agentic-flow 3.0.0-alpha.2 → 3.1.0

package/dist/packages/agentdb/src/security/MutationGuard.js

@@ -1,364 +0,0 @@
-/**
- * ADR-060: Proof-Gated State Mutation
- *
- * MutationGuard is the single validation gate between controllers and backends.
- * Every mutation must produce a MutationProof before the backend executes it.
- * If validation fails a MutationDenial is returned instead.
- * Optional WASM-accelerated proofs via @ruvnet/ruvector-verified-wasm.
- */
-import { createHash, randomUUID } from 'crypto';
-import { posix as posixPath } from 'path';
-import { validateVector, validateVectorId, validateSearchOptions, SECURITY_LIMITS, sanitizeMetadata, } from './validation.js';
-const DEFAULT_TOKEN_TTL_MS = 300_000; // 5 minutes
-const PROOF_TIME_WINDOW_SIZE = 200;
-function makeDefaultToken(ns) {
-    const now = Date.now();
-    return { agentId: 'system', namespace: ns, scope: 'write', issuedAt: now, expiresAt: now + DEFAULT_TOKEN_TTL_MS };
-}
-function hashInsertInputs(id, embedding) {
-    const h = createHash('sha256');
-    h.update(id);
-    h.update(Buffer.from(embedding.buffer, embedding.byteOffset, embedding.byteLength));
-    return h.digest('hex');
-}
-function hashBytes(...parts) {
-    const h = createHash('sha256');
-    for (const p of parts)
-        h.update(p);
-    return h.digest('hex');
-}
-function deny(operation, reason, code, field) {
-    return { operation, reason, code, field, timestamp: Date.now() };
-}
-export class MutationGuard {
-    config;
-    vectorCount = 0;
-    wasmEnv = null;
-    wasmAvailable = false;
-    engineType = 'js';
-    nextWasmProofId = 1;
-    proofsIssuedCount = 0;
-    denialsCount = 0;
-    proofTimesNs = [];
-    constructor(config) {
-        this.config = config;
-    }
-    async initialize() {
-        if (!this.config.enableWasmProofs)
-            return;
-        // Use GraphTransformerService for unified proof backend
-        try {
-            const { GraphTransformerService } = await import('../services/GraphTransformerService.js');
-            const gts = new GraphTransformerService();
-            await gts.initialize();
-            if (gts.isAvailable()) {
-                this.wasmEnv = gts;
-                this.wasmAvailable = true;
-                const stats = gts.getStats();
-                this.engineType = stats.engineType === 'native' ? 'native' : 'wasm';
-                console.log(`[MutationGuard] Initialized with ${this.engineType} proof engine`);
-                return;
-            }
-        }
-        catch (error) {
-            console.warn('[MutationGuard] GraphTransformerService initialization failed:', error);
-        }
-        // Legacy fallback: @ruvnet/ruvector-verified-wasm
-        try {
-            const mod = await import('@ruvnet/ruvector-verified-wasm');
-            if (mod && typeof mod.JsProofEnv === 'function') {
-                this.wasmEnv = new mod.JsProofEnv();
-                this.wasmAvailable = true;
-                this.engineType = 'legacy-wasm';
-                console.log('[MutationGuard] Using legacy verified-wasm proof engine');
-                return;
-            }
-        }
-        catch { /* legacy WASM not available */ }
-        // Pure JS validation fallback (no attestations, but still validates)
-        this.engineType = 'js';
-        this.wasmAvailable = false;
-        console.log('[MutationGuard] No accelerated proof engine available, using JS validation');
-    }
-    validateToken(token) {
-        if (token.expiresAt < Date.now()) {
-            return deny('token_validation', 'Authentication token expired', 'TOKEN_EXPIRED');
-        }
-        return null;
-    }
-    proveInsert(id, embedding, metadata, token) {
-        const start = this.hrtimeNs();
-        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
-        const tokenErr = this.validateToken(att);
-        if (tokenErr) {
-            this.denialsCount++;
-            return tokenErr;
-        }
-        const inv = [];
-        try {
-            validateVectorId(id);
-        }
-        catch (err) {
-            this.denialsCount++;
-            const ve = err;
-            return deny('insert', ve.message, ve.code ?? 'INVALID_ID', ve.field);
-        }
-        try {
-            validateVector(embedding, this.config.dimension);
-        }
-        catch (err) {
-            this.denialsCount++;
-            const ve = err;
-            return deny('insert', ve.message, ve.code ?? 'INVALID_VECTOR', ve.field);
-        }
-        if (metadata) {
-            try {
-                sanitizeMetadata(metadata);
-            }
-            catch (err) {
-                this.denialsCount++;
-                const ve = err;
-                return deny('insert', ve.message, ve.code ?? 'INVALID_METADATA', ve.field);
-            }
-        }
-        const capacityOk = this.vectorCount < this.config.maxElements;
-        inv.push({ check: 'capacity', passed: capacityOk });
-        if (!capacityOk) {
-            this.denialsCount++;
-            return deny('insert', 'Index capacity exceeded', 'CAPACITY_EXCEEDED');
-        }
-        let wasmProofId;
-        let attestationBytes;
-        if (this.wasmAvailable && this.wasmEnv) {
-            try {
-                if (this.engineType === 'native' || this.engineType === 'wasm') {
-                    // GraphTransformerService provides unified API
-                    const dimProof = this.wasmEnv.proveDimension(this.config.dimension, embedding.length);
-                    if (dimProof && dimProof.verified !== false) {
-                        wasmProofId = dimProof.proof_id ?? this.nextWasmProofId++;
-                        attestationBytes = this.wasmEnv.createAttestation?.(wasmProofId) ?? undefined;
-                        inv.push({ check: `graph_transformer_${this.engineType}_verify`, passed: true });
-                    }
-                    else {
-                        inv.push({ check: `graph_transformer_${this.engineType}_verify`, passed: false });
-                    }
-                }
-                else if (this.engineType === 'legacy-wasm') {
-                    // Legacy @ruvnet/ruvector-verified-wasm
-                    this.wasmEnv.verify_dim_check(this.config.dimension, embedding);
-                    wasmProofId = this.nextWasmProofId++;
-                    this.wasmEnv.create_attestation(wasmProofId);
-                    inv.push({ check: 'legacy_wasm_dim_verify', passed: true });
-                }
-            }
-            catch (error) {
-                inv.push({ check: 'proof_engine_verify', passed: false });
-            }
-        }
-        this.vectorCount++;
-        const proof = this.buildProof('insert', hashInsertInputs(id, embedding), att, inv, wasmProofId);
-        this.recordProofTime(start);
-        return proof;
-    }
-    proveSearch(query, k, options, token) {
-        const start = this.hrtimeNs();
-        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
-        const tokenErr = this.validateToken(att);
-        if (tokenErr) {
-            this.denialsCount++;
-            return tokenErr;
-        }
-        const inv = [];
-        try {
-            validateVector(query, this.config.dimension);
-        }
-        catch (err) {
-            this.denialsCount++;
-            const ve = err;
-            return deny('search', ve.message, ve.code ?? 'INVALID_VECTOR', ve.field);
-        }
-        try {
-            validateSearchOptions({ k, ...options });
-        }
-        catch (err) {
-            this.denialsCount++;
-            const ve = err;
-            return deny('search', ve.message, ve.code ?? 'INVALID_SEARCH_OPTIONS', ve.field);
-        }
-        inv.push({ check: 'query_valid', passed: true });
-        inv.push({ check: 'options_valid', passed: true });
-        const structuralHash = hashBytes(Buffer.from(query.buffer, query.byteOffset, query.byteLength), String(k));
-        const proof = this.buildProof('search', structuralHash, att, inv);
-        this.recordProofTime(start);
-        return proof;
-    }
-    proveBatchInsert(items, token) {
-        const start = this.hrtimeNs();
-        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
-        const tokenErr = this.validateToken(att);
-        if (tokenErr) {
-            this.denialsCount++;
-            return tokenErr;
-        }
-        const inv = [];
-        if (!items || items.length === 0) {
-            this.denialsCount++;
-            return deny('batch_insert', 'Batch is empty', 'EMPTY_BATCH');
-        }
-        if (items.length > SECURITY_LIMITS.MAX_BATCH_SIZE) {
-            this.denialsCount++;
-            return deny('batch_insert', 'Batch size exceeds maximum allowed limit', 'BATCH_SIZE_EXCEEDED');
-        }
-        inv.push({ check: 'batch_size', passed: true });
-        for (let i = 0; i < items.length; i++) {
-            const item = items[i];
-            try {
-                validateVectorId(item.id);
-            }
-            catch (err) {
-                this.denialsCount++;
-                const ve = err;
-                return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_ID', `items[${i}].id`);
-            }
-            try {
-                validateVector(item.embedding, this.config.dimension);
-            }
-            catch (err) {
-                this.denialsCount++;
-                const ve = err;
-                return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_VECTOR', `items[${i}].embedding`);
-            }
-            if (item.metadata) {
-                try {
-                    sanitizeMetadata(item.metadata);
-                }
-                catch (err) {
-                    this.denialsCount++;
-                    const ve = err;
-                    return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_METADATA', `items[${i}].metadata`);
-                }
-            }
-        }
-        inv.push({ check: 'items_valid', passed: true });
-        const capacityOk = this.vectorCount + items.length <= this.config.maxElements;
-        inv.push({ check: 'capacity', passed: capacityOk });
-        if (!capacityOk) {
-            this.denialsCount++;
-            return deny('batch_insert', 'Batch would exceed index capacity', 'CAPACITY_EXCEEDED');
-        }
-        const h = createHash('sha256');
-        for (const item of items) {
-            h.update(item.id);
-            h.update(Buffer.from(item.embedding.buffer, item.embedding.byteOffset, item.embedding.byteLength));
-        }
-        this.vectorCount += items.length;
-        const proof = this.buildProof('batch_insert', h.digest('hex'), att, inv);
-        this.recordProofTime(start);
-        return proof;
-    }
-    proveRemove(id, token) {
-        const start = this.hrtimeNs();
-        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
-        const tokenErr = this.validateToken(att);
-        if (tokenErr) {
-            this.denialsCount++;
-            return tokenErr;
-        }
-        const inv = [];
-        try {
-            validateVectorId(id);
-        }
-        catch (err) {
-            this.denialsCount++;
-            const ve = err;
-            return deny('remove', ve.message, ve.code ?? 'INVALID_ID', ve.field);
-        }
-        inv.push({ check: 'id_valid', passed: true });
-        if (this.vectorCount > 0)
-            this.vectorCount--;
-        const proof = this.buildProof('remove', hashBytes(id), att, inv);
-        this.recordProofTime(start);
-        return proof;
-    }
-    proveSave(path, token) {
-        const start = this.hrtimeNs();
-        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
-        const tokenErr = this.validateToken(att);
-        if (tokenErr) {
-            this.denialsCount++;
-            return tokenErr;
-        }
-        const inv = [];
-        const pathErr = this.validateSafePath(path, 'save');
-        if (pathErr !== null) {
-            this.denialsCount++;
-            return pathErr;
-        }
-        inv.push({ check: 'path_safe', passed: true });
-        const proof = this.buildProof('save', hashBytes(path), att, inv);
-        this.recordProofTime(start);
-        return proof;
-    }
-    proveLoad(path, token) {
-        const start = this.hrtimeNs();
-        const att = token ?? makeDefaultToken(this.config.defaultNamespace);
-        const tokenErr = this.validateToken(att);
-        if (tokenErr) {
-            this.denialsCount++;
-            return tokenErr;
-        }
-        const inv = [];
-        const pathErr = this.validateSafePath(path, 'load');
-        if (pathErr !== null) {
-            this.denialsCount++;
-            return pathErr;
-        }
-        inv.push({ check: 'path_safe', passed: true });
-        const proof = this.buildProof('load', hashBytes(path), att, inv);
-        this.recordProofTime(start);
-        return proof;
-    }
-    createToken(agentId, namespace, scope, ttlMs = DEFAULT_TOKEN_TTL_MS) {
-        const now = Date.now();
-        return { agentId, namespace, scope, issuedAt: now, expiresAt: now + ttlMs };
-    }
-    getStats() {
-        const avg = this.proofTimesNs.length > 0
-            ? this.proofTimesNs.reduce((a, b) => a + b, 0) / this.proofTimesNs.length
-            : 0;
-        return { proofsIssued: this.proofsIssuedCount, denials: this.denialsCount, wasmAvailable: this.wasmAvailable, engineType: this.engineType, avgProofTimeNs: avg };
-    }
-    static isDenial(result) {
-        return !('valid' in result);
-    }
-    getVectorCount() { return this.vectorCount; }
-    setVectorCount(count) { this.vectorCount = count; }
-    buildProof(operation, structuralHash, attestation, invariantChecks, wasmProofId) {
-        this.proofsIssuedCount++;
-        return {
-            id: randomUUID(), operation, timestamp: Date.now(),
-            structuralHash, attestation, invariantChecks, wasmProofId, valid: true,
-        };
-    }
-    validateSafePath(filePath, operation) {
-        if (!filePath || typeof filePath !== 'string')
-            return deny(operation, 'Path must be a non-empty string', 'INVALID_PATH', 'path');
-        if (filePath.includes('\x00'))
-            return deny(operation, 'Path contains null bytes', 'NULL_BYTE_IN_PATH', 'path');
-        // Normalize to resolve sequences like a/../b, then reject traversal
-        const normalized = posixPath.normalize(filePath);
-        if (normalized.startsWith('..') || normalized.includes('/..'))
-            return deny(operation, 'Path traversal attempt detected', 'PATH_TRAVERSAL', 'path');
-        if (posixPath.isAbsolute(normalized) || /^[a-zA-Z]:[\\/]/.test(filePath))
-            return deny(operation, 'Absolute paths are not allowed', 'ABSOLUTE_PATH', 'path');
-        return null;
-    }
-    hrtimeNs() { return process.hrtime.bigint(); }
-    recordProofTime(start) {
-        const elapsed = Number(process.hrtime.bigint() - start);
-        this.proofTimesNs.push(elapsed);
-        if (this.proofTimesNs.length > PROOF_TIME_WINDOW_SIZE)
-            this.proofTimesNs.shift();
-    }
-}
-//# sourceMappingURL=MutationGuard.js.map

package/dist/packages/agentdb/src/security/MutationGuard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"MutationGuard.js","sourceRoot":"","sources":["../../../../../../packages/agentdb/src/security/MutationGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AA2CzB,MAAM,oBAAoB,GAAG,OAAO,CAAC,CAAC,YAAY;AAClD,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,SAAS,gBAAgB,CAAC,EAAU;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;AACpH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAU,EAAE,SAAuB;IAC3D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACb,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,SAAS,CAAC,GAAG,KAA0B;IAC9C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,IAAI,CAAC,SAAiB,EAAE,MAAc,EAAE,IAAY,EAAE,KAAc;IAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,OAAO,aAAa;IACP,MAAM,CAAc;IAC7B,WAAW,GAAG,CAAC,CAAC;IAChB,OAAO,GAAQ,IAAI,CAAC;IACpB,aAAa,GAAG,KAAK,CAAC;IACtB,UAAU,GAA6C,IAAI,CAAC;IAC5D,eAAe,GAAG,CAAC,CAAC;IACpB,iBAAiB,GAAG,CAAC,CAAC;IACtB,YAAY,GAAG,CAAC,CAAC;IACjB,YAAY,GAAa,EAAE,CAAC;IAEpC,YAAY,MAAmB;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO;QAE1C,wDAAwD;QACxD,IAAI,CAAC;YACH,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;YAC3F,MAAM,GAAG,GAAG,IAAI,uBAAuB,EAAE,CAAC;YAC1C,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC;YAEvB,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;gBACnB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;gBACpE,OAAO,CAAC,GAAG,CAAC,oCAAoC,IAAI,CAAC,UAAU,eAAe,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,gEAAgE,EAAE,KAAK,CAAC,CAAC;QACxF,CAAC;QAED,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,gCAA0C,CAAC,CAAC;YACrE,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBAChD,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;QAE3C,qEAAqE;QACrE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;IAC5F,CAAC;IAEO,aAAa,CAAC,KAAuB;QAC3C,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,kBAAkB,EAAE,8BAA8B,EAAE,eAAe,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CACT,EAAU,EAAE,SAAuB,EACnC,QAA8B,EAAE,KAAwB;QAExD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAElC,IAAI,CAAC;YAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACzC,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACrE,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,gBAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;gBAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,kBAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,QAAQ,EAAE,yBAAyB,EAAE,mBAAmB,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,WAA+B,CAAC;QACpC,IAAI,gBAAwC,CAAC;QAC7C,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;oBAC/D,+CAA+C;oBAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;oBACtF,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;wBAC5C,WAAW,GAAG,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;wBAC1D,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;wBAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,IAAI,CAAC,UAAU,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnF,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,IAAI,CAAC,UAAU,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBACpF,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;oBAC7C,wCAAwC;oBACxC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBAChE,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;oBAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAChG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CACT,KAAmB,EAAE,CAAS,EAC9B,OAAa,EAAE,KAAwB;QAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAElC,IAAI,CAAC;YAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACjE,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,gBAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC;YAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,wBAAwB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACnF,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,SAAS,CAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CACzE,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gBAAgB,CACd,KAAqF,EACrF,KAAwB;QAExB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAElC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,cAAc,EAAE,CAAC;YAClD,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,cAAc,EAAE,0CAA0C,EAAE,qBAAqB,CAAC,CAAC;QACjG,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC;gBAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;gBAClC,OAAO,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,CAAC;gBAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;gBAClC,OAAO,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,gBAAgB,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;YAChH,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,IAAI,CAAC;oBAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACpD,IAAI,CAAC,YAAY,EAAE,CAAC;oBACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;oBAClC,OAAO,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,kBAAkB,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,cAAc,EAAE,mCAAmC,EAAE,mBAAmB,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACzE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CAAC,EAAU,EAAE,KAAwB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAElC,IAAI,CAAC;YAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACzC,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,GAAsB,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9C,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC;YAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,KAAwB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,OAAO,CAAC;QAAC,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,KAAwB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QACvD,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,OAAO,CAAC;QAAC,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CACT,OAAe,EAAE,SAAiB,EAClC,KAAiC,EAAE,QAAgB,oBAAoB;QAEvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,KAAK,EAAE,CAAC;IAC9E,CAAC;IAED,QAAQ;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM;YACzE,CAAC,CAAC,CAAC,CAAC;QACN,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;IACnK,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,MAAsC;QACpD,OAAO,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,cAAc,KAAa,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAErD,cAAc,CAAC,KAAa,IAAU,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC;IAEzD,UAAU,CAChB,SAAqC,EAAE,cAAsB,EAC7D,WAA6B,EAAE,eAAkC,EAAE,WAAoB;QAEvF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YAClD,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI;SACvE,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,QAAgB,EAAE,SAAiB;QAC1D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAC3C,OAAO,IAAI,CAAC,SAAS,EAAE,iCAAiC,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QACpF,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3B,OAAO,IAAI,CAAC,SAAS,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAClF,oEAAoE;QACpE,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,iCAAiC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACtE,OAAO,IAAI,CAAC,SAAS,EAAE,gCAAgC,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,QAAQ,KAAa,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEtD,eAAe,CAAC,KAAa;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,sBAAsB;YAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnF,CAAC;CACF","sourcesContent":["/**\n * ADR-060: Proof-Gated State Mutation\n *\n * MutationGuard is the single validation gate between controllers and backends.\n * Every mutation must produce a MutationProof before the backend executes it.\n * If validation fails a MutationDenial is returned instead.\n * Optional WASM-accelerated proofs via @ruvnet/ruvector-verified-wasm.\n */\n\nimport { createHash, randomUUID } from 'crypto';\nimport { posix as posixPath } from 'path';\nimport {\n  validateVector,\n  validateVectorId,\n  validateSearchOptions,\n  SECURITY_LIMITS,\n  sanitizeMetadata,\n} from './validation.js';\nimport { ValidationError } from './input-validation.js';\n\nexport interface MutationProof {\n  id: string;\n  operation: 'insert' | 'search' | 'remove' | 'batch_insert' | 'save' | 'load';\n  timestamp: number;\n  structuralHash: string;\n  attestation: AttestationToken;\n  invariantChecks: InvariantResult[];\n  wasmProofId?: number;\n  valid: true;\n}\n\nexport interface AttestationToken {\n  agentId: string;\n  namespace: string;\n  scope: 'read' | 'write' | 'admin';\n  issuedAt: number;\n  expiresAt: number;\n}\n\nexport interface InvariantResult {\n  check: string;\n  passed: boolean;\n}\n\nexport interface MutationDenial {\n  operation: string;\n  reason: string;\n  code: string;\n  field?: string;\n  timestamp: number;\n}\n\nexport interface GuardConfig {\n  dimension: number;\n  maxElements: number;\n  enableWasmProofs: boolean;\n  enableAttestationLog: boolean;\n  defaultNamespace: string;\n}\n\nconst DEFAULT_TOKEN_TTL_MS = 300_000; // 5 minutes\nconst PROOF_TIME_WINDOW_SIZE = 200;\n\nfunction makeDefaultToken(ns: string): AttestationToken {\n  const now = Date.now();\n  return { agentId: 'system', namespace: ns, scope: 'write', issuedAt: now, expiresAt: now + DEFAULT_TOKEN_TTL_MS };\n}\n\nfunction hashInsertInputs(id: string, embedding: Float32Array): string {\n  const h = createHash('sha256');\n  h.update(id);\n  h.update(Buffer.from(embedding.buffer, embedding.byteOffset, embedding.byteLength));\n  return h.digest('hex');\n}\n\nfunction hashBytes(...parts: (string | Buffer)[]): string {\n  const h = createHash('sha256');\n  for (const p of parts) h.update(p);\n  return h.digest('hex');\n}\n\nfunction deny(operation: string, reason: string, code: string, field?: string): MutationDenial {\n  return { operation, reason, code, field, timestamp: Date.now() };\n}\n\nexport class MutationGuard {\n  private readonly config: GuardConfig;\n  private vectorCount = 0;\n  private wasmEnv: any = null;\n  private wasmAvailable = false;\n  private engineType: 'native' | 'wasm' | 'legacy-wasm' | 'js' = 'js';\n  private nextWasmProofId = 1;\n  private proofsIssuedCount = 0;\n  private denialsCount = 0;\n  private proofTimesNs: number[] = [];\n\n  constructor(config: GuardConfig) {\n    this.config = config;\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.config.enableWasmProofs) return;\n\n    // Use GraphTransformerService for unified proof backend\n    try {\n      const { GraphTransformerService } = await import('../services/GraphTransformerService.js');\n      const gts = new GraphTransformerService();\n      await gts.initialize();\n\n      if (gts.isAvailable()) {\n        this.wasmEnv = gts;\n        this.wasmAvailable = true;\n        const stats = gts.getStats();\n        this.engineType = stats.engineType === 'native' ? 'native' : 'wasm';\n        console.log(`[MutationGuard] Initialized with ${this.engineType} proof engine`);\n        return;\n      }\n    } catch (error) {\n      console.warn('[MutationGuard] GraphTransformerService initialization failed:', error);\n    }\n\n    // Legacy fallback: @ruvnet/ruvector-verified-wasm\n    try {\n      const mod = await import('@ruvnet/ruvector-verified-wasm' as string);\n      if (mod && typeof mod.JsProofEnv === 'function') {\n        this.wasmEnv = new mod.JsProofEnv();\n        this.wasmAvailable = true;\n        this.engineType = 'legacy-wasm';\n        console.log('[MutationGuard] Using legacy verified-wasm proof engine');\n        return;\n      }\n    } catch { /* legacy WASM not available */ }\n\n    // Pure JS validation fallback (no attestations, but still validates)\n    this.engineType = 'js';\n    this.wasmAvailable = false;\n    console.log('[MutationGuard] No accelerated proof engine available, using JS validation');\n  }\n\n  private validateToken(token: AttestationToken): MutationDenial | null {\n    if (token.expiresAt < Date.now()) {\n      return deny('token_validation', 'Authentication token expired', 'TOKEN_EXPIRED');\n    }\n    return null;\n  }\n\n  proveInsert(\n    id: string, embedding: Float32Array,\n    metadata?: Record<string, any>, token?: AttestationToken,\n  ): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n\n    try { validateVectorId(id); } catch (err) {\n      this.denialsCount++;\n      const ve = err as ValidationError;\n      return deny('insert', ve.message, ve.code ?? 'INVALID_ID', ve.field);\n    }\n    try { validateVector(embedding, this.config.dimension); } catch (err) {\n      this.denialsCount++;\n      const ve = err as ValidationError;\n      return deny('insert', ve.message, ve.code ?? 'INVALID_VECTOR', ve.field);\n    }\n    if (metadata) {\n      try { sanitizeMetadata(metadata); } catch (err) {\n        this.denialsCount++;\n        const ve = err as ValidationError;\n        return deny('insert', ve.message, ve.code ?? 'INVALID_METADATA', ve.field);\n      }\n    }\n\n    const capacityOk = this.vectorCount < this.config.maxElements;\n    inv.push({ check: 'capacity', passed: capacityOk });\n    if (!capacityOk) {\n      this.denialsCount++;\n      return deny('insert', 'Index capacity exceeded', 'CAPACITY_EXCEEDED');\n    }\n\n    let wasmProofId: number | undefined;\n    let attestationBytes: Uint8Array | undefined;\n    if (this.wasmAvailable && this.wasmEnv) {\n      try {\n        if (this.engineType === 'native' || this.engineType === 'wasm') {\n          // GraphTransformerService provides unified API\n          const dimProof = this.wasmEnv.proveDimension(this.config.dimension, embedding.length);\n          if (dimProof && dimProof.verified !== false) {\n            wasmProofId = dimProof.proof_id ?? this.nextWasmProofId++;\n            attestationBytes = this.wasmEnv.createAttestation?.(wasmProofId) ?? undefined;\n            inv.push({ check: `graph_transformer_${this.engineType}_verify`, passed: true });\n          } else {\n            inv.push({ check: `graph_transformer_${this.engineType}_verify`, passed: false });\n          }\n        } else if (this.engineType === 'legacy-wasm') {\n          // Legacy @ruvnet/ruvector-verified-wasm\n          this.wasmEnv.verify_dim_check(this.config.dimension, embedding);\n          wasmProofId = this.nextWasmProofId++;\n          this.wasmEnv.create_attestation(wasmProofId);\n          inv.push({ check: 'legacy_wasm_dim_verify', passed: true });\n        }\n      } catch (error) {\n        inv.push({ check: 'proof_engine_verify', passed: false });\n      }\n    }\n\n    this.vectorCount++;\n    const proof = this.buildProof('insert', hashInsertInputs(id, embedding), att, inv, wasmProofId);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  proveSearch(\n    query: Float32Array, k: number,\n    options?: any, token?: AttestationToken,\n  ): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n\n    try { validateVector(query, this.config.dimension); } catch (err) {\n      this.denialsCount++;\n      const ve = err as ValidationError;\n      return deny('search', ve.message, ve.code ?? 'INVALID_VECTOR', ve.field);\n    }\n    try { validateSearchOptions({ k, ...options }); } catch (err) {\n      this.denialsCount++;\n      const ve = err as ValidationError;\n      return deny('search', ve.message, ve.code ?? 'INVALID_SEARCH_OPTIONS', ve.field);\n    }\n\n    inv.push({ check: 'query_valid', passed: true });\n    inv.push({ check: 'options_valid', passed: true });\n    const structuralHash = hashBytes(\n      Buffer.from(query.buffer, query.byteOffset, query.byteLength), String(k),\n    );\n    const proof = this.buildProof('search', structuralHash, att, inv);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  proveBatchInsert(\n    items: Array<{ id: string; embedding: Float32Array; metadata?: Record<string, any> }>,\n    token?: AttestationToken,\n  ): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n\n    if (!items || items.length === 0) {\n      this.denialsCount++;\n      return deny('batch_insert', 'Batch is empty', 'EMPTY_BATCH');\n    }\n    if (items.length > SECURITY_LIMITS.MAX_BATCH_SIZE) {\n      this.denialsCount++;\n      return deny('batch_insert', 'Batch size exceeds maximum allowed limit', 'BATCH_SIZE_EXCEEDED');\n    }\n    inv.push({ check: 'batch_size', passed: true });\n\n    for (let i = 0; i < items.length; i++) {\n      const item = items[i];\n      try { validateVectorId(item.id); } catch (err) {\n        this.denialsCount++;\n        const ve = err as ValidationError;\n        return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_ID', `items[${i}].id`);\n      }\n      try { validateVector(item.embedding, this.config.dimension); } catch (err) {\n        this.denialsCount++;\n        const ve = err as ValidationError;\n        return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_VECTOR', `items[${i}].embedding`);\n      }\n      if (item.metadata) {\n        try { sanitizeMetadata(item.metadata); } catch (err) {\n          this.denialsCount++;\n          const ve = err as ValidationError;\n          return deny('batch_insert', `Item ${i}: ${ve.message}`, ve.code ?? 'INVALID_METADATA', `items[${i}].metadata`);\n        }\n      }\n    }\n    inv.push({ check: 'items_valid', passed: true });\n\n    const capacityOk = this.vectorCount + items.length <= this.config.maxElements;\n    inv.push({ check: 'capacity', passed: capacityOk });\n    if (!capacityOk) {\n      this.denialsCount++;\n      return deny('batch_insert', 'Batch would exceed index capacity', 'CAPACITY_EXCEEDED');\n    }\n\n    const h = createHash('sha256');\n    for (const item of items) {\n      h.update(item.id);\n      h.update(Buffer.from(item.embedding.buffer, item.embedding.byteOffset, item.embedding.byteLength));\n    }\n\n    this.vectorCount += items.length;\n    const proof = this.buildProof('batch_insert', h.digest('hex'), att, inv);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  proveRemove(id: string, token?: AttestationToken): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n\n    try { validateVectorId(id); } catch (err) {\n      this.denialsCount++;\n      const ve = err as ValidationError;\n      return deny('remove', ve.message, ve.code ?? 'INVALID_ID', ve.field);\n    }\n    inv.push({ check: 'id_valid', passed: true });\n\n    if (this.vectorCount > 0) this.vectorCount--;\n    const proof = this.buildProof('remove', hashBytes(id), att, inv);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  proveSave(path: string, token?: AttestationToken): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n    const pathErr = this.validateSafePath(path, 'save');\n    if (pathErr !== null) { this.denialsCount++; return pathErr; }\n    inv.push({ check: 'path_safe', passed: true });\n    const proof = this.buildProof('save', hashBytes(path), att, inv);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  proveLoad(path: string, token?: AttestationToken): MutationProof | MutationDenial {\n    const start = this.hrtimeNs();\n    const att = token ?? makeDefaultToken(this.config.defaultNamespace);\n    const tokenErr = this.validateToken(att);\n    if (tokenErr) { this.denialsCount++; return tokenErr; }\n    const inv: InvariantResult[] = [];\n    const pathErr = this.validateSafePath(path, 'load');\n    if (pathErr !== null) { this.denialsCount++; return pathErr; }\n    inv.push({ check: 'path_safe', passed: true });\n    const proof = this.buildProof('load', hashBytes(path), att, inv);\n    this.recordProofTime(start);\n    return proof;\n  }\n\n  createToken(\n    agentId: string, namespace: string,\n    scope: 'read' | 'write' | 'admin', ttlMs: number = DEFAULT_TOKEN_TTL_MS,\n  ): AttestationToken {\n    const now = Date.now();\n    return { agentId, namespace, scope, issuedAt: now, expiresAt: now + ttlMs };\n  }\n\n  getStats(): { proofsIssued: number; denials: number; wasmAvailable: boolean; engineType: string; avgProofTimeNs: number } {\n    const avg = this.proofTimesNs.length > 0\n      ? this.proofTimesNs.reduce((a, b) => a + b, 0) / this.proofTimesNs.length\n      : 0;\n    return { proofsIssued: this.proofsIssuedCount, denials: this.denialsCount, wasmAvailable: this.wasmAvailable, engineType: this.engineType, avgProofTimeNs: avg };\n  }\n\n  static isDenial(result: MutationProof | MutationDenial): result is MutationDenial {\n    return !('valid' in result);\n  }\n\n  getVectorCount(): number { return this.vectorCount; }\n\n  setVectorCount(count: number): void { this.vectorCount = count; }\n\n  private buildProof(\n    operation: MutationProof['operation'], structuralHash: string,\n    attestation: AttestationToken, invariantChecks: InvariantResult[], wasmProofId?: number,\n  ): MutationProof {\n    this.proofsIssuedCount++;\n    return {\n      id: randomUUID(), operation, timestamp: Date.now(),\n      structuralHash, attestation, invariantChecks, wasmProofId, valid: true,\n    };\n  }\n\n  private validateSafePath(filePath: string, operation: string): MutationDenial | null {\n    if (!filePath || typeof filePath !== 'string')\n      return deny(operation, 'Path must be a non-empty string', 'INVALID_PATH', 'path');\n    if (filePath.includes('\\x00'))\n      return deny(operation, 'Path contains null bytes', 'NULL_BYTE_IN_PATH', 'path');\n    // Normalize to resolve sequences like a/../b, then reject traversal\n    const normalized = posixPath.normalize(filePath);\n    if (normalized.startsWith('..') || normalized.includes('/..'))\n      return deny(operation, 'Path traversal attempt detected', 'PATH_TRAVERSAL', 'path');\n    if (posixPath.isAbsolute(normalized) || /^[a-zA-Z]:[\\\\/]/.test(filePath))\n      return deny(operation, 'Absolute paths are not allowed', 'ABSOLUTE_PATH', 'path');\n    return null;\n  }\n\n  private hrtimeNs(): bigint { return process.hrtime.bigint(); }\n\n  private recordProofTime(start: bigint): void {\n    const elapsed = Number(process.hrtime.bigint() - start);\n    this.proofTimesNs.push(elapsed);\n    if (this.proofTimesNs.length > PROOF_TIME_WINDOW_SIZE) this.proofTimesNs.shift();\n  }\n}\n"]}

package/dist/packages/agentdb/src/security/input-validation.d.ts

@@ -1,109 +0,0 @@
-/**
- * Input Validation and Sanitization for AgentDB Security
- *
- * Provides comprehensive validation to prevent SQL injection and other attacks:
- * - Whitelist-based validation for identifiers (tables, columns, PRAGMA commands)
- * - Input sanitization for user data
- * - Type validation and constraints
- * - Error handling that doesn't leak sensitive information
- */
-/**
- * Validation error with safe error messages
- */
-export declare class ValidationError extends Error {
-    readonly code: string;
-    readonly field?: string;
-    constructor(message: string, code?: string, field?: string);
-    /**
-     * Get safe error message (doesn't leak sensitive info)
-     */
-    getSafeMessage(): string;
-}
-/**
- * Validate task string (NEW - for MCP tool optimization)
- */
-export declare function validateTaskString(task: unknown, fieldName?: string): string;
-/**
- * Validate numeric range (NEW - for MCP tool optimization)
- */
-export declare function validateNumericRange(value: unknown, fieldName: string, min: number, max: number): number;
-/**
- * Validate array length (NEW - for MCP tool optimization)
- */
-export declare function validateArrayLength<T>(arr: unknown, fieldName: string, minLength: number, maxLength: number): T[];
-/**
- * Validate object (NEW - for MCP tool optimization)
- */
-export declare function validateObject(obj: unknown, fieldName: string, required?: boolean): Record<string, any>;
-/**
- * Validate boolean (NEW - for MCP tool optimization)
- */
-export declare function validateBoolean(value: unknown, fieldName: string, defaultValue?: boolean): boolean;
-/**
- * Validate enum value (NEW - for MCP tool optimization)
- */
-export declare function validateEnum<T extends string>(value: unknown, fieldName: string, allowedValues: readonly T[]): T;
-/**
- * Validate table name against whitelist
- */
-export declare function validateTableName(tableName: string): string;
-/**
- * Validate column name against whitelist
- */
-export declare function validateColumnName(tableName: string, columnName: string): string;
-/**
- * Validate PRAGMA command against whitelist
- */
-export declare function validatePragmaCommand(pragma: string): string;
-/**
- * Validate and sanitize session ID
- */
-export declare function validateSessionId(sessionId: string): string;
-/**
- * Validate numeric ID
- */
-export declare function validateId(id: any, fieldName?: string): number;
-/**
- * Validate timestamp
- */
-export declare function validateTimestamp(timestamp: any, fieldName?: string): number;
-/**
- * Validate reward value (0-1)
- */
-export declare function validateReward(reward: any): number;
-/**
- * Validate success flag
- */
-export declare function validateSuccess(success: any): boolean;
-/**
- * Sanitize text input (prevent extremely long strings, null bytes, etc.)
- */
-export declare function sanitizeText(text: string, maxLength?: number, fieldName?: string): string;
-/**
- * Build safe WHERE clause with parameterized values
- * Returns both the SQL clause and the parameter values
- */
-export declare function buildSafeWhereClause(tableName: string, conditions: Record<string, any>): {
-    clause: string;
-    values: any[];
-};
-/**
- * Build safe SET clause for UPDATE statements
- */
-export declare function buildSafeSetClause(tableName: string, updates: Record<string, any>): {
-    clause: string;
-    values: any[];
-};
-/**
- * Validate JSON data
- */
-export declare function validateJSON(data: any, fieldName?: string): string;
-/**
- * Validate array of tags
- */
-export declare function validateTags(tags: any): string[];
-/**
- * Safe error handler that doesn't leak sensitive information
- */
-export declare function handleSecurityError(error: any): string;
-//# sourceMappingURL=input-validation.d.ts.map

package/dist/packages/agentdb/src/security/input-validation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../../../../packages/agentdb/src/security/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAyDH;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,KAAK,CAAC,EAAE,MAAM,CAAC;gBAEnB,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAA2B,EAAE,KAAK,CAAC,EAAE,MAAM;IAO9E;;OAEG;IACH,cAAc,IAAI,MAAM;CAGzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,GAAE,MAAe,GAAG,MAAM,CAkCpF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,MAAM,CAkBR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,CAAC,EAAE,CAkBL;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,OAAc,GACvB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAarB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAaT;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAC3C,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,SAAS,CAAC,EAAE,GAC1B,CAAC,CAkBH;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAkBhF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAkB5D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAqB3D;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,GAAE,MAAa,GAAG,MAAM,CAQpE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,GAAE,MAAoB,GAAG,MAAM,CAoBzF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,CAYlD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAgBrD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,MAAe,EAAE,SAAS,GAAE,MAAe,GAAG,MAAM,CAiBzG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC9B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,EAAE,CAAA;CAAE,CAoBnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,EAAE,CAAA;CAAE,CAoBnC;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,GAAE,MAAe,GAAG,MAAM,CAM1E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,GAAG,GAAG,MAAM,EAAE,CAahD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAStD"}