@vorionsys/platform-core 0.1.0

package/dist/semantic-governance/context-validator.js

@@ -0,0 +1,598 @@
+/**
+ * Context Validator - Context Authentication
+ *
+ * Validates context providers and their content to prevent indirect injection attacks.
+ * Context providers (RAG, MCP servers, APIs) must be authenticated and their content
+ * verified before being processed by the agent.
+ *
+ * Features:
+ * - Context provider authentication (trust tier, domains)
+ * - Content integrity verification (signatures, age)
+ * - Injection pattern detection
+ * - Allowlist/blocklist enforcement
+ *
+ * @packageDocumentation
+ * @module @vorion/semantic-governance/context-validator
+ */
+import { createHmac, timingSafeEqual } from 'crypto';
+import { createLogger } from '../common/logger.js';
+import { VorionError } from '../common/errors.js';
+import { TrustTier, } from './types.js';
+const logger = createLogger({ component: 'context-validator' });
+/**
+ * Error thrown when context validation fails
+ */
+export class ContextValidationError extends VorionError {
+    code = 'CONTEXT_VALIDATION_ERROR';
+    statusCode = 403;
+    constructor(message, details) {
+        super(message, details);
+        this.name = 'ContextValidationError';
+    }
+}
+/**
+ * Injection patterns to detect in context content
+ *
+ * These patterns indicate potential prompt injection attempts
+ * embedded in external data.
+ */
+export const INJECTION_PATTERNS = [
+    // Instruction override attempts
+    {
+        pattern: /ignore\s+(previous|prior|above)\s+instructions?/i,
+        description: 'Instruction override attempt',
+        severity: 'critical',
+    },
+    {
+        pattern: /disregard\s+(all|any)\s+(previous|prior)/i,
+        description: 'Instruction disregard attempt',
+        severity: 'critical',
+    },
+    {
+        pattern: /forget\s+(everything|all)/i,
+        description: 'Memory manipulation attempt',
+        severity: 'high',
+    },
+    {
+        pattern: /new\s+instructions?\s*:/i,
+        description: 'New instruction injection',
+        severity: 'critical',
+    },
+    {
+        pattern: /override\s+(your|the|these|current)\s+(instructions?|rules?|constraints?)/i,
+        description: 'Override attempt',
+        severity: 'critical',
+    },
+    // Role manipulation
+    {
+        pattern: /you\s+are\s+(now|actually)/i,
+        description: 'Role reassignment attempt',
+        severity: 'high',
+    },
+    {
+        pattern: /pretend\s+(to\s+be|you're)/i,
+        description: 'Impersonation instruction',
+        severity: 'high',
+    },
+    {
+        pattern: /act\s+as\s+(if|though)/i,
+        description: 'Behavioral manipulation',
+        severity: 'medium',
+    },
+    {
+        pattern: /your\s+new\s+role/i,
+        description: 'Role injection',
+        severity: 'high',
+    },
+    {
+        pattern: /you\s+must\s+(now\s+)?follow/i,
+        description: 'Mandatory instruction injection',
+        severity: 'high',
+    },
+    // Data exfiltration
+    {
+        pattern: /send\s+(to|data\s+to)/i,
+        description: 'Data exfiltration instruction',
+        severity: 'critical',
+    },
+    {
+        pattern: /export\s+(to|all)/i,
+        description: 'Export instruction',
+        severity: 'high',
+    },
+    {
+        pattern: /transfer\s+(funds?|money)/i,
+        description: 'Financial transfer instruction',
+        severity: 'critical',
+    },
+    {
+        pattern: /forward\s+(all|this|the)\s+(data|information|email)/i,
+        description: 'Data forwarding instruction',
+        severity: 'high',
+    },
+    // Privilege escalation
+    {
+        pattern: /admin(istrator)?\s+(mode|access)/i,
+        description: 'Admin access attempt',
+        severity: 'critical',
+    },
+    {
+        pattern: /bypass\s+(security|auth|authentication|authorization)/i,
+        description: 'Security bypass attempt',
+        severity: 'critical',
+    },
+    {
+        pattern: /elevate\s+(privileges?|permissions?)/i,
+        description: 'Privilege escalation attempt',
+        severity: 'critical',
+    },
+    {
+        pattern: /sudo|root\s+access/i,
+        description: 'Root access attempt',
+        severity: 'critical',
+    },
+    // System prompt extraction
+    {
+        pattern: /what\s+(is|are)\s+your\s+(system|initial)\s+(prompt|instructions?)/i,
+        description: 'System prompt extraction',
+        severity: 'high',
+    },
+    {
+        pattern: /reveal\s+(your|the)\s+(system|initial)/i,
+        description: 'Instruction reveal attempt',
+        severity: 'high',
+    },
+    {
+        pattern: /show\s+me\s+(your|the)\s+(original|system)/i,
+        description: 'Configuration extraction',
+        severity: 'high',
+    },
+    // Jailbreak attempts
+    {
+        pattern: /developer\s+mode/i,
+        description: 'Developer mode activation',
+        severity: 'critical',
+    },
+    {
+        pattern: /dan\s+mode/i,
+        description: 'DAN jailbreak attempt',
+        severity: 'critical',
+    },
+    {
+        pattern: /enable\s+unrestricted/i,
+        description: 'Unrestricted mode attempt',
+        severity: 'critical',
+    },
+    {
+        pattern: /jailbreak/i,
+        description: 'Explicit jailbreak reference',
+        severity: 'critical',
+    },
+    // Hidden instructions
+    {
+        pattern: /\[hidden\]|\[invisible\]|\[system\]/i,
+        description: 'Hidden instruction marker',
+        severity: 'high',
+    },
+    {
+        pattern: /<!--|-->|<\/?script/i,
+        description: 'HTML/Script injection',
+        severity: 'high',
+    },
+];
+/**
+ * Context Validator
+ *
+ * Validates context providers and their content to prevent indirect injection.
+ */
+export class ContextValidator {
+    config;
+    allowedProviderPatterns;
+    blockedProviderPatterns;
+    /**
+     * Create a new ContextValidator
+     *
+     * @param config - Context authentication requirements
+     */
+    constructor(config) {
+        this.config = config;
+        this.allowedProviderPatterns = config.allowedProviders.map((p) => this.globToRegex(p));
+        this.blockedProviderPatterns = config.blockedProviders.map((p) => this.globToRegex(p));
+        logger.debug({
+            required: config.required,
+            minTrustTier: config.minTrustTier,
+            signatureRequired: config.contentIntegrity.signatureRequired,
+            maxAge: config.contentIntegrity.maxAge,
+        }, 'ContextValidator initialized');
+    }
+    /**
+     * Validate a context provider
+     *
+     * @param providerId - Provider identifier (DID)
+     * @param providerTrust - Provider's trust profile
+     * @returns Provider validation result
+     */
+    validateProvider(providerId, providerTrust) {
+        // Check blocklist first
+        if (this.isProviderBlocked(providerId)) {
+            logger.warn({ providerId }, 'Context provider is blocked');
+            return {
+                valid: false,
+                providerId,
+                reason: 'Provider is on blocklist',
+                blocked: true,
+            };
+        }
+        // Check if authentication is required
+        if (!this.config.required) {
+            return {
+                valid: true,
+                providerId,
+                trustTier: providerTrust.trustTier,
+            };
+        }
+        // Check trust tier
+        if (providerTrust.trustTier < this.config.minTrustTier) {
+            logger.warn({
+                providerId,
+                providerTrustTier: providerTrust.trustTier,
+                requiredTrustTier: this.config.minTrustTier,
+            }, 'Context provider trust tier too low');
+            return {
+                valid: false,
+                providerId,
+                trustTier: providerTrust.trustTier,
+                reason: `Provider trust tier ${providerTrust.trustTier} is below required ${this.config.minTrustTier}`,
+            };
+        }
+        // Check required domains
+        if (this.config.requiredDomains && this.config.requiredDomains.length > 0) {
+            const missingDomains = this.config.requiredDomains.filter((d) => !providerTrust.domains.includes(d));
+            if (missingDomains.length > 0) {
+                logger.warn({ providerId, missingDomains }, 'Context provider missing required domains');
+                return {
+                    valid: false,
+                    providerId,
+                    trustTier: providerTrust.trustTier,
+                    reason: `Provider missing required domains: ${missingDomains.join(', ')}`,
+                };
+            }
+        }
+        // Check allowlist (if not empty)
+        if (!this.isProviderAllowed(providerId)) {
+            logger.warn({ providerId }, 'Context provider not in allowlist');
+            return {
+                valid: false,
+                providerId,
+                trustTier: providerTrust.trustTier,
+                reason: 'Provider not in allowlist',
+            };
+        }
+        logger.debug({ providerId, trustTier: providerTrust.trustTier }, 'Context provider validated');
+        return {
+            valid: true,
+            providerId,
+            trustTier: providerTrust.trustTier,
+        };
+    }
+    /**
+     * Validate context content
+     *
+     * @param content - The content to validate
+     * @param signature - Optional content signature
+     * @param timestamp - Optional content timestamp
+     * @returns Content validation result
+     */
+    validateContent(content, signature, timestamp) {
+        const { contentIntegrity } = this.config;
+        // Check signature if required
+        if (contentIntegrity.signatureRequired) {
+            if (!signature) {
+                logger.warn('Content signature required but not provided');
+                return {
+                    valid: false,
+                    reason: 'Content signature required but not provided',
+                };
+            }
+            // Verify HMAC-SHA256 content signature
+            const signatureValid = this.verifyContentSignature(content, signature);
+            if (!signatureValid) {
+                logger.warn('Content signature verification failed');
+                return {
+                    valid: false,
+                    signatureValid: false,
+                    reason: 'Content signature verification failed',
+                };
+            }
+        }
+        // Check content age
+        if (timestamp) {
+            const ageSeconds = (Date.now() - timestamp.getTime()) / 1000;
+            if (ageSeconds > contentIntegrity.maxAge) {
+                logger.warn({ ageSeconds, maxAge: contentIntegrity.maxAge }, 'Content is too old');
+                return {
+                    valid: false,
+                    ageSeconds,
+                    reason: `Content is ${Math.round(ageSeconds)} seconds old, max allowed is ${contentIntegrity.maxAge}`,
+                };
+            }
+        }
+        // Check content format
+        const format = this.detectContentFormat(content);
+        if (!contentIntegrity.allowedFormats.includes(format)) {
+            logger.warn({ format, allowedFormats: contentIntegrity.allowedFormats }, 'Content format not allowed');
+            return {
+                valid: false,
+                format,
+                reason: `Content format '${format}' not in allowed formats`,
+            };
+        }
+        return {
+            valid: true,
+            signatureValid: signature ? true : undefined,
+            ageSeconds: timestamp ? (Date.now() - timestamp.getTime()) / 1000 : undefined,
+            format,
+        };
+    }
+    /**
+     * Scan content for injection patterns
+     *
+     * @param content - Content to scan
+     * @returns Injection scan result
+     */
+    scanForInjection(content) {
+        const detected = [];
+        const descriptions = [];
+        let maxSeverity = undefined;
+        for (const { pattern, description, severity } of INJECTION_PATTERNS) {
+            if (pattern.test(content)) {
+                detected.push(pattern.source);
+                descriptions.push(description);
+                maxSeverity = this.getHigherSeverity(maxSeverity, severity);
+            }
+        }
+        if (detected.length > 0) {
+            logger.warn({
+                patternsDetected: detected.length,
+                severity: maxSeverity,
+                descriptions,
+            }, 'Injection patterns detected in context');
+        }
+        return {
+            detected: detected.length > 0,
+            patterns: detected,
+            severity: maxSeverity,
+            descriptions,
+        };
+    }
+    /**
+     * Classify a message as control plane or data plane
+     *
+     * @param message - Message to classify
+     * @returns Message channel classification
+     */
+    classifyChannel(message) {
+        // Control plane sources (trusted instruction sources)
+        const controlPlaneSources = [
+            'user-direct-input',
+            'signed-system-instruction',
+            'authenticated-api-command',
+            'admin-console',
+            'orchestrator',
+        ];
+        // Data plane sources (processed content, untrusted for instructions)
+        const dataPlaneSources = [
+            'email-content',
+            'retrieved-document',
+            'external-api-response',
+            'user-file-upload',
+            'mcp-context',
+            'rag-retrieval',
+            'web-scrape',
+        ];
+        // Check if source is explicitly in control plane
+        if (controlPlaneSources.some((src) => message.source.includes(src))) {
+            return 'control';
+        }
+        // Check if source is explicitly in data plane
+        if (dataPlaneSources.some((src) => message.source.includes(src))) {
+            return 'data';
+        }
+        // Default: unauthenticated sources are data plane
+        if (!message.authenticated) {
+            return 'data';
+        }
+        // Default for authenticated unknown sources
+        return 'control';
+    }
+    /**
+     * Perform full context validation
+     *
+     * @param providerId - Provider identifier
+     * @param providerTrust - Provider's trust profile
+     * @param content - Context content
+     * @param signature - Optional content signature
+     * @param timestamp - Optional content timestamp
+     * @returns Complete context validation result
+     */
+    validateContext(providerId, providerTrust, content, signature, timestamp) {
+        // Validate provider
+        const providerValidation = this.validateProvider(providerId, providerTrust);
+        if (!providerValidation.valid) {
+            return {
+                valid: false,
+                reason: providerValidation.reason,
+                providerValidation,
+            };
+        }
+        // Validate content
+        const contentValidation = this.validateContent(content, signature, timestamp);
+        if (!contentValidation.valid) {
+            return {
+                valid: false,
+                reason: contentValidation.reason,
+                providerValidation,
+                contentValidation,
+            };
+        }
+        // Scan for injection
+        const contentString = typeof content === 'string' ? content : JSON.stringify(content);
+        const injectionScan = this.scanForInjection(contentString);
+        if (injectionScan.detected) {
+            return {
+                valid: false,
+                reason: `Potential injection detected: ${injectionScan.descriptions?.join(', ')}`,
+                providerValidation,
+                contentValidation,
+                injectionScan,
+            };
+        }
+        return {
+            valid: true,
+            providerValidation,
+            contentValidation,
+            injectionScan,
+        };
+    }
+    /**
+     * Check if a provider is on the blocklist
+     *
+     * @param providerId - Provider identifier
+     * @returns Whether the provider is blocked
+     */
+    isProviderBlocked(providerId) {
+        return this.blockedProviderPatterns.some((pattern) => pattern.test(providerId));
+    }
+    /**
+     * Check if a provider is on the allowlist
+     *
+     * @param providerId - Provider identifier
+     * @returns Whether the provider is allowed
+     */
+    isProviderAllowed(providerId) {
+        // Empty allowlist means all non-blocked providers are allowed
+        if (this.allowedProviderPatterns.length === 0) {
+            return true;
+        }
+        return this.allowedProviderPatterns.some((pattern) => pattern.test(providerId));
+    }
+    /**
+     * Verify content signature using HMAC-SHA256.
+     *
+     * Expects signature format: hmac-sha256:<base64>
+     * Uses VORION_CONTENT_HMAC_KEY env var for verification.
+     *
+     * @param content - Content to verify
+     * @param signature - Signature string to verify
+     * @returns Whether signature is valid
+     */
+    verifyContentSignature(content, signature) {
+        const hmacKey = process.env['VORION_CONTENT_HMAC_KEY'];
+        if (!hmacKey) {
+            logger.warn('VORION_CONTENT_HMAC_KEY not set; signature verification requires HMAC key');
+            return false;
+        }
+        // Parse signature format: hmac-sha256:<base64>
+        const parts = signature.split(':');
+        if (parts.length !== 2 || parts[0] !== 'hmac-sha256') {
+            logger.warn({ format: parts[0] }, 'Unsupported signature format; expected hmac-sha256:<base64>');
+            return false;
+        }
+        const providedSig = parts[1];
+        const canonical = typeof content === 'string' ? content : JSON.stringify(content);
+        const expectedSig = createHmac('sha256', hmacKey).update(canonical).digest('base64');
+        // Constant-time comparison to prevent timing attacks
+        const a = Buffer.from(providedSig, 'base64');
+        const b = Buffer.from(expectedSig, 'base64');
+        if (a.length !== b.length) {
+            return false;
+        }
+        return timingSafeEqual(a, b);
+    }
+    /**
+     * Detect content format
+     *
+     * @param content - Content to analyze
+     * @returns Detected format
+     */
+    detectContentFormat(content) {
+        if (typeof content === 'string') {
+            // Try to parse as JSON
+            try {
+                JSON.parse(content);
+                return 'application/json';
+            }
+            catch {
+                return 'text/plain';
+            }
+        }
+        if (typeof content === 'object' && content !== null) {
+            return 'application/json';
+        }
+        return 'application/octet-stream';
+    }
+    /**
+     * Convert a glob pattern to a regex
+     *
+     * @param glob - Glob pattern
+     * @returns Compiled regex
+     */
+    globToRegex(glob) {
+        const escaped = glob
+            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+            .replace(/\*/g, '.*')
+            .replace(/\?/g, '.');
+        return new RegExp(`^${escaped}$`, 'i');
+    }
+    /**
+     * Get the higher severity level
+     *
+     * @param a - First severity
+     * @param b - Second severity
+     * @returns Higher severity
+     */
+    getHigherSeverity(a, b) {
+        const order = ['low', 'medium', 'high', 'critical'];
+        const aIndex = a ? order.indexOf(a) : -1;
+        const bIndex = b ? order.indexOf(b) : -1;
+        return aIndex >= bIndex ? a : b;
+    }
+}
+/**
+ * Create a ContextValidator with default configuration
+ *
+ * @returns ContextValidator with secure defaults
+ */
+export function createDefaultContextValidator() {
+    return new ContextValidator({
+        required: true,
+        minTrustTier: TrustTier.T2_PROVISIONAL,
+        allowedProviders: [],
+        blockedProviders: [],
+        contentIntegrity: {
+            signatureRequired: false,
+            maxAge: 300,
+            allowedFormats: ['application/json', 'text/plain'],
+        },
+    });
+}
+/**
+ * Create a strict ContextValidator for high-security environments
+ *
+ * @returns ContextValidator with strict settings
+ */
+export function createStrictContextValidator() {
+    return new ContextValidator({
+        required: true,
+        minTrustTier: TrustTier.T3_MONITORED,
+        requiredDomains: ['D'], // Require Data domain
+        allowedProviders: [],
+        blockedProviders: ['did:*:untrusted:*'],
+        contentIntegrity: {
+            signatureRequired: true,
+            maxAge: 60, // 1 minute max age
+            allowedFormats: ['application/json'],
+        },
+    });
+}
+//# sourceMappingURL=context-validator.js.map

package/dist/semantic-governance/context-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-validator.js","sourceRoot":"","sources":["../../src/semantic-governance/context-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAgB,eAAe,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,SAAS,GASV,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAEhE;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,WAAW;IAC5C,IAAI,GAAG,0BAA0B,CAAC;IAClC,UAAU,GAAG,GAAG,CAAC;IAE1B,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA+F;IAC5H,gCAAgC;IAChC;QACE,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EAAE,8BAA8B;QAC3C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,WAAW,EAAE,+BAA+B;QAC5C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,4BAA4B;QACrC,WAAW,EAAE,6BAA6B;QAC1C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,4EAA4E;QACrF,WAAW,EAAE,kBAAkB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IAED,oBAAoB;IACpB;QACE,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,OAAO,EAAE,yBAAyB;QAClC,WAAW,EAAE,yBAAyB;QACtC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,iCAAiC;QAC9C,QAAQ,EAAE,MAAM;KACjB;IAED,oBAAoB;IACpB;QACE,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,+BAA+B;QAC5C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EAAE,oBAAoB;QACjC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,OAAO,EAAE,4BAA4B;QACrC,WAAW,EAAE,gCAAgC;QAC7C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,sDAAsD;QAC/D,WAAW,EAAE,6BAA6B;QAC1C,QAAQ,EAAE,MAAM;KACjB;IAED,uBAAuB;IACvB;QACE,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,sBAAsB;QACnC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,yBAAyB;QACtC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,uCAAuC;QAChD,WAAW,EAAE,8BAA8B;QAC3C,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,qBAAqB;QAClC,QAAQ,EAAE,UAAU;KACrB;IAED,2BAA2B;IAC3B;QACE,OAAO,EAAE,qEAAqE;QAC9E,WAAW,EAAE,0BAA0B;QACvC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,OAAO,EAAE,yCAAyC;QAClD,WAAW,EAAE,4BAA4B;QACzC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,OAAO,EAAE,6CAA6C;QACtD,WAAW,EAAE,0BAA0B;QACvC,QAAQ,EAAE,MAAM;KACjB;IAED,qBAAqB;IACrB;QACE,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,aAAa;QACtB,WAAW,EAAE,uBAAuB;QACpC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,OAAO,EAAE,YAAY;QACrB,WAAW,EAAE,8BAA8B;QAC3C,QAAQ,EAAE,UAAU;KACrB;IAED,sBAAsB;IACtB;QACE,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EAAE,uBAAuB;QACpC,QAAQ,EAAE,MAAM;KACjB;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IACV,MAAM,CAAoC;IAC1C,uBAAuB,CAAW;IAClC,uBAAuB,CAAW;IAEnD;;;;OAIG;IACH,YAAY,MAAyC;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvF,MAAM,CAAC,KAAK,CACV;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,CAAC,iBAAiB;YAC5D,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM;SACvC,EACD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,UAAkB,EAAE,aAA2B;QAC9D,wBAAwB;QACxB,IAAI,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,6BAA6B,CAAC,CAAC;YAC3D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU;gBACV,MAAM,EAAE,0BAA0B;gBAClC,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,UAAU;gBACV,SAAS,EAAE,aAAa,CAAC,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,IAAI,aAAa,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CACT;gBACE,UAAU;gBACV,iBAAiB,EAAE,aAAa,CAAC,SAAS;gBAC1C,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;aAC5C,EACD,qCAAqC,CACtC,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU;gBACV,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,MAAM,EAAE,uBAAuB,aAAa,CAAC,SAAS,sBAAsB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE;aACvG,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC1C,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CACT,EAAE,UAAU,EAAE,cAAc,EAAE,EAC9B,2CAA2C,CAC5C,CAAC;gBACF,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,UAAU;oBACV,SAAS,EAAE,aAAa,CAAC,SAAS;oBAClC,MAAM,EAAE,sCAAsC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC1E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,mCAAmC,CAAC,CAAC;YACjE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU;gBACV,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,MAAM,EAAE,2BAA2B;aACpC,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,KAAK,CACV,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,EAClD,4BAA4B,CAC7B,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU;YACV,SAAS,EAAE,aAAa,CAAC,SAAS;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CACb,OAAgB,EAChB,SAAkB,EAClB,SAAgB;QAEhB,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAEzC,8BAA8B;QAC9B,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;YACvC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;gBAC3D,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,6CAA6C;iBACtD,CAAC;YACJ,CAAC;YAED,uCAAuC;YACvC,MAAM,cAAc,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACvE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;gBACrD,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,cAAc,EAAE,KAAK;oBACrB,MAAM,EAAE,uCAAuC;iBAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC;YAC7D,IAAI,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CACT,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,EAC/C,oBAAoB,CACrB,CAAC;gBACF,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,UAAU;oBACV,MAAM,EAAE,cAAc,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,gCAAgC,gBAAgB,CAAC,MAAM,EAAE;iBACtG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,cAAc,EAAE,gBAAgB,CAAC,cAAc,EAAE,EAC3D,4BAA4B,CAC7B,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM;gBACN,MAAM,EAAE,mBAAmB,MAAM,0BAA0B;aAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC5C,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;YAC7E,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,OAAe;QAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,WAAW,GAAoC,SAAS,CAAC;QAE7D,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,kBAAkB,EAAE,CAAC;YACpE,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC9B,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC/B,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT;gBACE,gBAAgB,EAAE,QAAQ,CAAC,MAAM;gBACjC,QAAQ,EAAE,WAAW;gBACrB,YAAY;aACb,EACD,wCAAwC,CACzC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,WAAW;YACrB,YAAY;SACb,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,OAAmD;QACjE,sDAAsD;QACtD,MAAM,mBAAmB,GAAG;YAC1B,mBAAmB;YACnB,2BAA2B;YAC3B,2BAA2B;YAC3B,eAAe;YACf,cAAc;SACf,CAAC;QAEF,qEAAqE;QACrE,MAAM,gBAAgB,GAAG;YACvB,eAAe;YACf,oBAAoB;YACpB,uBAAuB;YACvB,kBAAkB;YAClB,aAAa;YACb,eAAe;YACf,YAAY;SACb,CAAC;QAEF,iDAAiD;QACjD,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,8CAA8C;QAC9C,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,kDAAkD;QAClD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,4CAA4C;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;OASG;IACH,eAAe,CACb,UAAkB,EAClB,aAA2B,EAC3B,OAAgB,EAChB,SAAkB,EAClB,SAAgB;QAEhB,oBAAoB;QACpB,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC5E,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,kBAAkB;aACnB,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9E,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC7B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iBAAiB,CAAC,MAAM;gBAChC,kBAAkB;gBAClB,iBAAiB;aAClB,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,aAAa,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtF,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC3D,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBACjF,kBAAkB;gBAClB,iBAAiB;gBACjB,aAAa;aACd,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,kBAAkB;YAClB,iBAAiB;YACjB,aAAa;SACd,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,UAAkB;QAC1C,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAClF,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,UAAkB;QAC1C,8DAA8D;QAC9D,IAAI,IAAI,CAAC,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAClF,CAAC;IAED;;;;;;;;;OASG;IACK,sBAAsB,CAAC,OAAgB,EAAE,SAAiB;QAChE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,+CAA+C;QAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,6DAA6D,CAAC,CAAC;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErF,qDAAqD;QACrD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,OAAgB;QAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,uBAAuB;YACvB,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACpB,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QAED,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,IAAY;QAC9B,MAAM,OAAO,GAAG,IAAI;aACjB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;aACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;aACpB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAEvB,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CACvB,CAAkC,EAClC,CAAkC;QAElC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B;IAC3C,OAAO,IAAI,gBAAgB,CAAC;QAC1B,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,SAAS,CAAC,cAAc;QACtC,gBAAgB,EAAE,EAAE;QACpB,gBAAgB,EAAE,EAAE;QACpB,gBAAgB,EAAE;YAChB,iBAAiB,EAAE,KAAK;YACxB,MAAM,EAAE,GAAG;YACX,cAAc,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC;SACnD;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,IAAI,gBAAgB,CAAC;QAC1B,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,eAAe,EAAE,CAAC,GAAG,CAAiB,EAAE,sBAAsB;QAC9D,gBAAgB,EAAE,EAAE;QACpB,gBAAgB,EAAE,CAAC,mBAAmB,CAAC;QACvC,gBAAgB,EAAE;YAChB,iBAAiB,EAAE,IAAI;YACvB,MAAM,EAAE,EAAE,EAAE,mBAAmB;YAC/B,cAAc,EAAE,CAAC,kBAAkB,CAAC;SACrC;KACF,CAAC,CAAC;AACL,CAAC"}