@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/governance/post-tool-audit-enrichment.js

@@ -0,0 +1,466 @@
+/**
+ * PostToolAuditEnricher -- Policy-gated, field-aware enrichment of post-tool
+ * audit events.
+ *
+ * Problem:
+ *   The existing PostToolUse audit chain captures metadata (tool name, agent,
+ *   cycle, duration) but NOT the params an agent passed in nor the results
+ *   returned. This blinds forensics: auditors can see WHICH tool was called
+ *   but not WHAT was passed or returned.
+ *
+ * Solution:
+ *   Default-deny. No params/results are logged unless an operator explicitly
+ *   configures an enrichment rule for a (orgId, agentId, packId, toolName)
+ *   tuple. Rules specify per-field redaction modes so sensitive fields are
+ *   hashed, tokenized, or redacted before they enter the audit chain.
+ *
+ * Redaction modes:
+ *   redact    -- field replaced with '<REDACTED>'. Credentials, raw tokens.
+ *   hash      -- field replaced with 'sha256:<16-hex-chars>'. PHI/PII.
+ *               Same value => same hash. Operators can verify presence without
+ *               seeing raw value.
+ *   tokenize  -- field replaced with 'tok_<8-hex>_<seq>'. Per-org reversible.
+ *               Operators retain the de-tokenization map. Auditors may request
+ *               resolution via operator cooperation.
+ *   log       -- explicit pass-through. Field logged unredacted.
+ *
+ * Default-deny semantic:
+ *   If `enabledForTools` for the agent's bound packs does NOT list toolName,
+ *   enricher falls back to existing metadata-only TOOL_INVOCATION_COMPLETED
+ *   event. Operators must opt in tool-by-tool. Avoids accidental leakage from
+ *   an unreviewed tool schema.
+ *
+ * FieldPath syntax:
+ *   Dot notation: 'metadata.userId' resolves obj.metadata.userId.
+ *   Array wildcard: 'attachments[*].content' applies to each element.
+ *   Exact match only -- no fuzzy/partial matching (see PT-AUDIT-ENRICH-1).
+ *
+ * Tokenization (v0):
+ *   Tokens stored in-memory Map per org. Same value -> same token within org.
+ *   Cross-org lookup is rejected (PT-AUDIT-ENRICH-3).
+ *   V1 plan: persist token map to operator-side tokenization vault (out of scope
+ *   for this PR).
+ *
+ * Integration order (relative to PR #14 ToolRateLimiter):
+ *   1. PreToolUse: ToolRateLimiter.hook() -- rate check (throws if exceeded)
+ *   2. Tool executes
+ *   3. PostToolUse: ToolRateLimiter implicitly recorded (counter already
+ *      incremented in step 1); enrichAndEmit() fires AFTER the tool result
+ *      is available. The rate-limit counter is updated before the audit event
+ *      is emitted (no double-count risk).
+ *
+ * Pen-test gates:
+ *   PT-AUDIT-ENRICH-1: redaction-bypass via field aliasing. Defence is exact
+ *     fieldPath match only. Known limitation documented. Audit chain records
+ *     unmatched field names so operators can spot alias attacks.
+ *   PT-AUDIT-ENRICH-2: hash-collision lookup. SHA-256 full digest; 64-bit
+ *     prefix is the logged representation. Pre-image resistance is computationally
+ *     infeasible for SHA-256 (2^256 space). Full hash stored internally for
+ *     deduplication; only 16-char prefix emitted in audit event.
+ *   PT-AUDIT-ENRICH-3: tokenization cross-org leakage. Token map is keyed
+ *     per orgId. Cross-org token lookup produces a NEW token (not org-A's value).
+ *
+ * Compliance references:
+ *   HIPAA 164.312(b): Audit Controls -- tamper-evident activity logging
+ *   GDPR Art. 5(2): Accountability -- demonstrable compliance records
+ *   PCI DSS Req 10.2: Audit log events per security-related action
+ *   DORA Art. 9: ICT risk -- tool-invocation traceability
+ *   SOC 2 CC7.2: monitoring of system components
+ *
+ * BUILD_PLAN reference: line 237 "Post-tool-invocation audit enriched with
+ * full parameter + result logging (currently metadata-only)".
+ *
+ * @connexum/ai-governance
+ */
+import * as crypto from 'node:crypto';
+// ---------------------------------------------------------------------------
+// Strict-mode packs that require enrichment rules for every registered tool.
+// If a strict-pack tool is registered but has no enrichment rule, the enricher
+// emits ENRICHMENT_POLICY_VIOLATION severity ERROR.
+// ---------------------------------------------------------------------------
+export const ENRICHMENT_STRICT_MODE_PACKS = new Set([
+    'hipaa',
+    'gdpr',
+    'pci-dss',
+    'hmda',
+    'dora',
+]);
+// ---------------------------------------------------------------------------
+// Error classes
+// ---------------------------------------------------------------------------
+export class EnrichmentUnboundError extends Error {
+    context;
+    constructor(context) {
+        super(`PostToolAuditEnricher: packBinding must not be empty. Context: ${context}. ` +
+            `Per pack-binding-primacy governance: every audit record must carry at ` +
+            `least one pack binding for retention policy derivation.`);
+        this.name = 'EnrichmentUnboundError';
+        this.context = context;
+    }
+}
+// ---------------------------------------------------------------------------
+// Tokenization store (v0 in-memory; v1 plan: persist to operator vault)
+// ---------------------------------------------------------------------------
+/**
+ * PerOrgTokenStore -- isolated per-org token map.
+ *
+ * Token format: tok_<8-hex-of-sha256>_<seq>
+ *   - 8 hex = first 4 bytes of SHA-256(orgId + fieldPath + value)
+ *   - seq = per-(org, fieldPath) monotonically increasing counter
+ *
+ * Same value -> same token within org.
+ * Different orgs -> different tokens for the same raw value (PT-AUDIT-ENRICH-3).
+ *
+ * V1 plan: replace the inner Map with a call to an operator-supplied
+ * tokenization vault (e.g., Format-Preserving Encryption service, HashiCorp
+ * Vault Transit secrets engine, or AWS Macie tokenization). The vault
+ * persists the mapping across restarts, enabling auditors to request
+ * resolution with operator cooperation.
+ */
+class PerOrgTokenStore {
+    orgId;
+    /** key: `${fieldPath}::${value}` -> token */
+    tokenMap = new Map();
+    /** key: fieldPath -> next sequence number */
+    seqMap = new Map();
+    constructor(orgId) {
+        this.orgId = orgId;
+    }
+    tokenize(fieldPath, rawValue) {
+        const key = `${fieldPath}::${rawValue}`;
+        const existing = this.tokenMap.get(key);
+        if (existing)
+            return existing;
+        const seq = (this.seqMap.get(fieldPath) ?? 0) + 1;
+        this.seqMap.set(fieldPath, seq);
+        const hashInput = `${this.orgId}::${fieldPath}::${rawValue}`;
+        const hex8 = crypto.createHash('sha256').update(hashInput, 'utf8').digest('hex').slice(0, 8);
+        const seqStr = String(seq).padStart(3, '0');
+        const token = `tok_${hex8}_${seqStr}`;
+        this.tokenMap.set(key, token);
+        return token;
+    }
+    getOrgId() {
+        return this.orgId;
+    }
+}
+// ---------------------------------------------------------------------------
+// PostToolAuditEnricher
+// ---------------------------------------------------------------------------
+export class PostToolAuditEnricher {
+    /**
+     * rule registry key: `${orgId}::${agentId}::${toolName}`
+     * Value: first registered rule wins. Multiple configure() calls for the same
+     * key overwrite (last-write wins; operators should configure once at startup).
+     */
+    rules = new Map();
+    /** Per-org token stores for tokenization. */
+    tokenStores = new Map();
+    /** SHA chain: tracks the SHA-256 of the previous event. */
+    prevSha = '0'.repeat(64);
+    /** Audit sink: receives all emitted events. */
+    auditSink;
+    constructor(auditSink) {
+        this.auditSink = auditSink ?? (() => undefined);
+    }
+    // -------------------------------------------------------------------------
+    // Public: configure
+    // -------------------------------------------------------------------------
+    /**
+     * Register an enrichment policy for a specific (org, agent, tool) tuple.
+     *
+     * Operator-side call. Should be invoked once at agent startup for each tool
+     * that should have enriched audit logging. Tools NOT registered here fall
+     * back to metadata-only TOOL_INVOCATION_COMPLETED (default-deny).
+     *
+     * @param orgId      Tenant/org identifier.
+     * @param agentId    Agent identifier.
+     * @param packId     Compliance pack that owns this rule.
+     * @param toolName   Tool name (e.g., 'filesystem.read', 'http.fetch').
+     * @param paramRules Field redaction rules for invocation params.
+     * @param resultRules Field redaction rules for tool result.
+     */
+    configure(orgId, agentId, packId, toolName, paramRules, resultRules) {
+        const key = this.ruleKey(orgId, agentId, toolName);
+        this.rules.set(key, { packId, paramRules, resultRules });
+    }
+    // -------------------------------------------------------------------------
+    // Public: getEnrichmentStatus
+    // -------------------------------------------------------------------------
+    /**
+     * Returns whether enrichment is enabled for a given (org, agent, tool) tuple.
+     */
+    getEnrichmentStatus(orgId, agentId, toolName) {
+        return this.rules.has(this.ruleKey(orgId, agentId, toolName));
+    }
+    // -------------------------------------------------------------------------
+    // Public: enrichAndEmit
+    // -------------------------------------------------------------------------
+    /**
+     * Apply field-redaction rules and emit an audit event.
+     *
+     * If no rule is registered for the tool -> emits TOOL_INVOCATION_COMPLETED
+     * (metadata-only, default-deny).
+     *
+     * If a rule is registered -> emits TOOL_INVOCATION_ENRICHED with redacted
+     * params + result fields.
+     *
+     * Severity:
+     *   NOTICE  -- success=true
+     *   WARNING -- success=false (tool-side error)
+     *
+     * Strict-pack policy violation:
+     *   If the agent is bound to a strict pack (HIPAA, GDPR, PCI DSS, HMDA, DORA)
+     *   and the tool is NOT configured for enrichment, an
+     *   ENRICHMENT_POLICY_VIOLATION event (ERROR) is emitted BEFORE falling back
+     *   to the metadata-only event.
+     *
+     * @param orgId       Tenant/org identifier.
+     * @param agentId     Agent identifier.
+     * @param cycleId     Current governance cycle identifier.
+     * @param toolName    Tool name.
+     * @param params      Raw tool invocation params.
+     * @param result      Raw tool result (may be error object).
+     * @param durationMs  Tool execution duration in milliseconds.
+     * @param packBinding Active compliance pack IDs for this agent.
+     */
+    enrichAndEmit(orgId, agentId, cycleId, toolName, params, result, durationMs, packBinding) {
+        if (!packBinding || packBinding.length === 0) {
+            throw new EnrichmentUnboundError(`enrichAndEmit called for tool '${toolName}' on agent '${agentId}' with empty packBinding`);
+        }
+        const key = this.ruleKey(orgId, agentId, toolName);
+        const rule = this.rules.get(key);
+        const success = !(result instanceof Error) && result !== null && result !== undefined
+            ? true
+            : (result instanceof Error ? false : true);
+        const severity = success ? 'NOTICE' : 'WARNING';
+        const tsNs = this.nowNs();
+        if (!rule) {
+            // Check strict-pack violation: agent bound to strict pack but tool not configured
+            const strictViolatingPack = packBinding.find((p) => ENRICHMENT_STRICT_MODE_PACKS.has(p));
+            if (strictViolatingPack) {
+                const violationEvent = {
+                    type: 'ENRICHMENT_POLICY_VIOLATION',
+                    severity: 'ERROR',
+                    orgId,
+                    agentId,
+                    cycleId,
+                    toolName,
+                    violatingPackId: strictViolatingPack,
+                    reason: `Agent '${agentId}' is bound to strict pack '${strictViolatingPack}' ` +
+                        `but tool '${toolName}' has no enrichment rule configured. ` +
+                        `Strict packs require operators to explicitly configure enrichment rules ` +
+                        `or exclude the tool from audit scope.`,
+                    packBinding,
+                    timestampNs: tsNs,
+                    prevSha: this.prevSha,
+                };
+                this.emitAndChain(violationEvent);
+            }
+            // Default-deny fallback: metadata-only event
+            const metaEvent = {
+                type: 'TOOL_INVOCATION_COMPLETED',
+                severity,
+                orgId,
+                agentId,
+                cycleId,
+                toolName,
+                success,
+                durationMs,
+                packBinding,
+                timestampNs: tsNs,
+                prevSha: this.prevSha,
+            };
+            this.emitAndChain(metaEvent);
+            return;
+        }
+        // Enrichment path
+        const resultObj = this.normalizeResult(result);
+        const { enriched: enrichedParams, unmatched: unmatchedParamFields } = this.applyRules(orgId, params, rule.paramRules);
+        const { enriched: enrichedResult, unmatched: unmatchedResultFields } = this.applyRules(orgId, resultObj, rule.resultRules);
+        const enrichedEvent = {
+            type: 'TOOL_INVOCATION_ENRICHED',
+            severity,
+            orgId,
+            agentId,
+            cycleId,
+            toolName,
+            success,
+            durationMs,
+            packBinding,
+            enrichedParams,
+            enrichedResult,
+            unmatchedParamFields,
+            unmatchedResultFields,
+            timestampNs: tsNs,
+            prevSha: this.prevSha,
+        };
+        this.emitAndChain(enrichedEvent);
+    }
+    // -------------------------------------------------------------------------
+    // Private: rule application
+    // -------------------------------------------------------------------------
+    /**
+     * Apply a set of FieldRedactionRules to a flat-or-nested object.
+     *
+     * Returns:
+     *   enriched   -- copy of obj with rule-matching fields redacted/hashed/tokenized.
+     *   unmatched  -- leaf field paths present in obj that had no matching rule.
+     *                 Logged so operators can detect alias attacks (PT-AUDIT-ENRICH-1).
+     */
+    applyRules(orgId, obj, rules) {
+        const ruleMap = new Map();
+        for (const r of rules) {
+            ruleMap.set(r.fieldPath, r.mode);
+        }
+        const enriched = this.deepClone(obj);
+        const unmatched = [];
+        this.visitLeaves(enriched, '', ruleMap, unmatched, orgId);
+        return { enriched, unmatched };
+    }
+    /**
+     * Recursively visit all leaf paths in obj.
+     * For each leaf: if a matching rule exists, apply redaction mode.
+     * Otherwise, push path to unmatched list (PT-AUDIT-ENRICH-1 alias detection).
+     *
+     * Supports:
+     *   - Dot notation: 'metadata.userId'
+     *   - Array wildcard: 'attachments[*].content' via '[*]' segment
+     */
+    visitLeaves(obj, prefix, ruleMap, unmatched, orgId, parent, parentKey) {
+        if (Array.isArray(obj)) {
+            for (let i = 0; i < obj.length; i++) {
+                const elementPath = prefix ? `${prefix.replace(/\[\*\]$/, '')}[*]` : '[*]';
+                // Try exact array element path e.g. attachments[*].content is handled by parent
+                this.visitLeaves(obj[i], elementPath, ruleMap, unmatched, orgId, obj, i);
+            }
+            return;
+        }
+        if (obj !== null && typeof obj === 'object') {
+            const record = obj;
+            for (const [k, v] of Object.entries(record)) {
+                const childPath = prefix ? `${prefix}.${k}` : k;
+                // Also check array-wildcard path for nested array paths
+                const arrayPath = prefix.includes('[*]') ? childPath : childPath;
+                this.visitLeaves(v, arrayPath, ruleMap, unmatched, orgId, record, k);
+            }
+            return;
+        }
+        // Leaf value
+        if (parent === undefined || parentKey === undefined)
+            return;
+        const paths = this.candidatePaths(prefix);
+        let matched = false;
+        for (const candidatePath of paths) {
+            const mode = ruleMap.get(candidatePath);
+            if (mode !== undefined) {
+                matched = true;
+                const raw = String(obj ?? '');
+                if (Array.isArray(parent)) {
+                    parent[parentKey] = this.applyMode(orgId, candidatePath, raw, mode);
+                }
+                else {
+                    parent[parentKey] = this.applyMode(orgId, candidatePath, raw, mode);
+                }
+                break;
+            }
+        }
+        if (!matched) {
+            // Leaf had no matching rule -- log path so operators can detect aliases
+            unmatched.push(prefix);
+        }
+    }
+    /**
+     * Return all candidate path strings to check in ruleMap for a given prefix.
+     * Handles both exact paths and array-wildcard normalization.
+     */
+    candidatePaths(prefix) {
+        // Return both the exact path and a normalized [*] version
+        const paths = [prefix];
+        // Normalize numeric indices to [*] wildcard for matching
+        const wildcardPath = prefix.replace(/\[\d+\]/g, '[*]');
+        if (wildcardPath !== prefix)
+            paths.push(wildcardPath);
+        return paths;
+    }
+    /**
+     * Apply a single redaction mode to a raw string value.
+     *
+     * redact   -> '<REDACTED>'
+     * hash     -> 'sha256:<16-hex>' (first 16 hex chars of SHA-256)
+     * tokenize -> 'tok_<8-hex>_<seq>' (per-org reversible token)
+     * log      -> raw value (explicit pass-through)
+     */
+    applyMode(orgId, fieldPath, rawValue, mode) {
+        switch (mode) {
+            case 'redact':
+                return '<REDACTED>';
+            case 'hash': {
+                const full = crypto.createHash('sha256').update(rawValue, 'utf8').digest('hex');
+                return `sha256:${full.slice(0, 16)}`;
+            }
+            case 'tokenize': {
+                const store = this.getOrCreateTokenStore(orgId);
+                return store.tokenize(fieldPath, rawValue);
+            }
+            case 'log':
+                return rawValue;
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Private: helpers
+    // -------------------------------------------------------------------------
+    ruleKey(orgId, agentId, toolName) {
+        return `${orgId}::${agentId}::${toolName}`;
+    }
+    getOrCreateTokenStore(orgId) {
+        let store = this.tokenStores.get(orgId);
+        if (!store) {
+            store = new PerOrgTokenStore(orgId);
+            this.tokenStores.set(orgId, store);
+        }
+        return store;
+    }
+    normalizeResult(result) {
+        if (result === null || result === undefined)
+            return {};
+        if (result instanceof Error)
+            return { error: result.message };
+        if (typeof result === 'object' && !Array.isArray(result)) {
+            return result;
+        }
+        return { value: result };
+    }
+    deepClone(obj) {
+        return JSON.parse(JSON.stringify(obj));
+    }
+    /**
+     * Emit an audit event and advance the SHA-256 chain.
+     * Chain ensures replay or modification is detectable.
+     */
+    emitAndChain(event) {
+        this.auditSink(event);
+        this.prevSha = crypto
+            .createHash('sha256')
+            .update(JSON.stringify(event), 'utf8')
+            .digest('hex');
+    }
+    /**
+     * Return current time as nanoseconds (string).
+     */
+    nowNs() {
+        try {
+            return String(process.hrtime.bigint());
+        }
+        catch {
+            return String(BigInt(Date.now()) * 1000000n);
+        }
+    }
+    /**
+     * Expose current prevSha for chain verification in tests.
+     */
+    getCurrentChainHash() {
+        return this.prevSha;
+    }
+}
+//# sourceMappingURL=post-tool-audit-enrichment.js.map

package/dist/esm/governance/post-tool-audit-enrichment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-tool-audit-enrichment.js","sourceRoot":"","sources":["../../../src/governance/post-tool-audit-enrichment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,oDAAoD;AACpD,8EAA8E;AAE9E,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,OAAO;IACP,MAAM;IACN,SAAS;IACT,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAyHH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,OAAO,CAAS;IAEzB,YAAY,OAAe;QACzB,KAAK,CACH,kEAAkE,OAAO,IAAI;YAC3E,wEAAwE;YACxE,yDAAyD,CAC5D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,gBAAgB;IAMS;IAL7B,6CAA6C;IAC5B,QAAQ,GAAwB,IAAI,GAAG,EAAE,CAAC;IAC3D,6CAA6C;IAC5B,MAAM,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEzD,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE9C,QAAQ,CAAC,SAAiB,EAAE,QAAgB;QAC1C,MAAM,GAAG,GAAG,GAAG,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEhC,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,IAAI,IAAI,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAYD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,MAAM,OAAO,qBAAqB;IAChC;;;;OAIG;IACc,KAAK,GAAgC,IAAI,GAAG,EAAE,CAAC;IAEhE,6CAA6C;IAC5B,WAAW,GAAkC,IAAI,GAAG,EAAE,CAAC;IAExE,2DAA2D;IACnD,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAEjC,+CAA+C;IAC9B,SAAS,CAAsC;IAEhE,YAAY,SAA+C;QACzD,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,4EAA4E;IAC5E,oBAAoB;IACpB,4EAA4E;IAE5E;;;;;;;;;;;;;OAaG;IACH,SAAS,CACP,KAAa,EACb,OAAe,EACf,MAAc,EACd,QAAgB,EAChB,UAAgC,EAChC,WAAiC;QAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,4EAA4E;IAC5E,8BAA8B;IAC9B,4EAA4E;IAE5E;;OAEG;IACH,mBAAmB,CAAC,KAAa,EAAE,OAAe,EAAE,QAAgB;QAClE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,aAAa,CACX,KAAa,EACb,OAAe,EACf,OAAe,EACf,QAAgB,EAChB,MAA+B,EAC/B,MAAe,EACf,UAAkB,EAClB,WAAqB;QAErB,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,sBAAsB,CAC9B,kCAAkC,QAAQ,eAAe,OAAO,0BAA0B,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,YAAY,KAAK,CAAC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;YACnF,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAyB,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAE1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,kFAAkF;YAClF,MAAM,mBAAmB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACzF,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,cAAc,GAAmC;oBACrD,IAAI,EAAE,6BAA6B;oBACnC,QAAQ,EAAE,OAAO;oBACjB,KAAK;oBACL,OAAO;oBACP,OAAO;oBACP,QAAQ;oBACR,eAAe,EAAE,mBAAmB;oBACpC,MAAM,EACJ,UAAU,OAAO,8BAA8B,mBAAmB,IAAI;wBACtE,aAAa,QAAQ,uCAAuC;wBAC5D,0EAA0E;wBAC1E,uCAAuC;oBACzC,WAAW;oBACX,WAAW,EAAE,IAAI;oBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC;gBACF,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;YACpC,CAAC;YAED,6CAA6C;YAC7C,MAAM,SAAS,GAAiC;gBAC9C,IAAI,EAAE,2BAA2B;gBACjC,QAAQ;gBACR,KAAK;gBACL,OAAO;gBACP,OAAO;gBACP,QAAQ;gBACR,OAAO;gBACP,UAAU;gBACV,WAAW;gBACX,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,kBAAkB;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAE/C,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE,GACjE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAElD,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,qBAAqB,EAAE,GAClE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAEtD,MAAM,aAAa,GAAgC;YACjD,IAAI,EAAE,0BAA0B;YAChC,QAAQ;YACR,KAAK;YACL,OAAO;YACP,OAAO;YACP,QAAQ;YACR,OAAO;YACP,UAAU;YACV,WAAW;YACX,cAAc;YACd,cAAc;YACd,oBAAoB;YACpB,qBAAqB;YACrB,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC;IAED,4EAA4E;IAC5E,4BAA4B;IAC5B,4EAA4E;IAE5E;;;;;;;OAOG;IACK,UAAU,CAChB,KAAa,EACb,GAA4B,EAC5B,KAA2B;QAE3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAE1D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACK,WAAW,CACjB,GAAY,EACZ,MAAc,EACd,OAAwC,EACxC,SAAmB,EACnB,KAAa,EACb,MAA4C,EAC5C,SAA2B;QAE3B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC3E,gFAAgF;gBAChF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAgB,EAAE,CAAC,CAAC,CAAC;YACxF,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,GAA8B,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChD,wDAAwD;gBACxD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,OAAO;QACT,CAAC;QAED,aAAa;QACb,IAAI,MAAM,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO;QAE5D,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,aAAa,IAAI,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzB,MAAoB,CAAC,SAAmB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/F,CAAC;qBAAM,CAAC;oBACL,MAAkC,CAAC,SAAmB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7G,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,wEAAwE;YACxE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,MAAc;QACnC,0DAA0D;QAC1D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,yDAAyD;QACzD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,YAAY,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACK,SAAS,CAAC,KAAa,EAAE,SAAiB,EAAE,QAAgB,EAAE,IAAwB;QAC5F,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,QAAQ;gBACX,OAAO,YAAY,CAAC;YACtB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChF,OAAO,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACvC,CAAC;YACD,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,KAAK;gBACR,OAAO,QAAQ,CAAC;QACpB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,mBAAmB;IACnB,4EAA4E;IAEpE,OAAO,CAAC,KAAa,EAAE,OAAe,EAAE,QAAgB;QAC9D,OAAO,GAAG,KAAK,KAAK,OAAO,KAAK,QAAQ,EAAE,CAAC;IAC7C,CAAC;IAEO,qBAAqB,CAAC,KAAa;QACzC,IAAI,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CAAC,MAAe;QACrC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACvD,IAAI,MAAM,YAAY,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO,MAAiC,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAEO,SAAS,CAAC,GAA4B;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAA4B,CAAC;IACpE,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,KAAyB;QAC5C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM;aAClB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;aACrC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,KAAK;QACX,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,QAAU,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF"}