@connexum/ai-governance 1.0.0-beta.11

package/dist/security/http-interceptor.js

@@ -0,0 +1,637 @@
+"use strict";
+/**
+ * http-interceptor.ts  --  RawHttpInterceptor (CrabTrap-style)
+ *
+ * Defense-in-depth governance net that catches arbitrary outbound HTTP calls
+ * from AI agents that bypass the official LLM SDK adapters (e.g. a raw
+ * `await fetch('https://api.openai.com/...')` call).
+ *
+ * Inspired by Brex's open-source "CrabTrap" concept but implemented using
+ * Node.js built-ins only (no npm dependencies).
+ *
+ * Key capabilities:
+ *   - Patches globalThis.fetch with a governance-aware wrapper.
+ *   - Classifies every outbound request before sending.
+ *   - Enforces a configurable default policy: 'audit-only' | 'block' | 'sandbox'.
+ *   - Detects common secret patterns in request bodies, URLs, and auth headers.
+ *   - Writes structured audit events for every interception.
+ *   - Never logs raw Authorization / X-API-Key / Bearer token header values.
+ *   - attach() / detach() are idempotent.
+ *   - getStats() returns runtime interception counts.
+ *
+ * Limitations (v1):
+ *   - Does NOT intercept Node.js `http` / `https` low-level modules (deferred
+ *     to a follow-up PR -- see docs/security/http-interceptor.md).
+ *   - Does NOT cover non-Node runtimes (Deno, browsers, Bun).
+ *   - Does NOT prevent an agent from importing an alternative HTTP client
+ *     before attach() is called.  Attach early in process startup.
+ *
+ * Pen-tests:
+ *   PT-CRABTRAP-1  empty packBinding throws UnboundDataError pre-call
+ *   PT-CRABTRAP-2  secret in URL query string detected and redacted in audit
+ *   PT-CRABTRAP-3  malformed config rejected at construction
+ *   PT-CRABTRAP-4  audit entry never contains raw API key from headers
+ *
+ * @connexum/ai-governance
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RawHttpInterceptor = exports.HttpInterceptorConfigError = exports.HttpRequestBlockedError = exports.UnboundHttpRequestError = void 0;
+exports.redactBody = redactBody;
+exports.getDefaultInterceptor = getDefaultInterceptor;
+exports.clearDefaultInterceptor = clearDefaultInterceptor;
+const crypto = __importStar(require("node:crypto"));
+const built_in_llm_providers_1 = require("./built-in-llm-providers");
+const secret_leak_detector_1 = require("./secret-leak-detector");
+// ---------------------------------------------------------------------------
+// Error types
+// ---------------------------------------------------------------------------
+/**
+ * Thrown synchronously before any network call when packBinding is empty.
+ * Enforces the Pack-Binding Primacy invariant (AIAG-MEMORY-04).
+ */
+class UnboundHttpRequestError extends Error {
+    code = 'UNBOUND_HTTP_REQUEST';
+    constructor(url) {
+        super(`UnboundHttpRequestError: outbound HTTP request to "${url}" was made with ` +
+            'an empty packBinding[].  Every intercepted request must carry at least one ' +
+            'compliance pack binding.  Attach a packBinding to the HttpInterceptorContext ' +
+            'or configure a default packBinding on the RawHttpInterceptor.');
+        this.name = 'UnboundHttpRequestError';
+    }
+}
+exports.UnboundHttpRequestError = UnboundHttpRequestError;
+/**
+ * Thrown when the interceptor blocks a request due to an unknown host or
+ * a detected secret leak.
+ */
+class HttpRequestBlockedError extends Error {
+    code = 'HTTP_REQUEST_BLOCKED';
+    reason;
+    constructor(url, reason) {
+        super(`HttpRequestBlockedError: request to "${url}" was blocked. Reason: ${reason}`);
+        this.name = 'HttpRequestBlockedError';
+        this.reason = reason;
+    }
+}
+exports.HttpRequestBlockedError = HttpRequestBlockedError;
+/**
+ * Thrown at construction time when the config is invalid.
+ */
+class HttpInterceptorConfigError extends Error {
+    code = 'HTTP_INTERCEPTOR_CONFIG_ERROR';
+    constructor(message) {
+        super(`HttpInterceptorConfigError: ${message}`);
+        this.name = 'HttpInterceptorConfigError';
+    }
+}
+exports.HttpInterceptorConfigError = HttpInterceptorConfigError;
+// ---------------------------------------------------------------------------
+// Validation helpers
+// ---------------------------------------------------------------------------
+const VALID_POLICIES = ['audit-only', 'block', 'sandbox'];
+const VALID_LEAK_POLICIES = ['block', 'redact-and-warn', 'audit-only'];
+function validateConfig(cfg) {
+    if (cfg.defaultPolicy !== undefined && !VALID_POLICIES.includes(cfg.defaultPolicy)) {
+        throw new HttpInterceptorConfigError(`invalid defaultPolicy "${cfg.defaultPolicy}". ` +
+            `Valid values: ${VALID_POLICIES.join(', ')}`);
+    }
+    if (cfg.secretLeakPolicy !== undefined && !VALID_LEAK_POLICIES.includes(cfg.secretLeakPolicy)) {
+        throw new HttpInterceptorConfigError(`invalid secretLeakPolicy "${cfg.secretLeakPolicy}". ` +
+            `Valid values: ${VALID_LEAK_POLICIES.join(', ')}`);
+    }
+    if (cfg.additionalAllowedHosts) {
+        for (const host of cfg.additionalAllowedHosts) {
+            if (typeof host !== 'string' || host.trim() === '') {
+                throw new HttpInterceptorConfigError('additionalAllowedHosts entries must be non-empty strings.');
+            }
+            // Reject obviously invalid patterns
+            if (host === '.' || host === '*') {
+                throw new HttpInterceptorConfigError(`invalid host pattern "${host}". Use a specific domain or ".suffix" format.`);
+            }
+        }
+    }
+    if (cfg.defaultContext !== undefined) {
+        if (!Array.isArray(cfg.defaultContext.packBinding) || cfg.defaultContext.packBinding.length === 0) {
+            throw new HttpInterceptorConfigError('defaultContext.packBinding must be a non-empty array.');
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Host matching
+// ---------------------------------------------------------------------------
+/**
+ * Returns true if `hostname` matches an entry in `allowedHosts`.
+ *
+ * Matching rules:
+ *   - Exact match:  "api.openai.com" matches "api.openai.com".
+ *   - Suffix match: ".googleapis.com" matches "api.googleapis.com" and
+ *                   "us-central1-aiplatform.googleapis.com".
+ */
+function hostMatches(hostname, allowedHosts) {
+    const h = hostname.toLowerCase();
+    for (const entry of allowedHosts) {
+        const e = entry.toLowerCase();
+        if (e.startsWith('.')) {
+            // Suffix: hostname must end with the suffix OR equal the suffix without leading dot
+            const suffix = e.slice(1); // e.g. "googleapis.com"
+            if (h === suffix || h.endsWith('.' + suffix))
+                return true;
+        }
+        else {
+            if (h === e)
+                return true;
+        }
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Header redaction for audit (PT-CRABTRAP-4)
+// ---------------------------------------------------------------------------
+const SENSITIVE_HEADER_NAMES = new Set([
+    'authorization',
+    'x-api-key',
+    'x-goog-api-key',
+    'x-anthropic-api-key',
+    'api-key',
+    'openai-api-key',
+]);
+function isSensitiveHeader(name) {
+    return SENSITIVE_HEADER_NAMES.has(name.toLowerCase());
+}
+// ---------------------------------------------------------------------------
+// RawHttpInterceptor
+// ---------------------------------------------------------------------------
+/**
+ * Governance-aware fetch interceptor.
+ *
+ * Usage:
+ *
+ *   const interceptor = new RawHttpInterceptor({
+ *     defaultPolicy: 'block',
+ *     secretLeakPolicy: 'block',
+ *     defaultContext: { packBinding: ['hipaa', 'soc2'] },
+ *     onAuditEvent: (evt) => eventBus.publish(evt),
+ *   });
+ *
+ *   interceptor.attach();
+ *   // ... all subsequent fetch() calls are now governed ...
+ *   interceptor.detach();
+ */
+class RawHttpInterceptor {
+    cfg;
+    /** The original globalThis.fetch before patching. */
+    originalFetch = null;
+    /** Whether the interceptor is currently attached. */
+    attached = false;
+    /** Configured-allow entries registered via addAllowedOrigin(). */
+    configuredAllowList = [];
+    /** Flat list of built-in + additionalAllowedHosts. */
+    builtInHosts;
+    /** Secret leak detector instance. */
+    leakDetector = new secret_leak_detector_1.SecretLeakDetector();
+    /** Runtime statistics. */
+    stats = {
+        totalIntercepted: 0,
+        allowListHits: 0,
+        configuredAllowHits: 0,
+        unknownHostHits: 0,
+        blocked: 0,
+        secretLeaksDetected: 0,
+    };
+    constructor(config = {}) {
+        validateConfig(config);
+        this.cfg = {
+            defaultPolicy: config.defaultPolicy ?? 'audit-only',
+            secretLeakPolicy: config.secretLeakPolicy ?? 'block',
+            additionalAllowedHosts: config.additionalAllowedHosts ?? [],
+            sandboxProxy: config.sandboxProxy,
+            onAuditEvent: config.onAuditEvent,
+            defaultContext: config.defaultContext,
+        };
+        // Merge built-in + additional into one list
+        this.builtInHosts = [
+            ...built_in_llm_providers_1.BUILT_IN_LLM_HOSTNAMES,
+            ...(config.additionalAllowedHosts ?? []),
+        ];
+    }
+    // ---------------------------------------------------------------------------
+    // Lifecycle
+    // ---------------------------------------------------------------------------
+    /**
+     * Patch globalThis.fetch with the governance wrapper.
+     * Idempotent: calling attach() when already attached is a no-op.
+     */
+    attach() {
+        if (this.attached)
+            return;
+        // Capture the true original (not our own wrapper from a previous attach)
+        this.originalFetch = globalThis.fetch;
+        // We need `this` in the wrapper; bind explicitly
+        const self = this;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        globalThis.fetch = async function governedFetch(input, init) {
+            return self._intercept(input, init);
+        };
+        this.attached = true;
+    }
+    /**
+     * Restore the original globalThis.fetch.
+     * Idempotent: calling detach() when not attached is a no-op.
+     */
+    detach() {
+        if (!this.attached || this.originalFetch === null)
+            return;
+        globalThis.fetch = this.originalFetch;
+        this.originalFetch = null;
+        this.attached = false;
+    }
+    /** Whether the interceptor is currently attached. */
+    isAttached() {
+        return this.attached;
+    }
+    // ---------------------------------------------------------------------------
+    // Allow-list management
+    // ---------------------------------------------------------------------------
+    /**
+     * Register an additional allowed origin at runtime.
+     *
+     * @param host   Exact hostname or ".suffix" pattern.
+     * @param reason Human-readable justification (logged in allow-list).
+     */
+    addAllowedOrigin(host, reason) {
+        if (!host || host.trim() === '') {
+            throw new HttpInterceptorConfigError('addAllowedOrigin: host must be a non-empty string.');
+        }
+        this.configuredAllowList.push({
+            host: host.toLowerCase(),
+            reason,
+            registeredAt: new Date().toISOString(),
+        });
+    }
+    /** Return a copy of the current configured-allow list. */
+    getConfiguredAllowList() {
+        return [...this.configuredAllowList];
+    }
+    // ---------------------------------------------------------------------------
+    // Stats
+    // ---------------------------------------------------------------------------
+    /** Return a snapshot of runtime statistics. */
+    getStats() {
+        return { ...this.stats };
+    }
+    /** Reset statistics counters to zero. */
+    resetStats() {
+        this.stats = {
+            totalIntercepted: 0,
+            allowListHits: 0,
+            configuredAllowHits: 0,
+            unknownHostHits: 0,
+            blocked: 0,
+            secretLeaksDetected: 0,
+        };
+    }
+    // ---------------------------------------------------------------------------
+    // Core interception logic
+    // ---------------------------------------------------------------------------
+    /**
+     * Internal interception handler.  Called by the patched globalThis.fetch.
+     *
+     * Visibility: private -- exposed for testing purposes via _intercept.
+     */
+    async _intercept(input, init) {
+        const traceId = crypto.randomUUID();
+        const timestamp = new Date().toISOString();
+        // Resolve URL string
+        const urlStr = typeof input === 'string'
+            ? input
+            : input instanceof URL
+                ? input.toString()
+                : input.url;
+        // Parse URL for hostname, path extraction
+        let parsedUrl;
+        try {
+            parsedUrl = new URL(urlStr);
+        }
+        catch {
+            // Unparseable URL -- let the original fetch handle it (it will also fail)
+            return this.originalFetch(input, init);
+        }
+        const hostname = parsedUrl.hostname;
+        // Resolve context (per-call > default > empty)
+        const context = init?.__interceptorContext ?? this.cfg.defaultContext ?? { packBinding: [] };
+        // PT-CRABTRAP-1: Enforce pack-binding primacy pre-call
+        if (!context.packBinding || context.packBinding.length === 0) {
+            throw new UnboundHttpRequestError(urlStr);
+        }
+        this.stats.totalIntercepted++;
+        // Sanitized path for audit (no query string -- may contain secrets)
+        const sanitizedPath = parsedUrl.pathname;
+        const queryRedacted = parsedUrl.search !== '';
+        // Resolve body size
+        let bodyText = '';
+        let bytesOut = 0;
+        if (init?.body) {
+            if (typeof init.body === 'string') {
+                bodyText = init.body;
+                bytesOut = Buffer.byteLength(init.body, 'utf-8');
+            }
+            else if (init.body instanceof ArrayBuffer) {
+                bytesOut = init.body.byteLength;
+            }
+            else if (ArrayBuffer.isView(init.body)) {
+                bytesOut = init.body.byteLength;
+                // Try to decode for leak scanning
+                try {
+                    bodyText = Buffer.from(init.body).toString('utf-8');
+                }
+                catch {
+                    // Non-text binary body -- skip text scanning
+                }
+            }
+        }
+        // Resolve headers as plain object for inspection
+        const headersObj = {};
+        if (init?.headers) {
+            if (init.headers instanceof Headers) {
+                init.headers.forEach((v, k) => { headersObj[k] = v; });
+            }
+            else if (Array.isArray(init.headers)) {
+                for (const [k, v] of init.headers) {
+                    headersObj[k] = v;
+                }
+            }
+            else {
+                Object.assign(headersObj, init.headers);
+            }
+        }
+        // Classify the destination host
+        const isBuiltIn = hostMatches(hostname, this.builtInHosts);
+        const isConfigured = !isBuiltIn && hostMatches(hostname, this.configuredAllowList.map((e) => e.host));
+        let classification;
+        let policyApplied;
+        if (isBuiltIn) {
+            classification = 'allowed';
+            policyApplied = 'allow-list';
+            this.stats.allowListHits++;
+        }
+        else if (isConfigured) {
+            classification = 'allowed-configured';
+            policyApplied = 'allow-list';
+            this.stats.configuredAllowHits++;
+        }
+        else {
+            classification = 'unknown-host';
+            policyApplied = this.cfg.defaultPolicy;
+            this.stats.unknownHostHits++;
+        }
+        // Secret leak detection
+        // PT-CRABTRAP-2: scan full URL (includes query string) for secrets
+        const leakResult = this.leakDetector.scanAll(bodyText, urlStr, // full URL including query string
+        headersObj);
+        let bodyRedacted = false;
+        if (leakResult.detected) {
+            this.stats.secretLeaksDetected++;
+            switch (this.cfg.secretLeakPolicy) {
+                case 'block': {
+                    this.stats.blocked++;
+                    // Emit audit event before throwing
+                    this._emitAuditEvent({
+                        eventType: 'http:intercepted',
+                        traceId,
+                        timestamp,
+                        hostname,
+                        method: init?.method ?? (typeof input !== 'string' && !(input instanceof URL) ? input.method : 'GET'),
+                        sanitizedPath,
+                        queryRedacted,
+                        bytesOut,
+                        agentIdentity: context.agentIdentity,
+                        packBinding: context.packBinding,
+                        classification: 'blocked',
+                        policyApplied,
+                        secretLeakDetected: true,
+                        leakCategories: leakResult.findings.map((f) => f.category),
+                    });
+                    throw new HttpRequestBlockedError(`${parsedUrl.origin}${sanitizedPath}`, `secret leak detected: ${leakResult.findings.map((f) => f.label).join(', ')}`);
+                }
+                case 'redact-and-warn': {
+                    // Attempt body redaction -- replace matched patterns with [REDACTED]
+                    if (bodyText && typeof init?.body === 'string') {
+                        let redactedBody = bodyText;
+                        for (const finding of leakResult.findings.filter((f) => f.surface === 'body')) {
+                            // Find the pattern from the detector registry and replace
+                            redactedBody = redactBody(redactedBody, finding.patternId);
+                        }
+                        if (redactedBody !== bodyText) {
+                            init = { ...init, body: redactedBody };
+                            bodyRedacted = true;
+                        }
+                    }
+                    break;
+                }
+                case 'audit-only':
+                    // Fall through -- let the request proceed
+                    break;
+            }
+        }
+        // Apply unknown-host policy
+        if (classification === 'unknown-host') {
+            const effectivePolicy = this.cfg.defaultPolicy;
+            if (effectivePolicy === 'block') {
+                this.stats.blocked++;
+                this._emitAuditEvent({
+                    eventType: 'http:intercepted',
+                    traceId,
+                    timestamp,
+                    hostname,
+                    method: init?.method ?? 'GET',
+                    sanitizedPath,
+                    queryRedacted,
+                    bytesOut,
+                    agentIdentity: context.agentIdentity,
+                    packBinding: context.packBinding,
+                    classification: 'blocked',
+                    policyApplied: 'block',
+                    secretLeakDetected: leakResult.detected,
+                    leakCategories: leakResult.detected
+                        ? leakResult.findings.map((f) => f.category)
+                        : undefined,
+                });
+                throw new HttpRequestBlockedError(`${parsedUrl.origin}${sanitizedPath}`, `host "${hostname}" is not on the allow-list and defaultPolicy is "block"`);
+            }
+            if (effectivePolicy === 'sandbox') {
+                if (!this.cfg.sandboxProxy) {
+                    // No proxy configured -- fall back to block
+                    this.stats.blocked++;
+                    this._emitAuditEvent({
+                        eventType: 'http:intercepted',
+                        traceId,
+                        timestamp,
+                        hostname,
+                        method: init?.method ?? 'GET',
+                        sanitizedPath,
+                        queryRedacted,
+                        bytesOut,
+                        agentIdentity: context.agentIdentity,
+                        packBinding: context.packBinding,
+                        classification: 'blocked',
+                        policyApplied: 'sandbox',
+                        secretLeakDetected: leakResult.detected,
+                        leakCategories: leakResult.detected
+                            ? leakResult.findings.map((f) => f.category)
+                            : undefined,
+                    });
+                    throw new HttpRequestBlockedError(`${parsedUrl.origin}${sanitizedPath}`, 'sandbox policy active but no sandboxProxy configured -- request blocked');
+                }
+                // Sandbox routing: replace input URL with proxy URL
+                // Pass the original URL as a header for the proxy to forward
+                const proxyHeaders = {
+                    ...headersObj,
+                    'X-Governance-Original-URL': urlStr,
+                    'X-Governance-Trace-ID': traceId,
+                };
+                input = this.cfg.sandboxProxy;
+                init = { ...init, headers: proxyHeaders };
+            }
+            // 'audit-only' falls through to the actual fetch below
+        }
+        // Emit pre-send audit event
+        this._emitAuditEvent({
+            eventType: 'http:intercepted',
+            traceId,
+            timestamp,
+            hostname,
+            method: init?.method ?? 'GET',
+            sanitizedPath,
+            queryRedacted,
+            bytesOut,
+            agentIdentity: context.agentIdentity,
+            packBinding: context.packBinding,
+            classification,
+            policyApplied,
+            secretLeakDetected: leakResult.detected,
+            leakCategories: leakResult.detected
+                ? leakResult.findings.map((f) => f.category)
+                : undefined,
+            bodyRedacted: bodyRedacted || undefined,
+        });
+        // Execute the original fetch
+        const response = await this.originalFetch(input, init);
+        // Update audit event with response status (we cannot mutate the emitted
+        // event retroactively here, so we emit a second completion event)
+        this._emitAuditEvent({
+            eventType: 'http:intercepted',
+            traceId,
+            timestamp: new Date().toISOString(),
+            hostname,
+            method: init?.method ?? 'GET',
+            sanitizedPath,
+            queryRedacted,
+            bytesOut,
+            responseStatus: response.status,
+            agentIdentity: context.agentIdentity,
+            packBinding: context.packBinding,
+            classification,
+            policyApplied,
+            secretLeakDetected: leakResult.detected,
+            leakCategories: leakResult.detected
+                ? leakResult.findings.map((f) => f.category)
+                : undefined,
+            bodyRedacted: bodyRedacted || undefined,
+        });
+        return response;
+    }
+    // ---------------------------------------------------------------------------
+    // Internal helpers
+    // ---------------------------------------------------------------------------
+    _emitAuditEvent(event) {
+        if (this.cfg.onAuditEvent) {
+            try {
+                this.cfg.onAuditEvent(event);
+            }
+            catch {
+                // Audit sink errors must never propagate and break the guarded fetch
+            }
+        }
+    }
+}
+exports.RawHttpInterceptor = RawHttpInterceptor;
+// ---------------------------------------------------------------------------
+// Body redaction helper
+// ---------------------------------------------------------------------------
+/**
+ * Redacts known secret patterns from a body string.
+ * Uses the same pattern catalog as SecretLeakDetector.
+ *
+ * Exposed for testing.
+ */
+function redactBody(body, _patternId) {
+    // Apply all known patterns (conservative: redact anything that looks like a secret)
+    const patterns = [
+        /sk-[A-Za-z0-9]{20,}/g,
+        /sk-ant-[A-Za-z0-9_-]{20,}/g,
+        /xox[bpas]-[A-Za-z0-9-]{10,}/g,
+        /gh[psohr]_[A-Za-z0-9]{36,}/g,
+        /(?:AKIA|ASIA)[A-Z0-9]{16}/g,
+        /Bearer\s+[A-Za-z0-9+/=_.-]{20,}/g,
+    ];
+    let result = body;
+    for (const pat of patterns) {
+        result = result.replace(pat, '[REDACTED]');
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Module-level singleton helpers
+// ---------------------------------------------------------------------------
+let _defaultInterceptor = null;
+/**
+ * Create-or-return a process-scoped default interceptor.
+ * Useful for applications that want a single shared interceptor.
+ */
+function getDefaultInterceptor(config) {
+    if (!_defaultInterceptor) {
+        _defaultInterceptor = new RawHttpInterceptor(config);
+    }
+    return _defaultInterceptor;
+}
+/** Clear the process-scoped default interceptor (useful in tests). */
+function clearDefaultInterceptor() {
+    if (_defaultInterceptor?.isAttached()) {
+        _defaultInterceptor.detach();
+    }
+    _defaultInterceptor = null;
+}
+//# sourceMappingURL=http-interceptor.js.map

package/dist/security/http-interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-interceptor.js","sourceRoot":"","sources":["../../src/security/http-interceptor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyvBH,gCAgBC;AAYD,sDAKC;AAGD,0DAKC;AAhyBD,oDAAsC;AACtC,qEAAkE;AAClE,iEAA4F;AAE5F,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAa,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,sBAAsB,CAAC;IAEvC,YAAY,GAAW;QACrB,KAAK,CACH,sDAAsD,GAAG,kBAAkB;YAC3E,6EAA6E;YAC7E,+EAA+E;YAC/E,+DAA+D,CAChE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAZD,0DAYC;AAED;;;GAGG;AACH,MAAa,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,sBAAsB,CAAC;IAC9B,MAAM,CAAS;IAExB,YAAY,GAAW,EAAE,MAAc;QACrC,KAAK,CAAC,wCAAwC,GAAG,0BAA0B,MAAM,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AATD,0DASC;AAED;;GAEG;AACH,MAAa,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,+BAA+B,CAAC;IAEhD,YAAY,OAAe;QACzB,KAAK,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAPD,gEAOC;AA4ID,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,cAAc,GAA6B,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACpF,MAAM,mBAAmB,GAAgC,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAEpG,SAAS,cAAc,CAAC,GAA6B;IACnD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,GAAG,CAAC,aAAuB,KAAK;YAC1D,iBAAiB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,0BAA0B,CAClC,6BAA6B,GAAG,CAAC,gBAA0B,KAAK;YAChE,iBAAiB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;YAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,0BAA0B,CAClC,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,oCAAoC;YACpC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjC,MAAM,IAAI,0BAA0B,CAClC,yBAAyB,IAAI,+CAA+C,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,0BAA0B,CAClC,uDAAuD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,YAA+B;IACpE,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,oFAAoF;YACpF,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;YACnD,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,eAAe;IACf,WAAW;IACX,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;IACT,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAa,kBAAkB;IACZ,GAAG,CAIlB;IAEF,qDAAqD;IAC7C,aAAa,GAAmC,IAAI,CAAC;IAE7D,qDAAqD;IAC7C,QAAQ,GAAG,KAAK,CAAC;IAEzB,kEAAkE;IACjD,mBAAmB,GAAyB,EAAE,CAAC;IAEhE,sDAAsD;IACrC,YAAY,CAAoB;IAEjD,qCAAqC;IACpB,YAAY,GAAG,IAAI,yCAAkB,EAAE,CAAC;IAEzD,0BAA0B;IAClB,KAAK,GAAyB;QACpC,gBAAgB,EAAE,CAAC;QACnB,aAAa,EAAE,CAAC;QAChB,mBAAmB,EAAE,CAAC;QACtB,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;QACV,mBAAmB,EAAE,CAAC;KACvB,CAAC;IAEF,YAAY,SAAmC,EAAE;QAC/C,cAAc,CAAC,MAAM,CAAC,CAAC;QAEvB,IAAI,CAAC,GAAG,GAAG;YACT,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY;YACnD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,OAAO;YACpD,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,EAAE;YAC3D,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;QAEF,4CAA4C;QAC5C,IAAI,CAAC,YAAY,GAAG;YAClB,GAAG,+CAAsB;YACzB,GAAG,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC;SACzC,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,YAAY;IACZ,8EAA8E;IAE9E;;;OAGG;IACH,MAAM;QACJ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAE1B,yEAAyE;QACzE,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;QAEtC,iDAAiD;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC;QAElB,8DAA8D;QAC9D,UAAU,CAAC,KAAK,GAAG,KAAK,UAAU,aAAa,CAC7C,KAA6B,EAC7B,IAAsE;YAEtE,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,CAAuC,CAAC;QAExC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO;QAC1D,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,qDAAqD;IACrD,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,8EAA8E;IAC9E,wBAAwB;IACxB,8EAA8E;IAE9E;;;;;OAKG;IACH,gBAAgB,CAAC,IAAY,EAAE,MAAc;QAC3C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,0BAA0B,CAAC,oDAAoD,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAC5B,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;YACxB,MAAM;YACN,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,0DAA0D;IAC1D,sBAAsB;QACpB,OAAO,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,8EAA8E;IAC9E,QAAQ;IACR,8EAA8E;IAE9E,+CAA+C;IAC/C,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,yCAAyC;IACzC,UAAU;QACR,IAAI,CAAC,KAAK,GAAG;YACX,gBAAgB,EAAE,CAAC;YACnB,aAAa,EAAE,CAAC;YAChB,mBAAmB,EAAE,CAAC;YACtB,eAAe,EAAE,CAAC;YAClB,OAAO,EAAE,CAAC;YACV,mBAAmB,EAAE,CAAC;SACvB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,0BAA0B;IAC1B,8EAA8E;IAE9E;;;;OAIG;IACH,KAAK,CAAC,UAAU,CACd,KAA6B,EAC7B,IAAsE;QAEtE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,qBAAqB;QACrB,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,KAAK,YAAY,GAAG;gBACpB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAClB,CAAC,CAAE,KAAiB,CAAC,GAAG,CAAC;QAE7B,0CAA0C;QAC1C,IAAI,SAAc,CAAC;QACnB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,IAAI,CAAC,aAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;QAEpC,+CAA+C;QAC/C,MAAM,OAAO,GAA2B,IAAI,EAAE,oBAAoB,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAErH,uDAAuD;QACvD,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAE9B,oEAAoE;QACpE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC;QACzC,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,KAAK,EAAE,CAAC;QAE9C,oBAAoB;QACpB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;YACf,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;gBACrB,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,YAAY,WAAW,EAAE,CAAC;gBAC5C,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YAClC,CAAC;iBAAM,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;gBAChC,kCAAkC;gBAClC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAkB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,6CAA6C;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,OAAO,YAAY,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,CAAC,SAAS,IAAI,WAAW,CAC5C,QAAQ,EACR,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC5C,CAAC;QAEF,IAAI,cAAuD,CAAC;QAC5D,IAAI,aAAqD,CAAC;QAE1D,IAAI,SAAS,EAAE,CAAC;YACd,cAAc,GAAG,SAAS,CAAC;YAC3B,aAAa,GAAG,YAAY,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC7B,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,cAAc,GAAG,oBAAoB,CAAC;YACtC,aAAa,GAAG,YAAY,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,cAAc,CAAC;YAChC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC/B,CAAC;QAED,wBAAwB;QACxB,mEAAmE;QACnE,MAAM,UAAU,GAA8B,IAAI,CAAC,YAAY,CAAC,OAAO,CACrE,QAAQ,EACR,MAAM,EAAE,kCAAkC;QAC1C,UAAU,CACX,CAAC;QAEF,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAEjC,QAAQ,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBAClC,KAAK,OAAO,CAAC,CAAC,CAAC;oBACb,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBAErB,mCAAmC;oBACnC,IAAI,CAAC,eAAe,CAAC;wBACnB,SAAS,EAAE,kBAAkB;wBAC7B,OAAO;wBACP,SAAS;wBACT,QAAQ;wBACR,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,CAAE,KAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;wBAClH,aAAa;wBACb,aAAa;wBACb,QAAQ;wBACR,aAAa,EAAE,OAAO,CAAC,aAAa;wBACpC,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,cAAc,EAAE,SAAS;wBACzB,aAAa;wBACb,kBAAkB,EAAE,IAAI;wBACxB,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;qBAC3D,CAAC,CAAC;oBAEH,MAAM,IAAI,uBAAuB,CAC/B,GAAG,SAAS,CAAC,MAAM,GAAG,aAAa,EAAE,EACrC,yBAAyB,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9E,CAAC;gBACJ,CAAC;gBAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;oBACvB,qEAAqE;oBACrE,IAAI,QAAQ,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC/C,IAAI,YAAY,GAAG,QAAQ,CAAC;wBAC5B,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,EAAE,CAAC;4BAC9E,0DAA0D;4BAC1D,YAAY,GAAG,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;wBAC7D,CAAC;wBACD,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;4BAC9B,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;4BACvC,YAAY,GAAG,IAAI,CAAC;wBACtB,CAAC;oBACH,CAAC;oBACD,MAAM;gBACR,CAAC;gBAED,KAAK,YAAY;oBACf,0CAA0C;oBAC1C,MAAM;YACV,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,cAAc,KAAK,cAAc,EAAE,CAAC;YACtC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YAE/C,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAErB,IAAI,CAAC,eAAe,CAAC;oBACnB,SAAS,EAAE,kBAAkB;oBAC7B,OAAO;oBACP,SAAS;oBACT,QAAQ;oBACR,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;oBAC7B,aAAa;oBACb,aAAa;oBACb,QAAQ;oBACR,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,cAAc,EAAE,SAAS;oBACzB,aAAa,EAAE,OAAO;oBACtB,kBAAkB,EAAE,UAAU,CAAC,QAAQ;oBACvC,cAAc,EAAE,UAAU,CAAC,QAAQ;wBACjC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;wBAC5C,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;gBAEH,MAAM,IAAI,uBAAuB,CAC/B,GAAG,SAAS,CAAC,MAAM,GAAG,aAAa,EAAE,EACrC,SAAS,QAAQ,yDAAyD,CAC3E,CAAC;YACJ,CAAC;YAED,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;oBAC3B,4CAA4C;oBAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBAErB,IAAI,CAAC,eAAe,CAAC;wBACnB,SAAS,EAAE,kBAAkB;wBAC7B,OAAO;wBACP,SAAS;wBACT,QAAQ;wBACR,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;wBAC7B,aAAa;wBACb,aAAa;wBACb,QAAQ;wBACR,aAAa,EAAE,OAAO,CAAC,aAAa;wBACpC,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,cAAc,EAAE,SAAS;wBACzB,aAAa,EAAE,SAAS;wBACxB,kBAAkB,EAAE,UAAU,CAAC,QAAQ;wBACvC,cAAc,EAAE,UAAU,CAAC,QAAQ;4BACjC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;4BAC5C,CAAC,CAAC,SAAS;qBACd,CAAC,CAAC;oBAEH,MAAM,IAAI,uBAAuB,CAC/B,GAAG,SAAS,CAAC,MAAM,GAAG,aAAa,EAAE,EACrC,yEAAyE,CAC1E,CAAC;gBACJ,CAAC;gBACD,oDAAoD;gBACpD,6DAA6D;gBAC7D,MAAM,YAAY,GAA2B;oBAC3C,GAAG,UAAU;oBACb,2BAA2B,EAAE,MAAM;oBACnC,uBAAuB,EAAE,OAAO;iBACjC,CAAC;gBACF,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;gBAC9B,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YAC5C,CAAC;YACD,uDAAuD;QACzD,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,eAAe,CAAC;YACnB,SAAS,EAAE,kBAAkB;YAC7B,OAAO;YACP,SAAS;YACT,QAAQ;YACR,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,aAAa;YACb,aAAa;YACb,QAAQ;YACR,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,cAAc;YACd,aAAa;YACb,kBAAkB,EAAE,UAAU,CAAC,QAAQ;YACvC,cAAc,EAAE,UAAU,CAAC,QAAQ;gBACjC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC5C,CAAC,CAAC,SAAS;YACb,YAAY,EAAE,YAAY,IAAI,SAAS;SACxC,CAAC,CAAC;QAEH,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAExD,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,CAAC,eAAe,CAAC;YACnB,SAAS,EAAE,kBAAkB;YAC7B,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ;YACR,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,aAAa;YACb,aAAa;YACb,QAAQ;YACR,cAAc,EAAE,QAAQ,CAAC,MAAM;YAC/B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,cAAc;YACd,aAAa;YACb,kBAAkB,EAAE,UAAU,CAAC,QAAQ;YACvC,cAAc,EAAE,UAAU,CAAC,QAAQ;gBACjC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC5C,CAAC,CAAC,SAAS;YACb,YAAY,EAAE,YAAY,IAAI,SAAS;SACxC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAEtE,eAAe,CAAC,KAA4B;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;IACH,CAAC;CACF;AA7bD,gDA6bC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,IAAY,EAAE,UAAkB;IACzD,oFAAoF;IACpF,MAAM,QAAQ,GAAa;QACzB,sBAAsB;QACtB,4BAA4B;QAC5B,8BAA8B;QAC9B,6BAA6B;QAC7B,4BAA4B;QAC5B,kCAAkC;KACnC,CAAC;IAEF,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,IAAI,mBAAmB,GAA8B,IAAI,CAAC;AAE1D;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,MAAiC;IACrE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,sEAAsE;AACtE,SAAgB,uBAAuB;IACrC,IAAI,mBAAmB,EAAE,UAAU,EAAE,EAAE,CAAC;QACtC,mBAAmB,CAAC,MAAM,EAAE,CAAC;IAC/B,CAAC;IACD,mBAAmB,GAAG,IAAI,CAAC;AAC7B,CAAC"}