@bolloon/bolloon-agent 0.4.27 → 0.4.29

package/dist/electron-build/security/tool-gate.js

@@ -0,0 +1,287 @@
+"use strict";
+/**
+ * Tool Gate — 8 道安全 gate (调工具前/后的快速判断)
+ *
+ * 跟 harness-integration/gate-state-machine 区别:
+ * - 后者: 工程化工作流 8-gate (HARNESS-DEV 流程)
+ * - 本文件: 工具调用安全 8-gate (防越权 / 防注入 / 防越界)
+ *
+ * 每道 gate 独立可禁用, 调用方按顺序串联
+ * 任何 gate failed = 拒绝 tool 调用 + 返回 reason
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gateWhitelist = void 0;
+exports.checkWhitelist = checkWhitelist;
+exports.checkSchema = checkSchema;
+exports.checkChannel = checkChannel;
+exports.checkRate = checkRate;
+exports.checkInject = checkInject;
+exports.checkOutput = checkOutput;
+exports.checkBlacklist = checkBlacklist;
+exports.runToolGates = runToolGates;
+exports.runOutputGate = runOutputGate;
+const builtin_guards_js_1 = require("./builtin-guards.js");
+// ============================================================
+// Gate 1: 白名单
+// ============================================================
+const TOOL_WHITELIST = new Set([
+    // 已有 tool (见 pi-sdk.ts registerTools)
+    'read_document', 'summarize_document', 'improve_document',
+    'list_peers', 'send_message', 'broadcast_message',
+    'get_identity', 'list_skills', 'create_judgment',
+    'shell_exec', 'shell',
+    'read', 'write', 'edit_file', 'list_files',
+    'list_sessions', 'get_session_state', 'list_messages',
+    'send_to_channel', 'create_channel',
+    // M2.1 (2026-06-17): 新增的 10 个 agent 工具 (跟 pi-sdk registerTools 同步)
+    'write_file', 'git_diff', 'git_commit', 'git_push', 'git_branch',
+    'create_task', 'update_task', 'get_task', 'list_tasks',
+    'use_skill', 'self_improve',
+    // 2026-06-19: M4 新增 (跟 pi-sdk.ts registerTools 同步)
+    'read_file', 'delete_file', 'mkdir', 'move_file',
+    'grep_files', 'glob_files',
+    'git_log', 'git_show', 'git_stash',
+    'vitest_run', 'tsc_check',
+    // 2026-06-19: Agent Mesh 通信工具 (跟 pi-sdk.ts registerTools 同步)
+    'check_inbox', 'send_to_peer', 'p2p_broadcast', 'send_to_local_agent', 'list_local_agents', 'agent_call',
+    // 2026-06-24: Wallet + Polymarket + Safe 工具 (跟 pi-sdk.ts _registerWalletTools 同步)
+    'wallet_create', 'wallet_import', 'wallet_get_balance', 'wallet_sign_message', 'wallet_send_tx', 'wallet_transfer_token', 'wallet_autopay',
+    'polymarket_list_markets', 'polymarket_get_market', 'polymarket_get_orders', 'polymarket_create_order', 'polymarket_cancel_order',
+    'safe_deploy',
+    // MCP 注册的工具
+    'mcp_tool',
+    // 2026-07-29: 同步 pi-sdk-tools.ts 注册的全部工具
+    'read_directory', 'add_friend_by_id', 'delegate_to_engine',
+    'set_persona', 'get_operation_logs', 'park_goal',
+    'list_channels', 'list_local_channels',
+    // 2026-08-02: skill 沉淀工具 (skill-writer.ts)
+    'create_skill', 'update_skill', 'list_skill_candidates', 'promote_skill',
+    // 2026-08-02: plan/todo/review 工具 (plan-store.ts)
+    'create_plan', 'update_plan', 'review_plan', 'list_plans',
+    // 2026-08-03: 决策协议工具 (decision-store.ts, Context OS §7 九要素)
+    'create_decision', 'decide_decision', 'rollback_decision', 'list_decisions',
+    // 2026-08-03: Context OS 资产层工具 (context-os.ts, 12+3 层文件夹体系)
+    'list_context_layers', 'write_context_asset', 'read_context_assets',
+    // 2026-08-03: MCP 工具 (pi-ecosystem-mcp, 真实 stdio JSON-RPC)
+    'mcp_list_tools', 'mcp_tool',
+    // 2026-08-03: DID 发布到 IPFS+IPNS (自动安装 Kubo)
+    'publish_did',
+    // 2026-08-04: IPFS/IPNS 通用查询 + 发布 (pi-sdk-tools.ts)
+    'ipfs_add', 'ipfs_cat', 'ipfs_ls', 'ipns_publish', 'ipns_resolve',
+    // 2026-08-04: Web 上网工具 (pi-sdk-tools.ts)
+    'fetch_url', 'web_search',
+    // 2026-08-02: 远端 channel 工具 (本地智能体 @ 远程交流)
+    'list_remote_channels', 'send_to_remote_channel',
+    // 2026-08-06: OrbitDB/CID 数据层工具 (src/orbitdb/agent-tools.ts)
+    'cid_save', 'cid_load', 'cid_update', 'cid_version', 'cid_list', 'cid_share',
+    'context_save_snapshot', 'context_restore',
+    'ui_save_component', 'ui_load_component',
+    // 2026-08-12: Kanban 看板工具 (Hermes kanban_db → OrbitDB, src/orbitdb/kanban-store.ts)
+    'kanban_create', 'kanban_list', 'kanban_get', 'kanban_claim', 'kanban_complete', 'kanban_status',
+    // 2026-08-07: Bolloon 自身配置读写 (bolloon-config.json, agent 有修改自身配置权限)
+    'bolloon_config_get', 'bolloon_config_set',
+    // 2026-09-13: 下一代工具集 (人机问答 / 精确补丁 / 代码执行 / 桌面操作 / 技能分享 / 浏览器)
+    'clarify', 'patch', 'execute_code',
+    'git_status', 'git_add', 'git_restore',
+    'computer_use', 'browser',
+    'skill_export', 'skill_import', 'skill_share',
+    // 2026-09-13: 微支付信息服务 (x402 付费信息 + 验真)
+    'x402_info_publish', 'x402_info_list', 'x402_info_unpublish', 'x402_info_buy', 'x402_info_verify',
+]);
+exports.gateWhitelist = { gate: 'whitelist', allowed: true };
+/**
+ * @deprecated 不再被 TOOL_GATES 调用 (2026-07-29). 保留仅供测试直接引用.
+ * 工具准入由 `tools` 参数 (OpenAI 原生格式) 控制, 不再需要第二层白名单.
+ */
+function checkWhitelist(ctx) {
+    if (TOOL_WHITELIST.has(ctx.tool)) {
+        return exports.gateWhitelist;
+    }
+    return {
+        gate: 'whitelist',
+        allowed: false,
+        reason: `工具 '${ctx.tool}' 不在白名单`,
+        evidence: `白名单: ${Array.from(TOOL_WHITELIST).slice(0, 5).join(', ')}...`,
+    };
+}
+// ============================================================
+// Gate 2: args 形状校验 (防 schema 注入)
+// ============================================================
+const DANGEROUS_KEYS = ['__proto__', 'constructor', 'prototype'];
+function checkSchema(ctx) {
+    // 1) 直接遍历 args (JSON.stringify 会丢 __proto__, 必须手动检查)
+    function walkKeys(obj, path = []) {
+        if (obj === null || typeof obj !== 'object')
+            return null;
+        for (const k of Object.keys(obj)) {
+            if (DANGEROUS_KEYS.includes(k)) {
+                return [...path, k].join('.');
+            }
+            const found = walkKeys(obj[k], [...path, k]);
+            if (found)
+                return found;
+        }
+        return null;
+    }
+    const dangerousKey = walkKeys(ctx.args);
+    if (dangerousKey) {
+        return {
+            gate: 'schema',
+            allowed: false,
+            reason: `args 含 prototype pollution 风险 key: ${dangerousKey}`,
+            evidence: dangerousKey,
+        };
+    }
+    // 2) args 字符串过深 (>10000 字符) — 可能是 prompt injection 试图污染
+    const json = JSON.stringify(ctx.args);
+    if (json.length > 10000) {
+        return {
+            gate: 'schema',
+            allowed: false,
+            reason: `args 过长 (${json.length} 字符), 可能含 prompt injection`,
+            evidence: `前 100 字符: ${json.substring(0, 100)}`,
+        };
+    }
+    return { gate: 'schema', allowed: true };
+}
+// ============================================================
+// Gate 3: channel 权限 (channelId 是否被允许调该 tool)
+// ============================================================
+/** 工具 → 哪些 channelId 不允许 (黑名单模式, 留作扩展) */
+const TOOL_CHANNEL_RESTRICT = {
+// 'shell_exec': [/^ch_system_/],  // 示例: 某些 system channel 禁 shell
+};
+function checkChannel(ctx) {
+    if (!ctx.channelId) {
+        return { gate: 'channel', allowed: true };
+    }
+    const restrictions = TOOL_CHANNEL_RESTRICT[ctx.tool];
+    if (!restrictions) {
+        return { gate: 'channel', allowed: true };
+    }
+    for (const r of restrictions) {
+        if (typeof r === 'string' && r === ctx.channelId) {
+            return { gate: 'channel', allowed: false, reason: `channel '${ctx.channelId}' 不允许调 '${ctx.tool}'` };
+        }
+        if (r instanceof RegExp && r.test(ctx.channelId)) {
+            return { gate: 'channel', allowed: false, reason: `channel '${ctx.channelId}' 匹配禁模式 ${r}` };
+        }
+    }
+    return { gate: 'channel', allowed: true };
+}
+// ============================================================
+// Gate 4: 速率限制 (同 tool 1min 内最多 N 次)
+// ============================================================
+const RATE_LIMIT_PER_MIN = 5;
+function checkRate(ctx) {
+    const recent = ctx.recentCalls ?? [];
+    const now = Date.now();
+    const window = 60_000;
+    const sameTool = recent.filter((c) => c.tool === ctx.tool && now - c.ts < window);
+    if (sameTool.length >= RATE_LIMIT_PER_MIN) {
+        return {
+            gate: 'rate',
+            allowed: false,
+            reason: `工具 '${ctx.tool}' 在 1 分钟内已被调 ${sameTool.length} 次 (上限 ${RATE_LIMIT_PER_MIN})`,
+            evidence: `最近 ${sameTool.length} 次调用时间: ${sameTool.map((c) => new Date(c.ts).toISOString()).join(', ')}`,
+        };
+    }
+    return { gate: 'rate', allowed: true };
+}
+// ============================================================
+// Gate 5: prompt injection 检测
+// ============================================================
+const INJECTION_PATTERNS = [
+    { re: /\bignore (previous|all|above) (instructions?|prompts?)\b/i, label: 'ignore previous' },
+    { re: /\b(disregard|forget) (everything|all|instructions?)\b/i, label: 'disregard' },
+    { re: /\byou are now\b/i, label: 'role override' },
+    { re: /\bnew instructions?:\s*\[/i, label: 'new instructions block' },
+    { re: /<\|im_start\|>/, label: 'chatml tag' },
+    { re: /<\|im_end\|>/, label: 'chatml tag' },
+    { re: /\bSYSTEM:\s/i, label: 'system tag' },
+];
+function checkInject(ctx) {
+    const concat = JSON.stringify(ctx.args);
+    for (const { re, label } of INJECTION_PATTERNS) {
+        if (re.test(concat)) {
+            return {
+                gate: 'inject',
+                allowed: false,
+                reason: `args 含 prompt injection 模式: ${label}`,
+                evidence: `匹配: ${label}`,
+            };
+        }
+    }
+    return { gate: 'inject', allowed: true };
+}
+// ============================================================
+// Gate 6: 输出审查 (tool 执行后, 审计 tool 返的字符串)
+// 单独入口 auditOutput, 不是调 tool 前的 gate
+// ============================================================
+function checkOutput(output) {
+    const hit = (0, builtin_guards_js_1.auditToolOutput)(output);
+    if (!hit) {
+        return { gate: 'output', allowed: true };
+    }
+    return {
+        gate: 'output',
+        allowed: hit.severity !== 'critical',
+        reason: hit.reason,
+        evidence: hit.evidence,
+    };
+}
+// ============================================================
+// Gate 7: 黑名单 (复用 PreToolUse hook 已有 6 条规则, 重新实现于此)
+// ============================================================
+const DANGEROUS_CMD_PATTERNS = [
+    { re: /\brm\s+(-[a-z]*f[a-z]*\s+)?-[a-z]*r[a-z]*\s+\//, reason: '禁止递归删除根目录' },
+    { re: /\bgit\s+push\s+.*--force\b/, reason: '禁止 force push' },
+    { re: /\brm\s+-rf\s+~\//, reason: '禁止递归删除 home' },
+    { re: /\bdd\s+if=.*\s+of=\/dev\//, reason: '禁止 dd 覆盖块设备' },
+    { re: /\bcurl\s+.*\|\s*(ba)?sh\b/, reason: '禁止 curl|sh 直执行' },
+    { re: />\s*\/dev\/sd[a-z]/, reason: '禁止写裸设备' },
+];
+function checkBlacklist(ctx) {
+    if (ctx.tool !== 'shell' && ctx.tool !== 'shell_exec' && ctx.tool !== 'bash') {
+        return { gate: 'blacklist', allowed: true };
+    }
+    const cmd = String(ctx.args.command || ctx.args.cmd || '');
+    for (const { re, reason } of DANGEROUS_CMD_PATTERNS) {
+        if (re.test(cmd)) {
+            return { gate: 'blacklist', allowed: false, reason, evidence: cmd.substring(0, 100) };
+        }
+    }
+    return { gate: 'blacklist', allowed: true };
+}
+const TOOL_GATES = [
+    checkSchema,
+    checkChannel,
+    checkRate,
+    checkInject,
+    // 2026-08-04: 移除 checkChain — 单轮 5 工具上限会打断 agent 长流程 (MCP 多步测试被反复拦), 用户要求去掉
+    checkBlacklist,
+    // checkOutput 不在 tool.execute 前
+];
+function runToolGates(ctx) {
+    const details = [];
+    for (const check of TOOL_GATES) {
+        try {
+            const r = check(ctx);
+            details.push(r);
+            if (!r.allowed) {
+                return { allowed: false, rejectedBy: r.gate, reason: r.reason, details };
+            }
+        }
+        catch (err) {
+            // 静默: 任意 gate 自身挂掉 = pass (fail-open)
+            console.warn(`[tool-gate] ${check.name} failed (non-fatal, allowing):`, err);
+        }
+    }
+    return { allowed: true, details };
+}
+/** Post-call: 审查 tool 返的 output */
+function runOutputGate(output) {
+    const r = checkOutput(output);
+    return { allowed: r.allowed, rejectedBy: r.gate, reason: r.reason, details: [r] };
+}
+//# sourceMappingURL=tool-gate.js.map

package/dist/electron-build/security/tool-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-gate.js","sourceRoot":"","sources":["../../../src/security/tool-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;AAIH,2DAA2G;AAsB3G,+DAA+D;AAC/D,cAAc;AACd,+DAA+D;AAE/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,sCAAsC;IACtC,eAAe,EAAE,oBAAoB,EAAE,kBAAkB;IACzD,YAAY,EAAE,cAAc,EAAE,mBAAmB;IACjD,cAAc,EAAE,aAAa,EAAE,iBAAiB;IAChD,YAAY,EAAE,OAAO;IACrB,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY;IAC1C,eAAe,EAAE,mBAAmB,EAAE,eAAe;IACrD,iBAAiB,EAAE,gBAAgB;IACnC,mEAAmE;IACnE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY;IAChE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY;IACtD,WAAW,EAAE,cAAc;IAC3B,mDAAmD;IACnD,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW;IAChD,YAAY,EAAE,YAAY;IAC1B,SAAS,EAAE,UAAU,EAAE,WAAW;IAClC,YAAY,EAAE,WAAW;IACzB,6DAA6D;IAC7D,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,YAAY;IACxG,kFAAkF;IAClF,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB;IAC1I,yBAAyB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,yBAAyB;IACjI,aAAa;IACb,YAAY;IACZ,UAAU;IACV,yCAAyC;IACzC,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB;IAC1D,aAAa,EAAE,oBAAoB,EAAE,WAAW;IAChD,eAAe,EAAE,qBAAqB;IACtC,2CAA2C;IAC3C,cAAc,EAAE,cAAc,EAAE,uBAAuB,EAAE,eAAe;IACxE,kDAAkD;IAClD,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;IACzD,4DAA4D;IAC5D,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,gBAAgB;IAC3E,4DAA4D;IAC5D,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB;IACnE,2DAA2D;IAC3D,gBAAgB,EAAE,UAAU;IAC5B,4CAA4C;IAC5C,aAAa;IACb,oDAAoD;IACpD,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc;IACjE,yCAAyC;IACzC,WAAW,EAAE,YAAY;IACzB,2CAA2C;IAC3C,sBAAsB,EAAE,wBAAwB;IAChD,6DAA6D;IAC7D,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;IAC5E,uBAAuB,EAAE,iBAAiB;IAC1C,mBAAmB,EAAE,mBAAmB;IACxC,oFAAoF;IACpF,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe;IAChG,oEAAoE;IACpE,oBAAoB,EAAE,oBAAoB;IAC1C,8DAA8D;IAC9D,SAAS,EAAE,OAAO,EAAE,cAAc;IAClC,YAAY,EAAE,SAAS,EAAE,aAAa;IACtC,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,cAAc,EAAE,aAAa;IAC7C,uCAAuC;IACvC,mBAAmB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAAE,kBAAkB;CAClG,CAAC,CAAC;AAEU,QAAA,aAAa,GAAe,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAE9E;;;GAGG;AACH,wBAA+B,GAAgB;IAC7C,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,QAAA,aAAa,CAAC;IACvB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,OAAO,GAAG,CAAC,IAAI,SAAS;QAChC,QAAQ,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;KACzE,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,kCAAkC;AAClC,+DAA+D;AAE/D,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAEjE,qBAA4B,GAAgB;IAC1C,qDAAqD;IACrD,SAAS,QAAQ,CAAC,GAAY,EAAE,IAAI,GAAa,EAAE;QACjD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,IAAK,cAAoC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1E,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,sCAAsC,YAAY,EAAE;YAC5D,QAAQ,EAAE,YAAY;SACvB,CAAC;IACJ,CAAC;IACD,wDAAwD;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,YAAY,IAAI,CAAC,MAAM,4BAA4B;YAC3D,QAAQ,EAAE,aAAa,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAChD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,+DAA+D;AAC/D,8CAA8C;AAC9C,+DAA+D;AAE/D,0CAA0C;AAC1C,MAAM,qBAAqB,GAA2C;AACpE,mEAAmE;CACpE,CAAC;AAEF,sBAA6B,GAAgB;IAC3C,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,GAAG,CAAC,SAAS,WAAW,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,YAAY,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,GAAG,CAAC,SAAS,WAAW,CAAC,EAAE,EAAE,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,+DAA+D;AAC/D,qCAAqC;AACrC,+DAA+D;AAE/D,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,mBAA0B,GAAgB;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,QAAQ,CAAC,MAAM,UAAU,kBAAkB,GAAG;YACrF,QAAQ,EAAE,MAAM,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACzG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,+DAA+D;AAC/D,8BAA8B;AAC9B,+DAA+D;AAE/D,MAAM,kBAAkB,GAAyC;IAC/D,EAAE,EAAE,EAAE,2DAA2D,EAAE,KAAK,EAAE,iBAAiB,EAAE;IAC7F,EAAE,EAAE,EAAE,wDAAwD,EAAE,KAAK,EAAE,WAAW,EAAE;IACpF,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,eAAe,EAAE;IAClD,EAAE,EAAE,EAAE,4BAA4B,EAAE,KAAK,EAAE,wBAAwB,EAAE;IACrE,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE;IAC7C,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;IAC3C,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;CAC5C,CAAC;AAEF,qBAA4B,GAAgB;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,kBAAkB,EAAE,CAAC;QAC/C,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,+BAA+B,KAAK,EAAE;gBAC9C,QAAQ,EAAE,OAAO,KAAK,EAAE;aACzB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,+DAA+D;AAC/D,yCAAyC;AACzC,qCAAqC;AACrC,+DAA+D;AAE/D,qBAA4B,MAAc;IACxC,MAAM,GAAG,GAAG,IAAA,mCAAe,EAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,UAAU;QACpC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,oDAAoD;AACpD,+DAA+D;AAE/D,MAAM,sBAAsB,GAA0C;IACpE,EAAE,EAAE,EAAE,gDAAgD,EAAE,MAAM,EAAE,WAAW,EAAE;IAC7E,EAAE,EAAE,EAAE,4BAA4B,EAAE,MAAM,EAAE,eAAe,EAAE;IAC7D,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,EAAE;IACjD,EAAE,EAAE,EAAE,2BAA2B,EAAE,MAAM,EAAE,aAAa,EAAE;IAC1D,EAAE,EAAE,EAAE,2BAA2B,EAAE,MAAM,EAAE,gBAAgB,EAAE;IAC7D,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAQ,EAAE;CAC/C,CAAC;AAEF,wBAA+B,GAAgB;IAC7C,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC3D,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACpD,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAcD,MAAM,UAAU,GAA4C;IAC1D,WAAW;IACX,YAAY;IACZ,SAAS;IACT,WAAW;IACX,4EAA4E;IAC5E,cAAc;IACd,gCAAgC;CACjC,CAAC;AAEF,sBAA6B,GAAgB;IAC3C,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,IAAI,gCAAgC,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,mCAAmC;AACnC,uBAA8B,MAAc;IAC1C,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC"}