoConfirmation = tier >= 2
+        && tier > riskTier(input.defaults.riskClass);
+    const baseline = input.defaults.requiresApproval || raisedIntoConfirmation;
+    const baselineOrigin = !input.defaults.requiresApproval && raisedIntoConfirmation
+        ? risk.origin
+        : 'code-default';
+    let hardenedBy;
+    let relaxedBy;
+    for (const layer of layers) {
+        if (layer.entry.requiresApproval === true) {
+            hardenedBy ??= layer;
+        }
+        else if (layer.entry.requiresApproval === false
+            && relaxationAllowed(input.toolId, layer, risk.value, warnings, errors)) {
+            relaxedBy = layer;
+        }
+    }
+    let result;
+    if (hardenedBy) {
+        result = {
+            value: true,
+            origin: baseline && !relaxedBy ? baselineOrigin : hardenedBy.origin,
+        };
+    }
+    else if (relaxedBy) {
+        result = { value: false, origin: relaxedBy.origin };
+    }
+    else {
+        result = { value: baseline, origin: baselineOrigin };
+    }
+    // Tier 3 always confirms, whatever any layer says.
+    return !result.value && tier >= 3
+        ? { value: true, origin: 'code-default' }
+        : result;
+}
+function relaxationAllowed(toolId, layer, riskClass, warnings, errors) {
+    const field = `${layer.name}.requiresApproval`;
+    const outcome = confirmationRelaxationOutcome(toolId, layer.entry.pin, riskClass);
+    switch (outcome) {
+        case 'applies':
+            return true;
+        case 'pin-for-other-tool':
+            // Reported once as `policy-entry-orphaned` by collectPolicyLayers.
+            return false;
+        case 'override-lapsed-risk-raised':
+            warnings.push({ code: 'override-lapsed-risk-raised', field });
+            return false;
+        default:
+            errors.push({ code: 'E-POLICY-002', field, reason: outcome });
+            return false;
+    }
+}
+function resolveDescription(layers) {
+    let result = {
+        value: undefined,
+        origin: 'code-default',
+    };
+    for (const layer of layers) {
+        if (layer.entry.description !== undefined) {
+            result = { value: layer.entry.description, origin: layer.origin };
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=tool-policy.js.map

package/dist/contracts/tool-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-policy.js","sourceRoot":"","sources":["../../src/contracts/tool-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAGpB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAGhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAU,CAAC;AAIpD,MAAM,UAAU,GAA8C;IAC5D,WAAW,EAAE,CAAC;IACd,gBAAgB,EAAE,CAAC;IACnB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,SAAS,EAAE,CAAC;IACZ,QAAQ,EAAE,CAAC;IACX,6DAA6D;IAC7D,OAAO,EAAE,CAAC;CACX,CAAC;AAEF;;;GAGG;AACH,SAAS,cAAc,CAAC,SAAwB;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,QAAQ,CAAC,SAAwB;IAC/C,OAAO,UAAU,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAwB,EACxB,gBAAyB;IAEzB,OAAO,gBAAgB,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAc,EACd,GAA2B,EAC3B,SAAwB;IAExB,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,oBAAoB,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,IAAI,CAAC;YACd,CAAC,CAAC,iCAAiC;YACnC,CAAC,CAAC,kCAAkC,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,iCAAiC,CAAC;IAC9D,IAAI,IAAI,GAAG,UAAU;QAAE,OAAO,6BAA6B,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAwB,EACxB,sBAAgD;IAEhD,OAAO,sBAAsB,KAAK,cAAc,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAsB,EACtB,SAAoC;IAEpC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,QAAQ,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC5C,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC;QAC3B,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AASD,MAAM,UAAU,qBAAqB,CACnC,OAA8B,EAC9B,WAA8C;IAE9C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,eAAe,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,KAA4B;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AA4BD,MAAM,eAAe,GAAG,IAAI,GAAG,CAA6B;IAC1D,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IACpF,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IACrF,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAClF,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACjF,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACnF,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;CACtF,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAuB;IAClD,cAAc,EAAE,QAAQ;IACxB,SAAS,EAAE,OAAO;IAClB,gBAAgB,EAAE,IAAI;CACvB,CAAC;AAEF,MAAM,WAAW,GAAuB;IACtC,cAAc,EAAE,IAAI;IACpB,SAAS,EAAE,WAAW;IACtB,gBAAgB,EAAE,KAAK;CACxB,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,OAAO;IACP,OAAO;IACP,MAAM;IACN,WAAW;IACX,QAAQ;CACT,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,sBAAsB,GAA6C;IACvE,CAAC,OAAO,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,oBAAoB,GAAwD;IAChF,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,QAAQ;IACrB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAsB;IAC5D,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO;SACX,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,2EAA2E;AAC3E,SAAS,mBAAmB,CAC1B,GAAG,OAA0C;IAE7C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACzD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAClD,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;oBACzD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CACpB,OAA0B,EAC1B,SAA4B;IAE5B,OAAO,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,SAAS;QAC/D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA8B;IAE9B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI;QACf,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,uBAAuB,CAAC;IACjE,IAAI,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IACzC,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAE/B,MAAM,cAAc,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,IAAI;QACtB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,KAAK,IAAI;QACrC,CAAC,CAAC,CAAC,cAAc,CAAC;IACpB,IAAI,WAAW,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACvE,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,cAAc,GAAG,QAAQ,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACvC,SAAS,GAAG,aAAa,CACvB,SAAS,EACT,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAC3C,CAAC;QACF,IAAI,KAAK,CAAC,cAAc,KAAK,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC;YACpD,cAAc,GAAG,QAAQ,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;QACjC,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;QACvC,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,cAAc;QACd,SAAS;QACT,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC;QACnE,YAAY,EAAE,yBAAyB;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACvE,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7C,sGAAsG;AACtG,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAExD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,kFAAkF;QAClF,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE;YACpF,OAAO,EAAE,4DAA4D;SACtE,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC;KACzB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QACzC,SAAS,EAAE,mBAAmB;QAC9B,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE;KACjB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxB,6HAA6H;IAC7H,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,+DAA+D,CAAC;QAClH,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC;KACzB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IACxC,2EAA2E;IAC3E,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,0CAA0C;YACnD,IAAI,EAAE,aAAa;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,uEAAuE;IACvE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,IAAI,yBAAyB,CAAC;QAClC,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,cAAc;QACzB,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,yBAAyB;QACtC,IAAI,EAAE,6BAA6B;QACnC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AA4ED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAA6B;IAE7B,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,cAAc,CAC5B,KAAK,CAAC,WAAW,EACjB,MAAM,EACN,KAAK,CAAC,cAAc,EACpB,aAAa,CACd,CAAC;IACF,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO;QACL,SAAS,EAAE;YACT,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,gBAAgB,EAAE,QAAQ,CAAC,KAAK;YAChC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,YAAY,EAAE,KAAK,CAAC,KAAK;YACzB,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS;gBACjC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,EAAE;gBACN,OAAO,EAAE,OAAO,CAAC,MAAM;gBACvB,gBAAgB,EAAE,QAAQ,CAAC,MAAM;gBACjC,SAAS,EAAE,IAAI,CAAC,MAAM;gBACtB,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,WAAW,EAAE,WAAW,CAAC,MAAM;aAChC;SACF;QACD,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAA6B,EAC7B,QAAyB,EACzB,MAAqB;IAErB,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,aAAuC,CAAC;IAC5C,MAAM,UAAU,GAAG;QACjB,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;QAC7D,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;KACvD,CAAC;IACX,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;YAAE,SAAS;QAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI;gBAC1D,MAAM,EAAE,eAAe;aACxB,CAAC,CAAC;YACH,kEAAkE;YAClE,aAAa,KAAK,SAAS,CAAC,MAAM,CAAC;YACnC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAgB;YACzB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,KAAK,EAAE,MAAM,CAAC,IAAI;SACnB,CAAC;QACF,yEAAyE;QACzE,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,aAAa;aAClC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,gBAAgB,CACvB,KAA6B,EAC7B,MAAkC,EAClC,QAAyB;IAEzB,IAAI,KAAK,GAAkB,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;IACpD,IAAI,MAAM,GAAiB,cAAc,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,KAAK,GAAG,MAAM,CAAC;YACf,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACxB,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,0BAA0B,CAAC;IAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,MAAM,QAAQ,GAAG,YAAY,KAAK,SAAS;eACtC,YAAY,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;eACpC,YAAY,CAAC,SAAS,KAAK,KAAK,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,sBAAsB;gBAC5B,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,6DAA6D;YAC7D,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS,CAChB,IAA2B,EAC3B,KAA4B;IAE5B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;WAC9B,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAkC;IAElC,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,GAAiB,cAAc,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;QAC7C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvD,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,oEAAoE;YACpE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACnB,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,cAAc,CACrB,WAAoB,EACpB,MAAkC,EAClC,cAAwC,EACxC,aAAuC;IAEvC,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAClE,IAAI,aAAa;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACzE,IAAI,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACnE,IAAI,cAAc;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CACtB,KAA6B,EAC7B,MAAkC,EAClC,IAAkC,EAClC,QAAyB,EACzB,MAAqB;IAErB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,sBAAsB,GAAG,IAAI,IAAI,CAAC;WACnC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,gBAAgB,IAAI,sBAAsB,CAAC;IAC3E,MAAM,cAAc,GAClB,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,IAAI,sBAAsB;QACxD,CAAC,CAAC,IAAI,CAAC,MAAM;QACb,CAAC,CAAC,cAAc,CAAC;IACrB,IAAI,UAAmC,CAAC;IACxC,IAAI,SAAkC,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC1C,UAAU,KAAK,KAAK,CAAC;QACvB,CAAC;aAAM,IACL,KAAK,CAAC,KAAK,CAAC,gBAAgB,KAAK,KAAK;eACnC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EACvE,CAAC;YACD,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,IAAI,MAA8B,CAAC;IACnC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG;YACP,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;SACpE,CAAC;IACJ,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACvD,CAAC;IACD,mDAAmD;IACnD,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC;QAC/B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE;QACzC,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,KAAkB,EAClB,SAAwB,EACxB,QAAyB,EACzB,MAAqB;IAErB,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,IAAI,mBAAmB,CAAC;IAC/C,MAAM,OAAO,GAAG,6BAA6B,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAClF,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC;QACd,KAAK,oBAAoB;YACvB,mEAAmE;YACnE,OAAO,KAAK,CAAC;QACf,KAAK,6BAA6B;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf;YACE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9D,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAkC;IAElC,IAAI,MAAM,GAAsC;QAC9C,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,cAAc;KACvB,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/contracts/url.d.ts

@@ -0,0 +1,2 @@
+/** `url` without trailing slashes, in linear time (a `/\/+$/` replace is quadratic on hostile input). */
+export declare function trimTrailingSlashes(url: string): string;

package/dist/contracts/url.js

@@ -0,0 +1,8 @@
+/** `url` without trailing slashes, in linear time (a `/\/+$/` replace is quadratic on hostile input). */
+export function trimTrailingSlashes(url) {
+    let end = url.length;
+    while (end > 0 && url.charCodeAt(end - 1) === 47)
+        end -= 1;
+    return end === url.length ? url : url.slice(0, end);
+}
+//# sourceMappingURL=url.js.map

package/dist/contracts/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/contracts/url.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,OAAO,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC"}

package/dist/diagnostics/foundation-diagnostic.d.ts

@@ -0,0 +1,34 @@
+export type FoundationDiagnosticCode = `E-SETUP-${string}` | `E-INVENTORY-${string}` | `E-SEMANTICS-${string}` | `E-BINDING-${string}` | `E-SIGNATURE-${string}` | `E-SCOPE-${string}` | `E-SYNC-${string}` | `E-CONNECT-${string}` | `E-POLICY-${string}` | `E-TOOLS-${string}`;
+export interface FoundationDiagnosticJson {
+    schemaVersion: 1;
+    code: FoundationDiagnosticCode;
+    operation: string;
+    message: string;
+    remediation: string;
+    path?: string;
+    identifier?: string;
+}
+export interface FoundationDiagnosticInput {
+    code: FoundationDiagnosticCode;
+    operation: string;
+    message: string;
+    remediation: string;
+    path?: string;
+    identifier?: string;
+}
+/**
+ * A bounded operator diagnostic. It deliberately carries no arbitrary
+ * metadata or cause so JSON output cannot accidentally cross the local
+ * content and secret boundary.
+ */
+export declare class FoundationDiagnosticError extends Error {
+    readonly code: FoundationDiagnosticCode;
+    readonly operation: string;
+    readonly remediation: string;
+    readonly path?: string;
+    readonly identifier?: string;
+    constructor(input: FoundationDiagnosticInput);
+    toJSON(): FoundationDiagnosticJson;
+}
+export declare function isFoundationDiagnosticError(value: unknown): value is FoundationDiagnosticError;
+export declare function foundationDiagnosticJson(error: unknown, operation?: string): FoundationDiagnosticJson;

package/dist/diagnostics/foundation-diagnostic.js

@@ -0,0 +1,47 @@
+/**
+ * A bounded operator diagnostic. It deliberately carries no arbitrary
+ * metadata or cause so JSON output cannot accidentally cross the local
+ * content and secret boundary.
+ */
+export class FoundationDiagnosticError extends Error {
+    code;
+    operation;
+    remediation;
+    path;
+    identifier;
+    constructor(input) {
+        super(input.message);
+        this.name = 'FoundationDiagnosticError';
+        this.code = input.code;
+        this.operation = input.operation;
+        this.remediation = input.remediation;
+        this.path = input.path;
+        this.identifier = input.identifier;
+    }
+    toJSON() {
+        return {
+            schemaVersion: 1,
+            code: this.code,
+            operation: this.operation,
+            message: this.message,
+            remediation: this.remediation,
+            ...(this.path ? { path: this.path } : {}),
+            ...(this.identifier ? { identifier: this.identifier } : {}),
+        };
+    }
+}
+export function isFoundationDiagnosticError(value) {
+    return value instanceof FoundationDiagnosticError;
+}
+export function foundationDiagnosticJson(error, operation = 'unknown') {
+    if (isFoundationDiagnosticError(error))
+        return error.toJSON();
+    return {
+        schemaVersion: 1,
+        code: 'E-SETUP-999',
+        operation,
+        message: 'Glirastes command failed.',
+        remediation: 'inspect-local-diagnostics',
+    };
+}
+//# sourceMappingURL=foundation-diagnostic.js.map

package/dist/diagnostics/foundation-diagnostic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foundation-diagnostic.js","sourceRoot":"","sources":["../../src/diagnostics/foundation-diagnostic.ts"],"names":[],"mappings":"AA+BA;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,CAA2B;IAC/B,SAAS,CAAS;IAClB,WAAW,CAAS;IACpB,IAAI,CAAU;IACd,UAAU,CAAU;IAE7B,YAAY,KAAgC;QAC1C,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACrC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,KAAK,YAAY,yBAAyB,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAc,EACd,SAAS,GAAG,SAAS;IAErB,IAAI,2BAA2B,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;IAC9D,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,aAAa;QACnB,SAAS;QACT,OAAO,EAAE,2BAA2B;QACpC,WAAW,EAAE,2BAA2B;KACzC,CAAC;AACJ,CAAC"}

package/dist/diagnostics/index.d.ts

@@ -0,0 +1,2 @@
+export { FoundationDiagnosticError, foundationDiagnosticJson, isFoundationDiagnosticError, } from './foundation-diagnostic.js';
+export type { FoundationDiagnosticCode, FoundationDiagnosticInput, FoundationDiagnosticJson, } from './foundation-diagnostic.js';

package/dist/diagnostics/index.js

@@ -0,0 +1,2 @@
+export { FoundationDiagnosticError, foundationDiagnosticJson, isFoundationDiagnosticError, } from './foundation-diagnostic.js';
+//# sourceMappingURL=index.js.map

package/dist/diagnostics/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/diagnostics/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC"}