openclaw-observability 1.0.0

package/dist/security/rules.js

@@ -0,0 +1,479 @@
+"use strict";
+/**
+ * L1 Security detection rules
+ * Value-level scanning rules based on regex and functions
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALL_RULES = void 0;
+const types_1 = require("./types");
+/* ------------------------------------------------------------------ */
+/*  Helpers                                                             */
+/* ------------------------------------------------------------------ */
+/** Redact detected secrets: keep first 6 chars + ***DETECTED*** */
+function redactSecret(value) {
+    if (value.length <= 6)
+        return '***DETECTED***';
+    return value.substring(0, 6) + '***DETECTED***';
+}
+/** Find all regex matches in text, return redacted findings */
+function regexScan(text, pattern, rule, contextPrefix) {
+    const findings = [];
+    const seen = new Set();
+    let match;
+    // Use new RegExp instance to reset lastIndex
+    const re = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : pattern.flags + 'g');
+    while ((match = re.exec(text)) !== null) {
+        const raw = match[0];
+        const redacted = redactSecret(raw);
+        if (seen.has(redacted))
+            continue;
+        seen.add(redacted);
+        findings.push({
+            ruleId: rule.id,
+            ruleName: rule.name,
+            category: rule.category,
+            severity: rule.severity,
+            finding: redacted,
+            context: `${contextPrefix}: detected pattern at offset ${match.index}`,
+        });
+    }
+    return findings;
+}
+/* ------------------------------------------------------------------ */
+/*  S-series — Secret Leakage                                          */
+/* ------------------------------------------------------------------ */
+const S001_ALIYUN_AK = {
+    id: 'S001',
+    name: 'Alibaba Cloud AccessKey Leak',
+    category: types_1.RuleCategory.SecretLeakage,
+    severity: types_1.Severity.CRITICAL,
+    enabled: true,
+    detect: (text) => regexScan(text, /LTAI[A-Za-z0-9]{12,20}/g, S001_ALIYUN_AK, 'Alibaba Cloud AK'),
+};
+const S002_AWS_AK = {
+    id: 'S002',
+    name: 'AWS AccessKey Leak',
+    category: types_1.RuleCategory.SecretLeakage,
+    severity: types_1.Severity.CRITICAL,
+    enabled: true,
+    detect: (text) => regexScan(text, /AKIA[0-9A-Z]{16}/g, S002_AWS_AK, 'AWS AK'),
+};
+const S003_PRIVATE_KEY = {
+    id: 'S003',
+    name: 'Private Key Leak',
+    category: types_1.RuleCategory.SecretLeakage,
+    severity: types_1.Severity.CRITICAL,
+    enabled: true,
+    detect: (text) => regexScan(text, /-----BEGIN\s+(RSA|EC|OPENSSH|DSA|PGP)\s+PRIVATE\s+KEY-----/gi, S003_PRIVATE_KEY, 'Private Key'),
+};
+const S004_JWT = {
+    id: 'S004',
+    name: 'JWT Token Leak',
+    category: types_1.RuleCategory.SecretLeakage,
+    severity: types_1.Severity.WARN,
+    enabled: true,
+    detect: (text) => regexScan(text, /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+/g, S004_JWT, 'JWT Token'),
+};
+const S005_DB_CONN_STRING = {
+    id: 'S005',
+    name: 'Database Connection String Leak',
+    category: types_1.RuleCategory.SecretLeakage,
+    severity: types_1.Severity.WARN,
+    enabled: true,
+    detect: (text) => regexScan(text, /(mysql|postgres|postgresql|mongodb|redis|mssql):\/\/[^:]+:[^@]+@[^\s"',]+/gi, S005_DB_CONN_STRING, 'Database Connection String'),
+};
+const S006_GENERIC_API_KEY = {
+    id: 'S006',
+    name: 'Generic API Key Leak',
+    category: types_1.RuleCategory.SecretLeakage,
+    severity: types_1.Severity.WARN,
+    enabled: true,
+    detect: (text) => {
+        const findings = [];
+        // OpenAI style
+        findings.push(...regexScan(text, /sk-[A-Za-z0-9]{32,}/g, S006_GENERIC_API_KEY, 'OpenAI-style Key'));
+        // GitHub PAT
+        findings.push(...regexScan(text, /ghp_[A-Za-z0-9]{36}/g, S006_GENERIC_API_KEY, 'GitHub PAT'));
+        // GitHub fine-grained PAT
+        findings.push(...regexScan(text, /github_pat_[A-Za-z0-9_]{30,}/g, S006_GENERIC_API_KEY, 'GitHub Fine-grained PAT'));
+        // Generic bearer-like long tokens (40+ hex chars following common key patterns)
+        findings.push(...regexScan(text, /(?:api[_-]?key|secret|token|bearer)\s*[:=]\s*["']?([A-Za-z0-9_-]{32,})["']?/gi, S006_GENERIC_API_KEY, 'Generic API Key'));
+        return findings;
+    },
+};
+const S007_GCP_KEY = {
+    id: 'S007',
+    name: 'GCP Service Account Key',
+    category: types_1.RuleCategory.SecretLeakage,
+    severity: types_1.Severity.CRITICAL,
+    enabled: true,
+    detect: (text) => regexScan(text, /"type"\s*:\s*"service_account"/g, S007_GCP_KEY, 'GCP Service Account JSON'),
+};
+const S008_AZURE_CONN = {
+    id: 'S008',
+    name: 'Azure Connection String Leak',
+    category: types_1.RuleCategory.SecretLeakage,
+    severity: types_1.Severity.CRITICAL,
+    enabled: true,
+    detect: (text) => regexScan(text, /DefaultEndpointsProtocol=https?;AccountName=[^;]+;AccountKey=[^;]+/gi, S008_AZURE_CONN, 'Azure Connection String'),
+};
+/* ------------------------------------------------------------------ */
+/*  H-series — High Risk Operations                                    */
+/* ------------------------------------------------------------------ */
+const H001_DANGEROUS_SHELL = {
+    id: 'H001',
+    name: 'Dangerous Shell Command',
+    category: types_1.RuleCategory.HighRiskOp,
+    severity: types_1.Severity.CRITICAL,
+    enabled: true,
+    detect: (_text, action) => {
+        const dangerous = [
+            /rm\s+-rf\s+\//i, // rm -rf /
+            /rm\s+-rf\s+~/i, // rm -rf ~
+            /mkfs\./i, // format disk
+            /dd\s+if=/i, // disk write
+            />\s*\/dev\/sd/i, // overwrite disk
+            /chmod\s+777/i, // open all permissions
+            /chmod\s+\+s/i, // setuid
+            /chown\s+root/i, // change to root
+            /curl\s+.*\|\s*sh/i, // curl pipe to sh
+            /wget\s+.*\|\s*sh/i, // wget pipe to sh
+            /curl\s+.*\|\s*bash/i, // curl pipe to bash
+            /\|\s*nc\s+/i, // pipe to netcat
+            /python\s+-c\s+['"]import\s+os/i, // python command injection
+            /eval\s*\(/i, // eval
+            /base64\s+-d\s*\|/i, // base64 decode pipe
+        ];
+        // 1) Actual tool execution -> CRITICAL
+        if (action.actionType === 'tool_call') {
+            const name = action.actionName.toLowerCase();
+            if (!name.includes('shell') && !name.includes('exec') && !name.includes('terminal') && !name.includes('bash') && !name.includes('command'))
+                return [];
+            const paramText = action.inputParams ? JSON.stringify(action.inputParams) : '';
+            const findings = [];
+            for (const pat of dangerous) {
+                if (pat.test(paramText)) {
+                    findings.push({
+                        ruleId: H001_DANGEROUS_SHELL.id,
+                        ruleName: H001_DANGEROUS_SHELL.name,
+                        category: H001_DANGEROUS_SHELL.category,
+                        severity: types_1.Severity.CRITICAL,
+                        finding: `Dangerous command pattern: ${pat.source}`,
+                        context: `tool=${action.actionName}`,
+                    });
+                }
+            }
+            return findings;
+        }
+        // 2) User message intent detection -> WARN
+        if (action.actionType === 'model_resolve' || action.actionType === 'message') {
+            const inputText = action.inputParams ? JSON.stringify(action.inputParams) : '';
+            for (const pat of dangerous) {
+                if (pat.test(inputText)) {
+                    return [{
+                            ruleId: H001_DANGEROUS_SHELL.id,
+                            ruleName: H001_DANGEROUS_SHELL.name,
+                            category: H001_DANGEROUS_SHELL.category,
+                            severity: types_1.Severity.WARN,
+                            finding: `User requested dangerous command: ${pat.source}`,
+                            context: `action=${action.actionName}, intent detected (may not have been executed)`,
+                        }];
+                }
+            }
+        }
+        return [];
+    },
+};
+const H002_SENSITIVE_PATH = {
+    id: 'H002',
+    name: 'Sensitive File Path Access',
+    category: types_1.RuleCategory.HighRiskOp,
+    severity: types_1.Severity.WARN,
+    enabled: true,
+    detect: (_text, action) => {
+        const sensitivePaths = [
+            /\.ssh\//i,
+            /\.env(?:\.|$|["'\s])/i,
+            /\.aws\/credentials/i,
+            /\.kube\/config/i,
+            /\.docker\/config\.json/i,
+            /\/etc\/shadow/i,
+            /\/etc\/passwd/i,
+            /id_rsa/i,
+            /id_ed25519/i,
+            /\.pem["']/i,
+            /\.key["']/i,
+            /credentials\.json/i,
+            /\.netrc/i,
+            /\.pgpass/i,
+            /\.my\.cnf/i,
+        ];
+        // 1) Actual tool execution -> CRITICAL
+        if (action.actionType === 'tool_call') {
+            const paramText = action.inputParams ? JSON.stringify(action.inputParams) : '';
+            const findings = [];
+            for (const pat of sensitivePaths) {
+                if (pat.test(paramText)) {
+                    findings.push({
+                        ruleId: H002_SENSITIVE_PATH.id,
+                        ruleName: H002_SENSITIVE_PATH.name,
+                        category: H002_SENSITIVE_PATH.category,
+                        severity: types_1.Severity.CRITICAL,
+                        finding: `Sensitive path access: ${pat.source}`,
+                        context: `tool=${action.actionName}`,
+                    });
+                }
+            }
+            return findings;
+        }
+        // 2) User message intent detection -> WARN
+        if (action.actionType === 'model_resolve' || action.actionType === 'message') {
+            const inputText = action.inputParams ? JSON.stringify(action.inputParams) : '';
+            for (const pat of sensitivePaths) {
+                if (pat.test(inputText)) {
+                    return [{
+                            ruleId: H002_SENSITIVE_PATH.id,
+                            ruleName: H002_SENSITIVE_PATH.name,
+                            category: H002_SENSITIVE_PATH.category,
+                            severity: types_1.Severity.WARN,
+                            finding: `User requested sensitive path access: ${pat.source}`,
+                            context: `action=${action.actionName}, intent detected (may not have been executed)`,
+                        }];
+                }
+            }
+        }
+        return [];
+    },
+};
+const H003_LARGE_OUTPUT = {
+    id: 'H003',
+    name: 'Abnormally Large Data Output',
+    category: types_1.RuleCategory.DataExfil,
+    severity: types_1.Severity.WARN,
+    enabled: true,
+    detect: (_text, action) => {
+        if (action.actionType !== 'tool_call')
+            return [];
+        const outputText = action.outputResult ? JSON.stringify(action.outputResult) : '';
+        const sizeKB = Math.round(Buffer.byteLength(outputText, 'utf8') / 1024);
+        if (sizeKB > 100) {
+            return [{
+                    ruleId: H003_LARGE_OUTPUT.id,
+                    ruleName: H003_LARGE_OUTPUT.name,
+                    category: H003_LARGE_OUTPUT.category,
+                    severity: H003_LARGE_OUTPUT.severity,
+                    finding: `Tool output size: ${sizeKB}KB (threshold: 100KB)`,
+                    context: `tool=${action.actionName}`,
+                }];
+        }
+        return [];
+    },
+};
+const H004_ENV_ACCESS = {
+    id: 'H004',
+    name: 'Environment Variable Access',
+    category: types_1.RuleCategory.HighRiskOp,
+    severity: types_1.Severity.WARN,
+    enabled: true,
+    detect: (_text, action) => {
+        if (action.actionType !== 'tool_call')
+            return [];
+        const text = JSON.stringify(action.inputParams) + JSON.stringify(action.outputResult);
+        // Check for bulk environment variable leakage (multiple KEY=VALUE patterns)
+        const envVarPattern = /[A-Z_]{3,}=\S+/g;
+        const matches = text.match(envVarPattern);
+        if (matches && matches.length >= 5) {
+            return [{
+                    ruleId: H004_ENV_ACCESS.id,
+                    ruleName: H004_ENV_ACCESS.name,
+                    category: H004_ENV_ACCESS.category,
+                    severity: H004_ENV_ACCESS.severity,
+                    finding: `Bulk environment variables detected: ${matches.length} variables`,
+                    context: `tool=${action.actionName}, sample: ${matches.slice(0, 3).map(m => m.split('=')[0]).join(', ')}...`,
+                }];
+        }
+        return [];
+    },
+};
+const H005_SUDO = {
+    id: 'H005',
+    name: 'Privilege Escalation Attempt',
+    category: types_1.RuleCategory.HighRiskOp,
+    severity: types_1.Severity.CRITICAL,
+    enabled: true,
+    detect: (_text, action) => {
+        const sudoPatterns = [
+            /sudo\s+/i,
+            /su\s+-\s/i,
+            /pkexec\s+/i,
+            /doas\s+/i,
+        ];
+        // 1) Actual tool execution -> CRITICAL
+        if (action.actionType === 'tool_call') {
+            const paramText = action.inputParams ? JSON.stringify(action.inputParams) : '';
+            const findings = [];
+            for (const pat of sudoPatterns) {
+                if (pat.test(paramText)) {
+                    findings.push({
+                        ruleId: H005_SUDO.id,
+                        ruleName: H005_SUDO.name,
+                        category: H005_SUDO.category,
+                        severity: types_1.Severity.CRITICAL,
+                        finding: `Privilege escalation attempt: ${pat.source}`,
+                        context: `tool=${action.actionName}`,
+                    });
+                    break;
+                }
+            }
+            return findings;
+        }
+        // 2) User message intent detection -> WARN (LLM may refuse, but intent is logged)
+        if (action.actionType === 'model_resolve' || action.actionType === 'message') {
+            const inputText = action.inputParams ? JSON.stringify(action.inputParams) : '';
+            for (const pat of sudoPatterns) {
+                if (pat.test(inputText)) {
+                    return [{
+                            ruleId: H005_SUDO.id,
+                            ruleName: H005_SUDO.name,
+                            category: H005_SUDO.category,
+                            severity: types_1.Severity.WARN,
+                            finding: `User requested privilege escalation: ${pat.source}`,
+                            context: `action=${action.actionName}, intent detected (may not have been executed)`,
+                        }];
+                }
+            }
+        }
+        return [];
+    },
+};
+/* ------------------------------------------------------------------ */
+/*  T-series — Prompt Injection / Skill Threats                        */
+/* ------------------------------------------------------------------ */
+const T005_PROMPT_INJECTION = {
+    id: 'T005',
+    name: 'Prompt Injection Detection',
+    category: types_1.RuleCategory.PromptInjection,
+    severity: types_1.Severity.WARN,
+    enabled: true,
+    detect: (_text, action) => {
+        const injectionPatterns = [
+            /ignore\s+(all\s+)?previous\s+(instructions?|prompts?)/i,
+            /disregard\s+(all\s+)?(above|previous)/i,
+            /new\s+instructions?\s*:/i,
+            /system\s*prompt\s*:/i,
+            /you\s+are\s+now\s+/i,
+            /forget\s+(everything|all|your)/i,
+            /override\s+(your|the)\s+(instructions?|rules?|guidelines?)/i,
+            /\[system\]/i,
+            /\[INST\]/i,
+            /<<SYS>>/i,
+            /act\s+as\s+(a|an)\s+/i,
+        ];
+        const findings = [];
+        // 1) Check user input (message / model_resolve) -> user-initiated injection
+        if (action.actionType === 'message' || action.actionType === 'model_resolve') {
+            const inputText = action.inputParams ? JSON.stringify(action.inputParams).toLowerCase() : '';
+            for (const pat of injectionPatterns) {
+                if (pat.test(inputText)) {
+                    findings.push({
+                        ruleId: T005_PROMPT_INJECTION.id,
+                        ruleName: T005_PROMPT_INJECTION.name,
+                        category: T005_PROMPT_INJECTION.category,
+                        severity: types_1.Severity.WARN,
+                        finding: `Prompt injection attempt in user input: ${pat.source}`,
+                        context: `action=${action.actionName}, in input/params`,
+                    });
+                    break;
+                }
+            }
+        }
+        // 2) Check tool output (tool_call) -> malicious tool return injection
+        if (action.actionType === 'tool_call') {
+            const outputText = action.outputResult ? JSON.stringify(action.outputResult).toLowerCase() : '';
+            for (const pat of injectionPatterns) {
+                if (pat.test(outputText)) {
+                    findings.push({
+                        ruleId: T005_PROMPT_INJECTION.id,
+                        ruleName: T005_PROMPT_INJECTION.name,
+                        category: T005_PROMPT_INJECTION.category,
+                        severity: types_1.Severity.CRITICAL, // tool injection is more severe
+                        finding: `Prompt injection in tool output: ${pat.source}`,
+                        context: `tool=${action.actionName}, in output/result — potential skill trojan`,
+                    });
+                    break;
+                }
+            }
+        }
+        return findings;
+    },
+};
+/** Built-in safe domain whitelist (always active) */
+const BUILTIN_SAFE_DOMAINS = [
+    'api.openai.com', 'api.anthropic.com', 'dashscope.aliyuncs.com',
+    'generativelanguage.googleapis.com', 'api.groq.com',
+    'localhost', '127.0.0.1', '0.0.0.0',
+    'github.com', 'api.github.com',
+    'googleapis.com', 'azure.com',
+];
+const T003_EXTERNAL_REQUEST = {
+    id: 'T003',
+    name: 'External Network Request Detection',
+    category: types_1.RuleCategory.DataExfil,
+    severity: types_1.Severity.INFO,
+    enabled: true,
+    detect: (_text, action, ctx) => {
+        if (action.actionType !== 'tool_call')
+            return [];
+        const paramText = action.inputParams ? JSON.stringify(action.inputParams) : '';
+        // Merge built-in whitelist + user-configured whitelist
+        const userWhitelist = ctx?.domainWhitelist ?? [];
+        const safeList = [...BUILTIN_SAFE_DOMAINS, ...userWhitelist];
+        // Extract URLs
+        const urlPattern = /https?:\/\/([a-zA-Z0-9.-]+)/gi;
+        const findings = [];
+        const seen = new Set();
+        let match;
+        while ((match = urlPattern.exec(paramText)) !== null) {
+            const domain = match[1].toLowerCase();
+            if (seen.has(domain))
+                continue;
+            seen.add(domain);
+            // Whitelisted domains are not alerted
+            if (safeList.some(s => domain === s || domain.endsWith('.' + s)))
+                continue;
+            findings.push({
+                ruleId: T003_EXTERNAL_REQUEST.id,
+                ruleName: T003_EXTERNAL_REQUEST.name,
+                category: T003_EXTERNAL_REQUEST.category,
+                severity: types_1.Severity.WARN, // non-whitelisted domain -> escalate
+                finding: `External request to: ${domain}`,
+                context: `tool=${action.actionName}`,
+            });
+        }
+        return findings;
+    },
+};
+/* ------------------------------------------------------------------ */
+/*  Export all rules                                                    */
+/* ------------------------------------------------------------------ */
+exports.ALL_RULES = [
+    // S-series — Secret Leakage
+    S001_ALIYUN_AK,
+    S002_AWS_AK,
+    S003_PRIVATE_KEY,
+    S004_JWT,
+    S005_DB_CONN_STRING,
+    S006_GENERIC_API_KEY,
+    S007_GCP_KEY,
+    S008_AZURE_CONN,
+    // H-series — High Risk Operations
+    H001_DANGEROUS_SHELL,
+    H002_SENSITIVE_PATH,
+    H003_LARGE_OUTPUT,
+    H004_ENV_ACCESS,
+    H005_SUDO,
+    // T-series — Prompt Injection / Skill Threats
+    T005_PROMPT_INJECTION,
+    T003_EXTERNAL_REQUEST,
+];
+//# sourceMappingURL=rules.js.map

package/dist/security/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/security/rules.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,mCAAkE;AAuBlE,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AAExE,mEAAmE;AACnE,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC/C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,gBAAgB,CAAC;AAClD,CAAC;AAED,+DAA+D;AAC/D,SAAS,SAAS,CAChB,IAAY,EACZ,OAAe,EACf,IAA8E,EAC9E,aAAqB;IAErB,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,KAA6B,CAAC;IAElC,6CAA6C;IAC7C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;IACzG,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEnB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,GAAG,aAAa,gCAAgC,KAAK,CAAC,KAAK,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,MAAM,cAAc,GAAiB;IACnC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,8BAA8B;IACpC,QAAQ,EAAE,oBAAY,CAAC,aAAa;IACpC,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;IAC3B,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,SAAS,CAAC,IAAI,EAAE,yBAAyB,EAAE,cAAc,EAAE,kBAAkB,CAAC;CACjF,CAAC;AAEF,MAAM,WAAW,GAAiB;IAChC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,oBAAoB;IAC1B,QAAQ,EAAE,oBAAY,CAAC,aAAa;IACpC,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;IAC3B,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,SAAS,CAAC,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,QAAQ,CAAC;CAC9D,CAAC;AAEF,MAAM,gBAAgB,GAAiB;IACrC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,kBAAkB;IACxB,QAAQ,EAAE,oBAAY,CAAC,aAAa;IACpC,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;IAC3B,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,SAAS,CACP,IAAI,EACJ,8DAA8D,EAC9D,gBAAgB,EAChB,aAAa,CACd;CACJ,CAAC;AAEF,MAAM,QAAQ,GAAiB;IAC7B,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,gBAAgB;IACtB,QAAQ,EAAE,oBAAY,CAAC,aAAa;IACpC,QAAQ,EAAE,gBAAQ,CAAC,IAAI;IACvB,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,SAAS,CACP,IAAI,EACJ,+DAA+D,EAC/D,QAAQ,EACR,WAAW,CACZ;CACJ,CAAC;AAEF,MAAM,mBAAmB,GAAiB;IACxC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,iCAAiC;IACvC,QAAQ,EAAE,oBAAY,CAAC,aAAa;IACpC,QAAQ,EAAE,gBAAQ,CAAC,IAAI;IACvB,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,SAAS,CACP,IAAI,EACJ,6EAA6E,EAC7E,mBAAmB,EACnB,4BAA4B,CAC7B;CACJ,CAAC;AAEF,MAAM,oBAAoB,GAAiB;IACzC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,oBAAY,CAAC,aAAa;IACpC,QAAQ,EAAE,gBAAQ,CAAC,IAAI;IACvB,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACf,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,eAAe;QACf,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACpG,aAAa;QACb,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC;QAC9F,0BAA0B;QAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,+BAA+B,EAAE,oBAAoB,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACpH,gFAAgF;QAChF,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,+EAA+E,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC5J,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,MAAM,YAAY,GAAiB;IACjC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,yBAAyB;IAC/B,QAAQ,EAAE,oBAAY,CAAC,aAAa;IACpC,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;IAC3B,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,SAAS,CAAC,IAAI,EAAE,iCAAiC,EAAE,YAAY,EAAE,0BAA0B,CAAC;CAC/F,CAAC;AAEF,MAAM,eAAe,GAAiB;IACpC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,8BAA8B;IACpC,QAAQ,EAAE,oBAAY,CAAC,aAAa;IACpC,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;IAC3B,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,SAAS,CACP,IAAI,EACJ,sEAAsE,EACtE,eAAe,EACf,yBAAyB,CAC1B;CACJ,CAAC;AAEF,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,MAAM,oBAAoB,GAAiB;IACzC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,yBAAyB;IAC/B,QAAQ,EAAE,oBAAY,CAAC,UAAU;IACjC,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;IAC3B,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACxB,MAAM,SAAS,GAAG;YAChB,gBAAgB,EAAW,WAAW;YACtC,eAAe,EAAY,WAAW;YACtC,SAAS,EAAmB,cAAc;YAC1C,WAAW,EAAiB,aAAa;YACzC,gBAAgB,EAAW,iBAAiB;YAC5C,cAAc,EAAa,uBAAuB;YAClD,cAAc,EAAa,SAAS;YACpC,eAAe,EAAY,iBAAiB;YAC5C,mBAAmB,EAAO,kBAAkB;YAC5C,mBAAmB,EAAO,kBAAkB;YAC5C,qBAAqB,EAAK,oBAAoB;YAC9C,aAAa,EAAc,iBAAiB;YAC5C,gCAAgC,EAAE,2BAA2B;YAC7D,YAAY,EAAe,OAAO;YAClC,mBAAmB,EAAQ,qBAAqB;SACjD,CAAC;QAEF,uCAAuC;QACvC,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,CAAC;YAEtJ,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,QAAQ,GAAsB,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxB,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,oBAAoB,CAAC,EAAE;wBAC/B,QAAQ,EAAE,oBAAoB,CAAC,IAAI;wBACnC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ;wBACvC,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;wBAC3B,OAAO,EAAE,8BAA8B,GAAG,CAAC,MAAM,EAAE;wBACnD,OAAO,EAAE,QAAQ,MAAM,CAAC,UAAU,EAAE;qBACrC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,2CAA2C;QAC3C,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxB,OAAO,CAAC;4BACN,MAAM,EAAE,oBAAoB,CAAC,EAAE;4BAC/B,QAAQ,EAAE,oBAAoB,CAAC,IAAI;4BACnC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ;4BACvC,QAAQ,EAAE,gBAAQ,CAAC,IAAI;4BACvB,OAAO,EAAE,qCAAqC,GAAG,CAAC,MAAM,EAAE;4BAC1D,OAAO,EAAE,UAAU,MAAM,CAAC,UAAU,gDAAgD;yBACrF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC;AAEF,MAAM,mBAAmB,GAAiB;IACxC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,4BAA4B;IAClC,QAAQ,EAAE,oBAAY,CAAC,UAAU;IACjC,QAAQ,EAAE,gBAAQ,CAAC,IAAI;IACvB,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACxB,MAAM,cAAc,GAAG;YACrB,UAAU;YACV,uBAAuB;YACvB,qBAAqB;YACrB,iBAAiB;YACjB,yBAAyB;YACzB,gBAAgB;YAChB,gBAAgB;YAChB,SAAS;YACT,aAAa;YACb,YAAY;YACZ,YAAY;YACZ,oBAAoB;YACpB,UAAU;YACV,WAAW;YACX,YAAY;SACb,CAAC;QAEF,uCAAuC;QACvC,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,QAAQ,GAAsB,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxB,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,mBAAmB,CAAC,EAAE;wBAC9B,QAAQ,EAAE,mBAAmB,CAAC,IAAI;wBAClC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ;wBACtC,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;wBAC3B,OAAO,EAAE,0BAA0B,GAAG,CAAC,MAAM,EAAE;wBAC/C,OAAO,EAAE,QAAQ,MAAM,CAAC,UAAU,EAAE;qBACrC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,2CAA2C;QAC3C,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxB,OAAO,CAAC;4BACN,MAAM,EAAE,mBAAmB,CAAC,EAAE;4BAC9B,QAAQ,EAAE,mBAAmB,CAAC,IAAI;4BAClC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ;4BACtC,QAAQ,EAAE,gBAAQ,CAAC,IAAI;4BACvB,OAAO,EAAE,yCAAyC,GAAG,CAAC,MAAM,EAAE;4BAC9D,OAAO,EAAE,UAAU,MAAM,CAAC,UAAU,gDAAgD;yBACrF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAiB;IACtC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,8BAA8B;IACpC,QAAQ,EAAE,oBAAY,CAAC,SAAS;IAChC,QAAQ,EAAE,gBAAQ,CAAC,IAAI;IACvB,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACxB,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW;YAAE,OAAO,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QACxE,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACjB,OAAO,CAAC;oBACN,MAAM,EAAE,iBAAiB,CAAC,EAAE;oBAC5B,QAAQ,EAAE,iBAAiB,CAAC,IAAI;oBAChC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;oBACpC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;oBACpC,OAAO,EAAE,qBAAqB,MAAM,uBAAuB;oBAC3D,OAAO,EAAE,QAAQ,MAAM,CAAC,UAAU,EAAE;iBACrC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC;AAEF,MAAM,eAAe,GAAiB;IACpC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,6BAA6B;IACnC,QAAQ,EAAE,oBAAY,CAAC,UAAU;IACjC,QAAQ,EAAE,gBAAQ,CAAC,IAAI;IACvB,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACxB,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW;YAAE,OAAO,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEtF,4EAA4E;QAC5E,MAAM,aAAa,GAAG,iBAAiB,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC;oBACN,MAAM,EAAE,eAAe,CAAC,EAAE;oBAC1B,QAAQ,EAAE,eAAe,CAAC,IAAI;oBAC9B,QAAQ,EAAE,eAAe,CAAC,QAAQ;oBAClC,QAAQ,EAAE,eAAe,CAAC,QAAQ;oBAClC,OAAO,EAAE,wCAAwC,OAAO,CAAC,MAAM,YAAY;oBAC3E,OAAO,EAAE,QAAQ,MAAM,CAAC,UAAU,aAAa,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;iBAC7G,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC;AAEF,MAAM,SAAS,GAAiB;IAC9B,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,8BAA8B;IACpC,QAAQ,EAAE,oBAAY,CAAC,UAAU;IACjC,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;IAC3B,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACxB,MAAM,YAAY,GAAG;YACnB,UAAU;YACV,WAAW;YACX,YAAY;YACZ,UAAU;SACX,CAAC;QAEF,uCAAuC;QACvC,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,QAAQ,GAAsB,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxB,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,SAAS,CAAC,EAAE;wBACpB,QAAQ,EAAE,SAAS,CAAC,IAAI;wBACxB,QAAQ,EAAE,SAAS,CAAC,QAAQ;wBAC5B,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;wBAC3B,OAAO,EAAE,iCAAiC,GAAG,CAAC,MAAM,EAAE;wBACtD,OAAO,EAAE,QAAQ,MAAM,CAAC,UAAU,EAAE;qBACrC,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,kFAAkF;QAClF,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxB,OAAO,CAAC;4BACN,MAAM,EAAE,SAAS,CAAC,EAAE;4BACpB,QAAQ,EAAE,SAAS,CAAC,IAAI;4BACxB,QAAQ,EAAE,SAAS,CAAC,QAAQ;4BAC5B,QAAQ,EAAE,gBAAQ,CAAC,IAAI;4BACvB,OAAO,EAAE,wCAAwC,GAAG,CAAC,MAAM,EAAE;4BAC7D,OAAO,EAAE,UAAU,MAAM,CAAC,UAAU,gDAAgD;yBACrF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC;AAEF,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,MAAM,qBAAqB,GAAiB;IAC1C,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,4BAA4B;IAClC,QAAQ,EAAE,oBAAY,CAAC,eAAe;IACtC,QAAQ,EAAE,gBAAQ,CAAC,IAAI;IACvB,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACxB,MAAM,iBAAiB,GAAG;YACxB,wDAAwD;YACxD,wCAAwC;YACxC,0BAA0B;YAC1B,sBAAsB;YACtB,qBAAqB;YACrB,iCAAiC;YACjC,6DAA6D;YAC7D,aAAa;YACb,WAAW;YACX,UAAU;YACV,uBAAuB;SACxB,CAAC;QAEF,MAAM,QAAQ,GAAsB,EAAE,CAAC;QAEvC,4EAA4E;QAC5E,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;gBACpC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxB,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,qBAAqB,CAAC,EAAE;wBAChC,QAAQ,EAAE,qBAAqB,CAAC,IAAI;wBACpC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ;wBACxC,QAAQ,EAAE,gBAAQ,CAAC,IAAI;wBACvB,OAAO,EAAE,2CAA2C,GAAG,CAAC,MAAM,EAAE;wBAChE,OAAO,EAAE,UAAU,MAAM,CAAC,UAAU,mBAAmB;qBACxD,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;gBACpC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzB,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,qBAAqB,CAAC,EAAE;wBAChC,QAAQ,EAAE,qBAAqB,CAAC,IAAI;wBACpC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ;wBACxC,QAAQ,EAAE,gBAAQ,CAAC,QAAQ,EAAG,gCAAgC;wBAC9D,OAAO,EAAE,oCAAoC,GAAG,CAAC,MAAM,EAAE;wBACzD,OAAO,EAAE,QAAQ,MAAM,CAAC,UAAU,6CAA6C;qBAChF,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,qDAAqD;AACrD,MAAM,oBAAoB,GAAG;IAC3B,gBAAgB,EAAE,mBAAmB,EAAE,wBAAwB;IAC/D,mCAAmC,EAAE,cAAc;IACnD,WAAW,EAAE,WAAW,EAAE,SAAS;IACnC,YAAY,EAAE,gBAAgB;IAC9B,gBAAgB,EAAE,WAAW;CAC9B,CAAC;AAEF,MAAM,qBAAqB,GAAiB;IAC1C,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,oCAAoC;IAC1C,QAAQ,EAAE,oBAAY,CAAC,SAAS;IAChC,QAAQ,EAAE,gBAAQ,CAAC,IAAI;IACvB,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAI,EAAE,EAAE;QAC9B,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW;YAAE,OAAO,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAE/E,uDAAuD;QACvD,MAAM,aAAa,GAAG,GAAG,EAAE,eAAe,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,CAAC,GAAG,oBAAoB,EAAE,GAAG,aAAa,CAAC,CAAC;QAE7D,eAAe;QACf,MAAM,UAAU,GAAG,+BAA+B,CAAC;QACnD,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEjB,sCAAsC;YACtC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAE3E,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,qBAAqB,CAAC,EAAE;gBAChC,QAAQ,EAAE,qBAAqB,CAAC,IAAI;gBACpC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ;gBACxC,QAAQ,EAAE,gBAAQ,CAAC,IAAI,EAAG,qCAAqC;gBAC/D,OAAO,EAAE,wBAAwB,MAAM,EAAE;gBACzC,OAAO,EAAE,QAAQ,MAAM,CAAC,UAAU,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AAE3D,QAAA,SAAS,GAAmB;IACvC,4BAA4B;IAC5B,cAAc;IACd,WAAW;IACX,gBAAgB;IAChB,QAAQ;IACR,mBAAmB;IACnB,oBAAoB;IACpB,YAAY;IACZ,eAAe;IACf,kCAAkC;IAClC,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,SAAS;IACT,8CAA8C;IAC9C,qBAAqB;IACrB,qBAAqB;CACtB,CAAC"}

package/dist/security/scanner.d.ts

@@ -0,0 +1,47 @@
+/**
+ * SecurityScanner — main entry point for security detection
+ * Coordinates L1 rule engine + L2 behavior chain detector
+ */
+import { AuditAction } from '../types';
+import { SecurityAlert } from './types';
+export interface SecurityConfig {
+    /** Whether security scanning is enabled */
+    enabled: boolean;
+    /** Enabled rule categories */
+    rules: {
+        secretLeakage: boolean;
+        highRiskOps: boolean;
+        promptInjection: boolean;
+        chainDetection: boolean;
+    };
+    /** Domain whitelist — applies to T003 external request detection */
+    domainWhitelist: string[];
+}
+export declare const DEFAULT_SECURITY_CONFIG: SecurityConfig;
+export declare function resolveSecurityConfig(raw: Partial<SecurityConfig> | undefined): SecurityConfig;
+export declare class SecurityScanner {
+    private rules;
+    private chainDetector;
+    private config;
+    /** Runtime context — passed to each rule's detect method */
+    private ruleCtx;
+    /** Cumulative statistics */
+    private stats;
+    constructor(config: SecurityConfig);
+    /**
+     * Scan a single AuditAction, return 0~N security alerts
+     */
+    scan(action: AuditAction): SecurityAlert[];
+    /** Get statistics */
+    getStats(): {
+        scanned: number;
+        alertsGenerated: number;
+    };
+    /** Reset */
+    reset(): void;
+    /** Extract all scannable text from an action */
+    private extractText;
+    /** SecurityFinding -> SecurityAlert */
+    private toAlert;
+}
+//# sourceMappingURL=scanner.d.ts.map

package/dist/security/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/security/scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,aAAa,EAA2C,MAAM,SAAS,CAAC;AAQjF,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,KAAK,EAAE;QACL,aAAa,EAAE,OAAO,CAAC;QACvB,WAAW,EAAE,OAAO,CAAC;QACrB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,oEAAoE;IACpE,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,eAAO,MAAM,uBAAuB,EAAE,cASrC,CAAC;AAEF,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,GACvC,cAAc,CAUhB;AAeD,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,MAAM,CAAiB;IAC/B,4DAA4D;IAC5D,OAAO,CAAC,OAAO,CAAc;IAE7B,4BAA4B;IAC5B,OAAO,CAAC,KAAK,CAGX;gBAEU,MAAM,EAAE,cAAc;IAiBlC;;OAEG;IACH,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,EAAE;IAqC1C,qBAAqB;IACrB,QAAQ;;;;IAIR,YAAY;IACZ,KAAK,IAAI,IAAI;IASb,gDAAgD;IAChD,OAAO,CAAC,WAAW;IAOnB,uCAAuC;IACvC,OAAO,CAAC,OAAO;CAqBhB"}