@mondaydotcomorg/atp-compiler 0.19.4 → 0.19.5

package/dist/provenance/src/policies/engine.js

@@ -1,433 +0,0 @@
-import { ProvenanceSecurityError, ProvenanceSource } from '../types.js';
-import { getProvenance, getAllProvenance, canRead, } from '../registry.js';
-export class SecurityPolicyEngine {
-    policies;
-    logger;
-    approvalCallback;
-    customGetProvenance;
-    constructor(policies, logger, customGetProvenance) {
-        this.policies = policies;
-        this.logger = logger;
-        this.customGetProvenance = customGetProvenance;
-    }
-    /**
-     * Set a custom getProvenance function (e.g., for AST mode)
-     */
-    setGetProvenance(fn) {
-        this.customGetProvenance = fn;
-    }
-    /**
-     * Set approval callback for policies that return action='approve'
-     */
-    setApprovalCallback(callback) {
-        this.approvalCallback = callback;
-    }
-    async checkTool(toolName, apiGroup, args) {
-        this.logger.debug('Checking security policies', {
-            toolName,
-            apiGroup,
-            policyCount: this.policies.length,
-        });
-        // Use custom getProvenance if available, otherwise use default
-        const getProvenanceFn = this.customGetProvenance || getProvenance;
-        for (const policy of this.policies) {
-            const result = await policy.check(toolName, args, getProvenanceFn);
-            const action = this.normalizeAction(result);
-            if (action === 'block') {
-                this.logger.warn('Security policy blocked tool execution', {
-                    toolName,
-                    apiGroup,
-                    policy: policy.name,
-                    reason: result.reason,
-                });
-                throw new ProvenanceSecurityError(result.reason || `Policy ${policy.name} denied execution`, policy.name, toolName, { apiGroup, args: this.sanitizeArgs(args), context: result.context });
-            }
-            if (action === 'approve') {
-                this.logger.info('Security policy requires approval', {
-                    toolName,
-                    apiGroup,
-                    policy: policy.name,
-                    reason: result.reason,
-                });
-                const approved = await this.requestApproval(toolName, apiGroup, policy.name, result);
-                if (!approved) {
-                    this.logger.warn('Security policy approval denied', {
-                        toolName,
-                        apiGroup,
-                        policy: policy.name,
-                    });
-                    throw new ProvenanceSecurityError(`Approval denied: ${result.reason || 'Operation requires approval'}`, policy.name, toolName, { apiGroup, args: this.sanitizeArgs(args), approvalDenied: true });
-                }
-                this.logger.info('Security policy approval granted', {
-                    toolName,
-                    apiGroup,
-                    policy: policy.name,
-                });
-            }
-            if (action === 'log') {
-                this.logger.warn('Security policy audit event', {
-                    toolName,
-                    apiGroup,
-                    policy: policy.name,
-                    reason: result.reason,
-                    context: result.context,
-                    args: this.sanitizeArgs(args),
-                });
-            }
-        }
-        this.logger.debug('All security policies passed', { toolName, apiGroup });
-    }
-    normalizeAction(result) {
-        if (result.action) {
-            return result.action;
-        }
-        if (result.allowed !== undefined) {
-            return result.allowed ? 'log' : 'block';
-        }
-        return 'log';
-    }
-    async requestApproval(toolName, apiGroup, policyName, result) {
-        if (!this.approvalCallback) {
-            this.logger.error('Approval required but no callback configured', {
-                toolName,
-                policy: policyName,
-            });
-            throw new ProvenanceSecurityError('Approval required but approval handler not configured', policyName, toolName, { requiresApproval: true });
-        }
-        const message = result.reason || `Policy ${policyName} requires approval for ${toolName}`;
-        const context = {
-            toolName,
-            apiGroup,
-            policy: policyName,
-            ...(result.context || {}),
-        };
-        try {
-            return await this.approvalCallback(message, context);
-        }
-        catch (error) {
-            this.logger.error('Approval request failed', { error, toolName, policy: policyName });
-            return false;
-        }
-    }
-    sanitizeArgs(args) {
-        const sanitized = {};
-        for (const [key, value] of Object.entries(args)) {
-            if (typeof value === 'string' && value.length > 100) {
-                sanitized[key] = value.substring(0, 100) + '...';
-            }
-            else if (typeof value === 'object') {
-                sanitized[key] = '[object]';
-            }
-            else {
-                sanitized[key] = value;
-            }
-        }
-        return sanitized;
-    }
-}
-/**
- * Built-in Security Policies
- */
-/**
- * Helper: Get all provenance from args object, including scanning all nested values
- * This catches primitives that came from tool-originated objects
- */
-function getAllProvenanceFromArgs(args, getProvenance) {
-    const allProvenance = [];
-    const visited = new Set();
-    function scan(value) {
-        if (value === null || value === undefined)
-            return;
-        if (typeof value === 'string' || typeof value === 'number') {
-            try {
-                const primitiveProv = getProvenance(value);
-                if (primitiveProv) {
-                    allProvenance.push(primitiveProv);
-                }
-            }
-            catch (error) {
-                // Ignore errors during provenance lookup
-            }
-            return;
-        }
-        if (typeof value !== 'object')
-            return;
-        if (visited.has(value))
-            return;
-        visited.add(value);
-        const provenance = getProvenance(value);
-        if (provenance) {
-            allProvenance.push(provenance);
-        }
-        if (Array.isArray(value)) {
-            for (const item of value) {
-                scan(item);
-            }
-        }
-        else {
-            for (const key in value) {
-                if (Object.prototype.hasOwnProperty.call(value, key)) {
-                    scan(value[key]);
-                }
-            }
-        }
-    }
-    for (const key in args) {
-        if (Object.prototype.hasOwnProperty.call(args, key)) {
-            scan(args[key]);
-        }
-    }
-    return allProvenance;
-}
-/**
- * Prevent data exfiltration - blocks sending private data to unauthorized recipients
- */
-export const preventDataExfiltration = {
-    name: 'prevent-data-exfiltration',
-    description: 'Prevents sending data to recipients who cannot read it',
-    check: (toolName, args, getProvenance) => {
-        const recipientKeys = ['to', 'recipient', 'recipients', 'email', 'address'];
-        const dataKeys = ['body', 'message', 'content', 'data', 'payload'];
-        let recipient = null;
-        for (const key of recipientKeys) {
-            if (args[key] && typeof args[key] === 'string') {
-                recipient = args[key];
-                break;
-            }
-        }
-        if (!recipient) {
-            return { action: 'log' };
-        }
-        const allProvenance = getAllProvenanceFromArgs(args, getProvenance);
-        for (const metadata of allProvenance) {
-            if (metadata.source.type === ProvenanceSource.TOOL) {
-                if (metadata.readers.type === 'restricted') {
-                    if (!canRead(recipient, metadata.readers)) {
-                        return {
-                            action: 'block',
-                            reason: `Recipient "${recipient}" cannot read data from ${metadata.source.toolName}. Authorized readers: ${metadata.readers.readers.join(', ')}`,
-                            policy: 'prevent-data-exfiltration',
-                            context: {
-                                recipient,
-                                toolSource: metadata.source.toolName,
-                                authorizedReaders: metadata.readers.readers,
-                            },
-                        };
-                    }
-                }
-            }
-        }
-        return { action: 'log' };
-    },
-};
-/**
- * Prevent data exfiltration (approval mode) - requires approval for risky sends
- */
-export const preventDataExfiltrationWithApproval = {
-    name: 'prevent-data-exfiltration-approval',
-    description: 'Requires approval for sending data to recipients who cannot read it',
-    check: (toolName, args, getProvenance) => {
-        const recipientKeys = ['to', 'recipient', 'recipients', 'email', 'address'];
-        let recipient = null;
-        for (const key of recipientKeys) {
-            if (args[key] && typeof args[key] === 'string') {
-                recipient = args[key];
-                break;
-            }
-        }
-        if (!recipient) {
-            return { action: 'log' };
-        }
-        const allProvenance = getAllProvenanceFromArgs(args, getProvenance);
-        for (const metadata of allProvenance) {
-            if (metadata.source.type === ProvenanceSource.TOOL) {
-                if (metadata.readers.type === 'restricted') {
-                    if (!canRead(recipient, metadata.readers)) {
-                        return {
-                            action: 'approve',
-                            reason: `Sending data from ${metadata.source.toolName} to "${recipient}" (not in authorized readers)`,
-                            policy: 'prevent-data-exfiltration-approval',
-                            context: {
-                                recipient,
-                                toolSource: metadata.source.toolName,
-                                authorizedReaders: metadata.readers.readers,
-                                sensitiveFields: Object.keys(args).filter((k) => args[k] !== null),
-                            },
-                        };
-                    }
-                }
-            }
-        }
-        return { action: 'log' };
-    },
-};
-/**
- * Require user origin - ensures sensitive operations only use user-provided data
- */
-export const requireUserOrigin = {
-    name: 'require-user-origin',
-    description: 'Requires critical parameters to come directly from user input',
-    check: (toolName, args, getProvenance) => {
-        const criticalTools = ['deleteDatabase', 'dropTable', 'executeSQL', 'sendMoney', 'transfer'];
-        if (!criticalTools.some((t) => toolName.toLowerCase().includes(t.toLowerCase()))) {
-            return { action: 'log' };
-        }
-        for (const [key, value] of Object.entries(args)) {
-            const allProvenance = getAllProvenance(value);
-            for (const metadata of allProvenance) {
-                if (metadata.source.type !== ProvenanceSource.USER &&
-                    metadata.source.type !== ProvenanceSource.SYSTEM) {
-                    return {
-                        action: 'block',
-                        reason: `Critical tool "${toolName}" parameter "${key}" must come from user input, but came from ${metadata.source.type}`,
-                        policy: 'require-user-origin',
-                        context: {
-                            toolName,
-                            parameterKey: key,
-                            actualSource: metadata.source.type,
-                        },
-                    };
-                }
-            }
-        }
-        return { action: 'log' };
-    },
-};
-/**
- * Require user origin (approval mode) - requires approval for non-user-originated critical operations
- */
-export const requireUserOriginWithApproval = {
-    name: 'require-user-origin-approval',
-    description: 'Requires approval for critical operations with non-user data',
-    check: (toolName, args, getProvenance) => {
-        const criticalTools = ['deleteDatabase', 'dropTable', 'executeSQL', 'sendMoney', 'transfer'];
-        if (!criticalTools.some((t) => toolName.toLowerCase().includes(t.toLowerCase()))) {
-            return { action: 'log' };
-        }
-        for (const [key, value] of Object.entries(args)) {
-            const allProvenance = getAllProvenance(value);
-            for (const metadata of allProvenance) {
-                if (metadata.source.type !== ProvenanceSource.USER &&
-                    metadata.source.type !== ProvenanceSource.SYSTEM) {
-                    return {
-                        action: 'approve',
-                        reason: `Critical operation "${toolName}" with parameter "${key}" from ${metadata.source.type} source`,
-                        policy: 'require-user-origin-approval',
-                        context: {
-                            toolName,
-                            parameterKey: key,
-                            actualSource: metadata.source.type,
-                            value: String(value).substring(0, 100),
-                        },
-                    };
-                }
-            }
-        }
-        return { action: 'log' };
-    },
-};
-/**
- * Block LLM-generated recipients - prevents sending to LLM-extracted emails
- */
-export const blockLLMRecipients = {
-    name: 'block-llm-recipients',
-    description: 'Blocks sending data to LLM-extracted email addresses',
-    check: (toolName, args, getProvenance) => {
-        const recipientKeys = ['to', 'recipient', 'recipients', 'email'];
-        for (const key of recipientKeys) {
-            if (!args[key])
-                continue;
-            const metadata = getProvenance(args[key]);
-            if (metadata && metadata.source.type === ProvenanceSource.LLM) {
-                return {
-                    action: 'block',
-                    reason: `Cannot send to LLM-extracted recipient in parameter "${key}". Recipients must come from user input or trusted sources.`,
-                    policy: 'block-llm-recipients',
-                    context: {
-                        parameterKey: key,
-                        recipientValue: String(args[key]).substring(0, 50),
-                    },
-                };
-            }
-        }
-        return { action: 'log' };
-    },
-};
-/**
- * Block LLM-generated recipients (approval mode) - requires approval for LLM-extracted emails
- */
-export const blockLLMRecipientsWithApproval = {
-    name: 'block-llm-recipients-approval',
-    description: 'Requires approval for sending to LLM-extracted email addresses',
-    check: (toolName, args, getProvenance) => {
-        const recipientKeys = ['to', 'recipient', 'recipients', 'email'];
-        for (const key of recipientKeys) {
-            if (!args[key])
-                continue;
-            const metadata = getProvenance(args[key]);
-            if (metadata && metadata.source.type === ProvenanceSource.LLM) {
-                return {
-                    action: 'approve',
-                    reason: `Sending to LLM-extracted recipient "${args[key]}" in parameter "${key}"`,
-                    policy: 'block-llm-recipients-approval',
-                    context: {
-                        parameterKey: key,
-                        recipientValue: String(args[key]),
-                        llmOperation: metadata.source.operation,
-                    },
-                };
-            }
-        }
-        return { action: 'log' };
-    },
-};
-/**
- * Audit sensitive data access - logs access without blocking
- */
-export const auditSensitiveAccess = {
-    name: 'audit-sensitive-access',
-    description: 'Logs access to sensitive data (does not block)',
-    check: (toolName, args, getProvenance) => {
-        const sensitiveTools = ['getPassword', 'getCreditCard', 'getSSN', 'getBankAccount'];
-        if (sensitiveTools.some((t) => toolName.toLowerCase().includes(t.toLowerCase()))) {
-            const allProvenance = getAllProvenance(args);
-            return {
-                action: 'log',
-                reason: `Sensitive data accessed via ${toolName}`,
-                policy: 'audit-sensitive-access',
-                context: {
-                    toolName,
-                    provenanceChain: allProvenance.map((p) => ({
-                        source: p.source,
-                        id: p.id,
-                    })),
-                },
-            };
-        }
-        return { action: 'log' };
-    },
-};
-/**
- * Helper: Create custom policy
- */
-export function createCustomPolicy(name, description, checkFn) {
-    return { name, description, check: checkFn };
-}
-/**
- * Get all built-in policies
- */
-export function getBuiltInPolicies() {
-    return [preventDataExfiltration, requireUserOrigin, blockLLMRecipients, auditSensitiveAccess];
-}
-/**
- * Get all built-in policies with approval variants
- */
-export function getBuiltInPoliciesWithApproval() {
-    return [
-        preventDataExfiltrationWithApproval,
-        requireUserOriginWithApproval,
-        blockLLMRecipientsWithApproval,
-        auditSensitiveAccess,
-    ];
-}
-//# sourceMappingURL=engine.js.map

package/dist/provenance/src/policies/engine.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../../../provenance/src/policies/engine.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EACN,aAAa,EACb,gBAAgB,EAChB,OAAO,GAEP,MAAM,gBAAgB,CAAC;AASxB,MAAM,OAAO,oBAAoB;IACxB,QAAQ,CAAmB;IAC3B,MAAM,CAAS;IACf,gBAAgB,CAGF;IACd,mBAAmB,CAA2B;IAEtD,YACC,QAA0B,EAC1B,MAAc,EACd,mBAA6C;QAE7C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,EAA2B;QAC3C,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,mBAAmB,CAClB,QAAiF;QAEjF,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,SAAS,CACd,QAAgB,EAChB,QAAgB,EAChB,IAA6B;QAE7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;YAC/C,QAAQ;YACR,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;SACjC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,IAAI,aAAa,CAAC;QAElE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;YAEnE,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAE5C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;oBAC1D,QAAQ;oBACR,QAAQ;oBACR,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACrB,CAAC,CAAC;gBAEH,MAAM,IAAI,uBAAuB,CAChC,MAAM,CAAC,MAAM,IAAI,UAAU,MAAM,CAAC,IAAI,mBAAmB,EACzD,MAAM,CAAC,IAAI,EACX,QAAQ,EACR,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CACpE,CAAC;YACH,CAAC;YAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;oBACrD,QAAQ;oBACR,QAAQ;oBACR,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACrB,CAAC,CAAC;gBAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAErF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;wBACnD,QAAQ;wBACR,QAAQ;wBACR,MAAM,EAAE,MAAM,CAAC,IAAI;qBACnB,CAAC,CAAC;oBAEH,MAAM,IAAI,uBAAuB,CAChC,oBAAoB,MAAM,CAAC,MAAM,IAAI,6BAA6B,EAAE,EACpE,MAAM,CAAC,IAAI,EACX,QAAQ,EACR,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CACjE,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;oBACpD,QAAQ;oBACR,QAAQ;oBACR,MAAM,EAAE,MAAM,CAAC,IAAI;iBACnB,CAAC,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;oBAC/C,QAAQ;oBACR,QAAQ;oBACR,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;iBAC7B,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IAEO,eAAe,CAAC,MAAoB;QAC3C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,MAAM,CAAC;QACtB,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;QACzC,CAAC;QAED,OAAO,KAAK,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,eAAe,CAC5B,QAAgB,EAChB,QAAgB,EAChB,UAAkB,EAClB,MAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACjE,QAAQ;gBACR,MAAM,EAAE,UAAU;aAClB,CAAC,CAAC;YACH,MAAM,IAAI,uBAAuB,CAChC,uDAAuD,EACvD,UAAU,EACV,QAAQ,EACR,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAC1B,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,UAAU,0BAA0B,QAAQ,EAAE,CAAC;QAC1F,MAAM,OAAO,GAAG;YACf,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,UAAU;YAClB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SACzB,CAAC;QAEF,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IAEO,YAAY,CAAC,IAA6B;QACjD,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACrD,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;YAClD,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtC,SAAS,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACP,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;CACD;AAED;;GAEG;AAEH;;;GAGG;AACH,SAAS,wBAAwB,CAChC,IAA6B,EAC7B,aAAsC;IAEtC,MAAM,aAAa,GAAU,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAO,CAAC;IAE/B,SAAS,IAAI,CAAC,KAAc;QAC3B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAElD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACJ,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC3C,IAAI,aAAa,EAAE,CAAC;oBACnB,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACnC,CAAC;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,yCAAyC;YAC1C,CAAC;YACD,OAAO;QACR,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO;QACtC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEnB,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,UAAU,EAAE,CAAC;YAChB,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;YACZ,CAAC;QACF,CAAC;aAAM,CAAC;YACP,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;oBACtD,IAAI,CAAE,KAAa,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3B,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACjB,CAAC;IACF,CAAC;IAED,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACtD,IAAI,EAAE,2BAA2B;IACjC,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QACxC,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAEnE,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAChD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAW,CAAC;gBAChC,MAAM;YACP,CAAC;QACF,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,KAAqB,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,wBAAwB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAEpE,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC;gBACpD,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC5C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC3C,OAAO;4BACN,MAAM,EAAE,OAAuB;4BAC/B,MAAM,EAAE,cAAc,SAAS,2BAA2B,QAAQ,CAAC,MAAM,CAAC,QAAQ,yBAAyB,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;4BAChJ,MAAM,EAAE,2BAA2B;4BACnC,OAAO,EAAE;gCACR,SAAS;gCACT,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;gCACpC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO;6BAC3C;yBACD,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAqB,EAAE,CAAC;IAC1C,CAAC;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAmB;IAClE,IAAI,EAAE,oCAAoC;IAC1C,WAAW,EAAE,qEAAqE;IAClF,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QACxC,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAE5E,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAChD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAW,CAAC;gBAChC,MAAM;YACP,CAAC;QACF,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,KAAqB,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,wBAAwB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAEpE,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC;gBACpD,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC5C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC3C,OAAO;4BACN,MAAM,EAAE,SAAyB;4BACjC,MAAM,EAAE,qBAAqB,QAAQ,CAAC,MAAM,CAAC,QAAQ,QAAQ,SAAS,+BAA+B;4BACrG,MAAM,EAAE,oCAAoC;4BAC5C,OAAO,EAAE;gCACR,SAAS;gCACT,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;gCACpC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO;gCAC3C,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;6BAClE;yBACD,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAqB,EAAE,CAAC;IAC1C,CAAC;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAmB;IAChD,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,+DAA+D;IAC5E,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QACxC,MAAM,aAAa,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAE7F,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,EAAE,MAAM,EAAE,KAAqB,EAAE,CAAC;QAC1C,CAAC;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAE9C,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;gBACtC,IACC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;oBAC9C,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,MAAM,EAC/C,CAAC;oBACF,OAAO;wBACN,MAAM,EAAE,OAAuB;wBAC/B,MAAM,EAAE,kBAAkB,QAAQ,gBAAgB,GAAG,8CAA8C,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;wBACzH,MAAM,EAAE,qBAAqB;wBAC7B,OAAO,EAAE;4BACR,QAAQ;4BACR,YAAY,EAAE,GAAG;4BACjB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI;yBAClC;qBACD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAqB,EAAE,CAAC;IAC1C,CAAC;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAmB;IAC5D,IAAI,EAAE,8BAA8B;IACpC,WAAW,EAAE,8DAA8D;IAC3E,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QACxC,MAAM,aAAa,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAE7F,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,EAAE,MAAM,EAAE,KAAqB,EAAE,CAAC;QAC1C,CAAC;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAE9C,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;gBACtC,IACC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;oBAC9C,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,MAAM,EAC/C,CAAC;oBACF,OAAO;wBACN,MAAM,EAAE,SAAyB;wBACjC,MAAM,EAAE,uBAAuB,QAAQ,qBAAqB,GAAG,UAAU,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS;wBACtG,MAAM,EAAE,8BAA8B;wBACtC,OAAO,EAAE;4BACR,QAAQ;4BACR,YAAY,EAAE,GAAG;4BACjB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI;4BAClC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;yBACtC;qBACD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAqB,EAAE,CAAC;IAC1C,CAAC;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAmB;IACjD,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EAAE,sDAAsD;IACnE,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QACxC,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAEjE,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAEzB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,GAAG,EAAE,CAAC;gBAC/D,OAAO;oBACN,MAAM,EAAE,OAAuB;oBAC/B,MAAM,EAAE,wDAAwD,GAAG,6DAA6D;oBAChI,MAAM,EAAE,sBAAsB;oBAC9B,OAAO,EAAE;wBACR,YAAY,EAAE,GAAG;wBACjB,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;qBAClD;iBACD,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAqB,EAAE,CAAC;IAC1C,CAAC;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAmB;IAC7D,IAAI,EAAE,+BAA+B;IACrC,WAAW,EAAE,gEAAgE;IAC7E,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QACxC,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAEjE,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAEzB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,GAAG,EAAE,CAAC;gBAC/D,OAAO;oBACN,MAAM,EAAE,SAAyB;oBACjC,MAAM,EAAE,uCAAuC,IAAI,CAAC,GAAG,CAAC,mBAAmB,GAAG,GAAG;oBACjF,MAAM,EAAE,+BAA+B;oBACvC,OAAO,EAAE;wBACR,YAAY,EAAE,GAAG;wBACjB,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACjC,YAAY,EAAG,QAAQ,CAAC,MAAc,CAAC,SAAS;qBAChD;iBACD,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAqB,EAAE,CAAC;IAC1C,CAAC;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IACnD,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EAAE,gDAAgD;IAC7D,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;QACxC,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAEpF,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAE7C,OAAO;gBACN,MAAM,EAAE,KAAqB;gBAC7B,MAAM,EAAE,+BAA+B,QAAQ,EAAE;gBACjD,MAAM,EAAE,wBAAwB;gBAChC,OAAO,EAAE;oBACR,QAAQ;oBACR,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC1C,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,EAAE,EAAE,CAAC,CAAC,EAAE;qBACR,CAAC,CAAC;iBACH;aACD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAqB,EAAE,CAAC;IAC1C,CAAC;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,IAAY,EACZ,WAAmB,EACnB,OAAgC;IAEhC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IACjC,OAAO,CAAC,uBAAuB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;AAC/F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B;IAC7C,OAAO;QACN,mCAAmC;QACnC,6BAA6B;QAC7B,8BAA8B;QAC9B,oBAAoB;KACpB,CAAC;AACH,CAAC"}