{"version":3,"file":"schema.cjs","names":["z"],"sources":["../src/schema.ts"],"sourcesContent":["/**\n * Agent Permission Policy — Zod schema (source of truth).\n *\n * This file defines `.agents/permissions.json` and\n * `.agents/permissions.local.json`. The compiled JSON Schema\n * (`agent-permissions.schema.json`) is generated via `z.toJSONSchema()`\n * and submitted to SchemaStore for IDE autocomplete/validation.\n *\n * Compile: pnpm build:schema\n */\n\nimport * as z from \"zod\";\n\n// ---------------------------------------------------------------------------\n// Permission modes\n// ---------------------------------------------------------------------------\n\n/**\n * Default permission mode when starting an agent session.\n *\n * Agent Permission Policy modes:\n * - `standard`: Prompt for unsafe operations (default)\n * - `autonomous`: Auto-approve unless deny/ask rules match\n * - `restricted`: Prompt for all operations\n * - `readonly`: Only allow read-only tools\n *\n * Claude Code compatible modes (accepted for zero-translation migration):\n * - `plan`: Plan-only mode (maps to `restricted`)\n * - `dontAsk`: Auto-approve (maps to `autonomous`)\n * - `acceptEdits`: Accept edits without prompt (maps to `standard`)\n * - `bypassPermissions`: Bypass all permission checks (maps to `autonomous`)\n * - `default`: Agent default behaviour (maps to `standard`)\n *\n * **Security note**: `autonomous`, `bypassPermissions`, and `dontAsk` are only\n * trusted from personal (`permissions.local.json`) or managed (enterprise)\n * sources — NOT from committed `permissions.json`.\n */\nexport const PermissionMode = z\n  .enum([\n    // APP modes\n    \"standard\",\n    \"autonomous\",\n    \"restricted\",\n    \"readonly\",\n    // Claude Code compatible modes\n    \"plan\",\n    \"dontAsk\",\n    \"acceptEdits\",\n    \"bypassPermissions\",\n    \"default\",\n    \"auto\",\n  ])\n  .meta({\n    description:\n      \"Default permission mode. Agent Permission Policy modes: standard, autonomous, restricted, readonly. \" +\n      \"Claude Code compatible modes: plan, dontAsk, acceptEdits, bypassPermissions, default.\",\n    default: \"standard\",\n  });\n\n// ---------------------------------------------------------------------------\n// Permission rule pattern\n// ---------------------------------------------------------------------------\n\n/**\n * A permission rule string.\n *\n * Syntax (compatible with Claude Code's permission rule format):\n *\n * | Pattern                        | Matches                              |\n * |-------------------------------|--------------------------------------|\n * | `Tool`                        | All invocations of the tool          |\n * | `Tool(exact command)`          | Exactly that command                 |\n * | `Tool(prefix:*)`              | Commands starting with `prefix `     |\n * | `Tool(*suffix)`               | Commands ending with ` suffix`       |\n * | `Tool(pattern * middle *)`    | Commands containing both substrings  |\n * | `Read(./path)`                | File reads at that relative path     |\n * | `Read(./path/**)`             | File reads under that path (glob)    |\n * | `WebFetch(domain:example.com)`| Fetches to that domain               |\n * | `mcp__server`                 | All tools from an MCP server         |\n * | `mcp__server__tool`           | A specific MCP tool                  |\n */\nexport const PermissionRule = z.string();\n\n// ---------------------------------------------------------------------------\n// Permission tier lists\n// ---------------------------------------------------------------------------\n\nexport const PermissionTiers = z\n  .object({\n    /**\n     * Tools auto-approved without prompting.\n     * Evaluated after deny rules — if a deny matches, allow is never checked.\n     */\n    allow: z.array(PermissionRule).meta({\n      description:\n        \"Tools auto-approved without prompting. Evaluated after deny rules.\",\n      examples: [\"Bash(git status)\", \"Bash(npm run test:*)\", \"Read\", \"Grep\"],\n    }),\n\n    /**\n     * Tools always denied — short-circuits before allow and ask.\n     * Deny rules from ALL sources are merged and checked first.\n     * A deny cannot be overridden by an allow in any other source.\n     */\n    deny: z.array(PermissionRule).meta({\n      description:\n        \"Tools always denied — short-circuits before allow and ask. A deny cannot be overridden by an allow in any other source.\",\n      examples: [\"Bash(sudo:*)\", \"Bash(rm -rf /)\", \"Read(./.env)\"],\n    }),\n\n    /**\n     * Tools that always prompt, even in autonomous mode.\n     * Evaluated after deny but before allow.\n     */\n    ask: z.array(PermissionRule).meta({\n      description:\n        \"Tools that always prompt, even in autonomous mode. Evaluated after deny but before allow.\",\n      examples: [\"Bash(git push:*)\", \"Bash(npm publish:*)\"],\n    }),\n\n    /**\n     * Directories beyond project root that agents may access.\n     * Paths are relative to project root or absolute.\n     */\n    additionalDirectories: z.array(z.string()).meta({\n      description: \"Directories beyond project root that agents may access.\",\n      examples: [\"../shared-libs/\", \"/tmp/build-cache\"],\n    }),\n\n    /**\n     * Default permission mode. Also accepted at the top level.\n     * Included here for Claude Code compatibility — Claude Code places\n     * defaultMode inside the permissions object.\n     */\n    defaultMode: PermissionMode.meta({\n      description:\n        \"Default permission mode. Accepted here for Claude Code compatibility, \" +\n        \"or at the top level for the canonical placement.\",\n    }),\n  })\n  .partial()\n  .strict();\n\n// ---------------------------------------------------------------------------\n// Conditional rules\n// ---------------------------------------------------------------------------\n\nexport const RuleCondition = z\n  .object({\n    /** Working directory pattern (glob). */\n    cwd: z.string().meta({ description: \"Working directory pattern (glob).\" }),\n\n    /** Git branch name pattern (glob). */\n    branch: z.string().meta({ description: \"Git branch name pattern (glob).\" }),\n  })\n  .partial();\n\nexport const Rule = z\n  .object({\n    /** Canonical tool name (e.g. \"Bash\", \"Read\", \"Write\"). */\n    tool: z.string().meta({\n      description: \"Canonical tool name.\",\n      examples: [\n        \"Bash\",\n        \"Read\",\n        \"Write\",\n        \"Edit\",\n        \"Grep\",\n        \"WebFetch\",\n        \"Agent\",\n        \"mcp__github__create_issue\",\n      ],\n    }),\n\n    /**\n     * Pattern to match against tool input. Same syntax as permission rules.\n     * When absent, matches any input for the tool (bare tool rule).\n     */\n    pattern: z\n      .string()\n      .optional()\n      .meta({\n        description:\n          \"Pattern to match against tool input. When absent, matches any input.\",\n        examples: [\"npm run *\", \"./config/**\", \"git push --force:*\"],\n      }),\n\n    /** Permission tier to apply when this rule matches. */\n    tier: z.enum([\"allow\", \"deny\", \"ask\"]).meta({\n      description: \"Permission tier to apply when this rule matches.\",\n    }),\n\n    /** Optional conditions. All must match for the rule to apply (AND logic). */\n    when: RuleCondition.optional().meta({\n      description:\n        \"Optional conditions. All must match for the rule to apply (AND logic).\",\n    }),\n  })\n  .meta({\n    description:\n      \"Permission rule. Evaluated deny-first: all deny rules, then ask, then allow.\",\n  });\n\n// ---------------------------------------------------------------------------\n// Delegation controls\n// ---------------------------------------------------------------------------\n\nexport const Delegation = z\n  .object({\n    /**\n     * Maximum depth of agent nesting. 0 = no subagents allowed.\n     * @default 2\n     */\n    maxDepth: z.number().int().min(0).meta({\n      description: \"Maximum depth of agent nesting. 0 = no subagents allowed.\",\n      default: 2,\n    }),\n\n    /**\n     * Tools that cannot be delegated to subagents.\n     * Uses the same permission rule syntax.\n     */\n    nonDelegable: z.array(PermissionRule).meta({\n      description:\n        \"Tools that cannot be delegated to subagents. Uses the same rule syntax.\",\n      examples: [\"Bash(sudo:*)\", \"Write(./.agents/**)\"],\n    }),\n\n    /**\n     * Whether subagents can request elevated permissions from their parent.\n     * @default true\n     */\n    bubbleUp: z.boolean().meta({\n      description:\n        \"Whether subagents can request elevated permissions from their parent.\",\n      default: true,\n    }),\n\n    /**\n     * Per-agent permission overrides. Keys are agent names or glob patterns\n     * matching agent identifiers. Values are inline permission tiers that\n     * replace (not merge with) the parent policy for that agent.\n     *\n     * Maps to OpenCode's per-agent markdown frontmatter and Codex's\n     * `apps.<name>.tools` config.\n     */\n    agents: z.record(z.string(), PermissionTiers).meta({\n      description:\n        \"Per-agent permission overrides. Keys are agent names or glob patterns. \" +\n        \"Values replace (not merge with) the parent policy for that agent.\",\n      examples: [\n        {\n          review: { deny: [\"Write\", \"Edit\", \"Bash\"], allow: [\"Read\", \"Grep\"] },\n          docs: { allow: [\"Read\", \"Write(./docs/**)\", \"Bash(mdbook build:*)\"] },\n        },\n      ],\n    }),\n  })\n  .partial();\n\n// ---------------------------------------------------------------------------\n// Top-level schema\n// ---------------------------------------------------------------------------\n\n// ---------------------------------------------------------------------------\n// Sandbox configuration\n// ---------------------------------------------------------------------------\n\n/**\n * Sandbox mode — OS-level isolation for agent tool execution.\n *\n * When set, the agent harness should enforce filesystem and network\n * boundaries at the OS level (sandbox, container, namespace, etc).\n * This is orthogonal to permission rules — rules control what the agent\n * *asks* to do; sandbox controls what the OS *allows* it to do.\n *\n * Maps to Codex's `sandbox_mode` field.\n */\nexport const SandboxMode = z\n  .enum([\"readonly\", \"workspace-write\", \"full-access\"])\n  .meta({\n    description:\n      \"OS-level sandbox isolation mode. \" +\n      \"readonly: filesystem is read-only. \" +\n      \"workspace-write: writes confined to project directory + writableRoots. \" +\n      \"full-access: no OS-level restrictions.\",\n    default: \"workspace-write\",\n  });\n\nexport const Sandbox = z\n  .object({\n    /**\n     * Sandbox isolation mode.\n     */\n    mode: SandboxMode.meta({\n      description: \"Sandbox isolation mode.\",\n    }),\n\n    /**\n     * Additional paths the agent may write to (beyond project root).\n     * Only meaningful when mode is `workspace-write`.\n     */\n    writableRoots: z.array(z.string()).meta({\n      description:\n        \"Additional paths the agent may write to (beyond project root). \" +\n        \"Only meaningful when mode is `workspace-write`.\",\n      examples: [\"/tmp/build-cache\", \"../shared-libs\"],\n    }),\n\n    /**\n     * Whether the agent may make network requests from within the sandbox.\n     * When false, network access is blocked at the OS level.\n     * Maps to Codex's `sandbox_workspace_write.network_access`.\n     */\n    networkAccess: z.boolean().meta({\n      description:\n        \"Whether the agent may make network requests from within the sandbox. \" +\n        \"When false, network access is blocked at the OS level.\",\n      default: true,\n    }),\n  })\n  .partial()\n  .strict()\n  .meta({\n    description:\n      \"OS-level sandbox configuration. Controls filesystem and network \" +\n      \"isolation for agent tool execution, enforced by the harness runtime.\",\n  });\n\n// ---------------------------------------------------------------------------\n// Named profiles\n// ---------------------------------------------------------------------------\n\n/**\n * Named permission profiles that can be selected at session start.\n *\n * Maps to Codex's `permissions.<name>` + `default_permissions` fields.\n * Agents that don't support named profiles should use the profile\n * specified by `activeProfile` (or `\"default\"` if unset).\n */\nexport const Profiles = z.record(z.string(), PermissionTiers).meta({\n  description:\n    \"Named permission profiles. Each profile is a complete set of permission tiers. \" +\n    \"Select one at session start via `activeProfile`.\",\n  examples: [\n    {\n      strict: { deny: [\"Write\", \"Edit\", \"Bash\"], allow: [\"Read\", \"Grep\"] },\n      relaxed: {\n        allow: [\"Read\", \"Write\", \"Edit\", \"Bash(git:*)\", \"Bash(npm:*)\"],\n      },\n    },\n  ],\n});\n\n// ---------------------------------------------------------------------------\n// Network controls\n// ---------------------------------------------------------------------------\n\nexport const Network = z\n  .object({\n    /**\n     * Whether network access is permitted at all.\n     * When false, WebFetch and WebSearch are denied regardless of allow rules.\n     */\n    enabled: z.boolean().meta({\n      description:\n        \"Whether network access is permitted at all. When false, \" +\n        \"WebFetch and WebSearch are denied regardless of allow rules.\",\n      default: true,\n    }),\n\n    /**\n     * Domain-level allow/deny rules for HTTP(S) requests.\n     * Maps to both Codex's `network.domains` and Claude Code's\n     * `WebFetch(domain:...)` rules.\n     */\n    domains: z.record(z.string(), z.enum([\"allow\", \"deny\"])).meta({\n      description:\n        \"Domain-level allow/deny rules for HTTP(S) requests. \" +\n        \"Supplements the WebFetch(domain:...) permission rules.\",\n      examples: [{ \"api.example.com\": \"allow\", \"evil.com\": \"deny\" }],\n    }),\n  })\n  .partial()\n  .strict()\n  .meta({\n    description: \"Network access controls.\",\n  });\n\n// ---------------------------------------------------------------------------\n// Top-level schema\n// ---------------------------------------------------------------------------\n\nexport const AgentPermissionPolicy = z\n  .object({\n    /** JSON Schema URI for editor validation and autocomplete. */\n    $schema: z.string().meta({\n      description: \"JSON Schema URI for editor validation and autocomplete.\",\n    }),\n\n    /** Default permission mode when starting a session. */\n    defaultMode: PermissionMode,\n\n    /** Name of the active profile from `profiles`. */\n    activeProfile: z.string().meta({\n      description:\n        \"Name of the active profile from `profiles`. If unset, use the \" +\n        \"top-level permission tiers directly.\",\n    }),\n\n    /** Tool permission rules — evaluated in deny → ask → allow order. */\n    permissions: PermissionTiers.meta({\n      description:\n        \"Tool permission rules — evaluated in deny → ask → allow order.\",\n    }),\n\n    /** Permission rules — unified deny-first evaluation. */\n    rules: z.array(Rule).meta({\n      description:\n        \"Permission rules. Evaluated deny-first: all deny rules checked, then ask, then allow. \" +\n        \"Falls back to defaultMode when no rule matches.\",\n    }),\n\n    /** Named permission profiles — selectable at session start. */\n    profiles: Profiles.meta({\n      description: \"Named permission profiles.\",\n    }),\n\n    /** Agent delegation controls — what subagents may do. */\n    delegation: Delegation.meta({\n      description: \"Agent delegation controls — what subagents may do.\",\n    }),\n\n    /** OS-level sandbox configuration. */\n    sandbox: Sandbox.meta({\n      description: \"OS-level sandbox configuration.\",\n    }),\n\n    /** Network access controls. */\n    network: Network.meta({\n      description: \"Network access controls.\",\n    }),\n\n    /** Environment variables injected into all agent sessions. */\n    env: z.record(z.string(), z.string()).meta({\n      description: \"Environment variables injected into all agent sessions.\",\n      examples: [{ NODE_ENV: \"development\", DISABLE_TELEMETRY: \"1\" }],\n    }),\n\n    /**\n     * Agent configs to include when loading. When set, only these agent\n     * configs are read (plus canonical). Mutually exclusive with `without`.\n     */\n    with: z\n      .array(z.enum([\"claude-code\", \"codex\", \"kiro\", \"opencode\", \"crush\"]))\n      .meta({\n        description:\n          \"Agent configs to include when loading. Only these native configs \" +\n          \"are read (plus canonical). Mutually exclusive with `without`.\",\n        examples: [[\"claude-code\", \"opencode\"]],\n      }),\n\n    /**\n     * Agent configs to exclude when loading. Mutually exclusive with `with`.\n     */\n    without: z\n      .array(z.enum([\"claude-code\", \"codex\", \"kiro\", \"opencode\", \"crush\"]))\n      .meta({\n        description:\n          \"Agent configs to exclude when loading. Mutually exclusive with `with`.\",\n        examples: [[\"codex\"]],\n      }),\n\n    /**\n     * How far to walk up the directory tree when loading configs.\n     * `\"all\"` walks to the filesystem root. A number limits parent\n     * directories (0 = cwd only). Controls both canonical and native\n     * config discovery.\n     */\n    up: z.union([z.enum([\"all\"]), z.number().int().min(0)]).meta({\n      description:\n        \"How far to walk up the directory tree when loading configs. \" +\n        \"'all' walks to the filesystem root. A number limits parent directories (0 = cwd only).\",\n      default: \"all\",\n      examples: [\"all\", 0, 3, 5],\n    }),\n\n    /** Sync configuration for the MCP server and CLI sync command. */\n    sync: z\n      .object({\n        /**\n         * Sync mode.\n         * - `\"sync\"`: One-shot sync at startup, then exit.\n         * - `\"watch\"`: Continuous sync via filesystem watching.\n         * - `false`: No sync (MCP server is passive).\n         */\n        mode: z.union([z.enum([\"sync\", \"watch\"]), z.literal(false)]).meta({\n          description:\n            \"Sync mode. 'sync' = one-shot at startup. 'watch' = continuous via fs.watch. false = disabled.\",\n          default: false,\n        }),\n\n        /** Write .bak files before overwriting. */\n        backup: z.boolean().meta({\n          description: \"Write .bak files before overwriting.\",\n          default: false,\n        }),\n      })\n      .partial()\n      .meta({\n        description:\n          \"Sync configuration for the MCP server and CLI sync command.\",\n      }),\n  })\n  .partial()\n  .strict()\n  .check((ctx) => {\n    if (ctx.value.with !== undefined && ctx.value.without !== undefined) {\n      ctx.issues.push({\n        code: \"custom\",\n        input: ctx.value,\n        message: \"'with' and 'without' are mutually exclusive.\",\n        path: [\"with\"],\n      });\n    }\n  })\n  .meta({\n    title: \"Agent Permission Policy\",\n    description:\n      \"Cross-agent permission policy for AI coding agents. Defines what tools agents may use, under what conditions, and how subagents are constrained. \" +\n      \"The `with`/`without`/`up` fields control which native agent configs are \" +\n      \"discovered and merged during walk-up loading. \" +\n      \"Placed at .agents/permissions.json (team, committed) or .agents/permissions.local.json (personal, gitignored).\",\n  });\n\n// ---------------------------------------------------------------------------\n// Inferred types\n// ---------------------------------------------------------------------------\n\nexport type AgentPermissionPolicy = z.infer<typeof AgentPermissionPolicy>;\nexport type PermissionTiers = z.infer<typeof PermissionTiers>;\nexport type Rule = z.infer<typeof Rule>;\nexport type RuleCondition = z.infer<typeof RuleCondition>;\nexport type Delegation = z.infer<typeof Delegation>;\nexport type PermissionMode = z.infer<typeof PermissionMode>;\nexport type SandboxMode = z.infer<typeof SandboxMode>;\nexport type Sandbox = z.infer<typeof Sandbox>;\nexport type Profiles = z.infer<typeof Profiles>;\nexport type Network = z.infer<typeof Network>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,MAAa,iBAAiBA,IAC3B,KAAK;CAEJ;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC,CACD,KAAK;CACJ,aACE;CAEF,SAAS;CACV,CAAC;;;;;;;;;;;;;;;;;;;AAwBJ,MAAa,iBAAiBA,IAAE,QAAQ;AAMxC,MAAa,kBAAkBA,IAC5B,OAAO;;;;;CAKN,OAAOA,IAAE,MAAM,eAAe,CAAC,KAAK;EAClC,aACE;EACF,UAAU;GAAC;GAAoB;GAAwB;GAAQ;GAAO;EACvE,CAAC;;;;;;CAOF,MAAMA,IAAE,MAAM,eAAe,CAAC,KAAK;EACjC,aACE;EACF,UAAU;GAAC;GAAgB;GAAkB;GAAe;EAC7D,CAAC;;;;;CAMF,KAAKA,IAAE,MAAM,eAAe,CAAC,KAAK;EAChC,aACE;EACF,UAAU,CAAC,oBAAoB,sBAAsB;EACtD,CAAC;;;;;CAMF,uBAAuBA,IAAE,MAAMA,IAAE,QAAQ,CAAC,CAAC,KAAK;EAC9C,aAAa;EACb,UAAU,CAAC,mBAAmB,mBAAmB;EAClD,CAAC;;;;;;CAOF,aAAa,eAAe,KAAK,EAC/B,aACE,0HAEH,CAAC;CACH,CAAC,CACD,SAAS,CACT,QAAQ;AAMX,MAAa,gBAAgBA,IAC1B,OAAO;;CAEN,KAAKA,IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,qCAAqC,CAAC;;CAG1E,QAAQA,IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,mCAAmC,CAAC;CAC5E,CAAC,CACD,SAAS;AAEZ,MAAa,OAAOA,IACjB,OAAO;;CAEN,MAAMA,IAAE,QAAQ,CAAC,KAAK;EACpB,aAAa;EACb,UAAU;GACR;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD;EACF,CAAC;;;;;CAMF,SAASA,IACN,QAAQ,CACR,UAAU,CACV,KAAK;EACJ,aACE;EACF,UAAU;GAAC;GAAa;GAAe;GAAqB;EAC7D,CAAC;;CAGJ,MAAMA,IAAE,KAAK;EAAC;EAAS;EAAQ;EAAM,CAAC,CAAC,KAAK,EAC1C,aAAa,oDACd,CAAC;;CAGF,MAAM,cAAc,UAAU,CAAC,KAAK,EAClC,aACE,0EACH,CAAC;CACH,CAAC,CACD,KAAK,EACJ,aACE,gFACH,CAAC;AAMJ,MAAa,aAAaA,IACvB,OAAO;;;;;CAKN,UAAUA,IAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK;EACrC,aAAa;EACb,SAAS;EACV,CAAC;;;;;CAMF,cAAcA,IAAE,MAAM,eAAe,CAAC,KAAK;EACzC,aACE;EACF,UAAU,CAAC,gBAAgB,sBAAsB;EAClD,CAAC;;;;;CAMF,UAAUA,IAAE,SAAS,CAAC,KAAK;EACzB,aACE;EACF,SAAS;EACV,CAAC;;;;;;;;;CAUF,QAAQA,IAAE,OAAOA,IAAE,QAAQ,EAAE,gBAAgB,CAAC,KAAK;EACjD,aACE;EAEF,UAAU,CACR;GACE,QAAQ;IAAE,MAAM;KAAC;KAAS;KAAQ;KAAO;IAAE,OAAO,CAAC,QAAQ,OAAO;IAAE;GACpE,MAAM,EAAE,OAAO;IAAC;IAAQ;IAAoB;IAAuB,EAAE;GACtE,CACF;EACF,CAAC;CACH,CAAC,CACD,SAAS;;;;;;;;;;;AAoBZ,MAAa,cAAcA,IACxB,KAAK;CAAC;CAAY;CAAmB;CAAc,CAAC,CACpD,KAAK;CACJ,aACE;CAIF,SAAS;CACV,CAAC;AAEJ,MAAa,UAAUA,IACpB,OAAO;;;;CAIN,MAAM,YAAY,KAAK,EACrB,aAAa,2BACd,CAAC;;;;;CAMF,eAAeA,IAAE,MAAMA,IAAE,QAAQ,CAAC,CAAC,KAAK;EACtC,aACE;EAEF,UAAU,CAAC,oBAAoB,iBAAiB;EACjD,CAAC;;;;;;CAOF,eAAeA,IAAE,SAAS,CAAC,KAAK;EAC9B,aACE;EAEF,SAAS;EACV,CAAC;CACH,CAAC,CACD,SAAS,CACT,QAAQ,CACR,KAAK,EACJ,aACE,wIAEH,CAAC;;;;;;;;AAaJ,MAAa,WAAWA,IAAE,OAAOA,IAAE,QAAQ,EAAE,gBAAgB,CAAC,KAAK;CACjE,aACE;CAEF,UAAU,CACR;EACE,QAAQ;GAAE,MAAM;IAAC;IAAS;IAAQ;IAAO;GAAE,OAAO,CAAC,QAAQ,OAAO;GAAE;EACpE,SAAS,EACP,OAAO;GAAC;GAAQ;GAAS;GAAQ;GAAe;GAAc,EAC/D;EACF,CACF;CACF,CAAC;AAMF,MAAa,UAAUA,IACpB,OAAO;;;;;CAKN,SAASA,IAAE,SAAS,CAAC,KAAK;EACxB,aACE;EAEF,SAAS;EACV,CAAC;;;;;;CAOF,SAASA,IAAE,OAAOA,IAAE,QAAQ,EAAEA,IAAE,KAAK,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,KAAK;EAC5D,aACE;EAEF,UAAU,CAAC;GAAE,mBAAmB;GAAS,YAAY;GAAQ,CAAC;EAC/D,CAAC;CACH,CAAC,CACD,SAAS,CACT,QAAQ,CACR,KAAK,EACJ,aAAa,4BACd,CAAC;AAMJ,MAAa,wBAAwBA,IAClC,OAAO;;CAEN,SAASA,IAAE,QAAQ,CAAC,KAAK,EACvB,aAAa,2DACd,CAAC;;CAGF,aAAa;;CAGb,eAAeA,IAAE,QAAQ,CAAC,KAAK,EAC7B,aACE,sGAEH,CAAC;;CAGF,aAAa,gBAAgB,KAAK,EAChC,aACE,kEACH,CAAC;;CAGF,OAAOA,IAAE,MAAM,KAAK,CAAC,KAAK,EACxB,aACE,yIAEH,CAAC;;CAGF,UAAU,SAAS,KAAK,EACtB,aAAa,8BACd,CAAC;;CAGF,YAAY,WAAW,KAAK,EAC1B,aAAa,sDACd,CAAC;;CAGF,SAAS,QAAQ,KAAK,EACpB,aAAa,mCACd,CAAC;;CAGF,SAAS,QAAQ,KAAK,EACpB,aAAa,4BACd,CAAC;;CAGF,KAAKA,IAAE,OAAOA,IAAE,QAAQ,EAAEA,IAAE,QAAQ,CAAC,CAAC,KAAK;EACzC,aAAa;EACb,UAAU,CAAC;GAAE,UAAU;GAAe,mBAAmB;GAAK,CAAC;EAChE,CAAC;;;;;CAMF,MAAMA,IACH,MAAMA,IAAE,KAAK;EAAC;EAAe;EAAS;EAAQ;EAAY;EAAQ,CAAC,CAAC,CACpE,KAAK;EACJ,aACE;EAEF,UAAU,CAAC,CAAC,eAAe,WAAW,CAAC;EACxC,CAAC;;;;CAKJ,SAASA,IACN,MAAMA,IAAE,KAAK;EAAC;EAAe;EAAS;EAAQ;EAAY;EAAQ,CAAC,CAAC,CACpE,KAAK;EACJ,aACE;EACF,UAAU,CAAC,CAAC,QAAQ,CAAC;EACtB,CAAC;;;;;;;CAQJ,IAAIA,IAAE,MAAM,CAACA,IAAE,KAAK,CAAC,MAAM,CAAC,EAAEA,IAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK;EAC3D,aACE;EAEF,SAAS;EACT,UAAU;GAAC;GAAO;GAAG;GAAG;GAAE;EAC3B,CAAC;;CAGF,MAAMA,IACH,OAAO;;;;;;;EAON,MAAMA,IAAE,MAAM,CAACA,IAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC,EAAEA,IAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,KAAK;GAChE,aACE;GACF,SAAS;GACV,CAAC;;EAGF,QAAQA,IAAE,SAAS,CAAC,KAAK;GACvB,aAAa;GACb,SAAS;GACV,CAAC;EACH,CAAC,CACD,SAAS,CACT,KAAK,EACJ,aACE,+DACH,CAAC;CACL,CAAC,CACD,SAAS,CACT,QAAQ,CACR,OAAO,QAAQ;CACd,IAAI,IAAI,MAAM,SAAS,UAAa,IAAI,MAAM,YAAY,QACxD,IAAI,OAAO,KAAK;EACd,MAAM;EACN,OAAO,IAAI;EACX,SAAS;EACT,MAAM,CAAC,OAAO;EACf,CAAC;EAEJ,CACD,KAAK;CACJ,OAAO;CACP,aACE;CAIH,CAAC"}