{"version":3,"sources":["../src/types.ts","../src/tokens.ts","../src/store.ts","../src/registry.ts","../src/policies/engine.ts","../src/policies/declarative.ts","../src/policies/schema.ts","../src/policies/builder.ts","../src/policies/dynamic.ts","../src/ast/instrumentor.ts"],"names":["ProvenanceMode","ProvenanceSource","ProvenanceSecurityError","Error","constructor","message","policy","toolName","details","name","MAX_VALUE_SIZE","stableStringify","value","undefined","String","JSON","stringify","seen","WeakSet","replacer","_key","val","has","add","Array","isArray","sorted","keys","Object","sort","k","result","length","error","computeDigest","serialized","crypto","createHash","update","digest","getClientSecret","clientId","secret","process","env","PROVENANCE_SECRET","secretBytes","Buffer","from","hmacSign","data","createHmac","issueProvenanceToken","metadata","executionId","cacheProvider","ttl","valueDigest","metaId","nanoid","cacheKey","set","valueKey","log","payload","v","createdAt","Date","now","expiresAt","payloadStr","payloadB64","toString","signature","verifyProvenanceToken","token","parts","split","expectedSig","sigBuf","expectedBuf","timingSafeEqual","parse","version","tokenClientId","expectedClientId","tokenExecutionId","expectedExecutionId","warn","metaStr","get","verifyProvenanceHints","hints","maxHints","map","Map","hintsToProcess","slice","timeout","promises","fetchPromise","timeoutPromise","Promise","resolve","setTimeout","race","valueStr","__valueMap","e","all","InMemoryProvenanceStore","registry","primitives","executionIds","executionPrimitives","id","getBatch","ids","meta","Set","getPrimitive","key","setPrimitive","cleanupExecution","delete","primKeys","getExecution","PROVENANCE_KEY","PROVENANCE_ID_KEY","provenanceStore","WeakMap","provenanceRegistry","executionProvenanceIds","currentExecutionId","primitiveProvenanceMap","executionTaintedPrimitives","globalStore","setGlobalProvenanceStore","store","markPrimitiveTainted","sourceMetadata","tainted","catch","err","isPrimitiveTainted","setProvenanceExecutionId","clearProvenanceExecutionId","hydrateProvenance","batch","entries","execIds","hydrateExecutionProvenance","executionSet","registerProvenanceMetadata","startsWith","includes","cleanupProvenanceForExecution","keysToDelete","push","getProvenanceForPrimitive","taintedKey","taintedMetadata","primitiveValue","join","digestMetadata","captureProvenanceState","state","captureProvenanceSnapshot","registryMap","first","restoreProvenanceState","restoreProvenanceSnapshot","snapshot","createProvenanceProxy","source","readers","type","dependencies","context","defineProperty","writable","enumerable","configurable","__proto__","item","hasProvenance","prototype","hasOwnProperty","call","nestedValue","primitiveKey","getProvenance","primitiveProvenance","stored","getAllProvenance","visited","results","canRead","reader","permissions","SecurityPolicyEngine","policies","logger","approvalCallback","customGetProvenance","setGetProvenance","fn","setApprovalCallback","callback","checkTool","apiGroup","args","debug","policyCount","getProvenanceFn","check","action","normalizeAction","reason","sanitizeArgs","info","approved","requestApproval","approvalDenied","allowed","policyName","requiresApproval","sanitized","substring","getAllProvenanceFromArgs","allProvenance","scan","primitiveProv","provenance","preventDataExfiltration","description","recipientKeys","recipient","TOOL","toolSource","authorizedReaders","preventDataExfiltrationWithApproval","sensitiveFields","filter","requireUserOrigin","criticalTools","some","t","toLowerCase","USER","SYSTEM","parameterKey","actualSource","requireUserOriginWithApproval","blockLLMRecipients","LLM","recipientValue","blockLLMRecipientsWithApproval","llmOperation","operation","auditSensitiveAccess","sensitiveTools","provenanceChain","p","createCustomPolicy","checkFn","getBuiltInPolicies","getBuiltInPoliciesWithApproval","resolveValue","path","root","shift","current","part","argName","argValue","remainingParts","metadataKeys","splitIndex","i","valuePath","metaPath","currentVal","currentMeta","evaluateCondition","actual","operator","expected","endsWith","RegExp","test","match","op","numValue","parseFloat","createDeclarativePolicy","config","scope","toolRegex","extractedGroup","groupRegex","rule","rules","allMatch","conditions","every","condition","actualValue","field","ruleId","loadDeclarativePolicies","OperatorSchema","z","enum","ConditionSchema","object","string","describe","any","PolicyActionSchema","PolicyRuleSchema","optional","array","DeclarativePolicyConfigSchema","PolicyConfigurationSchema","RuleBuilder","build","PolicyBuilder","desc","scopeTool","toolNamePattern","scopeApiGroup","apiGroupPattern","addRule","buildFn","builder","addRuleObject","DynamicPolicyRegistry","initialPolicies","addPolicy","removePolicy","clear","loadFromConfigs","configs","replace","getPolicies","values","instrumentCode","code","wrappedCode","ast","ecmaVersion","sourceType","trackingCalls","walk","simple","BinaryExpression","node","wrapBinaryExpression","AssignmentExpression","wrapAssignment","CallExpression","callee","wrapMethodCall","TemplateLiteral","wrapTemplateLiteral","instrumentedCode","generate","originalNode","arguments","left","right","originalRight","obj","isAPICall","isAPIObject","property","elements","expressions","quasis","quasi","cooked","raw","ASTProvenanceTracker","valueToId","nextId","getId","existing","track","trackBinary","leftId","rightId","leftProv","rightProv","toolMetadata","timestamp","trackAssign","trackMethod","method","a","trackTemplate","expr","prov","getMetadata","getAllMetadata","restoreMetadata","createTrackingRuntime","tracker","runtime","__track","deps","__track_binary","__track_assign","__track_method","__track_template","__get_provenance"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOCA;UACWA,eAAAA,EAAAA;AACgC,EAAAA,eAAAA,CAAA,MAAA,CAAA,GAAA,MAAA;AAEC,EAAAA,eAAAA,CAAA,OAAA,CAAA,GAAA,OAAA;AAEI,EAAAA,eAAAA,CAAA,KAAA,CAAA,GAAA,KAAA;GALrCA,sBAAAA,KAAAA,sBAAAA,GAAAA,EAAAA,CAAAA,CAAAA;;UAYAC,iBAAAA,EAAAA;AAC0B,EAAAA,iBAAAA,CAAA,MAAA,CAAA,GAAA,MAAA;AAEb,EAAAA,iBAAAA,CAAA,KAAA,CAAA,GAAA,KAAA;AAEA,EAAAA,iBAAAA,CAAA,MAAA,CAAA,GAAA,MAAA;AAEQ,EAAAA,iBAAAA,CAAA,QAAA,CAAA,GAAA,QAAA;GAPrBA,wBAAAA,KAAAA,wBAAAA,GAAAA,EAAAA,CAAAA,CAAAA;AAgJL,IAAMC,uBAAAA,GAAN,cAAsCC,KAAAA,CAAAA;EApK7C;;;;;;EAqKCC,WAAAA,CACCC,OAAAA,EACOC,MAAAA,EACAC,QAAAA,EACAC,OAAAA,EACN;AACD,IAAA,KAAA,CAAMH,OAAAA,CAAAA;SAJCC,MAAAA,GAAAA,MAAAA;SACAC,QAAAA,GAAAA,QAAAA;SACAC,OAAAA,GAAAA,OAAAA;AAGP,IAAA,IAAA,CAAKC,IAAAA,GAAO,yBAAA;AACb,EAAA;AACD;AC7IA,IAAMC,iBAAiB,IAAA,GAAO,IAAA;AAKvB,SAASC,gBAAgBC,KAAAA,EAAc;AAC7C,EAAA,IAAI;AACH,IAAA,IAAIA,KAAAA,KAAU,IAAA,IAAQA,KAAAA,KAAUC,KAAAA,CAAAA,EAAW;AAC1C,MAAA,OAAOC,OAAOF,KAAAA,CAAAA;AACf,IAAA;AAEA,IAAA,IAAI,OAAOA,UAAU,QAAA,IAAY,OAAOA,UAAU,QAAA,IAAY,OAAOA,UAAU,SAAA,EAAW;AACzF,MAAA,OAAOG,IAAAA,CAAKC,UAAUJ,KAAAA,CAAAA;AACvB,IAAA;AAEA,IAAA,IAAI,OAAOA,KAAAA,KAAU,UAAA,IAAc,OAAOA,UAAU,QAAA,EAAU;AAC7D,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,MAAMK,IAAAA,uBAAWC,OAAAA,EAAAA;AAEjB,IAAA,MAAMC,QAAAA,mBAAW,MAAA,CAAA,CAACC,IAAAA,EAAcC,GAAAA,KAAAA;AAC/B,MAAA,IAAIA,GAAAA,KAAQ,IAAA,IAAQ,OAAOA,GAAAA,KAAQ,QAAA,EAAU;AAC5C,QAAA,IAAIJ,IAAAA,CAAKK,GAAAA,CAAID,GAAAA,CAAAA,EAAgB;AAC5B,UAAA,OAAO,YAAA;AACR,QAAA;AACAJ,QAAAA,IAAAA,CAAKM,IAAIF,GAAAA,CAAAA;AAET,QAAA,IAAI,CAACG,KAAAA,CAAMC,OAAAA,CAAQJ,GAAAA,CAAAA,EAAM;AACxB,UAAA,MAAMK,SAAkC,EAAC;AACzC,UAAA,MAAMC,IAAAA,GAAOC,MAAAA,CAAOD,IAAAA,CAAKN,GAAAA,EAAgCQ,IAAAA,EAAI;AAC7D,UAAA,KAAA,MAAWC,KAAKH,IAAAA,EAAM;AACrBD,YAAAA,MAAAA,CAAOI,CAAAA,CAAAA,GAAMT,GAAAA,CAAgCS,CAAAA,CAAAA;AAC9C,UAAA;AACA,UAAA,OAAOJ,MAAAA;AACR,QAAA;AACD,MAAA;AACA,MAAA,OAAOL,GAAAA;IACR,CAAA,EAjBiB,UAAA,CAAA;AAmBjB,IAAA,MAAMU,MAAAA,GAAShB,IAAAA,CAAKC,SAAAA,CAAUJ,KAAAA,EAAOO,QAAAA,CAAAA;AACrC,IAAA,IAAIY,MAAAA,CAAOC,SAAStB,cAAAA,EAAgB;AACnC,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,OAAOqB,MAAAA;AACR,EAAA,CAAA,CAAA,OAASE,KAAAA,EAAO;AACf,IAAA,OAAO,IAAA;AACR,EAAA;AACD;AA5CgBtB,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAiDT,SAASuB,cAActB,KAAAA,EAAc;AAC3C,EAAA,MAAMuB,UAAAA,GAAaxB,gBAAgBC,KAAAA,CAAAA;AACnC,EAAA,IAAI,CAACuB,UAAAA,EAAY;AAChB,IAAA,OAAO,IAAA;AACR,EAAA;AACA,EAAA,OAAOC,uBAAAA,CAAOC,WAAW,QAAA,CAAA,CAAUC,OAAOH,UAAAA,CAAAA,CAAYI,OAAO,WAAA,CAAA;AAC9D;AANgBL,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAWT,SAASM,gBAAgBC,QAAAA,EAAgB;AAC/C,EAAA,MAAMC,MAAAA,GAASC,QAAQC,GAAAA,CAAIC,iBAAAA;AAC3B,EAAA,IAAI,CAACH,MAAAA,EAAQ;AACZ,IAAA,MAAM,IAAIvC,MACT,oIACC,CAAA;AAEH,EAAA;AAGA,EAAA,MAAM2C,WAAAA,GAAcC,MAAAA,CAAOC,IAAAA,CAAKN,MAAAA,EAAQ,OAAA,CAAA,CAASV,MAAAA;AACjD,EAAA,IAAIc,cAAc,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI3C,KAAAA,CACT,CAAA,uDAAA,EAA0D2C,WAAAA,CAAAA,+DAAAA,CACzD,CAAA;AAEH,EAAA;AACA,EAAA,OAAOJ,MAAAA;AACR;AAlBgBF,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAuBhB,SAASS,QAAAA,CAASC,MAAcR,MAAAA,EAAc;AAC7C,EAAA,OAAON,uBAAAA,CAAOe,WAAW,QAAA,EAAUT,MAAAA,EAAQJ,MAAAA,CAAOY,IAAAA,CAAAA,CAAMX,MAAAA,CAAO,WAAA,CAAA;AAChE;AAFSU,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAOT,eAAsBG,qBACrBC,QAAAA,EACAzC,KAAAA,EACA6B,UACAa,WAAAA,EACAC,aAAAA,EACAC,MAAc,IAAA,EAAI;AAElB,EAAA,MAAMC,WAAAA,GAAcvB,cAActB,KAAAA,CAAAA;AAClC,EAAA,IAAI,CAAC6C,WAAAA,EAAa;AACjB,IAAA,OAAO,IAAA;AACR,EAAA;AAEA,EAAA,MAAMC,SAASC,aAAAA,EAAAA;AACf,EAAA,MAAMC,QAAAA,GAAW,CAAA,UAAA,EAAanB,QAAAA,CAAAA,CAAAA,EAAYiB,MAAAA,CAAAA,CAAAA;AAE1C,EAAA,IAAI;AACH,IAAA,MAAMH,cAAcM,GAAAA,CAAID,QAAAA,EAAU7C,KAAKC,SAAAA,CAAUqC,QAAAA,GAAWG,GAAAA,CAAAA;AAE5D,IAAA,IAAI,OAAO5C,KAAAA,KAAU,QAAA,IAAY,OAAOA,UAAU,QAAA,EAAU;AAC3D,MAAA,MAAMkD,QAAAA,GAAW,CAAA,WAAA,EAAcrB,QAAAA,CAAAA,CAAAA,EAAYgB,WAAAA,CAAAA,CAAAA;AAC3C,MAAA,MAAMF,aAAAA,CAAcM,GAAAA,CAAIC,QAAAA,EAAU/C,IAAAA,CAAKC,SAAAA,CAAU;AAAEJ,QAAAA,KAAAA,EAAOE,OAAOF,KAAAA,CAAAA;AAAQ8C,QAAAA;AAAO,OAAA,GAAIF,GAAAA,CAAAA;AACrF,IAAA;AACD,EAAA,CAAA,CAAA,OAASvB,KAAAA,EAAO;AACf8B,IAAAA,cAAAA,CAAI9B,MAAM,8CAAA,EAAgD;AAAEA,MAAAA;KAAM,CAAA;AAClE,IAAA,OAAO,IAAA;AACR,EAAA;AAEA,EAAA,MAAM+B,OAAAA,GAAwB;IAC7BC,CAAAA,EAAG,CAAA;AACHxB,IAAAA,QAAAA;AACAa,IAAAA,WAAAA;AACAY,IAAAA,SAAAA,EAAWC,KAAKC,GAAAA,EAAG;IACnBC,SAAAA,EAAWF,IAAAA,CAAKC,GAAAA,EAAG,GAAKZ,GAAAA,GAAM,GAAA;AAC9BC,IAAAA,WAAAA;AACAC,IAAAA;AACD,GAAA;AAEA,EAAA,MAAMY,UAAAA,GAAavD,IAAAA,CAAKC,SAAAA,CAAUgD,OAAAA,CAAAA;AAClC,EAAA,MAAMO,aAAaxB,MAAAA,CAAOC,IAAAA,CAAKsB,UAAAA,CAAAA,CAAYE,SAAS,WAAA,CAAA;AACpD,EAAA,MAAM9B,MAAAA,GAASF,gBAAgBC,CAAAA;AAC/B,EAAA,MAAMgC,SAAAA,GAAYxB,QAAAA,CAASsB,UAAAA,EAAY7B,MAAAA,CAAAA;AAEvC,EAAA,OAAO,CAAA,EAAG6B,UAAAA,CAAAA,CAAAA,EAAcE,SAAAA,CAAAA,CAAAA;AACzB;AA5CsBrB,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAiDtB,eAAsBsB,qBAAAA,CACrBC,KAAAA,EACA/D,KAAAA,EACA6B,QAAAA,EACAa,aACAC,aAAAA,EAA4B;AAE5B,EAAA,IAAI;AACH,IAAA,MAAMqB,KAAAA,GAAQD,KAAAA,CAAME,KAAAA,CAAM,GAAA,CAAA;AAC1B,IAAA,IAAID,KAAAA,CAAM5C,WAAW,CAAA,EAAG;AACvB,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,MAAM,CAACuC,UAAAA,EAAYE,SAAAA,CAAAA,GAAaG,KAAAA;AAChC,IAAA,IAAI,CAACL,UAAAA,IAAc,CAACE,SAAAA,EAAW;AAC9B,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,MAAM/B,MAAAA,GAASF,gBAAgBC,QAAAA,CAAAA;AAC/B,IAAA,MAAMqC,WAAAA,GAAc7B,QAAAA,CAASsB,UAAAA,EAAY7B,MAAAA,CAAAA;AAGzC,IAAA,IAAI;AACH,MAAA,MAAMqC,MAAAA,GAAShC,MAAAA,CAAOC,IAAAA,CAAKyB,SAAAA,EAAW,WAAA,CAAA;AACtC,MAAA,MAAMO,WAAAA,GAAcjC,MAAAA,CAAOC,IAAAA,CAAK8B,WAAAA,EAAa,WAAA,CAAA;AAE7C,MAAA,IAAIC,MAAAA,CAAO/C,WAAWgD,WAAAA,CAAYhD,MAAAA,IAAU,CAACI,uBAAAA,CAAO6C,eAAAA,CAAgBF,MAAAA,EAAQC,WAAAA,CAAAA,EAAc;AACzFjB,QAAAA,cAAAA,CAAI9B,MAAM,qCAAA,CAAA;AACV,QAAA,OAAO,IAAA;AACR,MAAA;AACD,IAAA,CAAA,CAAA,OAASA,KAAAA,EAAO;AACf8B,MAAAA,cAAAA,CAAI9B,MAAM,kCAAA,EAAoC;AAAEA,QAAAA;OAAM,CAAA;AACtD,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,MAAMqC,aAAavB,MAAAA,CAAOC,IAAAA,CAAKuB,UAAAA,EAAY,WAAA,EAAaC,QAAAA,EAAQ;AAChE,IAAA,MAAMR,OAAAA,GAAwBjD,IAAAA,CAAKmE,KAAAA,CAAMZ,UAAAA,CAAAA;AAEzC,IAAA,IAAIN,OAAAA,CAAQC,MAAM,CAAA,EAAG;AACpBF,MAAAA,cAAAA,CAAI9B,MAAM,2BAAA,EAA6B;AAAEkD,QAAAA,OAAAA,EAASnB,OAAAA,CAAQC;OAAE,CAAA;AAC5D,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,IAAID,OAAAA,CAAQvB,aAAaA,QAAAA,EAAU;AAClCsB,MAAAA,cAAAA,CAAI9B,MAAM,yBAAA,EAA2B;AACpCmD,QAAAA,aAAAA,EAAepB,OAAAA,CAAQvB,QAAAA;QACvB4C,gBAAAA,EAAkB5C;OACnB,CAAA;AACA,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,IAAIuB,OAAAA,CAAQV,gBAAgBA,WAAAA,EAAa;AACxCS,MAAAA,cAAAA,CAAI9B,MAAM,4BAAA,EAA8B;AACvCqD,QAAAA,gBAAAA,EAAkBtB,OAAAA,CAAQV,WAAAA;QAC1BiC,mBAAAA,EAAqBjC;OACtB,CAAA;AACA,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,IAAIa,IAAAA,CAAKC,GAAAA,EAAG,GAAKJ,OAAAA,CAAQK,SAAAA,EAAW;AACnCN,MAAAA,cAAAA,CAAIyB,KAAK,eAAA,CAAA;AACT,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,MAAM/B,WAAAA,GAAcvB,cAActB,KAAAA,CAAAA;AAClC,IAAA,IAAI,CAAC6C,WAAAA,IAAeA,WAAAA,KAAgBO,OAAAA,CAAQP,WAAAA,EAAa;AACxDM,MAAAA,cAAAA,CAAIyB,KAAK,4DAAA,CAAA;AACT,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,MAAM5B,WAAW,CAAA,UAAA,EAAaI,OAAAA,CAAQvB,QAAQ,CAAA,CAAA,EAAIuB,QAAQN,MAAM,CAAA,CAAA;AAChE,IAAA,MAAM+B,OAAAA,GAAU,MAAMlC,aAAAA,CAAcmC,GAAAA,CAAI9B,QAAAA,CAAAA;AAExC,IAAA,IAAI,CAAC6B,OAAAA,IAAW,OAAOA,OAAAA,KAAY,QAAA,EAAU;AAC5C1B,MAAAA,cAAAA,CAAIyB,KAAK,wDAAA,CAAA;AACT,MAAA,OAAO,IAAA;AACR,IAAA;AAEA,IAAA,MAAMnC,QAAAA,GAA+BtC,IAAAA,CAAKmE,KAAAA,CAAMO,OAAAA,CAAAA;AAChD,IAAA,OAAOpC,QAAAA;AACR,EAAA,CAAA,CAAA,OAASpB,KAAAA,EAAO;AACf8B,IAAAA,cAAAA,CAAI9B,MAAM,0BAAA,EAA4B;AAAEA,MAAAA;KAAM,CAAA;AAC9C,IAAA,OAAO,IAAA;AACR,EAAA;AACD;AApFsByC,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA2FtB,eAAsBiB,sBACrBC,KAAAA,EACAnD,QAAAA,EACAa,WAAAA,EACAC,aAAAA,EACAsC,WAAmB,GAAA,EAAI;AAEvB,EAAA,MAAMC,GAAAA,uBAAUC,GAAAA,EAAAA;AAEhB,EAAA,MAAMC,cAAAA,GAAiBJ,KAAAA,CAAMK,KAAAA,CAAM,CAAA,EAAGJ,QAAAA,CAAAA;AACtC,EAAA,IAAID,KAAAA,CAAM5D,SAAS6D,QAAAA,EAAU;AAC5B9B,IAAAA,cAAAA,CAAIyB,KAAK,CAAA,6BAAA,EAAgCI,KAAAA,CAAM5D,MAAM,CAAA,IAAA,EAAO6D,QAAAA,CAAAA,CAAU,CAAA;AACvE,EAAA;AAEA,EAAA,MAAMK,OAAAA,GAAU,GAAA;AAChB,EAAA,MAAMC,QAAAA,GAAWH,cAAAA,CAAeF,GAAAA,CAAI,OAAOnB,KAAAA,KAAAA;AAC1C,IAAA,IAAI;AACH,MAAA,MAAMC,KAAAA,GAAQD,KAAAA,CAAME,KAAAA,CAAM,GAAA,CAAA;AAC1B,MAAA,IAAID,KAAAA,CAAM5C,WAAW,CAAA,EAAG;AAExB,MAAA,MAAM,CAACuC,UAAAA,CAAAA,GAAcK,KAAAA;AACrB,MAAA,IAAI,CAACL,UAAAA,EAAY;AAEjB,MAAA,MAAMD,aAAavB,MAAAA,CAAOC,IAAAA,CAAKuB,UAAAA,EAAY,WAAA,EAAaC,QAAAA,EAAQ;AAChE,MAAA,MAAMR,OAAAA,GAAwBjD,IAAAA,CAAKmE,KAAAA,CAAMZ,UAAAA,CAAAA;AAEzC,MAAA,MAAMV,WAAW,CAAA,UAAA,EAAaI,OAAAA,CAAQvB,QAAQ,CAAA,CAAA,EAAIuB,QAAQN,MAAM,CAAA,CAAA;AAEhE,MAAA,MAAM0C,YAAAA,GAAe7C,aAAAA,CAAcmC,GAAAA,CAAI9B,QAAAA,CAAAA;AACvC,MAAA,MAAMyC,cAAAA,GAAiB,IAAIC,OAAAA,CAAc,CAACC,OAAAA,KACzCC,UAAAA,CAAW,MAAMD,OAAAA,CAAQ,IAAA,CAAA,EAAOL,OAAAA,CAAAA,CAAAA;AAGjC,MAAA,MAAMT,OAAAA,GAAU,MAAMa,OAAAA,CAAQG,IAAAA,CAAK;AAACL,QAAAA,YAAAA;AAAcC,QAAAA;AAAe,OAAA,CAAA;AAEjE,MAAA,IAAIZ,OAAAA,IAAW,OAAOA,OAAAA,KAAY,QAAA,EAAU;AAC3C,QAAA,MAAMpC,QAAAA,GAA+BtC,IAAAA,CAAKmE,KAAAA,CAAMO,OAAAA,CAAAA;AAChDK,QAAAA,GAAAA,CAAIjC,GAAAA,CAAIG,OAAAA,CAAQP,WAAAA,EAAaJ,QAAAA,CAAAA;AAE7B,QAAA,MAAMS,WAAW,CAAA,WAAA,EAAcE,OAAAA,CAAQvB,QAAQ,CAAA,CAAA,EAAIuB,QAAQP,WAAW,CAAA,CAAA;AACtE,QAAA,MAAMiD,QAAAA,GAAW,MAAMJ,OAAAA,CAAQG,IAAAA,CAAK;AACnClD,UAAAA,aAAAA,CAAcmC,IAAI5B,QAAAA,CAAAA;UAClB,IAAIwC,OAAAA,CAAc,CAACC,OAAAA,KAAYC,UAAAA,CAAW,MAAMD,OAAAA,CAAQ,IAAA,CAAA,EAAOL,OAAAA,CAAAA;AAC/D,SAAA,CAAA;AAED,QAAA,IAAIQ,QAAAA,IAAY,OAAOA,QAAAA,KAAa,QAAA,EAAU;AAC7C,UAAA,IAAI;AACH,YAAA,MAAM,EAAE9F,KAAAA,EAAK,GAAKG,IAAAA,CAAKmE,MAAMwB,QAAAA,CAAAA;AAC5BZ,YAAAA,GAAAA,CAAYa,UAAAA,GAAcb,GAAAA,CAAYa,UAAAA,oBAAc,IAAIZ,GAAAA,EAAAA;AACxDD,YAAAA,GAAAA,CAAYa,UAAAA,CAAW9C,GAAAA,CAAIjD,KAAAA,EAAOyC,QAAAA,CAAAA;AACpC,UAAA,CAAA,CAAA,OAASuD,CAAAA,EAAG;AAEZ,UAAA;AACD,QAAA;AACD,MAAA;AACD,IAAA,CAAA,CAAA,OAAS3E,KAAAA,EAAO;AAEhB,IAAA;EACD,CAAA,CAAA;AAEA,EAAA,MAAMqE,OAAAA,CAAQO,IAAIV,QAAAA,CAAAA;AAElB,EAAA,OAAOL,GAAAA;AACR;AA/DsBH,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;;;AC7Nf,IAAMmB,0BAAN,MAAMA;EAJb;;;AAKSC,EAAAA,QAAAA,uBAAehB,GAAAA,EAAAA;AACfiB,EAAAA,UAAAA,uBAAiBjB,GAAAA,EAAAA;AACjBkB,EAAAA,YAAAA,uBAAmBlB,GAAAA,EAAAA;AACnBmB,EAAAA,mBAAAA,uBAA0BnB,GAAAA,EAAAA;AAElC,EAAA,MAAML,IAAIyB,EAAAA,EAAgD;AACzD,IAAA,OAAO,IAAA,CAAKJ,QAAAA,CAASrB,GAAAA,CAAIyB,EAAAA,CAAAA,IAAO,IAAA;AACjC,EAAA;AAEA,EAAA,MAAMC,SAASC,GAAAA,EAAyD;AACvE,IAAA,MAAMtF,MAAAA,uBAAagE,GAAAA,EAAAA;AACnB,IAAA,KAAA,MAAWoB,MAAME,GAAAA,EAAK;AACrB,MAAA,MAAMC,IAAAA,GAAO,IAAA,CAAKP,QAAAA,CAASrB,GAAAA,CAAIyB,EAAAA,CAAAA;AAC/B,MAAA,IAAIG,IAAAA,EAAM;AACTvF,QAAAA,MAAAA,CAAO8B,GAAAA,CAAIsD,IAAIG,IAAAA,CAAAA;AAChB,MAAA;AACD,IAAA;AACA,IAAA,OAAOvF,MAAAA;AACR,EAAA;EAEA,MAAM8B,GAAAA,CAAIsD,EAAAA,EAAY9D,QAAAA,EAA8BC,WAAAA,EAAqC;AACxF,IAAA,IAAA,CAAKyD,QAAAA,CAASlD,GAAAA,CAAIsD,EAAAA,EAAI9D,QAAAA,CAAAA;AAEtB,IAAA,IAAIC,WAAAA,EAAa;AAChB,MAAA,IAAI+D,GAAAA,GAAM,IAAA,CAAKJ,YAAAA,CAAavB,GAAAA,CAAIpC,WAAAA,CAAAA;AAChC,MAAA,IAAI,CAAC+D,GAAAA,EAAK;AACTA,QAAAA,GAAAA,uBAAUE,GAAAA,EAAAA;AACV,QAAA,IAAA,CAAKN,YAAAA,CAAapD,GAAAA,CAAIP,WAAAA,EAAa+D,GAAAA,CAAAA;AACpC,MAAA;AACAA,MAAAA,GAAAA,CAAI9F,IAAI4F,EAAAA,CAAAA;AACT,IAAA;AACD,EAAA;AAEA,EAAA,MAAMK,aAAaC,GAAAA,EAAiD;AACnE,IAAA,OAAO,IAAA,CAAKT,UAAAA,CAAWtB,GAAAA,CAAI+B,GAAAA,CAAAA,IAAQ,IAAA;AACpC,EAAA;EAEA,MAAMC,YAAAA,CACLD,GAAAA,EACApE,QAAAA,EACAC,WAAAA,EACgB;AAChB,IAAA,IAAA,CAAK0D,UAAAA,CAAWnD,GAAAA,CAAI4D,GAAAA,EAAKpE,QAAAA,CAAAA;AAEzB,IAAA,IAAIC,WAAAA,EAAa;AAChB,MAAA,IAAI3B,IAAAA,GAAO,IAAA,CAAKuF,mBAAAA,CAAoBxB,GAAAA,CAAIpC,WAAAA,CAAAA;AACxC,MAAA,IAAI,CAAC3B,IAAAA,EAAM;AACVA,QAAAA,IAAAA,uBAAW4F,GAAAA,EAAAA;AACX,QAAA,IAAA,CAAKL,mBAAAA,CAAoBrD,GAAAA,CAAIP,WAAAA,EAAa3B,IAAAA,CAAAA;AAC3C,MAAA;AACAA,MAAAA,IAAAA,CAAKJ,IAAIkG,GAAAA,CAAAA;AACV,IAAA;AACD,EAAA;AAEA,EAAA,MAAME,iBAAiBrE,WAAAA,EAAoC;AAC1D,IAAA,MAAM+D,GAAAA,GAAM,IAAA,CAAKJ,YAAAA,CAAavB,GAAAA,CAAIpC,WAAAA,CAAAA;AAClC,IAAA,IAAI+D,GAAAA,EAAK;AACR,MAAA,KAAA,MAAWF,MAAME,GAAAA,EAAK;AACrB,QAAA,IAAA,CAAKN,QAAAA,CAASa,OAAOT,EAAAA,CAAAA;AACtB,MAAA;AACA,MAAA,IAAA,CAAKF,YAAAA,CAAaW,OAAOtE,WAAAA,CAAAA;AAC1B,IAAA;AAEA,IAAA,MAAMuE,QAAAA,GAAW,IAAA,CAAKX,mBAAAA,CAAoBxB,GAAAA,CAAIpC,WAAAA,CAAAA;AAC9C,IAAA,IAAIuE,QAAAA,EAAU;AACb,MAAA,KAAA,MAAWJ,OAAOI,QAAAA,EAAU;AAC3B,QAAA,IAAA,CAAKb,UAAAA,CAAWY,OAAOH,GAAAA,CAAAA;AACxB,MAAA;AACA,MAAA,IAAA,CAAKP,mBAAAA,CAAoBU,OAAOtE,WAAAA,CAAAA;AACjC,IAAA;AACD,EAAA;AAEA,EAAA,MAAMwE,aAAaxE,WAAAA,EAA+D;AACjF,IAAA,MAAMvB,MAAAA,uBAAagE,GAAAA,EAAAA;AACnB,IAAA,MAAMsB,GAAAA,GAAM,IAAA,CAAKJ,YAAAA,CAAavB,GAAAA,CAAIpC,WAAAA,CAAAA;AAClC,IAAA,IAAI+D,GAAAA,EAAK;AACR,MAAA,KAAA,MAAWF,MAAME,GAAAA,EAAK;AACrB,QAAA,MAAMC,IAAAA,GAAO,IAAA,CAAKP,QAAAA,CAASrB,GAAAA,CAAIyB,EAAAA,CAAAA;AAC/B,QAAA,IAAIG,IAAAA,EAAM;AACTvF,UAAAA,MAAAA,CAAO8B,GAAAA,CAAIsD,IAAIG,IAAAA,CAAAA;AAChB,QAAA;AACD,MAAA;AACD,IAAA;AACA,IAAA,OAAOvF,MAAAA;AACR,EAAA;AACD;;;AC1HA,IAAMgG,cAAAA,GAAiB,gBAAA;AACvB,IAAMC,iBAAAA,GAAoB,aAAA;AAC1B,IAAMC,eAAAA,uBAAsBC,OAAAA,EAAAA;AAE5B,IAAMC,kBAAAA,uBAAyBpC,GAAAA,EAAAA;AAE/B,IAAMqC,sBAAAA,uBAA6BrC,GAAAA,EAAAA;AAEnC,IAAIsC,kBAAAA,GAAoC,IAAA;AAExC,IAAMC,sBAAAA,uBAA6BvC,GAAAA,EAAAA;AAEnC,IAAMwC,0BAAAA,uBAAiCxC,GAAAA,EAAAA;AAEvC,IAAIyC,WAAAA,GAA+B,IAAI1B,uBAAAA,EAAAA;AAKhC,SAAS2B,yBAAyBC,KAAAA,EAAsB;AAC9DF,EAAAA,WAAAA,GAAcE,KAAAA;AACf;AAFgBD,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAQT,SAASE,oBAAAA,CAAqB/H,OAAgBgI,cAAAA,EAAkC;AACtF,EAAA,IAAI,OAAOhI,KAAAA,KAAU,QAAA,IAAY,OAAOA,UAAU,QAAA,EAAU;AAC3D,IAAA;AACD,EAAA;AAEA,EAAA,IAAIyH,kBAAAA,EAAoB;AACvB,IAAA,MAAMQ,OAAAA,GAAUN,0BAAAA,CAA2B7C,GAAAA,CAAI2C,kBAAAA,CAAAA;AAC/C,IAAA,IAAIQ,OAAAA,EAAS;AACZA,MAAAA,OAAAA,CAAQtH,IAAIX,KAAAA,CAAAA;AACb,IAAA;AACD,EAAA;AAEA,EAAA,MAAM6G,GAAAA,GAAM,CAAA,QAAA,EAAW3G,MAAAA,CAAOF,KAAAA,CAAAA,CAAAA,CAAAA;AAC9B0H,EAAAA,sBAAAA,CAAuBzE,GAAAA,CAAI4D,KAAKmB,cAAAA,CAAAA;AAEhCJ,EAAAA,WAAAA,CAAYd,YAAAA,CAAaD,KAAKmB,cAAAA,EAAgBP,kBAAAA,IAAsBxH,MAAAA,CAAAA,CAAWiI,KAAAA,CAAM,CAACC,GAAAA,KAAAA;AACrFhF,IAAAA,cAAAA,CAAIyB,KAAK,oDAAA,EAAsD;MAAEvD,KAAAA,EAAO8G;KAAI,CAAA;EAC7E,CAAA,CAAA;AACD;AAlBgBJ,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAuBT,SAASK,mBAAmBpI,KAAAA,EAAc;AAChD,EAAA,IAAI,OAAOA,KAAAA,KAAU,QAAA,IAAY,OAAOA,UAAU,QAAA,EAAU;AAC3D,IAAA,OAAO,KAAA;AACR,EAAA;AAEA,EAAA,IAAIyH,kBAAAA,EAAoB;AACvB,IAAA,MAAMQ,OAAAA,GAAUN,0BAAAA,CAA2B7C,GAAAA,CAAI2C,kBAAAA,CAAAA;AAC/C,IAAA,IAAIQ,OAAAA,IAAWA,OAAAA,CAAQvH,GAAAA,CAAIV,KAAAA,CAAAA,EAAQ;AAClC,MAAA,OAAO,IAAA;AACR,IAAA;AACD,EAAA;AAEA,EAAA,OAAO,KAAA;AACR;AAbgBoI,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAmBT,SAASC,yBAAyB3F,WAAAA,EAAmB;AAC3D+E,EAAAA,kBAAAA,GAAqB/E,WAAAA;AACrB,EAAA,IAAI,CAAC8E,sBAAAA,CAAuB9G,GAAAA,CAAIgC,WAAAA,CAAAA,EAAc;AAC7C8E,IAAAA,sBAAAA,CAAuBvE,GAAAA,CAAIP,WAAAA,kBAAa,IAAIiE,GAAAA,EAAAA,CAAAA;AAC7C,EAAA;AACA,EAAA,IAAI,CAACgB,0BAAAA,CAA2BjH,GAAAA,CAAIgC,WAAAA,CAAAA,EAAc;AACjDiF,IAAAA,0BAAAA,CAA2B1E,GAAAA,CAAIP,WAAAA,kBAAa,IAAIiE,GAAAA,EAAAA,CAAAA;AACjD,EAAA;AACD;AARgB0B,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAaT,SAASC,0BAAAA,GAAAA;AACfb,EAAAA,kBAAAA,GAAqB,IAAA;AACtB;AAFgBa,MAAAA,CAAAA,0BAAAA,EAAAA,4BAAAA,CAAAA;AAQhB,eAAsBC,kBAAkB9B,GAAAA,EAAa;AACpD,EAAA,MAAM+B,KAAAA,GAAQ,MAAMZ,WAAAA,CAAYpB,QAAAA,CAASC,GAAAA,CAAAA;AACzC,EAAA,KAAA,MAAW,CAACF,EAAAA,EAAI9D,QAAAA,CAAAA,IAAa+F,KAAAA,CAAMC,SAAO,EAAI;AAC7ClB,IAAAA,kBAAAA,CAAmBtE,GAAAA,CAAIsD,IAAI9D,QAAAA,CAAAA;AAC3B,IAAA,IAAIgF,kBAAAA,EAAoB;AACvB,MAAA,IAAIiB,OAAAA,GAAUlB,sBAAAA,CAAuB1C,GAAAA,CAAI2C,kBAAAA,CAAAA;AACzC,MAAA,IAAI,CAACiB,OAAAA,EAAS;AACbA,QAAAA,OAAAA,uBAAc/B,GAAAA,EAAAA;AACda,QAAAA,sBAAAA,CAAuBvE,GAAAA,CAAIwE,oBAAoBiB,OAAAA,CAAAA;AAChD,MAAA;AACAA,MAAAA,OAAAA,CAAQ/H,IAAI4F,EAAAA,CAAAA;AACb,IAAA;AACD,EAAA;AACD;AAbsBgC,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAmBtB,eAAsBI,2BAA2BjG,WAAAA,EAAmB;AACnE,EAAA,MAAM8F,KAAAA,GAAQ,MAAMZ,WAAAA,CAAYV,YAAAA,CAAaxE,WAAAA,CAAAA;AAC7C,EAAA,KAAA,MAAW,CAAC6D,EAAAA,EAAI9D,QAAAA,CAAAA,IAAa+F,KAAAA,CAAMC,SAAO,EAAI;AAC7ClB,IAAAA,kBAAAA,CAAmBtE,GAAAA,CAAIsD,IAAI9D,QAAAA,CAAAA;AAS3B,IAAA,IAAIgF,uBAAuB/E,WAAAA,EAAa;AACvC,MAAA,IAAIkG,YAAAA,GAAepB,sBAAAA,CAAuB1C,GAAAA,CAAIpC,WAAAA,CAAAA;AAC9C,MAAA,IAAI,CAACkG,YAAAA,EAAc;AAClBA,QAAAA,YAAAA,uBAAmBjC,GAAAA,EAAAA;AACnBa,QAAAA,sBAAAA,CAAuBvE,GAAAA,CAAIP,aAAakG,YAAAA,CAAAA;AACzC,MAAA;AACAA,MAAAA,YAAAA,CAAajI,IAAI4F,EAAAA,CAAAA;AAClB,IAAA;AACD,EAAA;AACD;AArBsBoC,MAAAA,CAAAA,0BAAAA,EAAAA,4BAAAA,CAAAA;AA0Bf,SAASE,0BAAAA,CACftC,EAAAA,EACA9D,QAAAA,EACAC,WAAAA,EAAoB;AAEpB,EAAA,IAAI6D,GAAGuC,UAAAA,CAAW,UAAA,KAAevC,EAAAA,CAAGwC,QAAAA,CAAS,GAAA,CAAA,EAAM;AAClDrB,IAAAA,sBAAAA,CAAuBzE,GAAAA,CAAIsD,IAAI9D,QAAAA,CAAAA;AAE/BmF,IAAAA,WAAAA,CAAYd,aAAaP,EAAAA,EAAI9D,QAAAA,EAAUC,WAAAA,CAAAA,CAAawF,KAAAA,CAAM,CAACC,GAAAA,KAAAA;AAC1DhF,MAAAA,cAAAA,CAAIyB,KAAK,8CAAA,EAAgD;QAAEvD,KAAAA,EAAO8G;OAAI,CAAA;IACvE,CAAA,CAAA;AAEA,IAAA,IAAI5B,EAAAA,CAAGuC,UAAAA,CAAW,UAAA,CAAA,EAAa;AAC9B,MAAA,MAAM9I,KAAAA,GAAQuG,EAAAA,CAAGlB,KAAAA,CAAM,UAAA,CAAWjE,MAAM,CAAA;AACxC,MAAA,IAAIsB,WAAAA,EAAa;AAChB,QAAA,IAAIuF,OAAAA,GAAUN,0BAAAA,CAA2B7C,GAAAA,CAAIpC,WAAAA,CAAAA;AAC7C,QAAA,IAAI,CAACuF,OAAAA,EAAS;AACbA,UAAAA,OAAAA,uBAActB,GAAAA,EAAAA;AACdgB,UAAAA,0BAAAA,CAA2B1E,GAAAA,CAAIP,aAAauF,OAAAA,CAAAA;AAC7C,QAAA;AACAA,QAAAA,OAAAA,CAAQtH,IAAIX,KAAAA,CAAAA;AACb,MAAA;AACD,IAAA;EACD,CAAA,MAAO;AACNuH,IAAAA,kBAAAA,CAAmBtE,GAAAA,CAAIsD,IAAI9D,QAAAA,CAAAA;AAC3BmF,IAAAA,WAAAA,CAAY3E,IAAIsD,EAAAA,EAAI9D,QAAAA,EAAUC,WAAAA,CAAAA,CAAawF,KAAAA,CAAM,CAACC,GAAAA,KAAAA;AACjDhF,MAAAA,cAAAA,CAAIyB,KAAK,oCAAA,EAAsC;QAAEvD,KAAAA,EAAO8G;OAAI,CAAA;IAC7D,CAAA,CAAA;AACD,EAAA;AAEA,EAAA,IAAIzF,WAAAA,EAAa;AAChB,IAAA,IAAI+D,GAAAA,GAAMe,sBAAAA,CAAuB1C,GAAAA,CAAIpC,WAAAA,CAAAA;AACrC,IAAA,IAAI,CAAC+D,GAAAA,EAAK;AACTA,MAAAA,GAAAA,uBAAUE,GAAAA,EAAAA;AACVa,MAAAA,sBAAAA,CAAuBvE,GAAAA,CAAIP,aAAa+D,GAAAA,CAAAA;AACzC,IAAA;AACAA,IAAAA,GAAAA,CAAI9F,IAAI4F,EAAAA,CAAAA;AACT,EAAA;AACD;AAtCgBsC,MAAAA,CAAAA,0BAAAA,EAAAA,4BAAAA,CAAAA;AA4CT,SAASG,8BAA8BtG,WAAAA,EAAmB;AAChE,EAAA,MAAM+D,GAAAA,GAAMe,sBAAAA,CAAuB1C,GAAAA,CAAIpC,WAAAA,CAAAA;AACvC,EAAA,IAAI+D,GAAAA,EAAK;AACR,IAAA,KAAA,MAAWF,MAAME,GAAAA,EAAK;AACrBc,MAAAA,kBAAAA,CAAmBP,OAAOT,EAAAA,CAAAA;AAC1B,MAAA,MAAM0C,eAAyB,EAAA;AAC/B,MAAA,KAAA,MAAWpC,GAAAA,IAAOa,sBAAAA,CAAuB3G,IAAAA,EAAI,EAAI;AAChD,QAAA,IAAI8F,GAAAA,CAAIiC,WAAW,CAAA,EAAGvC,EAAAA,GAAK,CAAA,IAAKM,GAAAA,CAAIiC,UAAAA,CAAW,UAAA,CAAA,EAAa;AAC3DG,UAAAA,YAAAA,CAAaC,KAAKrC,GAAAA,CAAAA;AACnB,QAAA;AACD,MAAA;AACA,MAAA,KAAA,MAAWA,OAAOoC,YAAAA,EAAc;AAC/BvB,QAAAA,sBAAAA,CAAuBV,OAAOH,GAAAA,CAAAA;AAC/B,MAAA;AACD,IAAA;AACAW,IAAAA,sBAAAA,CAAuBR,OAAOtE,WAAAA,CAAAA;AAC/B,EAAA;AAEAiF,EAAAA,0BAAAA,CAA2BX,OAAOtE,WAAAA,CAAAA;AAGlCkF,EAAAA,WAAAA,CAAYb,gBAAAA,CAAiBrE,WAAAA,CAAAA,CAAawF,KAAAA,CAAM,CAACC,GAAAA,KAAAA;AAChDhF,IAAAA,cAAAA,CAAIyB,KAAK,oCAAA,EAAsC;MAAEvD,KAAAA,EAAO8G;KAAI,CAAA;EAC7D,CAAA,CAAA;AACD;AAxBgBa,MAAAA,CAAAA,6BAAAA,EAAAA,+BAAAA,CAAAA;AA+BT,SAASG,0BAA0BnJ,KAAAA,EAAc;AACvD,EAAA,IAAI,OAAOA,KAAAA,KAAU,QAAA,IAAY,OAAOA,UAAU,QAAA,EAAU;AAC3D,IAAA,OAAO,IAAA;AACR,EAAA;AAEA,EAAA,MAAM8F,QAAAA,GAAW5F,OAAOF,KAAAA,CAAAA;AAExB,EAAA,IAAIoI,kBAAAA,CAAmBpI,KAAAA,CAAAA,EAAQ;AAC9B,IAAA,MAAMoJ,WAAAA,GAAa,WAAWtD,QAAAA,CAAAA,CAAAA;AAC9B,IAAA,MAAMrD,QAAAA,GAAWiF,sBAAAA,CAAuB5C,GAAAA,CAAIsE,WAAAA,CAAAA;AAC5C,IAAA,IAAI3G,QAAAA,EAAU;AACb,MAAA,OAAOA,QAAAA;AACR,IAAA;AACD,EAAA;AAEA,EAAA,MAAM2G,UAAAA,GAAa,WAAWtD,QAAAA,CAAAA,CAAAA;AAC9B,EAAA,MAAMuD,eAAAA,GAAkB3B,sBAAAA,CAAuB5C,GAAAA,CAAIsE,UAAAA,CAAAA;AACnD,EAAA,IAAIC,eAAAA,EAAiB;AACpB,IAAA,OAAOA,eAAAA;AACR,EAAA;AAEA,EAAA,KAAA,MAAW,CAACxC,GAAAA,EAAKpE,QAAAA,CAAAA,IAAaiF,sBAAAA,CAAuBe,SAAO,EAAI;AAC/D,IAAA,MAAMzE,KAAAA,GAAQ6C,GAAAA,CAAI5C,KAAAA,CAAM,GAAA,CAAA;AACxB,IAAA,IAAID,MAAM5C,MAAAA,IAAU,CAAA,IAAK,CAACyF,GAAAA,CAAIiC,UAAAA,CAAW,UAAA,CAAA,EAAa;AACrD,MAAA,MAAMQ,iBAAiBtF,KAAAA,CAAMqB,KAAAA,CAAM,CAAA,CAAA,CAAGkE,KAAK,GAAA,CAAA;AAC3C,MAAA,IAAID,mBAAmBxD,QAAAA,EAAU;AAChC,QAAA,OAAOrD,QAAAA;AACR,MAAA;AACD,IAAA;AACD,EAAA;AAEA,EAAA,MAAMd,MAAAA,GAASL,cAActB,KAAAA,CAAAA;AAC7B,EAAA,IAAI2B,MAAAA,EAAQ;AACX,IAAA,MAAM6H,cAAAA,GAAiBjC,kBAAAA,CAAmBzC,GAAAA,CAAInD,MAAAA,CAAAA;AAC9C,IAAA,IAAI6H,cAAAA,EAAgB;AACnB,MAAA,OAAOA,cAAAA;AACR,IAAA;AACD,EAAA;AAEA,EAAA,OAAO,IAAA;AACR;AAxCgBL,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AA6CT,SAASM,uBAAuB/G,WAAAA,EAAmB;AACzD,EAAA,MAAMgH,KAAAA,uBAAYvE,GAAAA,EAAAA;AAClB,EAAA,MAAMsB,GAAAA,GAAMe,sBAAAA,CAAuB1C,GAAAA,CAAIpC,WAAAA,CAAAA;AACvC,EAAA,IAAI+D,GAAAA,EAAK;AACR,IAAA,KAAA,MAAWF,MAAME,GAAAA,EAAK;AACrB,MAAA,MAAMhE,QAAAA,GAAW8E,kBAAAA,CAAmBzC,GAAAA,CAAIyB,EAAAA,CAAAA;AACxC,MAAA,IAAI9D,QAAAA,EAAU;AACbiH,QAAAA,KAAAA,CAAMzG,GAAAA,CAAIsD,IAAI9D,QAAAA,CAAAA;AACf,MAAA;AACD,IAAA;AACD,EAAA;AACA,EAAA,OAAOiH,KAAAA;AACR;AAZgBD,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAiBT,SAASE,0BAA0BjH,WAAAA,EAAmB;AAI5D,EAAA,MAAMkH,WAAAA,GAAcH,uBAAuB/G,WAAAA,CAAAA;AAC3C,EAAA,MAAMyD,QAAAA,GAAWvF,KAAAA,CAAMwB,IAAAA,CAAKwH,WAAAA,CAAYnB,SAAO,CAAA;AAE/C,EAAA,MAAMrC,aAAkD,EAAA;AACxD,EAAA,MAAMK,MAAMe,sBAAAA,CAAuB1C,GAAAA,CAAIpC,WAAAA,CAAAA,wBAAoBiE,GAAAA,EAAAA;AAE3D,EAAA,MAAMsB,OAAAA,GAAUN,0BAAAA,CAA2B7C,GAAAA,CAAIpC,WAAAA,CAAAA;AAC/C,EAAA,IAAIuF,OAAAA,EAAS;AACZ,IAAA,KAAA,MAAWjI,SAASiI,OAAAA,EAAS;AAC5B,MAAA,MAAMpB,GAAAA,GAAM,CAAA,QAAA,EAAW3G,MAAAA,CAAOF,KAAAA,CAAAA,CAAAA,CAAAA;AAC9B,MAAA,MAAM0G,IAAAA,GAAOgB,sBAAAA,CAAuB5C,GAAAA,CAAI+B,GAAAA,CAAAA;AACxC,MAAA,IAAIH,IAAAA,EAAM;AACTN,QAAAA,UAAAA,CAAW8C,IAAAA,CAAK;AAACrC,UAAAA,GAAAA;AAAKH,UAAAA;AAAK,SAAA,CAAA;AAC5B,MAAA;AACD,IAAA;AACD,EAAA;AAEA,EAAA,KAAA,MAAW,CAACG,GAAAA,EAAKH,IAAAA,CAAAA,IAASgB,sBAAAA,CAAuBe,SAAO,EAAI;AAC3D,IAAA,IAAI5B,GAAAA,CAAIiC,UAAAA,CAAW,UAAA,CAAA,EAAa;AAC/B,MAAA;AACD,IAAA;AACA,IAAA,MAAM,CAACe,KAAAA,CAAAA,GAAShD,GAAAA,CAAI5C,MAAM,GAAA,CAAA;AAC1B,IAAA,IAAI4F,KAAAA,IAASpD,GAAAA,CAAI/F,GAAAA,CAAImJ,KAAAA,CAAAA,EAAQ;AAC5BzD,MAAAA,UAAAA,CAAW8C,IAAAA,CAAK;AAACrC,QAAAA,GAAAA;AAAKH,QAAAA;AAAK,OAAA,CAAA;AAC5B,IAAA;AACD,EAAA;AAEA,EAAA,OAAO;AAAEP,IAAAA,QAAAA;AAAUC,IAAAA;AAAW,GAAA;AAC/B;AAhCgBuD,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AAqCT,SAASG,sBAAAA,CACfpH,aACAgH,KAAAA,EAAsC;AAEtCrB,EAAAA,wBAAAA,CAAyB3F,WAAAA,CAAAA;AACzB,EAAA,MAAM+D,GAAAA,GAAMe,sBAAAA,CAAuB1C,GAAAA,CAAIpC,WAAAA,CAAAA;AAEvC,EAAA,KAAA,MAAW,CAAC6D,EAAAA,EAAI9D,QAAAA,CAAAA,IAAaiH,KAAAA,EAAO;AACnCnC,IAAAA,kBAAAA,CAAmBtE,GAAAA,CAAIsD,IAAI9D,QAAAA,CAAAA;AAC3BgE,IAAAA,GAAAA,CAAI9F,IAAI4F,EAAAA,CAAAA;AACRqB,IAAAA,WAAAA,CAAY3E,IAAIsD,EAAAA,EAAI9D,QAAAA,EAAUC,WAAAA,CAAAA,CAAawF,KAAAA,CAAM,CAACC,GAAAA,KAAAA;AACjDhF,MAAAA,cAAAA,CAAI9B,MAAM,oCAAA,EAAsC;QAAEA,KAAAA,EAAO8G;OAAI,CAAA;IAC9D,CAAA,CAAA;AACD,EAAA;AACD;AAdgB2B,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAmBT,SAASC,yBAAAA,CACfrH,aACAsH,QAAAA,EAGC;AAED,EAAA,MAAMJ,WAAAA,GAAc,IAAIzE,GAAAA,CAAI6E,QAAAA,CAAS7D,QAAQ,CAAA;AAC7C2D,EAAAA,sBAAAA,CAAuBpH,aAAakH,WAAAA,CAAAA;AAEpC,EAAA,KAAA,MAAW,CAAC/C,GAAAA,EAAKH,IAAAA,CAAAA,IAASsD,SAAS5D,UAAAA,EAAY;AAC9CsB,IAAAA,sBAAAA,CAAuBzE,GAAAA,CAAI4D,KAAKH,IAAAA,CAAAA;AAChCkB,IAAAA,WAAAA,CAAYd,aAAaD,GAAAA,EAAKH,IAAAA,EAAMhE,WAAAA,CAAAA,CAAawF,KAAAA,CAAM,CAACC,GAAAA,KAAAA;AACvDhF,MAAAA,cAAAA,CAAI9B,MAAM,8CAAA,EAAgD;QAAEA,KAAAA,EAAO8G;OAAI,CAAA;IACxE,CAAA,CAAA;AAEA,IAAA,IAAItB,GAAAA,CAAIiC,UAAAA,CAAW,UAAA,CAAA,EAAa;AAC/B,MAAA,MAAM9I,KAAAA,GAAQ6G,GAAAA,CAAIxB,KAAAA,CAAM,UAAA,CAAWjE,MAAM,CAAA;AACzC,MAAA,IAAI6B,GAAAA,GAAM0E,0BAAAA,CAA2B7C,GAAAA,CAAIpC,WAAAA,CAAAA;AACzC,MAAA,IAAI,CAACO,GAAAA,EAAK;AACTA,QAAAA,GAAAA,uBAAU0D,GAAAA,EAAAA;AACVgB,QAAAA,0BAAAA,CAA2B1E,GAAAA,CAAIP,aAAaO,GAAAA,CAAAA;AAC7C,MAAA;AACAA,MAAAA,GAAAA,CAAItC,IAAIX,KAAAA,CAAAA;AACT,IAAA;AACD,EAAA;AACD;AA1BgB+J,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AAmCT,SAASE,qBAAAA,CACfjK,KAAAA,EACAkK,MAAAA,EACAC,OAAAA,GAA6B;EAAEC,IAAAA,EAAM;AAAS,CAAA,EAC9CC,YAAAA,GAAyB,EAAA,EAAE;AAE3B,EAAA,IAAIrK,KAAAA,KAAU,IAAA,IAAQA,KAAAA,KAAUC,MAAAA,EAAW;AAC1C,IAAA,OAAOD,KAAAA;AACR,EAAA;AAEA,EAAA,IAAI,OAAOA,KAAAA,KAAU,QAAA,IAAY,OAAOA,UAAU,UAAA,EAAY;AAC7D,IAAA,OAAOA,KAAAA;AACR,EAAA;AAEA,EAAA,MAAMuG,KAAKxD,aAAAA,EAAAA;AACX,EAAA,MAAMN,QAAAA,GAA+B;AACpC8D,IAAAA,EAAAA;AACA2D,IAAAA,MAAAA;AACAC,IAAAA,OAAAA;AACAE,IAAAA,YAAAA;AACAC,IAAAA,OAAAA,EAAS;AACV,GAAA;AAEA/C,EAAAA,kBAAAA,CAAmBtE,GAAAA,CAAIsD,IAAI9D,QAAAA,CAAAA;AAE3B,EAAA,IAAIgF,kBAAAA,EAAoB;AACvB,IAAA,MAAMhB,GAAAA,GAAMe,sBAAAA,CAAuB1C,GAAAA,CAAI2C,kBAAAA,CAAAA;AACvC,IAAA,IAAIhB,GAAAA,EAAK;AACRA,MAAAA,GAAAA,CAAI9F,IAAI4F,EAAAA,CAAAA;AACT,IAAA;AACD,EAAA;AAEAqB,EAAAA,WAAAA,CAAY3E,GAAAA,CAAIsD,IAAI9D,QAAAA,EAAUgF,kBAAAA,IAAsBxH,MAAAA,CAAAA,CAAWiI,KAAAA,CAAM,CAACC,GAAAA,KAAAA;AACrEhF,IAAAA,cAAAA,CAAIyB,KAAK,uCAAA,EAAyC;MAAEvD,KAAAA,EAAO8G;KAAI,CAAA;EAChE,CAAA,CAAA;AAEA,EAAA,IAAI;AACHnH,IAAAA,MAAAA,CAAOuJ,cAAAA,CAAevK,OAAOoH,iBAAAA,EAAmB;MAC/CpH,KAAAA,EAAOuG,EAAAA;MACPiE,QAAAA,EAAU,KAAA;MACVC,UAAAA,EAAY,IAAA;MACZC,YAAAA,EAAc,IAAA;;MAEdC,SAAAA,EAAW;KACZ,CAAA;AACD,EAAA,CAAA,CAAA,OAAS3E,CAAAA,EAAG;AACXqB,IAAAA,eAAAA,CAAgBpE,GAAAA,CAAIjD,OAAiByC,QAAAA,CAAAA;AACtC,EAAA;AAEA,EAAA,IAAI7B,KAAAA,CAAMC,OAAAA,CAAQb,KAAAA,CAAAA,EAAQ;AACzB,IAAA,KAAA,MAAW4K,QAAQ5K,KAAAA,EAAO;AACzB,MAAA,IAAI,OAAO4K,SAAS,QAAA,IAAYA,IAAAA,KAAS,QAAQ,CAACC,aAAAA,CAAcD,IAAAA,CAAAA,EAAO;AACtEX,QAAAA,qBAAAA,CAAsBW,IAAAA,EAAMV,QAAQC,OAAAA,EAAS;AAAC5D,UAAAA,EAAAA;AAAO8D,UAAAA,GAAAA;AAAa,SAAA,CAAA;AACnE,MAAA;AACD,IAAA;EACD,CAAA,MAAA,IAAW,OAAOrK,UAAU,QAAA,EAAU;AACrC,IAAA,KAAA,MAAW6G,OAAO7G,KAAAA,EAAkC;AACnD,MAAA,IAAIgB,MAAAA,CAAO8J,UAAUC,cAAAA,CAAeC,IAAAA,CAAKhL,OAAO6G,GAAAA,CAAAA,IAAQA,QAAQO,iBAAAA,EAAmB;AAClF,QAAA,MAAM6D,WAAAA,GAAejL,MAAkC6G,GAAAA,CAAAA;AACvD,QAAA,IACC,OAAOoE,gBAAgB,QAAA,IACvBA,WAAAA,KAAgB,QAChB,CAACJ,aAAAA,CAAcI,WAAAA,CAAAA,EACd;AACDhB,UAAAA,qBAAAA,CAAsBgB,WAAAA,EAAaf,QAAQC,OAAAA,EAAS;AAAC5D,YAAAA,EAAAA;AAAO8D,YAAAA,GAAAA;AAAa,WAAA,CAAA;AAC1E,QAAA,CAAA,MAAA,IAAW,OAAOY,WAAAA,KAAgB,QAAA,IAAY,OAAOA,gBAAgB,QAAA,EAAU;AAC9E,UAAA,MAAMC,YAAAA,GAAe,GAAG3E,EAAAA,CAAAA,CAAAA,EAAMM,GAAAA,CAAAA,CAAAA,EAAO3G,MAAAA,CAAO+K,WAAAA,CAAAA,CAAAA,CAAAA;AAC5CvD,UAAAA,sBAAAA,CAAuBzE,GAAAA,CAAIiI,cAAczI,QAAAA,CAAAA;AACzCmF,UAAAA,WAAAA,CACEd,YAAAA,CAAaoE,cAAczI,QAAAA,EAAUgF,kBAAAA,IAAsBxH,MAAAA,CAAAA,CAC3DiI,KAAAA,CAAM,CAACC,GAAAA,KAAAA;AACPhF,YAAAA,cAAAA,CAAI9B,MAAM,8CAAA,EAAgD;cAAEA,KAAAA,EAAO8G;aAAI,CAAA;UACxE,CAAA,CAAA;AACF,QAAA;AACD,MAAA;AACD,IAAA;AACD,EAAA;AAEA,EAAA,OAAOnI,KAAAA;AACR;AA/EgBiK,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AAqFT,SAASkB,cAAcnL,KAAAA,EAAc;AAC3C,EAAA,IAAIA,KAAAA,KAAU,IAAA,IAAQA,KAAAA,KAAUC,MAAAA,EAAW;AAC1C,IAAA,OAAO,IAAA;AACR,EAAA;AAEA,EAAA,IAAI,OAAOD,KAAAA,KAAU,QAAA,IAAY,OAAOA,UAAU,QAAA,EAAU;AAC3D,IAAA,MAAMoL,mBAAAA,GAAsBjC,0BAA0BnJ,KAAAA,CAAAA;AACtD,IAAA,IAAIoL,mBAAAA,EAAqB;AACxB,MAAA,OAAOA,mBAAAA;AACR,IAAA;AACD,EAAA;AAEA,EAAA,IAAI,OAAOpL,UAAU,QAAA,EAAU;AAC9B,IAAA,MAAMuG,EAAAA,GAAMvG,MAAcoH,iBAAAA,CAAAA;AAC1B,IAAA,IAAIb,EAAAA,IAAM,OAAOA,EAAAA,KAAO,QAAA,EAAU;AACjC,MAAA,MAAM9D,QAAAA,GAAW8E,kBAAAA,CAAmBzC,GAAAA,CAAIyB,EAAAA,CAAAA;AACxC,MAAA,IAAI9D,QAAAA,EAAU;AACb,QAAA,OAAOA,QAAAA;AACR,MAAA;AACD,IAAA;AAEA,IAAA,IAAI0E,kBAAmBnH,KAAAA,EAAe;AACrC,MAAA,OAAQA,MAAcmH,cAAAA,CAAAA;AACvB,IAAA;AAEA,IAAA,MAAMkE,MAAAA,GAAShE,eAAAA,CAAgBvC,GAAAA,CAAI9E,KAAAA,CAAAA;AACnC,IAAA,IAAIqL,MAAAA,EAAQ;AACX,MAAA,OAAOA,MAAAA;AACR,IAAA;AACD,EAAA;AAEA,EAAA,OAAO,IAAA;AACR;AAhCgBF,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAqCT,SAASN,cAAc7K,KAAAA,EAAc;AAC3C,EAAA,OAAOmL,aAAAA,CAAcnL,KAAAA,CAAAA,KAAW,IAAA;AACjC;AAFgB6K,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAOT,SAASS,gBAAAA,CAAiBtL,KAAAA,EAAgBuL,OAAAA,mBAAU,IAAI5E,KAAAA,EAAU;AACxE,EAAA,IAAI3G,UAAU,IAAA,IAAQA,KAAAA,KAAUC,MAAAA,IAAa,OAAOD,UAAU,QAAA,EAAU;AACvE,IAAA,OAAO,EAAA;AACR,EAAA;AAEA,EAAA,IAAIuL,OAAAA,CAAQ7K,GAAAA,CAAIV,KAAAA,CAAAA,EAAQ;AACvB,IAAA,OAAO,EAAA;AACR,EAAA;AACAuL,EAAAA,OAAAA,CAAQ5K,IAAIX,KAAAA,CAAAA;AAEZ,EAAA,MAAMwL,UAAgC,EAAA;AACtC,EAAA,MAAM/I,QAAAA,GAAW0I,cAAcnL,KAAAA,CAAAA;AAE/B,EAAA,IAAIyC,QAAAA,EAAU;AACb+I,IAAAA,OAAAA,CAAQtC,KAAKzG,QAAAA,CAAAA;AACd,EAAA;AAEA,EAAA,IAAI7B,KAAAA,CAAMC,OAAAA,CAAQb,KAAAA,CAAAA,EAAQ;AACzB,IAAA,KAAA,MAAW4K,QAAQ5K,KAAAA,EAAO;AACzBwL,MAAAA,OAAAA,CAAQtC,IAAAA,CAAI,GAAIoC,gBAAAA,CAAiBV,IAAAA,EAAMW,OAAAA,CAAAA,CAAAA;AACxC,IAAA;EACD,CAAA,MAAA,IAAW,OAAOvL,UAAU,QAAA,EAAU;AACrC,IAAA,KAAA,MAAW6G,OAAO7G,KAAAA,EAAO;AACxB,MAAA,IACC6G,GAAAA,KAAQM,cAAAA,IACRN,GAAAA,KAAQO,iBAAAA,IACRpG,MAAAA,CAAO8J,UAAUC,cAAAA,CAAeC,IAAAA,CAAKhL,KAAAA,EAAO6G,GAAAA,CAAAA,EAC3C;AACD2E,QAAAA,OAAAA,CAAQtC,KAAI,GAAIoC,gBAAAA,CAAkBtL,MAAc6G,GAAAA,CAAAA,EAAM0E,OAAAA,CAAAA,CAAAA;AACvD,MAAA;AACD,IAAA;AACD,EAAA;AAEA,EAAA,OAAOC,OAAAA;AACR;AAlCgBF,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAyDT,SAASG,OAAAA,CAAQC,QAAgBC,WAAAA,EAA8B;AACrE,EAAA,IAAIA,WAAAA,CAAYvB,SAAS,QAAA,EAAU;AAClC,IAAA,OAAO,IAAA;AACR,EAAA;AACA,EAAA,OAAOuB,WAAAA,CAAYxB,OAAAA,CAAQpB,QAAAA,CAAS2C,MAAAA,CAAAA;AACrC;AALgBD,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;;;AC5hBT,IAAMG,uBAAN,MAAMA;EApBb;;;AAqBSC,EAAAA,QAAAA;AACAC,EAAAA,MAAAA;AACAC,EAAAA,gBAAAA;AAIAC,EAAAA,mBAAAA;EAERxM,WAAAA,CACCqM,QAAAA,EACAC,QACAE,mBAAAA,EACC;AACD,IAAA,IAAA,CAAKH,QAAAA,GAAWA,QAAAA;AAChB,IAAA,IAAA,CAAKC,MAAAA,GAASA,MAAAA;AACd,IAAA,IAAA,CAAKE,mBAAAA,GAAsBA,mBAAAA;AAC5B,EAAA;;;;AAKAC,EAAAA,gBAAAA,CAAiBC,EAAAA,EAAmC;AACnD,IAAA,IAAA,CAAKF,mBAAAA,GAAsBE,EAAAA;AAC5B,EAAA;;;;AAKAC,EAAAA,mBAAAA,CACCC,QAAAA,EACO;AACP,IAAA,IAAA,CAAKL,gBAAAA,GAAmBK,QAAAA;AACzB,EAAA;EAEA,MAAMC,SAAAA,CACL1M,QAAAA,EACA2M,QAAAA,EACAC,IAAAA,EACgB;AAChB,IAAA,IAAA,CAAKT,MAAAA,CAAOU,MAAM,4BAAA,EAA8B;AAC/C7M,MAAAA,QAAAA;AACA2M,MAAAA,QAAAA;AACAG,MAAAA,WAAAA,EAAa,KAAKZ,QAAAA,CAASzK;KAC5B,CAAA;AAGA,IAAA,MAAMsL,eAAAA,GAAkB,KAAKV,mBAAAA,IAAuBb,aAAAA;AAEpD,IAAA,KAAA,MAAWzL,MAAAA,IAAU,KAAKmM,QAAAA,EAAU;AACnC,MAAA,MAAM1K,SAAS,MAAMzB,MAAAA,CAAOiN,KAAAA,CAAMhN,QAAAA,EAAU4M,MAAMG,eAAAA,CAAAA;AAElD,MAAA,MAAME,MAAAA,GAAS,IAAA,CAAKC,eAAAA,CAAgB1L,MAAAA,CAAAA;AAEpC,MAAA,IAAIyL,WAAW,OAAA,EAAS;AACvB,QAAA,IAAA,CAAKd,MAAAA,CAAOlH,KAAK,wCAAA,EAA0C;AAC1DjF,UAAAA,QAAAA;AACA2M,UAAAA,QAAAA;AACA5M,UAAAA,MAAAA,EAAQA,MAAAA,CAAOG,IAAAA;AACfiN,UAAAA,MAAAA,EAAQ3L,MAAAA,CAAO2L;SAChB,CAAA;AAEA,QAAA,MAAM,IAAIxN,uBAAAA,CACT6B,MAAAA,CAAO2L,MAAAA,IAAU,CAAA,OAAA,EAAUpN,OAAOG,IAAI,CAAA,iBAAA,CAAA,EACtCH,MAAAA,CAAOG,IAAAA,EACPF,QAAAA,EACA;AAAE2M,UAAAA,QAAAA;UAAUC,IAAAA,EAAM,IAAA,CAAKQ,aAAaR,IAAAA,CAAAA;AAAOjC,UAAAA,OAAAA,EAASnJ,MAAAA,CAAOmJ;SAAQ,CAAA;AAErE,MAAA;AAEA,MAAA,IAAIsC,WAAW,SAAA,EAAW;AACzB,QAAA,IAAA,CAAKd,MAAAA,CAAOkB,KAAK,mCAAA,EAAqC;AACrDrN,UAAAA,QAAAA;AACA2M,UAAAA,QAAAA;AACA5M,UAAAA,MAAAA,EAAQA,MAAAA,CAAOG,IAAAA;AACfiN,UAAAA,MAAAA,EAAQ3L,MAAAA,CAAO2L;SAChB,CAAA;AAEA,QAAA,MAAMG,QAAAA,GAAW,MAAM,IAAA,CAAKC,eAAAA,CAAgBvN,UAAU2M,QAAAA,EAAU5M,MAAAA,CAAOG,MAAMsB,MAAAA,CAAAA;AAE7E,QAAA,IAAI,CAAC8L,QAAAA,EAAU;AACd,UAAA,IAAA,CAAKnB,MAAAA,CAAOlH,KAAK,iCAAA,EAAmC;AACnDjF,YAAAA,QAAAA;AACA2M,YAAAA,QAAAA;AACA5M,YAAAA,MAAAA,EAAQA,MAAAA,CAAOG;WAChB,CAAA;AAEA,UAAA,MAAM,IAAIP,wBACT,CAAA,iBAAA,EAAoB6B,MAAAA,CAAO2L,UAAU,6BAAA,CAAA,CAAA,EACrCpN,MAAAA,CAAOG,IAAAA,EACPF,QAAAA,EACA;AAAE2M,YAAAA,QAAAA;YAAUC,IAAAA,EAAM,IAAA,CAAKQ,aAAaR,IAAAA,CAAAA;YAAOY,cAAAA,EAAgB;WAAK,CAAA;AAElE,QAAA;AAEA,QAAA,IAAA,CAAKrB,MAAAA,CAAOkB,KAAK,kCAAA,EAAoC;AACpDrN,UAAAA,QAAAA;AACA2M,UAAAA,QAAAA;AACA5M,UAAAA,MAAAA,EAAQA,MAAAA,CAAOG;SAChB,CAAA;AACD,MAAA;AAEA,MAAA,IAAI+M,WAAW,KAAA,EAAO;AACrB,QAAA,IAAA,CAAKd,MAAAA,CAAOlH,KAAK,6BAAA,EAA+B;AAC/CjF,UAAAA,QAAAA;AACA2M,UAAAA,QAAAA;AACA5M,UAAAA,MAAAA,EAAQA,MAAAA,CAAOG,IAAAA;AACfiN,UAAAA,MAAAA,EAAQ3L,MAAAA,CAAO2L,MAAAA;AACfxC,UAAAA,OAAAA,EAASnJ,MAAAA,CAAOmJ,OAAAA;UAChBiC,IAAAA,EAAM,IAAA,CAAKQ,aAAaR,IAAAA;SACzB,CAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,IAAA,CAAKT,MAAAA,CAAOU,MAAM,8BAAA,EAAgC;AAAE7M,MAAAA,QAAAA;AAAU2M,MAAAA;KAAS,CAAA;AACxE,EAAA;AAEQO,EAAAA,eAAAA,CAAgB1L,MAAAA,EAAoC;AAC3D,IAAA,IAAIA,OAAOyL,MAAAA,EAAQ;AAClB,MAAA,OAAOzL,MAAAA,CAAOyL,MAAAA;AACf,IAAA;AAEA,IAAA,IAAIzL,MAAAA,CAAOiM,YAAYnN,MAAAA,EAAW;AACjC,MAAA,OAAOkB,MAAAA,CAAOiM,UAAU,KAAA,GAAQ,OAAA;AACjC,IAAA;AAEA,IAAA,OAAO,KAAA;AACR,EAAA;AAEA,EAAA,MAAcF,eAAAA,CACbvN,QAAAA,EACA2M,QAAAA,EACAe,UAAAA,EACAlM,MAAAA,EACmB;AACnB,IAAA,IAAI,CAAC,KAAK4K,gBAAAA,EAAkB;AAC3B,MAAA,IAAA,CAAKD,MAAAA,CAAOzK,MAAM,8CAAA,EAAgD;AACjE1B,QAAAA,QAAAA;QACAD,MAAAA,EAAQ2N;OACT,CAAA;AACA,MAAA,MAAM,IAAI/N,uBAAAA,CACT,uDAAA,EACA+N,UAAAA,EACA1N,QAAAA,EACA;QAAE2N,gBAAAA,EAAkB;OAAK,CAAA;AAE3B,IAAA;AAEA,IAAA,MAAM7N,UAAU0B,MAAAA,CAAO2L,MAAAA,IAAU,CAAA,OAAA,EAAUO,UAAAA,0BAAoC1N,QAAAA,CAAAA,CAAAA;AAC/E,IAAA,MAAM2K,OAAAA,GAAU;AACf3K,MAAAA,QAAAA;AACA2M,MAAAA,QAAAA;MACA5M,MAAAA,EAAQ2N,UAAAA;MACR,GAAIlM,MAAAA,CAAOmJ,WAAW;AACvB,KAAA;AAEA,IAAA,IAAI;AACH,MAAA,OAAO,MAAM,IAAA,CAAKyB,gBAAAA,CAAiBtM,OAAAA,EAAS6K,OAAAA,CAAAA;AAC7C,IAAA,CAAA,CAAA,OAASjJ,KAAAA,EAAO;AACf,MAAA,IAAA,CAAKyK,MAAAA,CAAOzK,MAAM,yBAAA,EAA2B;AAAEA,QAAAA,KAAAA;AAAO1B,QAAAA,QAAAA;QAAUD,MAAAA,EAAQ2N;OAAW,CAAA;AACnF,MAAA,OAAO,KAAA;AACR,IAAA;AACD,EAAA;AAEQN,EAAAA,YAAAA,CAAaR,IAAAA,EAAwD;AAC5E,IAAA,MAAMgB,YAAqC,EAAC;AAC5C,IAAA,KAAA,MAAW,CAAC1G,GAAAA,EAAK7G,KAAAA,KAAUgB,MAAAA,CAAOyH,OAAAA,CAAQ8D,IAAAA,CAAAA,EAAO;AAChD,MAAA,IAAI,OAAOvM,KAAAA,KAAU,QAAA,IAAYA,KAAAA,CAAMoB,SAAS,GAAA,EAAK;AACpDmM,QAAAA,SAAAA,CAAU1G,GAAAA,CAAAA,GAAO7G,KAAAA,CAAMwN,SAAAA,CAAU,CAAA,EAAG,GAAA,CAAA,GAAO,KAAA;MAC5C,CAAA,MAAA,IAAW,OAAOxN,UAAU,QAAA,EAAU;AACrCuN,QAAAA,SAAAA,CAAU1G,GAAAA,CAAAA,GAAO,UAAA;MAClB,CAAA,MAAO;AACN0G,QAAAA,SAAAA,CAAU1G,GAAAA,CAAAA,GAAO7G,KAAAA;AAClB,MAAA;AACD,IAAA;AACA,IAAA,OAAOuN,SAAAA;AACR,EAAA;AACD;AAUA,SAASE,wBAAAA,CACRlB,MACApB,cAAAA,EAAsC;AAEtC,EAAA,MAAMuC,gBAAuB,EAAA;AAC7B,EAAA,MAAMnC,OAAAA,uBAAc5E,GAAAA,EAAAA;AAEpB,EAAA,SAASgH,KAAK3N,KAAAA,EAAc;AAC3B,IAAA,IAAIA,KAAAA,KAAU,IAAA,IAAQA,KAAAA,KAAUC,MAAAA,EAAW;AAE3C,IAAA,IAAI,OAAOD,KAAAA,KAAU,QAAA,IAAY,OAAOA,UAAU,QAAA,EAAU;AAC3D,MAAA,IAAI;AACH,QAAA,MAAM4N,aAAAA,GAAgBzC,eAAcnL,KAAAA,CAAAA;AACpC,QAAA,IAAI4N,aAAAA,EAAe;AAClBF,UAAAA,aAAAA,CAAcxE,KAAK0E,aAAAA,CAAAA;AACpB,QAAA;AACD,MAAA,CAAA,CAAA,OAASvM,KAAAA,EAAO;AAEhB,MAAA;AACA,MAAA;AACD,IAAA;AAEA,IAAA,IAAI,OAAOrB,UAAU,QAAA,EAAU;AAC/B,IAAA,IAAIuL,OAAAA,CAAQ7K,GAAAA,CAAIV,KAAAA,CAAAA,EAAQ;AACxBuL,IAAAA,OAAAA,CAAQ5K,IAAIX,KAAAA,CAAAA;AAEZ,IAAA,MAAM6N,UAAAA,GAAa1C,eAAcnL,KAAAA,CAAAA;AACjC,IAAA,IAAI6N,UAAAA,EAAY;AACfH,MAAAA,aAAAA,CAAcxE,KAAK2E,UAAAA,CAAAA;AACpB,IAAA;AAEA,IAAA,IAAIjN,KAAAA,CAAMC,OAAAA,CAAQb,KAAAA,CAAAA,EAAQ;AACzB,MAAA,KAAA,MAAW4K,QAAQ5K,KAAAA,EAAO;AACzB2N,QAAAA,IAAAA,CAAK/C,IAAAA,CAAAA;AACN,MAAA;IACD,CAAA,MAAO;AACN,MAAA,KAAA,MAAW/D,OAAO7G,KAAAA,EAAO;AACxB,QAAA,IAAIgB,OAAO8J,SAAAA,CAAUC,cAAAA,CAAeC,IAAAA,CAAKhL,KAAAA,EAAO6G,GAAAA,CAAAA,EAAM;AACrD8G,UAAAA,IAAAA,CAAM3N,KAAAA,CAAc6G,GAAAA,CAAI,CAAA;AACzB,QAAA;AACD,MAAA;AACD,IAAA;AACD,EAAA;AAnCS8G,EAAAA,MAAAA,CAAAA,IAAAA,EAAAA,MAAAA,CAAAA;AAqCT,EAAA,KAAA,MAAW9G,OAAO0F,IAAAA,EAAM;AACvB,IAAA,IAAIvL,OAAO8J,SAAAA,CAAUC,cAAAA,CAAeC,IAAAA,CAAKuB,IAAAA,EAAM1F,GAAAA,CAAAA,EAAM;AACpD8G,MAAAA,IAAAA,CAAKpB,IAAAA,CAAK1F,GAAAA,CAAI,CAAA;AACf,IAAA;AACD,EAAA;AAEA,EAAA,OAAO6G,aAAAA;AACR;AAnDSD,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAwDF,IAAMK,uBAAAA,GAA0C;EACtDjO,IAAAA,EAAM,2BAAA;EACNkO,WAAAA,EAAa,wDAAA;EACbpB,KAAAA,kBAAO,MAAA,CAAA,CAAChN,QAAAA,EAAU4M,IAAAA,EAAMpB,cAAAA,KAAAA;AACvB,IAAA,MAAM6C,aAAAA,GAAgB;AAAC,MAAA,IAAA;AAAM,MAAA,WAAA;AAAa,MAAA,YAAA;AAAc,MAAA,OAAA;AAAS,MAAA;;AAGjE,IAAA,IAAIC,SAAAA,GAA2B,IAAA;AAC/B,IAAA,KAAA,MAAWpH,OAAOmH,aAAAA,EAAe;AAChC,MAAA,IAAIzB,KAAK1F,GAAAA,CAAAA,IAAQ,OAAO0F,IAAAA,CAAK1F,GAAAA,MAAS,QAAA,EAAU;AAC/CoH,QAAAA,SAAAA,GAAY1B,KAAK1F,GAAAA,CAAAA;AACjB,QAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,IAAI,CAACoH,SAAAA,EAAW;AACf,MAAA,OAAO;QAAErB,MAAAA,EAAQ;AAAsB,OAAA;AACxC,IAAA;AAEA,IAAA,MAAMc,aAAAA,GAAgBD,wBAAAA,CAAyBlB,IAAAA,EAAMpB,cAAAA,CAAAA;AAErD,IAAA,KAAA,MAAW1I,YAAYiL,aAAAA,EAAe;AACrC,MAAA,IAAIjL,QAAAA,CAASyH,MAAAA,CAAOE,IAAAA,KAAS/K,wBAAAA,CAAiB6O,IAAAA,EAAM;AACnD,QAAA,IAAIzL,QAAAA,CAAS0H,OAAAA,CAAQC,IAAAA,KAAS,YAAA,EAAc;AAC3C,UAAA,IAAI,CAACqB,OAAAA,CAAQwC,SAAAA,EAAWxL,QAAAA,CAAS0H,OAAO,CAAA,EAAG;AAC1C,YAAA,OAAO;cACNyC,MAAAA,EAAQ,OAAA;AACRE,cAAAA,MAAAA,EAAQ,CAAA,WAAA,EAAcmB,SAAAA,CAAAA,wBAAAA,EAAoCxL,QAAAA,CAASyH,MAAAA,CAAOvK,QAAQ,CAAA,sBAAA,EAAyB8C,QAAAA,CAAS0H,OAAAA,CAAQA,OAAAA,CAAQZ,IAAAA,CAAK,IAAA,CAAA,CAAA,CAAA;cACzI7J,MAAAA,EAAQ,2BAAA;cACR4K,OAAAA,EAAS;AACR2D,gBAAAA,SAAAA;AACAE,gBAAAA,UAAAA,EAAY1L,SAASyH,MAAAA,CAAOvK,QAAAA;AAC5ByO,gBAAAA,iBAAAA,EAAmB3L,SAAS0H,OAAAA,CAAQA;AACrC;AACD,aAAA;AACD,UAAA;AACD,QAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,OAAO;MAAEyC,MAAAA,EAAQ;AAAsB,KAAA;EACxC,CAAA,EAtCO,OAAA;AAuCR;AAKO,IAAMyB,mCAAAA,GAAsD;EAClExO,IAAAA,EAAM,oCAAA;EACNkO,WAAAA,EAAa,qEAAA;EACbpB,KAAAA,kBAAO,MAAA,CAAA,CAAChN,QAAAA,EAAU4M,IAAAA,EAAMpB,cAAAA,KAAAA;AACvB,IAAA,MAAM6C,aAAAA,GAAgB;AAAC,MAAA,IAAA;AAAM,MAAA,WAAA;AAAa,MAAA,YAAA;AAAc,MAAA,OAAA;AAAS,MAAA;;AAEjE,IAAA,IAAIC,SAAAA,GAA2B,IAAA;AAC/B,IAAA,KAAA,MAAWpH,OAAOmH,aAAAA,EAAe;AAChC,MAAA,IAAIzB,KAAK1F,GAAAA,CAAAA,IAAQ,OAAO0F,IAAAA,CAAK1F,GAAAA,MAAS,QAAA,EAAU;AAC/CoH,QAAAA,SAAAA,GAAY1B,KAAK1F,GAAAA,CAAAA;AACjB,QAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,IAAI,CAACoH,SAAAA,EAAW;AACf,MAAA,OAAO;QAAErB,MAAAA,EAAQ;AAAsB,OAAA;AACxC,IAAA;AAEA,IAAA,MAAMc,aAAAA,GAAgBD,wBAAAA,CAAyBlB,IAAAA,EAAMpB,cAAAA,CAAAA;AAErD,IAAA,KAAA,MAAW1I,YAAYiL,aAAAA,EAAe;AACrC,MAAA,IAAIjL,QAAAA,CAASyH,MAAAA,CAAOE,IAAAA,KAAS/K,wBAAAA,CAAiB6O,IAAAA,EAAM;AACnD,QAAA,IAAIzL,QAAAA,CAAS0H,OAAAA,CAAQC,IAAAA,KAAS,YAAA,EAAc;AAC3C,UAAA,IAAI,CAACqB,OAAAA,CAAQwC,SAAAA,EAAWxL,QAAAA,CAAS0H,OAAO,CAAA,EAAG;AAC1C,YAAA,OAAO;cACNyC,MAAAA,EAAQ,SAAA;AACRE,cAAAA,MAAAA,EAAQ,CAAA,kBAAA,EAAqBrK,QAAAA,CAASyH,MAAAA,CAAOvK,QAAQ,QAAQsO,SAAAA,CAAAA,6BAAAA,CAAAA;cAC7DvO,MAAAA,EAAQ,oCAAA;cACR4K,OAAAA,EAAS;AACR2D,gBAAAA,SAAAA;AACAE,gBAAAA,UAAAA,EAAY1L,SAASyH,MAAAA,CAAOvK,QAAAA;AAC5ByO,gBAAAA,iBAAAA,EAAmB3L,SAAS0H,OAAAA,CAAQA,OAAAA;gBACpCmE,eAAAA,EAAiBtN,MAAAA,CAAOD,IAAAA,CAAKwL,IAAAA,CAAAA,CAAMgC,MAAAA,CAAO,CAACrN,CAAAA,KAAMqL,IAAAA,CAAKrL,CAAAA,CAAAA,KAAO,IAAA;AAC9D;AACD,aAAA;AACD,UAAA;AACD,QAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,OAAO;MAAE0L,MAAAA,EAAQ;AAAsB,KAAA;EACxC,CAAA,EAtCO,OAAA;AAuCR;AAKO,IAAM4B,iBAAAA,GAAoC;EAChD3O,IAAAA,EAAM,qBAAA;EACNkO,WAAAA,EAAa,+DAAA;EACbpB,KAAAA,kBAAO,MAAA,CAAA,CAAChN,QAAAA,EAAU4M,IAAAA,EAAMpB,cAAAA,KAAAA;AACvB,IAAA,MAAMsD,aAAAA,GAAgB;AAAC,MAAA,gBAAA;AAAkB,MAAA,WAAA;AAAa,MAAA,YAAA;AAAc,MAAA,WAAA;AAAa,MAAA;;AAEjF,IAAA,IAAI,CAACA,aAAAA,CAAcC,IAAAA,CAAK,CAACC,CAAAA,KAAMhP,QAAAA,CAASiP,WAAAA,EAAW,CAAG7F,QAAAA,CAAS4F,CAAAA,CAAEC,WAAAA,EAAW,CAAA,CAAA,EAAM;AACjF,MAAA,OAAO;QAAEhC,MAAAA,EAAQ;AAAsB,OAAA;AACxC,IAAA;AAEA,IAAA,KAAA,MAAW,CAAC/F,GAAAA,EAAK7G,KAAAA,KAAUgB,MAAAA,CAAOyH,OAAAA,CAAQ8D,IAAAA,CAAAA,EAAO;AAChD,MAAA,MAAMmB,aAAAA,GAAgBpC,iBAAiBtL,KAAAA,CAAAA;AAEvC,MAAA,KAAA,MAAWyC,YAAYiL,aAAAA,EAAe;AACrC,QAAA,IACCjL,QAAAA,CAASyH,OAAOE,IAAAA,KAAS/K,wBAAAA,CAAiBwP,QAC1CpM,QAAAA,CAASyH,MAAAA,CAAOE,IAAAA,KAAS/K,wBAAAA,CAAiByP,MAAAA,EACzC;AACD,UAAA,OAAO;YACNlC,MAAAA,EAAQ,OAAA;AACRE,YAAAA,MAAAA,EAAQ,kBAAkBnN,QAAAA,CAAAA,aAAAA,EAAwBkH,GAAAA,CAAAA,2CAAAA,EAAiDpE,QAAAA,CAASyH,OAAOE,IAAI,CAAA,CAAA;YACvH1K,MAAAA,EAAQ,qBAAA;YACR4K,OAAAA,EAAS;AACR3K,cAAAA,QAAAA;cACAoP,YAAAA,EAAclI,GAAAA;AACdmI,cAAAA,YAAAA,EAAcvM,SAASyH,MAAAA,CAAOE;AAC/B;AACD,WAAA;AACD,QAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,OAAO;MAAEwC,MAAAA,EAAQ;AAAsB,KAAA;EACxC,CAAA,EA9BO,OAAA;AA+BR;AAKO,IAAMqC,6BAAAA,GAAgD;EAC5DpP,IAAAA,EAAM,8BAAA;EACNkO,WAAAA,EAAa,8DAAA;EACbpB,KAAAA,kBAAO,MAAA,CAAA,CAAChN,QAAAA,EAAU4M,IAAAA,EAAMpB,cAAAA,KAAAA;AACvB,IAAA,MAAMsD,aAAAA,GAAgB;AAAC,MAAA,gBAAA;AAAkB,MAAA,WAAA;AAAa,MAAA,YAAA;AAAc,MAAA,WAAA;AAAa,MAAA;;AAEjF,IAAA,IAAI,CAACA,aAAAA,CAAcC,IAAAA,CAAK,CAACC,CAAAA,KAAMhP,QAAAA,CAASiP,WAAAA,EAAW,CAAG7F,QAAAA,CAAS4F,CAAAA,CAAEC,WAAAA,EAAW,CAAA,CAAA,EAAM;AACjF,MAAA,OAAO;QAAEhC,MAAAA,EAAQ;AAAsB,OAAA;AACxC,IAAA;AAEA,IAAA,KAAA,MAAW,CAAC/F,GAAAA,EAAK7G,KAAAA,KAAUgB,MAAAA,CAAOyH,OAAAA,CAAQ8D,IAAAA,CAAAA,EAAO;AAChD,MAAA,MAAMmB,aAAAA,GAAgBpC,iBAAiBtL,KAAAA,CAAAA;AAEvC,MAAA,KAAA,MAAWyC,YAAYiL,aAAAA,EAAe;AACrC,QAAA,IACCjL,QAAAA,CAASyH,OAAOE,IAAAA,KAAS/K,wBAAAA,CAAiBwP,QAC1CpM,QAAAA,CAASyH,MAAAA,CAAOE,IAAAA,KAAS/K,wBAAAA,CAAiByP,MAAAA,EACzC;AACD,UAAA,OAAO;YACNlC,MAAAA,EAAQ,SAAA;AACRE,YAAAA,MAAAA,EAAQ,uBAAuBnN,QAAAA,CAAAA,kBAAAA,EAA6BkH,GAAAA,CAAAA,OAAAA,EAAapE,QAAAA,CAASyH,OAAOE,IAAI,CAAA,OAAA,CAAA;YAC7F1K,MAAAA,EAAQ,8BAAA;YACR4K,OAAAA,EAAS;AACR3K,cAAAA,QAAAA;cACAoP,YAAAA,EAAclI,GAAAA;AACdmI,cAAAA,YAAAA,EAAcvM,SAASyH,MAAAA,CAAOE,IAAAA;AAC9BpK,cAAAA,KAAAA,EAAOE,MAAAA,CAAOF,KAAAA,CAAAA,CAAOwN,SAAAA,CAAU,GAAG,GAAA;AACnC;AACD,WAAA;AACD,QAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,OAAO;MAAEZ,MAAAA,EAAQ;AAAsB,KAAA;EACxC,CAAA,EA/BO,OAAA;AAgCR;AAKO,IAAMsC,kBAAAA,GAAqC;EACjDrP,IAAAA,EAAM,sBAAA;EACNkO,WAAAA,EAAa,sDAAA;EACbpB,KAAAA,kBAAO,MAAA,CAAA,CAAChN,QAAAA,EAAU4M,IAAAA,EAAMpB,cAAAA,KAAAA;AACvB,IAAA,MAAM6C,aAAAA,GAAgB;AAAC,MAAA,IAAA;AAAM,MAAA,WAAA;AAAa,MAAA,YAAA;AAAc,MAAA;;AAExD,IAAA,KAAA,MAAWnH,OAAOmH,aAAAA,EAAe;AAChC,MAAA,IAAI,CAACzB,IAAAA,CAAK1F,GAAAA,CAAAA,EAAM;AAEhB,MAAA,MAAMpE,QAAAA,GAAW0I,cAAAA,CAAcoB,IAAAA,CAAK1F,GAAAA,CAAI,CAAA;AACxC,MAAA,IAAIpE,QAAAA,IAAYA,QAAAA,CAASyH,MAAAA,CAAOE,IAAAA,KAAS/K,yBAAiB8P,GAAAA,EAAK;AAC9D,QAAA,OAAO;UACNvC,MAAAA,EAAQ,OAAA;AACRE,UAAAA,MAAAA,EAAQ,wDAAwDjG,GAAAA,CAAAA,2DAAAA,CAAAA;UAChEnH,MAAAA,EAAQ,sBAAA;UACR4K,OAAAA,EAAS;YACRyE,YAAAA,EAAclI,GAAAA;AACduI,YAAAA,cAAAA,EAAgBlP,OAAOqM,IAAAA,CAAK1F,GAAAA,CAAI,CAAA,CAAE2G,SAAAA,CAAU,GAAG,EAAA;AAChD;AACD,SAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,OAAO;MAAEZ,MAAAA,EAAQ;AAAsB,KAAA;EACxC,CAAA,EArBO,OAAA;AAsBR;AAKO,IAAMyC,8BAAAA,GAAiD;EAC7DxP,IAAAA,EAAM,+BAAA;EACNkO,WAAAA,EAAa,gEAAA;EACbpB,KAAAA,kBAAO,MAAA,CAAA,CAAChN,QAAAA,EAAU4M,IAAAA,EAAMpB,cAAAA,KAAAA;AACvB,IAAA,MAAM6C,aAAAA,GAAgB;AAAC,MAAA,IAAA;AAAM,MAAA,WAAA;AAAa,MAAA,YAAA;AAAc,MAAA;;AAExD,IAAA,KAAA,MAAWnH,OAAOmH,aAAAA,EAAe;AAChC,MAAA,IAAI,CAACzB,IAAAA,CAAK1F,GAAAA,CAAAA,EAAM;AAEhB,MAAA,MAAMpE,QAAAA,GAAW0I,cAAAA,CAAcoB,IAAAA,CAAK1F,GAAAA,CAAI,CAAA;AACxC,MAAA,IAAIpE,QAAAA,IAAYA,QAAAA,CAASyH,MAAAA,CAAOE,IAAAA,KAAS/K,yBAAiB8P,GAAAA,EAAK;AAC9D,QAAA,OAAO;UACNvC,MAAAA,EAAQ,SAAA;AACRE,UAAAA,MAAAA,EAAQ,CAAA,oCAAA,EAAuCP,IAAAA,CAAK1F,GAAAA,CAAI,mBAAmBA,GAAAA,CAAAA,CAAAA,CAAAA;UAC3EnH,MAAAA,EAAQ,+BAAA;UACR4K,OAAAA,EAAS;YACRyE,YAAAA,EAAclI,GAAAA;YACduI,cAAAA,EAAgBlP,MAAAA,CAAOqM,IAAAA,CAAK1F,GAAAA,CAAI,CAAA;AAChCyI,YAAAA,YAAAA,EAAe7M,SAASyH,MAAAA,CAAeqF;AACxC;AACD,SAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,OAAO;MAAE3C,MAAAA,EAAQ;AAAsB,KAAA;EACxC,CAAA,EAtBO,OAAA;AAuBR;AAKO,IAAM4C,oBAAAA,GAAuC;EACnD3P,IAAAA,EAAM,wBAAA;EACNkO,WAAAA,EAAa,gDAAA;EACbpB,KAAAA,kBAAO,MAAA,CAAA,CAAChN,QAAAA,EAAU4M,IAAAA,EAAMpB,cAAAA,KAAAA;AACvB,IAAA,MAAMsE,cAAAA,GAAiB;AAAC,MAAA,aAAA;AAAe,MAAA,eAAA;AAAiB,MAAA,QAAA;AAAU,MAAA;;AAElE,IAAA,IAAIA,cAAAA,CAAef,IAAAA,CAAK,CAACC,CAAAA,KAAMhP,QAAAA,CAASiP,WAAAA,EAAW,CAAG7F,QAAAA,CAAS4F,CAAAA,CAAEC,WAAAA,EAAW,CAAA,CAAA,EAAM;AACjF,MAAA,MAAMlB,aAAAA,GAAgBpC,iBAAiBiB,IAAAA,CAAAA;AAEvC,MAAA,OAAO;QACNK,MAAAA,EAAQ,KAAA;AACRE,QAAAA,MAAAA,EAAQ,+BAA+BnN,QAAAA,CAAAA,CAAAA;QACvCD,MAAAA,EAAQ,wBAAA;QACR4K,OAAAA,EAAS;AACR3K,UAAAA,QAAAA;UACA+P,eAAAA,EAAiBhC,aAAAA,CAAcxI,GAAAA,CAAI,CAACyK,CAAAA,MAAO;AAC1CzF,YAAAA,MAAAA,EAAQyF,CAAAA,CAAEzF,MAAAA;AACV3D,YAAAA,EAAAA,EAAIoJ,CAAAA,CAAEpJ;WACP,CAAA;AACD;AACD,OAAA;AACD,IAAA;AAEA,IAAA,OAAO;MAAEqG,MAAAA,EAAQ;AAAsB,KAAA;EACxC,CAAA,EArBO,OAAA;AAsBR;AAKO,SAASgD,kBAAAA,CACf/P,IAAAA,EACAkO,WAAAA,EACA8B,OAAAA,EAAgC;AAEhC,EAAA,OAAO;AAAEhQ,IAAAA,IAAAA;AAAMkO,IAAAA,WAAAA;IAAapB,KAAAA,EAAOkD;AAAQ,GAAA;AAC5C;AANgBD,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAWT,SAASE,kBAAAA,GAAAA;AACf,EAAA,OAAO;AAAChC,IAAAA,uBAAAA;AAAyBU,IAAAA,iBAAAA;AAAmBU,IAAAA,kBAAAA;AAAoBM,IAAAA;;AACzE;AAFgBM,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAOT,SAASC,8BAAAA,GAAAA;AACf,EAAA,OAAO;AACN1B,IAAAA,mCAAAA;AACAY,IAAAA,6BAAAA;AACAI,IAAAA,8BAAAA;AACAG,IAAAA;;AAEF;AAPgBO,MAAAA,CAAAA,8BAAAA,EAAAA,gCAAAA,CAAAA;;;ACvehB,SAASC,YAAAA,CACRC,IAAAA,EACA1D,IAAAA,EACApB,cAAAA,EAA4D;AAE5D,EAAA,MAAMnH,KAAAA,GAAQiM,IAAAA,CAAKhM,KAAAA,CAAM,GAAA,CAAA;AACzB,EAAA,MAAMiM,IAAAA,GAAOlM,MAAMmM,KAAAA,EAAK;AAExB,EAAA,IAAID,SAAS,MAAA,EAAQ;AACpB,IAAA,IAAIE,OAAAA,GAAe7D,IAAAA;AACnB,IAAA,KAAA,MAAW8D,QAAQrM,KAAAA,EAAO;AACzB,MAAA,IAAIoM,OAAAA,KAAY,IAAA,IAAQA,OAAAA,KAAYnQ,MAAAA,EAAW;AAC9C,QAAA,OAAOA,MAAAA;AACR,MAAA;AACAmQ,MAAAA,OAAAA,GAAUA,QAAQC,IAAAA,CAAAA;AACnB,IAAA;AACA,IAAA,OAAOD,OAAAA;AACR,EAAA;AAEA,EAAA,IAAIF,IAAAA,KAAS,YAAA,IAAgBlM,KAAAA,CAAM,CAAA,MAAO,MAAA,EAAQ;AACjDA,IAAAA,KAAAA,CAAMmM,KAAAA,EAAK;AACX,IAAA,MAAMG,OAAAA,GAAUtM,MAAMmM,KAAAA,EAAK;AAC3B,IAAA,IAAI,CAACG,SAAS,OAAOrQ,MAAAA;AAErB,IAAA,MAAMsQ,QAAAA,GAAWhE,KAAK+D,OAAAA,CAAAA;AAOtB,IAAA,IAAIE,cAAAA,GAAiB;AAAIxM,MAAAA,GAAAA;;AAIzB,IAAA,MAAMyM,YAAAA,GAAe;AAAC,MAAA,QAAA;AAAU,MAAA,SAAA;AAAW,MAAA,cAAA;AAAgB,MAAA,IAAA;AAAM,MAAA;;AACjE,IAAA,IAAIC,UAAAA,GAAa,EAAA;AACjB,IAAA,KAAA,IAASC,CAAAA,GAAI,CAAA,EAAGA,CAAAA,GAAIH,cAAAA,CAAepP,QAAQuP,CAAAA,EAAAA,EAAK;AAC/C,MAAA,IAAIF,YAAAA,CAAa1H,QAAAA,CAASyH,cAAAA,CAAeG,CAAAA,CAAE,CAAA,EAAI;AAC9CD,QAAAA,UAAAA,GAAaC,CAAAA;AACb,QAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,IAAID,eAAe,EAAA,EAAI;AACtB,MAAA,OAAOzQ,MAAAA;AACR,IAAA;AAGA,IAAA,IAAI2Q,SAAAA,GAAYJ,cAAAA,CAAenL,KAAAA,CAAM,CAAA,EAAGqL,UAAAA,CAAAA;AACxC,IAAA,IAAIG,QAAAA,GAAWL,cAAAA,CAAenL,KAAAA,CAAMqL,UAAAA,CAAAA;AAEpC,IAAA,IAAII,UAAAA,GAAaP,QAAAA;AACjB,IAAA,KAAA,MAAWF,QAAQO,SAAAA,EAAW;AAC7B,MAAA,IAAIE,UAAAA,KAAe,IAAA,IAAQA,UAAAA,KAAe7Q,MAAAA,EAAW,OAAOA,MAAAA;AAC5D6Q,MAAAA,UAAAA,GAAcA,WAAmBT,IAAAA,CAAAA;AAClC,IAAA;AAEA,IAAA,MAAM5N,QAAAA,GAAW0I,eAAc2F,UAAAA,CAAAA;AAC/B,IAAA,IAAI,CAACrO,UAAU,OAAOxC,MAAAA;AAGtB,IAAA,IAAI8Q,WAAAA,GAAmBtO,QAAAA;AACvB,IAAA,KAAA,MAAW4N,QAAQQ,QAAAA,EAAU;AAC5B,MAAA,IAAIE,WAAAA,KAAgB,IAAA,IAAQA,WAAAA,KAAgB9Q,MAAAA,EAAW,OAAOA,MAAAA;AAC9D8Q,MAAAA,WAAAA,GAAcA,YAAYV,IAAAA,CAAAA;AAC3B,IAAA;AACA,IAAA,OAAOU,WAAAA;AACR,EAAA;AAEA,EAAA,OAAO9Q,MAAAA;AACR;AAvES+P,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAyET,SAASgB,iBAAAA,CAAkBC,MAAAA,EAAaC,QAAAA,EAAoBC,QAAAA,EAAa;AACxE,EAAA,QAAQD,QAAAA;IACP,KAAK,QAAA;AACJ,MAAA,OAAOD,MAAAA,KAAWE,QAAAA;IACnB,KAAK,WAAA;AACJ,MAAA,OAAOF,MAAAA,KAAWE,QAAAA;IACnB,KAAK,UAAA;AACJ,MAAA,OAAOvQ,KAAAA,CAAMC,OAAAA,CAAQoQ,MAAAA,CAAAA,IAAW,OAAOA,WAAW,QAAA,GAC/CA,MAAAA,CAAOlI,QAAAA,CAASoI,QAAAA,CAAAA,GAChB,KAAA;IACJ,KAAK,aAAA;AACJ,MAAA,OAAOvQ,KAAAA,CAAMC,OAAAA,CAAQoQ,MAAAA,CAAAA,IAAW,OAAOA,MAAAA,KAAW,QAAA,GAC/C,CAACA,MAAAA,CAAOlI,QAAAA,CAASoI,QAAAA,CAAAA,GACjB,IAAA;IACJ,KAAK,YAAA;AACJ,MAAA,OAAO,OAAOF,MAAAA,KAAW,QAAA,GAAWA,MAAAA,CAAOnI,UAAAA,CAAWqI,QAAAA,CAAAA,GAAY,KAAA;IACnE,KAAK,eAAA;AACJ,MAAA,OAAO,OAAOF,MAAAA,KAAW,QAAA,GAAW,CAACA,MAAAA,CAAOnI,UAAAA,CAAWqI,QAAAA,CAAAA,GAAY,IAAA;IACpE,KAAK,UAAA;AACJ,MAAA,OAAO,OAAOF,MAAAA,KAAW,QAAA,GAAWA,MAAAA,CAAOG,QAAAA,CAASD,QAAAA,CAAAA,GAAY,KAAA;IACjE,KAAK,aAAA;AACJ,MAAA,OAAO,OAAOF,MAAAA,KAAW,QAAA,GAAW,CAACA,MAAAA,CAAOG,QAAAA,CAASD,QAAAA,CAAAA,GAAY,IAAA;IAClE,KAAK,SAAA;AACJ,MAAA,IAAI,OAAOF,WAAW,QAAA,EAAU;AAC/B,QAAA,OAAO,IAAII,MAAAA,CAAOF,QAAAA,CAAAA,CAAUG,KAAKL,MAAAA,CAAAA;AAClC,MAAA;AACA,MAAA,IAAI,OAAOA,MAAAA,KAAW,QAAA,IAAY,OAAOE,aAAa,QAAA,EAAU;AAC/D,QAAA,MAAMI,KAAAA,GAAQJ,QAAAA,CAASI,KAAAA,CAAM,iCAAA,CAAA;AAC7B,QAAA,IAAIA,KAAAA,EAAO;AACV,UAAA,MAAM,GAAGC,EAAAA,EAAIxR,KAAAA,CAAAA,GAASuR,KAAAA;AACtB,UAAA,MAAME,QAAAA,GAAWC,WAAW1R,KAAAA,CAAAA;AAC5B,UAAA,QAAQwR,EAAAA;YACP,KAAK,GAAA;AACJ,cAAA,OAAOP,MAAAA,GAASQ,QAAAA;YACjB,KAAK,IAAA;AACJ,cAAA,OAAOR,MAAAA,IAAUQ,QAAAA;YAClB,KAAK,GAAA;AACJ,cAAA,OAAOR,MAAAA,GAASQ,QAAAA;YACjB,KAAK,IAAA;AACJ,cAAA,OAAOR,MAAAA,IAAUQ,QAAAA;YAClB,KAAK,IAAA;AACJ,cAAA,OAAOR,MAAAA,KAAWQ,QAAAA;YACnB,KAAK,IAAA;AACJ,cAAA,OAAOR,MAAAA,KAAWQ,QAAAA;AACpB;AACD,QAAA;AACD,MAAA;AACA,MAAA,OAAO,KAAA;IACR,KAAK,IAAA;AACJ,MAAA,OAAO7Q,MAAMC,OAAAA,CAAQsQ,QAAAA,IAAYA,QAAAA,CAASpI,QAAAA,CAASkI,MAAAA,CAAAA,GAAU,KAAA;IAC9D,KAAK,OAAA;AACJ,MAAA,OAAOrQ,KAAAA,CAAMC,QAAQsQ,QAAAA,CAAAA,GAAY,CAACA,QAAAA,CAASpI,QAAAA,CAASkI,MAAAA,CAAAA,GAAU,IAAA;AAC/D,IAAA;AACC,MAAA,OAAO,KAAA;AACT;AACD;AAvDSD,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AA4DF,SAASW,wBAAwBC,MAAAA,EAA+B;AACtE,EAAA,OAAO;AACN/R,IAAAA,IAAAA,EAAM+R,MAAAA,CAAOrL,EAAAA;AACbwH,IAAAA,WAAAA,EAAa6D,MAAAA,CAAO7D,WAAAA;IACpBpB,KAAAA,kBAAO,MAAA,CAAA,OAAOhN,QAAAA,EAAU4M,IAAAA,EAAMpB,cAAAA,KAAAA;AAC7B,MAAA,IAAIyG,MAAAA,CAAOC,MAAMlS,QAAAA,EAAU;AAC1B,QAAA,MAAMmS,YAAY,IAAIT,MAAAA,CAAO,IAAIO,MAAAA,CAAOC,KAAAA,CAAMlS,QAAQ,CAAA,CAAA,CAAG,CAAA;AACzD,QAAA,IAAI,CAACmS,SAAAA,CAAUR,IAAAA,CAAK3R,QAAAA,CAAAA,EAAW;AAC9B,UAAA,OAAO;YAAEiN,MAAAA,EAAQ;AAAM,WAAA;AACxB,QAAA;AACD,MAAA;AAEA,MAAA,IAAIgF,MAAAA,CAAOC,MAAMvF,QAAAA,EAAU;AAG1B,QAAA,MAAMyF,iBAAiBpS,QAAAA,CAASsE,KAAAA,CAAM,GAAA,CAAA,CAAK,CAAA,CAAA,IAAM,EAAA;AACjD,QAAA,MAAM+N,aAAa,IAAIX,MAAAA,CAAO,IAAIO,MAAAA,CAAOC,KAAAA,CAAMvF,QAAQ,CAAA,CAAA,CAAG,CAAA;AAC1D,QAAA,IAAI,CAAC0F,UAAAA,CAAWV,IAAAA,CAAKS,cAAAA,CAAAA,EAAiB;AACrC,UAAA,OAAO;YAAEnF,MAAAA,EAAQ;AAAM,WAAA;AACxB,QAAA;AACD,MAAA;AAEA,MAAA,KAAA,MAAWqF,IAAAA,IAAQL,OAAOM,KAAAA,EAAO;AAChC,QAAA,MAAMC,QAAAA,GAAWF,IAAAA,CAAKG,UAAAA,CAAWC,KAAAA,CAAM,CAACC,SAAAA,KAAAA;AACvC,UAAA,MAAMC,WAAAA,GAAcvC,YAAAA,CAAasC,SAAAA,CAAUE,KAAAA,EAAOjG,MAAMpB,cAAAA,CAAAA;AACxD,UAAA,OAAO6F,iBAAAA,CAAkBuB,WAAAA,EAAaD,SAAAA,CAAUpB,QAAAA,EAAUoB,UAAUtS,KAAK,CAAA;QAC1E,CAAA,CAAA;AAEA,QAAA,IAAImS,QAAAA,EAAU;AACb,UAAA,OAAO;AACNvF,YAAAA,MAAAA,EAAQqF,IAAAA,CAAKrF,MAAAA;YACbE,MAAAA,EAAQmF,IAAAA,CAAKnF,UAAU,CAAA,aAAA,EAAgBmF,IAAAA,CAAK1L,MAAM,SAAA,CAAA,WAAA,EAAuBqL,OAAOrL,EAAE,CAAA,CAAA;AAClF7G,YAAAA,MAAAA,EAAQkS,MAAAA,CAAOrL,EAAAA;YACf+D,OAAAA,EAAS;AAAEmI,cAAAA,MAAAA,EAAQR,IAAAA,CAAK1L,EAAAA;AAAI6L,cAAAA,UAAAA,EAAYH,IAAAA,CAAKG;AAAW;AACzD,WAAA;AACD,QAAA;AACD,MAAA;AAEA,MAAA,OAAO;QAAExF,MAAAA,EAAQ;AAAM,OAAA;IACxB,CAAA,EAnCO,OAAA;AAoCR,GAAA;AACD;AAzCgB+E,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA8CT,SAASe,wBACfd,MAAAA,EAAuD;AAEvD,EAAA,IAAIhR,KAAAA,CAAMC,OAAAA,CAAQ+Q,MAAAA,CAAAA,EAAS;AAC1B,IAAA,OAAOA,MAAAA,CAAO1M,IAAIyM,uBAAAA,CAAAA;AACnB,EAAA;AACA,EAAA,OAAOC,MAAAA,CAAO/F,QAAAA,CAAS3G,GAAAA,CAAIyM,uBAAAA,CAAAA;AAC5B;AAPgBe,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AC3OT,IAAMC,cAAAA,GAAiBC,MAAEC,IAAAA,CAAK;AACpC,EAAA,QAAA;AACA,EAAA,WAAA;AACA,EAAA,UAAA;AACA,EAAA,aAAA;AACA,EAAA,YAAA;AACA,EAAA,eAAA;AACA,EAAA,UAAA;AACA,EAAA,aAAA;AACA,EAAA,SAAA;AACA,EAAA,IAAA;AACA,EAAA;AACA,CAAA;AAIM,IAAMC,eAAAA,GAAkBF,MAAEG,MAAAA,CAAO;AACvCP,EAAAA,KAAAA,EAAOI,KAAAA,CACLI,MAAAA,EAAM,CACNC,QAAAA,CAAS,yEAAA,CAAA;EACX/B,QAAAA,EAAUyB,cAAAA;AACV3S,EAAAA,KAAAA,EAAO4S,KAAAA,CAAEM,GAAAA,EAAG,CAAGD,QAAAA,CAAS,0BAAA;AACzB,CAAA;AAIO,IAAME,kBAAAA,GAAqBP,MAAEC,IAAAA,CAAK;AAAC,EAAA,KAAA;AAAO,EAAA,SAAA;AAAW,EAAA;AAAQ,CAAA;AAI7D,IAAMO,gBAAAA,GAAmBR,MAAEG,MAAAA,CAAO;EACxCxM,EAAAA,EAAIqM,KAAAA,CAAEI,MAAAA,EAAM,CAAGK,QAAAA,EAAQ;EACvBzG,MAAAA,EAAQuG,kBAAAA;AACRf,EAAAA,UAAAA,EAAYQ,KAAAA,CAAEU,KAAAA,CAAMR,eAAAA,CAAAA,CAAiBG,SAAS,0CAAA,CAAA;EAC9CnG,MAAAA,EAAQ8F,KAAAA,CAAEI,MAAAA,EAAM,CAAGK,QAAAA;AACpB,CAAA;AAIO,IAAME,6BAAAA,GAAgCX,MAAEG,MAAAA,CAAO;AACrDxM,EAAAA,EAAAA,EAAIqM,MAAEI,MAAAA,EAAM;EACZjF,WAAAA,EAAa6E,KAAAA,CAAEI,MAAAA,EAAM,CAAGK,QAAAA,EAAQ;AAChCxB,EAAAA,KAAAA,EAAOe,MAAEG,MAAAA,CAAO;AACfpT,IAAAA,QAAAA,EAAUiT,MAAEI,MAAAA,EAAM,CAAGK,QAAAA,EAAQ,CAAGJ,SAAS,4CAAA,CAAA;AACzC3G,IAAAA,QAAAA,EAAUsG,MAAEI,MAAAA,EAAM,CAAGK,QAAAA,EAAQ,CAAGJ,SAAS,4CAAA;GAC1C,CAAA;AACAf,EAAAA,KAAAA,EAAOU,KAAAA,CAAEU,KAAAA,CAAMF,gBAAAA,CAAAA,CAAkBH,SAAS,iDAAA;AAC3C,CAAA;AAIO,IAAMO,yBAAAA,GAA4BZ,MAAEG,MAAAA,CAAO;AACjDxO,EAAAA,OAAAA,EAASqO,MAAEI,MAAAA,EAAM;EACjBnH,QAAAA,EAAU+G,KAAAA,CAAEU,MAAMC,6BAAAA;AACnB,CAAA;;;AClDO,IAAME,cAAN,MAAMA;EAHb;;;EAISxB,IAAAA,GAAmB;IAC1BrF,MAAAA,EAAQ,KAAA;AACRwF,IAAAA,UAAAA,EAAY;AACb,GAAA;AAEA5S,EAAAA,WAAAA,CAAYoN,SAAuB,KAAA,EAAO;AACzC,IAAA,IAAA,CAAKqF,KAAKrF,MAAAA,GAASA,MAAAA;AACpB,EAAA;AAEAA,EAAAA,MAAAA,CAAOA,MAAAA,EAA4B;AAClC,IAAA,IAAA,CAAKqF,KAAKrF,MAAAA,GAASA,MAAAA;AACnB,IAAA,OAAO,IAAA;AACR,EAAA;AAEArG,EAAAA,EAAAA,CAAGA,EAAAA,EAAkB;AACpB,IAAA,IAAA,CAAK0L,KAAK1L,EAAAA,GAAKA,EAAAA;AACf,IAAA,OAAO,IAAA;AACR,EAAA;AAEAuG,EAAAA,MAAAA,CAAOA,MAAAA,EAAsB;AAC5B,IAAA,IAAA,CAAKmF,KAAKnF,MAAAA,GAASA,MAAAA;AACnB,IAAA,OAAO,IAAA;AACR,EAAA;EAEAwF,SAAAA,CAAUE,KAAAA,EAAetB,UAAoBlR,KAAAA,EAAkB;AAC9D,IAAA,IAAA,CAAKiS,IAAAA,CAAKG,WAAWlJ,IAAAA,CAAK;AAAEsJ,MAAAA,KAAAA;AAAOtB,MAAAA,QAAAA;AAAUlR,MAAAA;KAAM,CAAA;AACnD,IAAA,OAAO,IAAA;AACR,EAAA;EAEA0T,KAAAA,GAAoB;AACnB,IAAA,OAAO,IAAA,CAAKzB,IAAAA;AACb,EAAA;AACD;AAKO,IAAM0B,gBAAN,MAAMA;EAzCb;;;AA0CS/B,EAAAA,MAAAA;AAERpS,EAAAA,WAAAA,CAAY+G,EAAAA,EAAY;AACvB,IAAA,IAAA,CAAKqL,MAAAA,GAAS;AACbrL,MAAAA,EAAAA;AACAsL,MAAAA,KAAAA,EAAO,EAAC;AACRK,MAAAA,KAAAA,EAAO;AACR,KAAA;AACD,EAAA;AAEAnE,EAAAA,WAAAA,CAAY6F,IAAAA,EAAoB;AAC/B,IAAA,IAAA,CAAKhC,OAAO7D,WAAAA,GAAc6F,IAAAA;AAC1B,IAAA,OAAO,IAAA;AACR,EAAA;AAEAC,EAAAA,SAAAA,CAAUC,eAAAA,EAA+B;AACxC,IAAA,IAAA,CAAKlC,MAAAA,CAAOC,MAAMlS,QAAAA,GAAWmU,eAAAA;AAC7B,IAAA,OAAO,IAAA;AACR,EAAA;AAEAC,EAAAA,aAAAA,CAAcC,eAAAA,EAA+B;AAC5C,IAAA,IAAA,CAAKpC,MAAAA,CAAOC,MAAMvF,QAAAA,GAAW0H,eAAAA;AAC7B,IAAA,OAAO,IAAA;AACR,EAAA;;;;;;AAOAC,EAAAA,OAAAA,CAAQC,OAAAA,EAAsD;AAC7D,IAAA,MAAMC,OAAAA,GAAU,IAAIV,WAAAA,EAAAA;AACpB,IAAA,IAAA,CAAK7B,OAAOM,KAAAA,CAAMhJ,IAAAA,CAAKgL,QAAQC,OAAAA,CAAAA,CAAST,OAAK,CAAA;AAC7C,IAAA,OAAO,IAAA;AACR,EAAA;;;;AAKAU,EAAAA,aAAAA,CAAcnC,IAAAA,EAAwB;AACrC,IAAA,IAAA,CAAKL,MAAAA,CAAOM,KAAAA,CAAMhJ,IAAAA,CAAK+I,IAAAA,CAAAA;AACvB,IAAA,OAAO,IAAA;AACR,EAAA;EAEAyB,KAAAA,GAAiC;AAChC,IAAA,OAAO,IAAA,CAAK9B,MAAAA;AACb,EAAA;AACD;;;ACrFO,IAAMyC,wBAAN,MAAMA;EANb;;;EAOCxU,IAAAA,GAAO,yBAAA;EACPkO,WAAAA,GAAc,qDAAA;AAENlC,EAAAA,QAAAA,uBAA4C1G,GAAAA,EAAAA;EAEpD3F,WAAAA,CAAY8U,eAAAA,GAAoC,EAAA,EAAI;AACnD,IAAA,KAAA,MAAW5U,UAAU4U,eAAAA,EAAiB;AACrC,MAAA,IAAA,CAAKzI,QAAAA,CAAS5I,GAAAA,CAAIvD,MAAAA,CAAOG,IAAAA,EAAMH,MAAAA,CAAAA;AAChC,IAAA;AACD,EAAA;;;;AAKA6U,EAAAA,SAAAA,CAAU7U,MAAAA,EAA8B;AACvC,IAAA,IAAA,CAAKmM,QAAAA,CAAS5I,GAAAA,CAAIvD,MAAAA,CAAOG,IAAAA,EAAMH,MAAAA,CAAAA;AAChC,EAAA;;;;AAKA8U,EAAAA,YAAAA,CAAa3U,IAAAA,EAAoB;AAChC,IAAA,IAAA,CAAKgM,QAAAA,CAAS7E,OAAOnH,IAAAA,CAAAA;AACtB,EAAA;;;;EAKA4U,KAAAA,GAAc;AACb,IAAA,IAAA,CAAK5I,SAAS4I,KAAAA,EAAK;AACpB,EAAA;;;;;EAMAC,eAAAA,CAAgBC,OAAAA,EAAoCC,UAAU,KAAA,EAAa;AAC1E,IAAA,IAAIA,OAAAA,EAAS;AACZ,MAAA,IAAA,CAAK/I,SAAS4I,KAAAA,EAAK;AACpB,IAAA;AACA,IAAA,KAAA,MAAW7C,UAAU+C,OAAAA,EAAS;AAC7B,MAAA,MAAMjV,MAAAA,GAASiS,wBAAwBC,MAAAA,CAAAA;AACvC,MAAA,IAAA,CAAK/F,QAAAA,CAAS5I,GAAAA,CAAIvD,MAAAA,CAAOG,IAAAA,EAAMH,MAAAA,CAAAA;AAChC,IAAA;AACD,EAAA;;;;EAKAmV,WAAAA,GAAgC;AAC/B,IAAA,OAAOjU,KAAAA,CAAMwB,IAAAA,CAAK,IAAA,CAAKyJ,QAAAA,CAASiJ,QAAM,CAAA;AACvC,EAAA;;;;;EAMA,MAAMnI,KAAAA,CACLhN,QAAAA,EACA4M,IAAAA,EACApB,cAAAA,EACwB;AACxB,IAAA,IAAImC,gBAAAA,GAAwC,IAAA;AAE5C,IAAA,KAAA,MAAW5N,MAAAA,IAAU,IAAA,CAAKmM,QAAAA,CAASiJ,MAAAA,EAAM,EAAI;AAC5C,MAAA,MAAM3T,SAAS,MAAMzB,MAAAA,CAAOiN,KAAAA,CAAMhN,QAAAA,EAAU4M,MAAMpB,cAAAA,CAAAA;AAElD,MAAA,IAAIhK,MAAAA,CAAOyL,WAAW,OAAA,EAAS;AAC9B,QAAA,OAAOzL,MAAAA;AACR,MAAA;AAEA,MAAA,IAAIA,MAAAA,CAAOyL,WAAW,SAAA,EAAW;AAChC,QAAA,IAAI,CAACU,gBAAAA,EAAkB;AACtBA,UAAAA,gBAAAA,GAAmBnM,MAAAA;AACpB,QAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,IAAImM,gBAAAA,EAAkB;AACrB,MAAA,OAAOA,gBAAAA;AACR,IAAA;AAEA,IAAA,OAAO;MAAEV,MAAAA,EAAQ;AAAM,KAAA;AACxB,EAAA;AACD;ACrEO,SAASmI,eAAeC,IAAAA,EAAY;AAK1C,EAAA,MAAMC,WAAAA,GAAc,CAAA;EAAwBD,IAAAA;;AAE5C,EAAA,MAAME,GAAAA,GAAY5Q,uBAAM2Q,WAAAA,EAAa;IACpCE,WAAAA,EAAa,IAAA;IACbC,UAAAA,EAAY;GACb,CAAA;AAEA,EAAA,MAAM9K,OAAAA,GAAkC;IAEvC+K,aAAAA,EAAe;AAChB,GAAA;AAEAC,EAAKC,uBAAOL,GAAAA,EAAK;AAChBM,IAAAA,gBAAAA,CAAiBC,IAAAA,EAAS;AACzBC,MAAAA,oBAAAA,CAAqBD,MAAMnL,OAAAA,CAAAA;AAC5B,IAAA,CAAA;AACAqL,IAAAA,oBAAAA,CAAqBF,IAAAA,EAAS;AAC7BG,MAAAA,cAAAA,CAAeH,MAAMnL,OAAAA,CAAAA;AACtB,IAAA,CAAA;AACAuL,IAAAA,cAAAA,CAAeJ,IAAAA,EAAS;AACvB,MAAA,IAAIA,IAAAA,CAAKK,MAAAA,CAAO1L,IAAAA,KAAS,kBAAA,EAAoB;AAC5C2L,QAAAA,cAAAA,CAAeN,MAAMnL,OAAAA,CAAAA;AACtB,MAAA;AACD,IAAA,CAAA;AACA0L,IAAAA,eAAAA,CAAgBP,IAAAA,EAAS;AACxBQ,MAAAA,mBAAAA,CAAoBR,MAAMnL,OAAAA,CAAAA;AAC3B,IAAA;GACD,CAAA;AAEA,EAAA,IAAI4L,gBAAAA,GAA6BC,8BAASjB,GAAAA,CAAAA;AAI1C,EAAA,IAAIgB,gBAAAA,CAAiB9E,QAAAA,CAAS,IAAA,CAAA,EAAO;AACpC8E,IAAAA,gBAAAA,GAAmBA,gBAAAA,CAAiB7Q,KAAAA,CAAM,CAAA,EAAG,EAAC,CAAA;AAC/C,EAAA;AAEA,EAAA,OAAO;IACN2P,IAAAA,EAAMkB,gBAAAA;IACNzT,QAAAA,EAAU;AACT4S,MAAAA,aAAAA,EAAe/K,OAAAA,CAAQ+K;AACxB;AACD,GAAA;AACD;AAhDgBN,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAkDhB,SAASW,oBAAAA,CAAqBD,MAAWnL,OAAAA,EAA+B;AACvEA,EAAAA,OAAAA,CAAQ+K,aAAAA,EAAAA;AAER,EAAA,MAAMe,YAAAA,GAAe;IAAE,GAAGX;AAAK,GAAA;AAE/BA,EAAAA,IAAAA,CAAKrL,IAAAA,GAAO,gBAAA;AACZqL,EAAAA,IAAAA,CAAKK,MAAAA,GAAS;IACb1L,IAAAA,EAAM,YAAA;IACNvK,IAAAA,EAAM;AACP,GAAA;AACA4V,EAAAA,IAAAA,CAAKY,SAAAA,GAAY;IAChBD,YAAAA,CAAaE,IAAAA;IACbF,YAAAA,CAAaG,KAAAA;AACb,IAAA;MACCnM,IAAAA,EAAM,SAAA;AACNpK,MAAAA,KAAAA,EAAOoW,YAAAA,CAAalF;AACrB;;AAEF;AAlBSwE,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAoBT,SAASE,cAAAA,CAAeH,MAAWnL,OAAAA,EAA+B;AACjEA,EAAAA,OAAAA,CAAQ+K,aAAAA,EAAAA;AAER,EAAA,MAAMmB,gBAAgBf,IAAAA,CAAKc,KAAAA;AAC3Bd,EAAAA,IAAAA,CAAKc,KAAAA,GAAQ;IACZnM,IAAAA,EAAM,gBAAA;IACN0L,MAAAA,EAAQ;MACP1L,IAAAA,EAAM,YAAA;MACNvK,IAAAA,EAAM;AACP,KAAA;IACAwW,SAAAA,EAAW;AACV,MAAA;QACCjM,IAAAA,EAAM,SAAA;AACNpK,QAAAA,KAAAA,EAAOyV,KAAKa,IAAAA,CAAKlM,IAAAA,KAAS,YAAA,GAAeqL,IAAAA,CAAKa,KAAKzW,IAAAA,GAAO;AAC3D,OAAA;AACA2W,MAAAA;;AAEF,GAAA;AACD;AAlBSZ,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAoBT,SAASG,cAAAA,CAAeN,MAAWnL,OAAAA,EAA+B;AACjE,EAAA,MAAMmM,GAAAA,GAAMhB,KAAKK,MAAAA,CAAO/C,MAAAA;AAExB,EAAA,MAAM2D,SAAAA,GACJD,GAAAA,CAAIrM,IAAAA,KAAS,YAAA,KAAiBqM,IAAI5W,IAAAA,KAAS,KAAA,IAAS4W,GAAAA,CAAI5W,IAAAA,KAAS,KAAA,CAAA,IACjE4W,GAAAA,CAAIrM,IAAAA,KAAS,kBAAA,IAAsBuM,YAAYF,GAAAA,CAAAA;AAEjD,EAAA,IAAI,CAACC,SAAAA,EAAW;AACf,IAAA;AACD,EAAA;AAEApM,EAAAA,OAAAA,CAAQ+K,aAAAA,EAAAA;AAER,EAAA,MAAMe,YAAAA,GAAe;IAAE,GAAGX;AAAK,GAAA;AAE/BA,EAAAA,IAAAA,CAAKrL,IAAAA,GAAO,gBAAA;AACZqL,EAAAA,IAAAA,CAAKK,MAAAA,GAAS;IACb1L,IAAAA,EAAM,YAAA;IACNvK,IAAAA,EAAM;AACP,GAAA;AACA4V,EAAAA,IAAAA,CAAKY,SAAAA,GAAY;AAChBD,IAAAA,YAAAA,CAAaN,MAAAA,CAAO/C,MAAAA;AACpB,IAAA;MACC3I,IAAAA,EAAM,SAAA;AACNpK,MAAAA,KAAAA,EAAOoW,aAAaN,MAAAA,CAAOc,QAAAA,CAAS/W,IAAAA,IAAQuW,YAAAA,CAAaN,OAAOc,QAAAA,CAAS5W;AAC1E,KAAA;AACA,IAAA;MACCoK,IAAAA,EAAM,iBAAA;AACNyM,MAAAA,QAAAA,EAAUT,YAAAA,CAAaC;AACxB;;AAEF;AA/BSN,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAiCT,SAASY,YAAYlB,IAAAA,EAAS;AAC7B,EAAA,IAAIA,IAAAA,CAAKrL,SAAS,YAAA,EAAc;AAC/B,IAAA,OAAOqL,IAAAA,CAAK5V,IAAAA,KAAS,KAAA,IAAS4V,IAAAA,CAAK5V,IAAAA,KAAS,KAAA;AAC7C,EAAA;AACA,EAAA,IAAI4V,IAAAA,CAAKrL,SAAS,kBAAA,EAAoB;AACrC,IAAA,OAAOuM,WAAAA,CAAYlB,KAAK1C,MAAM,CAAA;AAC/B,EAAA;AACA,EAAA,OAAO,KAAA;AACR;AARS4D,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAUT,SAASV,mBAAAA,CAAoBR,MAAWnL,OAAAA,EAA+B;AACtEA,EAAAA,OAAAA,CAAQ+K,aAAAA,EAAAA;AAER,EAAA,MAAMe,YAAAA,GAAe;IAAE,GAAGX;AAAK,GAAA;AAE/BA,EAAAA,IAAAA,CAAKrL,IAAAA,GAAO,gBAAA;AACZqL,EAAAA,IAAAA,CAAKK,MAAAA,GAAS;IACb1L,IAAAA,EAAM,YAAA;IACNvK,IAAAA,EAAM;AACP,GAAA;AACA4V,EAAAA,IAAAA,CAAKY,SAAAA,GAAY;AAChB,IAAA;MACCjM,IAAAA,EAAM,iBAAA;MACNyM,QAAAA,EAAUT,YAAAA,CAAaU,eAAe;AACvC,KAAA;AACA,IAAA;MACC1M,IAAAA,EAAM,iBAAA;AACNyM,MAAAA,QAAAA,EAAAA,CAAWT,aAAaW,MAAAA,IAAU,EAAA,EAAI7R,GAAAA,CAAI,CAAC8R,KAAAA,MAAgB;QAC1D5M,IAAAA,EAAM,SAAA;AACNpK,QAAAA,KAAAA,EAAOgX,KAAAA,CAAMhX,KAAAA,CAAMiX,MAAAA,IAAUD,KAAAA,CAAMhX,KAAAA,CAAMkX;OAC1C,CAAA;AACD;;AAEF;AAvBSjB,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AA4BF,IAAMkB,uBAAN,MAAMA;EAxLb;;;AAyLS1U,EAAAA,QAAAA,uBAAgD0C,GAAAA,EAAAA;AAChDiS,EAAAA,SAAAA,uBAAyC9P,OAAAA,EAAAA;EACzC+P,MAAAA,GAAS,CAAA;AAETC,EAAAA,KAAAA,CAAMtX,KAAAA,EAAwB;AACrC,IAAA,IAAI,OAAOA,KAAAA,KAAU,QAAA,IAAYA,KAAAA,KAAU,IAAA,EAAM;AAChD,MAAA,MAAMuX,QAAAA,GAAW,IAAA,CAAKH,SAAAA,CAAUtS,GAAAA,CAAI9E,KAAAA,CAAAA;AACpC,MAAA,IAAIuX,UAAU,OAAOA,QAAAA;AAErB,MAAA,MAAMhR,EAAAA,GAAK,CAAA,QAAA,EAAW,IAAA,CAAK8Q,MAAAA,EAAM,CAAA,CAAA;AACjC,MAAA,IAAA,CAAKD,SAAAA,CAAUnU,GAAAA,CAAIjD,KAAAA,EAAiBuG,EAAAA,CAAAA;AACpC,MAAA,OAAOA,EAAAA;AACR,IAAA;AACA,IAAA,OAAO,CAAA,UAAA,EAAaxD,eAAAA,CAAAA,CAAAA;AACrB,EAAA;AAEAyU,EAAAA,KAAAA,CAAMxX,KAAAA,EAAgBkK,MAAAA,EAAwBG,YAAAA,GAAyB,EAAA,EAAa;AACnF,IAAA,IAAIrK,KAAAA,KAAU,IAAA,IAAQA,KAAAA,KAAUC,MAAAA,EAAW;AAC1C,MAAA,OAAOD,KAAAA;AACR,IAAA;AAEA,IAAA,MAAMuG,EAAAA,GAAK,IAAA,CAAK+Q,KAAAA,CAAMtX,KAAAA,CAAAA;AAEtB,IAAA,IAAI,CAAC,IAAA,CAAKyC,QAAAA,CAAS/B,GAAAA,CAAI6F,EAAAA,CAAAA,EAAK;AAC3B,MAAA,IAAA,CAAK9D,QAAAA,CAASQ,IAAIsD,EAAAA,EAAI;AACrBA,QAAAA,EAAAA;AACA2D,QAAAA,MAAAA;QACAC,OAAAA,EAAS;UAAEC,IAAAA,EAAM;AAAS,SAAA;AAC1BC,QAAAA;OACD,CAAA;AACD,IAAA;AAEA,IAAA,OAAOrK,KAAAA;AACR,EAAA;EAEAyX,WAAAA,CAAYnB,IAAAA,EAAeC,OAAgBrF,QAAAA,EAA2B;AACrE,IAAA,MAAMwG,MAAAA,GAAS,IAAA,CAAKJ,KAAAA,CAAMhB,IAAAA,CAAAA;AAC1B,IAAA,MAAMqB,OAAAA,GAAU,IAAA,CAAKL,KAAAA,CAAMf,KAAAA,CAAAA;AAE3B,IAAA,MAAMqB,QAAAA,GAAWzM,aAAAA,CAAcmL,IAAAA,CAAAA,IAASnN,0BAA0BmN,IAAAA,CAAAA;AAClE,IAAA,MAAMuB,SAAAA,GAAY1M,aAAAA,CAAcoL,KAAAA,CAAAA,IAAUpN,0BAA0BoN,KAAAA,CAAAA;AACpE,IAAA,MAAMuB,YAAAA,GACLF,QAAAA,EAAU1N,MAAAA,CAAOE,IAAAA,KAAS/K,wBAAAA,CAAiB6O,IAAAA,GACxC0J,QAAAA,GACAC,SAAAA,EAAW3N,MAAAA,CAAOE,IAAAA,KAAS/K,wBAAAA,CAAiB6O,IAAAA,GAC3C2J,SAAAA,GACA,IAAA;AAEL,IAAA,IAAI1W,MAAAA;AACJ,IAAA,QAAQ+P,QAAAA;MACP,KAAK,GAAA;AACJ/P,QAAAA,MAAAA,GAAUmV,IAAAA,GAAgBC,KAAAA;AAC1B,QAAA,IAAI,OAAOpV,MAAAA,KAAW,QAAA,IAAY2W,YAAAA,EAAc;AAC/C/P,UAAAA,oBAAAA,CAAqB5G,QAAQ2W,YAAAA,CAAAA;AAC9B,QAAA;AACA,QAAA;MACD,KAAK,GAAA;AACJ3W,QAAAA,MAAAA,GAAUmV,IAAAA,GAAgBC,KAAAA;AAC1B,QAAA;MACD,KAAK,GAAA;AACJpV,QAAAA,MAAAA,GAAUmV,IAAAA,GAAgBC,KAAAA;AAC1B,QAAA;MACD,KAAK,GAAA;AACJpV,QAAAA,MAAAA,GAAUmV,IAAAA,GAAgBC,KAAAA;AAC1B,QAAA;MACD,KAAK,GAAA;AACJpV,QAAAA,MAAAA,GAAUmV,IAAAA,GAAgBC,KAAAA;AAC1B,QAAA;MACD,KAAK,KAAA;MACL,KAAK,IAAA;AACJpV,QAAAA,MAAAA,GAASmV,IAAAA,KAASC,KAAAA;AAClB,QAAA;MACD,KAAK,KAAA;MACL,KAAK,IAAA;AACJpV,QAAAA,MAAAA,GAASmV,IAAAA,KAASC,KAAAA;AAClB,QAAA;MACD,KAAK,GAAA;AACJpV,QAAAA,MAAAA,GAAUmV,IAAAA,GAAgBC,KAAAA;AAC1B,QAAA;MACD,KAAK,GAAA;AACJpV,QAAAA,MAAAA,GAAUmV,IAAAA,GAAgBC,KAAAA;AAC1B,QAAA;MACD,KAAK,IAAA;AACJpV,QAAAA,MAAAA,GAAUmV,IAAAA,IAAiBC,KAAAA;AAC3B,QAAA;MACD,KAAK,IAAA;AACJpV,QAAAA,MAAAA,GAAUmV,IAAAA,IAAiBC,KAAAA;AAC3B,QAAA;MACD,KAAK,IAAA;AACJpV,QAAAA,MAAAA,GAASmV,IAAAA,IAAQC,KAAAA;AACjB,QAAA;MACD,KAAK,IAAA;AACJpV,QAAAA,MAAAA,GAASmV,IAAAA,IAAQC,KAAAA;AACjB,QAAA;AACD,MAAA;AACCpV,QAAAA,MAAAA,GAASlB,MAAAA;AACX;AAEA,IAAA,OAAO,IAAA,CAAKuX,MACXrW,MAAAA,EACA;MAAEiJ,IAAAA,EAAM,QAAA;AAAiBmF,MAAAA,SAAAA,EAAW,UAAU2B,QAAAA,CAAAA,CAAAA;AAAY6G,MAAAA,SAAAA,EAAWxU,KAAKC,GAAAA;KAAM,EAChF;AAACkU,MAAAA,MAAAA;AAAQC,MAAAA;AAAQ,KAAA,CAAA;AAEnB,EAAA;AAEAK,EAAAA,WAAAA,CAAYnY,MAAcG,KAAAA,EAAyB;AAClD,IAAA,OAAO,IAAA,CAAKwX,MACXxX,KAAAA,EACA;MAAEoK,IAAAA,EAAM,QAAA;MAAiBmF,SAAAA,EAAW,YAAA;AAAcwI,MAAAA,SAAAA,EAAWxU,KAAKC,GAAAA;KAAM,EACxE;AAAC,MAAA,IAAA,CAAK8T,MAAMtX,KAAAA;AAAO,KAAA,CAAA;AAErB,EAAA;EAEAiY,WAAAA,CAAYlF,MAAAA,EAAiBmF,QAAgB3L,IAAAA,EAA0B;AACtE,IAAA,IAAI,OAAOwG,MAAAA,KAAW,QAAA,IAAYA,MAAAA,KAAW,IAAA,IAAQmF,UAAWnF,MAAAA,EAAgB;AAC/E,MAAA,MAAM5R,MAAAA,GAAU4R,MAAAA,CAAemF,MAAAA,CAAAA,CAAO,GAAI3L,IAAAA,CAAAA;AAE1C,MAAA,OAAO,IAAA,CAAKiL,MACXrW,MAAAA,EACA;QAAEiJ,IAAAA,EAAM,QAAA;AAAiBmF,QAAAA,SAAAA,EAAW,UAAU2I,MAAAA,CAAAA,CAAAA;AAAUH,QAAAA,SAAAA,EAAWxU,KAAKC,GAAAA;OAAM,EAC9E;AAAC,QAAA,IAAA,CAAK8T,MAAMvE,MAAAA,CAAAA;AAAYxG,QAAAA,GAAAA,IAAAA,CAAKrH,IAAI,CAACiT,CAAAA,KAAM,IAAA,CAAKb,KAAAA,CAAMa,CAAAA,CAAAA;AAAI,OAAA,CAAA;AAEzD,IAAA;AAEA,IAAA,OAAOlY,MAAAA;AACR,EAAA;AAEAmY,EAAAA,aAAAA,CAActB,aAAwBC,MAAAA,EAA0B;AAC/D,IAAA,IAAI5V,MAAAA,GAAS,EAAA;AACb,IAAA,IAAI2W,YAAAA,GAA0C,IAAA;AAE9C,IAAA,KAAA,IAASnH,CAAAA,GAAI,CAAA,EAAGA,CAAAA,GAAIoG,MAAAA,CAAO3V,QAAQuP,CAAAA,EAAAA,EAAK;AACvCxP,MAAAA,MAAAA,IAAU4V,MAAAA,CAAOpG,CAAAA,CAAAA,IAAM,EAAA;AACvB,MAAA,IAAIA,CAAAA,GAAImG,YAAY1V,MAAAA,EAAQ;AAC3B,QAAA,MAAMiX,IAAAA,GAAOvB,YAAYnG,CAAAA,CAAAA;AACzBxP,QAAAA,MAAAA,IAAUjB,OAAOmY,IAAAA,CAAAA;AAEjB,QAAA,MAAMC,IAAAA,GAAOnN,aAAAA,CAAckN,IAAAA,CAAAA,IAASlP,0BAA0BkP,IAAAA,CAAAA;AAC9D,QAAA,IAAIC,QAAQA,IAAAA,CAAKpO,MAAAA,CAAOE,SAAS/K,wBAAAA,CAAiB6O,IAAAA,IAAQ,CAAC4J,YAAAA,EAAc;AACxEA,UAAAA,YAAAA,GAAeQ,IAAAA;AAChB,QAAA;AACD,MAAA;AACD,IAAA;AAEA,IAAA,IAAIR,YAAAA,EAAc;AACjB/P,MAAAA,oBAAAA,CAAqB5G,QAAQ2W,YAAAA,CAAAA;AAC9B,IAAA;AAEA,IAAA,OAAO3W,MAAAA;AACR,EAAA;AAEAoX,EAAAA,WAAAA,CAAYvY,KAAAA,EAA2C;AACtD,IAAA,IAAI,OAAOA,KAAAA,KAAU,QAAA,IAAYA,KAAAA,KAAU,IAAA,EAAM;AAChD,MAAA,MAAMuG,EAAAA,GAAK,IAAA,CAAK6Q,SAAAA,CAAUtS,GAAAA,CAAI9E,KAAAA,CAAAA;AAC9B,MAAA,IAAIuG,EAAAA,EAAI;AACP,QAAA,OAAO,IAAA,CAAK9D,QAAAA,CAASqC,GAAAA,CAAIyB,EAAAA,CAAAA,IAAO,IAAA;AACjC,MAAA;AACD,IAAA;AACA,IAAA,OAAO,IAAA;AACR,EAAA;EAEAiS,cAAAA,GAAkD;AACjD,IAAA,OAAO,IAAIrT,GAAAA,CAAI,IAAA,CAAK1C,QAAQ,CAAA;AAC7B,EAAA;AAEAgW,EAAAA,eAAAA,CAAgBhW,QAAAA,EAAiD;AAChE,IAAA,IAAA,CAAKA,QAAAA,GAAW,IAAI0C,GAAAA,CAAI1C,QAAAA,CAAAA;AACzB,EAAA;AACD,CAAA;AAKO,SAASiW,qBAAAA,GAAAA;AAIf,EAAA,MAAMC,OAAAA,GAAU,IAAIxB,oBAAAA,EAAAA;AAEpB,EAAA,OAAO;AACNwB,IAAAA,OAAAA;IACAC,OAAAA,EAAS;MACRC,OAAAA,kBAAS,MAAA,CAAA,CAAC7Y,OAAgBkK,MAAAA,EAAwB4O,IAAAA,KACjDH,QAAQnB,KAAAA,CAAMxX,KAAAA,EAAOkK,MAAAA,EAAQ4O,IAAAA,CAAAA,EADrB,SAAA,CAAA;MAETC,cAAAA,kBAAgB,MAAA,CAAA,CAACzC,MAAeC,KAAAA,EAAgBrF,QAAAA,KAC/CyH,QAAQlB,WAAAA,CAAYnB,IAAAA,EAAMC,KAAAA,EAAOrF,QAAAA,CAAAA,EADlB,gBAAA,CAAA;AAEhB8H,MAAAA,cAAAA,0BAAiBnZ,IAAAA,EAAcG,KAAAA,KAAmB2Y,QAAQX,WAAAA,CAAYnY,IAAAA,EAAMG,KAAAA,CAAAA,EAA5D,gBAAA,CAAA;MAChBiZ,cAAAA,kBAAgB,MAAA,CAAA,CAAClG,QAAiBmF,MAAAA,EAAgB3L,IAAAA,KACjDoM,QAAQV,WAAAA,CAAYlF,MAAAA,EAAQmF,MAAAA,EAAQ3L,IAAAA,CAAAA,EADrB,gBAAA,CAAA;AAEhB2M,MAAAA,gBAAAA,0BAAmBpC,WAAAA,EAAwBC,MAAAA,KAC1C4B,QAAQP,aAAAA,CAActB,WAAAA,EAAaC,MAAAA,CAAAA,EADlB,kBAAA,CAAA;AAElBoC,MAAAA,gBAAAA,kBAAkB,MAAA,CAAA,CAACnZ,KAAAA,KAAmB2Y,OAAAA,CAAQJ,WAAAA,CAAYvY,KAAAA,CAAAA,EAAxC,kBAAA;AACnB;AACD,GAAA;AACD;AArBgB0Y,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA","file":"index.cjs","sourcesContent":["/**\n * Provenance Tracking Types\n *\n * Implements CAMEL-inspired data provenance tracking for prompt injection defense.\n\n/**\n * Provenance tracking mode enum\n */\nexport enum ProvenanceMode {\n\t/** No provenance tracking - zero overhead */\n\tNONE = 'none',\n\t/** Proxy-based tracking - runtime tracking */\n\tPROXY = 'proxy',\n\t/** AST instrumentation - compile-time tracking */\n\tAST = 'ast',\n}\n\n/**\n * Data source types\n */\nexport enum ProvenanceSource {\n\t/** Direct from user input (trusted) */\n\tUSER = 'user',\n\t/** From LLM generation */\n\tLLM = 'llm',\n\t/** From tool execution */\n\tTOOL = 'tool',\n\t/** Generated by runtime/system */\n\tSYSTEM = 'system',\n}\n\n/**\n * Tool source metadata\n */\nexport interface ToolSource {\n\ttype: ProvenanceSource.TOOL;\n\ttoolName: string;\n\tapiGroup: string;\n\ttimestamp: number;\n}\n\n/**\n * LLM source metadata\n */\nexport interface LLMSource {\n\ttype: ProvenanceSource.LLM;\n\toperation: 'call' | 'extract' | 'classify';\n\ttimestamp: number;\n}\n\n/**\n * User source metadata\n */\nexport interface UserSource {\n\ttype: ProvenanceSource.USER;\n\ttimestamp: number;\n}\n\n/**\n * System source metadata\n */\nexport interface SystemSource {\n\ttype: ProvenanceSource.SYSTEM;\n\toperation: string;\n\ttimestamp: number;\n}\n\n/**\n * Source metadata union\n */\nexport type SourceMetadata = ToolSource | LLMSource | UserSource | SystemSource;\n\n/**\n * Reader permissions - who can access this data\n */\nexport type ReaderPermissions = { type: 'public' } | { type: 'restricted'; readers: string[] };\n\n/**\n * Complete provenance metadata\n */\nexport interface ProvenanceMetadata {\n\t/** Where this data came from */\n\tsource: SourceMetadata;\n\n\t/** Who can read this data */\n\treaders: ReaderPermissions;\n\n\t/** Chain of dependencies (for tracking data flow) */\n\tdependencies?: string[];\n\n\t/** Unique identifier for this provenance record */\n\tid: string;\n\n\t/** Additional context */\n\tcontext?: Record<string, unknown>;\n}\n\n/**\n * Serialized provenance state for pause/resume\n */\nexport interface ProvenanceState {\n\tregistry: Array<[string, ProvenanceMetadata]>;\n}\n\n/**\n * Enhanced provenance snapshot including primitive taints\n * Used for cross-execution token persistence\n */\nexport interface ProvenanceSnapshot {\n\t/** Object provenance registry */\n\tregistry: Array<[string, ProvenanceMetadata]>;\n\t/** Primitive taint mappings */\n\tprimitives: Array<[string, ProvenanceMetadata]>;\n}\n\n/**\n * Policy action types\n * - log: Allow operation but log security event for audit\n * - approve: Pause and request human approval\n * - block: Deny operation immediately\n */\nexport type PolicyAction = 'log' | 'approve' | 'block';\n\n/**\n * Security policy result\n */\nexport interface PolicyResult {\n\t/** @deprecated Use action instead */\n\tallowed?: boolean;\n\n\t/**\n\t * Action to take:\n\t * - log: Allow but audit (permissive monitoring)\n\t * - approve: Request human approval (interactive gating)\n\t * - block: Deny immediately (maximum security)\n\t */\n\taction: PolicyAction;\n\n\t/** Human-readable reason for the action */\n\treason?: string;\n\n\t/** Policy name that produced this result */\n\tpolicy?: string;\n\n\t/** Additional context for approval UI (when action='approve') or audit log */\n\tcontext?: Record<string, unknown>;\n}\n\n/**\n * Security policy interface\n */\nexport interface SecurityPolicy {\n\tname: string;\n\tdescription?: string;\n\tcheck: (\n\t\ttoolName: string,\n\t\targs: Record<string, unknown>,\n\t\tgetProvenance: (value: unknown) => ProvenanceMetadata | null\n\t) => PolicyResult | Promise<PolicyResult>;\n}\n\n/**\n * Provenance security policy violation error\n */\nexport class ProvenanceSecurityError extends Error {\n\tconstructor(\n\t\tmessage: string,\n\t\tpublic policy: string,\n\t\tpublic toolName: string,\n\t\tpublic details?: Record<string, unknown>\n\t) {\n\t\tsuper(message);\n\t\tthis.name = 'ProvenanceSecurityError';\n\t}\n}\n","/**\n * Provenance Token System\n *\n * Cryptographically-signed tokens for multi-step provenance tracking\n */\nimport crypto from 'crypto';\nimport { nanoid } from 'nanoid';\nimport { log } from '@mondaydotcomorg/atp-runtime';\nimport type { ProvenanceMetadata } from './types.js';\n\n// Forward declare CacheProvider to avoid circular dependency\ninterface CacheProvider {\n\tname: string;\n\tget(key: string): Promise<unknown>;\n\tset(key: string, value: unknown, ttl?: number): Promise<void>;\n\tdelete(key: string): Promise<void>;\n\thas?(key: string): Promise<boolean>;\n\tdisconnect?(): Promise<void>;\n}\n\n/**\n * Token payload structure\n */\nexport interface TokenPayload {\n\tv: 1; // version\n\tclientId: string; // tenant isolation\n\texecutionId: string; // prevent cross-execution replay\n\tcreatedAt: number; // timestamp\n\texpiresAt: number; // expiry (1hr default)\n\tvalueDigest: string; // SHA-256 of canonical value\n\tmetaId: string; // reference to cached metadata\n}\n\nconst MAX_VALUE_SIZE = 1024 * 1024; // 1MB\n\n/**\n * Deterministic JSON stringification with sorted keys\n */\nexport function stableStringify(value: unknown): string | null {\n\ttry {\n\t\tif (value === null || value === undefined) {\n\t\t\treturn String(value);\n\t\t}\n\n\t\tif (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {\n\t\t\treturn JSON.stringify(value);\n\t\t}\n\n\t\tif (typeof value === 'function' || typeof value === 'symbol') {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst seen = new WeakSet();\n\n\t\tconst replacer = (_key: string, val: unknown): unknown => {\n\t\t\tif (val !== null && typeof val === 'object') {\n\t\t\t\tif (seen.has(val as object)) {\n\t\t\t\t\treturn '[Circular]';\n\t\t\t\t}\n\t\t\t\tseen.add(val as object);\n\n\t\t\t\tif (!Array.isArray(val)) {\n\t\t\t\t\tconst sorted: Record<string, unknown> = {};\n\t\t\t\t\tconst keys = Object.keys(val as Record<string, unknown>).sort();\n\t\t\t\t\tfor (const k of keys) {\n\t\t\t\t\t\tsorted[k] = (val as Record<string, unknown>)[k];\n\t\t\t\t\t}\n\t\t\t\t\treturn sorted;\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn val;\n\t\t};\n\n\t\tconst result = JSON.stringify(value, replacer);\n\t\tif (result.length > MAX_VALUE_SIZE) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn result;\n\t} catch (error) {\n\t\treturn null;\n\t}\n}\n\n/**\n * Compute SHA-256 digest of value\n */\nexport function computeDigest(value: unknown): string | null {\n\tconst serialized = stableStringify(value);\n\tif (!serialized) {\n\t\treturn null;\n\t}\n\treturn crypto.createHash('sha256').update(serialized).digest('base64url');\n}\n\n/**\n * Get client secret (Phase 1: single secret from env)\n */\nexport function getClientSecret(clientId: string): string {\n\tconst secret = process.env.PROVENANCE_SECRET;\n\tif (!secret) {\n\t\tthrow new Error(\n\t\t\t'PROVENANCE_SECRET environment variable is required for provenance tracking. ' +\n\t\t\t\t'Generate a strong secret with: openssl rand -base64 32'\n\t\t);\n\t}\n\t// Validate secret length - must be at least 32 bytes\n\t// Base64 encoding: 32 bytes = 44 chars, but we'll check raw byte length\n\tconst secretBytes = Buffer.from(secret, 'utf-8').length;\n\tif (secretBytes < 32) {\n\t\tthrow new Error(\n\t\t\t`PROVENANCE_SECRET must be at least 32 bytes (currently ${secretBytes} bytes). ` +\n\t\t\t\t'Generate a strong secret with: openssl rand -base64 32'\n\t\t);\n\t}\n\treturn secret;\n}\n\n/**\n * Generate HMAC signature\n */\nfunction hmacSign(data: string, secret: string): string {\n\treturn crypto.createHmac('sha256', secret).update(data).digest('base64url');\n}\n\n/**\n * Issue a provenance token for a value\n */\nexport async function issueProvenanceToken(\n\tmetadata: ProvenanceMetadata,\n\tvalue: unknown,\n\tclientId: string,\n\texecutionId: string,\n\tcacheProvider: CacheProvider,\n\tttl: number = 3600\n): Promise<string | null> {\n\tconst valueDigest = computeDigest(value);\n\tif (!valueDigest) {\n\t\treturn null;\n\t}\n\n\tconst metaId = nanoid();\n\tconst cacheKey = `prov:meta:${clientId}:${metaId}`;\n\n\ttry {\n\t\tawait cacheProvider.set(cacheKey, JSON.stringify(metadata), ttl);\n\n\t\tif (typeof value === 'string' || typeof value === 'number') {\n\t\t\tconst valueKey = `prov:value:${clientId}:${valueDigest}`;\n\t\t\tawait cacheProvider.set(valueKey, JSON.stringify({ value: String(value), metaId }), ttl);\n\t\t}\n\t} catch (error) {\n\t\tlog.error('Failed to store provenance metadata in cache', { error });\n\t\treturn null;\n\t}\n\n\tconst payload: TokenPayload = {\n\t\tv: 1,\n\t\tclientId,\n\t\texecutionId,\n\t\tcreatedAt: Date.now(),\n\t\texpiresAt: Date.now() + ttl * 1000,\n\t\tvalueDigest,\n\t\tmetaId,\n\t};\n\n\tconst payloadStr = JSON.stringify(payload);\n\tconst payloadB64 = Buffer.from(payloadStr).toString('base64url');\n\tconst secret = getClientSecret(clientId);\n\tconst signature = hmacSign(payloadB64, secret);\n\n\treturn `${payloadB64}.${signature}`;\n}\n\n/**\n * Verify and extract provenance from a token\n */\nexport async function verifyProvenanceToken(\n\ttoken: string,\n\tvalue: unknown,\n\tclientId: string,\n\texecutionId: string,\n\tcacheProvider: CacheProvider\n): Promise<ProvenanceMetadata | null> {\n\ttry {\n\t\tconst parts = token.split('.');\n\t\tif (parts.length !== 2) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst [payloadB64, signature] = parts;\n\t\tif (!payloadB64 || !signature) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst secret = getClientSecret(clientId);\n\t\tconst expectedSig = hmacSign(payloadB64, secret);\n\n\t\t// Use constant-time comparison to prevent timing attacks\n\t\ttry {\n\t\t\tconst sigBuf = Buffer.from(signature, 'base64url');\n\t\t\tconst expectedBuf = Buffer.from(expectedSig, 'base64url');\n\n\t\t\tif (sigBuf.length !== expectedBuf.length || !crypto.timingSafeEqual(sigBuf, expectedBuf)) {\n\t\t\t\tlog.error('Token signature verification failed');\n\t\t\t\treturn null;\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tlog.error('Token signature comparison error', { error });\n\t\t\treturn null;\n\t\t}\n\n\t\tconst payloadStr = Buffer.from(payloadB64, 'base64url').toString();\n\t\tconst payload: TokenPayload = JSON.parse(payloadStr);\n\n\t\tif (payload.v !== 1) {\n\t\t\tlog.error('Unsupported token version', { version: payload.v });\n\t\t\treturn null;\n\t\t}\n\n\t\tif (payload.clientId !== clientId) {\n\t\t\tlog.error('Token clientId mismatch', {\n\t\t\t\ttokenClientId: payload.clientId,\n\t\t\t\texpectedClientId: clientId,\n\t\t\t});\n\t\t\treturn null;\n\t\t}\n\n\t\tif (payload.executionId !== executionId) {\n\t\t\tlog.error('Token executionId mismatch', {\n\t\t\t\ttokenExecutionId: payload.executionId,\n\t\t\t\texpectedExecutionId: executionId,\n\t\t\t});\n\t\t\treturn null;\n\t\t}\n\n\t\tif (Date.now() > payload.expiresAt) {\n\t\t\tlog.warn('Token expired');\n\t\t\treturn null;\n\t\t}\n\n\t\tconst valueDigest = computeDigest(value);\n\t\tif (!valueDigest || valueDigest !== payload.valueDigest) {\n\t\t\tlog.warn('Token value digest mismatch (value may have been modified)');\n\t\t\treturn null;\n\t\t}\n\n\t\tconst cacheKey = `prov:meta:${payload.clientId}:${payload.metaId}`;\n\t\tconst metaStr = await cacheProvider.get(cacheKey);\n\n\t\tif (!metaStr || typeof metaStr !== 'string') {\n\t\t\tlog.warn('Token metadata not found in cache (expired or evicted)');\n\t\t\treturn null;\n\t\t}\n\n\t\tconst metadata: ProvenanceMetadata = JSON.parse(metaStr);\n\t\treturn metadata;\n\t} catch (error) {\n\t\tlog.error('Token verification error', { error });\n\t\treturn null;\n\t}\n}\n\n/**\n * Verify multiple hints and build a digest → metadata map\n * Returns map for O(1) lookup during re-attachment\n * ALSO returns a value → metadata map for substring matching\n */\nexport async function verifyProvenanceHints(\n\thints: string[],\n\tclientId: string,\n\texecutionId: string,\n\tcacheProvider: CacheProvider,\n\tmaxHints: number = 1000\n): Promise<Map<string, ProvenanceMetadata>> {\n\tconst map = new Map<string, ProvenanceMetadata>();\n\n\tconst hintsToProcess = hints.slice(0, maxHints);\n\tif (hints.length > maxHints) {\n\t\tlog.warn(`Capped provenance hints from ${hints.length} to ${maxHints}`);\n\t}\n\n\tconst timeout = 100;\n\tconst promises = hintsToProcess.map(async (token) => {\n\t\ttry {\n\t\t\tconst parts = token.split('.');\n\t\t\tif (parts.length !== 2) return;\n\n\t\t\tconst [payloadB64] = parts;\n\t\t\tif (!payloadB64) return;\n\n\t\t\tconst payloadStr = Buffer.from(payloadB64, 'base64url').toString();\n\t\t\tconst payload: TokenPayload = JSON.parse(payloadStr);\n\n\t\t\tconst cacheKey = `prov:meta:${payload.clientId}:${payload.metaId}`;\n\n\t\t\tconst fetchPromise = cacheProvider.get(cacheKey);\n\t\t\tconst timeoutPromise = new Promise<null>((resolve) =>\n\t\t\t\tsetTimeout(() => resolve(null), timeout)\n\t\t\t);\n\n\t\t\tconst metaStr = await Promise.race([fetchPromise, timeoutPromise]);\n\n\t\t\tif (metaStr && typeof metaStr === 'string') {\n\t\t\t\tconst metadata: ProvenanceMetadata = JSON.parse(metaStr);\n\t\t\t\tmap.set(payload.valueDigest, metadata);\n\n\t\t\t\tconst valueKey = `prov:value:${payload.clientId}:${payload.valueDigest}`;\n\t\t\t\tconst valueStr = await Promise.race([\n\t\t\t\t\tcacheProvider.get(valueKey),\n\t\t\t\t\tnew Promise<null>((resolve) => setTimeout(() => resolve(null), timeout)),\n\t\t\t\t]);\n\n\t\t\t\tif (valueStr && typeof valueStr === 'string') {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst { value } = JSON.parse(valueStr);\n\t\t\t\t\t\t(map as any).__valueMap = (map as any).__valueMap || new Map();\n\t\t\t\t\t\t(map as any).__valueMap.set(value, metadata);\n\t\t\t\t\t} catch (e) {\n\t\t\t\t\t\t// Value parsing failed, skip\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (error) {\n\t\t\t// Skip invalid tokens silently\n\t\t}\n\t});\n\n\tawait Promise.all(promises);\n\n\treturn map;\n}\n","import type { ProvenanceMetadata } from './types.js';\n\n/**\n * Interface for Provenance Storage (supports distributed/async)\n */\nexport interface ProvenanceStore {\n\t/**\n\t * Get metadata by ID\n\t */\n\tget(id: string): Promise<ProvenanceMetadata | null>;\n\n\t/**\n\t * Get multiple metadata items by ID\n\t */\n\tgetBatch(ids: string[]): Promise<Map<string, ProvenanceMetadata>>;\n\n\t/**\n\t * Save metadata\n\t */\n\tset(id: string, metadata: ProvenanceMetadata, executionId?: string): Promise<void>;\n\n\t/**\n\t * Get primitive metadata by key\n\t */\n\tgetPrimitive(key: string): Promise<ProvenanceMetadata | null>;\n\n\t/**\n\t * Save primitive metadata\n\t */\n\tsetPrimitive(key: string, metadata: ProvenanceMetadata, executionId?: string): Promise<void>;\n\n\t/**\n\t * Cleanup all data associated with an execution ID\n\t */\n\tcleanupExecution(executionId: string): Promise<void>;\n\n\t/**\n\t * Get all provenance metadata associated with an execution ID\n\t * Used for hydrating a new pod when resuming execution\n\t */\n\tgetExecution(executionId: string): Promise<Map<string, ProvenanceMetadata>>;\n}\n\n/**\n * In-Memory implementation of ProvenanceStore (Default)\n * Acts as a monolithic store (like the original implementation)\n */\nexport class InMemoryProvenanceStore implements ProvenanceStore {\n\tprivate registry = new Map<string, ProvenanceMetadata>();\n\tprivate primitives = new Map<string, ProvenanceMetadata>();\n\tprivate executionIds = new Map<string, Set<string>>();\n\tprivate executionPrimitives = new Map<string, Set<string>>();\n\n\tasync get(id: string): Promise<ProvenanceMetadata | null> {\n\t\treturn this.registry.get(id) || null;\n\t}\n\n\tasync getBatch(ids: string[]): Promise<Map<string, ProvenanceMetadata>> {\n\t\tconst result = new Map<string, ProvenanceMetadata>();\n\t\tfor (const id of ids) {\n\t\t\tconst meta = this.registry.get(id);\n\t\t\tif (meta) {\n\t\t\t\tresult.set(id, meta);\n\t\t\t}\n\t\t}\n\t\treturn result;\n\t}\n\n\tasync set(id: string, metadata: ProvenanceMetadata, executionId?: string): Promise<void> {\n\t\tthis.registry.set(id, metadata);\n\n\t\tif (executionId) {\n\t\t\tlet ids = this.executionIds.get(executionId);\n\t\t\tif (!ids) {\n\t\t\t\tids = new Set();\n\t\t\t\tthis.executionIds.set(executionId, ids);\n\t\t\t}\n\t\t\tids.add(id);\n\t\t}\n\t}\n\n\tasync getPrimitive(key: string): Promise<ProvenanceMetadata | null> {\n\t\treturn this.primitives.get(key) || null;\n\t}\n\n\tasync setPrimitive(\n\t\tkey: string,\n\t\tmetadata: ProvenanceMetadata,\n\t\texecutionId?: string\n\t): Promise<void> {\n\t\tthis.primitives.set(key, metadata);\n\n\t\tif (executionId) {\n\t\t\tlet keys = this.executionPrimitives.get(executionId);\n\t\t\tif (!keys) {\n\t\t\t\tkeys = new Set();\n\t\t\t\tthis.executionPrimitives.set(executionId, keys);\n\t\t\t}\n\t\t\tkeys.add(key);\n\t\t}\n\t}\n\n\tasync cleanupExecution(executionId: string): Promise<void> {\n\t\tconst ids = this.executionIds.get(executionId);\n\t\tif (ids) {\n\t\t\tfor (const id of ids) {\n\t\t\t\tthis.registry.delete(id);\n\t\t\t}\n\t\t\tthis.executionIds.delete(executionId);\n\t\t}\n\n\t\tconst primKeys = this.executionPrimitives.get(executionId);\n\t\tif (primKeys) {\n\t\t\tfor (const key of primKeys) {\n\t\t\t\tthis.primitives.delete(key);\n\t\t\t}\n\t\t\tthis.executionPrimitives.delete(executionId);\n\t\t}\n\t}\n\n\tasync getExecution(executionId: string): Promise<Map<string, ProvenanceMetadata>> {\n\t\tconst result = new Map<string, ProvenanceMetadata>();\n\t\tconst ids = this.executionIds.get(executionId);\n\t\tif (ids) {\n\t\t\tfor (const id of ids) {\n\t\t\t\tconst meta = this.registry.get(id);\n\t\t\t\tif (meta) {\n\t\t\t\t\tresult.set(id, meta);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn result;\n\t}\n}\n","import { nanoid } from 'nanoid';\nimport { log } from '@mondaydotcomorg/atp-runtime';\nimport type {\n\tProvenanceMetadata,\n\tSourceMetadata,\n\tReaderPermissions,\n\tProvenanceState,\n} from './types.js';\nimport { computeDigest } from './tokens.js';\nimport { type ProvenanceStore, InMemoryProvenanceStore } from './store.js';\n\nconst PROVENANCE_KEY = '__provenance__';\nconst PROVENANCE_ID_KEY = '__prov_id__';\nconst provenanceStore = new WeakMap<object, ProvenanceMetadata>();\n\nconst provenanceRegistry = new Map<string, ProvenanceMetadata>();\n\nconst executionProvenanceIds = new Map<string, Set<string>>();\n\nlet currentExecutionId: string | null = null;\n\nconst primitiveProvenanceMap = new Map<string, ProvenanceMetadata>();\n\nconst executionTaintedPrimitives = new Map<string, Set<unknown>>();\n\nlet globalStore: ProvenanceStore = new InMemoryProvenanceStore();\n\n/**\n * Set the global provenance store implementation\n */\nexport function setGlobalProvenanceStore(store: ProvenanceStore): void {\n\tglobalStore = store;\n}\n\n/**\n * Mark a primitive value as tainted (derived from tool data)\n * Used by AST mode to track derived values\n */\nexport function markPrimitiveTainted(value: unknown, sourceMetadata: ProvenanceMetadata): void {\n\tif (typeof value !== 'string' && typeof value !== 'number') {\n\t\treturn;\n\t}\n\n\tif (currentExecutionId) {\n\t\tconst tainted = executionTaintedPrimitives.get(currentExecutionId);\n\t\tif (tainted) {\n\t\t\ttainted.add(value);\n\t\t}\n\t}\n\n\tconst key = `tainted:${String(value)}`;\n\tprimitiveProvenanceMap.set(key, sourceMetadata);\n\n\tglobalStore.setPrimitive(key, sourceMetadata, currentExecutionId || undefined).catch((err) => {\n\t\tlog.warn('Failed to save primitive taint to provenance store', { error: err });\n\t});\n}\n\n/**\n * Check if a primitive is tainted (derived from tool data)\n */\nexport function isPrimitiveTainted(value: unknown): boolean {\n\tif (typeof value !== 'string' && typeof value !== 'number') {\n\t\treturn false;\n\t}\n\n\tif (currentExecutionId) {\n\t\tconst tainted = executionTaintedPrimitives.get(currentExecutionId);\n\t\tif (tainted && tainted.has(value)) {\n\t\t\treturn true;\n\t\t}\n\t}\n\n\treturn false;\n}\n\n/**\n * Set the current execution ID for provenance tracking\n * MUST be called at start of each execution to prevent memory leaks\n */\nexport function setProvenanceExecutionId(executionId: string): void {\n\tcurrentExecutionId = executionId;\n\tif (!executionProvenanceIds.has(executionId)) {\n\t\texecutionProvenanceIds.set(executionId, new Set());\n\t}\n\tif (!executionTaintedPrimitives.has(executionId)) {\n\t\texecutionTaintedPrimitives.set(executionId, new Set());\n\t}\n}\n\n/**\n * Clear the current execution ID\n */\nexport function clearProvenanceExecutionId(): void {\n\tcurrentExecutionId = null;\n}\n\n/**\n * Hydrate provenance metadata for an execution (Multi-pod support)\n * Call this when resuming an execution on a new pod to warm up the local cache\n */\nexport async function hydrateProvenance(ids: string[]): Promise<void> {\n\tconst batch = await globalStore.getBatch(ids);\n\tfor (const [id, metadata] of batch.entries()) {\n\t\tprovenanceRegistry.set(id, metadata);\n\t\tif (currentExecutionId) {\n\t\t\tlet execIds = executionProvenanceIds.get(currentExecutionId);\n\t\t\tif (!execIds) {\n\t\t\t\texecIds = new Set();\n\t\t\t\texecutionProvenanceIds.set(currentExecutionId, execIds);\n\t\t\t}\n\t\t\texecIds.add(id);\n\t\t}\n\t}\n}\n\n/**\n * Hydrate all provenance for a specific execution ID (if store supports tracking by execution)\n * Note: Standard InMemoryProvenanceStore tracks execution IDs, but Redis implementations might need explicit sets\n */\nexport async function hydrateExecutionProvenance(executionId: string): Promise<void> {\n\tconst batch = await globalStore.getExecution(executionId);\n\tfor (const [id, metadata] of batch.entries()) {\n\t\tprovenanceRegistry.set(id, metadata);\n\n\t\t// Also track in current execution context (re-bind to new execution scope if needed)\n\t\t// Or just ensure it's in registry for reading.\n\t\t// Typically, we just want it available for reading.\n\t\t// If we want to ensure cleanup works for the *new* resumed execution, we might need to track it.\n\t\t// But usually resumed execution has same ID?\n\t\t// If executionId passed here IS the currentExecutionId, we track it.\n\n\t\tif (currentExecutionId === executionId) {\n\t\t\tlet executionSet = executionProvenanceIds.get(executionId);\n\t\t\tif (!executionSet) {\n\t\t\t\texecutionSet = new Set();\n\t\t\t\texecutionProvenanceIds.set(executionId, executionSet);\n\t\t\t}\n\t\t\texecutionSet.add(id);\n\t\t}\n\t}\n}\n\n/**\n * Register provenance metadata directly (for AST tracking in isolated-vm)\n */\nexport function registerProvenanceMetadata(\n\tid: string,\n\tmetadata: ProvenanceMetadata,\n\texecutionId?: string\n): void {\n\tif (id.startsWith('tainted:') || id.includes(':')) {\n\t\tprimitiveProvenanceMap.set(id, metadata);\n\n\t\tglobalStore.setPrimitive(id, metadata, executionId).catch((err) => {\n\t\t\tlog.warn('Failed to save primitive provenance to store', { error: err });\n\t\t});\n\n\t\tif (id.startsWith('tainted:')) {\n\t\t\tconst value = id.slice('tainted:'.length);\n\t\t\tif (executionId) {\n\t\t\t\tlet tainted = executionTaintedPrimitives.get(executionId);\n\t\t\t\tif (!tainted) {\n\t\t\t\t\ttainted = new Set();\n\t\t\t\t\texecutionTaintedPrimitives.set(executionId, tainted);\n\t\t\t\t}\n\t\t\t\ttainted.add(value);\n\t\t\t}\n\t\t}\n\t} else {\n\t\tprovenanceRegistry.set(id, metadata);\n\t\tglobalStore.set(id, metadata, executionId).catch((err) => {\n\t\t\tlog.warn('Failed to save provenance to store', { error: err });\n\t\t});\n\t}\n\n\tif (executionId) {\n\t\tlet ids = executionProvenanceIds.get(executionId);\n\t\tif (!ids) {\n\t\t\tids = new Set();\n\t\t\texecutionProvenanceIds.set(executionId, ids);\n\t\t}\n\t\tids.add(id);\n\t}\n}\n\n/**\n * Cleanup provenance for a specific execution to prevent memory leaks\n * MUST be called after execution completes or fails\n */\nexport function cleanupProvenanceForExecution(executionId: string): void {\n\tconst ids = executionProvenanceIds.get(executionId);\n\tif (ids) {\n\t\tfor (const id of ids) {\n\t\t\tprovenanceRegistry.delete(id);\n\t\t\tconst keysToDelete: string[] = [];\n\t\t\tfor (const key of primitiveProvenanceMap.keys()) {\n\t\t\t\tif (key.startsWith(`${id}:`) || key.startsWith('tainted:')) {\n\t\t\t\t\tkeysToDelete.push(key);\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (const key of keysToDelete) {\n\t\t\t\tprimitiveProvenanceMap.delete(key);\n\t\t\t}\n\t\t}\n\t\texecutionProvenanceIds.delete(executionId);\n\t}\n\n\texecutionTaintedPrimitives.delete(executionId);\n\n\t// Cleanup from persistent store\n\tglobalStore.cleanupExecution(executionId).catch((err) => {\n\t\tlog.warn('Failed to cleanup provenance store', { error: err });\n\t});\n}\n\n/**\n * Check if a primitive value was extracted from a provenance-tracked object\n * This catches: const ssn = user.ssn; await send({ body: ssn })\n * Also checks if value is marked as tainted (AST mode)\n */\nexport function getProvenanceForPrimitive(value: unknown): ProvenanceMetadata | null {\n\tif (typeof value !== 'string' && typeof value !== 'number') {\n\t\treturn null;\n\t}\n\n\tconst valueStr = String(value);\n\n\tif (isPrimitiveTainted(value)) {\n\t\tconst taintedKey = `tainted:${valueStr}`;\n\t\tconst metadata = primitiveProvenanceMap.get(taintedKey);\n\t\tif (metadata) {\n\t\t\treturn metadata;\n\t\t}\n\t}\n\n\tconst taintedKey = `tainted:${valueStr}`;\n\tconst taintedMetadata = primitiveProvenanceMap.get(taintedKey);\n\tif (taintedMetadata) {\n\t\treturn taintedMetadata;\n\t}\n\n\tfor (const [key, metadata] of primitiveProvenanceMap.entries()) {\n\t\tconst parts = key.split(':');\n\t\tif (parts.length >= 3 && !key.startsWith('tainted:')) {\n\t\t\tconst primitiveValue = parts.slice(2).join(':');\n\t\t\tif (primitiveValue === valueStr) {\n\t\t\t\treturn metadata;\n\t\t\t}\n\t\t}\n\t}\n\n\tconst digest = computeDigest(value);\n\tif (digest) {\n\t\tconst digestMetadata = provenanceRegistry.get(digest);\n\t\tif (digestMetadata) {\n\t\t\treturn digestMetadata;\n\t\t}\n\t}\n\n\treturn null;\n}\n\n/**\n * Capture provenance state for pause/resume\n */\nexport function captureProvenanceState(executionId: string): Map<string, ProvenanceMetadata> {\n\tconst state = new Map<string, ProvenanceMetadata>();\n\tconst ids = executionProvenanceIds.get(executionId);\n\tif (ids) {\n\t\tfor (const id of ids) {\n\t\t\tconst metadata = provenanceRegistry.get(id);\n\t\t\tif (metadata) {\n\t\t\t\tstate.set(id, metadata);\n\t\t\t}\n\t\t}\n\t}\n\treturn state;\n}\n\n/**\n * Capture provenance snapshot including primitive taints for multi-step token persistence\n */\nexport function captureProvenanceSnapshot(executionId: string): {\n\tregistry: Array<[string, ProvenanceMetadata]>;\n\tprimitives: Array<[string, ProvenanceMetadata]>;\n} {\n\tconst registryMap = captureProvenanceState(executionId);\n\tconst registry = Array.from(registryMap.entries());\n\n\tconst primitives: Array<[string, ProvenanceMetadata]> = [];\n\tconst ids = executionProvenanceIds.get(executionId) || new Set<string>();\n\n\tconst tainted = executionTaintedPrimitives.get(executionId);\n\tif (tainted) {\n\t\tfor (const value of tainted) {\n\t\t\tconst key = `tainted:${String(value)}`;\n\t\t\tconst meta = primitiveProvenanceMap.get(key);\n\t\t\tif (meta) {\n\t\t\t\tprimitives.push([key, meta]);\n\t\t\t}\n\t\t}\n\t}\n\n\tfor (const [key, meta] of primitiveProvenanceMap.entries()) {\n\t\tif (key.startsWith('tainted:')) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst [first] = key.split(':');\n\t\tif (first && ids.has(first)) {\n\t\t\tprimitives.push([key, meta]);\n\t\t}\n\t}\n\n\treturn { registry, primitives };\n}\n\n/**\n * Restore provenance state after resume\n */\nexport function restoreProvenanceState(\n\texecutionId: string,\n\tstate: Map<string, ProvenanceMetadata>\n): void {\n\tsetProvenanceExecutionId(executionId);\n\tconst ids = executionProvenanceIds.get(executionId)!;\n\n\tfor (const [id, metadata] of state) {\n\t\tprovenanceRegistry.set(id, metadata);\n\t\tids.add(id);\n\t\tglobalStore.set(id, metadata, executionId).catch((err) => {\n\t\t\tlog.error('Failed to save provenance to store', { error: err });\n\t\t});\n\t}\n}\n\n/**\n * Restore provenance snapshot including primitive taints for multi-step token persistence\n */\nexport function restoreProvenanceSnapshot(\n\texecutionId: string,\n\tsnapshot: {\n\t\tregistry: Array<[string, ProvenanceMetadata]>;\n\t\tprimitives: Array<[string, ProvenanceMetadata]>;\n\t}\n): void {\n\tconst registryMap = new Map(snapshot.registry);\n\trestoreProvenanceState(executionId, registryMap);\n\n\tfor (const [key, meta] of snapshot.primitives) {\n\t\tprimitiveProvenanceMap.set(key, meta);\n\t\tglobalStore.setPrimitive(key, meta, executionId).catch((err) => {\n\t\t\tlog.error('Failed to save primitive provenance to store', { error: err });\n\t\t});\n\n\t\tif (key.startsWith('tainted:')) {\n\t\t\tconst value = key.slice('tainted:'.length);\n\t\t\tlet set = executionTaintedPrimitives.get(executionId);\n\t\t\tif (!set) {\n\t\t\t\tset = new Set();\n\t\t\t\texecutionTaintedPrimitives.set(executionId, set);\n\t\t\t}\n\t\t\tset.add(value);\n\t\t}\n\t}\n}\n\n/**\n * Create a provenance-tracked value\n * SOLUTION: Store metadata in global registry, attach only ID to object\n * The ID (simple string) SURVIVES isolated-vm cloning\n *\n * For objects, also wraps in Proxy to track primitive extractions\n */\nexport function createProvenanceProxy<T>(\n\tvalue: T,\n\tsource: SourceMetadata,\n\treaders: ReaderPermissions = { type: 'public' },\n\tdependencies: string[] = []\n): T {\n\tif (value === null || value === undefined) {\n\t\treturn value;\n\t}\n\n\tif (typeof value !== 'object' && typeof value !== 'function') {\n\t\treturn value;\n\t}\n\n\tconst id = nanoid();\n\tconst metadata: ProvenanceMetadata = {\n\t\tid,\n\t\tsource,\n\t\treaders,\n\t\tdependencies,\n\t\tcontext: {},\n\t};\n\n\tprovenanceRegistry.set(id, metadata);\n\n\tif (currentExecutionId) {\n\t\tconst ids = executionProvenanceIds.get(currentExecutionId);\n\t\tif (ids) {\n\t\t\tids.add(id);\n\t\t}\n\t}\n\n\tglobalStore.set(id, metadata, currentExecutionId || undefined).catch((err) => {\n\t\tlog.warn('Failed to persist provenance to store', { error: err });\n\t});\n\n\ttry {\n\t\tObject.defineProperty(value, PROVENANCE_ID_KEY, {\n\t\t\tvalue: id,\n\t\t\twritable: false,\n\t\t\tenumerable: true,\n\t\t\tconfigurable: true,\n\t\t\t// @ts-ignore\n\t\t\t__proto__: null,\n\t\t});\n\t} catch (e) {\n\t\tprovenanceStore.set(value as object, metadata);\n\t}\n\n\tif (Array.isArray(value)) {\n\t\tfor (const item of value) {\n\t\t\tif (typeof item === 'object' && item !== null && !hasProvenance(item)) {\n\t\t\t\tcreateProvenanceProxy(item, source, readers, [id, ...dependencies]);\n\t\t\t}\n\t\t}\n\t} else if (typeof value === 'object') {\n\t\tfor (const key in value as Record<string, unknown>) {\n\t\t\tif (Object.prototype.hasOwnProperty.call(value, key) && key !== PROVENANCE_ID_KEY) {\n\t\t\t\tconst nestedValue = (value as Record<string, unknown>)[key];\n\t\t\t\tif (\n\t\t\t\t\ttypeof nestedValue === 'object' &&\n\t\t\t\t\tnestedValue !== null &&\n\t\t\t\t\t!hasProvenance(nestedValue)\n\t\t\t\t) {\n\t\t\t\t\tcreateProvenanceProxy(nestedValue, source, readers, [id, ...dependencies]);\n\t\t\t\t} else if (typeof nestedValue === 'string' || typeof nestedValue === 'number') {\n\t\t\t\t\tconst primitiveKey = `${id}:${key}:${String(nestedValue)}`;\n\t\t\t\t\tprimitiveProvenanceMap.set(primitiveKey, metadata);\n\t\t\t\t\tglobalStore\n\t\t\t\t\t\t.setPrimitive(primitiveKey, metadata, currentExecutionId || undefined)\n\t\t\t\t\t\t.catch((err) => {\n\t\t\t\t\t\t\tlog.error('Failed to save primitive provenance to store', { error: err });\n\t\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn value;\n}\n\n/**\n * Get provenance metadata from a value\n * Looks up by ID from global registry (survives isolated-vm cloning)\n */\nexport function getProvenance(value: unknown): ProvenanceMetadata | null {\n\tif (value === null || value === undefined) {\n\t\treturn null;\n\t}\n\n\tif (typeof value === 'string' || typeof value === 'number') {\n\t\tconst primitiveProvenance = getProvenanceForPrimitive(value);\n\t\tif (primitiveProvenance) {\n\t\t\treturn primitiveProvenance;\n\t\t}\n\t}\n\n\tif (typeof value === 'object') {\n\t\tconst id = (value as any)[PROVENANCE_ID_KEY];\n\t\tif (id && typeof id === 'string') {\n\t\t\tconst metadata = provenanceRegistry.get(id);\n\t\t\tif (metadata) {\n\t\t\t\treturn metadata;\n\t\t\t}\n\t\t}\n\n\t\tif (PROVENANCE_KEY in (value as any)) {\n\t\t\treturn (value as any)[PROVENANCE_KEY];\n\t\t}\n\n\t\tconst stored = provenanceStore.get(value as object);\n\t\tif (stored) {\n\t\t\treturn stored;\n\t\t}\n\t}\n\n\treturn null;\n}\n\n/**\n * Check if a value has provenance tracking\n */\nexport function hasProvenance(value: unknown): boolean {\n\treturn getProvenance(value) !== null;\n}\n\n/**\n * Get all provenance metadata in an object recursively\n */\nexport function getAllProvenance(value: unknown, visited = new Set<any>()): ProvenanceMetadata[] {\n\tif (value === null || value === undefined || typeof value !== 'object') {\n\t\treturn [];\n\t}\n\n\tif (visited.has(value)) {\n\t\treturn [];\n\t}\n\tvisited.add(value);\n\n\tconst results: ProvenanceMetadata[] = [];\n\tconst metadata = getProvenance(value);\n\n\tif (metadata) {\n\t\tresults.push(metadata);\n\t}\n\n\tif (Array.isArray(value)) {\n\t\tfor (const item of value) {\n\t\t\tresults.push(...getAllProvenance(item, visited));\n\t\t}\n\t} else if (typeof value === 'object') {\n\t\tfor (const key in value) {\n\t\t\tif (\n\t\t\t\tkey !== PROVENANCE_KEY &&\n\t\t\t\tkey !== PROVENANCE_ID_KEY &&\n\t\t\t\tObject.prototype.hasOwnProperty.call(value, key)\n\t\t\t) {\n\t\t\t\tresults.push(...getAllProvenance((value as any)[key], visited));\n\t\t\t}\n\t\t}\n\t}\n\n\treturn results;\n}\n\n/**\n * Merge reader permissions (intersection for security)\n */\nexport function mergeReaders(\n\treaders1: ReaderPermissions,\n\treaders2: ReaderPermissions\n): ReaderPermissions {\n\tif (readers1.type === 'public') {\n\t\treturn readers2;\n\t}\n\tif (readers2.type === 'public') {\n\t\treturn readers1;\n\t}\n\n\tconst intersection = readers1.readers.filter((r: string) => readers2.readers.includes(r));\n\treturn { type: 'restricted', readers: intersection };\n}\n\n/**\n * Check if a reader can access data with given permissions\n */\nexport function canRead(reader: string, permissions: ReaderPermissions): boolean {\n\tif (permissions.type === 'public') {\n\t\treturn true;\n\t}\n\treturn permissions.readers.includes(reader);\n}\n\n/**\n * Extract provenance for serialization (pause/resume)\n */\nexport function extractProvenanceMap(\n\tsandbox: Record<string, unknown>\n): Map<string, ProvenanceMetadata> {\n\tconst provenanceMap = new Map<string, ProvenanceMetadata>();\n\tconst visited = new Set<any>();\n\n\tfunction traverse(value: unknown, path: string = '') {\n\t\tif (value === null || value === undefined || typeof value !== 'object') {\n\t\t\treturn;\n\t\t}\n\n\t\tif (visited.has(value)) {\n\t\t\treturn;\n\t\t}\n\t\tvisited.add(value);\n\n\t\tconst metadata = getProvenance(value);\n\t\tif (metadata) {\n\t\t\tprovenanceMap.set(path || metadata.id, metadata);\n\t\t}\n\n\t\tif (Array.isArray(value)) {\n\t\t\tvalue.forEach((item, index) => {\n\t\t\t\ttraverse(item, `${path}[${index}]`);\n\t\t\t});\n\t\t} else if (typeof value === 'object') {\n\t\t\tfor (const key in value) {\n\t\t\t\tif (Object.prototype.hasOwnProperty.call(value, key)) {\n\t\t\t\t\ttraverse((value as any)[key], path ? `${path}.${key}` : key);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tfor (const [key, value] of Object.entries(sandbox)) {\n\t\ttraverse(value, key);\n\t}\n\n\treturn provenanceMap;\n}\n\n/**\n * Restore provenance from serialized state\n */\nexport function restoreProvenanceMap(\n\tprovenanceMap: Map<string, ProvenanceMetadata>,\n\tsandbox: Record<string, unknown>\n): void {\n\tfor (const [path, metadata] of provenanceMap.entries()) {\n\t\tconst value = resolvePath(sandbox, path);\n\t\tif (value !== undefined && typeof value === 'object') {\n\t\t\tprovenanceStore.set(value as object, metadata);\n\t\t}\n\t}\n}\n\nfunction resolvePath(obj: Record<string, unknown>, path: string): unknown {\n\tconst parts = path.split(/[\\.\\[]/).map((p) => p.replace(/\\]$/, ''));\n\tlet current: any = obj;\n\n\tfor (const part of parts) {\n\t\tif (current === null || current === undefined) {\n\t\t\treturn undefined;\n\t\t}\n\t\tcurrent = current[part];\n\t}\n\n\treturn current;\n}\n","/**\n * Security Policy Engine\n *\n */\nimport type { SecurityPolicy, PolicyResult, ProvenanceMetadata, PolicyAction } from '../types.js';\nimport { ProvenanceSecurityError, ProvenanceSource } from '../types.js';\nimport {\n\tgetProvenance,\n\tgetAllProvenance,\n\tcanRead,\n\tgetProvenanceForPrimitive,\n} from '../registry.js';\n\nexport interface Logger {\n\tdebug: (msg: string, obj?: any) => void;\n\tinfo: (msg: string, obj?: any) => void;\n\twarn: (msg: string, obj?: any) => void;\n\terror: (msg: string, obj?: any) => void;\n}\n\nexport class SecurityPolicyEngine {\n\tprivate policies: SecurityPolicy[];\n\tprivate logger: Logger;\n\tprivate approvalCallback?: (\n\t\tmessage: string,\n\t\tcontext: Record<string, unknown>\n\t) => Promise<boolean>;\n\tprivate customGetProvenance?: (value: unknown) => any;\n\n\tconstructor(\n\t\tpolicies: SecurityPolicy[],\n\t\tlogger: Logger,\n\t\tcustomGetProvenance?: (value: unknown) => any\n\t) {\n\t\tthis.policies = policies;\n\t\tthis.logger = logger;\n\t\tthis.customGetProvenance = customGetProvenance;\n\t}\n\n\t/**\n\t * Set a custom getProvenance function (e.g., for AST mode)\n\t */\n\tsetGetProvenance(fn: (value: unknown) => any): void {\n\t\tthis.customGetProvenance = fn;\n\t}\n\n\t/**\n\t * Set approval callback for policies that return action='approve'\n\t */\n\tsetApprovalCallback(\n\t\tcallback: (message: string, context: Record<string, unknown>) => Promise<boolean>\n\t): void {\n\t\tthis.approvalCallback = callback;\n\t}\n\n\tasync checkTool(\n\t\ttoolName: string,\n\t\tapiGroup: string,\n\t\targs: Record<string, unknown>\n\t): Promise<void> {\n\t\tthis.logger.debug('Checking security policies', {\n\t\t\ttoolName,\n\t\t\tapiGroup,\n\t\t\tpolicyCount: this.policies.length,\n\t\t});\n\n\t\t// Use custom getProvenance if available, otherwise use default\n\t\tconst getProvenanceFn = this.customGetProvenance || getProvenance;\n\n\t\tfor (const policy of this.policies) {\n\t\t\tconst result = await policy.check(toolName, args, getProvenanceFn);\n\n\t\t\tconst action = this.normalizeAction(result);\n\n\t\t\tif (action === 'block') {\n\t\t\t\tthis.logger.warn('Security policy blocked tool execution', {\n\t\t\t\t\ttoolName,\n\t\t\t\t\tapiGroup,\n\t\t\t\t\tpolicy: policy.name,\n\t\t\t\t\treason: result.reason,\n\t\t\t\t});\n\n\t\t\t\tthrow new ProvenanceSecurityError(\n\t\t\t\t\tresult.reason || `Policy ${policy.name} denied execution`,\n\t\t\t\t\tpolicy.name,\n\t\t\t\t\ttoolName,\n\t\t\t\t\t{ apiGroup, args: this.sanitizeArgs(args), context: result.context }\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tif (action === 'approve') {\n\t\t\t\tthis.logger.info('Security policy requires approval', {\n\t\t\t\t\ttoolName,\n\t\t\t\t\tapiGroup,\n\t\t\t\t\tpolicy: policy.name,\n\t\t\t\t\treason: result.reason,\n\t\t\t\t});\n\n\t\t\t\tconst approved = await this.requestApproval(toolName, apiGroup, policy.name, result);\n\n\t\t\t\tif (!approved) {\n\t\t\t\t\tthis.logger.warn('Security policy approval denied', {\n\t\t\t\t\t\ttoolName,\n\t\t\t\t\t\tapiGroup,\n\t\t\t\t\t\tpolicy: policy.name,\n\t\t\t\t\t});\n\n\t\t\t\t\tthrow new ProvenanceSecurityError(\n\t\t\t\t\t\t`Approval denied: ${result.reason || 'Operation requires approval'}`,\n\t\t\t\t\t\tpolicy.name,\n\t\t\t\t\t\ttoolName,\n\t\t\t\t\t\t{ apiGroup, args: this.sanitizeArgs(args), approvalDenied: true }\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tthis.logger.info('Security policy approval granted', {\n\t\t\t\t\ttoolName,\n\t\t\t\t\tapiGroup,\n\t\t\t\t\tpolicy: policy.name,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (action === 'log') {\n\t\t\t\tthis.logger.warn('Security policy audit event', {\n\t\t\t\t\ttoolName,\n\t\t\t\t\tapiGroup,\n\t\t\t\t\tpolicy: policy.name,\n\t\t\t\t\treason: result.reason,\n\t\t\t\t\tcontext: result.context,\n\t\t\t\t\targs: this.sanitizeArgs(args),\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\tthis.logger.debug('All security policies passed', { toolName, apiGroup });\n\t}\n\n\tprivate normalizeAction(result: PolicyResult): PolicyAction {\n\t\tif (result.action) {\n\t\t\treturn result.action;\n\t\t}\n\n\t\tif (result.allowed !== undefined) {\n\t\t\treturn result.allowed ? 'log' : 'block';\n\t\t}\n\n\t\treturn 'log';\n\t}\n\n\tprivate async requestApproval(\n\t\ttoolName: string,\n\t\tapiGroup: string,\n\t\tpolicyName: string,\n\t\tresult: PolicyResult\n\t): Promise<boolean> {\n\t\tif (!this.approvalCallback) {\n\t\t\tthis.logger.error('Approval required but no callback configured', {\n\t\t\t\ttoolName,\n\t\t\t\tpolicy: policyName,\n\t\t\t});\n\t\t\tthrow new ProvenanceSecurityError(\n\t\t\t\t'Approval required but approval handler not configured',\n\t\t\t\tpolicyName,\n\t\t\t\ttoolName,\n\t\t\t\t{ requiresApproval: true }\n\t\t\t);\n\t\t}\n\n\t\tconst message = result.reason || `Policy ${policyName} requires approval for ${toolName}`;\n\t\tconst context = {\n\t\t\ttoolName,\n\t\t\tapiGroup,\n\t\t\tpolicy: policyName,\n\t\t\t...(result.context || {}),\n\t\t};\n\n\t\ttry {\n\t\t\treturn await this.approvalCallback(message, context);\n\t\t} catch (error) {\n\t\t\tthis.logger.error('Approval request failed', { error, toolName, policy: policyName });\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tprivate sanitizeArgs(args: Record<string, unknown>): Record<string, unknown> {\n\t\tconst sanitized: Record<string, unknown> = {};\n\t\tfor (const [key, value] of Object.entries(args)) {\n\t\t\tif (typeof value === 'string' && value.length > 100) {\n\t\t\t\tsanitized[key] = value.substring(0, 100) + '...';\n\t\t\t} else if (typeof value === 'object') {\n\t\t\t\tsanitized[key] = '[object]';\n\t\t\t} else {\n\t\t\t\tsanitized[key] = value;\n\t\t\t}\n\t\t}\n\t\treturn sanitized;\n\t}\n}\n\n/**\n * Built-in Security Policies\n */\n\n/**\n * Helper: Get all provenance from args object, including scanning all nested values\n * This catches primitives that came from tool-originated objects\n */\nfunction getAllProvenanceFromArgs(\n\targs: Record<string, unknown>,\n\tgetProvenance: (value: unknown) => any\n): any[] {\n\tconst allProvenance: any[] = [];\n\tconst visited = new Set<any>();\n\n\tfunction scan(value: unknown) {\n\t\tif (value === null || value === undefined) return;\n\n\t\tif (typeof value === 'string' || typeof value === 'number') {\n\t\t\ttry {\n\t\t\t\tconst primitiveProv = getProvenance(value);\n\t\t\t\tif (primitiveProv) {\n\t\t\t\t\tallProvenance.push(primitiveProv);\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\t// Ignore errors during provenance lookup\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\tif (typeof value !== 'object') return;\n\t\tif (visited.has(value)) return;\n\t\tvisited.add(value);\n\n\t\tconst provenance = getProvenance(value);\n\t\tif (provenance) {\n\t\t\tallProvenance.push(provenance);\n\t\t}\n\n\t\tif (Array.isArray(value)) {\n\t\t\tfor (const item of value) {\n\t\t\t\tscan(item);\n\t\t\t}\n\t\t} else {\n\t\t\tfor (const key in value) {\n\t\t\t\tif (Object.prototype.hasOwnProperty.call(value, key)) {\n\t\t\t\t\tscan((value as any)[key]);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tfor (const key in args) {\n\t\tif (Object.prototype.hasOwnProperty.call(args, key)) {\n\t\t\tscan(args[key]);\n\t\t}\n\t}\n\n\treturn allProvenance;\n}\n\n/**\n * Prevent data exfiltration - blocks sending private data to unauthorized recipients\n */\nexport const preventDataExfiltration: SecurityPolicy = {\n\tname: 'prevent-data-exfiltration',\n\tdescription: 'Prevents sending data to recipients who cannot read it',\n\tcheck: (toolName, args, getProvenance) => {\n\t\tconst recipientKeys = ['to', 'recipient', 'recipients', 'email', 'address'];\n\t\tconst dataKeys = ['body', 'message', 'content', 'data', 'payload'];\n\n\t\tlet recipient: string | null = null;\n\t\tfor (const key of recipientKeys) {\n\t\t\tif (args[key] && typeof args[key] === 'string') {\n\t\t\t\trecipient = args[key] as string;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\n\t\tif (!recipient) {\n\t\t\treturn { action: 'log' as PolicyAction };\n\t\t}\n\n\t\tconst allProvenance = getAllProvenanceFromArgs(args, getProvenance);\n\n\t\tfor (const metadata of allProvenance) {\n\t\t\tif (metadata.source.type === ProvenanceSource.TOOL) {\n\t\t\t\tif (metadata.readers.type === 'restricted') {\n\t\t\t\t\tif (!canRead(recipient, metadata.readers)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\taction: 'block' as PolicyAction,\n\t\t\t\t\t\t\treason: `Recipient \"${recipient}\" cannot read data from ${metadata.source.toolName}. Authorized readers: ${metadata.readers.readers.join(', ')}`,\n\t\t\t\t\t\t\tpolicy: 'prevent-data-exfiltration',\n\t\t\t\t\t\t\tcontext: {\n\t\t\t\t\t\t\t\trecipient,\n\t\t\t\t\t\t\t\ttoolSource: metadata.source.toolName,\n\t\t\t\t\t\t\t\tauthorizedReaders: metadata.readers.readers,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn { action: 'log' as PolicyAction };\n\t},\n};\n\n/**\n * Prevent data exfiltration (approval mode) - requires approval for risky sends\n */\nexport const preventDataExfiltrationWithApproval: SecurityPolicy = {\n\tname: 'prevent-data-exfiltration-approval',\n\tdescription: 'Requires approval for sending data to recipients who cannot read it',\n\tcheck: (toolName, args, getProvenance) => {\n\t\tconst recipientKeys = ['to', 'recipient', 'recipients', 'email', 'address'];\n\n\t\tlet recipient: string | null = null;\n\t\tfor (const key of recipientKeys) {\n\t\t\tif (args[key] && typeof args[key] === 'string') {\n\t\t\t\trecipient = args[key] as string;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\n\t\tif (!recipient) {\n\t\t\treturn { action: 'log' as PolicyAction };\n\t\t}\n\n\t\tconst allProvenance = getAllProvenanceFromArgs(args, getProvenance);\n\n\t\tfor (const metadata of allProvenance) {\n\t\t\tif (metadata.source.type === ProvenanceSource.TOOL) {\n\t\t\t\tif (metadata.readers.type === 'restricted') {\n\t\t\t\t\tif (!canRead(recipient, metadata.readers)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\taction: 'approve' as PolicyAction,\n\t\t\t\t\t\t\treason: `Sending data from ${metadata.source.toolName} to \"${recipient}\" (not in authorized readers)`,\n\t\t\t\t\t\t\tpolicy: 'prevent-data-exfiltration-approval',\n\t\t\t\t\t\t\tcontext: {\n\t\t\t\t\t\t\t\trecipient,\n\t\t\t\t\t\t\t\ttoolSource: metadata.source.toolName,\n\t\t\t\t\t\t\t\tauthorizedReaders: metadata.readers.readers,\n\t\t\t\t\t\t\t\tsensitiveFields: Object.keys(args).filter((k) => args[k] !== null),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn { action: 'log' as PolicyAction };\n\t},\n};\n\n/**\n * Require user origin - ensures sensitive operations only use user-provided data\n */\nexport const requireUserOrigin: SecurityPolicy = {\n\tname: 'require-user-origin',\n\tdescription: 'Requires critical parameters to come directly from user input',\n\tcheck: (toolName, args, getProvenance) => {\n\t\tconst criticalTools = ['deleteDatabase', 'dropTable', 'executeSQL', 'sendMoney', 'transfer'];\n\n\t\tif (!criticalTools.some((t) => toolName.toLowerCase().includes(t.toLowerCase()))) {\n\t\t\treturn { action: 'log' as PolicyAction };\n\t\t}\n\n\t\tfor (const [key, value] of Object.entries(args)) {\n\t\t\tconst allProvenance = getAllProvenance(value);\n\n\t\t\tfor (const metadata of allProvenance) {\n\t\t\t\tif (\n\t\t\t\t\tmetadata.source.type !== ProvenanceSource.USER &&\n\t\t\t\t\tmetadata.source.type !== ProvenanceSource.SYSTEM\n\t\t\t\t) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\taction: 'block' as PolicyAction,\n\t\t\t\t\t\treason: `Critical tool \"${toolName}\" parameter \"${key}\" must come from user input, but came from ${metadata.source.type}`,\n\t\t\t\t\t\tpolicy: 'require-user-origin',\n\t\t\t\t\t\tcontext: {\n\t\t\t\t\t\t\ttoolName,\n\t\t\t\t\t\t\tparameterKey: key,\n\t\t\t\t\t\t\tactualSource: metadata.source.type,\n\t\t\t\t\t\t},\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn { action: 'log' as PolicyAction };\n\t},\n};\n\n/**\n * Require user origin (approval mode) - requires approval for non-user-originated critical operations\n */\nexport const requireUserOriginWithApproval: SecurityPolicy = {\n\tname: 'require-user-origin-approval',\n\tdescription: 'Requires approval for critical operations with non-user data',\n\tcheck: (toolName, args, getProvenance) => {\n\t\tconst criticalTools = ['deleteDatabase', 'dropTable', 'executeSQL', 'sendMoney', 'transfer'];\n\n\t\tif (!criticalTools.some((t) => toolName.toLowerCase().includes(t.toLowerCase()))) {\n\t\t\treturn { action: 'log' as PolicyAction };\n\t\t}\n\n\t\tfor (const [key, value] of Object.entries(args)) {\n\t\t\tconst allProvenance = getAllProvenance(value);\n\n\t\t\tfor (const metadata of allProvenance) {\n\t\t\t\tif (\n\t\t\t\t\tmetadata.source.type !== ProvenanceSource.USER &&\n\t\t\t\t\tmetadata.source.type !== ProvenanceSource.SYSTEM\n\t\t\t\t) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\taction: 'approve' as PolicyAction,\n\t\t\t\t\t\treason: `Critical operation \"${toolName}\" with parameter \"${key}\" from ${metadata.source.type} source`,\n\t\t\t\t\t\tpolicy: 'require-user-origin-approval',\n\t\t\t\t\t\tcontext: {\n\t\t\t\t\t\t\ttoolName,\n\t\t\t\t\t\t\tparameterKey: key,\n\t\t\t\t\t\t\tactualSource: metadata.source.type,\n\t\t\t\t\t\t\tvalue: String(value).substring(0, 100),\n\t\t\t\t\t\t},\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn { action: 'log' as PolicyAction };\n\t},\n};\n\n/**\n * Block LLM-generated recipients - prevents sending to LLM-extracted emails\n */\nexport const blockLLMRecipients: SecurityPolicy = {\n\tname: 'block-llm-recipients',\n\tdescription: 'Blocks sending data to LLM-extracted email addresses',\n\tcheck: (toolName, args, getProvenance) => {\n\t\tconst recipientKeys = ['to', 'recipient', 'recipients', 'email'];\n\n\t\tfor (const key of recipientKeys) {\n\t\t\tif (!args[key]) continue;\n\n\t\t\tconst metadata = getProvenance(args[key]);\n\t\t\tif (metadata && metadata.source.type === ProvenanceSource.LLM) {\n\t\t\t\treturn {\n\t\t\t\t\taction: 'block' as PolicyAction,\n\t\t\t\t\treason: `Cannot send to LLM-extracted recipient in parameter \"${key}\". Recipients must come from user input or trusted sources.`,\n\t\t\t\t\tpolicy: 'block-llm-recipients',\n\t\t\t\t\tcontext: {\n\t\t\t\t\t\tparameterKey: key,\n\t\t\t\t\t\trecipientValue: String(args[key]).substring(0, 50),\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { action: 'log' as PolicyAction };\n\t},\n};\n\n/**\n * Block LLM-generated recipients (approval mode) - requires approval for LLM-extracted emails\n */\nexport const blockLLMRecipientsWithApproval: SecurityPolicy = {\n\tname: 'block-llm-recipients-approval',\n\tdescription: 'Requires approval for sending to LLM-extracted email addresses',\n\tcheck: (toolName, args, getProvenance) => {\n\t\tconst recipientKeys = ['to', 'recipient', 'recipients', 'email'];\n\n\t\tfor (const key of recipientKeys) {\n\t\t\tif (!args[key]) continue;\n\n\t\t\tconst metadata = getProvenance(args[key]);\n\t\t\tif (metadata && metadata.source.type === ProvenanceSource.LLM) {\n\t\t\t\treturn {\n\t\t\t\t\taction: 'approve' as PolicyAction,\n\t\t\t\t\treason: `Sending to LLM-extracted recipient \"${args[key]}\" in parameter \"${key}\"`,\n\t\t\t\t\tpolicy: 'block-llm-recipients-approval',\n\t\t\t\t\tcontext: {\n\t\t\t\t\t\tparameterKey: key,\n\t\t\t\t\t\trecipientValue: String(args[key]),\n\t\t\t\t\t\tllmOperation: (metadata.source as any).operation,\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { action: 'log' as PolicyAction };\n\t},\n};\n\n/**\n * Audit sensitive data access - logs access without blocking\n */\nexport const auditSensitiveAccess: SecurityPolicy = {\n\tname: 'audit-sensitive-access',\n\tdescription: 'Logs access to sensitive data (does not block)',\n\tcheck: (toolName, args, getProvenance) => {\n\t\tconst sensitiveTools = ['getPassword', 'getCreditCard', 'getSSN', 'getBankAccount'];\n\n\t\tif (sensitiveTools.some((t) => toolName.toLowerCase().includes(t.toLowerCase()))) {\n\t\t\tconst allProvenance = getAllProvenance(args);\n\n\t\t\treturn {\n\t\t\t\taction: 'log' as PolicyAction,\n\t\t\t\treason: `Sensitive data accessed via ${toolName}`,\n\t\t\t\tpolicy: 'audit-sensitive-access',\n\t\t\t\tcontext: {\n\t\t\t\t\ttoolName,\n\t\t\t\t\tprovenanceChain: allProvenance.map((p) => ({\n\t\t\t\t\t\tsource: p.source,\n\t\t\t\t\t\tid: p.id,\n\t\t\t\t\t})),\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\treturn { action: 'log' as PolicyAction };\n\t},\n};\n\n/**\n * Helper: Create custom policy\n */\nexport function createCustomPolicy(\n\tname: string,\n\tdescription: string,\n\tcheckFn: SecurityPolicy['check']\n): SecurityPolicy {\n\treturn { name, description, check: checkFn };\n}\n\n/**\n * Get all built-in policies\n */\nexport function getBuiltInPolicies(): SecurityPolicy[] {\n\treturn [preventDataExfiltration, requireUserOrigin, blockLLMRecipients, auditSensitiveAccess];\n}\n\n/**\n * Get all built-in policies with approval variants\n */\nexport function getBuiltInPoliciesWithApproval(): SecurityPolicy[] {\n\treturn [\n\t\tpreventDataExfiltrationWithApproval,\n\t\trequireUserOriginWithApproval,\n\t\tblockLLMRecipientsWithApproval,\n\t\tauditSensitiveAccess,\n\t];\n}\n","import type { SecurityPolicy, PolicyResult, ProvenanceMetadata, PolicyAction } from '../types.js';\n\nexport type Operator =\n\t| 'equals'\n\t| 'notEquals'\n\t| 'contains'\n\t| 'notContains'\n\t| 'startsWith'\n\t| 'notStartsWith'\n\t| 'endsWith'\n\t| 'notEndsWith'\n\t| 'matches'\n\t| 'in'\n\t| 'notIn';\n\nexport interface Condition {\n\t/**\n\t * Field to check.\n\t * - \"args.paramName\": Value of a tool argument\n\t * - \"provenance.args.paramName.source.type\": Provenance metadata\n\t * - \"provenance.args.paramName.readers\": Reader permissions\n\t */\n\tfield: string;\n\toperator: Operator;\n\tvalue: any;\n}\n\nexport interface PolicyRule {\n\tid?: string;\n\t/** Action to take if conditions match */\n\taction: PolicyAction;\n\t/** Conditions (implicit AND) - all must match for the rule to trigger */\n\tconditions: Condition[];\n\t/** Custom reason message */\n\treason?: string;\n}\n\nexport interface DeclarativePolicyConfig {\n\tid: string;\n\tdescription?: string;\n\tscope: {\n\t\t/** Regex pattern or exact match for tool name */\n\t\ttoolName?: string;\n\t\t/** Regex pattern or exact match for API group */\n\t\tapiGroup?: string;\n\t};\n\t/** Rules are evaluated in order. First match wins. */\n\trules: PolicyRule[];\n}\n\nexport interface PolicyConfiguration {\n\tversion: string;\n\tpolicies: DeclarativePolicyConfig[];\n}\n\n/**\n * Resolve a value from a path in the arguments or provenance\n */\nfunction resolveValue(\n\tpath: string,\n\targs: Record<string, unknown>,\n\tgetProvenance: (value: unknown) => ProvenanceMetadata | null\n): any {\n\tconst parts = path.split('.');\n\tconst root = parts.shift();\n\n\tif (root === 'args') {\n\t\tlet current: any = args;\n\t\tfor (const part of parts) {\n\t\t\tif (current === null || current === undefined) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tcurrent = current[part];\n\t\t}\n\t\treturn current;\n\t}\n\n\tif (root === 'provenance' && parts[0] === 'args') {\n\t\tparts.shift(); // remove 'args'\n\t\tconst argName = parts.shift(); // get argument name\n\t\tif (!argName) return undefined;\n\n\t\tconst argValue = args[argName];\n\n\t\t// Better approach:\n\t\t// 1. Traverse args until we find the object.\n\t\t// 2. Get provenance of that object.\n\t\t// 3. Traverse provenance metadata.\n\n\t\tlet remainingParts = [...parts];\n\n\t\t// We don't know where the split is.\n\t\t// Let's try to find standard metadata keys in the path.\n\t\tconst metadataKeys = ['source', 'readers', 'dependencies', 'id', 'context'];\n\t\tlet splitIndex = -1;\n\t\tfor (let i = 0; i < remainingParts.length; i++) {\n\t\t\tif (metadataKeys.includes(remainingParts[i]!)) {\n\t\t\t\tsplitIndex = i;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\n\t\tif (splitIndex === -1) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\t// Traverse to the value that should have provenance\n\t\tlet valuePath = remainingParts.slice(0, splitIndex);\n\t\tlet metaPath = remainingParts.slice(splitIndex);\n\n\t\tlet currentVal = argValue;\n\t\tfor (const part of valuePath) {\n\t\t\tif (currentVal === null || currentVal === undefined) return undefined;\n\t\t\tcurrentVal = (currentVal as any)[part];\n\t\t}\n\n\t\tconst metadata = getProvenance(currentVal);\n\t\tif (!metadata) return undefined;\n\n\t\t// Now traverse metadata\n\t\tlet currentMeta: any = metadata;\n\t\tfor (const part of metaPath) {\n\t\t\tif (currentMeta === null || currentMeta === undefined) return undefined;\n\t\t\tcurrentMeta = currentMeta[part];\n\t\t}\n\t\treturn currentMeta;\n\t}\n\n\treturn undefined;\n}\n\nfunction evaluateCondition(actual: any, operator: Operator, expected: any): boolean {\n\tswitch (operator) {\n\t\tcase 'equals':\n\t\t\treturn actual === expected;\n\t\tcase 'notEquals':\n\t\t\treturn actual !== expected;\n\t\tcase 'contains':\n\t\t\treturn Array.isArray(actual) || typeof actual === 'string'\n\t\t\t\t? actual.includes(expected)\n\t\t\t\t: false;\n\t\tcase 'notContains':\n\t\t\treturn Array.isArray(actual) || typeof actual === 'string'\n\t\t\t\t? !actual.includes(expected)\n\t\t\t\t: true;\n\t\tcase 'startsWith':\n\t\t\treturn typeof actual === 'string' ? actual.startsWith(expected) : false;\n\t\tcase 'notStartsWith':\n\t\t\treturn typeof actual === 'string' ? !actual.startsWith(expected) : true;\n\t\tcase 'endsWith':\n\t\t\treturn typeof actual === 'string' ? actual.endsWith(expected) : false;\n\t\tcase 'notEndsWith':\n\t\t\treturn typeof actual === 'string' ? !actual.endsWith(expected) : true;\n\t\tcase 'matches':\n\t\t\tif (typeof actual === 'string') {\n\t\t\t\treturn new RegExp(expected).test(actual);\n\t\t\t}\n\t\t\tif (typeof actual === 'number' && typeof expected === 'string') {\n\t\t\t\tconst match = expected.match(/^([<>]=?|==|!=)(\\d+(?:\\.\\d+)?)$/);\n\t\t\t\tif (match) {\n\t\t\t\t\tconst [, op, value] = match;\n\t\t\t\t\tconst numValue = parseFloat(value!);\n\t\t\t\t\tswitch (op) {\n\t\t\t\t\t\tcase '>':\n\t\t\t\t\t\t\treturn actual > numValue;\n\t\t\t\t\t\tcase '>=':\n\t\t\t\t\t\t\treturn actual >= numValue;\n\t\t\t\t\t\tcase '<':\n\t\t\t\t\t\t\treturn actual < numValue;\n\t\t\t\t\t\tcase '<=':\n\t\t\t\t\t\t\treturn actual <= numValue;\n\t\t\t\t\t\tcase '==':\n\t\t\t\t\t\t\treturn actual === numValue;\n\t\t\t\t\t\tcase '!=':\n\t\t\t\t\t\t\treturn actual !== numValue;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn false;\n\t\tcase 'in':\n\t\t\treturn Array.isArray(expected) ? expected.includes(actual) : false;\n\t\tcase 'notIn':\n\t\t\treturn Array.isArray(expected) ? !expected.includes(actual) : true;\n\t\tdefault:\n\t\t\treturn false;\n\t}\n}\n\n/**\n * Create a SecurityPolicy from a declarative configuration\n */\nexport function createDeclarativePolicy(config: DeclarativePolicyConfig): SecurityPolicy {\n\treturn {\n\t\tname: config.id,\n\t\tdescription: config.description,\n\t\tcheck: async (toolName, args, getProvenance) => {\n\t\t\tif (config.scope.toolName) {\n\t\t\t\tconst toolRegex = new RegExp(`^${config.scope.toolName}$`);\n\t\t\t\tif (!toolRegex.test(toolName)) {\n\t\t\t\t\treturn { action: 'log' };\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (config.scope.apiGroup) {\n\t\t\t\t// Note: apiGroup is matched against the toolName prefix (e.g., \"payment\" from \"payment.transfer\")\n\t\t\t\t// The SecurityPolicy interface doesn't receive apiGroup separately, but we can extract it from toolName\n\t\t\t\tconst extractedGroup = toolName.split('.')[0] || '';\n\t\t\t\tconst groupRegex = new RegExp(`^${config.scope.apiGroup}$`);\n\t\t\t\tif (!groupRegex.test(extractedGroup)) {\n\t\t\t\t\treturn { action: 'log' };\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tfor (const rule of config.rules) {\n\t\t\t\tconst allMatch = rule.conditions.every((condition) => {\n\t\t\t\t\tconst actualValue = resolveValue(condition.field, args, getProvenance);\n\t\t\t\t\treturn evaluateCondition(actualValue, condition.operator, condition.value);\n\t\t\t\t});\n\n\t\t\t\tif (allMatch) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\taction: rule.action,\n\t\t\t\t\t\treason: rule.reason || `Matched rule ${rule.id || 'unknown'} in policy ${config.id}`,\n\t\t\t\t\t\tpolicy: config.id,\n\t\t\t\t\t\tcontext: { ruleId: rule.id, conditions: rule.conditions },\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn { action: 'log' };\n\t\t},\n\t};\n}\n\n/**\n * Load policies from a full configuration object or array of policy configs\n */\nexport function loadDeclarativePolicies(\n\tconfig: PolicyConfiguration | DeclarativePolicyConfig[]\n): SecurityPolicy[] {\n\tif (Array.isArray(config)) {\n\t\treturn config.map(createDeclarativePolicy);\n\t}\n\treturn config.policies.map(createDeclarativePolicy);\n}\n","import { z } from 'zod';\n\nexport const OperatorSchema = z.enum([\n\t'equals',\n\t'notEquals',\n\t'contains',\n\t'notContains',\n\t'startsWith',\n\t'notStartsWith',\n\t'endsWith',\n\t'notEndsWith',\n\t'matches',\n\t'in',\n\t'notIn',\n]);\n\nexport type Operator = z.infer<typeof OperatorSchema>;\n\nexport const ConditionSchema = z.object({\n\tfield: z\n\t\t.string()\n\t\t.describe('Field to check (e.g. args.paramName, provenance.args.param.source.type)'),\n\toperator: OperatorSchema,\n\tvalue: z.any().describe('Value to compare against'),\n});\n\nexport type Condition = z.infer<typeof ConditionSchema>;\n\nexport const PolicyActionSchema = z.enum(['log', 'approve', 'block']);\n\nexport type PolicyAction = z.infer<typeof PolicyActionSchema>;\n\nexport const PolicyRuleSchema = z.object({\n\tid: z.string().optional(),\n\taction: PolicyActionSchema,\n\tconditions: z.array(ConditionSchema).describe('All conditions must match (implicit AND)'),\n\treason: z.string().optional(),\n});\n\nexport type PolicyRule = z.infer<typeof PolicyRuleSchema>;\n\nexport const DeclarativePolicyConfigSchema = z.object({\n\tid: z.string(),\n\tdescription: z.string().optional(),\n\tscope: z.object({\n\t\ttoolName: z.string().optional().describe('Regex pattern or exact match for tool name'),\n\t\tapiGroup: z.string().optional().describe('Regex pattern or exact match for API group'),\n\t}),\n\trules: z.array(PolicyRuleSchema).describe('Rules are evaluated in order. First match wins.'),\n});\n\nexport type DeclarativePolicyConfig = z.infer<typeof DeclarativePolicyConfigSchema>;\n\nexport const PolicyConfigurationSchema = z.object({\n\tversion: z.string(),\n\tpolicies: z.array(DeclarativePolicyConfigSchema),\n});\n\nexport type PolicyConfiguration = z.infer<typeof PolicyConfigurationSchema>;\n","import type { DeclarativePolicyConfig, PolicyRule, Operator } from './declarative.js';\nimport type { PolicyAction } from '../types.js';\n\n/**\n * Helper class to build policy rules fluently\n */\nexport class RuleBuilder {\n\tprivate rule: PolicyRule = {\n\t\taction: 'log',\n\t\tconditions: [],\n\t};\n\n\tconstructor(action: PolicyAction = 'log') {\n\t\tthis.rule.action = action;\n\t}\n\n\taction(action: PolicyAction): this {\n\t\tthis.rule.action = action;\n\t\treturn this;\n\t}\n\n\tid(id: string): this {\n\t\tthis.rule.id = id;\n\t\treturn this;\n\t}\n\n\treason(reason: string): this {\n\t\tthis.rule.reason = reason;\n\t\treturn this;\n\t}\n\n\tcondition(field: string, operator: Operator, value: any): this {\n\t\tthis.rule.conditions.push({ field, operator, value });\n\t\treturn this;\n\t}\n\n\tbuild(): PolicyRule {\n\t\treturn this.rule;\n\t}\n}\n\n/**\n * Helper class to build declarative policies fluently\n */\nexport class PolicyBuilder {\n\tprivate config: DeclarativePolicyConfig;\n\n\tconstructor(id: string) {\n\t\tthis.config = {\n\t\t\tid,\n\t\t\tscope: {},\n\t\t\trules: [],\n\t\t};\n\t}\n\n\tdescription(desc: string): this {\n\t\tthis.config.description = desc;\n\t\treturn this;\n\t}\n\n\tscopeTool(toolNamePattern: string): this {\n\t\tthis.config.scope.toolName = toolNamePattern;\n\t\treturn this;\n\t}\n\n\tscopeApiGroup(apiGroupPattern: string): this {\n\t\tthis.config.scope.apiGroup = apiGroupPattern;\n\t\treturn this;\n\t}\n\n\t/**\n\t * Add a rule using a builder callback\n\t * @example\n\t * .addRule(r => r.action('block').condition('args.amount', 'matches', '>1000'))\n\t */\n\taddRule(buildFn: (builder: RuleBuilder) => RuleBuilder): this {\n\t\tconst builder = new RuleBuilder();\n\t\tthis.config.rules.push(buildFn(builder).build());\n\t\treturn this;\n\t}\n\n\t/**\n\t * Add a fully formed rule object\n\t */\n\taddRuleObject(rule: PolicyRule): this {\n\t\tthis.config.rules.push(rule);\n\t\treturn this;\n\t}\n\n\tbuild(): DeclarativePolicyConfig {\n\t\treturn this.config;\n\t}\n}\n","import type { SecurityPolicy, PolicyResult, ProvenanceMetadata } from '../types.js';\nimport { createDeclarativePolicy, type DeclarativePolicyConfig } from './declarative.js';\n\n/**\n * A dynamic registry that manages multiple policies and acts as a single SecurityPolicy.\n * This allows policies to be updated at runtime (e.g. from a UI or database) without restarting the server.\n */\nexport class DynamicPolicyRegistry implements SecurityPolicy {\n\tname = 'dynamic-policy-registry';\n\tdescription = 'Container for dynamically managed security policies';\n\n\tprivate policies: Map<string, SecurityPolicy> = new Map();\n\n\tconstructor(initialPolicies: SecurityPolicy[] = []) {\n\t\tfor (const policy of initialPolicies) {\n\t\t\tthis.policies.set(policy.name, policy);\n\t\t}\n\t}\n\n\t/**\n\t * Add or update a policy\n\t */\n\taddPolicy(policy: SecurityPolicy): void {\n\t\tthis.policies.set(policy.name, policy);\n\t}\n\n\t/**\n\t * Remove a policy by name\n\t */\n\tremovePolicy(name: string): void {\n\t\tthis.policies.delete(name);\n\t}\n\n\t/**\n\t * clear all policies\n\t */\n\tclear(): void {\n\t\tthis.policies.clear();\n\t}\n\n\t/**\n\t * Load policies from declarative configurations (JSON)\n\t * This is useful for loading policies saved from a UI\n\t */\n\tloadFromConfigs(configs: DeclarativePolicyConfig[], replace = false): void {\n\t\tif (replace) {\n\t\t\tthis.policies.clear();\n\t\t}\n\t\tfor (const config of configs) {\n\t\t\tconst policy = createDeclarativePolicy(config);\n\t\t\tthis.policies.set(policy.name, policy);\n\t\t}\n\t}\n\n\t/**\n\t * Get all registered policies\n\t */\n\tgetPolicies(): SecurityPolicy[] {\n\t\treturn Array.from(this.policies.values());\n\t}\n\n\t/**\n\t * Implementation of the SecurityPolicy check interface.\n\t * Delegates to all registered policies.\n\t */\n\tasync check(\n\t\ttoolName: string,\n\t\targs: Record<string, unknown>,\n\t\tgetProvenance: (value: unknown) => ProvenanceMetadata | null\n\t): Promise<PolicyResult> {\n\t\tlet requiresApproval: PolicyResult | null = null;\n\n\t\tfor (const policy of this.policies.values()) {\n\t\t\tconst result = await policy.check(toolName, args, getProvenance);\n\n\t\t\tif (result.action === 'block') {\n\t\t\t\treturn result;\n\t\t\t}\n\n\t\t\tif (result.action === 'approve') {\n\t\t\t\tif (!requiresApproval) {\n\t\t\t\t\trequiresApproval = result;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (requiresApproval) {\n\t\t\treturn requiresApproval;\n\t\t}\n\n\t\treturn { action: 'log' };\n\t}\n}\n","import * as acorn from 'acorn';\nimport * as walk from 'acorn-walk';\nimport * as escodegen from 'escodegen';\nimport { nanoid } from 'nanoid';\nimport type { ProvenanceMetadata, SourceMetadata } from '../types.js';\nimport { ProvenanceSource } from '../types.js';\nimport {\n\tcreateProvenanceProxy,\n\tgetProvenance,\n\tgetProvenanceForPrimitive,\n\tmarkPrimitiveTainted,\n} from '../registry.js';\n\nexport { getProvenance, getProvenanceForPrimitive };\n\ninterface InstrumentationContext {\n\tnextId: number;\n\ttrackingCalls: number;\n}\n\n/**\n * Instrument code to track provenance at AST level\n */\nexport function instrumentCode(code: string): {\n\tcode: string;\n\tmetadata: { trackingCalls: number };\n} {\n\t// Wrap code in async function for parsing (to allow await and return)\n\tconst wrappedCode = `(async function() {\\n${code}\\n})`;\n\n\tconst ast = acorn.parse(wrappedCode, {\n\t\tecmaVersion: 2022,\n\t\tsourceType: 'script',\n\t}) as any;\n\n\tconst context: InstrumentationContext = {\n\t\tnextId: 0,\n\t\ttrackingCalls: 0,\n\t};\n\n\twalk.simple(ast, {\n\t\tBinaryExpression(node: any) {\n\t\t\twrapBinaryExpression(node, context);\n\t\t},\n\t\tAssignmentExpression(node: any) {\n\t\t\twrapAssignment(node, context);\n\t\t},\n\t\tCallExpression(node: any) {\n\t\t\tif (node.callee.type === 'MemberExpression') {\n\t\t\t\twrapMethodCall(node, context);\n\t\t\t}\n\t\t},\n\t\tTemplateLiteral(node: any) {\n\t\t\twrapTemplateLiteral(node, context);\n\t\t},\n\t});\n\n\tlet instrumentedCode = escodegen.generate(ast);\n\n\t// escodegen adds a trailing semicolon to expression statements\n\t// Remove it so the result is a pure function expression that executor can call with ()\n\tif (instrumentedCode.endsWith(');')) {\n\t\tinstrumentedCode = instrumentedCode.slice(0, -1); // Remove trailing semicolon\n\t}\n\n\treturn {\n\t\tcode: instrumentedCode,\n\t\tmetadata: {\n\t\t\ttrackingCalls: context.trackingCalls,\n\t\t},\n\t};\n}\n\nfunction wrapBinaryExpression(node: any, context: InstrumentationContext) {\n\tcontext.trackingCalls++;\n\n\tconst originalNode = { ...node };\n\n\tnode.type = 'CallExpression';\n\tnode.callee = {\n\t\ttype: 'Identifier',\n\t\tname: '__track_binary',\n\t};\n\tnode.arguments = [\n\t\toriginalNode.left,\n\t\toriginalNode.right,\n\t\t{\n\t\t\ttype: 'Literal',\n\t\t\tvalue: originalNode.operator,\n\t\t},\n\t];\n}\n\nfunction wrapAssignment(node: any, context: InstrumentationContext) {\n\tcontext.trackingCalls++;\n\n\tconst originalRight = node.right;\n\tnode.right = {\n\t\ttype: 'CallExpression',\n\t\tcallee: {\n\t\t\ttype: 'Identifier',\n\t\t\tname: '__track_assign',\n\t\t},\n\t\targuments: [\n\t\t\t{\n\t\t\t\ttype: 'Literal',\n\t\t\t\tvalue: node.left.type === 'Identifier' ? node.left.name : 'unknown',\n\t\t\t},\n\t\t\toriginalRight,\n\t\t],\n\t};\n}\n\nfunction wrapMethodCall(node: any, context: InstrumentationContext) {\n\tconst obj = node.callee.object;\n\n\tconst isAPICall =\n\t\t(obj.type === 'Identifier' && (obj.name === 'api' || obj.name === 'atp')) ||\n\t\t(obj.type === 'MemberExpression' && isAPIObject(obj));\n\n\tif (!isAPICall) {\n\t\treturn;\n\t}\n\n\tcontext.trackingCalls++;\n\n\tconst originalNode = { ...node };\n\n\tnode.type = 'CallExpression';\n\tnode.callee = {\n\t\ttype: 'Identifier',\n\t\tname: '__track_method',\n\t};\n\tnode.arguments = [\n\t\toriginalNode.callee.object,\n\t\t{\n\t\t\ttype: 'Literal',\n\t\t\tvalue: originalNode.callee.property.name || originalNode.callee.property.value,\n\t\t},\n\t\t{\n\t\t\ttype: 'ArrayExpression',\n\t\t\telements: originalNode.arguments,\n\t\t},\n\t];\n}\n\nfunction isAPIObject(node: any): boolean {\n\tif (node.type === 'Identifier') {\n\t\treturn node.name === 'api' || node.name === 'atp';\n\t}\n\tif (node.type === 'MemberExpression') {\n\t\treturn isAPIObject(node.object);\n\t}\n\treturn false;\n}\n\nfunction wrapTemplateLiteral(node: any, context: InstrumentationContext) {\n\tcontext.trackingCalls++;\n\n\tconst originalNode = { ...node };\n\n\tnode.type = 'CallExpression';\n\tnode.callee = {\n\t\ttype: 'Identifier',\n\t\tname: '__track_template',\n\t};\n\tnode.arguments = [\n\t\t{\n\t\t\ttype: 'ArrayExpression',\n\t\t\telements: originalNode.expressions || [],\n\t\t},\n\t\t{\n\t\t\ttype: 'ArrayExpression',\n\t\t\telements: (originalNode.quasis || []).map((quasi: any) => ({\n\t\t\t\ttype: 'Literal',\n\t\t\t\tvalue: quasi.value.cooked || quasi.value.raw,\n\t\t\t})),\n\t\t},\n\t];\n}\n\n/**\n * Runtime tracking functions injected into sandbox\n */\nexport class ASTProvenanceTracker {\n\tprivate metadata: Map<string, ProvenanceMetadata> = new Map();\n\tprivate valueToId: WeakMap<object, string> = new WeakMap();\n\tprivate nextId = 0;\n\n\tprivate getId(value: unknown): string {\n\t\tif (typeof value === 'object' && value !== null) {\n\t\t\tconst existing = this.valueToId.get(value as object);\n\t\t\tif (existing) return existing;\n\n\t\t\tconst id = `tracked_${this.nextId++}`;\n\t\t\tthis.valueToId.set(value as object, id);\n\t\t\treturn id;\n\t\t}\n\t\treturn `primitive_${nanoid()}`;\n\t}\n\n\ttrack(value: unknown, source: SourceMetadata, dependencies: string[] = []): unknown {\n\t\tif (value === null || value === undefined) {\n\t\t\treturn value;\n\t\t}\n\n\t\tconst id = this.getId(value);\n\n\t\tif (!this.metadata.has(id)) {\n\t\t\tthis.metadata.set(id, {\n\t\t\t\tid,\n\t\t\t\tsource,\n\t\t\t\treaders: { type: 'public' },\n\t\t\t\tdependencies,\n\t\t\t});\n\t\t}\n\n\t\treturn value;\n\t}\n\n\ttrackBinary(left: unknown, right: unknown, operator: string): unknown {\n\t\tconst leftId = this.getId(left);\n\t\tconst rightId = this.getId(right);\n\n\t\tconst leftProv = getProvenance(left) || getProvenanceForPrimitive(left);\n\t\tconst rightProv = getProvenance(right) || getProvenanceForPrimitive(right);\n\t\tconst toolMetadata =\n\t\t\tleftProv?.source.type === ProvenanceSource.TOOL\n\t\t\t\t? leftProv\n\t\t\t\t: rightProv?.source.type === ProvenanceSource.TOOL\n\t\t\t\t\t? rightProv\n\t\t\t\t\t: null;\n\n\t\tlet result: unknown;\n\t\tswitch (operator) {\n\t\t\tcase '+':\n\t\t\t\tresult = (left as any) + (right as any);\n\t\t\t\tif (typeof result === 'string' && toolMetadata) {\n\t\t\t\t\tmarkPrimitiveTainted(result, toolMetadata);\n\t\t\t\t}\n\t\t\t\tbreak;\n\t\t\tcase '-':\n\t\t\t\tresult = (left as any) - (right as any);\n\t\t\t\tbreak;\n\t\t\tcase '*':\n\t\t\t\tresult = (left as any) * (right as any);\n\t\t\t\tbreak;\n\t\t\tcase '/':\n\t\t\t\tresult = (left as any) / (right as any);\n\t\t\t\tbreak;\n\t\t\tcase '%':\n\t\t\t\tresult = (left as any) % (right as any);\n\t\t\t\tbreak;\n\t\t\tcase '===':\n\t\t\tcase '==':\n\t\t\t\tresult = left === right;\n\t\t\t\tbreak;\n\t\t\tcase '!==':\n\t\t\tcase '!=':\n\t\t\t\tresult = left !== right;\n\t\t\t\tbreak;\n\t\t\tcase '<':\n\t\t\t\tresult = (left as any) < (right as any);\n\t\t\t\tbreak;\n\t\t\tcase '>':\n\t\t\t\tresult = (left as any) > (right as any);\n\t\t\t\tbreak;\n\t\t\tcase '<=':\n\t\t\t\tresult = (left as any) <= (right as any);\n\t\t\t\tbreak;\n\t\t\tcase '>=':\n\t\t\t\tresult = (left as any) >= (right as any);\n\t\t\t\tbreak;\n\t\t\tcase '&&':\n\t\t\t\tresult = left && right;\n\t\t\t\tbreak;\n\t\t\tcase '||':\n\t\t\t\tresult = left || right;\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tresult = undefined;\n\t\t}\n\n\t\treturn this.track(\n\t\t\tresult,\n\t\t\t{ type: 'system' as any, operation: `binary_${operator}`, timestamp: Date.now() },\n\t\t\t[leftId, rightId]\n\t\t);\n\t}\n\n\ttrackAssign(name: string, value: unknown): unknown {\n\t\treturn this.track(\n\t\t\tvalue,\n\t\t\t{ type: 'system' as any, operation: 'assignment', timestamp: Date.now() },\n\t\t\t[this.getId(value)]\n\t\t);\n\t}\n\n\ttrackMethod(object: unknown, method: string, args: unknown[]): unknown {\n\t\tif (typeof object === 'object' && object !== null && method in (object as any)) {\n\t\t\tconst result = (object as any)[method](...args);\n\n\t\t\treturn this.track(\n\t\t\t\tresult,\n\t\t\t\t{ type: 'system' as any, operation: `method_${method}`, timestamp: Date.now() },\n\t\t\t\t[this.getId(object), ...args.map((a) => this.getId(a))]\n\t\t\t);\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\ttrackTemplate(expressions: unknown[], quasis: string[]): string {\n\t\tlet result = '';\n\t\tlet toolMetadata: ProvenanceMetadata | null = null;\n\n\t\tfor (let i = 0; i < quasis.length; i++) {\n\t\t\tresult += quasis[i] || '';\n\t\t\tif (i < expressions.length) {\n\t\t\t\tconst expr = expressions[i];\n\t\t\t\tresult += String(expr);\n\n\t\t\t\tconst prov = getProvenance(expr) || getProvenanceForPrimitive(expr);\n\t\t\t\tif (prov && prov.source.type === ProvenanceSource.TOOL && !toolMetadata) {\n\t\t\t\t\ttoolMetadata = prov;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (toolMetadata) {\n\t\t\tmarkPrimitiveTainted(result, toolMetadata);\n\t\t}\n\n\t\treturn result;\n\t}\n\n\tgetMetadata(value: unknown): ProvenanceMetadata | null {\n\t\tif (typeof value === 'object' && value !== null) {\n\t\t\tconst id = this.valueToId.get(value as object);\n\t\t\tif (id) {\n\t\t\t\treturn this.metadata.get(id) || null;\n\t\t\t}\n\t\t}\n\t\treturn null;\n\t}\n\n\tgetAllMetadata(): Map<string, ProvenanceMetadata> {\n\t\treturn new Map(this.metadata);\n\t}\n\n\trestoreMetadata(metadata: Map<string, ProvenanceMetadata>): void {\n\t\tthis.metadata = new Map(metadata);\n\t}\n}\n\n/**\n * Create tracking runtime for sandbox injection\n */\nexport function createTrackingRuntime(): {\n\ttracker: ASTProvenanceTracker;\n\truntime: Record<string, Function>;\n} {\n\tconst tracker = new ASTProvenanceTracker();\n\n\treturn {\n\t\ttracker,\n\t\truntime: {\n\t\t\t__track: (value: unknown, source: SourceMetadata, deps?: string[]) =>\n\t\t\t\ttracker.track(value, source, deps),\n\t\t\t__track_binary: (left: unknown, right: unknown, operator: string) =>\n\t\t\t\ttracker.trackBinary(left, right, operator),\n\t\t\t__track_assign: (name: string, value: unknown) => tracker.trackAssign(name, value),\n\t\t\t__track_method: (object: unknown, method: string, args: unknown[]) =>\n\t\t\t\ttracker.trackMethod(object, method, args),\n\t\t\t__track_template: (expressions: unknown[], quasis: string[]) =>\n\t\t\t\ttracker.trackTemplate(expressions, quasis),\n\t\t\t__get_provenance: (value: unknown) => tracker.getMetadata(value),\n\t\t},\n\t};\n}\n"]}