@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/guards-evaluator/triage.js

@@ -0,0 +1,315 @@
+import { isKnownSafe } from './safe-commands.js';
+// ── dangerous reason slugs ──────────────────────────────────────────────────
+const R_RM_RF = 'rm-rf-root-home';
+const R_CHMOD_777 = 'chmod-777-broad';
+const R_ENCODED_PIPE = 'encoded-pipe-to-shell';
+// ── suspect signal slugs (the fixed set, in stable report order) ────────────
+const S_INDIRECT = 'indirect-executable';
+const S_INCOMPLETE = 'incomplete-parse';
+const S_DECODE = 'encoded-decode-step';
+const S_INLINE = 'inline-interpreter-code';
+const S_EXEC_SCRIPT = 'executes-script';
+const S_READ_EXFIL = 'read-then-exfil';
+const S_SUBST = 'substitution-in-args';
+const S_UNCLASSIFIED = 'unclassified';
+// ── command families ─────────────────────────────────────────────────────────
+/** Shells whose stdin / file argument is itself a command. */
+const SHELLS = new Set(['sh', 'bash', 'zsh', 'dash', 'ksh', 'fish', 'ash']);
+/** Script interpreters with an inline-code flag (`-c` / `-e`) or a stdin body. */
+const INLINE_FAMILIES = new Set([
+    'python',
+    'python2',
+    'python3',
+    'node',
+    'nodejs',
+    'ruby',
+    'perl',
+]);
+/** Commands that read / copy file CONTENT (a secret can leave through them). */
+const READ_EXES = new Set([
+    'cat',
+    'head',
+    'tail',
+    'less',
+    'more',
+    'cp',
+    'mv',
+    'dd',
+    'tee',
+    'od',
+    'strings',
+    'xxd',
+    'base64',
+    'base32',
+    'source',
+    '.',
+    'openssl',
+    'gpg',
+]);
+/** Commands that move bytes over the network (the exfil half of read→exfil). */
+const NET_EXES = new Set([
+    'curl',
+    'wget',
+    'nc',
+    'ncat',
+    'netcat',
+    'telnet',
+    'ssh',
+    'scp',
+    'sftp',
+    'rsync',
+    'ftp',
+    'socat',
+    'http',
+    'https',
+    'httpie',
+    'xh',
+    'aria2c',
+]);
+// ── dangerous: rm -rf of root/home ───────────────────────────────────────────
+/** `/`, `/*`, `~`, `~/`, `~/*`, `$HOME`, `${HOME}`, `$HOME/`, `$HOME/*`. */
+export function isCatastrophicPathArg(arg) {
+    const a = arg.trim();
+    if (a === '/' || a === '/*' || a === '/.')
+        return true;
+    if (a === '~' || a === '~/' || a === '~/*')
+        return true;
+    return /^\$\{?HOME\}?(?:\/\*?)?$/.test(a);
+}
+function isRmRfCatastrophic(cmd) {
+    if (cmd.executable !== 'rm')
+        return false;
+    if (!(cmd.flagLetters.has('r') && cmd.flagLetters.has('f')))
+        return false;
+    return cmd.args.some(isCatastrophicPathArg);
+}
+// ── dangerous: chmod 777 over a broad path ───────────────────────────────────
+function hasMode777(cmd) {
+    return cmd.args.some((a) => /^0*777$/.test(a) || /^(?:a|ugo)?[=+]rwx$/.test(a));
+}
+/** System / home / root paths: 777 here is dangerous even without `-R`. */
+const CHMOD_BROAD_ABS = new Set([
+    '/',
+    '/*',
+    '~',
+    '~/',
+    '/etc',
+    '/usr',
+    '/usr/bin',
+    '/usr/local',
+    '/var',
+    '/bin',
+    '/sbin',
+    '/lib',
+    '/opt',
+    '/root',
+    '/boot',
+]);
+/** Working-tree roots: broad only when applied recursively. */
+const CHMOD_BROAD_REL = new Set(['.', './', '*', './*', '..', '../']);
+function isChmod777Broad(cmd) {
+    if (cmd.executable !== 'chmod')
+        return false;
+    if (!hasMode777(cmd))
+        return false;
+    const recursive = cmd.flagLetters.has('R') || cmd.longFlags.includes('recursive');
+    for (const a of cmd.args) {
+        if (CHMOD_BROAD_ABS.has(a))
+            return true;
+        if (/^\$\{?HOME\}?$/.test(a))
+            return true;
+        if (recursive && CHMOD_BROAD_REL.has(a))
+            return true;
+    }
+    return false;
+}
+// ── dangerous: decode step piped straight into a shell/interpreter ───────────
+function isDecodeStep(cmd) {
+    const e = cmd.executable;
+    if (e === 'base64' || e === 'base32') {
+        return cmd.flagLetters.has('d') || cmd.longFlags.includes('decode');
+    }
+    if (e === 'xxd') {
+        return cmd.flagLetters.has('r') || cmd.longFlags.includes('revert');
+    }
+    if (e === 'uudecode')
+        return true;
+    if (e === 'openssl') {
+        return (cmd.args.includes('enc') &&
+            (cmd.flagLetters.has('d') || cmd.longFlags.includes('decrypt')));
+    }
+    return false;
+}
+/**
+ * A bare interpreter reading its SCRIPT from stdin — `… | sh`, `… | python3`.
+ * "Bare" = no script file argument and no inline-code flag, so whatever is
+ * piped in IS the program. Combined with a decode step in the same action this
+ * is the classic `echo <b64> | base64 -d | sh` loader.
+ */
+function isBareStdinInterpreter(cmd) {
+    const e = cmd.executable;
+    if (SHELLS.has(e)) {
+        return cmd.args.length === 0 && !cmd.flagLetters.has('c');
+    }
+    if (INLINE_FAMILIES.has(e)) {
+        return (cmd.args.length === 0 &&
+            !cmd.flagLetters.has('c') &&
+            !cmd.flagLetters.has('e') &&
+            !cmd.flagLetters.has('p') &&
+            !cmd.flagLetters.has('v') &&
+            !cmd.longFlags.includes('version'));
+    }
+    return false;
+}
+// ── suspect signals ───────────────────────────────────────────────────────────
+function isInlineInterpreterCode(cmd) {
+    if (!INLINE_FAMILIES.has(cmd.executable))
+        return false;
+    return (cmd.flagLetters.has('c') ||
+        cmd.flagLetters.has('e') ||
+        cmd.longFlags.includes('eval') ||
+        cmd.longFlags.includes('command'));
+}
+function isExecutesScript(cmd) {
+    const e = cmd.executable;
+    // A shell handed a script FILE (not `-c`, which the normalizer descends into).
+    if (SHELLS.has(e) && cmd.args.length > 0 && !cmd.flagLetters.has('c')) {
+        return true;
+    }
+    // `./x`, `../x`, or a relative path `scripts/x.sh` — running a local file.
+    const re = cmd.rawExecutable ?? '';
+    if (re.startsWith('./') || re.startsWith('../'))
+        return true;
+    if (re.includes('/') && !re.startsWith('/') && !re.startsWith('~')) {
+        return true;
+    }
+    // `npm run …`, `pnpm run …`, `yarn run …`, `npx …`, `pnpm|yarn dlx …`.
+    if (e === 'npm' || e === 'pnpm' || e === 'yarn') {
+        const sub = cmd.args[0];
+        if (sub === 'run' || sub === 'run-script')
+            return true;
+        if ((e === 'pnpm' || e === 'yarn') && sub === 'dlx')
+            return true;
+    }
+    if (e === 'npx')
+        return true;
+    return false;
+}
+/** A dotfile / credential / key / `/etc/shadow`-style path. */
+function looksSecretPath(arg) {
+    const a = arg.toLowerCase();
+    if (/(?:^|[/@=])\.env(?:\.[a-z0-9_.-]+)?$/.test(a))
+        return true;
+    if (/(?:^|[/@=])\.(?:netrc|npmrc|pypirc|git-credentials|htpasswd)$/.test(a)) {
+        return true;
+    }
+    if (/(?:^|[/@=])\.?(?:aws|ssh|gnupg|kube|docker)\//.test(a))
+        return true;
+    if (/id_(?:rsa|dsa|ecdsa|ed25519)/.test(a))
+        return true;
+    if (/\.(?:pem|key|p12|pfx|keystore|jks|ppk)(?:$|["')\]])/.test(a))
+        return true;
+    if (/(?:^|[/@=])(?:credentials|secrets?)(?:$|\.)/.test(a))
+        return true;
+    if (/(?:secret|credential|password|passwd|apikey|api_key|private[_-]?key)/.test(a)) {
+        return true;
+    }
+    if (a === '/etc/shadow' || a === '/etc/passwd')
+        return true;
+    return false;
+}
+function cmdReadsSecret(cmd) {
+    return READ_EXES.has(cmd.executable) && cmd.args.some(looksSecretPath);
+}
+function hasSubstitutionArg(cmd) {
+    return cmd.args.some((a) => a.includes('$(') || a.includes('`'));
+}
+// ── assembly ──────────────────────────────────────────────────────────────────
+function uniq(cmds) {
+    const seen = new Set();
+    const out = [];
+    for (const c of cmds) {
+        if (!seen.has(c)) {
+            seen.add(c);
+            out.push(c);
+        }
+    }
+    return out;
+}
+export function triageCommand(result) {
+    try {
+        const commands = result && Array.isArray(result.commands) ? result.commands : [];
+        // 1. DANGEROUS — unambiguous, block without a judge. Checked first.
+        const dangerReasons = [];
+        const dangerFlagged = [];
+        for (const cmd of commands) {
+            if (isRmRfCatastrophic(cmd)) {
+                if (!dangerReasons.includes(R_RM_RF))
+                    dangerReasons.push(R_RM_RF);
+                dangerFlagged.push(cmd);
+            }
+            if (isChmod777Broad(cmd)) {
+                if (!dangerReasons.includes(R_CHMOD_777))
+                    dangerReasons.push(R_CHMOD_777);
+                dangerFlagged.push(cmd);
+            }
+        }
+        const decoders = commands.filter(isDecodeStep);
+        const bareInterps = commands.filter(isBareStdinInterpreter);
+        if (decoders.length > 0 && bareInterps.length > 0) {
+            dangerReasons.push(R_ENCODED_PIPE);
+            dangerFlagged.push(...decoders, ...bareInterps);
+        }
+        if (dangerReasons.length > 0) {
+            return {
+                class: 'dangerous',
+                reasons: dangerReasons,
+                flagged: uniq(dangerFlagged),
+            };
+        }
+        // 2. SUSPECT signals — stable order. Each contributes its slug + drivers.
+        const reasons = [];
+        const flagged = [];
+        const add = (slug, drivers) => {
+            if (drivers.length === 0 && slug !== S_INCOMPLETE)
+                return;
+            if (!reasons.includes(slug))
+                reasons.push(slug);
+            flagged.push(...drivers);
+        };
+        add(S_INDIRECT, commands.filter((c) => c.executable === ''));
+        if (result && result.incomplete === true) {
+            reasons.push(S_INCOMPLETE);
+            flagged.push(...commands);
+        }
+        add(S_DECODE, decoders);
+        add(S_INLINE, commands.filter(isInlineInterpreterCode));
+        add(S_EXEC_SCRIPT, commands.filter(isExecutesScript));
+        const readers = commands.filter(cmdReadsSecret);
+        const netCmds = commands.filter((c) => NET_EXES.has(c.executable));
+        const netReadingSecret = netCmds.filter((c) => c.args.some(looksSecretPath));
+        if ((readers.length > 0 && netCmds.length > 0) || netReadingSecret.length > 0) {
+            add(S_READ_EXFIL, uniq([...readers, ...netCmds]));
+        }
+        add(S_SUBST, commands.filter(hasSubstitutionArg));
+        if (reasons.length > 0) {
+            return { class: 'suspect', reasons, flagged: uniq(flagged) };
+        }
+        // 3. SAFE — every command known-safe and the parse was complete.
+        if (!(result && result.incomplete === true) && commands.every(isKnownSafe)) {
+            return { class: 'safe', reasons: [], flagged: [] };
+        }
+        // 4. DEFAULT — not known-safe, not dangerous, no signal → suspect.
+        return {
+            class: 'suspect',
+            reasons: [S_UNCLASSIFIED],
+            flagged: commands.filter((c) => !isKnownSafe(c)),
+        };
+    }
+    catch {
+        // Never throw on the hot path: escalate to "look closer".
+        const commands = result && Array.isArray(result.commands) ? result.commands : [];
+        return { class: 'suspect', reasons: ['triage-error'], flagged: commands };
+    }
+}
+//# sourceMappingURL=triage.js.map

package/dist/guards-evaluator/triage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage.js","sourceRoot":"","sources":["../../src/guards-evaluator/triage.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,+EAA+E;AAC/E,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAClC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;AACvC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAC3C,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,OAAO,GAAG,sBAAsB,CAAC;AACvC,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC,gFAAgF;AAChF,8DAA8D;AAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACpF,kFAAkF;AAClF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IACtC,QAAQ;IACR,SAAS;IACT,SAAS;IACT,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AACH,gFAAgF;AAChF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS;IAChC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,SAAS;IACT,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,GAAG;IACH,SAAS;IACT,KAAK;CACN,CAAC,CAAC;AACH,gFAAgF;AAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS;IAC/B,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,IAAI;IACJ,QAAQ;CACT,CAAC,CAAC;AAEH,gFAAgF;AAChF,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAqB;IAC/C,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;AAC9C,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,GAAqB;IACvC,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AACD,2EAA2E;AAC3E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IACtC,GAAG;IACH,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IACN,MAAM;IACN,UAAU;IACV,YAAY;IACZ,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AACH,+DAA+D;AAC/D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9E,SAAS,eAAe,CAAC,GAAqB;IAC5C,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,SAAS,GACb,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,GAAqB;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC;IACzB,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QAChB,OAAO,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpB,OAAO,CACL,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,GAAqB;IACnD,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC;IACzB,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAClB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,OAAO,CACL,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YACzB,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YACzB,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YACzB,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YACzB,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,SAAS,uBAAuB,CAAC,GAAqB;IACpD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,CACL,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QACxB,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QACxB,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAqB;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC;IACzB,+EAA+E;IAC/E,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2EAA2E;IAC3E,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IACnC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,GAAG,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+DAA+D;AAC/D,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC5B,IAAI,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,+DAA+D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,+CAA+C,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,qDAAqD,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,sEAAsE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAAqB;IAC3C,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAqB;IAC/C,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,iFAAiF;AACjF,SAAS,IAAI,CAAC,IAAwB;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAuB;IACnD,IAAI,CAAC;QACH,MAAM,QAAQ,GACZ,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAElE,oEAAoE;QACpE,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,MAAM,aAAa,GAAuB,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAClE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YACD,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC1E,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnC,aAAa,CAAC,IAAI,CAAC,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,aAAa;gBACtB,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC;aAC7B,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAA2B,EAAQ,EAAE;YAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO;YAC1D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAC3B,CAAC,CAAC;QAEF,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7D,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACxB,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAElD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,CAAC;QAED,iEAAiE;QACjE,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACrD,CAAC;QAED,mEAAmE;QACnE,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,CAAC,cAAc,CAAC;YACzB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;SACjD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,MAAM,QAAQ,GACZ,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC"}