@zhin.js/agent 1.1.30 → 1.1.32

package/lib/security/outbound-leak-guard.js

@@ -0,0 +1,145 @@
+const MASKS = Object.freeze({
+    system_prompt: '[已隐藏：系统提示内容]',
+    secret: '[已隐藏：密钥]',
+    other_session_memory: '[已隐藏：其他会话的记忆]',
+});
+/** Prompt lines shorter than this are too generic to count as a leak. */
+const MIN_PROMPT_LINE = 24;
+/** Memory lines shorter than this are too generic to count as a leak. */
+const MIN_MEMORY_LINE = 12;
+/** Environment values shorter than this are not treated as secrets. */
+const MIN_SECRET_VALUE = 12;
+const SECRET_PATTERNS = [
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    /\b(?:sk|pk|rk)-[A-Za-z0-9_-]{16,}/g,
+    /\b(?:ghp|gho|ghs|ghu|github_pat)_[A-Za-z0-9_]{20,}/g,
+    /\bxox[abpr]-[A-Za-z0-9-]{10,}/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\bAIza[0-9A-Za-z_-]{35}\b/g,
+    /\b(?:bearer)\s+[A-Za-z0-9._~+/=-]{20,}/gi,
+];
+const LINE_NUMBER_PREFIX = /^\s*\d+\s*(?:→|\||:|\t)\s?/;
+const MARKDOWN_PREFIX = /^\s*(?:[-*+]\s+(?:\[[ xX]\]\s+)?|#{1,6}\s+|>\s+|\d+\.\s+)/;
+const SECRET_ENV_NAME = /(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL)/i;
+/** Values of secret-looking environment variables, for exact-match masking. */
+export function collectEnvironmentSecrets(env = process.env) {
+    return Object.entries(env)
+        .filter(([name, value]) => SECRET_ENV_NAME.test(name) && typeof value === 'string' && value.length >= MIN_SECRET_VALUE)
+        .map(([, value]) => value);
+}
+/** Per-turn inspector; other-session memory lines are added as the turn reads them. */
+export class OutboundLeakInspector {
+    #promptLines;
+    #secretValues;
+    #memoryLines = new Set();
+    constructor(options = {}) {
+        this.#promptLines = uniqueLines(options.promptTexts ?? [], MIN_PROMPT_LINE);
+        this.#secretValues = [...new Set(options.secretValues ?? collectEnvironmentSecrets())]
+            .filter((value) => value.length >= MIN_SECRET_VALUE)
+            .sort((left, right) => right.length - left.length);
+    }
+    /** Marks text read from another session's memory as private to that session. */
+    protectOtherSessionMemory(text) {
+        // File tools prefix lines with numbers ("12 | ") and notes use list markers; the model echoes the text only.
+        const plain = text
+            .split(/\r?\n/)
+            .map((line) => line.replace(LINE_NUMBER_PREFIX, '').replace(MARKDOWN_PREFIX, ''))
+            .join('\n');
+        for (const line of uniqueLines([plain], MIN_MEMORY_LINE))
+            this.#memoryLines.add(line);
+    }
+    inspect(text) {
+        const findings = [];
+        let result = text;
+        const mask = (kind, apply) => {
+            const [next, count] = apply(result);
+            if (count > 0)
+                findings.push(Object.freeze({ kind, count }));
+            result = next;
+        };
+        mask('secret', (current) => {
+            let count = 0;
+            let next = current;
+            for (const value of this.#secretValues)
+                [next, count] = replaceLiteral(next, value, MASKS.secret, count);
+            for (const pattern of SECRET_PATTERNS) {
+                next = next.replace(pattern, () => {
+                    count += 1;
+                    return MASKS.secret;
+                });
+            }
+            return [next, count];
+        });
+        mask('system_prompt', (current) => replaceLines(current, this.#promptLines, MASKS.system_prompt));
+        mask('other_session_memory', (current) => replaceLines(current, [...this.#memoryLines], MASKS.other_session_memory));
+        return Object.freeze({ text: result, findings: Object.freeze(findings) });
+    }
+    /** Inspects the text elements of an outbound message. */
+    inspectOutput(output) {
+        const findings = [];
+        const next = output.map((element) => {
+            if (element.type !== 'text')
+                return element;
+            const inspection = this.inspect(element.content);
+            if (inspection.findings.length === 0)
+                return element;
+            findings.push(...inspection.findings);
+            return { ...element, content: inspection.text };
+        });
+        return Object.freeze({ output: findings.length > 0 ? Object.freeze(next) : output, findings: Object.freeze(findings) });
+    }
+    /** Inspects the string arguments of an outbound tool call. */
+    inspectArguments(input) {
+        const findings = [];
+        const next = {};
+        for (const [key, value] of Object.entries(input)) {
+            if (typeof value !== 'string') {
+                next[key] = value;
+                continue;
+            }
+            const inspection = this.inspect(value);
+            findings.push(...inspection.findings);
+            next[key] = inspection.text;
+        }
+        return Object.freeze({ input: findings.length > 0 ? Object.freeze(next) : input, findings: Object.freeze(findings) });
+    }
+}
+/**
+ * Send-chain step for the turn's ReplyPort: masks leaks, reports them, then
+ * delegates to the real port unchanged.
+ */
+export function guardReplyPort(port, inspector, onFindings) {
+    return Object.freeze({
+        async send(output) {
+            const inspected = inspector.inspectOutput(output);
+            if (inspected.findings.length > 0)
+                onFindings?.(inspected.findings);
+            return port.send(inspected.output);
+        },
+    });
+}
+function uniqueLines(texts, minLength) {
+    const lines = new Set();
+    for (const text of texts) {
+        for (const raw of text.split(/\r?\n/)) {
+            const line = raw.trim();
+            if (line.length >= minLength)
+                lines.add(line);
+        }
+    }
+    return [...lines].sort((left, right) => right.length - left.length);
+}
+function replaceLines(text, lines, replacement) {
+    let count = 0;
+    let next = text;
+    for (const line of lines)
+        [next, count] = replaceLiteral(next, line, replacement, count);
+    return [next, count];
+}
+function replaceLiteral(text, needle, replacement, count) {
+    if (!needle || !text.includes(needle))
+        return [text, count];
+    const parts = text.split(needle);
+    return [parts.join(replacement), count + parts.length - 1];
+}
+//# sourceMappingURL=outbound-leak-guard.js.map

package/lib/security/outbound-leak-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-leak-guard.js","sourceRoot":"","sources":["../../src/security/outbound-leak-guard.ts"],"names":[],"mappings":"AAiCA,MAAM,KAAK,GAAuC,MAAM,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,cAAc;IAC7B,MAAM,EAAE,UAAU;IAClB,oBAAoB,EAAE,eAAe;CACtC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,yEAAyE;AACzE,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,MAAM,eAAe,GAAsB;IACzC,6EAA6E;IAC7E,oCAAoC;IACpC,qDAAqD;IACrD,gCAAgC;IAChC,uBAAuB;IACvB,4BAA4B;IAC5B,0CAA0C;CAC3C,CAAC;AAEF,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAExD,MAAM,eAAe,GAAG,2DAA2D,CAAC;AAEpF,MAAM,eAAe,GAAG,kDAAkD,CAAC;AAE3E,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;SACtH,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAe,CAAC,CAAC;AACzC,CAAC;AASD,uFAAuF;AACvF,MAAM,OAAO,qBAAqB;IACvB,YAAY,CAAoB;IAChC,aAAa,CAAoB;IACjC,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,YAAY,UAAwC,EAAE;QACpD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,yBAAyB,EAAE,CAAC,CAAC;aACnF,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;aACnD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,gFAAgF;IAChF,yBAAyB,CAAC,IAAY;QACpC,6GAA6G;QAC7G,MAAM,KAAK,GAAG,IAAI;aACf,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;aAChF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,KAA4C,EAAE,EAAE;YAC5E,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;YACzB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,IAAI,GAAG,OAAO,CAAC;YACnB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa;gBAAE,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzG,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;oBAChC,KAAK,IAAI,CAAC,CAAC;oBACX,OAAO,KAAK,CAAC,MAAM,CAAC;gBACtB,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,sBAAsB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACrH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,yDAAyD;IACzD,aAAa,CAAC,MAAgC;QAC5C,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,OAAO,CAAC;YAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,8DAA8D;IAC9D,gBAAgB,CAAC,KAAwC;QACvD,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAe,EACf,SAAgC,EAChC,UAAuD;IAEvD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,MAAgC;YACzC,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,UAAU,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB,EAAE,SAAiB;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAwB,EAAE,WAAmB;IAC/E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACzF,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,WAAmB,EAAE,KAAa;IACtF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/lib/security/policy-facade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-facade.d.ts","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAQ1D,OAAO,EAKL,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAM/F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAK3D,MAAM,WAAW,eAAe;IAC9B,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sBAAsB;IACtB,MAAM,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnC,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,iBAAiB,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,kFAAkF;IAClF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB;IAChB,SAAS,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CACjD;AAED,MAAM,MAAM,sBAAsB,GAC9B,QAAQ,CAAC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,GACzE,QAAQ,CAAC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9D,QAAQ,CAAC;IAAE,MAAM,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC;AAExH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,gFAAgF;AAChF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAgHrG;AAiHD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;IACzC,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,CAAC,qBAAqB,CAAC,GAAG,kBAAkB,CAAC;CAChG;AAyND;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAWxE;AAID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,SAAK,GAAG,MAAM,GAAG,IAAI,CA4BhG"}
+{"version":3,"file":"policy-facade.d.ts","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAc1D,OAAO,EAKL,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAM/F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAK3D,MAAM,WAAW,eAAe;IAC9B,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sBAAsB;IACtB,MAAM,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnC,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,iBAAiB,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,kFAAkF;IAClF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB;IAChB,SAAS,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CACjD;AAED,MAAM,MAAM,sBAAsB,GAC9B,QAAQ,CAAC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,GACzE,QAAQ,CAAC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9D,QAAQ,CAAC;IAAE,MAAM,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC;AAExH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,gFAAgF;AAChF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAwHrG;AAiHD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;IACzC,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,CAAC,qBAAqB,CAAC,GAAG,kBAAkB,CAAC;CAChG;AAyND;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAWxE;AAID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,SAAK,GAAG,MAAM,GAAG,IAAI,CA4BhG"}

package/lib/security/policy-facade.js

@@ -16,6 +16,7 @@
  * read 类工具由文件权限矩阵和显式 devicePathGuard 约束。
  */
 import { checkMemoryWritePath } from '../memory-layers.js';
+import { TRUST_LEVEL_POLICY, TRUST_RESTRICTION_REASON, isToolAboveTrust, resolveTurnTrustLevel, } from './trust-level.js';
 import { checkFileAccess, checkBashCommandSafety, extractBashReadPaths, isBlockedDevicePath, } from './file-policy.js';
 import { checkBashFilePermission, checkFilePermission, formatFilePermissionMessage, toolRequesterRoleToFileRole, } from './file-role-policy.js';
 import { checkBashSensitiveReadAccess, checkDangerousToolAccess, checkFileToolAccess, checkSensitiveFilePathAccess, toDenyError, toOwnerSignal, } from './dangerous-tool-policy.js';
@@ -26,6 +27,14 @@ import { authorizeTurnFileInput } from './turn-file-authority.js';
 /** Generic, execution-domain-neutral policy facade for canonical Turn tools. */
 export async function runTurnToolPolicies(input) {
     const requesterRole = resolveTurnRequesterRole(input.turn);
+    // Defense in depth for #726: also covers tools that reach a turn later (e.g. deferred loads).
+    if (isToolAboveTrust(input.tool, resolveTurnTrustLevel(input.turn))) {
+        return Object.freeze({
+            status: 'denied',
+            policy: TRUST_LEVEL_POLICY,
+            reason: TRUST_RESTRICTION_REASON,
+        });
+    }
     const networkDecision = checkTurnNetworkPolicy(input);
     if (networkDecision)
         return networkDecision;

package/lib/security/policy-facade.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-facade.js","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,4BAA4B,EAC5B,WAAW,EACX,aAAa,GAGd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAE,wBAAwB,EAA0B,MAAM,6BAA6B,CAAC;AAC/F,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAgElE,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA0B;IAClE,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,KAAK,CAAC,IAAI,CAAC,IAAI,EACf,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,mBAAmB,CACpC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,aAAa,EACb,IAAI,CACL,CAAC;QACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;QACnG,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YACrF,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,gCAAgC,aAAa,iBAAiB;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,MAAM,EACN,eAAe,EACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,eAAe,GAAG,YAAY,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAChF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,qBAAqB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,SAAS;qBACpF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,OAAO,MAAM,CAAC,MAAM,CAAC;4BACnB,MAAM,EAAE,mBAAmB;4BAC3B,MAAM,EAAE,aAAa;4BACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,iCAAiC;4BACxD,KAAK,EAAE,eAAe;yBACvB,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,sBAAsB;qBAC9C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,qBAAqB;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,qBAAqB;iBAC/C,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,MAAM,aAAa,GAAG,mBAAmB,CACvC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,MAAM,EACN,IAAI,CACL,CAAC;gBACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,aAAa,EAAE,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC/F,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;YACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;YAChG,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;YACjG,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBACrI,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,kBAAkB;oBAC1B,MAAM,EAAE,sCAAsC,UAAU,CAAC,aAAa,iBAAiB;iBACxF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,2BAA2B,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAChE,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAoB;IACvD,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,QAAQ,KAAK,MAAM;WACrB,QAAQ,KAAK,WAAW;WACxB,QAAQ,KAAK,YAAY;WACzB,wBAAwB,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAA0B;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;IAC1F,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,+BAA+B;SACxC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;QAC1C,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC,CAAC,OAAO;YACP,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,gBAAgB,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE;YAC1C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,uBAAuB;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAgC,EAChC,MAAc,EACd,KAAwC;IAExC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,oBAAoB;YAC7E,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;WACzE,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CACrB,KAAwC,EACxC,GAAG,KAAwB;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AACtG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,0DAA0D;AAC1D,SAAS,oBAAoB,CAAC,KAAsB;IAClD,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gDAAgD;AAChD,SAAS,aAAa,CAAC,KAAsB;IAC3C,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAwB;IACrD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,0BAA0B,CAAC,KAAsB;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,aAAa,GAAsB,cAAc,CAAC;IACtD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;QACpE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAW,EAAE;gBACtD,SAAS,EAAE,KAAK,CAAC,aAAc,CAAC,SAAS;gBACzC,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAc,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;aACjE,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7E,CAAC;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,uDAAuD;YACvD,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACvG,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC1E,CAAC;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAC1B,wBAAwB,CAAC,KAAK,CAAC,QAAoD,EAAE,KAAK,CAAC,WAAW,CAAC,CACxG,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CACrC,4BAA4B,CAAC,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CACpF;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,SAAS;QAC7D,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAsB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;YAC9E,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,2BAA2B,CAAC,aAAa,CAAC;wBAChD,SAAS;qBACqB;iBACjC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjG,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,aAAa,GACjB,KAAK,CAAC,WAAW;gBACf,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC7C,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,IAAI,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YACvF,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,qBAAqB,CACnB,4BAA4B,CAC1B,KAAK,CAAC,QAAwB,EAC9B,KAAK,CAAC,QAAS,EACf,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,CACnB,CACF;KACJ;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;QACvG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACpE,iCAAiC;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,aAAa,KAAK,CAAC,QAAS,EAAE;gBAChC,CAAC,CAAC,YAAY,KAAK,CAAC,QAAS,gBAAgB,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAO,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAChH,CAAC;KACF;CACF,CAAC,CAAC;AAEH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,sDAAsD;AAEtD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAwB,EAAE,QAAQ,GAAG,EAAE;IAC/E,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC9D,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,wBAAwB,CAAC;QAC9B,KAAK,sBAAsB;YACzB,4DAA4D;YAC5D,OAAO,2BAA2B,CAAC,MAAM,CAAC,OAA+B,EAAE,QAAQ,CAAC,CAAC;QACvF,KAAK,mBAAmB;YACtB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,qBAAqB;YACxB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,kBAAkB;YACrB,OAAO,sBAAsB,MAAM,CAAC,MAAO,0CAA0C,CAAC;QACxF,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE;gBAC5D,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC;YACR,oFAAoF;YACpF,MAAM,QAAQ,GAA0B;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC;YACF,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"policy-facade.js","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,4BAA4B,EAC5B,WAAW,EACX,aAAa,GAGd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAE,wBAAwB,EAA0B,MAAM,6BAA6B,CAAC;AAC/F,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAgElE,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA0B;IAClE,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,8FAA8F;IAC9F,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,wBAAwB;SACjC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,KAAK,CAAC,IAAI,CAAC,IAAI,EACf,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,mBAAmB,CACpC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,aAAa,EACb,IAAI,CACL,CAAC;QACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;QACnG,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YACrF,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,gCAAgC,aAAa,iBAAiB;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,MAAM,EACN,eAAe,EACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,eAAe,GAAG,YAAY,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAChF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,qBAAqB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,SAAS;qBACpF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,OAAO,MAAM,CAAC,MAAM,CAAC;4BACnB,MAAM,EAAE,mBAAmB;4BAC3B,MAAM,EAAE,aAAa;4BACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,iCAAiC;4BACxD,KAAK,EAAE,eAAe;yBACvB,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,sBAAsB;qBAC9C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,qBAAqB;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,qBAAqB;iBAC/C,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,MAAM,aAAa,GAAG,mBAAmB,CACvC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,MAAM,EACN,IAAI,CACL,CAAC;gBACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,aAAa,EAAE,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC/F,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;YACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;YAChG,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;YACjG,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBACrI,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,kBAAkB;oBAC1B,MAAM,EAAE,sCAAsC,UAAU,CAAC,aAAa,iBAAiB;iBACxF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,2BAA2B,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAChE,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAoB;IACvD,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,QAAQ,KAAK,MAAM;WACrB,QAAQ,KAAK,WAAW;WACxB,QAAQ,KAAK,YAAY;WACzB,wBAAwB,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAA0B;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;IAC1F,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,+BAA+B;SACxC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;QAC1C,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC,CAAC,OAAO;YACP,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,gBAAgB,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE;YAC1C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,uBAAuB;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAgC,EAChC,MAAc,EACd,KAAwC;IAExC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,oBAAoB;YAC7E,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;WACzE,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CACrB,KAAwC,EACxC,GAAG,KAAwB;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AACtG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,0DAA0D;AAC1D,SAAS,oBAAoB,CAAC,KAAsB;IAClD,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gDAAgD;AAChD,SAAS,aAAa,CAAC,KAAsB;IAC3C,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAwB;IACrD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,0BAA0B,CAAC,KAAsB;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,aAAa,GAAsB,cAAc,CAAC;IACtD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;QACpE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAW,EAAE;gBACtD,SAAS,EAAE,KAAK,CAAC,aAAc,CAAC,SAAS;gBACzC,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAc,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;aACjE,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7E,CAAC;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,uDAAuD;YACvD,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACvG,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC1E,CAAC;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAC1B,wBAAwB,CAAC,KAAK,CAAC,QAAoD,EAAE,KAAK,CAAC,WAAW,CAAC,CACxG,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CACrC,4BAA4B,CAAC,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CACpF;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,SAAS;QAC7D,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAsB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;YAC9E,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,2BAA2B,CAAC,aAAa,CAAC;wBAChD,SAAS;qBACqB;iBACjC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjG,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,aAAa,GACjB,KAAK,CAAC,WAAW;gBACf,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC7C,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,IAAI,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YACvF,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,qBAAqB,CACnB,4BAA4B,CAC1B,KAAK,CAAC,QAAwB,EAC9B,KAAK,CAAC,QAAS,EACf,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,CACnB,CACF;KACJ;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;QACvG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACpE,iCAAiC;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,aAAa,KAAK,CAAC,QAAS,EAAE;gBAChC,CAAC,CAAC,YAAY,KAAK,CAAC,QAAS,gBAAgB,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAO,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAChH,CAAC;KACF;CACF,CAAC,CAAC;AAEH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,sDAAsD;AAEtD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAwB,EAAE,QAAQ,GAAG,EAAE;IAC/E,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC9D,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,wBAAwB,CAAC;QAC9B,KAAK,sBAAsB;YACzB,4DAA4D;YAC5D,OAAO,2BAA2B,CAAC,MAAM,CAAC,OAA+B,EAAE,QAAQ,CAAC,CAAC;QACvF,KAAK,mBAAmB;YACtB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,qBAAqB;YACxB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,kBAAkB;YACrB,OAAO,sBAAsB,MAAM,CAAC,MAAO,0CAA0C,CAAC;QACxF,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE;gBAC5D,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC;YACR,oFAAoF;YACpF,MAAM,QAAQ,GAA0B;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC;YACF,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}

package/lib/security/policy-narrowing.d.ts

@@ -0,0 +1,12 @@
+import type { TurnPolicyContext } from '../turn/turn-ingress.js';
+export interface SubagentPolicyNarrowing {
+    /** Read-only delegation: no shell, read-only filesystem. */
+    readonly readOnly?: boolean;
+}
+/**
+ * Policy for a sub-agent turn. It is derived only from the parent policy, so it
+ * can never be wider: every authority the parent lacks stays absent, a shell
+ * the parent cannot actually run is dropped, and narrowing only removes power.
+ */
+export declare function deriveSubagentPolicy(parent: Readonly<TurnPolicyContext>, narrowing?: SubagentPolicyNarrowing): Readonly<TurnPolicyContext>;
+//# sourceMappingURL=policy-narrowing.d.ts.map

package/lib/security/policy-narrowing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-narrowing.d.ts","sourceRoot":"","sources":["../../src/security/policy-narrowing.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EACnC,SAAS,GAAE,uBAA4B,GACtC,QAAQ,CAAC,iBAAiB,CAAC,CA0B7B"}

package/lib/security/policy-narrowing.js

@@ -0,0 +1,38 @@
+/**
+ * Policy narrowing shared by sub-agent turns (#718) and trust tiers (#726).
+ * Every function here only removes authority from a policy; none can add it.
+ */
+import { turnPolicyAllowsShell } from '../plugin-runtime/native-bash-tool.js';
+/**
+ * Policy for a sub-agent turn. It is derived only from the parent policy, so it
+ * can never be wider: every authority the parent lacks stays absent, a shell
+ * the parent cannot actually run is dropped, and narrowing only removes power.
+ */
+export function deriveSubagentPolicy(parent, narrowing = {}) {
+    const filesystem = parent.filesystem
+        ? Object.freeze({
+            ...parent.filesystem,
+            ...(narrowing.readOnly ? { access: 'read-only' } : {}),
+        })
+        : undefined;
+    const keepShell = parent.shell !== undefined
+        && !narrowing.readOnly
+        && turnPolicyAllowsShell(parent);
+    return Object.freeze({
+        permissions: Object.freeze([...parent.permissions]),
+        unattended: parent.unattended,
+        ...(parent.network
+            ? {
+                network: Object.freeze({
+                    ...parent.network,
+                    ...(parent.network.allowedDomains
+                        ? { allowedDomains: Object.freeze([...parent.network.allowedDomains]) }
+                        : {}),
+                }),
+            }
+            : {}),
+        ...(filesystem ? { filesystem } : {}),
+        ...(keepShell ? { shell: Object.freeze({ ...parent.shell }) } : {}),
+    });
+}
+//# sourceMappingURL=policy-narrowing.js.map

package/lib/security/policy-narrowing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-narrowing.js","sourceRoot":"","sources":["../../src/security/policy-narrowing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAQ9E;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmC,EACnC,YAAqC,EAAE;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU;QAClC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YACd,GAAG,MAAM,CAAC,UAAU;YACpB,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS;WACvC,CAAC,SAAS,CAAC,QAAQ;WACnB,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC;gBACA,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBACrB,GAAG,MAAM,CAAC,OAAO;oBACjB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;wBAC/B,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE;wBACvE,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;aACH;YACD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,CAAC;AACL,CAAC"}

package/lib/security/provenance.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Provenance chain and high-risk action confirmation (#727, M3.3).
+ *
+ * A turn becomes "tainted" as soon as content from a lower-trust source
+ * (tool results, web pages, files, sub-agent reports, background
+ * conversation events) reaches the model. From then on a model-chosen
+ * high-risk action — running a shell command, messaging another
+ * conversation, changing configuration or scheduling a task — may have been
+ * steered by that content, so it is always routed through the ApprovalPort,
+ * even when the configured policy would allow it outright. The approval card
+ * shows the chain of sources that led to the call.
+ *
+ * Unattended turns have no ApprovalPort, so such calls are denied there.
+ */
+import type { InitiatorTrustLevel } from './trust-level.js';
+export type HighRiskActionKind = 'shell' | 'outbound' | 'config' | 'schedule';
+export interface InjectionGuardSettings {
+    /**
+     * `external_content` (default): once lower-trust content entered the turn,
+     * high-risk actions require approval. `off`: no provenance confirmation.
+     */
+    readonly confirmHighRisk: 'external_content' | 'off';
+    /** `redact` (default): mask system-prompt, secret and other-session memory leaks in replies. `off`: no check. */
+    readonly outboundCheck: 'redact' | 'off';
+    /** Tools whose results are trusted (e.g. a first-party lookup); their output does not taint the turn. */
+    readonly trustedOutputTools: readonly string[];
+}
+export declare const DEFAULT_INJECTION_GUARD: InjectionGuardSettings;
+export declare function resolveInjectionGuard(raw?: Partial<InjectionGuardSettings>): InjectionGuardSettings;
+/** Policy name reported when a call is gated or denied because of its provenance. */
+export declare const PROVENANCE_POLICY = "external-content-confirmation";
+type ToolView = Readonly<{
+    name: string;
+    tags?: readonly string[];
+}>;
+/** The high-risk category of a tool call, or undefined for ordinary tools. */
+export declare function classifyHighRiskAction(tool: ToolView): HighRiskActionKind | undefined;
+/** Whether a completed call of `tool` brought lower-trust content into the turn. */
+export declare function isExternalContentSource(tool: ToolView, settings: InjectionGuardSettings): boolean;
+export type ProvenanceSource = Readonly<{
+    kind: 'tool_result';
+    toolName: string;
+}> | Readonly<{
+    kind: 'subagent_report';
+}> | Readonly<{
+    kind: 'conversation_context';
+}>
+/** A perception-model description of user media (`ai.multimodal.perception`). */
+ | Readonly<{
+    kind: 'media_perception';
+}>;
+/** Records which lower-trust sources reached the model during one turn. */
+export declare class TurnProvenance {
+    #private;
+    record(source: ProvenanceSource): void;
+    get tainted(): boolean;
+    get sources(): readonly ProvenanceSource[];
+    /** Human-readable chain for approval cards, e.g. `主人的消息 → 工具 web_fetch 的结果 → 本次调用 bash`. */
+    describeChain(initiator: InitiatorTrustLevel, toolName: string): string;
+}
+/** Approval question shown when a tainted turn attempts a high-risk action. */
+export declare function formatProvenanceReason(kind: HighRiskActionKind, chain: string): string;
+export declare const PROVENANCE_UNATTENDED_REASON = "\u8BFB\u53D6\u5916\u90E8\u5185\u5BB9\u4E4B\u540E\u7684\u9AD8\u5371\u52A8\u4F5C\uFF08\u6267\u884C\u547D\u4EE4\u3001\u5411\u5176\u4ED6\u4F1A\u8BDD\u53D1\u6D88\u606F\u3001\u4FEE\u6539\u914D\u7F6E\u3001\u5B9A\u65F6\u4EFB\u52A1\uFF09\u9700\u8981\u4EBA\u5DE5\u786E\u8BA4\uFF0C\u65E0\u4EBA\u503C\u5B88\u7684\u56DE\u5408\u65E0\u6CD5\u786E\u8BA4\uFF0C\u5DF2\u62D2\u7EDD\u3002";
+export {};
+//# sourceMappingURL=provenance.d.ts.map

package/lib/security/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../src/security/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE9E,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,kBAAkB,GAAG,KAAK,CAAC;IACrD,iHAAiH;IACjH,QAAQ,CAAC,aAAa,EAAE,QAAQ,GAAG,KAAK,CAAC;IACzC,yGAAyG;IACzG,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAED,eAAO,MAAM,uBAAuB,EAAE,sBAIpC,CAAC;AAEH,wBAAgB,qBAAqB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAMnG;AAED,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,kCAAkC,CAAC;AAEjE,KAAK,QAAQ,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAYrE,8EAA8E;AAC9E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,GAAG,kBAAkB,GAAG,SAAS,CAUrF;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAMjG;AAED,MAAM,MAAM,gBAAgB,GACxB,QAAQ,CAAC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,GACnD,QAAQ,CAAC;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC,GACrC,QAAQ,CAAC;IAAE,IAAI,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAC5C,iFAAiF;GAC/E,QAAQ,CAAC;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,CAAC,CAAC;AAiB3C,2EAA2E;AAC3E,qBAAa,cAAc;;IAGzB,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAMtC,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,IAAI,OAAO,IAAI,SAAS,gBAAgB,EAAE,CAEzC;IAED,4FAA4F;IAC5F,aAAa,CAAC,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAUxE;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKtF;AAED,eAAO,MAAM,4BAA4B,mXACwB,CAAC"}

package/lib/security/provenance.js

@@ -0,0 +1,112 @@
+import { isOutboundToolName } from './trust-level.js';
+export const DEFAULT_INJECTION_GUARD = Object.freeze({
+    confirmHighRisk: 'external_content',
+    outboundCheck: 'redact',
+    trustedOutputTools: Object.freeze([]),
+});
+export function resolveInjectionGuard(raw) {
+    return Object.freeze({
+        confirmHighRisk: raw?.confirmHighRisk === 'off' ? 'off' : 'external_content',
+        outboundCheck: raw?.outboundCheck === 'off' ? 'off' : 'redact',
+        trustedOutputTools: Object.freeze([...(raw?.trustedOutputTools ?? [])]),
+    });
+}
+/** Policy name reported when a call is gated or denied because of its provenance. */
+export const PROVENANCE_POLICY = 'external-content-confirmation';
+/**
+ * Harness tools whose output is produced by zhin itself (catalog lookups,
+ * skill loading) rather than by an outside source.
+ */
+const HARNESS_OUTPUT_TOOLS = new Set(['discover', 'load_tool', 'load_skill', 'ask_user']);
+const READ_VERB = /^(?:get|read|list|show|view|query|search|find|check)_/;
+const CONFIG_NAME = /(?:^|_)(?:config|configs|configuration|setting|settings|plugin_install|install_plugin|uninstall_plugin)(?:_|$)/;
+const SCHEDULE_NAME = /(?:^|_)(?:schedule|schedules|cron|crons|reminder|reminders|remind|timer|timers|alarm|alarms)(?:_|$)/;
+/** The high-risk category of a tool call, or undefined for ordinary tools. */
+export function classifyHighRiskAction(tool) {
+    const tags = tool.tags ?? [];
+    if (tool.name === 'bash' || tags.includes('shell'))
+        return 'shell';
+    if (tags.includes('outbound') || isOutboundToolName(tool.name))
+        return 'outbound';
+    if (tags.includes('config'))
+        return 'config';
+    if (tags.includes('schedule'))
+        return 'schedule';
+    if (READ_VERB.test(tool.name))
+        return undefined;
+    if (CONFIG_NAME.test(tool.name))
+        return 'config';
+    if (SCHEDULE_NAME.test(tool.name))
+        return 'schedule';
+    return undefined;
+}
+/** Whether a completed call of `tool` brought lower-trust content into the turn. */
+export function isExternalContentSource(tool, settings) {
+    if (HARNESS_OUTPUT_TOOLS.has(tool.name))
+        return false;
+    if (settings.trustedOutputTools.includes(tool.name))
+        return false;
+    if (tool.tags?.includes('trusted_output'))
+        return false;
+    // Conservative: every other result (built-in, plugin, MCP, sub-agent report) is data from outside.
+    return true;
+}
+const MAX_CHAIN_SOURCES = 5;
+const LEVEL_LABELS = Object.freeze({
+    owner: '主人',
+    trusted_member: '信任成员',
+    group_member: '群成员',
+});
+const ACTION_LABELS = Object.freeze({
+    shell: '执行命令',
+    outbound: '向其他会话发消息',
+    config: '修改配置',
+    schedule: '创建或修改定时任务',
+});
+/** Records which lower-trust sources reached the model during one turn. */
+export class TurnProvenance {
+    #sources = [];
+    record(source) {
+        const key = sourceKey(source);
+        if (this.#sources.some((existing) => sourceKey(existing) === key))
+            return;
+        this.#sources.push(Object.freeze({ ...source }));
+    }
+    get tainted() {
+        return this.#sources.length > 0;
+    }
+    get sources() {
+        return Object.freeze([...this.#sources]);
+    }
+    /** Human-readable chain for approval cards, e.g. `主人的消息 → 工具 web_fetch 的结果 → 本次调用 bash`. */
+    describeChain(initiator, toolName) {
+        const shown = this.#sources.slice(0, MAX_CHAIN_SOURCES).map(describeSource);
+        const hidden = this.#sources.length - shown.length;
+        return [
+            `${LEVEL_LABELS[initiator]}的消息`,
+            ...shown,
+            ...(hidden > 0 ? [`另外 ${hidden} 个来源`] : []),
+            `本次调用 ${toolName}`,
+        ].join(' → ');
+    }
+}
+/** Approval question shown when a tainted turn attempts a high-risk action. */
+export function formatProvenanceReason(kind, chain) {
+    return [
+        `这次${ACTION_LABELS[kind]}发生在读取外部内容之后，外部内容可能夹带了指令。`,
+        `来源链：${chain}`,
+    ].join('\n');
+}
+export const PROVENANCE_UNATTENDED_REASON = '读取外部内容之后的高危动作（执行命令、向其他会话发消息、修改配置、定时任务）需要人工确认，无人值守的回合无法确认，已拒绝。';
+function describeSource(source) {
+    switch (source.kind) {
+        case 'tool_result': return `工具 ${source.toolName} 的结果`;
+        case 'subagent_report': return '子 agent 的报告';
+        case 'conversation_context': return '群聊背景消息';
+        case 'media_perception': return '图片/媒体的自动描述';
+    }
+}
+function sourceKey(source) {
+    return source.kind === 'tool_result' ? `tool:${source.toolName}` : source.kind;
+}
+//# sourceMappingURL=provenance.js.map

package/lib/security/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/security/provenance.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAgBtD,MAAM,CAAC,MAAM,uBAAuB,GAA2B,MAAM,CAAC,MAAM,CAAC;IAC3E,eAAe,EAAE,kBAAkB;IACnC,aAAa,EAAE,QAAQ;IACvB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAsB;CAC3D,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,GAAqC;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,eAAe,EAAE,GAAG,EAAE,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;QAC5E,aAAa,EAAE,GAAG,EAAE,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;QAC9D,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,CAAC;KACxE,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAIjE;;;GAGG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1F,MAAM,SAAS,GAAG,uDAAuD,CAAC;AAC1E,MAAM,WAAW,GAAG,gHAAgH,CAAC;AACrI,MAAM,aAAa,GAAG,qGAAqG,CAAC;AAE5H,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,IAAc;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACnE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACjD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,IAAc,EAAE,QAAgC;IACtF,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,mGAAmG;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AASD,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,MAAM,YAAY,GAAkD,MAAM,CAAC,MAAM,CAAC;IAChF,KAAK,EAAE,IAAI;IACX,cAAc,EAAE,MAAM;IACtB,YAAY,EAAE,KAAK;CACpB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAiD,MAAM,CAAC,MAAM,CAAC;IAChF,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,OAAO,cAAc;IAChB,QAAQ,GAAuB,EAAE,CAAC;IAE3C,MAAM,CAAC,MAAwB;QAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC;YAAE,OAAO;QAC1E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,4FAA4F;IAC5F,aAAa,CAAC,SAA8B,EAAE,QAAgB;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACnD,OAAO;YACL,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK;YAC/B,GAAG,KAAK;YACR,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,QAAQ,QAAQ,EAAE;SACnB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,IAAwB,EAAE,KAAa;IAC5E,OAAO;QACL,KAAK,aAAa,CAAC,IAAI,CAAC,0BAA0B;QAClD,OAAO,KAAK,EAAE;KACf,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GACvC,+DAA+D,CAAC;AAElE,SAAS,cAAc,CAAC,MAAwB;IAC9C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,aAAa,CAAC,CAAC,OAAO,MAAM,MAAM,CAAC,QAAQ,MAAM,CAAC;QACvD,KAAK,iBAAiB,CAAC,CAAC,OAAO,aAAa,CAAC;QAC7C,KAAK,sBAAsB,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC7C,KAAK,kBAAkB,CAAC,CAAC,OAAO,YAAY,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAwB;IACzC,OAAO,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AACjF,CAAC"}

package/lib/security/trust-level.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Trust tiers (#726): every input source has a trust level, and a turn's
+ * authority is the intersection of the initiator's level and the configured
+ * policy. Levels only ever narrow authority; content from a lower level
+ * (tool output, web pages, files, forwarded messages, plugin / skill prompts,
+ * sub-agent reports) is rendered as labelled data and can never raise it.
+ *
+ * Levels, from most to least trusted:
+ * - owner:            the bot master (`master` role).
+ * - trusted_member:   a member on the `trigger.trusted` list; also non-IM
+ *                     ingress, which keeps its configured policy unchanged.
+ * - group_member:     anyone else reaching the bot over IM — in a group or
+ *                     channel, or in a private chat (#753).
+ * - external_content: never initiates a turn; labels data inside a turn.
+ *
+ * Replaces the #719 group-member stopgap.
+ */
+import type { TurnPolicyContext } from '../turn/turn-ingress.js';
+export declare const TRUST_LEVELS: readonly ["owner", "trusted_member", "group_member", "external_content"];
+export type TrustLevel = (typeof TRUST_LEVELS)[number];
+/** Levels that can start a turn. */
+export type InitiatorTrustLevel = Exclude<TrustLevel, 'external_content'>;
+/** Highest authority a level may hold; the configured policy can only narrow it further. */
+export interface TrustCeiling {
+    readonly shell: boolean;
+    readonly fileWrite: boolean;
+    /** Messaging other conversations. */
+    readonly outbound: boolean;
+}
+export declare const TRUST_CEILINGS: Readonly<Record<TrustLevel, TrustCeiling>>;
+/** Policy name reported when a tool is withheld or denied because of the initiator's level. */
+export declare const TRUST_LEVEL_POLICY = "trust-level";
+export declare const TRUST_RESTRICTION_REASON = "\u975E\u4E3B\u4EBA\u4E14\u4E0D\u5728\u4FE1\u4EFB\u540D\u5355\u4E2D\u7684\u7528\u6237\u53D1\u8D77\u7684\u5BF9\u8BDD\u6682\u4E0D\u652F\u6301\u6267\u884C\u547D\u4EE4\u3001\u5199\u5165\u6587\u4EF6\u6216\u5411\u5176\u4ED6\u4F1A\u8BDD\u53D1\u6D88\u606F\uFF1B\u5982\u786E\u6709\u9700\u8981\uFF0C\u8BF7\u8054\u7CFB\u4E3B\u4EBA\u5904\u7406\u6216\u5C06\u4F60\u52A0\u5165\u4FE1\u4EFB\u540D\u5355\u3002";
+export interface TrustTurnView {
+    readonly origin: Readonly<{
+        kind: string;
+        scope?: string;
+    }>;
+    readonly principal: Readonly<{
+        roles: readonly string[];
+    }>;
+}
+type ToolView = Readonly<{
+    name: string;
+    tags?: readonly string[];
+}>;
+/** Tool names that look like messaging another conversation (send_*, *_forward, notify, ...). */
+export declare function isOutboundToolName(name: string): boolean;
+/** Trust level of a turn's initiator. Roles come from the trusted product ingress, never from message text. */
+export declare function resolveTurnTrustLevel(turn: TrustTurnView): InitiatorTrustLevel;
+/** True when the tool needs authority that `level` does not have. */
+export declare function isToolAboveTrust(tool: ToolView, level: TrustLevel): boolean;
+/** Configured policy ∩ level ceiling. Never widens the configured policy. */
+export declare function narrowPolicyForTrust(policy: Readonly<TurnPolicyContext>, level: TrustLevel): Readonly<TurnPolicyContext>;
+export interface TurnTrustDecision<TTool> {
+    readonly level: InitiatorTrustLevel;
+    /** Whether the level removed anything from the configured policy or tools. */
+    readonly restricted: boolean;
+    readonly policy: Readonly<TurnPolicyContext>;
+    readonly tools: readonly TTool[];
+}
+/**
+ * Applied to a Turn before it starts: tools above the initiator's level are
+ * removed and the policy is narrowed to the level's ceiling. Used by
+ * AgentRuntime, sub-agent turns and the agent evals so all share one rule.
+ */
+export declare function applyTurnTrust<TTool extends ToolView>(turn: TrustTurnView & Readonly<{
+    policy: TurnPolicyContext;
+}>, tools: readonly TTool[]): TurnTrustDecision<TTool>;
+/**
+ * Renders content from a lower-trust source as a labelled data block. The
+ * model is told it is data: instructions inside it never grant permissions.
+ */
+export declare function renderExternalContent(source: string, text: string): string;
+export {};
+//# sourceMappingURL=trust-level.d.ts.map

package/lib/security/trust-level.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-level.d.ts","sourceRoot":"","sources":["../../src/security/trust-level.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,eAAO,MAAM,YAAY,0EAA2E,CAAC;AACrG,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AACvD,oCAAoC;AACpC,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;AAE1E,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,qCAAqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAKD,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAKpE,CAAC;AAEH,+FAA+F;AAC/F,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD,eAAO,MAAM,wBAAwB,2YACgC,CAAC;AAgBtE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;QAAE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED,KAAK,QAAQ,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAErE,iGAAiG;AACjG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,+GAA+G;AAC/G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,mBAAmB,CAO9E;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAQ3E;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EACnC,KAAK,EAAE,UAAU,GAChB,QAAQ,CAAC,iBAAiB,CAAC,CAK7B;AAED,MAAM,WAAW,iBAAiB,CAAC,KAAK;IACtC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,SAAS,KAAK,EAAE,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,SAAS,QAAQ,EACnD,IAAI,EAAE,aAAa,GAAG,QAAQ,CAAC;IAAE,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC,EAC7D,KAAK,EAAE,SAAS,KAAK,EAAE,GACtB,iBAAiB,CAAC,KAAK,CAAC,CAU1B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM1E"}