@goplus/agentguard 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (131) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +242 -0
  3. package/dist/action/detectors/exec.d.ts +21 -0
  4. package/dist/action/detectors/exec.d.ts.map +1 -0
  5. package/dist/action/detectors/exec.js +201 -0
  6. package/dist/action/detectors/exec.js.map +1 -0
  7. package/dist/action/detectors/index.d.ts +4 -0
  8. package/dist/action/detectors/index.d.ts.map +1 -0
  9. package/dist/action/detectors/index.js +20 -0
  10. package/dist/action/detectors/index.js.map +1 -0
  11. package/dist/action/detectors/network.d.ts +21 -0
  12. package/dist/action/detectors/network.d.ts.map +1 -0
  13. package/dist/action/detectors/network.js +152 -0
  14. package/dist/action/detectors/network.js.map +1 -0
  15. package/dist/action/detectors/secret-leak.d.ts +28 -0
  16. package/dist/action/detectors/secret-leak.d.ts.map +1 -0
  17. package/dist/action/detectors/secret-leak.js +94 -0
  18. package/dist/action/detectors/secret-leak.js.map +1 -0
  19. package/dist/action/goplus/client.d.ts +151 -0
  20. package/dist/action/goplus/client.d.ts.map +1 -0
  21. package/dist/action/goplus/client.js +187 -0
  22. package/dist/action/goplus/client.js.map +1 -0
  23. package/dist/action/index.d.ts +61 -0
  24. package/dist/action/index.d.ts.map +1 -0
  25. package/dist/action/index.js +643 -0
  26. package/dist/action/index.js.map +1 -0
  27. package/dist/index.d.ts +31 -0
  28. package/dist/index.d.ts.map +1 -0
  29. package/dist/index.js +77 -0
  30. package/dist/index.js.map +1 -0
  31. package/dist/mcp-server.d.ts +3 -0
  32. package/dist/mcp-server.d.ts.map +1 -0
  33. package/dist/mcp-server.js +410 -0
  34. package/dist/mcp-server.js.map +1 -0
  35. package/dist/policy/default.d.ts +77 -0
  36. package/dist/policy/default.d.ts.map +1 -0
  37. package/dist/policy/default.js +94 -0
  38. package/dist/policy/default.js.map +1 -0
  39. package/dist/registry/index.d.ts +93 -0
  40. package/dist/registry/index.d.ts.map +1 -0
  41. package/dist/registry/index.js +280 -0
  42. package/dist/registry/index.js.map +1 -0
  43. package/dist/registry/storage.d.ts +69 -0
  44. package/dist/registry/storage.d.ts.map +1 -0
  45. package/dist/registry/storage.js +208 -0
  46. package/dist/registry/storage.js.map +1 -0
  47. package/dist/registry/trust.d.ts +41 -0
  48. package/dist/registry/trust.d.ts.map +1 -0
  49. package/dist/registry/trust.js +139 -0
  50. package/dist/registry/trust.js.map +1 -0
  51. package/dist/scanner/file-walker.d.ts +34 -0
  52. package/dist/scanner/file-walker.d.ts.map +1 -0
  53. package/dist/scanner/file-walker.js +134 -0
  54. package/dist/scanner/file-walker.js.map +1 -0
  55. package/dist/scanner/index.d.ts +67 -0
  56. package/dist/scanner/index.d.ts.map +1 -0
  57. package/dist/scanner/index.js +349 -0
  58. package/dist/scanner/index.js.map +1 -0
  59. package/dist/scanner/rules/exfiltration.d.ts +6 -0
  60. package/dist/scanner/rules/exfiltration.d.ts.map +1 -0
  61. package/dist/scanner/rules/exfiltration.js +48 -0
  62. package/dist/scanner/rules/exfiltration.js.map +1 -0
  63. package/dist/scanner/rules/index.d.ts +18 -0
  64. package/dist/scanner/rules/index.d.ts.map +1 -0
  65. package/dist/scanner/rules/index.js +54 -0
  66. package/dist/scanner/rules/index.js.map +1 -0
  67. package/dist/scanner/rules/obfuscation.d.ts +6 -0
  68. package/dist/scanner/rules/obfuscation.d.ts.map +1 -0
  69. package/dist/scanner/rules/obfuscation.js +37 -0
  70. package/dist/scanner/rules/obfuscation.js.map +1 -0
  71. package/dist/scanner/rules/prompt-injection.d.ts +6 -0
  72. package/dist/scanner/rules/prompt-injection.d.ts.map +1 -0
  73. package/dist/scanner/rules/prompt-injection.js +38 -0
  74. package/dist/scanner/rules/prompt-injection.js.map +1 -0
  75. package/dist/scanner/rules/remote-loader.d.ts +6 -0
  76. package/dist/scanner/rules/remote-loader.d.ts.map +1 -0
  77. package/dist/scanner/rules/remote-loader.js +31 -0
  78. package/dist/scanner/rules/remote-loader.js.map +1 -0
  79. package/dist/scanner/rules/secrets.d.ts +6 -0
  80. package/dist/scanner/rules/secrets.d.ts.map +1 -0
  81. package/dist/scanner/rules/secrets.js +68 -0
  82. package/dist/scanner/rules/secrets.js.map +1 -0
  83. package/dist/scanner/rules/shell-exec.d.ts +6 -0
  84. package/dist/scanner/rules/shell-exec.d.ts.map +1 -0
  85. package/dist/scanner/rules/shell-exec.js +52 -0
  86. package/dist/scanner/rules/shell-exec.js.map +1 -0
  87. package/dist/scanner/rules/web3.d.ts +6 -0
  88. package/dist/scanner/rules/web3.d.ts.map +1 -0
  89. package/dist/scanner/rules/web3.js +139 -0
  90. package/dist/scanner/rules/web3.js.map +1 -0
  91. package/dist/tests/action.test.d.ts +2 -0
  92. package/dist/tests/action.test.d.ts.map +1 -0
  93. package/dist/tests/action.test.js +127 -0
  94. package/dist/tests/action.test.js.map +1 -0
  95. package/dist/tests/registry.test.d.ts +2 -0
  96. package/dist/tests/registry.test.d.ts.map +1 -0
  97. package/dist/tests/registry.test.js +109 -0
  98. package/dist/tests/registry.test.js.map +1 -0
  99. package/dist/tests/scanner.test.d.ts +2 -0
  100. package/dist/tests/scanner.test.d.ts.map +1 -0
  101. package/dist/tests/scanner.test.js +57 -0
  102. package/dist/tests/scanner.test.js.map +1 -0
  103. package/dist/types/action.d.ts +198 -0
  104. package/dist/types/action.d.ts.map +1 -0
  105. package/dist/types/action.js +3 -0
  106. package/dist/types/action.js.map +1 -0
  107. package/dist/types/index.d.ts +5 -0
  108. package/dist/types/index.d.ts.map +1 -0
  109. package/dist/types/index.js +22 -0
  110. package/dist/types/index.js.map +1 -0
  111. package/dist/types/registry.d.ts +104 -0
  112. package/dist/types/registry.d.ts.map +1 -0
  113. package/dist/types/registry.js +21 -0
  114. package/dist/types/registry.js.map +1 -0
  115. package/dist/types/scanner.d.ts +88 -0
  116. package/dist/types/scanner.d.ts.map +1 -0
  117. package/dist/types/scanner.js +20 -0
  118. package/dist/types/scanner.js.map +1 -0
  119. package/dist/types/skill.d.ts +52 -0
  120. package/dist/types/skill.d.ts.map +1 -0
  121. package/dist/types/skill.js +33 -0
  122. package/dist/types/skill.js.map +1 -0
  123. package/dist/utils/hash.d.ts +21 -0
  124. package/dist/utils/hash.d.ts.map +1 -0
  125. package/dist/utils/hash.js +112 -0
  126. package/dist/utils/hash.js.map +1 -0
  127. package/dist/utils/patterns.d.ts +74 -0
  128. package/dist/utils/patterns.d.ts.map +1 -0
  129. package/dist/utils/patterns.js +157 -0
  130. package/dist/utils/patterns.js.map +1 -0
  131. package/package.json +60 -0
@@ -0,0 +1,643 @@
1
+ "use strict";
2
+ var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
3
+ if (k2 === undefined) k2 = k;
4
+ var desc = Object.getOwnPropertyDescriptor(m, k);
5
+ if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
6
+ desc = { enumerable: true, get: function() { return m[k]; } };
7
+ }
8
+ Object.defineProperty(o, k2, desc);
9
+ }) : (function(o, m, k, k2) {
10
+ if (k2 === undefined) k2 = k;
11
+ o[k2] = m[k];
12
+ }));
13
+ var __exportStar = (this && this.__exportStar) || function(m, exports) {
14
+ for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
15
+ };
16
+ Object.defineProperty(exports, "__esModule", { value: true });
17
+ exports.actionScanner = exports.ActionScanner = void 0;
18
+ const skill_js_1 = require("../types/skill.js");
19
+ const index_js_1 = require("../registry/index.js");
20
+ const network_js_1 = require("./detectors/network.js");
21
+ const exec_js_1 = require("./detectors/exec.js");
22
+ const secret_leak_js_1 = require("./detectors/secret-leak.js");
23
+ const client_js_1 = require("./goplus/client.js");
24
+ /**
25
+ * Action Scanner - Module C
26
+ * Runtime action decision engine
27
+ */
28
+ class ActionScanner {
29
+ registry;
30
+ goplus;
31
+ defaultCapabilities;
32
+ constructor(options = {}) {
33
+ this.registry = options.registry || new index_js_1.SkillRegistry();
34
+ this.goplus = options.goplusClient || client_js_1.goplusClient;
35
+ this.defaultCapabilities = options.defaultCapabilities || skill_js_1.DEFAULT_CAPABILITY;
36
+ }
37
+ /**
38
+ * Main decision method
39
+ */
40
+ async decide(envelope) {
41
+ const { actor, action, context } = envelope;
42
+ // Look up skill capabilities
43
+ const lookupResult = await this.registry.lookup(actor.skill);
44
+ const capabilities = lookupResult.effective_capabilities;
45
+ const trustLevel = lookupResult.effective_trust_level;
46
+ // Route to appropriate handler based on action type
47
+ switch (action.type) {
48
+ case 'network_request':
49
+ return this.handleNetworkRequest(action.data, capabilities, context.user_present);
50
+ case 'exec_command':
51
+ return this.handleExecCommand(action.data, capabilities);
52
+ case 'web3_tx':
53
+ return this.handleWeb3Tx(action.data, capabilities, context.user_present);
54
+ case 'web3_sign':
55
+ return this.handleWeb3Sign(action.data, capabilities, context.user_present);
56
+ case 'secret_access':
57
+ return this.handleSecretAccess(action.data, capabilities);
58
+ case 'read_file':
59
+ case 'write_file':
60
+ return this.handleFileOperation(action.data, action.type, capabilities);
61
+ default:
62
+ return {
63
+ decision: 'deny',
64
+ risk_level: 'high',
65
+ risk_tags: ['UNKNOWN_ACTION_TYPE'],
66
+ evidence: [
67
+ {
68
+ type: 'unknown_action',
69
+ description: `Unknown action type: ${action.type}`,
70
+ },
71
+ ],
72
+ explanation: `Unknown action type: ${action.type}`,
73
+ };
74
+ }
75
+ }
76
+ /**
77
+ * Handle network request actions
78
+ */
79
+ async handleNetworkRequest(request, capabilities, userPresent) {
80
+ const analysis = (0, network_js_1.analyzeNetworkRequest)(request, capabilities.network_allowlist);
81
+ // Critical secret leak - always deny
82
+ if (analysis.risk_tags.includes('CRITICAL_SECRET_EXFIL')) {
83
+ return {
84
+ decision: 'deny',
85
+ risk_level: 'critical',
86
+ risk_tags: analysis.risk_tags,
87
+ evidence: analysis.evidence,
88
+ explanation: analysis.block_reason || 'Critical secret exfiltration blocked',
89
+ };
90
+ }
91
+ // Should block
92
+ if (analysis.should_block) {
93
+ return {
94
+ decision: 'deny',
95
+ risk_level: analysis.risk_level,
96
+ risk_tags: analysis.risk_tags,
97
+ evidence: analysis.evidence,
98
+ explanation: analysis.block_reason || 'Request blocked',
99
+ };
100
+ }
101
+ // High risk - require confirmation
102
+ if (analysis.risk_level === 'high' || analysis.risk_level === 'critical') {
103
+ return {
104
+ decision: userPresent ? 'confirm' : 'deny',
105
+ risk_level: analysis.risk_level,
106
+ risk_tags: analysis.risk_tags,
107
+ evidence: analysis.evidence,
108
+ explanation: userPresent
109
+ ? 'High-risk request requires confirmation'
110
+ : 'High-risk request denied (user not present)',
111
+ };
112
+ }
113
+ // Untrusted domain - require confirmation
114
+ if (analysis.risk_tags.includes('UNTRUSTED_DOMAIN')) {
115
+ return {
116
+ decision: userPresent ? 'confirm' : 'deny',
117
+ risk_level: analysis.risk_level,
118
+ risk_tags: analysis.risk_tags,
119
+ evidence: analysis.evidence,
120
+ explanation: userPresent
121
+ ? 'Request to untrusted domain requires confirmation'
122
+ : 'Request to untrusted domain denied (user not present)',
123
+ };
124
+ }
125
+ // Allow
126
+ return {
127
+ decision: 'allow',
128
+ risk_level: analysis.risk_level,
129
+ risk_tags: analysis.risk_tags,
130
+ evidence: analysis.evidence,
131
+ };
132
+ }
133
+ /**
134
+ * Handle command execution actions
135
+ */
136
+ handleExecCommand(command, capabilities) {
137
+ const execAllowed = capabilities.exec === 'allow';
138
+ const analysis = (0, exec_js_1.analyzeExecCommand)(command, execAllowed);
139
+ if (analysis.should_block) {
140
+ return {
141
+ decision: 'deny',
142
+ risk_level: analysis.risk_level,
143
+ risk_tags: analysis.risk_tags,
144
+ evidence: analysis.evidence,
145
+ explanation: analysis.block_reason || 'Command execution blocked',
146
+ };
147
+ }
148
+ // High-risk commands need confirmation even if exec is allowed
149
+ if (analysis.risk_level === 'high' || analysis.risk_level === 'critical') {
150
+ return {
151
+ decision: 'confirm',
152
+ risk_level: analysis.risk_level,
153
+ risk_tags: analysis.risk_tags,
154
+ evidence: analysis.evidence,
155
+ explanation: 'High-risk command requires confirmation',
156
+ };
157
+ }
158
+ return {
159
+ decision: 'allow',
160
+ risk_level: analysis.risk_level,
161
+ risk_tags: analysis.risk_tags,
162
+ evidence: analysis.evidence,
163
+ };
164
+ }
165
+ /**
166
+ * Handle Web3 transaction actions
167
+ */
168
+ async handleWeb3Tx(tx, capabilities, userPresent) {
169
+ const evidence = [];
170
+ const riskTags = [];
171
+ let riskLevel = 'low';
172
+ let decision = 'allow';
173
+ // Check if chain is allowed
174
+ if (capabilities.web3) {
175
+ if (!capabilities.web3.chains_allowlist.includes(tx.chain_id)) {
176
+ evidence.push({
177
+ type: 'chain_not_allowed',
178
+ description: `Chain ${tx.chain_id} not in allowlist`,
179
+ });
180
+ riskTags.push('CHAIN_NOT_ALLOWED');
181
+ riskLevel = 'high';
182
+ decision = 'deny';
183
+ }
184
+ }
185
+ // Check origin for phishing
186
+ if (tx.origin) {
187
+ try {
188
+ const phishingResult = await this.goplus.phishingSite(tx.origin);
189
+ if (phishingResult.is_phishing || phishingResult.phishing_site) {
190
+ evidence.push({
191
+ type: 'phishing_origin',
192
+ field: 'origin',
193
+ match: tx.origin,
194
+ description: 'Transaction origin is a known phishing site',
195
+ });
196
+ riskTags.push('PHISHING_ORIGIN');
197
+ riskLevel = 'critical';
198
+ decision = 'deny';
199
+ }
200
+ }
201
+ catch (err) {
202
+ // Phishing check failed, continue with other checks
203
+ }
204
+ }
205
+ // Check target address
206
+ try {
207
+ const addressResult = await this.goplus.addressSecurity(tx.chain_id.toString(), [tx.to]);
208
+ const addressRisk = addressResult[tx.to.toLowerCase()];
209
+ if (addressRisk) {
210
+ if (addressRisk.is_blacklisted ||
211
+ addressRisk.is_phishing_activities ||
212
+ addressRisk.is_stealing_attack) {
213
+ evidence.push({
214
+ type: 'malicious_address',
215
+ field: 'to',
216
+ match: tx.to,
217
+ description: 'Target address is flagged as malicious',
218
+ });
219
+ riskTags.push('MALICIOUS_ADDRESS');
220
+ riskLevel = 'critical';
221
+ decision = 'deny';
222
+ }
223
+ if (addressRisk.is_honeypot_related_address) {
224
+ evidence.push({
225
+ type: 'honeypot_related',
226
+ field: 'to',
227
+ match: tx.to,
228
+ description: 'Target address is honeypot-related',
229
+ });
230
+ riskTags.push('HONEYPOT_RELATED');
231
+ if (riskLevel !== 'critical')
232
+ riskLevel = 'high';
233
+ }
234
+ }
235
+ }
236
+ catch (err) {
237
+ // Address check failed, continue
238
+ }
239
+ // Simulate transaction if GoPlus is configured
240
+ if (client_js_1.GoPlusClient.isConfigured() && decision !== 'deny') {
241
+ try {
242
+ const simulation = await this.goplus.simulateTransaction({
243
+ chain_id: tx.chain_id.toString(),
244
+ from: tx.from,
245
+ to: tx.to,
246
+ value: tx.value,
247
+ data: tx.data,
248
+ });
249
+ // Check for unlimited approvals
250
+ const unlimitedApprovals = simulation.approval_changes.filter((a) => a.is_unlimited);
251
+ if (unlimitedApprovals.length > 0) {
252
+ evidence.push({
253
+ type: 'unlimited_approval',
254
+ description: `Unlimited approval to ${unlimitedApprovals.map((a) => a.spender).join(', ')}`,
255
+ });
256
+ riskTags.push('UNLIMITED_APPROVAL');
257
+ if (riskLevel !== 'critical')
258
+ riskLevel = 'high';
259
+ if (decision === 'allow')
260
+ decision = 'confirm';
261
+ }
262
+ // Add simulation risk tags
263
+ riskTags.push(...simulation.risk_tags);
264
+ if (!simulation.success) {
265
+ evidence.push({
266
+ type: 'simulation_failed',
267
+ description: simulation.error_message || 'Transaction simulation failed',
268
+ });
269
+ riskTags.push('SIMULATION_FAILED');
270
+ if (riskLevel === 'low')
271
+ riskLevel = 'medium';
272
+ }
273
+ }
274
+ catch (err) {
275
+ // Simulation failed, continue with conservative approach
276
+ evidence.push({
277
+ type: 'simulation_error',
278
+ description: 'Could not simulate transaction',
279
+ });
280
+ }
281
+ }
282
+ // Apply tx_policy
283
+ if (capabilities.web3) {
284
+ if (capabilities.web3.tx_policy === 'deny') {
285
+ decision = 'deny';
286
+ }
287
+ else if (capabilities.web3.tx_policy === 'confirm_high_risk' &&
288
+ riskLevel !== 'low') {
289
+ if (decision === 'allow')
290
+ decision = 'confirm';
291
+ }
292
+ }
293
+ // User not present - upgrade confirm to deny
294
+ if (!userPresent && decision === 'confirm') {
295
+ decision = 'deny';
296
+ evidence.push({
297
+ type: 'user_not_present',
298
+ description: 'Risky transaction denied because user is not present',
299
+ });
300
+ }
301
+ return {
302
+ decision,
303
+ risk_level: riskLevel,
304
+ risk_tags: riskTags,
305
+ evidence,
306
+ explanation: decision === 'deny'
307
+ ? 'Transaction blocked due to security risks'
308
+ : decision === 'confirm'
309
+ ? 'Transaction requires user confirmation'
310
+ : 'Transaction allowed',
311
+ };
312
+ }
313
+ /**
314
+ * Handle Web3 sign actions
315
+ */
316
+ async handleWeb3Sign(sign, capabilities, userPresent) {
317
+ const evidence = [];
318
+ const riskTags = [];
319
+ let riskLevel = 'low';
320
+ let decision = 'allow';
321
+ // Check if chain is allowed
322
+ if (capabilities.web3) {
323
+ if (!capabilities.web3.chains_allowlist.includes(sign.chain_id)) {
324
+ evidence.push({
325
+ type: 'chain_not_allowed',
326
+ description: `Chain ${sign.chain_id} not in allowlist`,
327
+ });
328
+ riskTags.push('CHAIN_NOT_ALLOWED');
329
+ riskLevel = 'high';
330
+ decision = 'deny';
331
+ }
332
+ }
333
+ // Check origin for phishing
334
+ if (sign.origin) {
335
+ try {
336
+ const phishingResult = await this.goplus.phishingSite(sign.origin);
337
+ if (phishingResult.is_phishing || phishingResult.phishing_site) {
338
+ evidence.push({
339
+ type: 'phishing_origin',
340
+ field: 'origin',
341
+ match: sign.origin,
342
+ description: 'Signature request origin is a known phishing site',
343
+ });
344
+ riskTags.push('PHISHING_ORIGIN');
345
+ riskLevel = 'critical';
346
+ decision = 'deny';
347
+ }
348
+ }
349
+ catch (err) {
350
+ // Continue
351
+ }
352
+ }
353
+ // Check typed data for permit signatures
354
+ if (sign.typed_data) {
355
+ const typedDataStr = JSON.stringify(sign.typed_data);
356
+ // Check for Permit/Permit2 signatures
357
+ if (typedDataStr.includes('Permit') ||
358
+ typedDataStr.includes('permit')) {
359
+ evidence.push({
360
+ type: 'permit_signature',
361
+ description: 'Permit signature detected - can grant token approvals',
362
+ });
363
+ riskTags.push('PERMIT_SIGNATURE');
364
+ if (riskLevel === 'low')
365
+ riskLevel = 'medium';
366
+ if (decision === 'allow')
367
+ decision = 'confirm';
368
+ }
369
+ // Check for unlimited values
370
+ if (typedDataStr.includes('ffffffff') ||
371
+ typedDataStr.includes('max') ||
372
+ /value.*:.*['"]\d{30,}['"]/.test(typedDataStr)) {
373
+ evidence.push({
374
+ type: 'unlimited_value',
375
+ description: 'Signature contains unlimited/max value',
376
+ });
377
+ riskTags.push('UNLIMITED_VALUE');
378
+ if (riskLevel !== 'critical')
379
+ riskLevel = 'high';
380
+ if (decision === 'allow')
381
+ decision = 'confirm';
382
+ }
383
+ }
384
+ // Check message for sensitive data
385
+ if (sign.message) {
386
+ if ((0, secret_leak_js_1.containsCriticalSecrets)(sign.message)) {
387
+ evidence.push({
388
+ type: 'secret_in_message',
389
+ description: 'Message to sign contains sensitive data',
390
+ });
391
+ riskTags.push('SECRET_IN_SIGNATURE');
392
+ riskLevel = 'critical';
393
+ decision = 'deny';
394
+ }
395
+ }
396
+ // User not present - upgrade confirm to deny
397
+ if (!userPresent && decision === 'confirm') {
398
+ decision = 'deny';
399
+ evidence.push({
400
+ type: 'user_not_present',
401
+ description: 'Risky signature denied because user is not present',
402
+ });
403
+ }
404
+ return {
405
+ decision,
406
+ risk_level: riskLevel,
407
+ risk_tags: riskTags,
408
+ evidence,
409
+ explanation: decision === 'deny'
410
+ ? 'Signature request blocked due to security risks'
411
+ : decision === 'confirm'
412
+ ? 'Signature request requires user confirmation'
413
+ : 'Signature request allowed',
414
+ };
415
+ }
416
+ /**
417
+ * Handle secret access
418
+ */
419
+ handleSecretAccess(access, capabilities) {
420
+ const isAllowed = capabilities.secrets_allowlist.includes(access.secret_name);
421
+ if (isAllowed) {
422
+ return {
423
+ decision: 'allow',
424
+ risk_level: 'low',
425
+ risk_tags: [],
426
+ evidence: [],
427
+ };
428
+ }
429
+ return {
430
+ decision: 'deny',
431
+ risk_level: 'high',
432
+ risk_tags: ['SECRET_NOT_ALLOWED'],
433
+ evidence: [
434
+ {
435
+ type: 'secret_access_denied',
436
+ field: 'secret_name',
437
+ match: access.secret_name,
438
+ description: `Secret ${access.secret_name} not in allowlist`,
439
+ },
440
+ ],
441
+ explanation: `Access to secret '${access.secret_name}' is not allowed`,
442
+ };
443
+ }
444
+ /**
445
+ * Handle file operations
446
+ */
447
+ handleFileOperation(file, type, capabilities) {
448
+ // Check if path is in allowlist
449
+ const isAllowed = capabilities.filesystem_allowlist.some((pattern) => {
450
+ if (pattern === '*')
451
+ return true;
452
+ if (pattern.endsWith('/**')) {
453
+ const prefix = pattern.slice(0, -3);
454
+ return file.path.startsWith(prefix);
455
+ }
456
+ if (pattern.endsWith('/*')) {
457
+ const prefix = pattern.slice(0, -2);
458
+ const remainder = file.path.slice(prefix.length);
459
+ return file.path.startsWith(prefix) && !remainder.includes('/');
460
+ }
461
+ return file.path === pattern || file.path.startsWith(pattern + '/');
462
+ });
463
+ if (isAllowed) {
464
+ return {
465
+ decision: 'allow',
466
+ risk_level: 'low',
467
+ risk_tags: [],
468
+ evidence: [],
469
+ };
470
+ }
471
+ return {
472
+ decision: 'deny',
473
+ risk_level: 'medium',
474
+ risk_tags: ['PATH_NOT_ALLOWED'],
475
+ evidence: [
476
+ {
477
+ type: 'path_access_denied',
478
+ field: 'path',
479
+ match: file.path,
480
+ description: `Path ${file.path} not in allowlist`,
481
+ },
482
+ ],
483
+ explanation: `${type === 'read_file' ? 'Read' : 'Write'} access to '${file.path}' is not allowed`,
484
+ };
485
+ }
486
+ /**
487
+ * Simulate Web3 transaction/signature
488
+ */
489
+ async simulateWeb3(intent) {
490
+ const evidence = [];
491
+ const riskTags = [];
492
+ let riskLevel = 'low';
493
+ let decision = 'allow';
494
+ // Check if GoPlus is configured
495
+ if (!client_js_1.GoPlusClient.isConfigured()) {
496
+ return {
497
+ decision: 'confirm',
498
+ risk_level: 'medium',
499
+ risk_tags: ['SIMULATION_UNAVAILABLE'],
500
+ explanation: 'GoPlus API not configured - cannot simulate transaction',
501
+ guardrail: {
502
+ require_user_confirmation: true,
503
+ suggested_change: 'Configure GOPLUS_API_KEY and GOPLUS_API_SECRET',
504
+ },
505
+ };
506
+ }
507
+ // Check origin for phishing
508
+ if (intent.origin) {
509
+ try {
510
+ const phishingResult = await this.goplus.phishingSite(intent.origin);
511
+ if (phishingResult.is_phishing || phishingResult.phishing_site) {
512
+ return {
513
+ decision: 'deny',
514
+ risk_level: 'critical',
515
+ risk_tags: ['PHISHING_ORIGIN'],
516
+ explanation: 'Transaction origin is a known phishing site',
517
+ goplus: {
518
+ address_risk: {
519
+ is_malicious: false,
520
+ is_phishing: true,
521
+ },
522
+ },
523
+ };
524
+ }
525
+ }
526
+ catch (err) {
527
+ // Continue
528
+ }
529
+ }
530
+ // Check target address
531
+ try {
532
+ const addressResult = await this.goplus.addressSecurity(intent.chain_id.toString(), [intent.to]);
533
+ const addressRisk = addressResult[intent.to.toLowerCase()];
534
+ if (addressRisk) {
535
+ const isMalicious = addressRisk.is_blacklisted ||
536
+ addressRisk.is_phishing_activities ||
537
+ addressRisk.is_stealing_attack;
538
+ if (isMalicious) {
539
+ return {
540
+ decision: 'deny',
541
+ risk_level: 'critical',
542
+ risk_tags: ['MALICIOUS_ADDRESS'],
543
+ explanation: 'Target address is flagged as malicious',
544
+ goplus: {
545
+ address_risk: {
546
+ is_malicious: true,
547
+ is_phishing: addressRisk.is_phishing_activities,
548
+ risk_type: Object.entries(addressRisk)
549
+ .filter(([_, v]) => v === true)
550
+ .map(([k]) => k),
551
+ },
552
+ },
553
+ };
554
+ }
555
+ }
556
+ }
557
+ catch (err) {
558
+ evidence.push({
559
+ type: 'address_check_failed',
560
+ description: 'Could not verify target address',
561
+ });
562
+ }
563
+ // Simulate transaction
564
+ try {
565
+ const simulation = await this.goplus.simulateTransaction({
566
+ chain_id: intent.chain_id.toString(),
567
+ from: intent.from,
568
+ to: intent.to,
569
+ value: intent.value,
570
+ data: intent.data,
571
+ });
572
+ // Check for unlimited approvals
573
+ const unlimitedApprovals = simulation.approval_changes.filter((a) => a.is_unlimited);
574
+ if (unlimitedApprovals.length > 0) {
575
+ riskTags.push('UNLIMITED_APPROVAL');
576
+ riskLevel = 'high';
577
+ decision = 'confirm';
578
+ }
579
+ // Add all simulation risk tags
580
+ riskTags.push(...simulation.risk_tags);
581
+ // Determine final risk level
582
+ if (simulation.risk_level === 'critical') {
583
+ riskLevel = 'critical';
584
+ decision = 'deny';
585
+ }
586
+ else if (simulation.risk_level === 'high') {
587
+ riskLevel = 'high';
588
+ if (decision === 'allow')
589
+ decision = 'confirm';
590
+ }
591
+ return {
592
+ decision,
593
+ risk_level: riskLevel,
594
+ risk_tags: riskTags,
595
+ explanation: !simulation.success
596
+ ? simulation.error_message || 'Simulation failed'
597
+ : unlimitedApprovals.length > 0
598
+ ? 'Unlimited token approval detected'
599
+ : riskTags.length > 0
600
+ ? `Risks detected: ${riskTags.join(', ')}`
601
+ : 'Transaction appears safe',
602
+ goplus: {
603
+ simulation: {
604
+ success: simulation.success,
605
+ balance_changes: simulation.balance_changes.map((c) => ({
606
+ asset_type: c.token_address ? 'erc20' : 'native',
607
+ token_address: c.token_address,
608
+ amount: c.amount,
609
+ direction: c.direction,
610
+ })),
611
+ approval_changes: simulation.approval_changes,
612
+ },
613
+ },
614
+ guardrail: decision === 'confirm'
615
+ ? {
616
+ require_user_confirmation: true,
617
+ suggested_change: unlimitedApprovals.length > 0
618
+ ? 'Use limited approval amount instead'
619
+ : undefined,
620
+ }
621
+ : undefined,
622
+ };
623
+ }
624
+ catch (err) {
625
+ return {
626
+ decision: 'confirm',
627
+ risk_level: 'medium',
628
+ risk_tags: ['SIMULATION_FAILED'],
629
+ explanation: err instanceof Error ? err.message : 'Simulation failed',
630
+ guardrail: {
631
+ require_user_confirmation: true,
632
+ },
633
+ };
634
+ }
635
+ }
636
+ }
637
+ exports.ActionScanner = ActionScanner;
638
+ // Export singleton instance
639
+ exports.actionScanner = new ActionScanner();
640
+ // Re-export types and sub-modules
641
+ __exportStar(require("./detectors/index.js"), exports);
642
+ __exportStar(require("./goplus/client.js"), exports);
643
+ //# sourceMappingURL=index.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/action/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAcA,gDAAuD;AACvD,mDAAqD;AACrD,uDAA+D;AAC/D,iDAAyD;AACzD,+DAAuF;AACvF,kDAAgE;AAehE;;;GAGG;AACH,MAAa,aAAa;IAChB,QAAQ,CAAgB;IACxB,MAAM,CAAe;IACrB,mBAAmB,CAAkB;IAE7C,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,wBAAa,EAAE,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,wBAAY,CAAC;QACnD,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,6BAAkB,CAAC;IAC/E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,QAAwB;QACnC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;QAE5C,6BAA6B;QAC7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,YAAY,CAAC,sBAAsB,CAAC;QACzD,MAAM,UAAU,GAAG,YAAY,CAAC,qBAAqB,CAAC;QAEtD,oDAAoD;QACpD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,iBAAiB;gBACpB,OAAO,IAAI,CAAC,oBAAoB,CAC9B,MAAM,CAAC,IAA0B,EACjC,YAAY,EACZ,OAAO,CAAC,YAAY,CACrB,CAAC;YAEJ,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,iBAAiB,CAC3B,MAAM,CAAC,IAAuB,EAC9B,YAAY,CACb,CAAC;YAEJ,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,YAAY,CACtB,MAAM,CAAC,IAAkB,EACzB,YAAY,EACZ,OAAO,CAAC,YAAY,CACrB,CAAC;YAEJ,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,cAAc,CACxB,MAAM,CAAC,IAAoB,EAC3B,YAAY,EACZ,OAAO,CAAC,YAAY,CACrB,CAAC;YAEJ,KAAK,eAAe;gBAClB,OAAO,IAAI,CAAC,kBAAkB,CAC5B,MAAM,CAAC,IAAoD,EAC3D,YAAY,CACb,CAAC;YAEJ,KAAK,WAAW,CAAC;YACjB,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAC7B,MAAM,CAAC,IAAwB,EAC/B,MAAM,CAAC,IAAI,EACX,YAAY,CACb,CAAC;YAEJ;gBACE,OAAO;oBACL,QAAQ,EAAE,MAAM;oBAChB,UAAU,EAAE,MAAM;oBAClB,SAAS,EAAE,CAAC,qBAAqB,CAAC;oBAClC,QAAQ,EAAE;wBACR;4BACE,IAAI,EAAE,gBAAgB;4BACtB,WAAW,EAAE,wBAAwB,MAAM,CAAC,IAAI,EAAE;yBACnD;qBACF;oBACD,WAAW,EAAE,wBAAwB,MAAM,CAAC,IAAI,EAAE;iBACnD,CAAC;QACN,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,oBAAoB,CAChC,OAA2B,EAC3B,YAA6B,EAC7B,WAAoB;QAEpB,MAAM,QAAQ,GAAG,IAAA,kCAAqB,EACpC,OAAO,EACP,YAAY,CAAC,iBAAiB,CAC/B,CAAC;QAEF,qCAAqC;QACrC,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,UAAU;gBACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,WAAW,EAAE,QAAQ,CAAC,YAAY,IAAI,sCAAsC;aAC7E,CAAC;QACJ,CAAC;QAED,eAAe;QACf,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO;gBACL,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,WAAW,EAAE,QAAQ,CAAC,YAAY,IAAI,iBAAiB;aACxD,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACzE,OAAO;gBACL,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;gBAC1C,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,WAAW,EAAE,WAAW;oBACtB,CAAC,CAAC,yCAAyC;oBAC3C,CAAC,CAAC,6CAA6C;aAClD,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;gBAC1C,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,WAAW,EAAE,WAAW;oBACtB,CAAC,CAAC,mDAAmD;oBACrD,CAAC,CAAC,uDAAuD;aAC5D,CAAC;QACJ,CAAC;QAED,QAAQ;QACR,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,iBAAiB,CACvB,OAAwB,EACxB,YAA6B;QAE7B,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,KAAK,OAAO,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAA,4BAAkB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAE1D,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO;gBACL,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,WAAW,EAAE,QAAQ,CAAC,YAAY,IAAI,2BAA2B;aAClE,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACzE,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,WAAW,EAAE,yCAAyC;aACvD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CACxB,EAAc,EACd,YAA6B,EAC7B,WAAoB;QAEpB,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,SAAS,GAAc,KAAK,CAAC;QACjC,IAAI,QAAQ,GAAa,OAAO,CAAC;QAEjC,4BAA4B;QAC5B,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,WAAW,EAAE,SAAS,EAAE,CAAC,QAAQ,mBAAmB;iBACrD,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACnC,SAAS,GAAG,MAAM,CAAC;gBACnB,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;gBACjE,IAAI,cAAc,CAAC,WAAW,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;oBAC/D,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,iBAAiB;wBACvB,KAAK,EAAE,QAAQ;wBACf,KAAK,EAAE,EAAE,CAAC,MAAM;wBAChB,WAAW,EAAE,6CAA6C;qBAC3D,CAAC,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACjC,SAAS,GAAG,UAAU,CAAC;oBACvB,QAAQ,GAAG,MAAM,CAAC;gBACpB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oDAAoD;YACtD,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CACrD,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EACtB,CAAC,EAAE,CAAC,EAAE,CAAC,CACR,CAAC;YACF,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAEvD,IAAI,WAAW,EAAE,CAAC;gBAChB,IACE,WAAW,CAAC,cAAc;oBAC1B,WAAW,CAAC,sBAAsB;oBAClC,WAAW,CAAC,kBAAkB,EAC9B,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,mBAAmB;wBACzB,KAAK,EAAE,IAAI;wBACX,KAAK,EAAE,EAAE,CAAC,EAAE;wBACZ,WAAW,EAAE,wCAAwC;qBACtD,CAAC,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACnC,SAAS,GAAG,UAAU,CAAC;oBACvB,QAAQ,GAAG,MAAM,CAAC;gBACpB,CAAC;gBAED,IAAI,WAAW,CAAC,2BAA2B,EAAE,CAAC;oBAC5C,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,kBAAkB;wBACxB,KAAK,EAAE,IAAI;wBACX,KAAK,EAAE,EAAE,CAAC,EAAE;wBACZ,WAAW,EAAE,oCAAoC;qBAClD,CAAC,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;oBAClC,IAAI,SAAS,KAAK,UAAU;wBAAE,SAAS,GAAG,MAAM,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iCAAiC;QACnC,CAAC;QAED,+CAA+C;QAC/C,IAAI,wBAAY,CAAC,YAAY,EAAE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;oBACvD,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE;oBAChC,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,EAAE,EAAE,EAAE,CAAC,EAAE;oBACT,KAAK,EAAE,EAAE,CAAC,KAAK;oBACf,IAAI,EAAE,EAAE,CAAC,IAAI;iBACd,CAAC,CAAC;gBAEH,gCAAgC;gBAChC,MAAM,kBAAkB,GAAG,UAAU,CAAC,gBAAgB,CAAC,MAAM,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CACtB,CAAC;gBAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,WAAW,EAAE,yBAAyB,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC5F,CAAC,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;oBACpC,IAAI,SAAS,KAAK,UAAU;wBAAE,SAAS,GAAG,MAAM,CAAC;oBACjD,IAAI,QAAQ,KAAK,OAAO;wBAAE,QAAQ,GAAG,SAAS,CAAC;gBACjD,CAAC;gBAED,2BAA2B;gBAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;gBAEvC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBACxB,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,mBAAmB;wBACzB,WAAW,EAAE,UAAU,CAAC,aAAa,IAAI,+BAA+B;qBACzE,CAAC,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACnC,IAAI,SAAS,KAAK,KAAK;wBAAE,SAAS,GAAG,QAAQ,CAAC;gBAChD,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,yDAAyD;gBACzD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,gCAAgC;iBAC9C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBAC3C,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;iBAAM,IACL,YAAY,CAAC,IAAI,CAAC,SAAS,KAAK,mBAAmB;gBACnD,SAAS,KAAK,KAAK,EACnB,CAAC;gBACD,IAAI,QAAQ,KAAK,OAAO;oBAAE,QAAQ,GAAG,SAAS,CAAC;YACjD,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,WAAW,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3C,QAAQ,GAAG,MAAM,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EAAE,sDAAsD;aACpE,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,QAAQ;YACR,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,QAAQ;YACnB,QAAQ;YACR,WAAW,EACT,QAAQ,KAAK,MAAM;gBACjB,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,QAAQ,KAAK,SAAS;oBACxB,CAAC,CAAC,wCAAwC;oBAC1C,CAAC,CAAC,qBAAqB;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc,CAC1B,IAAkB,EAClB,YAA6B,EAC7B,WAAoB;QAEpB,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,SAAS,GAAc,KAAK,CAAC;QACjC,IAAI,QAAQ,GAAa,OAAO,CAAC;QAEjC,4BAA4B;QAC5B,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChE,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,WAAW,EAAE,SAAS,IAAI,CAAC,QAAQ,mBAAmB;iBACvD,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACnC,SAAS,GAAG,MAAM,CAAC;gBACnB,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnE,IAAI,cAAc,CAAC,WAAW,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;oBAC/D,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,iBAAiB;wBACvB,KAAK,EAAE,QAAQ;wBACf,KAAK,EAAE,IAAI,CAAC,MAAM;wBAClB,WAAW,EAAE,mDAAmD;qBACjE,CAAC,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACjC,SAAS,GAAG,UAAU,CAAC;oBACvB,QAAQ,GAAG,MAAM,CAAC;gBACpB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,WAAW;YACb,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAErD,sCAAsC;YACtC,IACE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC/B,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC/B,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,kBAAkB;oBACxB,WAAW,EAAE,uDAAuD;iBACrE,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAClC,IAAI,SAAS,KAAK,KAAK;oBAAE,SAAS,GAAG,QAAQ,CAAC;gBAC9C,IAAI,QAAQ,KAAK,OAAO;oBAAE,QAAQ,GAAG,SAAS,CAAC;YACjD,CAAC;YAED,6BAA6B;YAC7B,IACE,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;gBACjC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC5B,2BAA2B,CAAC,IAAI,CAAC,YAAY,CAAC,EAC9C,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,wCAAwC;iBACtD,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACjC,IAAI,SAAS,KAAK,UAAU;oBAAE,SAAS,GAAG,MAAM,CAAC;gBACjD,IAAI,QAAQ,KAAK,OAAO;oBAAE,QAAQ,GAAG,SAAS,CAAC;YACjD,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,IAAA,wCAAuB,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,WAAW,EAAE,yCAAyC;iBACvD,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACrC,SAAS,GAAG,UAAU,CAAC;gBACvB,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,WAAW,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3C,QAAQ,GAAG,MAAM,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EAAE,oDAAoD;aAClE,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,QAAQ;YACR,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,QAAQ;YACnB,QAAQ;YACR,WAAW,EACT,QAAQ,KAAK,MAAM;gBACjB,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,QAAQ,KAAK,SAAS;oBACxB,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,2BAA2B;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,MAAoD,EACpD,YAA6B;QAE7B,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAE9E,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,KAAK;gBACjB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,CAAC,oBAAoB,CAAC;YACjC,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,KAAK,EAAE,aAAa;oBACpB,KAAK,EAAE,MAAM,CAAC,WAAW;oBACzB,WAAW,EAAE,UAAU,MAAM,CAAC,WAAW,mBAAmB;iBAC7D;aACF;YACD,WAAW,EAAE,qBAAqB,MAAM,CAAC,WAAW,kBAAkB;SACvE,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,IAAsB,EACtB,IAAgC,EAChC,YAA6B;QAE7B,gCAAgC;QAChC,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACnE,IAAI,OAAO,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjD,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,KAAK;gBACjB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,CAAC,kBAAkB,CAAC;YAC/B,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,KAAK,EAAE,MAAM;oBACb,KAAK,EAAE,IAAI,CAAC,IAAI;oBAChB,WAAW,EAAE,QAAQ,IAAI,CAAC,IAAI,mBAAmB;iBAClD;aACF;YACD,WAAW,EAAE,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,eAAe,IAAI,CAAC,IAAI,kBAAkB;SAClG,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,MAAkB;QACnC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,SAAS,GAAc,KAAK,CAAC;QACjC,IAAI,QAAQ,GAAa,OAAO,CAAC;QAEjC,gCAAgC;QAChC,IAAI,CAAC,wBAAY,CAAC,YAAY,EAAE,EAAE,CAAC;YACjC,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,CAAC,wBAAwB,CAAC;gBACrC,WAAW,EAAE,yDAAyD;gBACtE,SAAS,EAAE;oBACT,yBAAyB,EAAE,IAAI;oBAC/B,gBAAgB,EAAE,gDAAgD;iBACnE;aACF,CAAC;QACJ,CAAC;QAED,4BAA4B;QAC5B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACrE,IAAI,cAAc,CAAC,WAAW,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;oBAC/D,OAAO;wBACL,QAAQ,EAAE,MAAM;wBAChB,UAAU,EAAE,UAAU;wBACtB,SAAS,EAAE,CAAC,iBAAiB,CAAC;wBAC9B,WAAW,EAAE,6CAA6C;wBAC1D,MAAM,EAAE;4BACN,YAAY,EAAE;gCACZ,YAAY,EAAE,KAAK;gCACnB,WAAW,EAAE,IAAI;6BAClB;yBACF;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,WAAW;YACb,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CACrD,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAC1B,CAAC,MAAM,CAAC,EAAE,CAAC,CACZ,CAAC;YACF,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAE3D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,WAAW,GACf,WAAW,CAAC,cAAc;oBAC1B,WAAW,CAAC,sBAAsB;oBAClC,WAAW,CAAC,kBAAkB,CAAC;gBAEjC,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO;wBACL,QAAQ,EAAE,MAAM;wBAChB,UAAU,EAAE,UAAU;wBACtB,SAAS,EAAE,CAAC,mBAAmB,CAAC;wBAChC,WAAW,EAAE,wCAAwC;wBACrD,MAAM,EAAE;4BACN,YAAY,EAAE;gCACZ,YAAY,EAAE,IAAI;gCAClB,WAAW,EAAE,WAAW,CAAC,sBAAsB;gCAC/C,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;qCACnC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;qCAC9B,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;6BACnB;yBACF;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,sBAAsB;gBAC5B,WAAW,EAAE,iCAAiC;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBACpC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YAEH,gCAAgC;YAChC,MAAM,kBAAkB,GAAG,UAAU,CAAC,gBAAgB,CAAC,MAAM,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CACtB,CAAC;YAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACpC,SAAS,GAAG,MAAM,CAAC;gBACnB,QAAQ,GAAG,SAAS,CAAC;YACvB,CAAC;YAED,+BAA+B;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YAEvC,6BAA6B;YAC7B,IAAI,UAAU,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACzC,SAAS,GAAG,UAAU,CAAC;gBACvB,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;iBAAM,IAAI,UAAU,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC5C,SAAS,GAAG,MAAM,CAAC;gBACnB,IAAI,QAAQ,KAAK,OAAO;oBAAE,QAAQ,GAAG,SAAS,CAAC;YACjD,CAAC;YAED,OAAO;gBACL,QAAQ;gBACR,UAAU,EAAE,SAAS;gBACrB,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO;oBAC9B,CAAC,CAAC,UAAU,CAAC,aAAa,IAAI,mBAAmB;oBACjD,CAAC,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;wBAC/B,CAAC,CAAC,mCAAmC;wBACrC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;4BACrB,CAAC,CAAC,mBAAmB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;4BAC1C,CAAC,CAAC,0BAA0B;gBAC9B,MAAM,EAAE;oBACN,UAAU,EAAE;wBACV,OAAO,EAAE,UAAU,CAAC,OAAO;wBAC3B,eAAe,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BACtD,UAAU,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;4BAChD,aAAa,EAAE,CAAC,CAAC,aAAa;4BAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;4BAChB,SAAS,EAAE,CAAC,CAAC,SAAS;yBACvB,CAAC,CAAC;wBACH,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;qBAC9C;iBACF;gBACD,SAAS,EACP,QAAQ,KAAK,SAAS;oBACpB,CAAC,CAAC;wBACE,yBAAyB,EAAE,IAAI;wBAC/B,gBAAgB,EAAE,kBAAkB,CAAC,MAAM,GAAG,CAAC;4BAC7C,CAAC,CAAC,qCAAqC;4BACvC,CAAC,CAAC,SAAS;qBACd;oBACH,CAAC,CAAC,SAAS;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,CAAC,mBAAmB,CAAC;gBAChC,WAAW,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB;gBACrE,SAAS,EAAE;oBACT,yBAAyB,EAAE,IAAI;iBAChC;aACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA9sBD,sCA8sBC;AAED,4BAA4B;AACf,QAAA,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;AAEjD,kCAAkC;AAClC,uDAAqC;AACrC,qDAAmC"}