@vorionsys/security 1.0.0

package/dist/semantic-governance/output-validator.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Output Validator - Output Schema Binding
+ *
+ * Validates agent output against allowed schemas and scans for prohibited patterns.
+ * Prevents data exfiltration and ensures output conforms to expected formats.
+ *
+ * Features:
+ * - JSON Schema validation for structured output
+ * - Prohibited pattern detection (PII, credentials, etc.)
+ * - External endpoint allowlist/blocklist
+ * - Output sanitization
+ *
+ * @packageDocumentation
+ * @module @vorion/semantic-governance/output-validator
+ */
+import { VorionError } from '../common/errors.js';
+import type { OutputBinding, ProhibitedPattern, OutputValidationResult, PatternScanResult, SanitizedOutput } from './types.js';
+/**
+ * Error thrown when output validation fails
+ */
+export declare class OutputValidationError extends VorionError {
+    code: string;
+    statusCode: number;
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Built-in prohibited patterns for common sensitive data
+ */
+export declare const BUILT_IN_PROHIBITED_PATTERNS: ProhibitedPattern[];
+/**
+ * Output Validator
+ *
+ * Validates agent output against configured schemas and patterns.
+ */
+export declare class OutputValidator {
+    private readonly config;
+    private readonly ajv;
+    private readonly schemaValidators;
+    private readonly compiledPatterns;
+    private readonly allowedEndpointPatterns;
+    private readonly blockedEndpointPatterns;
+    /**
+     * Create a new OutputValidator
+     *
+     * @param config - Output binding configuration
+     */
+    constructor(config: OutputBinding);
+    /**
+     * Validate output against allowed schemas
+     *
+     * @param output - Output to validate
+     * @returns Validation result
+     */
+    validateOutput(output: unknown): OutputValidationResult;
+    /**
+     * Scan content for prohibited patterns
+     *
+     * @param content - Content to scan
+     * @returns Pattern scan result
+     */
+    scanForProhibitedPatterns(content: string): PatternScanResult;
+    /**
+     * Check if an external endpoint is allowed
+     *
+     * @param url - URL to check
+     * @returns Whether the endpoint is allowed
+     */
+    validateExternalEndpoint(url: string): boolean;
+    /**
+     * Sanitize output by removing prohibited content
+     *
+     * @param output - Output to sanitize
+     * @returns Sanitized output
+     */
+    sanitizeOutput(output: unknown): SanitizedOutput;
+    /**
+     * Extract all URLs from content
+     *
+     * @param content - Content to scan
+     * @returns Array of extracted URLs
+     */
+    extractUrls(content: string): string[];
+    /**
+     * Validate all URLs in content against endpoint rules
+     *
+     * @param content - Content to validate
+     * @returns Array of invalid URLs
+     */
+    validateAllUrls(content: string): string[];
+    /**
+     * Convert a glob pattern to a regex
+     *
+     * @param glob - Glob pattern
+     * @returns Compiled regex
+     */
+    private globToRegex;
+    /**
+     * Find all matches for a pattern in content
+     *
+     * @param content - Content to search
+     * @param pattern - Pattern to match
+     * @returns Array of matches
+     */
+    private findPatternMatches;
+    /**
+     * Escape special regex characters
+     *
+     * @param str - String to escape
+     * @returns Escaped string
+     */
+    private escapeRegex;
+    /**
+     * Get the higher severity level
+     *
+     * @param a - First severity
+     * @param b - Second severity
+     * @returns Higher severity
+     */
+    private getHigherSeverity;
+    /**
+     * Convert output to string for scanning
+     *
+     * @param output - Output to stringify
+     * @returns String representation
+     */
+    private stringifyOutput;
+}
+/**
+ * Create an OutputValidator with default configuration
+ *
+ * @param additionalPatterns - Additional prohibited patterns to include
+ * @returns OutputValidator with secure defaults
+ */
+export declare function createDefaultOutputValidator(additionalPatterns?: ProhibitedPattern[]): OutputValidator;
+//# sourceMappingURL=output-validator.d.ts.map

package/dist/semantic-governance/output-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-validator.d.ts","sourceRoot":"","sources":["../../src/semantic-governance/output-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EACV,aAAa,EAEb,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EAChB,MAAM,YAAY,CAAC;AAIpB;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,WAAW;IAC3C,IAAI,SAA6B;IACjC,UAAU,SAAO;gBAEd,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,iBAAiB,EAgE3D,CAAC;AAEF;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0C;IAC3E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsB;IACvD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IAEnD;;;;OAIG;gBACS,MAAM,EAAE,aAAa;IA8CjC;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,sBAAsB;IAoDvD;;;;;OAKG;IACH,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB;IAgC7D;;;;;OAKG;IACH,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAyB9C;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe;IA6DhD;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAMtC;;;;;OAKG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAK1C;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IASnB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAmB1B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAInB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAUzB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;CAUxB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,kBAAkB,GAAE,iBAAiB,EAAO,GAAG,eAAe,CAO1G"}

package/dist/semantic-governance/output-validator.js

@@ -0,0 +1,442 @@
+/**
+ * Output Validator - Output Schema Binding
+ *
+ * Validates agent output against allowed schemas and scans for prohibited patterns.
+ * Prevents data exfiltration and ensures output conforms to expected formats.
+ *
+ * Features:
+ * - JSON Schema validation for structured output
+ * - Prohibited pattern detection (PII, credentials, etc.)
+ * - External endpoint allowlist/blocklist
+ * - Output sanitization
+ *
+ * @packageDocumentation
+ * @module @vorion/semantic-governance/output-validator
+ */
+import Ajv from 'ajv';
+import addFormats from 'ajv-formats';
+import { createLogger } from '../common/logger.js';
+import { VorionError } from '../common/errors.js';
+const logger = createLogger({ component: 'output-validator' });
+/**
+ * Error thrown when output validation fails
+ */
+export class OutputValidationError extends VorionError {
+    code = 'OUTPUT_VALIDATION_ERROR';
+    statusCode = 403;
+    constructor(message, details) {
+        super(message, details);
+        this.name = 'OutputValidationError';
+    }
+}
+/**
+ * Built-in prohibited patterns for common sensitive data
+ */
+export const BUILT_IN_PROHIBITED_PATTERNS = [
+    // Email addresses
+    {
+        type: 'regex',
+        pattern: '\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b',
+        description: 'Email addresses',
+        severity: 'medium',
+    },
+    // Social Security Numbers
+    {
+        type: 'regex',
+        pattern: '\\b\\d{3}-\\d{2}-\\d{4}\\b',
+        description: 'Social Security Numbers (SSN)',
+        severity: 'critical',
+    },
+    // Credit card numbers (basic patterns)
+    {
+        type: 'regex',
+        pattern: '\\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\\b',
+        description: 'Credit card numbers',
+        severity: 'critical',
+    },
+    // API keys (common formats)
+    {
+        type: 'regex',
+        pattern: '\\b(?:api[_-]?key|apikey|api[_-]?secret|api[_-]?token)[\\s:=]+[\'"]?[A-Za-z0-9_-]{20,}[\'"]?',
+        description: 'API keys',
+        severity: 'critical',
+    },
+    // AWS access keys
+    {
+        type: 'regex',
+        pattern: '\\bAKIA[0-9A-Z]{16}\\b',
+        description: 'AWS Access Key IDs',
+        severity: 'critical',
+    },
+    // Private keys
+    {
+        type: 'regex',
+        pattern: '-----BEGIN\\s+(RSA\\s+)?PRIVATE\\s+KEY-----',
+        description: 'Private keys',
+        severity: 'critical',
+    },
+    // JWT tokens
+    {
+        type: 'regex',
+        pattern: '\\beyJ[A-Za-z0-9_-]*\\.[A-Za-z0-9_-]*\\.[A-Za-z0-9_-]*\\b',
+        description: 'JWT tokens',
+        severity: 'high',
+    },
+    // Phone numbers (US format)
+    {
+        type: 'regex',
+        pattern: '\\b(?:\\+1[-.]?)?\\(?[2-9][0-9]{2}\\)?[-.]?[2-9][0-9]{2}[-.]?[0-9]{4}\\b',
+        description: 'Phone numbers',
+        severity: 'medium',
+    },
+    // IP addresses
+    {
+        type: 'regex',
+        pattern: '\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b',
+        description: 'IP addresses',
+        severity: 'low',
+    },
+];
+/**
+ * Output Validator
+ *
+ * Validates agent output against configured schemas and patterns.
+ */
+export class OutputValidator {
+    config;
+    ajv;
+    schemaValidators;
+    compiledPatterns;
+    allowedEndpointPatterns;
+    blockedEndpointPatterns;
+    /**
+     * Create a new OutputValidator
+     *
+     * @param config - Output binding configuration
+     */
+    constructor(config) {
+        this.config = config;
+        this.ajv = new Ajv({ allErrors: true, strict: false });
+        addFormats(this.ajv);
+        this.schemaValidators = new Map();
+        this.compiledPatterns = new Map();
+        this.allowedEndpointPatterns = [];
+        this.blockedEndpointPatterns = [];
+        // Pre-compile schema validators
+        for (const schema of config.allowedSchemas) {
+            try {
+                const validator = this.ajv.compile(schema.jsonSchema);
+                this.schemaValidators.set(schema.id, validator);
+            }
+            catch (error) {
+                logger.error({ schemaId: schema.id, error }, 'Failed to compile output schema');
+            }
+        }
+        // Pre-compile prohibited patterns
+        for (const pattern of config.prohibitedPatterns) {
+            if (pattern.type === 'regex') {
+                try {
+                    const regex = new RegExp(pattern.pattern, 'gi');
+                    this.compiledPatterns.set(pattern.pattern, regex);
+                }
+                catch (error) {
+                    logger.error({ pattern: pattern.pattern, error }, 'Failed to compile prohibited pattern');
+                }
+            }
+        }
+        // Compile endpoint patterns
+        this.allowedEndpointPatterns = config.allowedExternalEndpoints.map((p) => this.globToRegex(p));
+        this.blockedEndpointPatterns = config.blockedExternalEndpoints.map((p) => this.globToRegex(p));
+        logger.debug({
+            schemas: config.allowedSchemas.length,
+            prohibitedPatterns: config.prohibitedPatterns.length,
+            allowedEndpoints: config.allowedExternalEndpoints.length,
+            blockedEndpoints: config.blockedExternalEndpoints.length,
+        }, 'OutputValidator initialized');
+    }
+    /**
+     * Validate output against allowed schemas
+     *
+     * @param output - Output to validate
+     * @returns Validation result
+     */
+    validateOutput(output) {
+        const startTime = Date.now();
+        try {
+            // If no schemas configured, only check patterns
+            if (this.config.allowedSchemas.length === 0) {
+                const patternScan = this.scanForProhibitedPatterns(this.stringifyOutput(output));
+                if (patternScan.detected) {
+                    return {
+                        valid: false,
+                        reason: `Prohibited patterns detected: ${patternScan.patterns.map((p) => p.description).join(', ')}`,
+                        patternScan,
+                    };
+                }
+                return { valid: true };
+            }
+            // Try to match against each allowed schema
+            for (const [schemaId, validator] of Array.from(this.schemaValidators.entries())) {
+                if (validator(output)) {
+                    // Schema matched, now check for prohibited patterns
+                    const patternScan = this.scanForProhibitedPatterns(this.stringifyOutput(output));
+                    if (patternScan.detected) {
+                        logger.warn({ schemaId, patterns: patternScan.patterns.map((p) => p.description) }, 'Output matched schema but contains prohibited patterns');
+                        return {
+                            valid: false,
+                            schemaId,
+                            reason: `Prohibited patterns detected: ${patternScan.patterns.map((p) => p.description).join(', ')}`,
+                            patternScan,
+                        };
+                    }
+                    logger.debug({ schemaId }, 'Output validated against schema');
+                    return { valid: true, schemaId };
+                }
+            }
+            // No schema matched
+            logger.warn('Output does not match any allowed schema');
+            return {
+                valid: false,
+                reason: 'Output does not match any allowed schema',
+            };
+        }
+        finally {
+            const duration = Date.now() - startTime;
+            logger.debug({ durationMs: duration }, 'Output validation completed');
+        }
+    }
+    /**
+     * Scan content for prohibited patterns
+     *
+     * @param content - Content to scan
+     * @returns Pattern scan result
+     */
+    scanForProhibitedPatterns(content) {
+        const detectedPatterns = [];
+        let maxSeverity = undefined;
+        // Combine configured patterns with built-in patterns
+        const allPatterns = [...this.config.prohibitedPatterns, ...BUILT_IN_PROHIBITED_PATTERNS];
+        for (const pattern of allPatterns) {
+            const matches = this.findPatternMatches(content, pattern);
+            if (matches.length > 0) {
+                detectedPatterns.push({
+                    type: pattern.type,
+                    pattern: pattern.pattern,
+                    description: pattern.description,
+                    matches,
+                    severity: pattern.severity,
+                });
+                // Track maximum severity
+                if (pattern.severity) {
+                    maxSeverity = this.getHigherSeverity(maxSeverity, pattern.severity);
+                }
+            }
+        }
+        return {
+            detected: detectedPatterns.length > 0,
+            patterns: detectedPatterns,
+            severity: maxSeverity,
+        };
+    }
+    /**
+     * Check if an external endpoint is allowed
+     *
+     * @param url - URL to check
+     * @returns Whether the endpoint is allowed
+     */
+    validateExternalEndpoint(url) {
+        // Check blocklist first
+        for (const pattern of this.blockedEndpointPatterns) {
+            if (pattern.test(url)) {
+                logger.debug({ url }, 'External endpoint blocked');
+                return false;
+            }
+        }
+        // If allowlist is empty, allow all (except blocked)
+        if (this.allowedEndpointPatterns.length === 0) {
+            return true;
+        }
+        // Check allowlist
+        for (const pattern of this.allowedEndpointPatterns) {
+            if (pattern.test(url)) {
+                return true;
+            }
+        }
+        logger.debug({ url }, 'External endpoint not in allowlist');
+        return false;
+    }
+    /**
+     * Sanitize output by removing prohibited content
+     *
+     * @param output - Output to sanitize
+     * @returns Sanitized output
+     */
+    sanitizeOutput(output) {
+        const redactions = [];
+        let content = this.stringifyOutput(output);
+        let modified = false;
+        // Apply all prohibited patterns
+        const allPatterns = [...this.config.prohibitedPatterns, ...BUILT_IN_PROHIBITED_PATTERNS];
+        for (const pattern of allPatterns) {
+            if (pattern.type === 'regex') {
+                const regex = this.compiledPatterns.get(pattern.pattern) || new RegExp(pattern.pattern, 'gi');
+                const matches = content.match(regex);
+                if (matches && matches.length > 0) {
+                    content = content.replace(regex, '[REDACTED]');
+                    redactions.push({
+                        type: pattern.type,
+                        description: pattern.description,
+                        count: matches.length,
+                    });
+                    modified = true;
+                }
+            }
+            else if (pattern.type === 'keyword') {
+                const regex = new RegExp(`\\b${this.escapeRegex(pattern.pattern)}\\b`, 'gi');
+                const matches = content.match(regex);
+                if (matches && matches.length > 0) {
+                    content = content.replace(regex, '[REDACTED]');
+                    redactions.push({
+                        type: pattern.type,
+                        description: pattern.description,
+                        count: matches.length,
+                    });
+                    modified = true;
+                }
+            }
+        }
+        // Try to parse back to original type
+        let sanitizedContent;
+        try {
+            sanitizedContent = JSON.parse(content);
+        }
+        catch {
+            sanitizedContent = content;
+        }
+        if (modified) {
+            logger.info({
+                redactionCount: redactions.reduce((sum, r) => sum + r.count, 0),
+                redactionTypes: redactions.map((r) => r.description),
+            }, 'Output sanitized');
+        }
+        return {
+            content: sanitizedContent,
+            modified,
+            redactions,
+        };
+    }
+    /**
+     * Extract all URLs from content
+     *
+     * @param content - Content to scan
+     * @returns Array of extracted URLs
+     */
+    extractUrls(content) {
+        const urlRegex = /https?:\/\/[^\s<>"{}|\\^`[\]]+/gi;
+        const matches = content.match(urlRegex);
+        return matches || [];
+    }
+    /**
+     * Validate all URLs in content against endpoint rules
+     *
+     * @param content - Content to validate
+     * @returns Array of invalid URLs
+     */
+    validateAllUrls(content) {
+        const urls = this.extractUrls(content);
+        return urls.filter((url) => !this.validateExternalEndpoint(url));
+    }
+    /**
+     * Convert a glob pattern to a regex
+     *
+     * @param glob - Glob pattern
+     * @returns Compiled regex
+     */
+    globToRegex(glob) {
+        const escaped = glob
+            .replace(/[.+^${}()|[\]\\]/g, '\\$&') // Escape regex special chars
+            .replace(/\*/g, '.*') // Convert * to .*
+            .replace(/\?/g, '.'); // Convert ? to .
+        return new RegExp(`^${escaped}$`, 'i');
+    }
+    /**
+     * Find all matches for a pattern in content
+     *
+     * @param content - Content to search
+     * @param pattern - Pattern to match
+     * @returns Array of matches
+     */
+    findPatternMatches(content, pattern) {
+        if (pattern.type === 'regex') {
+            const regex = this.compiledPatterns.get(pattern.pattern) || new RegExp(pattern.pattern, 'gi');
+            const matches = content.match(regex);
+            return matches || [];
+        }
+        else if (pattern.type === 'keyword') {
+            const regex = new RegExp(`\\b${this.escapeRegex(pattern.pattern)}\\b`, 'gi');
+            const matches = content.match(regex);
+            return matches || [];
+        }
+        else if (pattern.type === 'semantic') {
+            // Semantic patterns require an ML/NLP embedding model (e.g. sentence-transformers).
+            // Integration point: replace this with a vector similarity search against pattern embeddings.
+            logger.debug({ pattern: pattern.pattern }, 'Semantic pattern matching requires NLP integration');
+            return [];
+        }
+        return [];
+    }
+    /**
+     * Escape special regex characters
+     *
+     * @param str - String to escape
+     * @returns Escaped string
+     */
+    escapeRegex(str) {
+        return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    }
+    /**
+     * Get the higher severity level
+     *
+     * @param a - First severity
+     * @param b - Second severity
+     * @returns Higher severity
+     */
+    getHigherSeverity(a, b) {
+        const order = ['low', 'medium', 'high', 'critical'];
+        const aIndex = a ? order.indexOf(a) : -1;
+        const bIndex = b ? order.indexOf(b) : -1;
+        return aIndex >= bIndex ? a : b;
+    }
+    /**
+     * Convert output to string for scanning
+     *
+     * @param output - Output to stringify
+     * @returns String representation
+     */
+    stringifyOutput(output) {
+        if (typeof output === 'string') {
+            return output;
+        }
+        try {
+            return JSON.stringify(output, null, 2);
+        }
+        catch {
+            return String(output);
+        }
+    }
+}
+/**
+ * Create an OutputValidator with default configuration
+ *
+ * @param additionalPatterns - Additional prohibited patterns to include
+ * @returns OutputValidator with secure defaults
+ */
+export function createDefaultOutputValidator(additionalPatterns = []) {
+    return new OutputValidator({
+        allowedSchemas: [],
+        prohibitedPatterns: [...BUILT_IN_PROHIBITED_PATTERNS, ...additionalPatterns],
+        allowedExternalEndpoints: [],
+        blockedExternalEndpoints: ['*'],
+    });
+}
+//# sourceMappingURL=output-validator.js.map

package/dist/semantic-governance/output-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-validator.js","sourceRoot":"","sources":["../../src/semantic-governance/output-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAUlD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAE/D;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,WAAW;IAC3C,IAAI,GAAG,yBAAyB,CAAC;IACjC,UAAU,GAAG,GAAG,CAAC;IAE1B,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB;IAC/D,kBAAkB;IAClB;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,iBAAiB;QAC9B,QAAQ,EAAE,QAAQ;KACnB;IACD,0BAA0B;IAC1B;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,4BAA4B;QACrC,WAAW,EAAE,+BAA+B;QAC5C,QAAQ,EAAE,UAAU;KACrB;IACD,uCAAuC;IACvC;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,8FAA8F;QACvG,WAAW,EAAE,qBAAqB;QAClC,QAAQ,EAAE,UAAU;KACrB;IACD,4BAA4B;IAC5B;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,8FAA8F;QACvG,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,UAAU;KACrB;IACD,kBAAkB;IAClB;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,oBAAoB;QACjC,QAAQ,EAAE,UAAU;KACrB;IACD,eAAe;IACf;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,6CAA6C;QACtD,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,UAAU;KACrB;IACD,aAAa;IACb;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,2DAA2D;QACpE,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,MAAM;KACjB;IACD,4BAA4B;IAC5B;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,0EAA0E;QACnF,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD,eAAe;IACf;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,kGAAkG;QAC3G,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,KAAK;KAChB;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACT,MAAM,CAAgB;IACtB,GAAG,CAAM;IACT,gBAAgB,CAA0C;IAC1D,gBAAgB,CAAsB;IACtC,uBAAuB,CAAW;IAClC,uBAAuB,CAAW;IAEnD;;;;OAIG;IACH,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,uBAAuB,GAAG,EAAE,CAAC;QAElC,gCAAgC;QAChC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACtD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,iCAAiC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAChD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,sCAAsC,CAAC,CAAC;gBAC5F,CAAC;YACH,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/F,MAAM,CAAC,KAAK,CACV;YACE,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;YACrC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,CAAC,MAAM;YACpD,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC,MAAM;YACxD,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC,MAAM;SACzD,EACD,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAe;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,gDAAgD;YAChD,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjF,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACzB,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,iCAAiC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBACpG,WAAW;qBACZ,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAED,2CAA2C;YAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAChF,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtB,oDAAoD;oBACpD,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;oBACjF,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;wBACzB,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EACtE,wDAAwD,CACzD,CAAC;wBACF,OAAO;4BACL,KAAK,EAAE,KAAK;4BACZ,QAAQ;4BACR,MAAM,EAAE,iCAAiC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;4BACpG,WAAW;yBACZ,CAAC;oBACJ,CAAC;oBAED,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,iCAAiC,CAAC,CAAC;oBAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACnC,CAAC;YACH,CAAC;YAED,oBAAoB;YACpB,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0CAA0C;aACnD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,yBAAyB,CAAC,OAAe;QACvC,MAAM,gBAAgB,GAAkC,EAAE,CAAC;QAC3D,IAAI,WAAW,GAAkC,SAAS,CAAC;QAE3D,qDAAqD;QACrD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,4BAA4B,CAAC,CAAC;QAEzF,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,OAAO;oBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC,CAAC;gBAEH,yBAAyB;gBACzB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACrB,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC;YACrC,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,WAAW;SACtB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,wBAAwB,CAAC,GAAW;QAClC,wBAAwB;QACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,2BAA2B,CAAC,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,kBAAkB;QAClB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAe;QAC5B,MAAM,UAAU,GAAkC,EAAE,CAAC;QACrD,IAAI,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,gCAAgC;QAChC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,4BAA4B,CAAC,CAAC;QAEzF,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC9F,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACrC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;oBAC/C,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,KAAK,EAAE,OAAO,CAAC,MAAM;qBACtB,CAAC,CAAC;oBACH,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACrC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;oBAC/C,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,KAAK,EAAE,OAAO,CAAC,MAAM;qBACtB,CAAC,CAAC;oBACH,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,gBAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,OAAO,CAAC;QAC7B,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT;gBACE,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC/D,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;aACrD,EACD,kBAAkB,CACnB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,QAAQ;YACR,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,OAAe;QACzB,MAAM,QAAQ,GAAG,kCAAkC,CAAC;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,OAAO,IAAI,EAAE,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,OAAe;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,IAAY;QAC9B,MAAM,OAAO,GAAG,IAAI;aACjB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,6BAA6B;aAClE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,kBAAkB;aACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,iBAAiB;QAEzC,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,OAAe,EAAE,OAA0B;QACpE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9F,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,OAAO,OAAO,IAAI,EAAE,CAAC;QACvB,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,OAAO,OAAO,IAAI,EAAE,CAAC;QACvB,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvC,oFAAoF;YACpF,8FAA8F;YAC9F,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,oDAAoD,CAAC,CAAC;YACjG,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,GAAW;QAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CACvB,CAAgC,EAChC,CAAgC;QAEhC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,MAAe;QACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,qBAA0C,EAAE;IACvF,OAAO,IAAI,eAAe,CAAC;QACzB,cAAc,EAAE,EAAE;QAClB,kBAAkB,EAAE,CAAC,GAAG,4BAA4B,EAAE,GAAG,kBAAkB,CAAC;QAC5E,wBAAwB,EAAE,EAAE;QAC5B,wBAAwB,EAAE,CAAC,GAAG,CAAC;KAChC,CAAC,CAAC;AACL,CAAC"}