@vurb/core 3.2.0

package/dist/introspection/CryptoAttestation.js

@@ -0,0 +1,192 @@
+// Bug #55: Lazy resolution instead of top-level await (breaks CJS consumers)
+let _subtle;
+async function getSubtle() {
+    if (_subtle)
+        return _subtle;
+    _subtle = globalThis.crypto?.subtle
+        ?? (await import('node:crypto')).webcrypto.subtle;
+    return _subtle;
+}
+// ============================================================================
+// HMAC Signer (Built-in)
+// ============================================================================
+/**
+ * Create an HMAC-SHA256 signer from a shared secret.
+ *
+ * @param secret - The shared secret (should be ≥32 bytes)
+ * @returns An `AttestationSigner` using HMAC-SHA256
+ */
+export function createHmacSigner(secret) {
+    return {
+        name: 'hmac-sha256',
+        async sign(digest) {
+            return hmacSign(digest, secret);
+        },
+        async verify(digest, signature) {
+            const expected = await hmacSign(digest, secret);
+            return timingSafeCompare(expected, signature);
+        },
+    };
+}
+// ============================================================================
+// Attestation Operations
+// ============================================================================
+/**
+ * Sign a server digest and produce an attestation result.
+ *
+ * @param serverDigest - The server's behavioral digest
+ * @param config - Zero-trust configuration
+ * @returns Attestation result with signature
+ */
+export async function attestServerDigest(serverDigest, config) {
+    const signer = resolveSigner(config);
+    const signature = await signer.sign(serverDigest.digest);
+    const attestedAt = new Date().toISOString();
+    // Verify against expected digest if configured
+    if (config.expectedDigest) {
+        const matches = serverDigest.digest === config.expectedDigest;
+        return {
+            valid: matches,
+            computedDigest: serverDigest.digest,
+            expectedDigest: config.expectedDigest,
+            signature,
+            signerName: signer.name,
+            attestedAt,
+            error: matches ? null : `Attestation failed: computed digest ${serverDigest.digest} does not match expected ${config.expectedDigest}`,
+        };
+    }
+    return {
+        valid: true,
+        computedDigest: serverDigest.digest,
+        expectedDigest: null,
+        signature,
+        signerName: signer.name,
+        attestedAt,
+        error: null,
+    };
+}
+/**
+ * Verify a previously signed attestation.
+ *
+ * @param serverDigest - The current server digest
+ * @param signature - The signature to verify
+ * @param config - Zero-trust configuration
+ * @returns Attestation result with verification status
+ */
+export async function verifyAttestation(serverDigest, signature, config) {
+    const signer = resolveSigner(config);
+    const verified = await signer.verify(serverDigest.digest, signature);
+    const attestedAt = new Date().toISOString();
+    return {
+        valid: verified,
+        computedDigest: serverDigest.digest,
+        expectedDigest: config.expectedDigest ?? null,
+        signature,
+        signerName: signer.name,
+        attestedAt,
+        error: verified ? null : `Signature verification failed for digest ${serverDigest.digest}`,
+    };
+}
+/**
+ * Runtime capability pinning — check that the current digest
+ * matches what was attested at build time.
+ *
+ * Designed to be called once at server startup in the `attach()` flow.
+ *
+ * @param currentDigest - Re-computed server digest
+ * @param config - Zero-trust configuration
+ * @returns Attestation result
+ * @throws If `failOnMismatch` is true and the digest doesn't match
+ */
+export async function verifyCapabilityPin(currentDigest, config) {
+    const result = await attestServerDigest(currentDigest, config);
+    if (!result.valid && (config.failOnMismatch ?? true)) {
+        throw new AttestationError(`[Vurb] Zero-Trust attestation failed: ${result.error}`, result);
+    }
+    return result;
+}
+/**
+ * Build the `vurbTrust` capability object for MCP exposure.
+ *
+ * @param attestation - A completed attestation result
+ * @param toolCount - Number of tools in the registry
+ * @returns Capability structure for `server.capabilities`
+ */
+export function buildTrustCapability(attestation, toolCount) {
+    return {
+        serverDigest: attestation.computedDigest,
+        signature: attestation.signature,
+        signerName: attestation.signerName,
+        attestedAt: attestation.attestedAt,
+        toolCount,
+        verified: attestation.valid,
+    };
+}
+// ============================================================================
+// Attestation Error
+// ============================================================================
+/**
+ * Error thrown when zero-trust attestation fails with failOnMismatch.
+ *
+ * Carries the full `AttestationResult` for programmatic inspection.
+ */
+export class AttestationError extends Error {
+    attestation;
+    constructor(message, attestation) {
+        super(message);
+        this.name = 'AttestationError';
+        this.attestation = attestation;
+    }
+}
+// ============================================================================
+// Internals
+// ============================================================================
+/**
+ * Resolve the signer from config.
+ * @internal
+ */
+function resolveSigner(config) {
+    if (config.signer === 'hmac') {
+        if (!config.secret) {
+            throw new Error('[Vurb] HMAC signer requires a secret. Set zeroTrust.secret or use a custom signer.');
+        }
+        return createHmacSigner(config.secret);
+    }
+    return config.signer;
+}
+/**
+ * HMAC-SHA256 sign using Web Crypto API.
+ * @internal
+ */
+async function hmacSign(data, secret) {
+    const encoder = new TextEncoder();
+    const keyData = encoder.encode(secret);
+    const msgData = encoder.encode(data);
+    const subtle = await getSubtle();
+    const key = await subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await subtle.sign('HMAC', key, msgData);
+    return Array.from(new Uint8Array(signature))
+        .map(b => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Constant-time string comparison to prevent timing attacks.
+ *
+ * Compares byte-by-byte using XOR accumulation — the comparison
+ * always processes all bytes regardless of where differences occur.
+ * @internal
+ */
+function timingSafeCompare(a, b) {
+    const encoder = new TextEncoder();
+    const bufA = encoder.encode(a);
+    const bufB = encoder.encode(b);
+    // Constant-time: always process max(lenA, lenB) bytes.
+    // Length mismatch contributes to diff but does NOT cause early return.
+    const maxLen = Math.max(bufA.length, bufB.length);
+    let diff = bufA.length ^ bufB.length; // length mismatch is a difference
+    for (let i = 0; i < maxLen; i++) {
+        diff |= (bufA[i] ?? 0) ^ (bufB[i] ?? 0);
+    }
+    return diff === 0;
+}
+//# sourceMappingURL=CryptoAttestation.js.map

package/dist/introspection/CryptoAttestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoAttestation.js","sourceRoot":"","sources":["../../src/introspection/CryptoAttestation.ts"],"names":[],"mappings":"AAiCA,6EAA6E;AAC7E,IAAI,OAAiC,CAAC;AACtC,KAAK,UAAU,SAAS;IACpB,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM;WAC5B,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,MAAsB,CAAC;IACtE,OAAO,OAAO,CAAC;AACnB,CAAC;AAsGD,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC3C,OAAO;QACH,IAAI,EAAE,aAAa;QACnB,KAAK,CAAC,IAAI,CAAC,MAAc;YACrB,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,SAAiB;YAC1C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChD,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;KACJ,CAAC;AACN,CAAC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,YAA0B,EAC1B,MAAuB;IAEvB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5C,+CAA+C;IAC/C,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,KAAK,MAAM,CAAC,cAAc,CAAC;QAC9D,OAAO;YACH,KAAK,EAAE,OAAO;YACd,cAAc,EAAE,YAAY,CAAC,MAAM;YACnC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,UAAU;YACV,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,uCAAuC,YAAY,CAAC,MAAM,4BAA4B,MAAM,CAAC,cAAc,EAAE;SACxI,CAAC;IACN,CAAC;IAED,OAAO;QACH,KAAK,EAAE,IAAI;QACX,cAAc,EAAE,YAAY,CAAC,MAAM;QACnC,cAAc,EAAE,IAAI;QACpB,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,UAAU;QACV,KAAK,EAAE,IAAI;KACd,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,YAA0B,EAC1B,SAAiB,EACjB,MAAuB;IAEvB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5C,OAAO;QACH,KAAK,EAAE,QAAQ;QACf,cAAc,EAAE,YAAY,CAAC,MAAM;QACnC,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;QAC7C,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,UAAU;QACV,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,4CAA4C,YAAY,CAAC,MAAM,EAAE;KAC7F,CAAC;AACN,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,aAA2B,EAC3B,MAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAE/D,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,gBAAgB,CACtB,yCAAyC,MAAM,CAAC,KAAK,EAAE,EACvD,MAAM,CACT,CAAC;IACN,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAChC,WAA8B,EAC9B,SAAiB;IAEjB,OAAO;QACH,YAAY,EAAE,WAAW,CAAC,cAAc;QACxC,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,SAAS;QACT,QAAQ,EAAE,WAAW,CAAC,KAAK;KAC9B,CAAC;AACN,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAC9B,WAAW,CAAoB;IAExC,YAAY,OAAe,EAAE,WAA8B;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;CACJ;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAuB;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAc;IAChD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAC9B,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjD,KAAK,EAAE,CAAC,MAAM,CAAC,CAClB,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACzC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE/B,uDAAuD;IACvD,uEAAuE;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,kCAAkC;IACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACtB,CAAC"}

package/dist/introspection/EntitlementScanner.d.ts

@@ -0,0 +1,177 @@
+/**
+ * EntitlementScanner — Hardened Multi-Layer Blast Radius Analysis
+ *
+ * **Evolution 5: Blast Radius**
+ *
+ * Performs static analysis of handler source files to detect
+ * I/O capabilities (filesystem, network, subprocess, crypto,
+ * code evaluation) that expand the tool's blast radius beyond
+ * what its declarative contract suggests.
+ *
+ * **Key insight**: A tool declared as `readOnly: true` that
+ * imports `child_process` has a mismatch between its declared
+ * contract and its actual capabilities. This scanner detects
+ * such mismatches and reports them as entitlement violations.
+ *
+ * **Multi-layer defense**:
+ *
+ * 1. **Pattern detection** — Regex-based pattern matching for
+ *    known I/O APIs across 5 categories. Conservative: may
+ *    over-report but never under-report.
+ *
+ * 2. **Code evaluation detection** — Detects `eval()`,
+ *    `new Function()`, `vm` module, indirect eval, and other
+ *    dynamic code execution vectors.
+ *
+ * 3. **Evasion heuristics** — Detects techniques commonly used
+ *    to bypass static analysis: `String.fromCharCode()`,
+ *    bracket-notation global access, computed require/import,
+ *    high encoding density, and entropy anomalies in string
+ *    literals.
+ *
+ * The evasion layer does NOT try to determine what obfuscated
+ * code does — it flags the *presence of obfuscation itself*
+ * as a security concern. Code that hides its intent is
+ * inherently untrustworthy.
+ *
+ * **Contract integration**: The entitlement report is embedded
+ * in the `ToolContract.entitlements` field, making entitlement
+ * changes trackable via `ContractDiff`.
+ *
+ * Pure-function module: no state, no side effects.
+ *
+ * @module
+ */
+import type { HandlerEntitlements } from './ToolContract.js';
+/**
+ * Complete entitlement report for a handler.
+ */
+export interface EntitlementReport {
+    /** Resolved entitlements */
+    readonly entitlements: HandlerEntitlements;
+    /** All detected entitlement matches */
+    readonly matches: readonly EntitlementMatch[];
+    /** Entitlement violations (declared vs detected mismatches) */
+    readonly violations: readonly EntitlementViolation[];
+    /** Evasion indicators — patterns suggesting intentional detection bypass */
+    readonly evasionIndicators: readonly EvasionIndicator[];
+    /** Whether the handler is considered safe */
+    readonly safe: boolean;
+    /** Human-readable summary */
+    readonly summary: string;
+}
+/**
+ * A single entitlement match detected in source code.
+ */
+export interface EntitlementMatch {
+    /** Which entitlement category */
+    readonly category: EntitlementCategory;
+    /** The specific API/import detected */
+    readonly identifier: string;
+    /** Pattern that matched */
+    readonly pattern: string;
+    /** Source text (context around the match) */
+    readonly context: string;
+    /** Line number in the source (1-based) */
+    readonly line: number;
+}
+/**
+ * An entitlement violation — mismatch between declaration and detection.
+ */
+export interface EntitlementViolation {
+    /** Which entitlement is violated */
+    readonly category: EntitlementCategory;
+    /** What was declared (e.g., readOnly: true) */
+    readonly declared: string;
+    /** What was detected */
+    readonly detected: string;
+    /** Severity */
+    readonly severity: 'warning' | 'error';
+    /** Human-readable description */
+    readonly description: string;
+}
+/** Entitlement categories */
+export type EntitlementCategory = 'filesystem' | 'network' | 'subprocess' | 'crypto' | 'codeEvaluation';
+/**
+ * Declaration claims for validation against detected entitlements.
+ */
+export interface EntitlementClaims {
+    /** Whether the action is declared as readOnly */
+    readonly readOnly?: boolean;
+    /** Whether the action is declared as destructive */
+    readonly destructive?: boolean;
+    /** Explicitly allowed entitlements (bypasses violation detection) */
+    readonly allowed?: readonly EntitlementCategory[];
+}
+/**
+ * Evasion indicator — suspicious pattern suggesting intentional
+ * static-analysis bypass.
+ *
+ * Evasion indicators do NOT identify a specific I/O capability.
+ * Instead, they flag *techniques* commonly used to hide intent:
+ * string construction, bracket-notation access, computed imports,
+ * high-entropy payloads, and dense hex/unicode escape sequences.
+ */
+export interface EvasionIndicator {
+    /** Type of evasion technique detected */
+    readonly type: EvasionType;
+    /** Confidence level — high confidence makes handler UNSAFE */
+    readonly confidence: 'low' | 'medium' | 'high';
+    /** Human-readable description */
+    readonly description: string;
+    /** Source context around the match */
+    readonly context: string;
+    /** Line number (1-based) */
+    readonly line: number;
+}
+/** Evasion technique categories */
+export type EvasionType = 'string-construction' | 'indirect-access' | 'computed-import' | 'encoding-density' | 'entropy-anomaly';
+/**
+ * Scan source text for entitlement patterns.
+ *
+ * @param source - The source code text to scan
+ * @param fileName - File name for reporting (optional)
+ * @returns All entitlement matches found
+ */
+export declare function scanSource(source: string, fileName?: string): readonly EntitlementMatch[];
+/**
+ * Scan source for evasion indicators.
+ *
+ * This is a secondary analysis pass that detects patterns
+ * commonly associated with intentional static-analysis bypass.
+ * Unlike `scanSource`, which identifies specific I/O capabilities,
+ * this function flags *evasion techniques* regardless of what
+ * they ultimately execute.
+ *
+ * @param source - Source code text
+ * @returns Detected evasion indicators
+ */
+export declare function scanEvasionIndicators(source: string): readonly EvasionIndicator[];
+/**
+ * Build `HandlerEntitlements` from detected matches.
+ *
+ * @param matches - Detected entitlement matches
+ * @returns Aggregated entitlements
+ */
+export declare function buildEntitlements(matches: readonly EntitlementMatch[]): HandlerEntitlements;
+/**
+ * Validate detected entitlements against declared claims.
+ *
+ * Uses a rule table instead of imperative branching.
+ * Each rule encodes a policy check as pure data.
+ *
+ * @param matches - Detected matches
+ * @param claims - Declared claims from action metadata
+ * @returns Violations found
+ */
+export declare function validateClaims(matches: readonly EntitlementMatch[], claims: EntitlementClaims): readonly EntitlementViolation[];
+/**
+ * Perform a complete entitlement scan and validation.
+ *
+ * @param source - Handler source code
+ * @param claims - Declared claims for validation
+ * @param fileName - Optional file name for reporting
+ * @returns Complete entitlement report
+ */
+export declare function scanAndValidate(source: string, claims?: EntitlementClaims, fileName?: string): EntitlementReport;
+//# sourceMappingURL=EntitlementScanner.d.ts.map

package/dist/introspection/EntitlementScanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EntitlementScanner.d.ts","sourceRoot":"","sources":["../../src/introspection/EntitlementScanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAM7D;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAC9B,4BAA4B;IAC5B,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,uCAAuC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wBAAwB;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,eAAe;IACf,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,OAAO,CAAC;IACvC,iCAAiC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAChC;AAED,6BAA6B;AAC7B,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,gBAAgB,CAAC;AAExG;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACrD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC/C,iCAAiC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,MAAM,WAAW,GACjB,qBAAqB,GACrB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,CAAC;AAmLxB;;;;;;GAMG;AACH,wBAAgB,UAAU,CACtB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAClB,SAAS,gBAAgB,EAAE,CAyB7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,gBAAgB,EAAE,CA6DjF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC7B,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACrC,mBAAmB,CAYrB;AAwGD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC1B,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,MAAM,EAAE,iBAAiB,GAC1B,SAAS,oBAAoB,EAAE,CAOjC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,iBAAsB,EAC9B,QAAQ,CAAC,EAAE,MAAM,GAClB,iBAAiB,CAmBnB"}