@intutic/mcp-governance-proxy 1.9.0 → 1.10.1

package/dist/injection.d.ts

@@ -0,0 +1,46 @@
+/**
+ * injection.ts — Prompt-injection pattern scanning over MCP tool-call traffic.
+ *
+ * Direct TypeScript port of `packages/proxy/src/injection.rs`'s five named
+ * regex patterns. Rust's `regex` crate and JS `RegExp` agree on everything
+ * these patterns use (case-insensitive alternation, `\b`, `\s+`, no
+ * backreferences or lookaround), so the pattern SOURCE TEXT is unchanged —
+ * only the syntax wrapper (Rust raw string → JS regex literal) differs.
+ *
+ * This is deliberately not a classifier — see injection.rs's module doc for
+ * the full argument. Pattern matching only, priced at a handful of regex
+ * tests, catching the well-known phrasings and nothing else. False positives
+ * are the real cost (people legitimately tell an agent to "ignore my last
+ * message"), which is why the patterns stay narrow and a single match steers
+ * rather than kills.
+ *
+ * @module
+ */
+/**
+ * Replace the dynamic pattern set. Cheap to call on every scan: a source
+ * list identical to the last one is a no-op, so callers can hand it the
+ * policy's current list without tracking changes themselves. Returns how
+ * many sources did not compile.
+ */
+export declare function setDynamicInjectionPatterns(sources: readonly string[]): number;
+/**
+ * Names of the injection patterns present in `text`, deduplicated. Empty
+ * when nothing matched (the overwhelmingly common case).
+ */
+export declare function scanText(text: string): string[];
+/** Where a piece of scanned MCP traffic came from. */
+export type InjectionSource = 'tool_result' | 'tool_description' | 'tool_input';
+export type InjectionSeverity = 'low' | 'high';
+/**
+ * Mirrors `PromptInjectionDetector::detect`'s escalation rule (detectors.rs):
+ * severity escalates to `high` when findings reach the kill threshold (≥2
+ * distinct techniques) OR the source is untrusted content — otherwise `low`.
+ * Note this is an EVENT-severity mirror only; it does not by itself decide
+ * `allow`/`block` — see `mcpInjectionAction` (interceptor.ts / proxy.ts) for
+ * the actual disposition, which follows this package's own warn/block
+ * config rather than the Rust detector's reask/steer ladder (MCP's headless
+ * proxy has no reask loop of its own at the injection layer — Phase 2's
+ * anomaly reask ladder is the analogue for that).
+ */
+export declare function injectionSeverity(findings: readonly string[], source: InjectionSource): InjectionSeverity;
+//# sourceMappingURL=injection.d.ts.map

package/dist/injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.d.ts","sourceRoot":"","sources":["../src/injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAsEH;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAe9E;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAW/C;AAED,sDAAsD;AACtD,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,kBAAkB,GAAG,YAAY,CAAA;AAE/E,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,MAAM,CAAA;AAc9C;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,GAAG,iBAAiB,CAGzG"}

package/dist/injection.js

@@ -0,0 +1,147 @@
+/**
+ * injection.ts — Prompt-injection pattern scanning over MCP tool-call traffic.
+ *
+ * Direct TypeScript port of `packages/proxy/src/injection.rs`'s five named
+ * regex patterns. Rust's `regex` crate and JS `RegExp` agree on everything
+ * these patterns use (case-insensitive alternation, `\b`, `\s+`, no
+ * backreferences or lookaround), so the pattern SOURCE TEXT is unchanged —
+ * only the syntax wrapper (Rust raw string → JS regex literal) differs.
+ *
+ * This is deliberately not a classifier — see injection.rs's module doc for
+ * the full argument. Pattern matching only, priced at a handful of regex
+ * tests, catching the well-known phrasings and nothing else. False positives
+ * are the real cost (people legitimately tell an agent to "ignore my last
+ * message"), which is why the patterns stay narrow and a single match steers
+ * rather than kills.
+ *
+ * @module
+ */
+/**
+ * Ported verbatim from `packages/proxy/src/injection.rs`'s `PATTERNS` const
+ * (confirmed by reading that file directly — names and pattern text below
+ * are not inferred). None of these patterns has the wide bounded-repetition
+ * shape (`{20,300}`, etc.) that caused the unrelated `RegexSet` performance
+ * regression documented in `dlp.rs` — the widest quantifier here is `\s+`
+ * and a handful of short alternations — so a plain sequential scan (no
+ * RegexSet-equivalent needed) is both correct and linear-time on untrusted
+ * input.
+ */
+const PATTERNS = [
+    {
+        name: 'override-instructions',
+        regex: /\b(ignore|disregard|forget)\s+(all\s+|any\s+)?(previous|prior|earlier|above|preceding)\s+(instruction|direction|prompt|rule|command)s?\b/i,
+    },
+    {
+        name: 'reveal-system-prompt',
+        regex: /\b(reveal|repeat|print|show|output|display)\s+(me\s+)?(your|the)\s+(system\s+prompt|initial\s+instructions|original\s+instructions)\b/i,
+    },
+    {
+        name: 'role-reassignment',
+        regex: /\byou\s+are\s+now\s+(a|an|in)\b|\bfrom\s+now\s+on,?\s+you\s+(are|will|must)\b/i,
+    },
+    {
+        name: 'guardrail-bypass',
+        regex: /\b(developer|debug|god)\s+mode\b|\bDAN\s+mode\b|\bwithout\s+any\s+(restrictions|filters|guardrails)\b/i,
+    },
+    {
+        name: 'instruction-boundary-forgery',
+        // Rust's `(^|\n)` with no `(?m)` flag matches only the start of the WHOLE
+        // haystack or a literal newline character — never "start of any line" the
+        // way `^` would under a multiline flag. JS `^` without the `m` flag has
+        // the identical "start of whole string" semantics, and the pattern
+        // already spells out `(^|\n)` explicitly, so no `m` flag is added here —
+        // adding one would change behavior (every line start would match) rather
+        // than preserve it.
+        regex: /(^|\n)\s*(\[\/?(INST|SYSTEM)\]|<\|?(im_start|system)\|?>|###\s*system\b)/i,
+    },
+];
+/**
+ * Ported from `detectors.rs`'s `INJECTION_KILL_THRESHOLD` (confirmed: `const
+ * INJECTION_KILL_THRESHOLD: usize = 2;`) — the Rust `PromptInjectionDetector`
+ * escalates to `reask` once findings reach this count, OR immediately on any
+ * untrusted-content source. `scanText`/`injectionSeverity` below reuse the
+ * same threshold for MCP's `injection_detected` event severity, mirroring
+ * that escalation rule rather than reimplementing a new one.
+ */
+const KILL_THRESHOLD = 2;
+/**
+ * Workspace-supplied patterns, compiled (TD-436). Same contract as
+ * `dlp.ts`'s `setDynamicPatterns`: sources come from the control plane's
+ * `mcpInjectionPatterns`, an invalid one is dropped and counted, and the
+ * hardcoded floor above applies regardless — an unreachable control plane
+ * degrades to the floor, never to no scanning. Named `workspace:<n>` so a
+ * finding says which layer matched.
+ */
+let dynamicPatterns = [];
+let dynamicKey = '';
+/**
+ * Replace the dynamic pattern set. Cheap to call on every scan: a source
+ * list identical to the last one is a no-op, so callers can hand it the
+ * policy's current list without tracking changes themselves. Returns how
+ * many sources did not compile.
+ */
+export function setDynamicInjectionPatterns(sources) {
+    const key = sources.join('\u0000');
+    if (key === dynamicKey)
+        return 0;
+    const compiled = [];
+    let dropped = 0;
+    sources.forEach((src, i) => {
+        try {
+            compiled.push({ name: `workspace:${i + 1}`, regex: new RegExp(src, 'i') });
+        }
+        catch {
+            dropped += 1;
+        }
+    });
+    dynamicPatterns = compiled;
+    dynamicKey = key;
+    return dropped;
+}
+/**
+ * Names of the injection patterns present in `text`, deduplicated. Empty
+ * when nothing matched (the overwhelmingly common case).
+ */
+export function scanText(text) {
+    if (!text)
+        return [];
+    const found = [];
+    for (const { name, regex } of PATTERNS) {
+        if (regex.test(text))
+            found.push(name);
+    }
+    for (const { name, regex } of dynamicPatterns) {
+        regex.lastIndex = 0;
+        if (regex.test(text))
+            found.push(name);
+    }
+    return found;
+}
+/**
+ * Sources this proxy treats as untrusted content the agent fetched or was
+ * handed, rather than the calling agent's own request — the same
+ * distinction `detectors.rs`'s `from_untrusted_content` draws between
+ * `tool_result`/`tool_description` and `user_prompt`. MCP has no
+ * `user_prompt`/`system_prompt` concept of its own; `tool_input` (the
+ * request direction, the calling agent's own tool arguments) is this
+ * proxy's closest analogue to the Rust detector's trusted `user_prompt`
+ * source, so it is deliberately excluded here.
+ */
+const UNTRUSTED_SOURCES = new Set(['tool_result', 'tool_description']);
+/**
+ * Mirrors `PromptInjectionDetector::detect`'s escalation rule (detectors.rs):
+ * severity escalates to `high` when findings reach the kill threshold (≥2
+ * distinct techniques) OR the source is untrusted content — otherwise `low`.
+ * Note this is an EVENT-severity mirror only; it does not by itself decide
+ * `allow`/`block` — see `mcpInjectionAction` (interceptor.ts / proxy.ts) for
+ * the actual disposition, which follows this package's own warn/block
+ * config rather than the Rust detector's reask/steer ladder (MCP's headless
+ * proxy has no reask loop of its own at the injection layer — Phase 2's
+ * anomaly reask ladder is the analogue for that).
+ */
+export function injectionSeverity(findings, source) {
+    if (findings.length >= KILL_THRESHOLD || UNTRUSTED_SOURCES.has(source))
+        return 'high';
+    return 'low';
+}
+//# sourceMappingURL=injection.js.map

package/dist/injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.js","sourceRoot":"","sources":["../src/injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH;;;;;;;;;GASG;AACH,MAAM,QAAQ,GAAgC;IAC5C;QACE,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EACH,2IAA2I;KAC9I;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EACH,wIAAwI;KAC3I;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,gFAAgF;KACxF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,wGAAwG;KAChH;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,mEAAmE;QACnE,yEAAyE;QACzE,yEAAyE;QACzE,oBAAoB;QACpB,KAAK,EAAE,2EAA2E;KACnF;CACF,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,CAAC,CAAA;AAExB;;;;;;;GAOG;AACH,IAAI,eAAe,GAAgC,EAAE,CAAA;AACrD,IAAI,UAAU,GAAG,EAAE,CAAA;AAEnB;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAA0B;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,CAAC,CAAA;IAChC,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;IACF,eAAe,GAAG,QAAQ,CAAA;IAC1B,UAAU,GAAG,GAAG,CAAA;IAChB,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxC,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,eAAe,EAAE,CAAC;QAC9C,KAAK,CAAC,SAAS,GAAG,CAAC,CAAA;QACnB,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAiC,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAA;AAEpG;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B,EAAE,MAAuB;IACpF,IAAI,QAAQ,CAAC,MAAM,IAAI,cAAc,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IACrF,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/interceptor.d.ts

@@ -9,6 +9,9 @@
  *
  * @module
  */
+import type { AnomalyMode, Disposition } from './anomaly/index.js';
+import { SessionState } from './session.js';
+import type { WasmRunner } from './wasm/runner.js';
 import type { PolicyClient } from './policy.js';
 import type { GovernanceEmitter } from './emitter.js';
 export type Decision = {
@@ -25,7 +28,134 @@ export declare class ToolCallInterceptor {
     private readonly policy;
     private readonly emitter;
     private readonly failOpen;
-    constructor(policy: PolicyClient, emitter: GovernanceEmitter, failOpen?: boolean);
+    /**
+     * The real MCP server this proxy process fronts, from `--server-name`
+     * (config.ts, threaded since Phase D's `wrapWithProxy` but unconsumed
+     * until now). `'unknown'` when unset, matching config.ts's own default —
+     * see the server-scoping check below for why an allowlist naming
+     * anything else then refuses every call from this process.
+     */
+    private readonly serverName;
+    /**
+     * Env-derived default prompt-injection disposition (`config.ts`'s
+     * `mcpInjectionAction`), used whenever `policy.getInjectionAction()`
+     * reports no control-plane override. Defaults to `'warn'` here too, so
+     * every existing construction site/test that doesn't pass this
+     * parameter keeps the same steer-not-kill posture the Rust detector this
+     * was ported from uses by default.
+     */
+    private readonly injectionActionDefault;
+    /**
+     * Shared per-process session state (Phase 2) — the SAME instance
+     * `McpGovernanceProxy` (proxy.ts) owns and hands to `handleHarnessLine`
+     * for post-decision recording, so the sequence this method reads for
+     * detection and the sequence `handleHarnessLine` appends to after an
+     * `allow` are never two different objects that could drift. Defaults to
+     * a fresh instance so every existing construction site/test that
+     * predates Phase 2 keeps working unchanged.
+     */
+    private readonly session;
+    /**
+     * Env-derived default anomaly mode (`config.ts`'s `mcpAnomalyMode`),
+     * used whenever `policy.getAnomalyMode()` reports no control-plane
+     * override. Defaults to `'enforce'` — see `config.ts`'s doc comment on
+     * why "enforce" here does not mean "block on suspicion": every
+     * detector's own Rust-declared disposition ceiling still applies via
+     * `resolveEffectiveDisposition`.
+     */
+    private readonly anomalyModeDefault;
+    /**
+     * Env-derived default per-detector override map (`config.ts`'s
+     * `mcpAnomalyOverrides`). Merged with `policy.getAnomalyOverrides()` per
+     * key, control-plane value winning — the same "policy overrides the
+     * env-derived default, per field" shape `injectionActionDefault` uses,
+     * just applied per-map-entry instead of to one scalar.
+     */
+    private readonly anomalyOverridesDefault;
+    /**
+     * Phase 3's WASM custom-rule runner, or `undefined` to skip WASM
+     * evaluation entirely (every construction site/test that predates Phase
+     * 3, and any deployment with no `~/.intutic/wasm/` rules). Owned by
+     * `McpGovernanceProxy` (proxy.ts), same sharing pattern as `session`.
+     */
+    private readonly wasmRunner;
+    /**
+     * This proxy's workspace id, from `config.ts` — needed for Phase 3's
+     * `RequestContext.workspace_id` field. Stored separately from `policy`
+     * (which has no getter for it) and from `serverName` (a different
+     * identity: the MCP SERVER this process fronts, not the WORKSPACE it
+     * belongs to).
+     */
+    private readonly workspaceId;
+    constructor(policy: PolicyClient, emitter: GovernanceEmitter, failOpen?: boolean, 
+    /**
+     * The real MCP server this proxy process fronts, from `--server-name`
+     * (config.ts, threaded since Phase D's `wrapWithProxy` but unconsumed
+     * until now). `'unknown'` when unset, matching config.ts's own default —
+     * see the server-scoping check below for why an allowlist naming
+     * anything else then refuses every call from this process.
+     */
+    serverName?: string, 
+    /**
+     * Env-derived default prompt-injection disposition (`config.ts`'s
+     * `mcpInjectionAction`), used whenever `policy.getInjectionAction()`
+     * reports no control-plane override. Defaults to `'warn'` here too, so
+     * every existing construction site/test that doesn't pass this
+     * parameter keeps the same steer-not-kill posture the Rust detector this
+     * was ported from uses by default.
+     */
+    injectionActionDefault?: 'warn' | 'block', 
+    /**
+     * Shared per-process session state (Phase 2) — the SAME instance
+     * `McpGovernanceProxy` (proxy.ts) owns and hands to `handleHarnessLine`
+     * for post-decision recording, so the sequence this method reads for
+     * detection and the sequence `handleHarnessLine` appends to after an
+     * `allow` are never two different objects that could drift. Defaults to
+     * a fresh instance so every existing construction site/test that
+     * predates Phase 2 keeps working unchanged.
+     */
+    session?: SessionState, 
+    /**
+     * Env-derived default anomaly mode (`config.ts`'s `mcpAnomalyMode`),
+     * used whenever `policy.getAnomalyMode()` reports no control-plane
+     * override. Defaults to `'enforce'` — see `config.ts`'s doc comment on
+     * why "enforce" here does not mean "block on suspicion": every
+     * detector's own Rust-declared disposition ceiling still applies via
+     * `resolveEffectiveDisposition`.
+     */
+    anomalyModeDefault?: AnomalyMode, 
+    /**
+     * Env-derived default per-detector override map (`config.ts`'s
+     * `mcpAnomalyOverrides`). Merged with `policy.getAnomalyOverrides()` per
+     * key, control-plane value winning — the same "policy overrides the
+     * env-derived default, per field" shape `injectionActionDefault` uses,
+     * just applied per-map-entry instead of to one scalar.
+     */
+    anomalyOverridesDefault?: Readonly<Record<string, Disposition | 'off'>>, 
+    /**
+     * Phase 3's WASM custom-rule runner, or `undefined` to skip WASM
+     * evaluation entirely (every construction site/test that predates Phase
+     * 3, and any deployment with no `~/.intutic/wasm/` rules). Owned by
+     * `McpGovernanceProxy` (proxy.ts), same sharing pattern as `session`.
+     */
+    wasmRunner?: WasmRunner | undefined, 
+    /**
+     * This proxy's workspace id, from `config.ts` — needed for Phase 3's
+     * `RequestContext.workspace_id` field. Stored separately from `policy`
+     * (which has no getter for it) and from `serverName` (a different
+     * identity: the MCP SERVER this process fronts, not the WORKSPACE it
+     * belongs to).
+     */
+    workspaceId?: string);
+    /**
+     * Applies the shared reask ladder (Phase 2 anomaly detectors AND Phase 3
+     * WASM rules both use this): a session-lifetime attempt counter keyed by
+     * `key`, `REASK_MAX_ATTEMPTS` (3) tries before hardening into an
+     * unconditional block. Always emits `tool_blocked` — a reask blocks the
+     * CURRENT attempt, so existing consumers keyed on `tool_blocked` must see
+     * it, exactly like every other new block reason in this package.
+     */
+    private applyReaskLadder;
     /**
      * Evaluate a tools/call request and return a governance decision.
      *

package/dist/interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interceptor.d.ts","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAIrD,MAAM,MAAM,QAAQ,GAChB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAAA;AAEhE,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,GAAE,OAAc;IAG3C;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAgEtE"}
+{"version":3,"file":"interceptor.d.ts","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAIrD,MAAM,MAAM,QAAQ,GAChB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAAA;AAEhE,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW;gBA7DX,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,GAAE,OAAc;IACzC;;;;;;OAMG;IACc,UAAU,GAAE,MAAkB;IAC/C;;;;;;;OAOG;IACc,sBAAsB,GAAE,MAAM,GAAG,OAAgB;IAClE;;;;;;;;OAQG;IACc,OAAO,GAAE,YAAiC;IAC3D;;;;;;;OAOG;IACc,kBAAkB,GAAE,WAAuB;IAC5D;;;;;;OAMG;IACc,uBAAuB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAAC,CAAM;IAC5F;;;;;OAKG;IACc,UAAU,GAAE,UAAU,GAAG,SAAqB;IAC/D;;;;;;OAMG;IACc,WAAW,GAAE,MAAkB;IAGlD;;;;;;;OAOG;YACW,gBAAgB;IAmB9B;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAiRtE"}