@connexum/ai-governance 1.0.0-beta.11

package/dist/governance/rag-source-allowlist.js

@@ -0,0 +1,535 @@
+"use strict";
+/**
+ * RagSourceAllowlist -- Per-agent, per-org RAG retrieval source allowlisting.
+ *
+ * When an agent performs retrieval (vector search, document lookup, web fetch
+ * for grounding, MCP resource access), the source must be on the agent's
+ * configured allowlist. Off-allowlist retrieval is rejected BEFORE the actual
+ * retrieval call is made (pre-retrieval gate, not post-fetch).
+ *
+ * Entry kinds:
+ *   - vector-store:         literal ID match (e.g. "vs_org_a_pubmed_2026")
+ *   - document-collection:  literal ID match (e.g. "dc_legal_casebook_2025")
+ *   - url-prefix:           URL prefix match with scheme-aware canonicalisation
+ *   - mcp-resource:         MCP URI prefix match with path canonicalisation
+ *
+ * Strict-mode packs (fail-closed when no allowlist is configured):
+ *   - hipaa     HIPAA §164.312(a)(1): access control to PHI sources
+ *   - gdpr      GDPR Art. 5(1)(b): purpose limitation, storage limitation
+ *   - pci-dss   PCI DSS Req 7: restrict access to system components
+ *   - hmda      HMDA Reg C 12 CFR §1003: GMI data source integrity
+ *   - dora      DORA Art. 9: ICT risk management, third-party data access
+ *
+ * Non-strict packs default to lenient mode: first retrieval per cycle emits
+ * one audit warning and allows; subsequent retrievals in the same cycle do not
+ * re-emit (spam prevention).
+ *
+ * Audit events:
+ *   - RAG_SOURCE_REJECTED  severity WARNING, sourceHash (SHA-256, not raw URL)
+ *   - RAG_SOURCE_ALLOWED   severity INFO
+ *   - RAG_UNALLOWLISTED_WARN severity WARNING (lenient-mode first-call)
+ *
+ * Pack-binding is mandatory on every entry (UnboundDataError if missing).
+ *
+ * Integration:
+ *   - LlamaIndex: call guardPreRetrieval() inside the documentRetrieval() hook
+ *     before LlamaIndex executes the vector-store or document-store fetch.
+ *   - Haystack:   call guardPreRetrieval() in the nodeStart() hook when
+ *     nodeType is 'Retriever' or 'DocumentStore'.
+ *   - Other adapters: any adapter exposing a retrieval surface should call
+ *     guardPreRetrieval() before dispatching to the underlying retrieval API.
+ *   - The PreRetrievalHook interface in src/governance/index.ts declares the
+ *     integration contract for adapters that want to self-register.
+ *
+ * Pen-test gates:
+ *   PT-RAG-ALLOWLIST-1: URL-encoding bypass -- encoded host confusables are
+ *     normalised and rejected.
+ *   PT-RAG-ALLOWLIST-2: vector-store ID confusable -- "vs_x_evil" is not
+ *     accepted when allowlist has "vs_x"; exact match required.
+ *   PT-RAG-ALLOWLIST-3: MCP URI traversal -- "../" segments are canonicalised
+ *     away and traversal is blocked.
+ *
+ * BUILD_PLAN reference: line 246 "Retrieval source allowlisting per agent".
+ *
+ * @connexum/ai-governance
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RagSourceAllowlist = exports.UnboundDataError = exports.RagSourceAllowlistRequiredError = exports.RagSourceNotAllowlistedError = exports.STRICT_MODE_PACKS = void 0;
+const crypto = __importStar(require("node:crypto"));
+// ---------------------------------------------------------------------------
+// Strict-mode pack list
+// ---------------------------------------------------------------------------
+/**
+ * Packs that force fail-closed behaviour when no allowlist is configured.
+ * If an agent is bound to any of these packs and has no allowlist entries,
+ * every retrieval throws RagSourceAllowlistRequiredError.
+ *
+ * hipaa  -- HIPAA §164.312(a)(1): PHI access controls; unconfigured source
+ *           access violates minimum-necessary principle.
+ * gdpr   -- GDPR Art. 5(1)(b) purpose limitation; Art. 25 data minimisation.
+ * pci-dss -- PCI DSS Req 7: restrict access to system components to business
+ *           need-to-know; cardholder data sources must be explicit.
+ * hmda   -- HMDA Reg C §1003: GMI data (race, sex, ethnicity) must only flow
+ *           from verified HMDA collection forms, not arbitrary sources.
+ * dora   -- DORA Art. 9: ICT third-party risk; unknown data sources are an
+ *           unacknowledged ICT risk requiring explicit registration.
+ */
+exports.STRICT_MODE_PACKS = new Set([
+    'hipaa',
+    'gdpr',
+    'pci-dss',
+    'hmda',
+    'dora',
+]);
+// ---------------------------------------------------------------------------
+// Error classes
+// ---------------------------------------------------------------------------
+/**
+ * Thrown when a retrieval source is not on the agent's allowlist.
+ */
+class RagSourceNotAllowlistedError extends Error {
+    orgId;
+    agentId;
+    sourceHash;
+    kind;
+    constructor(opts) {
+        super(`RAG retrieval blocked: agent '${opts.agentId}' (org '${opts.orgId}') attempted ` +
+            `to retrieve from a source (kind: ${opts.kind}) that is not on its configured allowlist.`);
+        this.name = 'RagSourceNotAllowlistedError';
+        this.orgId = opts.orgId;
+        this.agentId = opts.agentId;
+        this.sourceHash = opts.sourceHash;
+        this.kind = opts.kind;
+    }
+}
+exports.RagSourceNotAllowlistedError = RagSourceNotAllowlistedError;
+/**
+ * Thrown when a strict-mode pack is bound to an agent that has no allowlist
+ * configured. Fail-closed: every retrieval is rejected.
+ */
+class RagSourceAllowlistRequiredError extends Error {
+    orgId;
+    agentId;
+    strictPacks;
+    constructor(opts) {
+        super(`RAG retrieval blocked: agent '${opts.agentId}' (org '${opts.orgId}') has no ` +
+            `RAG source allowlist configured but is bound to strict-mode pack(s): ` +
+            `[${opts.strictPacks.join(', ')}]. ` +
+            `Configure an allowlist via RagSourceAllowlist.configure() before enabling retrieval.`);
+        this.name = 'RagSourceAllowlistRequiredError';
+        this.orgId = opts.orgId;
+        this.agentId = opts.agentId;
+        this.strictPacks = opts.strictPacks;
+    }
+}
+exports.RagSourceAllowlistRequiredError = RagSourceAllowlistRequiredError;
+/**
+ * Thrown when configure() receives an entry with an empty packBinding.
+ * Per feedback_pack_binding_primacy.md: every entry MUST carry packBinding.
+ */
+class UnboundDataError extends Error {
+    entryPattern;
+    constructor(pattern) {
+        super(`RagSourceAllowlist entry '${pattern}' has an empty packBinding. ` +
+            `Every allowlist entry must carry at least one pack binding. ` +
+            `Set packBinding to the compliance pack(s) governing this data source.`);
+        this.name = 'UnboundDataError';
+        this.entryPattern = pattern;
+    }
+}
+exports.UnboundDataError = UnboundDataError;
+// ---------------------------------------------------------------------------
+// Internal agent key
+// ---------------------------------------------------------------------------
+function agentKey(orgId, agentId) {
+    return `${orgId}::${agentId}`;
+}
+// ---------------------------------------------------------------------------
+// URL canonicalisation helpers
+// ---------------------------------------------------------------------------
+/**
+ * Canonicalise a URL for allowlist matching.
+ *
+ * Rules:
+ * 1. Parse with the built-in URL class (throws on malformed URLs).
+ * 2. Reject any URL with embedded credentials (user or password in authority).
+ * 3. Normalise scheme to lowercase.
+ * 4. Normalise host to lowercase.
+ * 5. Decode percent-encoded characters in the host (prevents encoding bypass).
+ * 6. Resolve any ".." or "." segments in the pathname.
+ * 7. Return a normalised URL string (scheme + host + path) without query or hash.
+ *
+ * Returns null if the URL is invalid or has embedded credentials.
+ */
+function canonicaliseUrl(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    // Reject embedded credentials
+    if (parsed.username || parsed.password) {
+        return null;
+    }
+    const scheme = parsed.protocol.toLowerCase().replace(/:$/, '');
+    const host = decodeURIComponent(parsed.hostname).toLowerCase();
+    // Resolve ".." segments in pathname
+    const segments = parsed.pathname.split('/');
+    const resolved = [];
+    for (const seg of segments) {
+        if (seg === '..') {
+            resolved.pop();
+        }
+        else if (seg !== '.') {
+            resolved.push(seg);
+        }
+    }
+    const path = resolved.join('/') || '/';
+    const port = parsed.port ? `:${parsed.port}` : '';
+    return `${scheme}://${host}${port}${path}`;
+}
+/**
+ * Canonicalise an MCP URI for allowlist matching.
+ *
+ * Rules:
+ * 1. Lowercase the scheme ("mcp://").
+ * 2. Lowercase the host segment.
+ * 3. Remove trailing slash before the path.
+ * 4. Resolve ".." and "." segments in the path (traversal prevention).
+ *
+ * Returns null if the URI cannot be parsed (no valid mcp:// scheme) or
+ * if it contains ".." segments that escape the root.
+ */
+function canonicaliseMcpUri(raw) {
+    const lower = raw.toLowerCase();
+    if (!lower.startsWith('mcp://'))
+        return null;
+    // Strip "mcp://" and split into host + path
+    const withoutScheme = raw.slice('mcp://'.length);
+    const slashIdx = withoutScheme.indexOf('/');
+    const host = (slashIdx === -1 ? withoutScheme : withoutScheme.slice(0, slashIdx)).toLowerCase();
+    const rawPath = slashIdx === -1 ? '' : withoutScheme.slice(slashIdx);
+    // Resolve path segments
+    const segments = rawPath.split('/');
+    const resolved = [];
+    for (const seg of segments) {
+        if (seg === '..') {
+            if (resolved.length === 0)
+                return null; // traversal above root
+            resolved.pop();
+        }
+        else if (seg !== '.') {
+            resolved.push(seg);
+        }
+    }
+    const path = resolved.join('/');
+    return `mcp://${host}${path}`;
+}
+// ---------------------------------------------------------------------------
+// RagSourceAllowlist
+// ---------------------------------------------------------------------------
+/**
+ * Per-agent, per-org RAG retrieval source allowlist.
+ *
+ * Usage:
+ *   const allowlist = new RagSourceAllowlist(auditSink);
+ *
+ *   // Operator configuration at agent-startup time:
+ *   allowlist.configure('org-acme', 'agent-rag-01', [
+ *     { pattern: 'vs_acme_pubmed_2026', kind: 'vector-store', packBinding: ['hipaa'] },
+ *     { pattern: 'https://drugs.fda.gov/', kind: 'url-prefix', packBinding: ['hipaa'] },
+ *   ]);
+ *
+ *   // Pre-retrieval gate (call BEFORE dispatching to the retrieval API):
+ *   allowlist.guardPreRetrieval('org-acme', 'agent-rag-01', {
+ *     source: 'vs_acme_pubmed_2026',
+ *     kind:   'vector-store',
+ *   }); // returns { allowed: true, matchedEntry }
+ *
+ *   // Throws RagSourceNotAllowlistedError if source is not on the list.
+ *   // Throws RagSourceAllowlistRequiredError if strict pack is bound + no list.
+ */
+class RagSourceAllowlist {
+    /** Key: orgId::agentId -> entries */
+    lists = new Map();
+    /** Key: orgId::agentId -> pack bindings active for strict-mode checks */
+    agentPackBindings = new Map();
+    /**
+     * Per-cycle lenient-warn tracking.
+     * Key: orgId::agentId -> Set of cycle IDs that have already emitted the
+     * single per-cycle warning. Prevents spam in lenient mode.
+     */
+    lenientWarnEmitted = new Set();
+    /** SHA-256 of the last emitted audit event (chain linkage). */
+    prevSha = '0'.repeat(64);
+    auditSink;
+    constructor(auditSink) {
+        this.auditSink = auditSink ?? (() => undefined);
+        // Re-initialise lenientWarnEmitted as a proper Map
+        this.lenientWarnEmitted = new Map();
+    }
+    // ---------------------------------------------------------------------------
+    // configure()
+    // ---------------------------------------------------------------------------
+    /**
+     * Register the allowlist for an agent.
+     *
+     * Throws UnboundDataError if any entry has an empty packBinding (mandatory
+     * per feedback_pack_binding_primacy.md).
+     *
+     * @param orgId   Operator/tenant identifier.
+     * @param agentId Agent identifier.
+     * @param entries Allowlist entries for this agent.
+     * @param activePackIds Optional list of active compliance pack IDs for strict-mode determination.
+     */
+    configure(orgId, agentId, entries, activePackIds) {
+        // Validate pack binding on every entry
+        for (const entry of entries) {
+            if (!entry.packBinding || entry.packBinding.length === 0) {
+                throw new UnboundDataError(entry.pattern);
+            }
+        }
+        const key = agentKey(orgId, agentId);
+        this.lists.set(key, entries);
+        if (activePackIds) {
+            this.agentPackBindings.set(key, activePackIds);
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // guardPreRetrieval()
+    // ---------------------------------------------------------------------------
+    /**
+     * Pre-retrieval gate. Must be called BEFORE dispatching to the retrieval API.
+     *
+     * Returns { allowed: true, matchedEntry } on success.
+     * Throws RagSourceNotAllowlistedError when the source is not allowlisted.
+     * Throws RagSourceAllowlistRequiredError when a strict pack is bound and
+     * no allowlist is configured.
+     *
+     * @param orgId   Operator/tenant identifier.
+     * @param agentId Agent identifier.
+     * @param request Retrieval request with source and kind.
+     * @param cycleId Optional cycle identifier used for lenient-mode spam prevention.
+     */
+    guardPreRetrieval(orgId, agentId, request, cycleId) {
+        const key = agentKey(orgId, agentId);
+        const entries = this.lists.get(key);
+        const sourceHash = this.sha256(request.source);
+        // -- No allowlist configured -----------------------------------------------
+        if (!entries || entries.length === 0) {
+            const packBindings = this.agentPackBindings.get(key) ?? [];
+            const strictActive = packBindings.filter((p) => exports.STRICT_MODE_PACKS.has(p));
+            if (strictActive.length > 0) {
+                // Strict-mode pack with no allowlist: fail-closed
+                this.emitRejection(orgId, agentId, sourceHash, request.kind, 'strict-mode-no-allowlist');
+                throw new RagSourceAllowlistRequiredError({
+                    orgId,
+                    agentId,
+                    strictPacks: strictActive,
+                });
+            }
+            // Lenient mode: warn once per cycle, then allow
+            const warnKey = key;
+            const cycleSet = this.lenientWarnEmitted.get(warnKey) ?? new Set();
+            const effectiveCycleId = cycleId ?? '_default';
+            if (!cycleSet.has(effectiveCycleId)) {
+                cycleSet.add(effectiveCycleId);
+                this.lenientWarnEmitted.set(warnKey, cycleSet);
+                const event = {
+                    type: 'RAG_UNALLOWLISTED_WARN',
+                    severity: 'WARNING',
+                    orgId,
+                    agentId,
+                    sourceHash,
+                    kind: request.kind,
+                    timestamp: new Date().toISOString(),
+                };
+                this.auditSink(event);
+            }
+            // Lenient allow -- construct a synthetic entry so return type is consistent
+            const syntheticEntry = {
+                pattern: '*',
+                kind: request.kind,
+                packBinding: ['__lenient__'],
+            };
+            return { allowed: true, matchedEntry: syntheticEntry };
+        }
+        // -- Allowlist is configured: find a matching entry -----------------------
+        const matched = this.findMatch(request, entries);
+        if (!matched) {
+            this.emitRejection(orgId, agentId, sourceHash, request.kind, 'not-allowlisted');
+            throw new RagSourceNotAllowlistedError({
+                orgId,
+                agentId,
+                sourceHash,
+                kind: request.kind,
+            });
+        }
+        const event = {
+            type: 'RAG_SOURCE_ALLOWED',
+            severity: 'INFO',
+            orgId,
+            agentId,
+            sourceHash,
+            kind: request.kind,
+            matchedPattern: matched.pattern,
+            timestamp: new Date().toISOString(),
+        };
+        this.auditSink(event);
+        return { allowed: true, matchedEntry: matched };
+    }
+    // ---------------------------------------------------------------------------
+    // getEntries()
+    // ---------------------------------------------------------------------------
+    /**
+     * Read-only view of allowlist entries for an agent.
+     * Returns an empty array if no allowlist is configured.
+     */
+    getEntries(orgId, agentId) {
+        return this.lists.get(agentKey(orgId, agentId)) ?? [];
+    }
+    // ---------------------------------------------------------------------------
+    // clearAgent()
+    // ---------------------------------------------------------------------------
+    /**
+     * Remove all allowlist entries for an agent.
+     * Called at agent shutdown for clean teardown.
+     */
+    clearAgent(orgId, agentId) {
+        const key = agentKey(orgId, agentId);
+        this.lists.delete(key);
+        this.agentPackBindings.delete(key);
+        this.lenientWarnEmitted.delete(key);
+    }
+    // ---------------------------------------------------------------------------
+    // Private helpers
+    // ---------------------------------------------------------------------------
+    /**
+     * Find the first matching allowlist entry for the request.
+     * Returns null if no entry matches.
+     */
+    findMatch(request, entries) {
+        for (const entry of entries) {
+            if (entry.kind !== request.kind)
+                continue;
+            switch (request.kind) {
+                case 'vector-store':
+                case 'document-collection':
+                    // Exact match, case-sensitive
+                    if (request.source === entry.pattern)
+                        return entry;
+                    break;
+                case 'url-prefix': {
+                    const matched = this.matchUrlPrefix(request.source, entry.pattern);
+                    if (matched)
+                        return entry;
+                    break;
+                }
+                case 'mcp-resource': {
+                    const matched = this.matchMcpPrefix(request.source, entry.pattern);
+                    if (matched)
+                        return entry;
+                    break;
+                }
+            }
+        }
+        return null;
+    }
+    /**
+     * URL prefix matching with canonicalisation.
+     *
+     * - Reject URLs with embedded credentials immediately (no allowlist match).
+     * - Canonicalise both the request URL and the allowlist pattern before comparing.
+     * - Case-insensitive on scheme+host, case-sensitive on path.
+     */
+    matchUrlPrefix(rawSource, patternRaw) {
+        // Reject embedded credentials in source (PT-RAG-ALLOWLIST-1 guard)
+        const canonSource = canonicaliseUrl(rawSource);
+        if (canonSource === null)
+            return false;
+        const canonPattern = canonicaliseUrl(patternRaw);
+        if (canonPattern === null)
+            return false;
+        return canonSource === canonPattern || canonSource.startsWith(canonPattern);
+    }
+    /**
+     * MCP URI prefix matching with canonicalisation and traversal prevention.
+     * (PT-RAG-ALLOWLIST-3)
+     */
+    matchMcpPrefix(rawSource, patternRaw) {
+        const canonSource = canonicaliseMcpUri(rawSource);
+        if (canonSource === null)
+            return false;
+        const canonPattern = canonicaliseMcpUri(patternRaw);
+        if (canonPattern === null)
+            return false;
+        return canonSource === canonPattern || canonSource.startsWith(canonPattern);
+    }
+    /**
+     * Compute SHA-256 of a string. Used to hash source URLs for audit logs
+     * so that sensitive URL parameters are never written to the audit trail.
+     */
+    sha256(input) {
+        return crypto.createHash('sha256').update(input, 'utf8').digest('hex');
+    }
+    /**
+     * Emit a RAG_SOURCE_REJECTED audit event with prev-SHA chain linkage.
+     * The source is stored as its SHA-256 hash, never as the raw URL.
+     */
+    emitRejection(orgId, agentId, sourceHash, kind, reason) {
+        const event = {
+            type: 'RAG_SOURCE_REJECTED',
+            severity: 'WARNING',
+            orgId,
+            agentId,
+            sourceHash,
+            kind,
+            reason,
+            prevSha: this.prevSha,
+            timestamp: new Date().toISOString(),
+        };
+        this.auditSink(event);
+        // Advance the chain: prevSha for the next event is SHA-256 of this event
+        this.prevSha = crypto
+            .createHash('sha256')
+            .update(JSON.stringify(event), 'utf8')
+            .digest('hex');
+    }
+}
+exports.RagSourceAllowlist = RagSourceAllowlist;
+//# sourceMappingURL=rag-source-allowlist.js.map

package/dist/governance/rag-source-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rag-source-allowlist.js","sourceRoot":"","sources":["../../src/governance/rag-source-allowlist.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,oDAAsC;AAEtC,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACU,QAAA,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IAC5D,OAAO;IACP,MAAM;IACN,SAAS;IACT,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;GAEG;AACH,MAAa,4BAA6B,SAAQ,KAAK;IAC5C,KAAK,CAAS;IACd,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,IAAI,CAAgB;IAE7B,YAAY,IAKX;QACC,KAAK,CACH,iCAAiC,IAAI,CAAC,OAAO,WAAW,IAAI,CAAC,KAAK,eAAe;YAC/E,oCAAoC,IAAI,CAAC,IAAI,4CAA4C,CAC5F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;CACF;AAtBD,oEAsBC;AAED;;;GAGG;AACH,MAAa,+BAAgC,SAAQ,KAAK;IAC/C,KAAK,CAAS;IACd,OAAO,CAAS;IAChB,WAAW,CAAW;IAE/B,YAAY,IAIX;QACC,KAAK,CACH,iCAAiC,IAAI,CAAC,OAAO,WAAW,IAAI,CAAC,KAAK,YAAY;YAC5E,uEAAuE;YACvE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACpC,sFAAsF,CACzF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,CAAC;CACF;AArBD,0EAqBC;AAED;;;GAGG;AACH,MAAa,gBAAiB,SAAQ,KAAK;IAChC,YAAY,CAAS;IAE9B,YAAY,OAAe;QACzB,KAAK,CACH,6BAA6B,OAAO,8BAA8B;YAChE,8DAA8D;YAC9D,uEAAuE,CAC1E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;IAC9B,CAAC;CACF;AAZD,4CAYC;AAqFD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,KAAa,EAAE,OAAe;IAC9C,OAAO,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8BAA8B;IAC9B,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAE/D,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;aAAM,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IAEvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,OAAO,GAAG,MAAM,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,4CAA4C;IAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAChG,MAAM,OAAO,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErE,wBAAwB;IACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;YAC/D,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;aAAM,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEhC,OAAO,SAAS,IAAI,GAAG,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,kBAAkB;IAC7B,qCAAqC;IACpB,KAAK,GAA2C,IAAI,GAAG,EAAE,CAAC;IAC3E,yEAAyE;IACxD,iBAAiB,GAA0B,IAAI,GAAG,EAAE,CAAC;IACtE;;;;OAIG;IACc,kBAAkB,GAA6B,IAAI,GAAG,EAAyC,CAAC;IAEjH,+DAA+D;IACvD,OAAO,GAAW,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAExB,SAAS,CAAiC;IAE3D,YAAY,SAA0C;QACpD,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChD,mDAAmD;QAClD,IAAoE,CAAC,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;IACvG,CAAC;IAED,8EAA8E;IAC9E,cAAc;IACd,8EAA8E;IAE9E;;;;;;;;;;OAUG;IACH,SAAS,CACP,KAAa,EACb,OAAe,EACf,OAAkC,EAClC,aAAwB;QAExB,uCAAuC;QACvC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,sBAAsB;IACtB,8EAA8E;IAE9E;;;;;;;;;;;;OAYG;IACH,iBAAiB,CACf,KAAa,EACb,OAAe,EACf,OAA4B,EAC5B,OAAgB;QAEhB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE/C,6EAA6E;QAC7E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3D,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAE1E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,kDAAkD;gBAClD,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;gBACzF,MAAM,IAAI,+BAA+B,CAAC;oBACxC,KAAK;oBACL,OAAO;oBACP,WAAW,EAAE,YAAY;iBAC1B,CAAC,CAAC;YACL,CAAC;YAED,gDAAgD;YAChD,MAAM,OAAO,GAAG,GAAG,CAAC;YACpB,MAAM,QAAQ,GAAI,IAAoE,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAC5I,MAAM,gBAAgB,GAAG,OAAO,IAAI,UAAU,CAAC;YAE/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC9B,IAAoE,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAChH,MAAM,KAAK,GAAmC;oBAC5C,IAAI,EAAE,wBAAwB;oBAC9B,QAAQ,EAAE,SAAS;oBACnB,KAAK;oBACL,OAAO;oBACP,UAAU;oBACV,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;gBACF,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YACD,4EAA4E;YAC5E,MAAM,cAAc,GAA4B;gBAC9C,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,WAAW,EAAE,CAAC,aAAa,CAAC;aAC7B,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;QACzD,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAChF,MAAM,IAAI,4BAA4B,CAAC;gBACrC,KAAK;gBACL,OAAO;gBACP,UAAU;gBACV,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAA+B;YACxC,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,MAAM;YAChB,KAAK;YACL,OAAO;YACP,UAAU;YACV,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,cAAc,EAAE,OAAO,CAAC,OAAO;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAEtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAED,8EAA8E;IAC9E,eAAe;IACf,8EAA8E;IAE9E;;;OAGG;IACH,UAAU,CAAC,KAAa,EAAE,OAAe;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,8EAA8E;IAC9E,eAAe;IACf,8EAA8E;IAE9E;;;OAGG;IACH,UAAU,CAAC,KAAa,EAAE,OAAe;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,IAAoE,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvG,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;OAGG;IACK,SAAS,CACf,OAA4B,EAC5B,OAAkC;QAElC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;gBAAE,SAAS;YAE1C,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrB,KAAK,cAAc,CAAC;gBACpB,KAAK,qBAAqB;oBACxB,8BAA8B;oBAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAC;oBACnD,MAAM;gBAER,KAAK,YAAY,CAAC,CAAC,CAAC;oBAClB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;oBACnE,IAAI,OAAO;wBAAE,OAAO,KAAK,CAAC;oBAC1B,MAAM;gBACR,CAAC;gBAED,KAAK,cAAc,CAAC,CAAC,CAAC;oBACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;oBACnE,IAAI,OAAO;wBAAE,OAAO,KAAK,CAAC;oBAC1B,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,SAAiB,EAAE,UAAkB;QAC1D,mEAAmE;QACnE,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,YAAY,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAExC,OAAO,WAAW,KAAK,YAAY,IAAI,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9E,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,SAAiB,EAAE,UAAkB;QAC1D,MAAM,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAExC,OAAO,WAAW,KAAK,YAAY,IAAI,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9E,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,KAAa;QAC1B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;IAED;;;OAGG;IACK,aAAa,CACnB,KAAa,EACb,OAAe,EACf,UAAkB,EAClB,IAAmB,EACnB,MAA6C;QAE7C,MAAM,KAAK,GAAgC;YACzC,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,SAAS;YACnB,KAAK;YACL,OAAO;YACP,UAAU;YACV,IAAI;YACJ,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtB,yEAAyE;QACzE,IAAI,CAAC,OAAO,GAAG,MAAM;aAClB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;aACrC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;CACF;AAlSD,gDAkSC"}