pi-codex-auto-review 0.1.0

package/dist/tools/controller.d.ts

@@ -0,0 +1,63 @@
+import { type BashToolOptions, type BashOperations, type ExtensionContext, type ToolDefinition, type ToolCallEvent, type ReadToolOptions } from '@earendil-works/pi-coding-agent';
+import { type GuardAction, type Json, type PermissionProfile } from '../contracts.js';
+import { PolicyEngine, type GuardSettings } from '../policy/index.js';
+import { ApprovalManager } from '../approvals.js';
+import { type ReviewProvider } from '../reviewer.js';
+import { AuditLog } from '../audit.js';
+import { type SandboxExecutor } from '../sandbox/executor.js';
+import { ReviewContextStore } from '../review/context.js';
+import { type ExternalToolIdentity } from './external.js';
+export declare class GuardController {
+    readonly options: {
+        profile: PermissionProfile;
+        settings: GuardSettings;
+        executor: SandboxExecutor;
+        approvals: ApprovalManager;
+        audit: AuditLog;
+        provider?: ReviewProvider;
+        shellPath?: string;
+    };
+    readonly policy: PolicyEngine;
+    readonly approvals: ApprovalManager;
+    private sources;
+    private ownedOperations;
+    private stopped;
+    private sessionId;
+    private isReady;
+    readonly reviewContext: ReviewContextStore;
+    private activeReviews;
+    private retryArguments;
+    private externalTools;
+    constructor(options: {
+        profile: PermissionProfile;
+        settings: GuardSettings;
+        executor: SandboxExecutor;
+        approvals: ApprovalManager;
+        audit: AuditLog;
+        provider?: ReviewProvider;
+        shellPath?: string;
+    });
+    initialize(cwd: string): Promise<void>;
+    assertReady(): void;
+    isBoundToSession(sessionId: string): boolean;
+    reset(sessionId: string, manager?: ExtensionContext['sessionManager']): void;
+    startTurn(): void;
+    authorizeRetry(id: string, context: ExtensionContext): Promise<{
+        denial: import("../contracts.js").RecentDenial;
+        args: Readonly<Record<string, Json>>;
+    }>;
+    retryUserBash(action: GuardAction, context: ExtensionContext): Promise<void>;
+    authorizeUser(text: string): void;
+    noteCall(event: ToolCallEvent): void;
+    completeCall(toolCallId: string): void;
+    close(): Promise<void>;
+    private ui;
+    private requestAdmission;
+    private denied;
+    isExternalTool(name: string): boolean;
+    wrapExternalTool(definition: ToolDefinition<any, any, any>, identify: () => ExternalToolIdentity): ToolDefinition<any, any, any>;
+    private admitAndExecute;
+    wrapTool(definition: ToolDefinition<any, any, any>, toolOptions?: ReadToolOptions | BashToolOptions): ToolDefinition<any, any, any>;
+    userBashOperations(context: ExtensionContext, trustedCommand?: string): BashOperations;
+    isGuardedOperations(operations: BashOperations): boolean;
+}

package/dist/tools/controller.js

@@ -0,0 +1,286 @@
+import { randomUUID } from 'node:crypto';
+import { createBashToolDefinition, withFileMutationQueue } from '@earendil-works/pi-coding-agent';
+import { pathToFileURL } from 'node:url';
+import { createAction, canonicalJson, digest, decision, GuardError, TOOL_NAMES } from '../contracts.js';
+import { PolicyEngine, canonicalPath, resolveToolPath } from '../policy/index.js';
+import { PiReviewProvider } from '../reviewer.js';
+import { redact } from '../audit.js';
+import { workloadEnvironment } from '../sandbox/config.js';
+import { ReviewContextStore, safeEvidence } from '../review/context.js';
+import { NativeInvestigation } from '../review/investigation.js';
+import { matchesDomain } from '../policy/domains.js';
+import { reviewFeedback } from '../review/lifecycle.js';
+import { externalInvocations, externalPolicy } from './external.js';
+export class GuardController {
+    options;
+    policy;
+    approvals;
+    sources = new Map();
+    ownedOperations = new WeakSet();
+    stopped = new AbortController();
+    sessionId = 'not-started';
+    isReady = false;
+    reviewContext = new ReviewContextStore();
+    activeReviews = new Set();
+    retryArguments = new Map();
+    externalTools = new Map();
+    constructor(options) {
+        this.options = options;
+        this.policy = new PolicyEngine(options.settings, options.profile);
+        this.approvals = options.approvals;
+    }
+    async initialize(cwd) {
+        await this.policy.initialize(cwd);
+        await this.approvals.initialize();
+        await this.options.executor.qualify(this.policy.profile, cwd);
+        this.isReady = true;
+    }
+    assertReady() { if (!this.isReady || this.stopped.signal.aborted)
+        throw new GuardError('GUARD_NOT_READY', 'Guard is not ready for execution'); }
+    isBoundToSession(sessionId) { return this.sessionId === sessionId && !this.stopped.signal.aborted; }
+    reset(sessionId, manager) {
+        this.stopped.abort(new GuardError('SESSION_CHANGED', 'Session changed'));
+        this.stopped = new AbortController();
+        this.sessionId = sessionId;
+        this.reviewContext.reset(sessionId, manager);
+        this.approvals.reset(sessionId);
+        this.sources.clear();
+        this.activeReviews.clear();
+        this.retryArguments.clear();
+    }
+    startTurn() { this.reviewContext.startTurn(); this.approvals.lifecycle.startTurn(); this.activeReviews.clear(); }
+    async authorizeRetry(id, context) {
+        this.assertReady();
+        const denial = this.approvals.lifecycle.authorizeRetry(id, { sessionId: context.sessionManager.getSessionId(), contextId: this.reviewContext.identity, cwd: await canonicalPath(context.cwd, context.cwd), policyRevision: this.policy.revision, permissionDigest: digest(this.policy.profile) });
+        const args = this.retryArguments.get(id) ?? denial.action.args;
+        this.retryArguments.delete(id);
+        return { denial, args };
+    }
+    async retryUserBash(action, context) {
+        const next = createAction({ ...action, toolCallId: randomUUID() }, this.policy.profile);
+        const command = String(next.args.command), shellPath = String(next.args.shellPath ?? '/bin/bash');
+        await this.admitAndExecute(next, { kind: 'shell', command, shellPath, cwd: next.cwd }, context, { timeoutSeconds: typeof next.args.timeout === 'number' ? next.args.timeout : undefined, env: next.args.environment });
+    }
+    authorizeUser(text) { this.reviewContext.authorize(text); this.approvals.lifecycle.invalidateRetries(); }
+    noteCall(event) {
+        this.sources.set(event.toolCallId, event.parentToolCallId ? 'nested' : 'model');
+        this.reviewContext.toolCall({ tool: event.toolName, args: JSON.parse(canonicalJson(event.input)) }, event.toolCallId);
+    }
+    completeCall(toolCallId) { this.sources.delete(toolCallId); }
+    async close() {
+        this.isReady = false;
+        this.stopped.abort();
+        this.approvals.reset();
+        this.externalTools.clear();
+        await this.options.executor.close();
+        await this.approvals.settle();
+    }
+    ui(context, isOnceOnly = false) {
+        if (!context.hasUI || (context.mode !== 'tui' && context.mode !== 'rpc'))
+            return undefined;
+        const scopes = { '한 번 허용': 'once', '이 세션에서 허용': 'session', '규칙으로 저장해 허용': 'persistent', '거부': 'deny' };
+        return { select: async (action, delta, options) => {
+                const text = `도구: ${action.tool}\n작업 디렉터리: ${action.cwd}\n입력: ${canonicalJson(action.args)}\n추가 권한: ${canonicalJson(delta)}`;
+                const selected = await context.ui.select(`실행 승인\n${text}`, isOnceOnly ? ['한 번 허용', '거부'] : Object.keys(scopes), { signal: options.signal, timeout: options.timeoutMs });
+                if (selected)
+                    this.reviewContext.confirm({ actionDigest: action.digest, choice: selected });
+                return selected ? scopes[selected] : undefined;
+            } };
+    }
+    async requestAdmission(action, policyDecision, context, signal, trustedAuthorization = '') {
+        let reviewContext = policyDecision.kind === 'ask' ? this.reviewContext.snapshot(this.options.settings.reviewContextChars, canonicalJson(action).length + canonicalJson(policyDecision.delta).length + 1000) : undefined;
+        if (reviewContext && trustedAuthorization) {
+            const data = { ...reviewContext, items: [...reviewContext.items, { id: 'direct-user-bash', source: 'user', trust: 'authorization', content: safeEvidence(trustedAuthorization) }] };
+            reviewContext = { ...data, digest: digest(data) };
+        }
+        const turnIdentity = this.reviewContext.turnIdentity;
+        return this.approvals.admit(action, policyDecision, {
+            provider: this.options.provider ?? new PiReviewProvider(context, this.options.settings, new NativeInvestigation(this.options.executor, this.policy.profile, action.cwd)), ui: this.ui(context, policyDecision.requiresFreshReview || policyDecision.requiresUserInput), trustedAuthorization, signal, reviewContext, settings: this.options.settings,
+            onReviewStart: () => { this.activeReviews.add(action.digest); if (context.hasUI)
+                context.ui.setStatus('auto-review', `자동 검토 중 (${this.activeReviews.size})`); },
+            onReviewResult: result => {
+                this.activeReviews.delete(action.digest);
+                if (turnIdentity !== this.reviewContext.turnIdentity || !context.hasUI)
+                    return;
+                const labels = { 'approved': '승인', 'denied': '거부', 'timed-out': '시간 초과', 'aborted': '취소', 'failed': '실패' };
+                context.ui.setStatus('auto-review', this.activeReviews.size ? `자동 검토 중 (${this.activeReviews.size})` : result ? `자동 검토: ${labels[result.status]}` : undefined);
+                if (result && result.status !== 'approved' && result.status !== 'aborted')
+                    context.ui.notify(`자동 검토 ${labels[result.status]}: ${redact('assessment' in result ? result.assessment.rationale : result.reason).slice(0, 1000)}`, 'warning');
+            },
+            onInterrupt: () => { if (context.hasUI)
+                context.ui.notify('자동 검토의 반복 거부 한도에 도달해 현재 작업을 중단합니다.', 'warning'); context.abort?.(); },
+        });
+    }
+    denied(admission, retryArguments) {
+        if (admission.denialId && retryArguments)
+            this.retryArguments.set(admission.denialId, retryArguments);
+        const retained = new Set(this.approvals.lifecycle.recentDenials.map(item => item.id));
+        for (const id of this.retryArguments.keys())
+            if (!retained.has(id))
+                this.retryArguments.delete(id);
+        if (admission.review) {
+            const feedback = reviewFeedback(admission.review);
+            return new GuardError(feedback.code, `[${feedback.code}] ${feedback.message}${admission.denialId ? `\nRecent denial: ${admission.denialId}. The user may request /approve for one exact reviewed retry.` : ''}`);
+        }
+        return new GuardError('PERMISSION_DENIED', admission.reason);
+    }
+    isExternalTool(name) { return this.externalTools.get(name)?.isEnabled === true; }
+    wrapExternalTool(definition, identify) {
+        if (TOOL_NAMES.includes(definition.name) || definition.name === 'codemode')
+            throw new GuardError('RESERVED_TOOL', 'An external adapter cannot replace guarded local tools');
+        const token = randomUUID(), execute = definition.execute;
+        this.externalTools.set(definition.name, { token, isEnabled: definition.exposure !== 'hidden' });
+        const schema = JSON.parse(JSON.stringify({ parameters: definition.parameters, description: definition.description, annotations: definition.annotations ?? {} }));
+        return { ...definition, execute: async (toolCallId, params, callerSignal, onUpdate, context) => {
+                this.assertReady();
+                const lifetime = new AbortController();
+                const signal = AbortSignal.any([lifetime.signal, this.stopped.signal, this.approvals.lifecycle.signal, ...(callerSignal ? [callerSignal] : [])]);
+                signal.throwIfAborted();
+                const args = JSON.parse(canonicalJson(params ?? {}));
+                const identity = JSON.parse(JSON.stringify(identify()));
+                const identityDigest = digest(identity), cwd = await canonicalPath(context.cwd, context.cwd);
+                const action = createAction({ toolCallId, tool: definition.name, args: { arguments: args, externalTool: JSON.parse(JSON.stringify(identity)), schema }, cwd, source: this.sources.get(toolCallId) ?? 'model', sessionId: context.sessionManager.getSessionId(), policyRevision: this.policy.revision }, this.policy.profile);
+                const authorizationVersion = this.reviewContext.scopeVersion, turn = this.reviewContext.turnIdentity;
+                const checkCurrent = async () => {
+                    this.assertReady();
+                    signal.throwIfAborted();
+                    if (this.externalTools.get(definition.name)?.token !== token || !this.isExternalTool(definition.name) || digest(JSON.parse(JSON.stringify(identify()))) !== identityDigest)
+                        throw new GuardError('STALE_EXTERNAL_TOOL', 'External registration changed; a fresh action must be reviewed');
+                    if (this.reviewContext.scopeVersion !== authorizationVersion || this.reviewContext.turnIdentity !== turn || this.sessionId !== action.sessionId || this.policy.revision !== action.policyRevision || await canonicalPath(context.cwd, context.cwd) !== cwd)
+                        throw new GuardError('STALE_APPROVAL', 'External execution context changed after admission');
+                    signal.throwIfAborted();
+                };
+                const approve = async (candidate, candidateIdentity) => {
+                    await checkCurrent();
+                    const admission = await this.requestAdmission(candidate, externalPolicy(candidate, candidateIdentity, this.options.settings), context, signal);
+                    if (!admission.isAllowed)
+                        throw this.denied(admission, args);
+                    await checkCurrent();
+                };
+                try {
+                    await approve(action, identity);
+                    const result = await externalInvocations.run({ toolCallId, identity, arguments: args, signal, checkCurrent, approveNested: async (nestedIdentity, nestedArgs) => {
+                            if (nestedIdentity.server !== identity.server || nestedIdentity.registration !== identity.registration)
+                                return false;
+                            const nested = createAction({ toolCallId: `${toolCallId}:elicitation:${randomUUID()}`, tool: definition.name, args: { arguments: nestedArgs, externalTool: JSON.parse(JSON.stringify(nestedIdentity)), originatingActionDigest: action.digest }, cwd, source: 'nested', sessionId: action.sessionId, policyRevision: action.policyRevision }, this.policy.profile);
+                            try {
+                                await approve(nested, nestedIdentity);
+                                return true;
+                            }
+                            catch {
+                                return false;
+                            }
+                        } }, () => execute.call(definition, toolCallId, args, signal, onUpdate, context));
+                    await this.options.audit.record(action, 'execution', 'settled');
+                    return result;
+                }
+                catch (error) {
+                    await this.options.audit.record(action, 'execution', 'failed');
+                    throw error;
+                }
+                finally {
+                    lifetime.abort();
+                    this.completeCall(toolCallId);
+                }
+            } };
+    }
+    async admitAndExecute(action, job, context, options, trustedAuthorization = '', retryArguments) {
+        this.assertReady();
+        const signal = AbortSignal.any([this.stopped.signal, ...(action.source === 'user-bash' ? [] : [this.approvals.lifecycle.signal]), ...(options.signal ? [options.signal] : [])]);
+        const authorizationVersion = this.reviewContext.scopeVersion;
+        const policyDecision = await this.policy.evaluate(action, signal);
+        const admission = await this.requestAdmission(action, policyDecision, context, signal, trustedAuthorization);
+        if (!admission.isAllowed)
+            throw this.denied(admission, retryArguments);
+        signal.throwIfAborted();
+        if (this.reviewContext.scopeVersion !== authorizationVersion)
+            throw new GuardError('STALE_AUTHORIZATION', 'User authorization changed during review; request a fresh review');
+        if (this.sessionId !== action.sessionId || await canonicalPath(context.cwd, context.cwd) !== action.cwd || this.policy.revision !== action.policyRevision)
+            throw new GuardError('STALE_APPROVAL', 'Execution context changed after admission');
+        const finalDecision = await this.policy.evaluate(action, signal);
+        if (finalDecision.kind === 'deny')
+            throw new GuardError('PERMISSION_DENIED', finalDecision.reason);
+        if (digest(finalDecision.delta) !== digest(policyDecision.delta))
+            throw new GuardError('STALE_APPROVAL', 'Resolved permissions changed after admission');
+        if (digest(finalDecision.authority ?? null) !== digest(policyDecision.authority ?? null))
+            throw new GuardError('STALE_APPROVAL', 'Execution authority changed after admission');
+        try {
+            let networkDenial;
+            const result = await this.options.executor.execute(job, this.policy.profile, admission.delta, {
+                ...options, signal, authority: admission.authority, timeoutSeconds: options.timeoutSeconds ?? this.options.settings.executionTimeoutSeconds,
+                onNetworkRequest: async (destination, networkSignal) => {
+                    if (networkSignal.aborted || action.sessionId !== this.sessionId || this.policy.profile.deniedDomains.some(pattern => matchesDomain(destination.host, pattern)))
+                        return false;
+                    const networkAction = createAction({ toolCallId: `${action.toolCallId}:network:${randomUUID()}`, tool: action.tool, args: { ...action.args, networkDestination: { ...destination }, originatingActionDigest: action.digest }, cwd: action.cwd, source: action.source, sessionId: action.sessionId, policyRevision: action.policyRevision }, this.policy.profile);
+                    const networkPolicy = decision(networkAction, 'ask', 'Runtime network request from the exact originating command', { readPaths: [], writePaths: [], domains: [destination.host] });
+                    const networkAuthorizationVersion = this.reviewContext.scopeVersion;
+                    const reviewed = await this.requestAdmission(networkAction, networkPolicy, context, networkSignal, trustedAuthorization);
+                    if (!reviewed.isAllowed)
+                        networkDenial = this.denied(reviewed, retryArguments);
+                    if (networkSignal.aborted || this.reviewContext.scopeVersion !== networkAuthorizationVersion || this.sessionId !== action.sessionId || this.policy.revision !== action.policyRevision || await canonicalPath(context.cwd, context.cwd) !== action.cwd)
+                        return false;
+                    return reviewed.isAllowed;
+                },
+            });
+            if (networkDenial)
+                throw networkDenial;
+            await this.options.audit.record(action, 'execution', 'settled');
+            return result;
+        }
+        catch (error) {
+            await this.options.audit.record(action, 'execution', 'failed');
+            throw error;
+        }
+        finally {
+            this.completeCall(action.toolCallId);
+        }
+    }
+    wrapTool(definition, toolOptions) {
+        const tool = definition.name;
+        if (!TOOL_NAMES.includes(tool))
+            throw new GuardError('UNKNOWN_LOCAL_TOOL', 'Cannot delegate unknown local tool');
+        const parameters = tool === 'bash' ? { ...definition.parameters, properties: { ...definition.parameters.properties,
+                sandbox_permissions: { type: 'string', enum: ['use_default', 'require_escalated'], description: 'Request review before this exact command crosses the native sandbox boundary.' },
+                additional_permissions: { type: 'object', properties: { readPaths: { type: 'array', items: { type: 'string' } }, writePaths: { type: 'array', items: { type: 'string' } }, domains: { type: 'array', items: { type: 'string' } } }, additionalProperties: false, description: 'Narrow permission increase for this invocation; omit for an explicitly reviewed full command.' },
+                justification: { type: 'string', description: 'Explain the boundary crossing for review.' },
+            } } : definition.parameters;
+        return { ...definition, parameters, execute: async (toolCallId, params, signal, onUpdate, context) => {
+                this.assertReady();
+                const cwd = await canonicalPath(context.cwd, context.cwd);
+                if (tool === 'bash') {
+                    const input = params;
+                    const requested = JSON.parse(canonicalJson(Object.fromEntries(['sandbox_permissions', 'additional_permissions', 'justification'].filter(key => input[key] !== undefined).map(key => [key, input[key]]))));
+                    const delegate = createBashToolDefinition(cwd, { ...toolOptions, operations: { exec: async (command, finalCwd, options) => {
+                                const env = workloadEnvironment(options.env);
+                                const shellPath = toolOptions?.shellPath ?? '/bin/bash';
+                                const args = { command, shellPath, ...(options.timeout !== undefined ? { timeout: options.timeout } : {}), environment: env, ...requested };
+                                const resolvedCwd = await canonicalPath(finalCwd, finalCwd);
+                                const action = createAction({ toolCallId, tool, args: JSON.parse(canonicalJson(args)), cwd: resolvedCwd, source: this.sources.get(toolCallId) ?? 'model', sessionId: context.sessionManager.getSessionId(), policyRevision: this.policy.revision }, this.policy.profile);
+                                return await this.admitAndExecute(action, { kind: 'shell', command, shellPath, cwd: resolvedCwd }, { ...context, cwd: finalCwd }, { signal: options.signal, timeoutSeconds: options.timeout, env, onData: options.onData }, '', JSON.parse(canonicalJson(params)));
+                            } } });
+                    return delegate.execute(toolCallId, params, signal, onUpdate, context);
+                }
+                const args = JSON.parse(canonicalJson(params));
+                const target = await resolveToolPath(typeof args.path === 'string' ? args.path : '.', cwd, tool === 'read');
+                args.path = pathToFileURL(target).href;
+                const action = createAction({ toolCallId, tool, args, cwd, source: this.sources.get(toolCallId) ?? 'model', sessionId: context.sessionManager.getSessionId(), policyRevision: this.policy.revision }, this.policy.profile);
+                const options = tool === 'read' ? { ...toolOptions, ...(context.model?.inputLimits?.images?.resize ? { resizeOptions: context.model.inputLimits.images.resize } : {}) } : undefined;
+                const execute = () => this.admitAndExecute(action, { kind: 'tool', tool, args: action.args, cwd, toolCallId, ...(options ? { options } : {}) }, context, { signal, onUpdate: onUpdate ? result => onUpdate(result) : undefined }, '', JSON.parse(canonicalJson(params)));
+                const result = await (tool === 'write' || tool === 'edit' ? withFileMutationQueue(await canonicalPath(target, cwd), execute) : execute());
+                return result;
+            } };
+    }
+    userBashOperations(context, trustedCommand) {
+        const operations = { exec: async (command, cwd, options) => {
+                const resolvedCwd = await canonicalPath(cwd, cwd);
+                const env = workloadEnvironment(options.env);
+                const shellPath = this.options.shellPath ?? '/bin/bash';
+                const action = createAction({ toolCallId: randomUUID(), tool: 'bash', source: 'user-bash', args: JSON.parse(canonicalJson({ command, shellPath, environment: env, ...(options.timeout !== undefined ? { timeout: options.timeout } : {}) })), cwd: resolvedCwd, sessionId: context.sessionManager.getSessionId(), policyRevision: this.policy.revision }, this.policy.profile);
+                return await this.admitAndExecute(action, { kind: 'shell', command, shellPath, cwd: resolvedCwd }, context, { signal: options.signal, timeoutSeconds: options.timeout, env: options.env, onData: options.onData }, trustedCommand === undefined ? '' : `The user directly requested this shell command: ${trustedCommand}`, { command: trustedCommand ?? command });
+            } };
+        this.ownedOperations.add(operations);
+        return operations;
+    }
+    isGuardedOperations(operations) { return this.ownedOperations.has(operations); }
+}
+//# sourceMappingURL=controller.js.map

package/dist/tools/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/tools/controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAmI,MAAM,iCAAiC,CAAC;AACnO,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAsI,MAAM,iBAAiB,CAAC;AAC5O,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAsB,MAAM,oBAAoB,CAAC;AAEtG,OAAO,EAAE,gBAAgB,EAAuB,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAY,MAAM,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAA6B,MAAM,eAAe,CAAC;AAE/F,MAAM,OAAO,eAAe;IAYL;IAXZ,MAAM,CAAe;IACrB,SAAS,CAAkB;IAC5B,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC1C,eAAe,GAAG,IAAI,OAAO,EAAkB,CAAC;IAChD,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IAChC,SAAS,GAAG,aAAa,CAAC;IAC1B,OAAO,GAAG,KAAK,CAAC;IACf,aAAa,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAC1C,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,cAAc,GAAG,IAAI,GAAG,EAA0C,CAAC;IACnE,aAAa,GAAG,IAAI,GAAG,EAA+C,CAAC;IAC/E,YAAqB,OAAuL;QAAvL,YAAO,GAAP,OAAO,CAAgL;QAC1M,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,WAAW,KAAW,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC,CAAC,CAAC;IACtJ,gBAAgB,CAAC,SAAiB,IAAa,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACrH,KAAK,CAAC,SAAiB,EAAE,OAA4C;QACnE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IACD,SAAS,KAAW,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvH,KAAK,CAAC,cAAc,CAAC,EAAU,EAAE,OAAyB;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,EAAC,SAAS,EAAC,OAAO,CAAC,cAAc,CAAC,YAAY,EAAE,EAAC,SAAS,EAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAC,GAAG,EAAC,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAC,OAAO,CAAC,GAAG,CAAC,EAAC,cAAc,EAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAC,gBAAgB,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAC,CAAC,CAAC;QACtR,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC/D,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAC,MAAM,EAAE,IAAI,EAAC,CAAC;IACxB,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,MAAmB,EAAE,OAAyB;QAChE,MAAM,IAAI,GAAG,YAAY,CAAC,EAAC,GAAG,MAAM,EAAC,UAAU,EAAC,UAAU,EAAE,EAAC,EAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnF,MAAM,OAAO,GAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAC,SAAS,GAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAE,WAAW,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAC,EAAC,IAAI,EAAC,OAAO,EAAC,OAAO,EAAC,SAAS,EAAC,GAAG,EAAC,IAAI,CAAC,GAAG,EAAC,EAAC,OAAO,EAAC,EAAC,cAAc,EAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,KAAG,QAAQ,CAAA,CAAC,CAAA,IAAI,CAAC,IAAI,CAAC,OAAO,CAAA,CAAC,CAAA,SAAS,EAAC,GAAG,EAAC,IAAI,CAAC,IAAI,CAAC,WAAgC,EAAC,CAAC,CAAC;IACzN,CAAC;IACD,aAAa,CAAC,IAAY,IAAU,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACvH,QAAQ,CAAC,KAAoB;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACtH,CAAC;IACD,YAAY,CAAC,UAAkB,IAAU,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACnE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC;IACO,EAAE,CAAC,OAAyB,EAAE,UAAU,GAAG,KAAK;QACtD,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3F,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAW,CAAC;QAChH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAChD,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,cAAc,MAAM,CAAC,GAAG,SAAS,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7H,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;gBACvK,IAAI,QAAQ;oBAAE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAC,CAAC,CAAC;gBAC1F,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAA+B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,CAAC,EAAE,CAAC;IACN,CAAC;IACO,KAAK,CAAC,gBAAgB,CAAC,MAAmB,EAAE,cAA8B,EAAE,OAAyB,EAAE,MAAmB,EAAE,oBAAoB,GAAG,EAAE;QAC3J,IAAI,aAAa,GAAG,cAAc,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxN,IAAI,aAAa,IAAI,oBAAoB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,EAAC,GAAG,aAAa,EAAE,KAAK,EAAE,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,EAAC,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAe,EAAE,KAAK,EAAE,eAAwB,EAAE,OAAO,EAAE,YAAY,CAAC,oBAAoB,CAAC,EAAC,CAAC,EAAC,CAAC;YAClM,aAAa,GAAG,EAAC,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAC,CAAC;QAClD,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;QACrD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE;YAClD,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,mBAAmB,IAAI,cAAc,CAAC,iBAAiB,CAAC,EAAE,oBAAoB,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YACpV,aAAa,EAAE,GAAG,EAAE,GAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA,IAAG,OAAO,CAAC,KAAK;gBAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,EAAC,YAAY,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA,CAAC;YACzJ,cAAc,EAAE,MAAM,CAAC,EAAE;gBACvB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,YAAY,KAAK,IAAI,CAAC,aAAa,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,KAAK;oBAAE,OAAO;gBAC/E,MAAM,MAAM,GAAG,EAAC,UAAU,EAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,WAAW,EAAC,OAAO,EAAC,SAAS,EAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC;gBAChG,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,EAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC9J,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;oBAAE,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,IAAI,CAAC,EAAE,EAAC,SAAS,CAAC,CAAC;YAC1O,CAAC;YACD,WAAW,EAAE,GAAG,EAAE,GAAE,IAAG,OAAO,CAAC,KAAK;gBAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,oCAAoC,EAAC,SAAS,CAAC,CAAC,CAAA,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA,CAAC;SAC3H,CAAC,CAAC;IACL,CAAC;IACO,MAAM,CAAC,SAAoB,EAAE,cAA+C;QAClF,IAAI,SAAS,CAAC,QAAQ,IAAI,cAAc;YAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACtG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,QAAQ,+DAA+D,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnN,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,mBAAmB,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,cAAc,CAAC,IAAY,IAAa,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC;IAClG,gBAAgB,CAAC,UAAyC,EAAE,QAAoC;QAC9F,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAa,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU;YAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,wDAAwD,CAAC,CAAC;QACrL,MAAM,KAAK,GAAG,UAAU,EAAE,EAAE,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QACzD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAC,KAAK,EAAE,SAAS,EAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,EAAC,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,UAAU,EAAC,UAAU,CAAC,UAAU,EAAE,WAAW,EAAC,UAAU,CAAC,WAAW,EAAE,WAAW,EAAC,UAAU,CAAC,WAAW,IAAI,EAAE,EAAC,CAAC,CAAS,CAAC;QACpK,OAAO,EAAC,GAAG,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;gBAC5F,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACjJ,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,IAAI,EAAE,CAAC,CAAyB,CAAC;gBAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAyB,CAAC;gBAChF,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7F,MAAM,MAAM,GAAG,YAAY,CAAC,EAAC,UAAU,EAAE,IAAI,EAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAC,EAAC,SAAS,EAAC,IAAI,EAAE,YAAY,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAC,EAAE,GAAG,EAAE,MAAM,EAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,SAAS,EAAC,OAAO,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,cAAc,EAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClT,MAAM,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;gBACrG,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE;oBAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;oBAAC,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC5C,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,cAAc;wBAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,gEAAgE,CAAC,CAAC;oBAC1R,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,KAAK,oBAAoB,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,cAAc,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;wBAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,oDAAoD,CAAC,CAAC;oBACzV,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,CAAC,CAAC;gBACF,MAAM,OAAO,GAAG,KAAK,EAAE,SAAsB,EAAE,iBAAuC,EAAE,EAAE;oBACxF,MAAM,YAAY,EAAE,CAAC;oBACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;oBAC/I,IAAI,CAAC,SAAS,CAAC,SAAS;wBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC7D,MAAM,YAAY,EAAE,CAAC;gBACvB,CAAC,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,EAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE;4BAC5J,IAAI,cAAc,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,cAAc,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;gCAAE,OAAO,KAAK,CAAC;4BACrH,MAAM,MAAM,GAAG,YAAY,CAAC,EAAC,UAAU,EAAC,GAAG,UAAU,gBAAgB,UAAU,EAAE,EAAE,EAAC,IAAI,EAAC,UAAU,CAAC,IAAI,EAAC,IAAI,EAAC,EAAC,SAAS,EAAC,UAAU,EAAE,YAAY,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,EAAC,uBAAuB,EAAC,MAAM,CAAC,MAAM,EAAC,EAAC,GAAG,EAAC,MAAM,EAAC,QAAQ,EAAC,SAAS,EAAC,MAAM,CAAC,SAAS,EAAC,cAAc,EAAC,MAAM,CAAC,cAAc,EAAC,EAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;4BAC9U,IAAI,CAAC;gCAAC,MAAM,OAAO,CAAC,MAAM,EAAC,cAAc,CAAC,CAAC;gCAAC,OAAO,IAAI,CAAC;4BAAC,CAAC;4BAAC,MAAM,CAAC;gCAAC,OAAO,KAAK,CAAC;4BAAC,CAAC;wBACpF,CAAC,EAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;oBACjF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAC,WAAW,EAAC,SAAS,CAAC,CAAC;oBAC9D,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAC,WAAW,EAAC,QAAQ,CAAC,CAAC;oBAAC,MAAM,KAAK,CAAC;gBAAC,CAAC;wBACtF,CAAC;oBAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;oBAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;gBAAC,CAAC;YAC9D,CAAC,EAAC,CAAC;IACL,CAAC;IACO,KAAK,CAAC,eAAe,CAAC,MAAmB,EAAE,GAAc,EAAE,OAAyB,EAAE,OAAyB,EAAE,oBAAoB,GAAG,EAAE,EAAE,cAA+C;QACjM,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9K,MAAM,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;QAC7D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAC7G,IAAI,CAAC,SAAS,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAC,cAAc,CAAC,CAAC;QACtE,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,KAAK,oBAAoB;YAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,kEAAkE,CAAC,CAAC;QAC9K,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,cAAc;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,2CAA2C,CAAC,CAAC;QAC/O,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,aAAa,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QACnG,IAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAC,8CAA8C,CAAC,CAAC;QACpJ,IAAI,MAAM,CAAC,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,MAAM,CAAC,cAAc,CAAC,SAAS,IAAI,IAAI,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,6CAA6C,CAAC,CAAC;QAChL,IAAI,CAAC;YACH,IAAI,aAAqC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE;gBAC5F,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBAC3I,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE;oBACrD,IAAI,aAAa,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;oBAC9K,MAAM,aAAa,GAAG,YAAY,CAAC,EAAC,UAAU,EAAE,GAAG,MAAM,CAAC,UAAU,YAAY,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAC,GAAG,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,EAAC,GAAG,WAAW,EAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC3V,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,EAAE,KAAK,EAAE,4DAA4D,EAAE,EAAC,SAAS,EAAC,EAAE,EAAC,UAAU,EAAC,EAAE,EAAC,OAAO,EAAC,CAAC,WAAW,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;oBAC5K,MAAM,2BAA2B,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;oBACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC;oBACzH,IAAI,CAAC,QAAQ,CAAC,SAAS;wBAAE,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAC,cAAc,CAAC,CAAC;oBAC9E,IAAI,aAAa,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,KAAK,2BAA2B,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,cAAc,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG;wBAAE,OAAO,KAAK,CAAC;oBACpQ,OAAO,QAAQ,CAAC,SAAS,CAAC;gBAC5B,CAAC;aACF,CAAC,CAAC;YACH,IAAI,aAAa;gBAAE,MAAM,aAAa,CAAC;YACvC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;gBACxF,CAAC;YAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;IACnD,CAAC;IACD,QAAQ,CAAC,UAAyC,EAAE,WAA+C;QACjG,MAAM,IAAI,GAAG,UAAU,CAAC,IAAmC,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,oCAAoC,CAAC,CAAC;QACjH,MAAM,UAAU,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAC,GAAG,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,EAAC,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU;gBAC9G,mBAAmB,EAAE,EAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC,aAAa,EAAC,mBAAmB,CAAC,EAAC,WAAW,EAAC,+EAA+E,EAAC;gBACzK,sBAAsB,EAAE,EAAC,IAAI,EAAC,QAAQ,EAAC,UAAU,EAAC,EAAC,SAAS,EAAC,EAAC,IAAI,EAAC,OAAO,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,EAAC,EAAC,UAAU,EAAC,EAAC,IAAI,EAAC,OAAO,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,EAAC,EAAC,OAAO,EAAC,EAAC,IAAI,EAAC,OAAO,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,EAAC,EAAC,EAAC,oBAAoB,EAAC,KAAK,EAAC,WAAW,EAAC,+FAA+F,EAAC;gBACvU,aAAa,EAAE,EAAC,IAAI,EAAC,QAAQ,EAAC,WAAW,EAAC,2CAA2C,EAAC;aACvF,EAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QAC3B,OAAO,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;gBACnG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC1D,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACpB,MAAM,KAAK,GAAG,MAA8B,CAAC;oBAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,EAAC,wBAAwB,EAAC,eAAe,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAyB,CAAC;oBAChO,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,EAAE,GAAG,WAA8B,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;gCAC3I,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gCAC7C,MAAM,SAAS,GAAI,WAA+B,EAAE,SAAS,IAAI,WAAW,CAAC;gCAC7E,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;gCAC5I,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gCAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gCACzQ,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAC,IAAI,EAAC,OAAO,EAAC,OAAO,EAAC,SAAS,EAAC,GAAG,EAAC,WAAW,EAAC,EAAE,EAAC,GAAG,OAAO,EAAC,GAAG,EAAC,QAAQ,EAAC,EAAE,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,cAAc,EAAC,OAAO,CAAC,OAAO,EAAC,GAAG,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,EAAC,EAAE,EAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAsC,CAAC;4BACrR,CAAC,EAAE,EAAE,CAAC,CAAC;oBACP,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,MAA0C,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC7G,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAyB,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,IAAI,CAAC,IAAI,KAAG,QAAQ,CAAA,CAAC,CAAA,IAAI,CAAC,IAAI,CAAA,CAAC,CAAA,GAAG,EAAC,GAAG,EAAC,IAAI,KAAG,MAAM,CAAC,CAAC;gBAClG,IAAI,CAAC,IAAI,GAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBACrC,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC3N,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAI,WAA+B,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzM,MAAM,OAAO,GAAC,GAAE,EAAE,CAAA,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAA4B,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAe,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,EAAC,EAAE,EAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAClS,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAG,OAAO,IAAE,IAAI,KAAG,MAAM,CAAA,CAAC,CAAA,qBAAqB,CAAC,MAAM,aAAa,CAAC,MAAM,EAAC,GAAG,CAAC,EAAC,OAAO,CAAC,CAAA,CAAC,CAAA,OAAO,EAAE,CAAC,CAAC;gBAC9H,OAAO,MAAe,CAAC;YACzB,CAAC,EAAE,CAAC;IACN,CAAC;IACD,kBAAkB,CAAC,OAAyB,EAAE,cAAuB;QACnE,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;gBACzE,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAClD,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC;gBACxD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAC,OAAO,EAAC,OAAO,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC5W,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mDAAmD,cAAc,EAAE,EAAC,EAAC,OAAO,EAAC,cAAc,IAAE,OAAO,EAAC,CAAsC,CAAC;YACrY,CAAC,EAAE,CAAC;QACJ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,mBAAmB,CAAC,UAA0B,IAAa,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;CAC1G"}

package/dist/tools/external.d.ts

@@ -0,0 +1,30 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import type { ToolAnnotations } from '@earendil-works/pi-coding-agent';
+import { type GuardAction, type Json, type PolicyDecision } from '../contracts.js';
+import type { GuardSettings } from '../policy/index.js';
+export interface ExternalToolIdentity {
+    readonly kind: 'mcp' | 'extension';
+    readonly server: string;
+    readonly tool: string;
+    readonly registration: string;
+    readonly connectorId?: string;
+    readonly account?: string;
+    readonly approvalMode?: 'auto' | 'prompt' | 'writes' | 'approve';
+    readonly annotations?: ToolAnnotations;
+    readonly requiresUserInput?: boolean;
+    readonly isSensitiveAction?: boolean;
+    readonly requiresStrictReview?: boolean;
+}
+/** Literal ordering of Codex mcp_tool_call.rs requires_mcp_tool_approval. */
+export declare function requiresMcpApproval(annotations?: ToolAnnotations, mode?: ExternalToolIdentity['approvalMode']): boolean;
+export declare function externalPolicy(action: GuardAction, identity: ExternalToolIdentity, settings: GuardSettings): PolicyDecision;
+export interface ExternalInvocation {
+    readonly toolCallId: string;
+    readonly identity: ExternalToolIdentity;
+    readonly arguments: Readonly<Record<string, Json>>;
+    readonly signal: AbortSignal;
+    checkCurrent(): Promise<void>;
+    approveNested(identity: ExternalToolIdentity, args: Record<string, Json>): Promise<boolean>;
+}
+/** The invocation comes from the final execute wrapper, never from model arguments. */
+export declare const externalInvocations: AsyncLocalStorage<ExternalInvocation>;

package/dist/tools/external.js

@@ -0,0 +1,24 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { decision, immutable } from '../contracts.js';
+/** Literal ordering of Codex mcp_tool_call.rs requires_mcp_tool_approval. */
+export function requiresMcpApproval(annotations = {}, mode = 'auto') {
+    if (mode === 'prompt')
+        return true;
+    if (mode === 'writes')
+        return annotations.readOnlyHint !== true;
+    if (mode === 'approve')
+        return false;
+    if (annotations.destructiveHint === true)
+        return true;
+    if (annotations.readOnlyHint === true)
+        return false;
+    return (annotations.destructiveHint ?? true) || (annotations.openWorldHint ?? true);
+}
+export function externalPolicy(action, identity, settings) {
+    const isFresh = identity.requiresStrictReview === true || identity.isSensitiveAction === true || identity.requiresUserInput === true;
+    const shouldReview = isFresh || requiresMcpApproval(identity.annotations, identity.approvalMode);
+    return immutable({ ...decision(action, shouldReview ? 'ask' : 'allow', shouldReview ? 'Review the exact registered external action' : 'Registered external tool approval policy permits this action'), approvalCategory: 'mcp_elicitations', requiresFreshReview: isFresh, requiresUserInput: identity.requiresUserInput === true });
+}
+/** The invocation comes from the final execute wrapper, never from model arguments. */
+export const externalInvocations = new AsyncLocalStorage();
+//# sourceMappingURL=external.js.map

package/dist/tools/external.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external.js","sourceRoot":"","sources":["../../src/tools/external.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAoD,MAAM,iBAAiB,CAAC;AAgBxG,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,cAA+B,EAAE,EAAE,OAA6C,MAAM;IACxH,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,YAAY,KAAK,IAAI,CAAC;IAChE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,WAAW,CAAC,eAAe,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,WAAW,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,CAAC,WAAW,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC;AACtF,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,MAAmB,EAAE,QAA8B,EAAE,QAAuB;IACzG,MAAM,OAAO,GAAG,QAAQ,CAAC,oBAAoB,KAAK,IAAI,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI,CAAC;IACrI,MAAM,YAAY,GAAG,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IACjG,OAAO,SAAS,CAAC,EAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC,8DAA8D,CAAC,EAAE,gBAAgB,EAAC,kBAAkB,EAAE,mBAAmB,EAAC,OAAO,EAAE,iBAAiB,EAAC,QAAQ,CAAC,iBAAiB,KAAK,IAAI,EAAC,CAAC,CAAC;AAClU,CAAC;AASD,uFAAuF;AACvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,iBAAiB,EAAsB,CAAC"}

package/dist/tools/mcp.d.ts

@@ -0,0 +1,17 @@
+import { type InlineExtension, type McpExtensionOptions, type ToolDefinition } from '@earendil-works/pi-coding-agent';
+import type { GuardController } from './controller.js';
+import { type ExternalToolIdentity } from './external.js';
+type Tool = ToolDefinition<any, any, any>;
+export interface ExternalExtension {
+    readonly extension: InlineExtension;
+    /** Trusted adapter metadata; model arguments and tool-result text never supply this. */
+    readonly identifyTool: (definition: Tool) => ExternalToolIdentity;
+}
+export declare function guardedExternalExtension(input: ExternalExtension, controller: () => GuardController): InlineExtension;
+export type McpToolPolicies = Readonly<Record<string, Partial<Pick<ExternalToolIdentity, 'approvalMode'>>>>;
+/**
+ * Pi 0.99.1 exports the extension API but not its default transport/config helpers.
+ * This small, version-qualified seam preserves the SDK's transport, config and OAuth implementation.
+ */
+export declare function createGuardedMcpExtension(agentDir: string, controller: () => GuardController, options?: McpExtensionOptions, policies?: McpToolPolicies): Promise<InlineExtension>;
+export {};