agentic-flow 2.0.7 → 3.0.0-alpha.2

package/dist/packages/agentdb/src/security/MutationGuard.js

@@ -0,0 +1,364 @@
+/**
+ * ADR-060: Proof-Gated State Mutation
+ *
+ * MutationGuard is the single validation gate between controllers and backends.
+ * Every mutation must produce a MutationProof before the backend executes it.
+ * If validation fails a MutationDenial is returned instead.
+ * Optional WASM-accelerated proofs via @ruvnet/ruvector-verified-wasm.
+ */
+import { createHash, randomUUID } from 'crypto';
+import { posix as posixPath } from 'path';
+import { validateVector, validateVectorId, validateSearchOptions, SECURITY_LIMITS, sanitizeMetadata, } from './validation.js';
+const DEFAULT_TOKEN_TTL_MS = 300_000; // 5 minutes
+const PROOF_TIME_WINDOW_SIZE = 200;
+function makeDefaultToken(ns) {
+    const now = Date.now();
+    return { agentId: 'system', namespace: ns, scope: 'write', issuedAt: now, expiresAt: now + DEFAULT_TOKEN_TTL_MS };
+}
+function hashInsertInputs(id, embedding) {
+    const h = createHash('sha256');
+    h.update(id);
+    h.update(Buffer.from(embedding.buffer, embedding.byteOffset, embedding.byteLength));
+    return h.digest('hex');
+}
+function hashBytes(...parts) {
+    const h = createHash('sha256');
+    for (const p of parts)
+        h.update(p);
+    return h.digest('hex');
+}
+function deny(operation, reason, code, field) {
+    return { operation, reason, code, field, timestamp: Date.now() };
+}
+export class MutationGuard {
+    config;
+    vectorCount = 0;
+    wasmEnv = null;
+    wasmAvailable = false;
+    engineType = 'js';
+    nextWasmProofId = 1;
+    proofsIssuedCount = 0;
+    denialsCount = 0;
+    proofTimesNs = [];
+    constructor(config) {
+        this.config = config;
+    }
+    async initialize() {
+        if (!this.config.enableWasmProofs)
+            return;
+        // Use GraphTransformerService for unified proof backend
+        try {
+            const { GraphTransformerService } = await import('../services/GraphTransformerService.js');
+            const gts = new GraphTransformerService();
+            await gts.initialize();
+            if (gts.isAvailable()) {
+                this.wasmEnv = gts;
+                this.wasmAvailable = true;
+                const stats = gts.getStats();
+                this.engineType = stats.engineType === 'native' ? 'native' : 'wasm';
+                console.log(`[MutationGuard] Initialized with ${this.engineType} proof engine`);
+                return;
+            }
+        }
+        catch (error) {
+            console.warn('[MutationGuard] GraphTransformerService initialization failed:', error);
+        }
+        // Legacy fallback: @ruvnet/ruvector-verified-wasm
+        try {
+            const mod = await import('@ruvnet/ruvector-verified-wasm');
+            if (mod && typeof mod.JsProofEnv === 'function') {
+                this.wasmEnv = new mod.JsProofEnv();
+                this.wasmAvailable = true;
+                this.engineType = 'legacy-wasm';
+                console.log('[MutationGuard] Using legacy verified-wasm proof engine');
+                return;
+            }
+        }
+        catch { /* legacy WASM not available */ }
+        // Pure JS validation fallback (no attestations, but still validates)
+        this.engineType = 'js';
+        this.wasmAvailable = false;
+        console.log('[MutationGuard] No accelerated proof engine available, using JS validation');
+    }
+    validateToken(token) {
+        if (token.expiresAt < Date.now()) {
+            return deny('token_validation', 'Authentication token expired', 'TOKEN_EXPIRED');
+        }
+        return null;
+    }
+    proveInsert(id, embedding, metadata, token) {
+        const start = this.hrtimeNs();
+        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
+        const tokenErr = this.validateToken(att);
+        if (tokenErr) {
+            this.denialsCount++;
+            return tokenErr;
+        }
+        const inv = [];
+        try {
+            validateVectorId(id);
+        }
+        catch (err) {
+            this.denialsCount++;
+            const ve = err;
+            return deny('insert', ve.message, ve.code ?? 'INVALID_ID', ve.field);
+        }
+        try {
+            validateVector(embedding, this.config.dimension);
+        }
+        catch (err) {
+            this.denialsCount++;
+            const ve = err;
+            return deny('insert', ve.message, ve.code ?? 'INVALID_VECTOR', ve.field);
+        }
+        if (metadata) {
+            try {
+                sanitizeMetadata(metadata);
+            }
+            catch (err) {
+                this.denialsCount++;
+                const ve = err;
+                return deny('insert', ve.message, ve.code ?? 'INVALID_METADATA', ve.field);
+            }
+        }
+        const capacityOk = this.vectorCount < this.config.maxElements;
+        inv.push({ check: 'capacity', passed: capacityOk });
+        if (!capacityOk) {
+            this.denialsCount++;
+            return deny('insert', 'Index capacity exceeded', 'CAPACITY_EXCEEDED');
+        }
+        let wasmProofId;
+        let attestationBytes;
+        if (this.wasmAvailable && this.wasmEnv) {
+            try {
+                if (this.engineType === 'native' || this.engineType === 'wasm') {
+                    // GraphTransformerService provides unified API
+                    const dimProof = this.wasmEnv.proveDimension(this.config.dimension, embedding.length);
+                    if (dimProof && dimProof.verified !== false) {
+                        wasmProofId = dimProof.proof_id ?? this.nextWasmProofId++;
+                        attestationBytes = this.wasmEnv.createAttestation?.(wasmProofId) ?? undefined;
+                        inv.push({ check: `graph_transformer_${this.engineType}_verify`, passed: true });
+                    }
+                    else {
+                        inv.push({ check: `graph_transformer_${this.engineType}_verify`, passed: false });
+                    }
+                }
+                else if (this.engineType === 'legacy-wasm') {
+                    // Legacy @ruvnet/ruvector-verified-wasm
+                    this.wasmEnv.verify_dim_check(this.config.dimension, embedding);
+                    wasmProofId = this.nextWasmProofId++;
+                    this.wasmEnv.create_attestation(wasmProofId);
+                    inv.push({ check: 'legacy_wasm_dim_verify', passed: true });
+                }
+            }
+            catch (error) {
+                inv.push({ check: 'proof_engine_verify', passed: false });
+            }
+        }
+        this.vectorCount++;
+        const proof = this.buildProof('insert', hashInsertInputs(id, embedding), att, inv, wasmProofId);
+        this.recordProofTime(start);
+        return proof;
+    }
+    proveSearch(query, k, options, token) {
+        const start = this.hrtimeNs();
+        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
+        const tokenErr = this.validateToken(att);
+        if (tokenErr) {
+            this.denialsCount++;
+            return tokenErr;
+        }
+        const inv = [];
+        try {
+            validateVector(query, this.config.dimension);
+        }
+        catch (err) {
+            this.denialsCount++;
+            const ve = err;
+            return deny('search', ve.message, ve.code ?? 'INVALID_VECTOR', ve.field);
+        }
+        try {
+            validateSearchOptions({ k, ...options });
+        }
+        catch (err) {
+            this.denialsCount++;
+            const ve = err;
+            return deny('search', ve.message, ve.code ?? 'INVALID_SEARCH_OPTIONS', ve.field);
+        }
+        inv.push({ check: 'query_valid', passed: true });
+        inv.push({ check: 'options_valid', passed: true });
+        const structuralHash = hashBytes(Buffer.from(query.buffer, query.byteOffset, query.byteLength), String(k));
+        const proof = this.buildProof('search', structuralHash, att, inv);
+        this.recordProofTime(start);
+        return proof;
+    }
+    proveBatchInsert(items, token) {
+        const start = this.hrtimeNs();
+        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
+        const tokenErr = this.validateToken(att);
+        if (tokenErr) {
+            this.denialsCount++;
+            return tokenErr;
+        }
+        const inv = [];
+        if (!items || items.length === 0) {
+            this.denialsCount++;
+            return deny('batch_insert', 'Batch is empty', 'EMPTY_BATCH');
+        }
+        if (items.length > SECURITY_LIMITS.MAX_BATCH_SIZE) {
+            this.denialsCount++;
+            return deny('batch_insert', 'Batch size exceeds maximum allowed limit', 'BATCH_SIZE_EXCEEDED');
+        }
+        inv.push({ check: 'batch_size', passed: true });
+        for (let i = 0; i < items.length; i++) {
+            const item = items[i];
+            try {
+                validateVectorId(item.id);
+            }
+            catch (err) {
+                this.denialsCount++;
+                const ve = err;
+                return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_ID', `items[${i}].id`);
+            }
+            try {
+                validateVector(item.embedding, this.config.dimension);
+            }
+            catch (err) {
+                this.denialsCount++;
+                const ve = err;
+                return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_VECTOR', `items[${i}].embedding`);
+            }
+            if (item.metadata) {
+                try {
+                    sanitizeMetadata(item.metadata);
+                }
+                catch (err) {
+                    this.denialsCount++;
+                    const ve = err;
+                    return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_METADATA', `items[${i}].metadata`);
+                }
+            }
+        }
+        inv.push({ check: 'items_valid', passed: true });
+        const capacityOk = this.vectorCount + items.length <= this.config.maxElements;
+        inv.push({ check: 'capacity', passed: capacityOk });
+        if (!capacityOk) {
+            this.denialsCount++;
+            return deny('batch_insert', 'Batch would exceed index capacity', 'CAPACITY_EXCEEDED');
+        }
+        const h = createHash('sha256');
+        for (const item of items) {
+            h.update(item.id);
+            h.update(Buffer.from(item.embedding.buffer, item.embedding.byteOffset, item.embedding.byteLength));
+        }
+        this.vectorCount += items.length;
+        const proof = this.buildProof('batch_insert', h.digest('hex'), att, inv);
+        this.recordProofTime(start);
+        return proof;
+    }
+    proveRemove(id, token) {
+        const start = this.hrtimeNs();
+        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
+        const tokenErr = this.validateToken(att);
+        if (tokenErr) {
+            this.denialsCount++;
+            return tokenErr;
+        }
+        const inv = [];
+        try {
+            validateVectorId(id);
+        }
+        catch (err) {
+            this.denialsCount++;
+            const ve = err;
+            return deny('remove', ve.message, ve.code ?? 'INVALID_ID', ve.field);
+        }
+        inv.push({ check: 'id_valid', passed: true });
+        if (this.vectorCount > 0)
+            this.vectorCount--;
+        const proof = this.buildProof('remove', hashBytes(id), att, inv);
+        this.recordProofTime(start);
+        return proof;
+    }
+    proveSave(path, token) {
+        const start = this.hrtimeNs();
+        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
+        const tokenErr = this.validateToken(att);
+        if (tokenErr) {
+            this.denialsCount++;
+            return tokenErr;
+        }
+        const inv = [];
+        const pathErr = this.validateSafePath(path, 'save');
+        if (pathErr !== null) {
+            this.denialsCount++;
+            return pathErr;
+        }
+        inv.push({ check: 'path_safe', passed: true });
+        const proof = this.buildProof('save', hashBytes(path), att, inv);
+        this.recordProofTime(start);
+        return proof;
+    }
+    proveLoad(path, token) {
+        const start = this.hrtimeNs();
+        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
+        const tokenErr = this.validateToken(att);
+        if (tokenErr) {
+            this.denialsCount++;
+            return tokenErr;
+        }
+        const inv = [];
+        const pathErr = this.validateSafePath(path, 'load');
+        if (pathErr !== null) {
+            this.denialsCount++;
+            return pathErr;
+        }
+        inv.push({ check: 'path_safe', passed: true });
+        const proof = this.buildProof('load', hashBytes(path), att, inv);
+        this.recordProofTime(start);
+        return proof;
+    }
+    createToken(agentId, namespace, scope, ttlMs = DEFAULT_TOKEN_TTL_MS) {
+        const now = Date.now();
+        return { agentId, namespace, scope, issuedAt: now, expiresAt: now + ttlMs };
+    }
+    getStats() {
+        const avg = this.proofTimesNs.length > 0
+            ? this.proofTimesNs.reduce((a, b) => a + b, 0) / this.proofTimesNs.length
+            : 0;
+        return { proofsIssued: this.proofsIssuedCount, denials: this.denialsCount, wasmAvailable: this.wasmAvailable, engineType: this.engineType, avgProofTimeNs: avg };
+    }
+    static isDenial(result) {
+        return !('valid' in result);
+    }
+    getVectorCount() { return this.vectorCount; }
+    setVectorCount(count) { this.vectorCount = count; }
+    buildProof(operation, structuralHash, attestation, invariantChecks, wasmProofId) {
+        this.proofsIssuedCount++;
+        return {
+            id: randomUUID(), operation, timestamp: Date.now(),
+            structuralHash, attestation, invariantChecks, wasmProofId, valid: true,
+        };
+    }
+    validateSafePath(filePath, operation) {
+        if (!filePath || typeof filePath !== 'string')
+            return deny(operation, 'Path must be a non-empty string', 'INVALID_PATH', 'path');
+        if (filePath.includes('\x00'))
+            return deny(operation, 'Path contains null bytes', 'NULL_BYTE_IN_PATH', 'path');
+        // Normalize to resolve sequences like a/../b, then reject traversal
+        const normalized = posixPath.normalize(filePath);
+        if (normalized.startsWith('..') || normalized.includes('/..'))
+            return deny(operation, 'Path traversal attempt detected', 'PATH_TRAVERSAL', 'path');
+        if (posixPath.isAbsolute(normalized) || /^[a-zA-Z]:[\\/]/.test(filePath))
+            return deny(operation, 'Absolute paths are not allowed', 'ABSOLUTE_PATH', 'path');
+        return null;
+    }
+    hrtimeNs() { return process.hrtime.bigint(); }
+    recordProofTime(start) {
+        const elapsed = Number(process.hrtime.bigint() - start);
+        this.proofTimesNs.push(elapsed);
+        if (this.proofTimesNs.length > PROOF_TIME_WINDOW_SIZE)
+            this.proofTimesNs.shift();
+    }
+}
+//# sourceMappingURL=MutationGuard.js.map

package/dist/packages/agentdb/src/security/MutationGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MutationGuard.js","sourceRoot":"","sources":["../../../../../../packages/agentdb/src/security/MutationGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AA2CzB,MAAM,oBAAoB,GAAG,OAAO,CAAC,CAAC,YAAY;AAClD,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,SAAS,gBAAgB,CAAC,EAAU;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;AACpH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAU,EAAE,SAAuB;IAC3D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACb,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,SAAS,CAAC,GAAG,KAA0B;IAC9C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,IAAI,CAAC,SAAiB,EAAE,MAAc,EAAE,IAAY,EAAE,KAAc;IAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,OAAO,aAAa;IACP,MAAM,CAAc;IAC7B,WAAW,GAAG,CAAC,CAAC;IAChB,OAAO,GAAQ,IAAI,CAAC;IACpB,aAAa,GAAG,KAAK,CAAC;IACtB,UAAU,GAA6C,IAAI,CAAC;IAC5D,eAAe,GAAG,CAAC,CAAC;IACpB,iBAAiB,GAAG,CAAC,CAAC;IACtB,YAAY,GAAG,CAAC,CAAC;IACjB,YAAY,GAAa,EAAE,CAAC;IAEpC,YAAY,MAAmB;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO;QAE1C,wDAAwD;QACxD,IAAI,CAAC;YACH,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;YAC3F,MAAM,GAAG,GAAG,IAAI,uBAAuB,EAAE,CAAC;YAC1C,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC;YAEvB,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;gBACnB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;gBACpE,OAAO,CAAC,GAAG,CAAC,oCAAoC,IAAI,CAAC,UAAU,eAAe,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,gEAAgE,EAAE,KAAK,CAAC,CAAC;QACxF,CAAC;QAED,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,gCAA0C,CAAC,CAAC;YACrE,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBAChD,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;QAE3C,qEAAqE;QACrE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;IAC5F,CAAC;IAEO,aAAa,CAAC,KAAuB;QAC3C,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,kBAAkB,EAAE,8BAA8B,EAAE,eAAe,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CACT,EAAU,EAAE,SAAuB,EACnC,QAA8B,EAAE,KAAwB;QAExD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAElC,IAAI,CAAC;YAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACzC,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACrE,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,gBAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;gBAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,kBAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,QAAQ,EAAE,yBAAyB,EAAE,mBAAmB,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,WAA+B,CAAC;QACpC,IAAI,gBAAwC,CAAC;QAC7C,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;oBAC/D,+CAA+C;oBAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;oBACtF,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;wBAC5C,WAAW,GAAG,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;wBAC1D,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;wBAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,IAAI,CAAC,UAAU,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnF,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,IAAI,CAAC,UAAU,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBACpF,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;oBAC7C,wCAAwC;oBACxC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBAChE,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;oBAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAChG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CACT,KAAmB,EAAE,CAAS,EAC9B,OAAa,EAAE,KAAwB;QAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAElC,IAAI,CAAC;YAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACjE,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,gBAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC;YAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,wBAAwB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACnF,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,SAAS,CAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CACzE,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gBAAgB,CACd,KAAqF,EACrF,KAAwB;QAExB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAElC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,cAAc,EAAE,CAAC;YAClD,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,cAAc,EAAE,0CAA0C,EAAE,qBAAqB,CAAC,CAAC;QACjG,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC;gBAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;gBAClC,OAAO,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,CAAC;gBAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;gBAClC,OAAO,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,gBAAgB,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;YAChH,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,IAAI,CAAC;oBAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACpD,IAAI,CAAC,YAAY,EAAE,CAAC;oBACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;oBAClC,OAAO,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,kBAAkB,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,cAAc,EAAE,mCAAmC,EAAE,mBAAmB,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACzE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CAAC,EAAU,EAAE,KAAwB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAElC,IAAI,CAAC;YAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACzC,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9C,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC;YAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,KAAwB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,OAAO,CAAC;QAAC,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,KAAwB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,OAAO,CAAC;QAAC,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CACT,OAAe,EAAE,SAAiB,EAClC,KAAiC,EAAE,QAAgB,oBAAoB;QAEvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,KAAK,EAAE,CAAC;IAC9E,CAAC;IAED,QAAQ;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM;YACzE,CAAC,CAAC,CAAC,CAAC;QACN,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;IACnK,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,MAAsC;QACpD,OAAO,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,cAAc,KAAa,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAErD,cAAc,CAAC,KAAa,IAAU,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC;IAEzD,UAAU,CAChB,SAAqC,EAAE,cAAsB,EAC7D,WAA6B,EAAE,eAAkC,EAAE,WAAoB;QAEvF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YAClD,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI;SACvE,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,QAAgB,EAAE,SAAiB;QAC1D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAC3C,OAAO,IAAI,CAAC,SAAS,EAAE,iCAAiC,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QACpF,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3B,OAAO,IAAI,CAAC,SAAS,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAClF,oEAAoE;QACpE,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,iCAAiC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACtE,OAAO,IAAI,CAAC,SAAS,EAAE,gCAAgC,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,QAAQ,KAAa,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEtD,eAAe,CAAC,KAAa;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,sBAAsB;YAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnF,CAAC;CACF","sourcesContent":["/**\n * ADR-060: Proof-Gated State Mutation\n *\n * MutationGuard is the single validation gate between controllers and backends.\n * Every mutation must produce a MutationProof before the backend executes it.\n * If validation fails a MutationDenial is returned instead.\n * Optional WASM-accelerated proofs via @ruvnet/ruvector-verified-wasm.\n */\n\nimport { createHash, randomUUID } from 'crypto';\nimport { posix as posixPath } from 'path';\nimport {\n  validateVector,\n  validateVectorId,\n  validateSearchOptions,\n  SECURITY_LIMITS,\n  sanitizeMetadata,\n} from './validation.js';\nimport { ValidationError } from './input-validation.js';\n\nexport interface MutationProof {\n  id: string;\n  operation: 'insert' | 'search' | 'remove' | 'batch_insert' | 'save' | 'load';\n  timestamp: number;\n  structuralHash: string;\n  attestation: AttestationToken;\n  invariantChecks: InvariantResult[];\n  wasmProofId?: number;\n  valid: true;\n}\n\nexport interface AttestationToken {\n  agentId: string;\n  namespace: string;\n  scope: 'read' | 'write' | 'admin';\n  issuedAt: number;\n  expiresAt: number;\n}\n\nexport interface InvariantResult {\n  check: string;\n  passed: boolean;\n}\n\nexport interface MutationDenial {\n  operation: string;\n  reason: string;\n  code: string;\n  field?: string;\n  timestamp: number;\n}\n\nexport interface GuardConfig {\n  dimension: number;\n  maxElements: number;\n  enableWasmProofs: boolean;\n  enableAttestationLog: boolean;\n  defaultNamespace: string;\n}\n\nconst DEFAULT_TOKEN_TTL_MS = 300_000; // 5 minutes\nconst PROOF_TIME_WINDOW_SIZE = 200;\n\nfunction makeDefaultToken(ns: string): AttestationToken {\n  const now = Date.now();\n  return { agentId: 'system', namespace: ns, scope: 'write', issuedAt: now, expiresAt: now + DEFAULT_TOKEN_TTL_MS };\n}\n\nfunction hashInsertInputs(id: string, embedding: Float32Array): string {\n  const h = createHash('sha256');\n  h.update(id);\n  h.update(Buffer.from(embedding.buffer, embedding.byteOffset, embedding.byteLength));\n  return h.digest('hex');\n}\n\nfunction hashBytes(...parts: (string | Buffer)[]): string {\n  const h = createHash('sha256');\n  for (const p of parts) h.update(p);\n  return h.digest('hex');\n}\n\nfunction deny(operation: string, reason: string, code: string, field?: string): MutationDenial {\n  return { operation, reason, code, field, timestamp: Date.now() };\n}\n\nexport class MutationGuard {\n  private readonly config: GuardConfig;\n  private vectorCount = 0;\n  private wasmEnv: any = null;\n  private wasmAvailable = false;\n  private engineType: 'native' | 'wasm' | 'legacy-wasm' | 'js' = 'js';\n  private nextWasmProofId = 1;\n  private proofsIssuedCount = 0;\n  private denialsCount = 0;\n  private proofTimesNs: number[] = [];\n\n  constructor(config: GuardConfig) {\n    this.config = config;\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.config.enableWasmProofs) return;\n\n    // Use GraphTransformerService for unified proof backend\n    try {\n      const { GraphTransformerService } = await import('../services/GraphTransformerService.js');\n      const gts = new GraphTransformerService();\n      await gts.initialize();\n\n      if (gts.isAvailable()) {\n        this.wasmEnv = gts;\n        this.wasmAvailable = true;\n        const stats = gts.getStats();\n        this.engineType = stats.engineType === 'native' ? 'native' : 'wasm';\n        console.log(`[MutationGuard] Initialized with ${this.engineType} proof engine`);\n        return;\n      }\n    } catch (error) {\n      console.warn('[MutationGuard] GraphTransformerService initialization failed:', error);\n    }\n\n    // Legacy fallback: @ruvnet/ruvector-verified-wasm\n    try {\n      const mod = await import('@ruvnet/ruvector-verified-wasm' as string);\n      if (mod && typeof mod.JsProofEnv === 'function') {\n        this.wasmEnv = new mod.JsProofEnv();\n        this.wasmAvailable = true;\n        this.engineType = 'legacy-wasm';\n        console.log('[MutationGuard] Using legacy verified-wasm proof engine');\n        return;\n      }\n    } catch { /* legacy WASM not available */ }\n\n    // Pure JS validation fallback (no attestations, but still validates)\n    this.engineType = 'js';\n    this.wasmAvailable = false;\n    console.log('[MutationGuard] No accelerated proof engine available, using JS validation');\n  }\n\n  private validateToken(token: AttestationToken): MutationDenial | null {\n    if (token.expiresAt < Date.now()) {\n      return deny('token_validation', 'Authentication token expired', 'TOKEN_EXPIRED');\n    }\n    return null;\n  }\n\n  proveInsert(\n    id: string, embedding: Float32Array,\n    metadata?: Record<string, any>, token?: AttestationToken,\n  ): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n\n    try { validateVectorId(id); } catch (err) {\n      this.denialsCount++;\n      const ve = err as ValidationError;\n      return deny('insert', ve.message, ve.code ?? 'INVALID_ID', ve.field);\n    }\n    try { validateVector(embedding, this.config.dimension); } catch (err) {\n      this.denialsCount++;\n      const ve = err as ValidationError;\n      return deny('insert', ve.message, ve.code ?? 'INVALID_VECTOR', ve.field);\n    }\n    if (metadata) {\n      try { sanitizeMetadata(metadata); } catch (err) {\n        this.denialsCount++;\n        const ve = err as ValidationError;\n        return deny('insert', ve.message, ve.code ?? 'INVALID_METADATA', ve.field);\n      }\n    }\n\n    const capacityOk = this.vectorCount < this.config.maxElements;\n    inv.push({ check: 'capacity', passed: capacityOk });\n    if (!capacityOk) {\n      this.denialsCount++;\n      return deny('insert', 'Index capacity exceeded', 'CAPACITY_EXCEEDED');\n    }\n\n    let wasmProofId: number | undefined;\n    let attestationBytes: Uint8Array | undefined;\n    if (this.wasmAvailable && this.wasmEnv) {\n      try {\n        if (this.engineType === 'native' || this.engineType === 'wasm') {\n          // GraphTransformerService provides unified API\n          const dimProof = this.wasmEnv.proveDimension(this.config.dimension, embedding.length);\n          if (dimProof && dimProof.verified !== false) {\n            wasmProofId = dimProof.proof_id ?? this.nextWasmProofId++;\n            attestationBytes = this.wasmEnv.createAttestation?.(wasmProofId) ?? undefined;\n            inv.push({ check: `graph_transformer_${this.engineType}_verify`, passed: true });\n          } else {\n            inv.push({ check: `graph_transformer_${this.engineType}_verify`, passed: false });\n          }\n        } else if (this.engineType === 'legacy-wasm') {\n          // Legacy @ruvnet/ruvector-verified-wasm\n          this.wasmEnv.verify_dim_check(this.config.dimension, embedding);\n          wasmProofId = this.nextWasmProofId++;\n          this.wasmEnv.create_attestation(wasmProofId);\n          inv.push({ check: 'legacy_wasm_dim_verify', passed: true });\n        }\n      } catch (error) {\n        inv.push({ check: 'proof_engine_verify', passed: false });\n      }\n    }\n\n    this.vectorCount++;\n    const proof = this.buildProof('insert', hashInsertInputs(id, embedding), att, inv, wasmProofId);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  proveSearch(\n    query: Float32Array, k: number,\n    options?: any, token?: AttestationToken,\n  ): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n\n    try { validateVector(query, this.config.dimension); } catch (err) {\n      this.denialsCount++;\n      const ve = err as ValidationError;\n      return deny('search', ve.message, ve.code ?? 'INVALID_VECTOR', ve.field);\n    }\n    try { validateSearchOptions({ k, ...options }); } catch (err) {\n      this.denialsCount++;\n      const ve = err as ValidationError;\n      return deny('search', ve.message, ve.code ?? 'INVALID_SEARCH_OPTIONS', ve.field);\n    }\n\n    inv.push({ check: 'query_valid', passed: true });\n    inv.push({ check: 'options_valid', passed: true });\n    const structuralHash = hashBytes(\n      Buffer.from(query.buffer, query.byteOffset, query.byteLength), String(k),\n    );\n    const proof = this.buildProof('search', structuralHash, att, inv);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  proveBatchInsert(\n    items: Array<{ id: string; embedding: Float32Array; metadata?: Record<string, any> }>,\n    token?: AttestationToken,\n  ): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n\n    if (!items || items.length === 0) {\n      this.denialsCount++;\n      return deny('batch_insert', 'Batch is empty', 'EMPTY_BATCH');\n    }\n    if (items.length > SECURITY_LIMITS.MAX_BATCH_SIZE) {\n      this.denialsCount++;\n      return deny('batch_insert', 'Batch size exceeds maximum allowed limit', 'BATCH_SIZE_EXCEEDED');\n    }\n    inv.push({ check: 'batch_size', passed: true });\n\n    for (let i = 0; i < items.length; i++) {\n      const item = items[i];\n      try { validateVectorId(item.id); } catch (err) {\n        this.denialsCount++;\n        const ve = err as ValidationError;\n        return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_ID', `items[${i}].id`);\n      }\n      try { validateVector(item.embedding, this.config.dimension); } catch (err) {\n        this.denialsCount++;\n        const ve = err as ValidationError;\n        return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_VECTOR', `items[${i}].embedding`);\n      }\n      if (item.metadata) {\n        try { sanitizeMetadata(item.metadata); } catch (err) {\n          this.denialsCount++;\n          const ve = err as ValidationError;\n          return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_METADATA', `items[${i}].metadata`);\n        }\n      }\n    }\n    inv.push({ check: 'items_valid', passed: true });\n\n    const capacityOk = this.vectorCount + items.length <= this.config.maxElements;\n    inv.push({ check: 'capacity', passed: capacityOk });\n    if (!capacityOk) {\n      this.denialsCount++;\n      return deny('batch_insert', 'Batch would exceed index capacity', 'CAPACITY_EXCEEDED');\n    }\n\n    const h = createHash('sha256');\n    for (const item of items) {\n      h.update(item.id);\n      h.update(Buffer.from(item.embedding.buffer, item.embedding.byteOffset, item.embedding.byteLength));\n    }\n\n    this.vectorCount += items.length;\n    const proof = this.buildProof('batch_insert', h.digest('hex'), att, inv);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  proveRemove(id: string, token?: AttestationToken): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n\n    try { validateVectorId(id); } catch (err) {\n      this.denialsCount++;\n      const ve = err as ValidationError;\n      return deny('remove', ve.message, ve.code ?? 'INVALID_ID', ve.field);\n    }\n    inv.push({ check: 'id_valid', passed: true });\n\n    if (this.vectorCount > 0) this.vectorCount--;\n    const proof = this.buildProof('remove', hashBytes(id), att, inv);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  proveSave(path: string, token?: AttestationToken): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n    const pathErr = this.validateSafePath(path, 'save');\n    if (pathErr !== null) { this.denialsCount++; return pathErr; }\n    inv.push({ check: 'path_safe', passed: true });\n    const proof = this.buildProof('save', hashBytes(path), att, inv);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  proveLoad(path: string, token?: AttestationToken): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n    const pathErr = this.validateSafePath(path, 'load');\n    if (pathErr !== null) { this.denialsCount++; return pathErr; }\n    inv.push({ check: 'path_safe', passed: true });\n    const proof = this.buildProof('load', hashBytes(path), att, inv);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  createToken(\n    agentId: string, namespace: string,\n    scope: 'read' | 'write' | 'admin', ttlMs: number = DEFAULT_TOKEN_TTL_MS,\n  ): AttestationToken {\n    const now = Date.now();\n    return { agentId, namespace, scope, issuedAt: now, expiresAt: now + ttlMs };\n  }\n\n  getStats(): { proofsIssued: number; denials: number; wasmAvailable: boolean; engineType: string; avgProofTimeNs: number } {\n    const avg = this.proofTimesNs.length > 0\n      ? this.proofTimesNs.reduce((a, b) => a + b, 0) / this.proofTimesNs.length\n      : 0;\n    return { proofsIssued: this.proofsIssuedCount, denials: this.denialsCount, wasmAvailable: this.wasmAvailable, engineType: this.engineType, avgProofTimeNs: avg };\n  }\n\n  static isDenial(result: MutationProof | MutationDenial): result is MutationDenial {\n    return !('valid' in result);\n  }\n\n  getVectorCount(): number { return this.vectorCount; }\n\n  setVectorCount(count: number): void { this.vectorCount = count; }\n\n  private buildProof(\n    operation: MutationProof['operation'], structuralHash: string,\n    attestation: AttestationToken, invariantChecks: InvariantResult[], wasmProofId?: number,\n  ): MutationProof {\n    this.proofsIssuedCount++;\n    return {\n      id: randomUUID(), operation, timestamp: Date.now(),\n      structuralHash, attestation, invariantChecks, wasmProofId, valid: true,\n    };\n  }\n\n  private validateSafePath(filePath: string, operation: string): MutationDenial | null {\n    if (!filePath || typeof filePath !== 'string')\n      return deny(operation, 'Path must be a non-empty string', 'INVALID_PATH', 'path');\n    if (filePath.includes('\\x00'))\n      return deny(operation, 'Path contains null bytes', 'NULL_BYTE_IN_PATH', 'path');\n    // Normalize to resolve sequences like a/../b, then reject traversal\n    const normalized = posixPath.normalize(filePath);\n    if (normalized.startsWith('..') || normalized.includes('/..'))\n      return deny(operation, 'Path traversal attempt detected', 'PATH_TRAVERSAL', 'path');\n    if (posixPath.isAbsolute(normalized) || /^[a-zA-Z]:[\\\\/]/.test(filePath))\n      return deny(operation, 'Absolute paths are not allowed', 'ABSOLUTE_PATH', 'path');\n    return null;\n  }\n\n  private hrtimeNs(): bigint { return process.hrtime.bigint(); }\n\n  private recordProofTime(start: bigint): void {\n    const elapsed = Number(process.hrtime.bigint() - start);\n    this.proofTimesNs.push(elapsed);\n    if (this.proofTimesNs.length > PROOF_TIME_WINDOW_SIZE) this.proofTimesNs.shift();\n  }\n}\n"]}

package/dist/packages/agentdb/src/security/input-validation.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Input Validation and Sanitization for AgentDB Security
+ *
+ * Provides comprehensive validation to prevent SQL injection and other attacks:
+ * - Whitelist-based validation for identifiers (tables, columns, PRAGMA commands)
+ * - Input sanitization for user data
+ * - Type validation and constraints
+ * - Error handling that doesn't leak sensitive information
+ */
+/**
+ * Validation error with safe error messages
+ */
+export declare class ValidationError extends Error {
+    readonly code: string;
+    readonly field?: string;
+    constructor(message: string, code?: string, field?: string);
+    /**
+     * Get safe error message (doesn't leak sensitive info)
+     */
+    getSafeMessage(): string;
+}
+/**
+ * Validate task string (NEW - for MCP tool optimization)
+ */
+export declare function validateTaskString(task: unknown, fieldName?: string): string;
+/**
+ * Validate numeric range (NEW - for MCP tool optimization)
+ */
+export declare function validateNumericRange(value: unknown, fieldName: string, min: number, max: number): number;
+/**
+ * Validate array length (NEW - for MCP tool optimization)
+ */
+export declare function validateArrayLength<T>(arr: unknown, fieldName: string, minLength: number, maxLength: number): T[];
+/**
+ * Validate object (NEW - for MCP tool optimization)
+ */
+export declare function validateObject(obj: unknown, fieldName: string, required?: boolean): Record<string, any>;
+/**
+ * Validate boolean (NEW - for MCP tool optimization)
+ */
+export declare function validateBoolean(value: unknown, fieldName: string, defaultValue?: boolean): boolean;
+/**
+ * Validate enum value (NEW - for MCP tool optimization)
+ */
+export declare function validateEnum<T extends string>(value: unknown, fieldName: string, allowedValues: readonly T[]): T;
+/**
+ * Validate table name against whitelist
+ */
+export declare function validateTableName(tableName: string): string;
+/**
+ * Validate column name against whitelist
+ */
+export declare function validateColumnName(tableName: string, columnName: string): string;
+/**
+ * Validate PRAGMA command against whitelist
+ */
+export declare function validatePragmaCommand(pragma: string): string;
+/**
+ * Validate and sanitize session ID
+ */
+export declare function validateSessionId(sessionId: string): string;
+/**
+ * Validate numeric ID
+ */
+export declare function validateId(id: any, fieldName?: string): number;
+/**
+ * Validate timestamp
+ */
+export declare function validateTimestamp(timestamp: any, fieldName?: string): number;
+/**
+ * Validate reward value (0-1)
+ */
+export declare function validateReward(reward: any): number;
+/**
+ * Validate success flag
+ */
+export declare function validateSuccess(success: any): boolean;
+/**
+ * Sanitize text input (prevent extremely long strings, null bytes, etc.)
+ */
+export declare function sanitizeText(text: string, maxLength?: number, fieldName?: string): string;
+/**
+ * Build safe WHERE clause with parameterized values
+ * Returns both the SQL clause and the parameter values
+ */
+export declare function buildSafeWhereClause(tableName: string, conditions: Record<string, any>): {
+    clause: string;
+    values: any[];
+};
+/**
+ * Build safe SET clause for UPDATE statements
+ */
+export declare function buildSafeSetClause(tableName: string, updates: Record<string, any>): {
+    clause: string;
+    values: any[];
+};
+/**
+ * Validate JSON data
+ */
+export declare function validateJSON(data: any, fieldName?: string): string;
+/**
+ * Validate array of tags
+ */
+export declare function validateTags(tags: any): string[];
+/**
+ * Safe error handler that doesn't leak sensitive information
+ */
+export declare function handleSecurityError(error: any): string;
+//# sourceMappingURL=input-validation.d.ts.map

package/dist/packages/agentdb/src/security/input-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../../../../packages/agentdb/src/security/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAyDH;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,KAAK,CAAC,EAAE,MAAM,CAAC;gBAEnB,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAA2B,EAAE,KAAK,CAAC,EAAE,MAAM;IAO9E;;OAEG;IACH,cAAc,IAAI,MAAM;CAGzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,GAAE,MAAe,GAAG,MAAM,CAkCpF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,MAAM,CAkBR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,CAAC,EAAE,CAkBL;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,OAAc,GACvB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAarB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAaT;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAC3C,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,SAAS,CAAC,EAAE,GAC1B,CAAC,CAkBH;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAkBhF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAkB5D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAqB3D;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,GAAE,MAAa,GAAG,MAAM,CAQpE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,GAAE,MAAoB,GAAG,MAAM,CAoBzF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,CAYlD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAgBrD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,MAAe,EAAE,SAAS,GAAE,MAAe,GAAG,MAAM,CAiBzG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC9B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,EAAE,CAAA;CAAE,CAoBnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,EAAE,CAAA;CAAE,CAoBnC;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,GAAE,MAAe,GAAG,MAAM,CAM1E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,GAAG,GAAG,MAAM,EAAE,CAahD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAStD"}