@lingxiao-office/sdk 1.0.0

package/dist/core/workflow/executors/ToolNodeExecutor.d.ts

@@ -0,0 +1,16 @@
+/**
+ * ToolNodeExecutor - Tool 节点执行器
+ *
+ * 集成现有的 ToolRegistry
+ */
+import { BaseNodeExecutor } from './BaseNodeExecutor.js';
+import type { NodeDefinition, ExecutionContext } from '../types.js';
+import type { ToolRegistryContract } from '../../../contracts/types/Tool.js';
+export declare class ToolNodeExecutor extends BaseNodeExecutor {
+    private toolRegistry;
+    private variableResolver;
+    constructor(toolRegistry: ToolRegistryContract);
+    execute(node: NodeDefinition, input: Record<string, unknown>, context: ExecutionContext): Promise<unknown>;
+    private unwrapToolResult;
+}
+//# sourceMappingURL=ToolNodeExecutor.d.ts.map

package/dist/core/workflow/executors/ToolNodeExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ToolNodeExecutor.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/executors/ToolNodeExecutor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAAe,oBAAoB,EAAc,MAAM,kCAAkC,CAAC;AAkBtG,qBAAa,gBAAiB,SAAQ,gBAAgB;IAGxC,OAAO,CAAC,YAAY;IAFhC,OAAO,CAAC,gBAAgB,CAA0B;gBAE9B,YAAY,EAAE,oBAAoB;IAIhD,OAAO,CACX,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,CAAC;IA+DnB,OAAO,CAAC,gBAAgB;CAmBzB"}

package/dist/core/workflow/executors/ToolNodeExecutor.js

@@ -0,0 +1,83 @@
+/**
+ * ToolNodeExecutor - Tool 节点执行器
+ *
+ * 集成现有的 ToolRegistry
+ */
+import { BaseNodeExecutor } from './BaseNodeExecutor.js';
+import { VariableResolver } from '../VariableResolver.js';
+import { buildVariableScope } from '../variableScope.js';
+function isSafeParseSchema(value) {
+    return !!value && typeof value === 'object' && typeof value.safeParse === 'function';
+}
+function hasCanonicalExecute(registry) {
+    return typeof registry.execute === 'function';
+}
+export class ToolNodeExecutor extends BaseNodeExecutor {
+    toolRegistry;
+    variableResolver = new VariableResolver();
+    constructor(toolRegistry) {
+        super();
+        this.toolRegistry = toolRegistry;
+    }
+    async execute(node, input, context) {
+        this.validateNode(node);
+        const { config } = node.data;
+        const { toolName, toolArgs } = config;
+        if (!toolName) {
+            throw new Error(`Tool name not specified for node ${node.id}`);
+        }
+        this.log(context, 'info', node.id, `Executing tool: ${toolName}`);
+        try {
+            // 合并配置参数和输入参数
+            const resolvedToolArgs = this.variableResolver.resolveObject(toolArgs || {}, buildVariableScope(context, { input }));
+            const args = { ...resolvedToolArgs, ...input };
+            // 构建工具上下文
+            const toolContext = {
+                workspace: context.variables.get('workspace') || process.cwd(),
+                sessionId: context.sessionId,
+                agentId: `workflow-${context.workflowId}`,
+                taskId: context.executionId,
+                db: context.db,
+                emitter: context.emitter,
+                workflowManager: context.workflowManager,
+                workflowEngine: context.workflowEngine,
+                blackboardGraph: context.blackboardGraph,
+            };
+            this.log(context, 'debug', node.id, `Tool args: ${JSON.stringify(args)}`);
+            if (hasCanonicalExecute(this.toolRegistry)) {
+                const result = await this.toolRegistry.execute(toolName, args, toolContext);
+                return this.unwrapToolResult(toolName, node.id, result, context);
+            }
+            // 兼容旧的最小 ToolRegistryContract；生产 Registry 应走上面的 canonical execute。
+            const tool = this.toolRegistry.get(toolName);
+            if (!tool) {
+                throw new Error(`Tool not found: ${toolName}`);
+            }
+            const parameters = 'parameters' in tool ? tool.parameters : undefined;
+            const parsedArgs = isSafeParseSchema(parameters) ? parameters.safeParse(args) : undefined;
+            if (parsedArgs && !parsedArgs.success) {
+                throw new Error(`Invalid args for tool ${toolName} on node ${node.id}: ${parsedArgs.error.issues.map((issue) => `${issue.path.map(String).join('.') || '<root>'}: ${issue.message}`).join('; ')}`);
+            }
+            const executableArgs = parsedArgs?.success ? parsedArgs.data : args;
+            const result = await tool.execute(executableArgs, toolContext);
+            return this.unwrapToolResult(toolName, node.id, result, context);
+        }
+        catch (error) {
+            this.log(context, 'error', node.id, `Tool execution failed: ${error instanceof Error ? error.message : String(error)}`);
+            throw error;
+        }
+    }
+    unwrapToolResult(toolName, nodeId, result, context) {
+        if (typeof result === 'object' && result !== null && 'success' in result) {
+            const toolResult = result;
+            if (!toolResult.success) {
+                throw new Error(toolResult.error || 'Tool execution failed');
+            }
+            this.log(context, 'info', nodeId, `Tool ${toolName} completed successfully`);
+            return toolResult.data;
+        }
+        this.log(context, 'info', nodeId, `Tool ${toolName} completed successfully`);
+        return result;
+    }
+}
+//# sourceMappingURL=ToolNodeExecutor.js.map

package/dist/core/workflow/executors/ToolNodeExecutor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ToolNodeExecutor.js","sourceRoot":"","sources":["../../../../src/core/workflow/executors/ToolNodeExecutor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAQzD,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CAAC;AACpH,CAAC;AAMD,SAAS,mBAAmB,CAAC,QAA8B;IACzD,OAAO,OAAQ,QAAkC,CAAC,OAAO,KAAK,UAAU,CAAC;AAC3E,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,gBAAgB;IAGhC;IAFZ,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAElD,YAAoB,YAAkC;QACpD,KAAK,EAAE,CAAC;QADU,iBAAY,GAAZ,YAAY,CAAsB;IAEtD,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAAoB,EACpB,KAA8B,EAC9B,OAAyB;QAEzB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAExB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAEtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,mBAAmB,QAAQ,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,cAAc;YACd,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,QAAQ,IAAI,EAAE,EAAE,kBAAkB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACrH,MAAM,IAAI,GAAG,EAAE,GAAG,gBAAgB,EAAE,GAAG,KAAK,EAAE,CAAC;YAE/C,UAAU;YACV,MAAM,WAAW,GAAgB;gBAC/B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAW,IAAI,OAAO,CAAC,GAAG,EAAE;gBACxE,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,YAAY,OAAO,CAAC,UAAU,EAAE;gBACzC,MAAM,EAAE,OAAO,CAAC,WAAW;gBAC3B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,eAAe,EAAE,OAAO,CAAC,eAAe;aACzC,CAAC;YAEF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAE1E,IAAI,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;gBAC5E,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACnE,CAAC;YAED,mEAAmE;YACnE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,UAAU,GAAG,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1F,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,YAAY,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAA2C,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3O,CAAC;YACD,MAAM,cAAc,GAAG,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAEnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CACN,OAAO,EACP,OAAO,EACP,IAAI,CAAC,EAAE,EACP,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,gBAAgB,CACtB,QAAgB,EAChB,MAAc,EACd,MAA4B,EAC5B,OAAyB;QAEzB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACzE,MAAM,UAAU,GAAG,MAA8D,CAAC;YAClF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,QAAQ,yBAAyB,CAAC,CAAC;YAC7E,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,QAAQ,yBAAyB,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/core/workflow/expressionEvaluator.d.ts

@@ -0,0 +1,27 @@
+/**
+ * expressionEvaluator - 共享的表达式求值函数
+ *
+ * 求值委托给 {@link ./safeExpressionEvaluator.ts} 的 AST 白名单解释器：
+ * 表达式先经 acorn 解析为 AST，再在封闭节点白名单内递归求值。
+ *
+ * 安全模型（确定性、结构化）：
+ *   - 仅允许的字面量 / 标识符 / 成员访问 / 调用 / 运算 / 条件等节点。
+ *   - 标识符只能解析注入的 scope 名 + 白名单全局（Math/Date/JSON/Array...）；
+ *     未注入的标识符（process / require / globalThis / fetch ...）一律不可解析。
+ *   - 成员访问封堵 `constructor` / `__proto__` / `prototype`，从构造上断绝
+ *     `{}.constructor.constructor('return process')()` 这条逃逸链。
+ *   - 全程不调用 `eval` / `new Function`，不接触 `globalThis`。
+ *
+ * 这是 workflow 表达式的硬安全边界，由 workflow sandbox gate 统一收口。
+ * 调用方仍应在可信 workflow 来源下使用——白名单封堵逃逸，但不限制合法表达式的能力。
+ */
+/**
+ * 在 AST 白名单沙箱内求值表达式，返回 Boolean 化结果。
+ *
+ * @param expression - 待求值的 JS 表达式字符串
+ * @param scope - 注入的变量作用域（key → 值；仅这些名字可被标识符访问，外加白名单全局）
+ * @returns 表达式求值结果（Boolean 化）
+ * @throws 表达式含不允许的节点/属性/逃逸企图时抛错
+ */
+export declare function evaluateExpression(expression: string, scope: Record<string, unknown>): boolean;
+//# sourceMappingURL=expressionEvaluator.d.ts.map

package/dist/core/workflow/expressionEvaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expressionEvaluator.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/expressionEvaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAQ9F"}

package/dist/core/workflow/expressionEvaluator.js

@@ -0,0 +1,35 @@
+/**
+ * expressionEvaluator - 共享的表达式求值函数
+ *
+ * 求值委托给 {@link ./safeExpressionEvaluator.ts} 的 AST 白名单解释器：
+ * 表达式先经 acorn 解析为 AST，再在封闭节点白名单内递归求值。
+ *
+ * 安全模型（确定性、结构化）：
+ *   - 仅允许的字面量 / 标识符 / 成员访问 / 调用 / 运算 / 条件等节点。
+ *   - 标识符只能解析注入的 scope 名 + 白名单全局（Math/Date/JSON/Array...）；
+ *     未注入的标识符（process / require / globalThis / fetch ...）一律不可解析。
+ *   - 成员访问封堵 `constructor` / `__proto__` / `prototype`，从构造上断绝
+ *     `{}.constructor.constructor('return process')()` 这条逃逸链。
+ *   - 全程不调用 `eval` / `new Function`，不接触 `globalThis`。
+ *
+ * 这是 workflow 表达式的硬安全边界，由 workflow sandbox gate 统一收口。
+ * 调用方仍应在可信 workflow 来源下使用——白名单封堵逃逸，但不限制合法表达式的能力。
+ */
+import { evaluateSafeExpression } from './safeExpressionEvaluator.js';
+/**
+ * 在 AST 白名单沙箱内求值表达式，返回 Boolean 化结果。
+ *
+ * @param expression - 待求值的 JS 表达式字符串
+ * @param scope - 注入的变量作用域（key → 值；仅这些名字可被标识符访问，外加白名单全局）
+ * @returns 表达式求值结果（Boolean 化）
+ * @throws 表达式含不允许的节点/属性/逃逸企图时抛错
+ */
+export function evaluateExpression(expression, scope) {
+    try {
+        return evaluateSafeExpression(expression, scope);
+    }
+    catch (error) {
+        throw new Error(`Expression evaluation failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+//# sourceMappingURL=expressionEvaluator.js.map

package/dist/core/workflow/expressionEvaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expressionEvaluator.js","sourceRoot":"","sources":["../../../src/core/workflow/expressionEvaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,KAA8B;IACnF,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/workflow/safeExpressionEvaluator.d.ts

@@ -0,0 +1,28 @@
+/**
+ * 安全表达式求值器（AST 白名单解释器，构造上不可逃逸）。
+ *
+ * 替换历史上的 `new Function` 裸 eval（见原 expressionEvaluator.ts 的 RCE 注释）。
+ * 原方案在主进程直接执行任意 JS，scope 只是命名参数、非真正沙箱——表达式可经
+ * `constructor` / `globalThis` / `eval` 逃逸，读取 env / 访问 FS / 发起网络 / 执行 shell。
+ *
+ * 本实现用 acorn 把表达式解析为 AST，然后只在一个**封闭的节点白名单**里递归求值：
+ *   - 允许的节点：字面量 / 标识符（仅注入的 scope 名 + 白名单全局）/ 成员访问 /
+ *     调用 / 一元·二元·逻辑·条件·数组·对象·展开·模板·序列表达式 等。
+ *   - 求值环境是一个冻结的 scope Map：成员访问只在普通对象/数组/白名单全局函数上发生，
+ *     且对 `constructor` / `prototype` / `__proto__` 属性一律封堵——从构造上断绝
+ *     `{}.constructor.constructor('return process')()` 这条逃逸链。
+ *   - 不调用 `eval`、不调用 `new Function`、不接触 `globalThis`；宿主进程里任何
+ *     未通过 scope 显式注入的东西（process / require / fetch / fs…）表达式都拿不到。
+ *
+ * 这是确定性、结构化的安全边界：判定基于 AST 节点类型与属性名，不依赖任何启发式。
+ */
+/**
+ * 在封闭的 AST 白名单内求值表达式，返回 Boolean 化结果。
+ *
+ * @param expression 待求值的 JS 表达式字符串（不可含语句）。
+ * @param scope 注入的变量作用域：key → 值。仅这些名字可被标识符访问，外加白名单全局。
+ * @returns 表达式求值结果的 Boolean 化。
+ * @throws 任何不被允许的节点/属性/逃逸企图都会抛 SafeExpressionError（message 可读）。
+ */
+export declare function evaluateSafeExpression(expression: string, scope: Record<string, unknown>): boolean;
+//# sourceMappingURL=safeExpressionEvaluator.d.ts.map

package/dist/core/workflow/safeExpressionEvaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeExpressionEvaluator.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/safeExpressionEvaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA0RH;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAoBlG"}

package/dist/core/workflow/safeExpressionEvaluator.js

@@ -0,0 +1,298 @@
+/**
+ * 安全表达式求值器（AST 白名单解释器，构造上不可逃逸）。
+ *
+ * 替换历史上的 `new Function` 裸 eval（见原 expressionEvaluator.ts 的 RCE 注释）。
+ * 原方案在主进程直接执行任意 JS，scope 只是命名参数、非真正沙箱——表达式可经
+ * `constructor` / `globalThis` / `eval` 逃逸，读取 env / 访问 FS / 发起网络 / 执行 shell。
+ *
+ * 本实现用 acorn 把表达式解析为 AST，然后只在一个**封闭的节点白名单**里递归求值：
+ *   - 允许的节点：字面量 / 标识符（仅注入的 scope 名 + 白名单全局）/ 成员访问 /
+ *     调用 / 一元·二元·逻辑·条件·数组·对象·展开·模板·序列表达式 等。
+ *   - 求值环境是一个冻结的 scope Map：成员访问只在普通对象/数组/白名单全局函数上发生，
+ *     且对 `constructor` / `prototype` / `__proto__` 属性一律封堵——从构造上断绝
+ *     `{}.constructor.constructor('return process')()` 这条逃逸链。
+ *   - 不调用 `eval`、不调用 `new Function`、不接触 `globalThis`；宿主进程里任何
+ *     未通过 scope 显式注入的东西（process / require / fetch / fs…）表达式都拿不到。
+ *
+ * 这是确定性、结构化的安全边界：判定基于 AST 节点类型与属性名，不依赖任何启发式。
+ */
+import { parseExpressionAt } from 'acorn';
+/** 标识符求值时允许的全局函数（仅这些名字会落到对应的宿主实现）。 */
+const ALLOWED_GLOBALS = new Map([
+    ['Math', Math],
+    ['Date', Date],
+    ['JSON', JSON],
+    ['String', String],
+    ['Number', Number],
+    ['Boolean', Boolean],
+    ['Array', Array],
+    ['Object', Object],
+    // 显式不放 process / global / globalThis / require / eval / fetch / Buffer / Function 等。
+]);
+/** 成员访问封堵名单：任何通向对象元结构（构造器/原型链）的属性都视为逃逸企图。 */
+const BLOCKED_MEMBER_NAMES = new Set([
+    'constructor',
+    '__proto__',
+    'prototype',
+]);
+/** acorn 解析所需的来源标记（仅用于错误信息，不参与求值）。 */
+const SOURCE_ORIGIN = 'workflow-expression';
+class SafeExpressionError extends Error {
+}
+function evaluateNode(node, scope) {
+    if (!node || typeof node !== 'object') {
+        throw new SafeExpressionError('invalid AST node');
+    }
+    const n = node;
+    switch (n.type) {
+        case 'Literal':
+            return n.value;
+        case 'Identifier': {
+            const name = n.name;
+            if (scope.has(name))
+                return scope.get(name);
+            if (ALLOWED_GLOBALS.has(name))
+                return ALLOWED_GLOBALS.get(name);
+            // 未注入、非白名单全局的标识符一律不可解析——杜绝访问 process/require 等。
+            throw new SafeExpressionError(`identifier not allowed: ${name}`);
+        }
+        case 'MemberExpression': {
+            const property = n.computed
+                ? evaluateNode(n.property, scope)
+                : n.property?.name;
+            if (typeof property === 'string' && BLOCKED_MEMBER_NAMES.has(property)) {
+                throw new SafeExpressionError(`property access forbidden: ${property}`);
+            }
+            const object = evaluateNode(n.object, scope);
+            return readMember(object, property);
+        }
+        case 'CallExpression': {
+            const args = n.arguments.map((arg) => evaluateNode(arg, scope));
+            // 直接 callee：Math.max(...) / allowed(scope.fn)(...)
+            const callee = evaluateNode(n.callee, scope);
+            if (typeof callee !== 'function') {
+                throw new SafeExpressionError('call target is not a function');
+            }
+            return callAllowed(callee, args);
+        }
+        case 'NewExpression': {
+            const args = n.arguments.map((arg) => evaluateNode(arg, scope));
+            const callee = evaluateNode(n.callee, scope);
+            if (typeof callee !== 'function') {
+                throw new SafeExpressionError('new target is not a function');
+            }
+            return newAllowed(callee, args);
+        }
+        case 'UnaryExpression': {
+            const value = evaluateNode(n.argument, scope);
+            switch (n.operator) {
+                case '!': return !value;
+                case '-': return -value;
+                case '+': return +value;
+                case '~': return ~value;
+                case 'typeof': return typeof value;
+                case 'void': return undefined;
+                default: throw new SafeExpressionError(`unary operator not allowed: ${String(n.operator)}`);
+            }
+        }
+        case 'BinaryExpression': {
+            const left = evaluateNode(n.left, scope);
+            const right = evaluateNode(n.right, scope);
+            return applyBinary(String(n.operator), left, right);
+        }
+        case 'LogicalExpression': {
+            const left = evaluateNode(n.left, scope);
+            switch (n.operator) {
+                case '&&': return left ? evaluateNode(n.right, scope) : left;
+                case '||': return left ? left : evaluateNode(n.right, scope);
+                case '??': return (left === null || left === undefined) ? evaluateNode(n.right, scope) : left;
+                default: throw new SafeExpressionError(`logical operator not allowed: ${String(n.operator)}`);
+            }
+        }
+        case 'ConditionalExpression': {
+            const test = evaluateNode(n.test, scope);
+            return test ? evaluateNode(n.consequent, scope) : evaluateNode(n.alternate, scope);
+        }
+        case 'ArrayExpression':
+            return n.elements.map((el) => el === null ? undefined : evaluateNode(el, scope));
+        case 'ObjectExpression': {
+            const obj = {};
+            for (const prop of n.properties) {
+                if (prop.type === 'SpreadElement') {
+                    throw new SafeExpressionError('spread in object literal not allowed');
+                }
+                const keyNode = prop.computed ? prop.key : prop.key;
+                const key = prop.computed
+                    ? String(evaluateNode(keyNode, scope))
+                    : keyNode?.name;
+                if (typeof key !== 'string') {
+                    throw new SafeExpressionError('object literal key must be a name');
+                }
+                if (BLOCKED_MEMBER_NAMES.has(key)) {
+                    throw new SafeExpressionError(`object key forbidden: ${key}`);
+                }
+                obj[key] = evaluateNode(prop.value, scope);
+            }
+            return obj;
+        }
+        case 'SpreadElement':
+            // 仅数组调用参数里的展开，在外层被 CallExpression 单独处理；落到这里是独立展开，不支持。
+            throw new SafeExpressionError('standalone spread not allowed');
+        case 'TemplateLiteral': {
+            const parts = [];
+            const quasis = n.quasis;
+            const expressions = n.expressions;
+            for (let i = 0; i < quasis.length; i++) {
+                parts.push(quasis[i].value.cooked);
+                if (i < expressions.length) {
+                    parts.push(String(evaluateNode(expressions[i], scope)));
+                }
+            }
+            return parts.join('');
+        }
+        case 'SequenceExpression': {
+            const expressions = n.expressions;
+            let last;
+            for (const expr of expressions)
+                last = evaluateNode(expr, scope);
+            return last;
+        }
+        case 'ChainExpression':
+            // optional chaining：递归到内部表达式，忽略 optional 语义差异。
+            return evaluateNode(n.expression, scope);
+        default:
+            throw new SafeExpressionError(`expression node not allowed: ${n.type}`);
+    }
+}
+function readMember(object, property) {
+    if (object === null || object === undefined) {
+        throw new SafeExpressionError(`cannot read property '${String(property)}' of ${String(object)}`);
+    }
+    // 允许在普通对象/数组/字符串/数字/布尔/白名单全局函数上读属性。
+    // 函数（Math.max / JSON.parse / String.fromCharCode 等）也允许，但 constructor/
+    // __proto__/prototype 已由 BLOCKED 命中封堵——通向 Function 构造器的逃逸链被断。
+    const allowed = typeof object === 'object' ||
+        typeof object === 'function' ||
+        typeof object === 'string' ||
+        typeof object === 'number' ||
+        typeof object === 'boolean';
+    if (!allowed) {
+        throw new SafeExpressionError(`member access not allowed on ${typeof object}`);
+    }
+    if (typeof property === 'string' && BLOCKED_MEMBER_NAMES.has(property)) {
+        throw new SafeExpressionError(`property access forbidden: ${property}`);
+    }
+    if (Array.isArray(object)) {
+        if (typeof property === 'number' || (typeof property === 'string' && /^\d+$/.test(property))) {
+            return object[Number(property)];
+        }
+        // 数组方法：length / includes / indexOf / join / slice / map 等——白名单收窄。
+        if (property === 'length')
+            return object.length;
+        return readArrayMethod(object, property);
+    }
+    if (typeof object === 'string') {
+        return readStringMember(object, property);
+    }
+    // 普通对象 / 白名单全局对象（Math/JSON/Date...）：按属性名直读，但封堵被 BLOCKED 命中。
+    return object[property];
+}
+const ARRAY_METHODS = new Set([
+    'includes', 'indexOf', 'join', 'slice', 'concat', 'map', 'filter', 'find',
+    'some', 'every', 'length',
+]);
+function readArrayMethod(array, property) {
+    const name = property;
+    if (typeof name !== 'string' || !ARRAY_METHODS.has(name)) {
+        throw new SafeExpressionError(`array member not allowed: ${String(property)}`);
+    }
+    const fn = array[name];
+    return typeof fn === 'function'
+        ? (...args) => fn.apply(array, args)
+        : fn;
+}
+const STRING_MEMBERS = new Set([
+    'length', 'toUpperCase', 'toLowerCase', 'trim', 'includes', 'startsWith',
+    'endsWith', 'indexOf', 'slice', 'substring', 'split', 'charAt', 'charCodeAt',
+]);
+function readStringMember(str, property) {
+    const name = property;
+    if (typeof name !== 'number' && (typeof name !== 'string' || !STRING_MEMBERS.has(name))) {
+        throw new SafeExpressionError(`string member not allowed: ${String(property)}`);
+    }
+    const value = str[name];
+    return typeof value === 'function'
+        ? (...args) => value.apply(str, args)
+        : value;
+}
+function applyBinary(operator, left, right) {
+    switch (operator) {
+        case '==': return left == right; // eslint-disable-line eqeqeq
+        case '!=': return left != right; // eslint-disable-line eqeqeq
+        case '===': return left === right;
+        case '!==': return left !== right;
+        case '<': return left < right;
+        case '<=': return left <= right;
+        case '>': return left > right;
+        case '>=': return left >= right;
+        case '+': return left + right;
+        case '-': return left - right;
+        case '*': return left * right;
+        case '/': return left / right;
+        case '%': return left % right;
+        case '**': return left ** right;
+        case '&': return left & right;
+        case '|': return left | right;
+        case '^': return left ^ right;
+        case '<<': return left << right;
+        case '>>': return left >> right;
+        case '>>>': return left >>> right;
+        case 'in': return String(left) in right;
+        case 'instanceof': return left instanceof right;
+        default: throw new SafeExpressionError(`binary operator not allowed: ${operator}`);
+    }
+}
+/**
+ * 调用从 scope/全局拿到的函数。仅允许普通函数与绑定函数，封堵 Function 构造器相关。
+ * （ALLOWED_GLOBALS 里本就没有 Function，这里只是多一道断言。）
+ */
+function callAllowed(callee, args) {
+    if (typeof callee !== 'function') {
+        throw new SafeExpressionError('call target is not a function');
+    }
+    return callee(...args);
+}
+function newAllowed(callee, args) {
+    if (typeof callee !== 'function') {
+        throw new SafeExpressionError('new target is not a function');
+    }
+    return new callee(...args);
+}
+/**
+ * 在封闭的 AST 白名单内求值表达式，返回 Boolean 化结果。
+ *
+ * @param expression 待求值的 JS 表达式字符串（不可含语句）。
+ * @param scope 注入的变量作用域：key → 值。仅这些名字可被标识符访问，外加白名单全局。
+ * @returns 表达式求值结果的 Boolean 化。
+ * @throws 任何不被允许的节点/属性/逃逸企图都会抛 SafeExpressionError（message 可读）。
+ */
+export function evaluateSafeExpression(expression, scope) {
+    if (typeof expression !== 'string' || expression.trim().length === 0) {
+        throw new SafeExpressionError('expression must be a non-empty string');
+    }
+    let ast;
+    try {
+        ast = parseExpressionAt(expression, 0, {
+            ecmaVersion: 'latest',
+            sourceType: 'script',
+            sourceFile: SOURCE_ORIGIN,
+        });
+    }
+    catch (error) {
+        throw new SafeExpressionError(`expression parse failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const scopeMap = new Map(Object.entries(scope ?? {}));
+    const result = evaluateNode(ast, scopeMap);
+    return Boolean(result);
+}
+//# sourceMappingURL=safeExpressionEvaluator.js.map

package/dist/core/workflow/safeExpressionEvaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeExpressionEvaluator.js","sourceRoot":"","sources":["../../../src/core/workflow/safeExpressionEvaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAE1C,sCAAsC;AACtC,MAAM,eAAe,GAAiC,IAAI,GAAG,CAAkB;IAC7E,CAAC,MAAM,EAAE,IAAI,CAAC;IACd,CAAC,MAAM,EAAE,IAAI,CAAC;IACd,CAAC,MAAM,EAAE,IAAI,CAAC;IACd,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,SAAS,EAAE,OAAO,CAAC;IACpB,CAAC,OAAO,EAAE,KAAK,CAAC;IAChB,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,qFAAqF;CACtF,CAAC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IACxD,aAAa;IACb,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,sCAAsC;AACtC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAE5C,MAAM,mBAAoB,SAAQ,KAAK;CAAG;AAE1C,SAAS,YAAY,CAAC,IAAa,EAAE,KAAmC;IACtE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,CAAC,GAAG,IAAgD,CAAC;IAE3D,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,KAAK,CAAC;QAEjB,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAc,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChE,gDAAgD;YAChD,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ;gBACzB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC;gBACjC,CAAC,CAAE,CAAC,CAAC,QAA8B,EAAE,IAAI,CAAC;YAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,IAAI,GAAI,CAAC,CAAC,SAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/E,mDAAmD;YACnD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,IAAI,GAAI,CAAC,CAAC,SAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9C,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACnB,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;gBACxB,KAAK,GAAG,CAAC,CAAC,OAAO,CAAE,KAAgB,CAAC;gBACpC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAE,KAAgB,CAAC;gBACpC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAE,KAAgB,CAAC;gBACpC,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,CAAC;gBACnC,KAAK,MAAM,CAAC,CAAC,OAAO,SAAS,CAAC;gBAC9B,OAAO,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3C,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACnB,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7D,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC7D,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9F,OAAO,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;QAED,KAAK,uBAAuB,CAAC,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACrF,CAAC;QAED,KAAK,iBAAiB;YACpB,OAAQ,CAAC,CAAC,QAA2B,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAC/C,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAClD,CAAC;QAEJ,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,KAAK,MAAM,IAAI,IAAK,CAAC,CAAC,UAA6C,EAAE,CAAC;gBACpE,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBAClC,MAAM,IAAI,mBAAmB,CAAC,sCAAsC,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,GAAyB,CAAC;gBAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ;oBACvB,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBACtC,CAAC,CAAE,OAA6B,EAAE,IAAI,CAAC;gBACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC5B,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;gBACrE,CAAC;gBACD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;gBAChE,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,eAAe;YAClB,sDAAsD;YACtD,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;QAEjE,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAI,CAAC,CAAC,MAA+C,CAAC;YAClE,MAAM,WAAW,GAAI,CAAC,CAAC,WAAyB,CAAC;YACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACnC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;oBAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;QAED,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,WAAW,GAAI,CAAC,CAAC,WAAyB,CAAC;YACjD,IAAI,IAAa,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,WAAW;gBAAE,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,iBAAiB;YACpB,+CAA+C;YAC/C,OAAO,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAE3C;YACE,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAe,EAAE,QAAiB;IACpD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,CAAC,QAAQ,CAAC,QAAQ,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,oCAAoC;IACpC,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,MAAM,KAAK,UAAU;QAC5B,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,MAAM,KAAK,SAAS,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,OAAO,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC7F,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,kEAAkE;QAClE,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAChD,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,4DAA4D;IAC5D,OAAQ,MAAkC,CAAC,QAAkB,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IACjD,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;IACzE,MAAM,EAAE,OAAO,EAAE,QAAQ;CAC1B,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,KAAgB,EAAE,QAAiB;IAC1D,MAAM,IAAI,GAAG,QAAkB,CAAC;IAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,EAAE,GAAI,KAA4C,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,OAAO,EAAE,KAAK,UAAU;QAC7B,CAAC,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE,CAAE,EAAmC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC;QACjF,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY;IACxE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY;CAC7E,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,GAAW,EAAE,QAAiB;IACtD,MAAM,IAAI,GAAG,QAAkB,CAAC;IAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,KAAK,GAAI,GAA0C,CAAC,IAAc,CAAC,CAAC;IAC1E,OAAO,OAAO,KAAK,KAAK,UAAU;QAChC,CAAC,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE,CAAE,KAAsC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;QAClF,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAa,EAAE,KAAc;IAClE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC,CAAC,6BAA6B;QAC9D,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC,CAAC,6BAA6B;QAC9D,KAAK,KAAK,CAAC,CAAC,OAAO,IAAI,KAAK,KAAK,CAAC;QAClC,KAAK,KAAK,CAAC,CAAC,OAAO,IAAI,KAAK,KAAK,CAAC;QAClC,KAAK,GAAG,CAAC,CAAC,OAAQ,IAAe,GAAI,KAAgB,CAAC;QACtD,KAAK,IAAI,CAAC,CAAC,OAAQ,IAAe,IAAK,KAAgB,CAAC;QACxD,KAAK,GAAG,CAAC,CAAC,OAAQ,IAAe,GAAI,KAAgB,CAAC;QACtD,KAAK,IAAI,CAAC,CAAC,OAAQ,IAAe,IAAK,KAAgB,CAAC;QACxD,KAAK,GAAG,CAAC,CAAC,OAAQ,IAAe,GAAI,KAAgB,CAAC;QACtD,KAAK,GAAG,CAAC,CAAC,OAAQ,IAAe,GAAI,KAAgB,CAAC;QACtD,KAAK,GAAG,CAAC,CAAC,OAAQ,IAAe,GAAI,KAAgB,CAAC;QACtD,KAAK,GAAG,CAAC,CAAC,OAAQ,IAAe,GAAI,KAAgB,CAAC;QACtD,KAAK,GAAG,CAAC,CAAC,OAAQ,IAAe,GAAI,KAAgB,CAAC;QACtD,KAAK,IAAI,CAAC,CAAC,OAAQ,IAAe,IAAK,KAAgB,CAAC;QACxD,KAAK,GAAG,CAAC,CAAC,OAAQ,IAAe,GAAI,KAAgB,CAAC;QACtD,KAAK,GAAG,CAAC,CAAC,OAAQ,IAAe,GAAI,KAAgB,CAAC;QACtD,KAAK,GAAG,CAAC,CAAC,OAAQ,IAAe,GAAI,KAAgB,CAAC;QACtD,KAAK,IAAI,CAAC,CAAC,OAAQ,IAAe,IAAK,KAAgB,CAAC;QACxD,KAAK,IAAI,CAAC,CAAC,OAAQ,IAAe,IAAK,KAAgB,CAAC;QACxD,KAAK,KAAK,CAAC,CAAC,OAAQ,IAAe,KAAM,KAAgB,CAAC;QAC1D,KAAK,IAAI,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAK,KAAgB,CAAC;QACpD,KAAK,YAAY,CAAC,CAAC,OAAQ,IAAe,YAAa,KAAkB,CAAC;QAC1E,OAAO,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,MAAe,EAAE,IAAe;IACnD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;IACjE,CAAC;IACD,OAAQ,MAAuC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,MAAe,EAAE,IAAe;IAClD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAK,MAA2C,CAAC,GAAG,IAAI,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,KAA8B;IACvF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,mBAAmB,CAAC,uCAAuC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,CAAC,EAAE;YACrC,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAkB,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC"}