zelari-code 2.13.0 → 2.14.0

package/dist/cli/safety/resourceClaims.js

@@ -0,0 +1,373 @@
+import { pathCandidates, resolvePolicyRule } from './policyEngine.js';
+import { intersectEffects } from './policyLayers.js';
+function asArgs(args) {
+    return args !== null && typeof args === 'object' ? args : {};
+}
+function str(v) {
+    return typeof v === 'string' && v !== '' ? v : undefined;
+}
+/** The primary path argument, mirroring matchAgentPolicyRule: `path` then `file_path`. */
+function primaryPath(a) {
+    return str(a['path']) ?? str(a['file_path']);
+}
+/** Paths referenced by a diff's `---`/`+++` headers (best-effort, `/dev/null`
+ * skipped, `a/` `b/` + quotes stripped) — write claims so none dodges a deny. */
+function pathsFromUnifiedDiff(diff) {
+    const out = new Set();
+    for (const line of diff.split(/\r?\n/)) {
+        const m = /^(?:---|\+\+\+)\s+(\S+)/.exec(line);
+        if (!m)
+            continue;
+        let p = m[1].replace(/^"|"$/g, '');
+        if (p === '/dev/null')
+            continue;
+        if (p.startsWith('a/') || p.startsWith('b/'))
+            p = p.slice(2);
+        if (p !== '')
+            out.add(p);
+    }
+    return [...out];
+}
+/** Host (+optional port) claims for every absolute URL in the args. */
+function networkClaimsForUrls(urls) {
+    const out = [];
+    for (const u of urls) {
+        if (typeof u !== 'string' || u === '')
+            continue;
+        try {
+            const parsed = new URL(u);
+            const port = parsed.port !== '' ? Number(parsed.port) : undefined;
+            out.push(port !== undefined && Number.isInteger(port)
+                ? { kind: 'network', host: parsed.hostname, port }
+                : { kind: 'network', host: parsed.hostname });
+        }
+        catch {
+            // Not an absolute URL — the tool itself will reject it later; no claim.
+        }
+    }
+    return out;
+}
+/** Best-effort `mcp_<server>_<tool>` reverse-parse (first underscore split;
+ * ambiguous for underscored server names — accepted). */
+function mcpClaimFromName(registryName) {
+    const rest = registryName.startsWith('mcp_') ? registryName.slice('mcp_'.length) : '';
+    const sep = rest.indexOf('_');
+    return sep <= 0 || sep === rest.length - 1
+        ? null
+        : { kind: 'mcp', server: rest.slice(0, sep), tool: rest.slice(sep + 1) };
+}
+/** Nested action URLs a browser_check call may navigate to. */
+function browserActionUrls(a) {
+    const actions = Array.isArray(a['actions']) ? a['actions'] : [];
+    return actions.map((x) => (x !== null && typeof x === 'object' ? x['url'] : undefined));
+}
+/**
+ * Raw-shell normalization (P0.C2/t17) — BEST-EFFORT, deliberately not a shell
+ * parser: strip common wrapper prefixes so `env FOO=x git push`,
+ * `command git push`, `exec git push`, `bash -lc 'git push'`,
+ * `cmd.exe /c git push` and extra whitespace classify as the program they
+ * actually run (`git push`), letting a `git push*` rule hit what a plain
+ * `command: 'git push …'` would have hit. Quoted strings are re-tokenized
+ * quote-aware; recursion is depth-capped and ANY ambiguity keeps the original.
+ */
+/** Cap for nested wrappers (`bash -lc 'bash -lc …'`). */
+const MAX_RAW_SHELL_STRIP_DEPTH = 3;
+/** Prefixes that prepend context around the real command. */
+const RAW_SHELL_WRAPPERS = new Set(['command', 'exec', 'nice', 'nohup', 'time']);
+/** Interpreters whose `-c`-style flag executes the NEXT argument as a string. */
+const RAW_SHELL_INTERPRETERS = new Set(['sh', 'bash', 'dash', 'ksh', 'zsh']);
+function stripWindowsExecutableExt(name) {
+    return name.replace(/\.(exe|cmd|bat|com)$/i, '');
+}
+/** Whitespace tokenizer honoring single/double quotes; quotes are dropped. */
+function tokenizeCommandString(command) {
+    const out = [];
+    let cur = '';
+    let quote = null;
+    let started = false;
+    for (const ch of command.trim()) {
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else
+                cur += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            started = true;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            if (started || cur !== '')
+                out.push(cur);
+            cur = '';
+            started = false;
+            continue;
+        }
+        cur += ch;
+        started = true;
+    }
+    if (started || cur !== '')
+        out.push(cur);
+    return out;
+}
+function isEnvAssignment(token) {
+    const eq = token.indexOf('=');
+    return eq > 0 && /^[A-Za-z_][A-Za-z0-9_]*$/.test(token.slice(0, eq));
+}
+/** Strip one wrapper layer per call; returns argv for the program it runs. */
+function stripRawShellLayer(argv, depth) {
+    if (depth >= MAX_RAW_SHELL_STRIP_DEPTH || argv.length === 0)
+        return [...argv];
+    const bare = stripWindowsExecutableExt(argv[0]).toLowerCase();
+    // env [VAR=val|-flag]* [--] cmd …
+    if (bare === 'env') {
+        let i = 1;
+        while (i < argv.length && (isEnvAssignment(argv[i]) || argv[i].startsWith('-')))
+            i++;
+        if (argv[i] === '--')
+            i++;
+        if (i >= argv.length)
+            return [...argv]; // nothing left — keep original
+        return stripRawShellLayer(argv.slice(i), depth + 1);
+    }
+    if (RAW_SHELL_WRAPPERS.has(bare)) {
+        let i = 1;
+        while (i < argv.length && argv[i].startsWith('-'))
+            i++;
+        if (i >= argv.length)
+            return [...argv];
+        return stripRawShellLayer(argv.slice(i), depth + 1);
+    }
+    // sh/bash -lc '<command string>' — execute the string, not the interpreter.
+    if (RAW_SHELL_INTERPRETERS.has(bare)) {
+        if (argv.length >= 3 && /^-\w*c\w*$/.test(argv[1])) {
+            return stripRawShellLayer(tokenizeCommandString(argv[2]), depth + 1);
+        }
+        return [...argv]; // `bash script.sh` — can't know what the script runs
+    }
+    // cmd.exe /c <string>
+    if ((bare === 'cmd' || bare === 'cmd.exe') && argv.length >= 3 && /^\/c$/i.test(argv[1])) {
+        return stripRawShellLayer(tokenizeCommandString(argv.slice(2).join(' ')), depth + 1);
+    }
+    return [...argv];
+}
+/**
+ * Best-effort wrapper stripping over an already-whitespace-split token list —
+ * the entry point used by the tool → claims table below.
+ */
+export function normalizeProcessArgs(tokens) {
+    const stripped = stripRawShellLayer(tokens, 0);
+    return { argv: stripped, changed: stripped.join(' ') !== tokens.join(' ') };
+}
+/** Match values for ONE process claim: canonical chain first (+ raw original). */
+function processClaimValues(claim) {
+    const main = claim.argv && claim.argv.length > 0
+        ? [claim.executable, ...claim.argv].join(' ')
+        : claim.executable;
+    return claim.raw && claim.raw !== main ? [main, claim.raw] : [main];
+}
+/**
+ * Central tool → claims table (best-effort throughout). `web_search` yields
+ * NO claim: its destination host is the search backend, not argument-chosen
+ * (category policy still gates it). Unknown tool → [].
+ */
+export function resourceClaimsFor(toolName, args) {
+    const a = asArgs(args);
+    switch (toolName) {
+        case 'write_file':
+        case 'edit_file': {
+            const p = primaryPath(a);
+            return p ? [{ kind: 'path', operation: 'write', path: p }] : [];
+        }
+        case 'apply_diff': {
+            // Cover EVERY path it can touch: primary `path` + all diff headers.
+            const uniq = [];
+            for (const p of [primaryPath(a), ...pathsFromUnifiedDiff(str(a['diff']) ?? '')]) {
+                if (p && !uniq.includes(p))
+                    uniq.push(p);
+            }
+            return uniq.map((p) => ({ kind: 'path', operation: 'write', path: p }));
+        }
+        // READ tools — match only explicit v2 `claims` rules, never the edit list.
+        case 'read_file':
+        case 'show_diff':
+        case 'list_files':
+        case 'grep_content': {
+            const p = primaryPath(a);
+            return p ? [{ kind: 'path', operation: 'read', path: p }] : [];
+        }
+        // Shell-like — raw-shell string normalized into the process it runs
+        // (best-effort wrapper stripping, P0.C2/t17; NOT a shell parser).
+        // Tokenize quote-aware FIRST so `bash -lc '<string>'` keeps its command
+        // argument intact for the interpreter branch.
+        case 'bash':
+        case 'inspect_command': {
+            const cmd = str(a['command']);
+            if (!cmd)
+                return [];
+            const tokens = tokenizeCommandString(cmd);
+            const { argv, changed } = normalizeProcessArgs(tokens);
+            const claim = {
+                kind: 'process',
+                executable: argv[0],
+                ...(argv.length > 1 ? { argv: argv.slice(1) } : {}),
+                ...(changed ? { raw: cmd.trim() } : {}),
+            };
+            return [claim];
+        }
+        // Structured execution (t17): no shell ever involved — the claim IS the
+        // invocation. program basename (Windows extension stripped) matches
+        // `git push*`-style rules; the literal path is kept as a second value.
+        case 'exec_process': {
+            const program = str(a['program']);
+            if (!program)
+                return [];
+            const name = stripWindowsExecutableExt(program.split(/[\\/]/).pop() ?? program);
+            const argv = Array.isArray(a['args'])
+                ? a['args'].filter((x) => typeof x === 'string')
+                : [];
+            return [{ kind: 'process', executable: name, ...(argv.length > 0 ? { argv } : {}) }];
+        }
+        case 'fetch_url':
+            return networkClaimsForUrls([str(a['url'])]);
+        case 'browser_check': {
+            const urls = [a['url'], ...browserActionUrls(a)];
+            return networkClaimsForUrls(urls.filter((u) => typeof u === 'string'));
+        }
+        case 'web_search':
+            return []; // no argument-controlled destination host (see table doc)
+        case 'ssh_run': {
+            const target = str(a['targetId']);
+            const command = str(a['command']);
+            return target ? [command ? { kind: 'ssh', target, command } : { kind: 'ssh', target }] : [];
+        }
+        case 'ssh_status': {
+            const target = str(a['targetId']);
+            return target ? [{ kind: 'ssh', target }] : [];
+        }
+        case 'observe_batch': {
+            // Nested observations fan out into the wrapped read tools.
+            const ops = Array.isArray(a['operations']) ? a['operations'] : [];
+            const out = [];
+            for (const op of ops) {
+                if (op === null || typeof op !== 'object')
+                    continue;
+                const o = op;
+                const p = primaryPath(asArgs(o['args']));
+                if (p && ['read_file', 'grep_content', 'list_files'].includes(String(o['tool']))) {
+                    out.push({ kind: 'path', operation: 'read', path: p });
+                }
+            }
+            return out;
+        }
+        default: {
+            const mcp = mcpClaimFromName(toolName);
+            return mcp ? [mcp] : [];
+        }
+    }
+}
+/** Values a claim's rules glob-match (anchored; paths try root-relative first). */
+export function claimMatchValues(claim, root) {
+    switch (claim.kind) {
+        case 'path':
+            return pathCandidates(claim.path, root);
+        case 'process':
+            return processClaimValues(claim);
+        case 'network':
+            return claim.port !== undefined ? [`${claim.host}:${claim.port}`, claim.host] : [claim.host];
+        case 'mcp':
+            return [`${claim.server}.${claim.tool}`];
+        case 'ssh':
+            return claim.command !== undefined ? [`${claim.target} ${claim.command}`] : [claim.target];
+        case 'ui':
+            return [claim.action];
+        case 'agent':
+            return [claim.role];
+    }
+}
+/** Glob hits when ANY candidate value full-matches the anchored pattern. */
+function globHits(pattern, values) {
+    // resolvePolicyRule only reads `.match`; a deny placeholder keeps this a pure probe.
+    return values.some((v) => resolvePolicyRule([{ match: pattern, effect: 'deny' }], v) !== null);
+}
+/**
+ * Match ONE claim against ONE layer: the v2 `claims` section first (ordered,
+ * kind+operation-aware), then the legacy fallback for retrocompat — path
+ * WRITE claims reuse the v1 `edit` list and process claims the v1 `shell`
+ * list with EXACTLY today's semantics. Read/network/mcp/ssh only hit
+ * explicit `claims` rules, so v1 files never start denying them. Null =
+ * this layer says nothing.
+ */
+export function claimRuleFor(rules, claim, root) {
+    if (!rules)
+        return null;
+    for (const cr of rules.claims ?? []) {
+        if (cr.kind !== claim.kind)
+            continue;
+        if (claim.kind === 'path' && cr.operation !== undefined && cr.operation !== claim.operation) {
+            continue;
+        }
+        if (globHits(cr.pattern, claimMatchValues(claim, root))) {
+            return cr.reason
+                ? { match: cr.pattern, effect: cr.effect, reason: cr.reason }
+                : { match: cr.pattern, effect: cr.effect };
+        }
+    }
+    // Legacy single-value fallbacks (identical behavior to the P0.A matcher).
+    if (claim.kind === 'path' && claim.operation === 'write') {
+        for (const candidate of pathCandidates(claim.path, root)) {
+            const hit = resolvePolicyRule(rules.edit, candidate);
+            if (hit)
+                return hit;
+        }
+    }
+    if (claim.kind === 'process') {
+        return resolvePolicyRule(rules.shell, claimMatchValues(claim)[0]);
+    }
+    return null;
+}
+/** Combine BOTH layers for ONE claim — restrict-only per {@link matchAgentPolicyRuleLayered}
+ * (stricter wins, ties keep project; legacy = project-first first-match). A
+ * global-floor deny can NEVER be relaxed by an agent-local allow — this IS the
+ * subagent ⊆ parent property through claims. */
+export function matchResourceClaimLayered(layers, precedence, claim, root) {
+    if (!layers)
+        return null;
+    if (precedence === 'legacy') {
+        const merged = {
+            shell: [...layers.project.shell, ...layers.global.shell],
+            edit: [...layers.project.edit, ...layers.global.edit],
+        };
+        if (layers.project.claims || layers.global.claims) {
+            merged.claims = [...(layers.project.claims ?? []), ...(layers.global.claims ?? [])];
+        }
+        return claimRuleFor(merged, claim, root);
+    }
+    const g = claimRuleFor(layers.global, claim, root);
+    const p = claimRuleFor(layers.project, claim, root);
+    if (!g)
+        return p;
+    if (!p)
+        return g;
+    const win = intersectEffects(p.effect, g.effect);
+    return p.effect === win ? p : g;
+}
+/** Expand the invocation to claims, match EACH on the layered rules, intersect. */
+export function resolveClaimsVerdict(layers, precedence, toolName, args, root) {
+    const claims = resourceClaimsFor(toolName, args);
+    const matchedRules = [];
+    if (!layers || claims.length === 0)
+        return { matchedRules };
+    const effects = [];
+    for (const claim of claims) {
+        const hit = matchResourceClaimLayered(layers, precedence, claim, root);
+        if (hit) {
+            effects.push(hit.effect);
+            matchedRules.push(hit);
+        }
+    }
+    return effects.length > 0 ? { effect: intersectEffects(...effects), matchedRules } : { matchedRules };
+}
+//# sourceMappingURL=resourceClaims.js.map

package/dist/cli/safety/resourceClaims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceClaims.js","sourceRoot":"","sources":["../../../src/cli/safety/resourceClaims.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAkBrD,SAAS,MAAM,CAAC,IAAa;IAC3B,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,0FAA0F;AAC1F,SAAS,WAAW,CAAC,CAA0B;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;iFACiF;AACjF,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,WAAW;YAAE,SAAS;QAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,uEAAuE;AACvE,SAAS,oBAAoB,CAAC,IAAwB;IACpD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,GAAG,CAAC,IAAI,CACN,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1C,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE;gBAClD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAC/C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;yDACyD;AACzD,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QACxC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,+DAA+D;AAC/D,SAAS,iBAAiB,CAAC,CAA0B;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACvH,CAAC;AACD;;;;;;;;GAQG;AAEH,yDAAyD;AACzD,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC,6DAA6D;AAC7D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACjF,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAE7E,SAAS,yBAAyB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,8EAA8E;AAC9E,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;;gBAC1B,GAAG,IAAI,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,GAAG,EAAE,CAAC;YACX,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClB,IAAI,OAAO,IAAI,GAAG,KAAK,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzC,GAAG,GAAG,EAAE,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,IAAI,GAAG,KAAK,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,SAAS,kBAAkB,CAAC,IAAuB,EAAE,KAAa;IAChE,IAAI,KAAK,IAAI,yBAAyB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,kCAAkC;IAClC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QACrF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,+BAA+B;QACvE,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACvC,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,4EAA4E;IAC5E,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,kBAAkB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,qDAAqD;IACzE,CAAC;IACD,sBAAsB;IACtB,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,kBAAkB,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAyB;IAC5D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,KAAkD;IAC5E,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7C,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IACvB,OAAO,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,IAAa;IAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,oEAAoE;YACpE,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAChF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAkB,CAAC,CAAC;QAC3F,CAAC;QACD,2EAA2E;QAC3E,KAAK,WAAW,CAAC;QACjB,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,CAAC;QACD,oEAAoE;QACpE,kEAAkE;QAClE,wEAAwE;QACxE,8CAA8C;QAC9C,KAAK,MAAM,CAAC;QACZ,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,KAAK,GAAkB;gBAC3B,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QACD,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,KAAK,WAAW;YACd,OAAO,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,OAAO,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,YAAY;YACf,OAAO,EAAE,CAAC,CAAC,0DAA0D;QACvE,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,2DAA2D;YAC3D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,GAAG,GAAoB,EAAE,CAAC;YAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ;oBAAE,SAAS;gBACpD,MAAM,CAAC,GAAG,EAA6B,CAAC;gBACxC,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACvC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAGD,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,KAAoB,EAAE,IAAa;IAClE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/F,KAAK,KAAK;YACR,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,KAAK,KAAK;YACR,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7F,KAAK,IAAI;YACP,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxB,KAAK,OAAO;YACV,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,OAAe,EAAE,MAAyB;IAC1D,qFAAqF;IACrF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAgC,EAChC,KAAoB,EACpB,IAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAAE,SAAS;QACrC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YAC5F,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,CAAC,MAAM;gBACd,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE;gBAC7D,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACzD,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACrD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;gDAGgD;AAChD,MAAM,UAAU,yBAAyB,CACvC,MAAwC,EACxC,UAA4B,EAC5B,KAAoB,EACpB,IAAa;IAEb,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAkB;YAC5B,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YACxD,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;SACtD,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAClD,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AASD,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAClC,MAAwC,EACxC,UAA4B,EAC5B,QAAgB,EAChB,IAAa,EACb,IAAa;IAEb,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,YAAY,GAAiB,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,yBAAyB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACvE,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,GAAG,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;AACxG,CAAC"}

package/dist/cli/safety/sandboxPath.js

@@ -2,14 +2,37 @@
  * sandboxPath — enforce that filesystem tool paths stay inside an allowed
  * root directory (default: process.cwd()).
  *
- * Prevents the agent from escaping its working directory by using
- * `..` segments or absolute paths outside the sandbox.
+ * Task A2 of AnathemaCoder v3-A; symlink-safe resolution added by P0.D (t18).
  *
- * Task A2 of AnathemaCoder v3-A.
+ * Two-layer containment:
+ *  1. TEXTUAL — normalize `..` segments and absolute forms, then prefix-match
+ *     against the root. Fast path (zero syscalls), catches obvious escapes.
+ *  2. SYMLINK-SAFE — realpath the DEEPEST EXISTING ANCESTOR of the target
+ *     and require its REAL location to sit inside the REAL root
+ *     (`fs.realpathSync` of the root). Defeats junction/symlink escapes
+ *     — including chains a→b→outside and cross-drive junctions on win32 —
+ *     that textual checks cannot see. Comparison folds character case only
+ *     on platforms whose default FS is case-insensitive (win32, darwin);
+ *     linux keeps exact comparison.
+ *
+ * Return-value stability: the resolver still returns the LEXICALLY resolved
+ * path so rewritten tool args stay byte-identical across versions; a link
+ * escape surfaces as SandboxViolationError instead of a silently different
+ * target. When the sandbox root itself does not exist there is nothing
+ * between it and the target that could be a link, so layer 2 degrades to
+ * layer 1 (documented behaviour, keeps legacy fake-root usage working).
+ *
+ * TOCTOU 〔PW §5〕: `verifyContainment()` re-runs layer 2 on fresh syscalls.
+ * Callers that mutate the FS may call it as the LAST step right before a
+ * write to catch links swapped after an earlier permission check. The CLI
+ * guarantee itself lives in `wrapWithSandbox` (toolRegistry.ts): resolve →
+ * execute are adjacent, so for write_file/edit_file/apply_diff/read_file the
+ * verified resolution IS the last step before the factory touches disk.
  *
  * @see docs/plans/2026-06-29-anathema-coder-v3.md (Task A2)
  */
 import path from 'node:path';
+import fs from 'node:fs';
 export class SandboxViolationError extends Error {
     attemptedPath;
     resolvedPath;
@@ -20,17 +43,85 @@ export class SandboxViolationError extends Error {
         this.name = 'SandboxViolationError';
     }
 }
+/** Platforms whose default filesystem is case-insensitive. */
+const CASE_FOLDING_PLATFORMS = ['win32', 'darwin'];
+/** True when path comparison must fold character case (win32/darwin only). */
+const IS_CASE_FOLDING = CASE_FOLDING_PLATFORMS.includes(process.platform);
+/** Fold case only where the default filesystem is case-insensitive. */
+function normalizedCase(p) {
+    return IS_CASE_FOLDING ? p.toLowerCase() : p;
+}
 /**
- * Resolve a user-supplied path against an allowed root, throwing
- * SandboxViolationError if the result escapes the root.
+ * True when `candidate` equals or sits under `base`. Case folding is applied
+ * ONLY on case-insensitive platforms (guard: process.platform). Cross-drive
+ * targets on win32 fail here naturally — `C:\...` never starts with `E:\`.
+ */
+function isWithin(candidate, base) {
+    const c = normalizedCase(candidate);
+    const b = normalizedCase(base);
+    if (c === b)
+        return true;
+    const baseWithSep = b.endsWith(path.sep) ? b : b + path.sep;
+    return c.startsWith(baseWithSep);
+}
+function escapeError(userPath, attempted, real, realRoot) {
+    return new SandboxViolationError(`Path escapes sandbox root through a symlink/junction: ${userPath} → real ${real} is outside real root ${realRoot}`, userPath, attempted);
+}
+/**
+ * TEXTUAL containment check (layer 1) — unchanged Task A2 semantics.
+ */
+function assertLexicalContainment(resolved, root, userPath) {
+    // Ensure trailing separator for prefix check so `/foo/bar` does not match
+    // `/foo/barbaz`.
+    const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
+    if (resolved !== root && !resolved.startsWith(rootWithSep)) {
+        throw new SandboxViolationError(`Path escapes sandbox root: ${userPath} → ${resolved} (root: ${root})`, userPath, resolved);
+    }
+}
+/**
+ * SYMLINK-SAFE check (layer 2). Walks up from the lexically-resolved target
+ * until realpath succeeds (deepest existing ancestor — fs.realpathSync
+ * resolves whole chains natively, e.g. a→b→outside), verifies its REAL
+ * location stays inside the REAL root, then re-applies textual containment
+ * for the not-yet-existing suffix below that ancestor (it lands next to a
+ * verified-inside parent, so this holds trivially — kept explicit as defense
+ * in depth).
  *
- * - Absolute paths are taken as-is but must be inside the root.
- * - Relative paths are joined to the root.
- * - Symlink resolution is the caller's responsibility (the FS tool
- *   resolves on read/write); this function only checks textual containment
- *   after normalization.
+ * Unexpected FS errors (EPERM & co.) degrade to layer 1 rather than crashing
+ * unrelated operations — same failure surface as pre-P0.D.
  */
-export function resolveSandboxedPath(userPath, options = {}) {
+function assertRealAncestorContained(resolvedLexical, realRoot, userPath) {
+    let probe = resolvedLexical;
+    let realProbe = null;
+    for (;;) {
+        if (probe === path.dirname(probe))
+            break; // filesystem apex reached
+        try {
+            realProbe = fs.realpathSync(probe);
+            break;
+        }
+        catch (err) {
+            if (err?.code === 'ENOENT') {
+                probe = path.dirname(probe);
+                continue;
+            }
+            return; // degrade to textual layer only
+        }
+    }
+    if (realProbe === null)
+        return; // fully nonexistent chain → layer 1 already passed
+    if (!isWithin(realProbe, realRoot)) {
+        throw escapeError(userPath, resolvedLexical, realProbe, realRoot);
+    }
+    // Containment re-check for the non-existent remainder of the path.
+    const suffix = resolvedLexical.startsWith(probe)
+        ? resolvedLexical.slice(probe.length)
+        : '';
+    if (suffix.length > 0 && !isWithin(realProbe + suffix, realRoot)) {
+        throw escapeError(userPath, resolvedLexical, realProbe + suffix, realRoot);
+    }
+}
+function resolveSandboxedCore(userPath, options = {}) {
     if (typeof userPath !== 'string' || userPath.length === 0) {
         throw new SandboxViolationError('Empty path', userPath, '');
     }
@@ -38,17 +129,69 @@ export function resolveSandboxedPath(userPath, options = {}) {
     const resolved = path.isAbsolute(userPath)
         ? path.resolve(userPath)
         : path.resolve(root, userPath);
-    // Normalize for comparison: ensure trailing separator for prefix check
-    // so `/foo/bar` does not match `/foo/barbaz`.
-    const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
-    if (resolved !== root && !resolved.startsWith(rootWithSep)) {
-        throw new SandboxViolationError(`Path escapes sandbox root: ${userPath} → ${resolved} (root: ${root})`, userPath, resolved);
+    // Layer 1: lexical containment after normalization.
+    assertLexicalContainment(resolved, root, userPath);
+    // Layer 2: symlink/junction safety. Skipped when the root itself does not
+    // exist (ENOENT) — no ancestor between a nonexistent root and the target
+    // can hold a link yet, and legacy fake-root callers keep working.
+    let realRoot = null;
+    try {
+        realRoot = fs.realpathSync(root);
     }
+    catch {
+        return resolved;
+    }
+    assertRealAncestorContained(resolved, realRoot, userPath);
     return resolved;
 }
+/**
+ * Resolve a user-supplied path against an allowed root, throwing
+ * SandboxViolationError if the result escapes the root.
+ *
+ * - Absolute paths are taken as-is but must be inside the root.
+ * - Relative paths are joined to the root.
+ * - P0.D: symlinks/junctions are now resolved via realpath of the deepest
+ *   existing ancestor; any link resolving OUTSIDE the real root is rejected.
+ *   Internal links (inside the workspace) keep working. The returned value
+ *   is still the lexically normalized path.
+ */
+export function resolveSandboxedPath(userPath, options = {}) {
+    return resolveSandboxedCore(userPath, options);
+}
+/**
+ * Explicit name for the symlink-safe resolver (P0.D t18) — IDENTICAL
+ * behavior to resolveSandboxedPath since P0.D upgraded it in place so every
+ * existing caller inherits safety transparently (zero call-site churn).
+ * Kept as a stable, self-documenting export for new call sites and tests.
+ */
+export const resolveSandboxedPathReal = resolveSandboxedPath;
+/**
+ * TOCTOU re-check 〔PW §5〕: re-run BOTH layers on fresh syscalls for an
+ * ALREADY-resolved absolute path. Call this immediately before performing a
+ * filesystem mutation when state may have changed since the original
+ * resolveSandboxedPath call (e.g. a directory swapped for a junction between
+ * the permission check and the write). Throws SandboxViolationError if the
+ * candidate would now leave the real root; returns normally otherwise.
+ */
+export function verifyContainment(resolvedAbsolute, options = {}) {
+    if (typeof resolvedAbsolute !== 'string' || resolvedAbsolute.length === 0) {
+        throw new SandboxViolationError('Empty path', resolvedAbsolute, '');
+    }
+    const root = path.resolve(options.root ?? process.cwd());
+    const resolved = path.resolve(resolvedAbsolute);
+    assertLexicalContainment(resolved, root, resolvedAbsolute);
+    let realRoot = null;
+    try {
+        realRoot = fs.realpathSync(root);
+    }
+    catch {
+        return; // root vanished / nonexistent → textual layer is all we have
+    }
+    assertRealAncestorContained(resolved, realRoot, resolvedAbsolute);
+}
 /**
  * Lightweight check that does NOT throw — returns true if the path
- * would be allowed by resolveSandboxedPath.
+ * would be allowed by resolveSandboxedPath (symlink-aware since P0.D).
  */
 export function isPathInsideSandbox(userPath, options = {}) {
     try {

package/dist/cli/safety/sandboxPath.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxPath.js","sourceRoot":"","sources":["../../../src/cli/safety/sandboxPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAG5B;IACA;IAHlB,YACE,OAAe,EACC,aAAqB,EACrB,YAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,kBAAa,GAAb,aAAa,CAAQ;QACrB,iBAAY,GAAZ,YAAY,CAAQ;QAGpC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,UAA6B,EAAE;IAE/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,qBAAqB,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjC,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;IACrE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,qBAAqB,CAC7B,8BAA8B,QAAQ,MAAM,QAAQ,WAAW,IAAI,GAAG,EACtE,QAAQ,EACR,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,UAA6B,EAAE;IAE/B,IAAI,CAAC;QACH,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"sandboxPath.js","sourceRoot":"","sources":["../../../src/cli/safety/sandboxPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAG5B;IACA;IAHlB,YACE,OAAe,EACC,aAAqB,EACrB,YAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,kBAAa,GAAb,aAAa,CAAQ;QACrB,iBAAY,GAAZ,YAAY,CAAQ;QAGpC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAO1E,uEAAuE;AACvE,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,SAAiB,EAAE,IAAY;IAC/C,MAAM,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;IAC5D,OAAO,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAClB,QAAgB,EAChB,SAAiB,EACjB,IAAY,EACZ,QAAgB;IAEhB,OAAO,IAAI,qBAAqB,CAC9B,yDAAyD,QAAQ,WAAW,IAAI,yBAAyB,QAAQ,EAAE,EACnH,QAAQ,EACR,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,IAAY,EACZ,QAAgB;IAEhB,0EAA0E;IAC1E,iBAAiB;IACjB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;IACrE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,qBAAqB,CAC7B,8BAA8B,QAAQ,MAAM,QAAQ,WAAW,IAAI,GAAG,EACtE,QAAQ,EACR,QAAQ,CACT,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,2BAA2B,CAClC,eAAuB,EACvB,QAAgB,EAChB,QAAgB;IAEhB,IAAI,KAAK,GAAG,eAAe,CAAC;IAC5B,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,SAAS,CAAC;QACR,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,0BAA0B;QACpE,IAAI,CAAC;YACH,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtD,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,OAAO,CAAC,gCAAgC;QAC1C,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,CAAC,mDAAmD;IACnF,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,WAAW,CAAC,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD,mEAAmE;IACnE,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9C,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjE,MAAM,WAAW,CAAC,QAAQ,EAAE,eAAe,EAAE,SAAS,GAAG,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAgB,EAChB,UAA0B,EAAE;IAE5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,qBAAqB,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjC,oDAAoD;IACpD,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEnD,0EAA0E;IAC1E,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,UAA0B,EAAE;IAE5B,OAAO,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,oBAAoB,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,gBAAwB,EACxB,UAA0B,EAAE;IAE5B,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,qBAAqB,CAAC,YAAY,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC3D,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,6DAA6D;IACvE,CAAC;IACD,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,UAA0B,EAAE;IAE5B,IAAI,CAAC;QACH,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}