lattice-orchestrator 0.7.0

package/dist/services/permission-event-log.js

@@ -0,0 +1,252 @@
+/**
+ * PermissionEventLog - Structured event logging for permission flow observability.
+ *
+ * This provides a clear, queryable log of all permission system decisions:
+ * - Permission requests from MCP server
+ * - Pattern matching decisions (allowed/denied)
+ * - Pattern suggestions (LLM vs heuristic)
+ * - Allowlist modifications
+ *
+ * The log is designed for:
+ * 1. Debugging: "Why was this tool auto-approved?" / "What pattern matched?"
+ * 2. Monitoring: "How many permissions are being requested?"
+ * 3. Pattern analysis: "What patterns would reduce permission prompts?"
+ */
+import { createLogger } from './infrastructure/logger.js';
+// ============================================================================
+// Event Log Service
+// ============================================================================
+export class PermissionEventLog {
+    logger;
+    events = [];
+    eventId = 0;
+    maxEvents = 500; // Ring buffer size
+    constructor() {
+        this.logger = createLogger('PermissionEventLog');
+    }
+    // ========== Logging Methods ==========
+    /**
+     * Log a permission request from MCP server
+     */
+    request(params) {
+        this.addEvent({
+            eventType: 'request',
+            toolName: params.toolName,
+            toolInput: params.toolInput,
+            streamingId: params.streamingId,
+            permissionRequestId: params.permissionRequestId,
+        });
+        this.logger.info('Permission request', {
+            tool: params.toolName,
+            streamingId: params.streamingId?.slice(0, 8),
+            requestId: params.permissionRequestId.slice(0, 8),
+        });
+    }
+    /**
+     * Log auto-approval by pattern match
+     */
+    autoApproved(params) {
+        this.addEvent({
+            eventType: 'auto_approved',
+            toolName: params.toolName,
+            toolInput: params.toolInput,
+            streamingId: params.streamingId,
+            matchedPattern: params.matchedPattern,
+            patternSource: params.patternSource,
+        });
+        this.logger.info('Permission auto-approved', {
+            tool: params.toolName,
+            pattern: params.matchedPattern,
+            source: params.patternSource,
+            streamingId: params.streamingId?.slice(0, 8),
+        });
+    }
+    /**
+     * Log pattern suggestions
+     */
+    patternSuggest(params) {
+        this.addEvent({
+            eventType: 'pattern_suggest',
+            toolName: params.toolName,
+            toolInput: params.toolInput,
+            suggestedPatterns: params.suggestedPatterns,
+            suggestionSource: params.suggestionSource,
+            durationMs: params.durationMs,
+        });
+        this.logger.debug('Pattern suggestions generated', {
+            tool: params.toolName,
+            patterns: params.suggestedPatterns,
+            source: params.suggestionSource,
+            durationMs: params.durationMs,
+        });
+    }
+    /**
+     * Log user decision
+     */
+    decision(params) {
+        this.addEvent({
+            eventType: params.decision === 'approve' ? 'approved' : 'denied',
+            toolName: params.toolName,
+            permissionRequestId: params.permissionRequestId,
+            decision: params.decision,
+            denyReason: params.denyReason,
+            streamingId: params.streamingId,
+        });
+        this.logger.info('Permission decision', {
+            tool: params.toolName,
+            decision: params.decision,
+            requestId: params.permissionRequestId.slice(0, 8),
+            streamingId: params.streamingId?.slice(0, 8),
+        });
+    }
+    /**
+     * Log pattern added to allowlist
+     */
+    allowlistAdd(params) {
+        this.addEvent({
+            eventType: 'allowlist_add',
+            toolName: '', // Not applicable for allowlist add
+            addedPattern: params.pattern,
+            allowlistScope: params.scope,
+            streamingId: params.streamingId,
+        });
+        this.logger.info('Pattern added to allowlist', {
+            pattern: params.pattern,
+            scope: params.scope,
+            streamingId: params.streamingId?.slice(0, 8),
+        });
+    }
+    // ========== Internal ==========
+    addEvent(params) {
+        const event = {
+            id: ++this.eventId,
+            timestamp: Date.now(),
+            ...params,
+        };
+        // Ring buffer
+        if (this.events.length >= this.maxEvents) {
+            this.events.shift();
+        }
+        this.events.push(event);
+    }
+    // ========== Query Methods ==========
+    /**
+     * Get all events (most recent first)
+     */
+    getAll(limit = 100) {
+        return this.events.slice(-limit).reverse();
+    }
+    /**
+     * Get events for a specific streaming session
+     */
+    getForSession(streamingId, limit = 50) {
+        return this.events
+            .filter(e => e.streamingId === streamingId)
+            .slice(-limit)
+            .reverse();
+    }
+    /**
+     * Get events for a specific tool
+     */
+    getForTool(toolName, limit = 50) {
+        return this.events
+            .filter(e => e.toolName === toolName)
+            .slice(-limit)
+            .reverse();
+    }
+    /**
+     * Get auto-approved events (useful for understanding pattern coverage)
+     */
+    getAutoApproved(limit = 50) {
+        return this.events
+            .filter(e => e.eventType === 'auto_approved')
+            .slice(-limit)
+            .reverse();
+    }
+    /**
+     * Get pending/denied events (useful for identifying missing patterns)
+     */
+    getManualDecisions(limit = 50) {
+        return this.events
+            .filter(e => e.eventType === 'approved' || e.eventType === 'denied')
+            .slice(-limit)
+            .reverse();
+    }
+    /**
+     * Get pattern match statistics
+     */
+    getPatternStats() {
+        const requests = this.events.filter(e => e.eventType === 'request').length;
+        const autoApproved = this.events.filter(e => e.eventType === 'auto_approved').length;
+        const approved = this.events.filter(e => e.eventType === 'approved').length;
+        const denied = this.events.filter(e => e.eventType === 'denied').length;
+        // Count pattern matches
+        const patternCounts = new Map();
+        for (const event of this.events) {
+            if (event.eventType === 'auto_approved' && event.matchedPattern) {
+                patternCounts.set(event.matchedPattern, (patternCounts.get(event.matchedPattern) || 0) + 1);
+            }
+        }
+        const topPatterns = Array.from(patternCounts.entries())
+            .sort((a, b) => b[1] - a[1])
+            .slice(0, 10)
+            .map(([pattern, count]) => ({ pattern, count }));
+        const total = autoApproved + approved + denied;
+        return {
+            totalRequests: requests,
+            autoApproved,
+            manualApproved: approved,
+            denied,
+            patternHitRate: total > 0 ? autoApproved / total : 0,
+            topMatchedPatterns: topPatterns,
+        };
+    }
+    /**
+     * Get a human-readable timeline
+     */
+    getTimeline(limit = 30) {
+        const events = this.getAll(limit);
+        return events.map(e => {
+            const time = new Date(e.timestamp).toISOString().slice(11, 19);
+            const duration = e.durationMs ? ` (${e.durationMs}ms)` : '';
+            switch (e.eventType) {
+                case 'request':
+                    return `${time} 📋 Request: ${e.toolName}`;
+                case 'auto_approved':
+                    return `${time} ✅ AutoApproved: ${e.toolName} [${e.matchedPattern}] (${e.patternSource})`;
+                case 'approved':
+                    return `${time} 👍 Approved: ${e.toolName}`;
+                case 'denied':
+                    return `${time} 👎 Denied: ${e.toolName}${e.denyReason ? ` - ${e.denyReason}` : ''}`;
+                case 'pattern_suggest':
+                    return `${time} 💡 Suggest: ${e.toolName} → [${e.suggestedPatterns?.join(', ')}]${duration}`;
+                case 'allowlist_add':
+                    return `${time} ➕ Allowlist: ${e.addedPattern} (${e.allowlistScope})`;
+                default:
+                    return `${time} ❓ ${e.eventType}: ${e.toolName}`;
+            }
+        });
+    }
+    /**
+     * Clear all events (for testing)
+     */
+    clear() {
+        this.events = [];
+        this.eventId = 0;
+    }
+}
+// ============================================================================
+// Singleton
+// ============================================================================
+let instance = null;
+export function getPermissionEventLog() {
+    if (!instance) {
+        instance = new PermissionEventLog();
+    }
+    return instance;
+}
+// For testing
+export function resetPermissionEventLog() {
+    instance = null;
+}
+//# sourceMappingURL=permission-event-log.js.map

package/dist/services/permission-event-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-event-log.js","sourceRoot":"","sources":["../../src/services/permission-event-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,4BAA4B,CAAC;AAwDvE,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,MAAM,OAAO,kBAAkB;IACrB,MAAM,CAAS;IACf,MAAM,GAAsB,EAAE,CAAC;IAC/B,OAAO,GAAG,CAAC,CAAC;IACZ,SAAS,GAAG,GAAG,CAAC,CAAC,mBAAmB;IAE5C;QACE,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC;IAED,wCAAwC;IAExC;;OAEG;IACH,OAAO,CAAC,MAKP;QACC,IAAI,CAAC,QAAQ,CAAC;YACZ,SAAS,EAAE,SAAS;YACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACrC,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5C,SAAS,EAAE,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAMZ;QACC,IAAI,CAAC,QAAQ,CAAC;YACZ,SAAS,EAAE,eAAe;YAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC3C,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,OAAO,EAAE,MAAM,CAAC,cAAc;YAC9B,MAAM,EAAE,MAAM,CAAC,aAAa;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAMd;QACC,IAAI,CAAC,QAAQ,CAAC;YACZ,SAAS,EAAE,iBAAiB;YAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;YACjD,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,QAAQ,EAAE,MAAM,CAAC,iBAAiB;YAClC,MAAM,EAAE,MAAM,CAAC,gBAAgB;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,MAMR;QACC,IAAI,CAAC,QAAQ,CAAC;YACZ,SAAS,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YAChE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;YACtC,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACjD,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAIZ;QACC,IAAI,CAAC,QAAQ,CAAC;YACZ,SAAS,EAAE,eAAe;YAC1B,QAAQ,EAAE,EAAE,EAAE,mCAAmC;YACjD,YAAY,EAAE,MAAM,CAAC,OAAO;YAC5B,cAAc,EAAE,MAAM,CAAC,KAAK;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;YAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,iCAAiC;IAEzB,QAAQ,CAAC,MAAiD;QAChE,MAAM,KAAK,GAAoB;YAC7B,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,GAAG,MAAM;SACV,CAAC;QAEF,cAAc;QACd,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,sCAAsC;IAEtC;;OAEG;IACH,MAAM,CAAC,KAAK,GAAG,GAAG;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,WAAmB,EAAE,KAAK,GAAG,EAAE;QAC3C,OAAO,IAAI,CAAC,MAAM;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC;aAC1C,KAAK,CAAC,CAAC,KAAK,CAAC;aACb,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,QAAgB,EAAE,KAAK,GAAG,EAAE;QACrC,OAAO,IAAI,CAAC,MAAM;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;aACpC,KAAK,CAAC,CAAC,KAAK,CAAC;aACb,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,GAAG,EAAE;QACxB,OAAO,IAAI,CAAC,MAAM;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,eAAe,CAAC;aAC5C,KAAK,CAAC,CAAC,KAAK,CAAC;aACb,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,KAAK,GAAG,EAAE;QAC3B,OAAO,IAAI,CAAC,MAAM;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC;aACnE,KAAK,CAAC,CAAC,KAAK,CAAC;aACb,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,eAAe;QAQb,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC,MAAM,CAAC;QACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QAExE,wBAAwB;QACxB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBAChE,aAAa,CAAC,GAAG,CACf,KAAK,CAAC,cAAc,EACpB,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CACnD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;aACpD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACZ,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAEnD,MAAM,KAAK,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;QAC/C,OAAO;YACL,aAAa,EAAE,QAAQ;YACvB,YAAY;YACZ,cAAc,EAAE,QAAQ;YACxB,MAAM;YACN,cAAc,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACpD,kBAAkB,EAAE,WAAW;SAChC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAK,GAAG,EAAE;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACpB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAE5D,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;gBACpB,KAAK,SAAS;oBACZ,OAAO,GAAG,IAAI,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC7C,KAAK,eAAe;oBAClB,OAAO,GAAG,IAAI,oBAAoB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,cAAc,MAAM,CAAC,CAAC,aAAa,GAAG,CAAC;gBAC5F,KAAK,UAAU;oBACb,OAAO,GAAG,IAAI,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9C,KAAK,QAAQ;oBACX,OAAO,GAAG,IAAI,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACvF,KAAK,iBAAiB;oBACpB,OAAO,GAAG,IAAI,gBAAgB,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAC/F,KAAK,eAAe;oBAClB,OAAO,GAAG,IAAI,iBAAiB,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC;gBACxE;oBACE,OAAO,GAAG,IAAI,MAAM,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;YACrD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IACnB,CAAC;CACF;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,IAAI,QAAQ,GAA8B,IAAI,CAAC;AAE/C,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,cAAc;AACd,MAAM,UAAU,uBAAuB;IACrC,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC"}

package/dist/services/permission-pattern-matcher.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Pattern-based permission matching for granular tool control.
+ *
+ * Supports Claude Code-style patterns:
+ * - Bash - all bash commands
+ * - Bash(npm *) - bash commands starting with "npm "
+ * - Bash(git commit *) - bash commands starting with "git commit "
+ * - Write(src/**) - write to any file under src/
+ * - Write(*.ts) - write to any .ts file
+ * - Edit(src/**.tsx) - edit .tsx files under src/
+ * - Read - all read operations
+ *
+ * Pattern syntax:
+ * - * matches any characters except path separators
+ * - ** matches any characters including path separators
+ * - Patterns without parentheses match the entire tool (e.g., Bash matches all bash)
+ */
+export interface PermissionPattern {
+    tool: string;
+    pattern: string | null;
+    raw: string;
+}
+/**
+ * Parse a permission pattern string into its components.
+ *
+ * Examples:
+ * - "Bash" -> { tool: "Bash", pattern: null, raw: "Bash" }
+ * - "Bash(npm *)" -> { tool: "Bash", pattern: "npm *", raw: "Bash(npm *)" }
+ * - "Write(src/**)" -> { tool: "Write", pattern: "src/**", raw: "Write(src/**)" }
+ */
+export declare function parsePattern(patternStr: string): PermissionPattern;
+/**
+ * Extract the matchable value from a tool input based on tool type.
+ */
+export declare function getMatchableValue(toolName: string, input: Record<string, unknown>): string | null;
+/**
+ * Check if a tool invocation matches a permission pattern.
+ *
+ * @param pattern - The parsed permission pattern
+ * @param toolName - The tool being invoked (e.g., "Bash")
+ * @param input - The tool input parameters
+ * @returns true if the pattern allows this invocation
+ */
+export declare function matchesPermission(pattern: PermissionPattern, toolName: string, input: Record<string, unknown>): boolean;
+/**
+ * Check if a tool invocation is allowed by any pattern in a list.
+ *
+ * @param patterns - List of permission pattern strings
+ * @param toolName - The tool being invoked
+ * @param input - The tool input parameters
+ * @returns The matching pattern if allowed, null otherwise
+ */
+export declare function isAllowedByPatterns(patterns: string[], toolName: string, input: Record<string, unknown>): string | null;
+/**
+ * Generate suggested patterns for a given tool invocation.
+ * Returns patterns from most specific to least specific.
+ *
+ * For bash commands, handles complex multi-part commands:
+ * - Extracts primary command before pipes (|) and chains (&&, ;)
+ * - Recognizes common CLI tools and their subcommands
+ * - Generates meaningful intermediate patterns
+ *
+ * Examples for Bash(fd -e tsx . ~/cui-custom | head -30):
+ * - "Bash(fd -e tsx . ~/cui-custom | head -30)" - exact command
+ * - "Bash(fd *)" - any fd command
+ * - "Bash" - all bash
+ *
+ * Examples for Bash(git commit -m "message"):
+ * - "Bash(git commit -m "message")" - exact command
+ * - "Bash(git commit *)" - any git commit
+ * - "Bash(git *)" - any git command
+ * - "Bash" - all bash
+ *
+ * Examples for Write(src/components/Button.tsx):
+ * - "Write(src/components/Button.tsx)" - exact file
+ * - "Write(src/components/[star].tsx)" - any tsx in components
+ * - "Write(src/[starstar]/[star].tsx)" - any tsx under src
+ * - "Write([star].tsx)" - any tsx file
+ * - "Write" - all writes
+ */
+export declare function suggestPatterns(toolName: string, input: Record<string, unknown>): string[];
+//# sourceMappingURL=permission-pattern-matcher.d.ts.map

package/dist/services/permission-pattern-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-pattern-matcher.d.ts","sourceRoot":"","sources":["../../src/services/permission-pattern-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAeH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB,CAclE;AAkCD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAUjG;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAsBT;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,GAAG,IAAI,CAQf;AA4FD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,EAAE,CAuEV"}

package/dist/services/permission-pattern-matcher.js

@@ -0,0 +1,294 @@
+/**
+ * Pattern-based permission matching for granular tool control.
+ *
+ * Supports Claude Code-style patterns:
+ * - Bash - all bash commands
+ * - Bash(npm *) - bash commands starting with "npm "
+ * - Bash(git commit *) - bash commands starting with "git commit "
+ * - Write(src/**) - write to any file under src/
+ * - Write(*.ts) - write to any .ts file
+ * - Edit(src/**.tsx) - edit .tsx files under src/
+ * - Read - all read operations
+ *
+ * Pattern syntax:
+ * - * matches any characters except path separators
+ * - ** matches any characters including path separators
+ * - Patterns without parentheses match the entire tool (e.g., Bash matches all bash)
+ */
+import { minimatch } from 'minimatch';
+// Tool input field mappings - which field to match against for each tool
+const TOOL_MATCH_FIELDS = {
+    Bash: 'command',
+    Write: 'file_path',
+    Read: 'file_path',
+    Edit: 'file_path',
+    Glob: 'pattern',
+    Grep: 'pattern',
+    // MCP tools use the full tool name as the pattern
+};
+/**
+ * Parse a permission pattern string into its components.
+ *
+ * Examples:
+ * - "Bash" -> { tool: "Bash", pattern: null, raw: "Bash" }
+ * - "Bash(npm *)" -> { tool: "Bash", pattern: "npm *", raw: "Bash(npm *)" }
+ * - "Write(src/**)" -> { tool: "Write", pattern: "src/**", raw: "Write(src/**)" }
+ */
+export function parsePattern(patternStr) {
+    const match = patternStr.match(/^([A-Za-z_][A-Za-z0-9_]*)(?:\((.+)\))?$/);
+    if (!match) {
+        // Invalid pattern, treat as literal tool name
+        return { tool: patternStr, pattern: null, raw: patternStr };
+    }
+    const [, tool, pattern] = match;
+    return {
+        tool,
+        pattern: pattern || null,
+        raw: patternStr,
+    };
+}
+/**
+ * Convert a Claude Code-style pattern to a regex or minimatch pattern.
+ *
+ * For Bash commands:
+ * - "npm *" matches "npm install", "npm run test", etc.
+ * - "*" is converted to match any non-newline characters
+ *
+ * For file paths:
+ * - "src/**" matches any file under src/
+ * - "*.ts" matches any .ts file
+ * - Uses minimatch for glob-style matching
+ */
+function matchesPattern(value, pattern, isPath) {
+    if (isPath) {
+        // Use minimatch for file path patterns (supports ** and *)
+        return minimatch(value, pattern, {
+            matchBase: true, // Match basename if pattern has no slashes
+            dot: true, // Match dotfiles
+        });
+    }
+    else {
+        // For command matching, convert simple wildcards to regex
+        // "npm *" should match "npm install" but not "npm"
+        // "*" matches any characters
+        const regexPattern = pattern
+            .replace(/[.+^${}()|[\]\\]/g, '\\$&') // Escape special regex chars except *
+            .replace(/\*/g, '.*'); // Convert * to .*
+        const regex = new RegExp(`^${regexPattern}$`);
+        return regex.test(value);
+    }
+}
+/**
+ * Extract the matchable value from a tool input based on tool type.
+ */
+export function getMatchableValue(toolName, input) {
+    const field = TOOL_MATCH_FIELDS[toolName];
+    if (!field) {
+        // Unknown tool or MCP tool - no pattern matching support
+        return null;
+    }
+    const value = input[field];
+    return typeof value === 'string' ? value : null;
+}
+/**
+ * Check if a tool invocation matches a permission pattern.
+ *
+ * @param pattern - The parsed permission pattern
+ * @param toolName - The tool being invoked (e.g., "Bash")
+ * @param input - The tool input parameters
+ * @returns true if the pattern allows this invocation
+ */
+export function matchesPermission(pattern, toolName, input) {
+    // Tool name must match
+    if (pattern.tool !== toolName) {
+        return false;
+    }
+    // If no pattern specified, match all invocations of this tool
+    if (!pattern.pattern) {
+        return true;
+    }
+    // Get the value to match against
+    const value = getMatchableValue(toolName, input);
+    if (value === null) {
+        // Can't extract matchable value - no match
+        return false;
+    }
+    // Determine if this is a path-based tool
+    const isPath = ['Write', 'Read', 'Edit', 'Glob'].includes(toolName);
+    return matchesPattern(value, pattern.pattern, isPath);
+}
+/**
+ * Check if a tool invocation is allowed by any pattern in a list.
+ *
+ * @param patterns - List of permission pattern strings
+ * @param toolName - The tool being invoked
+ * @param input - The tool input parameters
+ * @returns The matching pattern if allowed, null otherwise
+ */
+export function isAllowedByPatterns(patterns, toolName, input) {
+    for (const patternStr of patterns) {
+        const pattern = parsePattern(patternStr);
+        if (matchesPermission(pattern, toolName, input)) {
+            return patternStr;
+        }
+    }
+    return null;
+}
+/**
+ * Extract the primary command from a complex bash command.
+ * Handles pipes, chains (&&, ;), and redirections.
+ *
+ * Examples:
+ * - "fd -e tsx . ~/cui-custom | head -30" -> "fd -e tsx . ~/cui-custom"
+ * - "git add . && git commit -m 'msg'" -> "git add ."
+ * - "echo 'test' > file.txt && cat file.txt" -> "echo 'test'"
+ */
+function extractPrimaryCommand(command) {
+    // Remove leading/trailing whitespace
+    let cmd = command.trim();
+    // Find the first pipe or chain operator (not inside quotes)
+    let inSingleQuote = false;
+    let inDoubleQuote = false;
+    let cutIndex = -1;
+    for (let i = 0; i < cmd.length; i++) {
+        const char = cmd[i];
+        const prevChar = i > 0 ? cmd[i - 1] : '';
+        if (char === "'" && prevChar !== '\\' && !inDoubleQuote) {
+            inSingleQuote = !inSingleQuote;
+        }
+        else if (char === '"' && prevChar !== '\\' && !inSingleQuote) {
+            inDoubleQuote = !inDoubleQuote;
+        }
+        else if (!inSingleQuote && !inDoubleQuote) {
+            // Check for pipe or chain operators
+            if (char === '|' || char === ';') {
+                cutIndex = i;
+                break;
+            }
+            if (char === '&' && cmd[i + 1] === '&') {
+                cutIndex = i;
+                break;
+            }
+        }
+    }
+    if (cutIndex > 0) {
+        cmd = cmd.substring(0, cutIndex).trim();
+    }
+    // Remove output redirections from end (> file, >> file, 2>&1, etc.)
+    // Be careful to preserve redirections that are part of the command meaning
+    cmd = cmd.replace(/\s*(?:2>&1|>&2|>\s*\S+|>>\s*\S+)\s*$/, '').trim();
+    return cmd;
+}
+function analyzeCommand(command) {
+    const primary = extractPrimaryCommand(command);
+    const parts = primary.split(/\s+/).filter(p => p.length > 0);
+    if (parts.length === 0) {
+        return { baseCommand: '', subCommand: null, fullCommand: primary };
+    }
+    const baseCommand = parts[0];
+    // Commands that have meaningful subcommands
+    const commandsWithSubcommands = new Set([
+        'git', 'npm', 'pnpm', 'yarn', 'docker', 'kubectl', 'systemctl',
+        'cargo', 'go', 'pip', 'python', 'node', 'deno', 'bun',
+        'gh', 'aws', 'gcloud', 'az', 'terraform', 'make',
+    ]);
+    // Check if second part is a subcommand (not a flag)
+    let subCommand = null;
+    if (parts.length > 1 && commandsWithSubcommands.has(baseCommand)) {
+        const second = parts[1];
+        // Subcommands don't start with - and aren't paths
+        if (!second.startsWith('-') && !second.includes('/')) {
+            subCommand = second;
+        }
+    }
+    return { baseCommand, subCommand, fullCommand: primary };
+}
+/**
+ * Generate suggested patterns for a given tool invocation.
+ * Returns patterns from most specific to least specific.
+ *
+ * For bash commands, handles complex multi-part commands:
+ * - Extracts primary command before pipes (|) and chains (&&, ;)
+ * - Recognizes common CLI tools and their subcommands
+ * - Generates meaningful intermediate patterns
+ *
+ * Examples for Bash(fd -e tsx . ~/cui-custom | head -30):
+ * - "Bash(fd -e tsx . ~/cui-custom | head -30)" - exact command
+ * - "Bash(fd *)" - any fd command
+ * - "Bash" - all bash
+ *
+ * Examples for Bash(git commit -m "message"):
+ * - "Bash(git commit -m "message")" - exact command
+ * - "Bash(git commit *)" - any git commit
+ * - "Bash(git *)" - any git command
+ * - "Bash" - all bash
+ *
+ * Examples for Write(src/components/Button.tsx):
+ * - "Write(src/components/Button.tsx)" - exact file
+ * - "Write(src/components/[star].tsx)" - any tsx in components
+ * - "Write(src/[starstar]/[star].tsx)" - any tsx under src
+ * - "Write([star].tsx)" - any tsx file
+ * - "Write" - all writes
+ */
+export function suggestPatterns(toolName, input) {
+    const suggestions = [];
+    const value = getMatchableValue(toolName, input);
+    if (!value) {
+        // No matchable value - just return tool-level permission
+        return [toolName];
+    }
+    if (toolName === 'Bash') {
+        const { baseCommand, subCommand, fullCommand } = analyzeCommand(value);
+        // 1. Exact command (safest) - always include full original
+        suggestions.push(`Bash(${value})`);
+        // 2. If command was extracted from pipes/chains, offer the primary command
+        if (fullCommand !== value && fullCommand.length > 0) {
+            suggestions.push(`Bash(${fullCommand})`);
+        }
+        // 3. If there's a subcommand, offer "base subcommand *" pattern
+        if (subCommand) {
+            suggestions.push(`Bash(${baseCommand} ${subCommand} *)`);
+        }
+        // 4. Offer "base *" pattern for the base command
+        if (baseCommand) {
+            suggestions.push(`Bash(${baseCommand} *)`);
+        }
+        // 5. All bash commands (broadest)
+        suggestions.push(toolName);
+    }
+    else if (['Write', 'Read', 'Edit'].includes(toolName)) {
+        // For file operations, suggest path patterns from specific to broad
+        const filePath = value;
+        const fileName = filePath.split('/').pop() || filePath;
+        const ext = fileName.includes('.') ? fileName.split('.').pop() : null;
+        const dirPath = filePath.includes('/') ? filePath.substring(0, filePath.lastIndexOf('/')) : null;
+        // 1. Exact file (safest)
+        suggestions.push(`${toolName}(${filePath})`);
+        // 2. Same directory, same extension (e.g., src/components/*.tsx)
+        if (dirPath && ext) {
+            suggestions.push(`${toolName}(${dirPath}/*.${ext})`);
+        }
+        // 3. Recursive from directory with same extension (e.g., src/**/*.tsx)
+        if (dirPath && ext) {
+            // Find the top-level directory for recursive pattern
+            const topDir = dirPath.split('/')[0];
+            if (topDir && topDir !== dirPath) {
+                suggestions.push(`${toolName}(${topDir}/**/*.${ext})`);
+            }
+        }
+        // 4. Any file with this extension anywhere (e.g., *.tsx)
+        if (ext) {
+            suggestions.push(`${toolName}(*.${ext})`);
+        }
+        // 5. All operations of this tool (broadest)
+        suggestions.push(toolName);
+    }
+    else {
+        // Unknown tool type - just exact and all
+        suggestions.push(`${toolName}(${value})`);
+        suggestions.push(toolName);
+    }
+    // Remove duplicates while preserving order
+    return [...new Set(suggestions)];
+}
+//# sourceMappingURL=permission-pattern-matcher.js.map

package/dist/services/permission-pattern-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-pattern-matcher.js","sourceRoot":"","sources":["../../src/services/permission-pattern-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,yEAAyE;AACzE,MAAM,iBAAiB,GAA2B;IAChD,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,SAAS;IACf,kDAAkD;CACnD,CAAC;AAQF;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,8CAA8C;QAC9C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IAChC,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,GAAG,EAAE,UAAU;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,KAAa,EAAE,OAAe,EAAE,MAAe;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,2DAA2D;QAC3D,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE;YAC/B,SAAS,EAAE,IAAI,EAAG,2CAA2C;YAC7D,GAAG,EAAE,IAAI,EAAS,iBAAiB;SACpC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,0DAA0D;QAC1D,mDAAmD;QACnD,6BAA6B;QAC7B,MAAM,YAAY,GAAG,OAAO;aACzB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAE,sCAAsC;aAC5E,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAkB,kBAAkB;QAE5D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAA8B;IAChF,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,yDAAyD;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA0B,EAC1B,QAAgB,EAChB,KAA8B;IAE9B,uBAAuB;IACvB,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iCAAiC;IACjC,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,2CAA2C;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yCAAyC;IACzC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpE,OAAO,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAkB,EAClB,QAAgB,EAChB,KAA8B;IAE9B,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,qCAAqC;IACrC,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAEzB,4DAA4D;IAC5D,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAElB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzC,IAAI,IAAI,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,aAAa,GAAG,CAAC,aAAa,CAAC;QACjC,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/D,aAAa,GAAG,CAAC,aAAa,CAAC;QACjC,CAAC;aAAM,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;YAC5C,oCAAoC;YACpC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjC,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM;YACR,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACvC,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,oEAAoE;IACpE,2EAA2E;IAC3E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAErE,OAAO,GAAG,CAAC;AACb,CAAC;AAYD,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7B,4CAA4C;IAC5C,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;QACtC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW;QAC9D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;QACrD,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM;KACjD,CAAC,CAAC;IAEH,oDAAoD;IACpD,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,KAA8B;IAE9B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,yDAAyD;QACzD,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAEvE,2DAA2D;QAC3D,WAAW,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;QAEnC,2EAA2E;QAC3E,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,WAAW,CAAC,IAAI,CAAC,QAAQ,WAAW,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,gEAAgE;QAChE,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CAAC,QAAQ,WAAW,IAAI,UAAU,KAAK,CAAC,CAAC;QAC3D,CAAC;QAED,iDAAiD;QACjD,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,CAAC,IAAI,CAAC,QAAQ,WAAW,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,kCAAkC;QAClC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;SAAM,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,oEAAoE;QACpE,MAAM,QAAQ,GAAG,KAAK,CAAC;QACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEjG,yBAAyB;QACzB,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,QAAQ,GAAG,CAAC,CAAC;QAE7C,iEAAiE;QACjE,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,uEAAuE;QACvE,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,qDAAqD;YACrD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,MAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACjC,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,GAAG,EAAE,CAAC;YACR,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,MAAM,GAAG,GAAG,CAAC,CAAC;QAC5C,CAAC;QAED,4CAA4C;QAC5C,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,yCAAyC;QACzC,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,KAAK,GAAG,CAAC,CAAC;QAC1C,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,2CAA2C;IAC3C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;AACnC,CAAC"}