@elizaos/agent 2.0.0-alpha.98 → 2.0.0-beta.2

package/packages/agent/src/services/capability-broker.d.ts

@@ -0,0 +1,89 @@
+/**
+ * CapabilityBroker — single decision point for privileged tool access.
+ *
+ * Every tool that touches a privileged resource (filesystem, shell, network,
+ * camera, mic, location, screen, contacts, messages, health, browser, wallet)
+ * calls `broker.check(req)` before doing the work. The broker consults a
+ * static policy table keyed by `(runtime mode, distribution profile)` and
+ * returns an allow/deny decision with a stable `policyKey` for auditing.
+ *
+ * Two orthogonal axes drive policy:
+ *   1. RuntimeExecutionMode — `cloud` | `local-safe` | `local-yolo`
+ *      Where computation lives and how trusted the local machine is. Cloud
+ *      runtime never gets to touch native surfaces; local-safe routes
+ *      shell/exec through the sandbox; local-yolo is the developer mode.
+ *   2. DistributionProfile — `store` | `unrestricted`
+ *      Which storefront the binary will be submitted to. Store builds must
+ *      be containable inside Apple/Google/Microsoft sandbox guarantees, so
+ *      arbitrary host-fs writes and raw shell exec are denied even in
+ *      local-yolo. `unrestricted` is for direct-download / dev builds.
+ *
+ * Audit log lands at `<stateDir>/audit/capability.jsonl` as one JSON object
+ * per check. Writes are synchronous so a crash mid-action still leaves a
+ * record. The file is truncated at broker boot if it exceeds 50MB.
+ */
+import { type DistributionProfile, type RuntimeExecutionMode } from "@elizaos/shared";
+export type CapabilityKind = "fs" | "shell" | "net" | "camera" | "mic" | "location" | "screen" | "contacts" | "messages" | "health" | "browser" | "wallet";
+export type CapabilityOp = "read" | "write" | "exec" | "connect" | "capture" | "list";
+export interface CapabilityRequest {
+    kind: CapabilityKind;
+    op: CapabilityOp;
+    target?: string;
+    reason?: string;
+    toolName?: string;
+}
+export type CapabilityDecision = {
+    allowed: true;
+    policyKey: string;
+} | {
+    allowed: false;
+    reason: string;
+    policyKey: string;
+};
+export interface BrokerOptions {
+    stateDir?: string;
+    auditFilePath?: string;
+    mode?: () => RuntimeExecutionMode;
+    distributionProfile?: () => DistributionProfile;
+    now?: () => Date;
+}
+export interface AuditedDecision {
+    ts: string;
+    kind: CapabilityKind;
+    op: CapabilityOp;
+    target: string | null;
+    toolName: string | null;
+    reason: string | null;
+    allowed: boolean;
+    denyReason: string | null;
+    mode: RuntimeExecutionMode;
+    profile: DistributionProfile;
+    policyKey: string;
+}
+export interface BrokerSnapshot {
+    mode: RuntimeExecutionMode;
+    profile: DistributionProfile;
+    auditFilePath: string;
+    recent: AuditedDecision[];
+}
+export declare class CapabilityBroker {
+    private readonly auditFilePath;
+    private readonly modeFn;
+    private readonly profileFn;
+    private readonly nowFn;
+    private readonly recent;
+    constructor(options?: BrokerOptions);
+    check(req: CapabilityRequest): CapabilityDecision;
+    snapshot(): BrokerSnapshot;
+    recentDecisions(limit?: number): AuditedDecision[];
+    private rotateIfOversized;
+    private audit;
+}
+export declare function getCapabilityBroker(): CapabilityBroker;
+/**
+ * Test-only escape hatch — drops the cached singleton so the next call to
+ * `getCapabilityBroker()` re-reads env. Not exported to consumers via the
+ * package barrel.
+ */
+export declare function __resetCapabilityBrokerForTests(): void;
+//# sourceMappingURL=capability-broker.d.ts.map

package/packages/agent/src/services/capability-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-broker.d.ts","sourceRoot":"","sources":["../../../../../src/services/capability-broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAE1B,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,cAAc,GACtB,IAAI,GACJ,OAAO,GACP,KAAK,GACL,QAAQ,GACR,KAAK,GACL,UAAU,GACV,QAAQ,GACR,UAAU,GACV,UAAU,GACV,QAAQ,GACR,SAAS,GACT,QAAQ,CAAC;AAEb,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,OAAO,GACP,MAAM,GACN,SAAS,GACT,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,EAAE,EAAE,YAAY,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,oBAAoB,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,mBAAmB,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,EAAE,EAAE,YAAY,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAkQD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;gBAEpC,OAAO,GAAE,aAAkB;IAavC,KAAK,CAAC,GAAG,EAAE,iBAAiB,GAAG,kBAAkB;IAwBjD,QAAQ,IAAI,cAAc;IAS1B,eAAe,CAAC,KAAK,SAAK,GAAG,eAAe,EAAE;IAM9C,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,KAAK;CAuCd;AAID,wBAAgB,mBAAmB,IAAI,gBAAgB,CAItD;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}

package/packages/agent/src/services/capability-broker.js

@@ -0,0 +1,339 @@
+/**
+ * CapabilityBroker — single decision point for privileged tool access.
+ *
+ * Every tool that touches a privileged resource (filesystem, shell, network,
+ * camera, mic, location, screen, contacts, messages, health, browser, wallet)
+ * calls `broker.check(req)` before doing the work. The broker consults a
+ * static policy table keyed by `(runtime mode, distribution profile)` and
+ * returns an allow/deny decision with a stable `policyKey` for auditing.
+ *
+ * Two orthogonal axes drive policy:
+ *   1. RuntimeExecutionMode — `cloud` | `local-safe` | `local-yolo`
+ *      Where computation lives and how trusted the local machine is. Cloud
+ *      runtime never gets to touch native surfaces; local-safe routes
+ *      shell/exec through the sandbox; local-yolo is the developer mode.
+ *   2. DistributionProfile — `store` | `unrestricted`
+ *      Which storefront the binary will be submitted to. Store builds must
+ *      be containable inside Apple/Google/Microsoft sandbox guarantees, so
+ *      arbitrary host-fs writes and raw shell exec are denied even in
+ *      local-yolo. `unrestricted` is for direct-download / dev builds.
+ *
+ * Audit log lands at `<stateDir>/audit/capability.jsonl` as one JSON object
+ * per check. Writes are synchronous so a crash mid-action still leaves a
+ * record. The file is truncated at broker boot if it exceeds 50MB.
+ */
+import { appendFileSync, mkdirSync, statSync, truncateSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { logger } from "@elizaos/core";
+import { resolveDistributionProfile, } from "@elizaos/shared";
+import { resolveStateDir } from "../config/paths.js";
+const AUDIT_LOG_MAX_BYTES = 50 * 1024 * 1024;
+const RECENT_DECISION_BUFFER = 256;
+/**
+ * Cloud egress allowlist. The cloud runtime is sandboxed so it cannot reach
+ * arbitrary hosts; only the elizaOS Cloud control plane and inference
+ * surfaces are reachable. Any host outside this list must be denied.
+ */
+const CLOUD_NET_ALLOWED_HOSTS = [
+    "elizacloud.ai",
+    "api.elizacloud.ai",
+    "www.elizacloud.ai",
+];
+/**
+ * Tool-name prefix that signals a request is going through the local-safe
+ * sandbox engine (Docker / Apple Container). Tools without this prefix are
+ * touching the host directly, which `local-safe` mode forbids.
+ */
+const SANDBOX_TOOL_NAME_PREFIX = "sandbox.";
+const ALLOW = { allow: true, reason: null };
+function deny(reason) {
+    return { allow: false, reason };
+}
+function isHostFsTarget(target) {
+    if (typeof target !== "string" || target.length === 0)
+        return false;
+    // VFS targets are expressed as virtual paths: scheme `vfs://` or relative.
+    // Anything starting with `/`, `~`, or a drive letter is a host path.
+    if (target.startsWith("vfs://"))
+        return false;
+    return (target.startsWith("/") ||
+        target.startsWith("~") ||
+        /^[a-zA-Z]:[\\/]/.test(target));
+}
+function isCloudAllowedHost(target) {
+    if (typeof target !== "string" || target.length === 0)
+        return false;
+    let host;
+    try {
+        host = new URL(target).hostname.toLowerCase();
+    }
+    catch {
+        host = target.toLowerCase();
+    }
+    return CLOUD_NET_ALLOWED_HOSTS.includes(host);
+}
+function isSandboxedTool(toolName) {
+    return (typeof toolName === "string" &&
+        toolName.startsWith(SANDBOX_TOOL_NAME_PREFIX));
+}
+const fsHostWriteSandboxed = (req) => isHostFsTarget(req.target)
+    ? deny("Host filesystem writes require VFS targets in this profile")
+    : ALLOW;
+const fsHostWriteHardDenied = (req) => isHostFsTarget(req.target)
+    ? deny("Cloud runtime cannot touch host filesystem; route through VFS or Cloud APIs")
+    : ALLOW;
+const cloudNetConnect = (req) => isCloudAllowedHost(req.target)
+    ? ALLOW
+    : deny(`Cloud runtime can only reach allowlisted hosts: ${CLOUD_NET_ALLOWED_HOSTS.join(", ")}`);
+const sandboxedShell = (req) => isSandboxedTool(req.toolName)
+    ? ALLOW
+    : deny("local-safe denies host shell exec; invoke via sandbox.* tools (Docker / Apple Container)");
+const POLICY = {
+    cloud: {
+        store: cloudKindPolicy(),
+        unrestricted: cloudKindPolicy(),
+    },
+    "local-safe": {
+        store: localSafeStorePolicy(),
+        unrestricted: localSafeUnrestrictedPolicy(),
+    },
+    "local-yolo": {
+        store: localYoloStorePolicy(),
+        unrestricted: localYoloUnrestrictedPolicy(),
+    },
+};
+function cloudKindPolicy() {
+    return {
+        fs: {
+            read: fsHostWriteHardDenied,
+            write: fsHostWriteHardDenied,
+            list: fsHostWriteHardDenied,
+        },
+        shell: {
+            exec: "deny",
+        },
+        net: {
+            connect: cloudNetConnect,
+        },
+        camera: { capture: "deny" },
+        mic: { capture: "deny" },
+        location: { read: "deny" },
+        screen: { capture: "deny" },
+        contacts: { read: "deny", list: "deny" },
+        messages: { read: "deny", write: "deny" },
+        health: { read: "deny" },
+        browser: { exec: "deny" },
+        wallet: { read: "deny", write: "deny" },
+    };
+}
+function localSafeStorePolicy() {
+    return {
+        fs: {
+            read: fsHostWriteSandboxed,
+            write: fsHostWriteSandboxed,
+            list: fsHostWriteSandboxed,
+        },
+        shell: {
+            exec: sandboxedShell,
+        },
+        net: {
+            connect: "allow",
+        },
+        camera: { capture: "allow" },
+        mic: { capture: "allow" },
+        location: { read: "allow" },
+        screen: { capture: "deny" },
+        contacts: { read: "allow", list: "allow" },
+        messages: { read: "allow", write: "allow" },
+        health: { read: "allow" },
+        browser: { exec: "allow" },
+        wallet: { read: "allow", write: "deny" },
+    };
+}
+function localSafeUnrestrictedPolicy() {
+    return {
+        fs: {
+            read: "allow",
+            write: fsHostWriteSandboxed,
+            list: "allow",
+        },
+        shell: {
+            exec: sandboxedShell,
+        },
+        net: { connect: "allow" },
+        camera: { capture: "allow" },
+        mic: { capture: "allow" },
+        location: { read: "allow" },
+        screen: { capture: "allow" },
+        contacts: { read: "allow", list: "allow" },
+        messages: { read: "allow", write: "allow" },
+        health: { read: "allow" },
+        browser: { exec: "allow" },
+        wallet: { read: "allow", write: "allow" },
+    };
+}
+function localYoloStorePolicy() {
+    return {
+        fs: {
+            read: fsHostWriteSandboxed,
+            write: fsHostWriteSandboxed,
+            list: fsHostWriteSandboxed,
+        },
+        shell: {
+            exec: "deny",
+        },
+        net: { connect: "allow" },
+        camera: { capture: "allow" },
+        mic: { capture: "allow" },
+        location: { read: "allow" },
+        screen: { capture: "deny" },
+        contacts: { read: "allow", list: "allow" },
+        messages: { read: "allow", write: "allow" },
+        health: { read: "allow" },
+        browser: { exec: "allow" },
+        wallet: { read: "allow", write: "deny" },
+    };
+}
+function localYoloUnrestrictedPolicy() {
+    return {
+        fs: { read: "allow", write: "allow", list: "allow" },
+        shell: { exec: "allow" },
+        net: { connect: "allow" },
+        camera: { capture: "allow" },
+        mic: { capture: "allow" },
+        location: { read: "allow" },
+        screen: { capture: "allow" },
+        contacts: { read: "allow", list: "allow" },
+        messages: { read: "allow", write: "allow" },
+        health: { read: "allow" },
+        browser: { exec: "allow" },
+        wallet: { read: "allow", write: "allow" },
+    };
+}
+function policyKeyFor(mode, profile, req) {
+    return `${mode}:${profile}:${req.kind}:${req.op}`;
+}
+function evaluatePolicy(mode, profile, req) {
+    const opPolicy = POLICY[mode][profile][req.kind]?.[req.op];
+    if (opPolicy === undefined) {
+        return deny(`No policy entry for ${req.kind}.${req.op} in ${mode}/${profile}`);
+    }
+    if (opPolicy === "allow")
+        return ALLOW;
+    if (opPolicy === "deny") {
+        return deny(`${req.kind}.${req.op} is denied in ${mode}/${profile}`);
+    }
+    return opPolicy(req);
+}
+export class CapabilityBroker {
+    auditFilePath;
+    modeFn;
+    profileFn;
+    nowFn;
+    recent = [];
+    constructor(options = {}) {
+        const stateDir = options.stateDir ?? resolveStateDir(process.env, os.homedir);
+        this.auditFilePath =
+            options.auditFilePath ?? path.join(stateDir, "audit", "capability.jsonl");
+        this.modeFn = options.mode ?? (() => "local-safe");
+        this.profileFn = options.distributionProfile ?? resolveDistributionProfile;
+        this.nowFn = options.now ?? (() => new Date());
+        mkdirSync(path.dirname(this.auditFilePath), { recursive: true });
+        this.rotateIfOversized();
+    }
+    check(req) {
+        const mode = this.modeFn();
+        const profile = this.profileFn();
+        const policyKey = policyKeyFor(mode, profile, req);
+        const result = evaluatePolicy(mode, profile, req);
+        let decision;
+        if (result.allow) {
+            decision = { allowed: true, policyKey };
+        }
+        else {
+            // Invariant: deny() always supplies a non-null reason. Surface a
+            // structured error if a policy resolver violated that contract so the
+            // bug fails loud instead of writing `null` into the audit log.
+            if (result.reason === null) {
+                throw new Error(`[CapabilityBroker] Policy resolver returned deny without a reason for ${policyKey}`);
+            }
+            decision = { allowed: false, reason: result.reason, policyKey };
+        }
+        this.audit(req, decision, mode, profile, policyKey);
+        return decision;
+    }
+    snapshot() {
+        return {
+            mode: this.modeFn(),
+            profile: this.profileFn(),
+            auditFilePath: this.auditFilePath,
+            recent: [...this.recent],
+        };
+    }
+    recentDecisions(limit = 50) {
+        if (!Number.isFinite(limit) || limit <= 0)
+            return [];
+        const start = Math.max(0, this.recent.length - Math.floor(limit));
+        return this.recent.slice(start);
+    }
+    rotateIfOversized() {
+        let size;
+        try {
+            size = statSync(this.auditFilePath).size;
+        }
+        catch {
+            return;
+        }
+        if (size > AUDIT_LOG_MAX_BYTES) {
+            truncateSync(this.auditFilePath, 0);
+            logger.info(`[CapabilityBroker] Truncated audit log at ${this.auditFilePath} (was ${size} bytes)`);
+        }
+    }
+    audit(req, decision, mode, profile, policyKey) {
+        const denyReason = decision.allowed === true ? null : decision.reason;
+        const record = {
+            ts: this.nowFn().toISOString(),
+            kind: req.kind,
+            op: req.op,
+            target: req.target ?? null,
+            toolName: req.toolName ?? null,
+            reason: req.reason ?? null,
+            allowed: decision.allowed,
+            denyReason,
+            mode,
+            profile,
+            policyKey,
+        };
+        this.recent.push(record);
+        if (this.recent.length > RECENT_DECISION_BUFFER) {
+            this.recent.splice(0, this.recent.length - RECENT_DECISION_BUFFER);
+        }
+        try {
+            appendFileSync(this.auditFilePath, `${JSON.stringify(record)}\n`, "utf8");
+        }
+        catch (err) {
+            // The audit boundary is the only place we tolerate a catch — but we
+            // surface the failure structurally rather than swallowing it. A broken
+            // audit log is a security incident, not a no-op.
+            const message = err instanceof Error ? err.message : String(err);
+            logger.error(`[CapabilityBroker] Failed to append capability audit record at ${this.auditFilePath} (policyKey=${policyKey}): ${message}`);
+            throw err;
+        }
+    }
+}
+let cachedBroker = null;
+export function getCapabilityBroker() {
+    if (cachedBroker)
+        return cachedBroker;
+    cachedBroker = new CapabilityBroker();
+    return cachedBroker;
+}
+/**
+ * Test-only escape hatch — drops the cached singleton so the next call to
+ * `getCapabilityBroker()` re-reads env. Not exported to consumers via the
+ * package barrel.
+ */
+export function __resetCapabilityBrokerForTests() {
+    cachedBroker = null;
+}

package/packages/agent/src/services/character-history.d.ts

@@ -0,0 +1,69 @@
+import { type IAgentRuntime, type Memory } from "@elizaos/core";
+export declare const CHARACTER_HISTORY_TABLE = "character_modifications";
+export declare const MAX_CHARACTER_HISTORY_LIMIT = 100;
+export type RuntimeCharacterLike = {
+    name?: string;
+    username?: string;
+    bio?: string | string[];
+    system?: string;
+    adjectives?: string[];
+    topics?: string[];
+    style?: {
+        all?: string[];
+        chat?: string[];
+        post?: string[];
+    };
+    postExamples?: string[];
+    messageExamples?: unknown;
+    settings?: Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+};
+export type CharacterHistorySource = "manual" | "agent" | "restore";
+type CharacterHistoryValue = string | number | boolean | null | CharacterHistoryValue[] | {
+    [key: string]: CharacterHistoryValue | undefined;
+};
+export type CharacterHistorySnapshot = {
+    name?: string;
+    username?: string;
+    bio?: string[];
+    system?: string;
+    adjectives?: string[];
+    topics?: string[];
+    style?: {
+        all?: string[];
+        chat?: string[];
+        post?: string[];
+    };
+    postExamples?: string[];
+    messageExamples?: CharacterHistoryValue[];
+};
+export type CharacterHistoryField = keyof CharacterHistorySnapshot;
+export type CharacterHistoryChange = {
+    field: CharacterHistoryField;
+    before?: CharacterHistoryValue;
+    after?: CharacterHistoryValue;
+};
+export type CharacterHistoryEntry = {
+    id?: string;
+    timestamp: number;
+    source: CharacterHistorySource;
+    summary: string;
+    fieldsChanged: CharacterHistoryField[];
+    changes: CharacterHistoryChange[];
+    before: CharacterHistorySnapshot;
+    after: CharacterHistorySnapshot;
+};
+type CharacterHistoryRecordParams = {
+    previousCharacter?: RuntimeCharacterLike | null;
+    nextCharacter: RuntimeCharacterLike;
+    source: CharacterHistorySource;
+    timestamp?: number;
+    roomId?: string;
+};
+export declare function buildCharacterHistorySnapshot(character: RuntimeCharacterLike): CharacterHistorySnapshot;
+export declare function diffCharacterHistorySnapshots(previous: CharacterHistorySnapshot, next: CharacterHistorySnapshot): CharacterHistoryChange[];
+export declare function recordCharacterHistory(runtime: IAgentRuntime, params: CharacterHistoryRecordParams): Promise<CharacterHistoryEntry | null>;
+export declare function parseCharacterHistoryEntry(memory: Memory): CharacterHistoryEntry | null;
+export declare function listCharacterHistory(runtime: IAgentRuntime, limit?: number): Promise<CharacterHistoryEntry[]>;
+export {};
+//# sourceMappingURL=character-history.d.ts.map

package/packages/agent/src/services/character-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"character-history.d.ts","sourceRoot":"","sources":["../../../../../src/services/character-history.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,MAAM,EAAc,MAAM,eAAe,CAAC;AAE5E,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AACjE,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpE,KAAK,qBAAqB,GACtB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,qBAAqB,EAAE,GACvB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;CAAE,CAAC;AAEzD,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,qBAAqB,EAAE,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,MAAM,wBAAwB,CAAC;AAEnE,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,qBAAqB,EAAE,CAAC;IACvC,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC,MAAM,EAAE,wBAAwB,CAAC;IACjC,KAAK,EAAE,wBAAwB,CAAC;CACjC,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAClC,iBAAiB,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAChD,aAAa,EAAE,oBAAoB,CAAC;IACpC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AA8HF,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,oBAAoB,GAC9B,wBAAwB,CAkD1B;AAED,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,wBAAwB,GAC7B,sBAAsB,EAAE,CAwB1B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAiDvC;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,GACb,qBAAqB,GAAG,IAAI,CAsE9B;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,aAAa,EACtB,KAAK,SAAK,GACT,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAiBlC"}