shield360 1.1.0 → 1.2.0

package/dist/rasp/middleware.js

@@ -0,0 +1,568 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lowerHeaders = void 0;
+exports.isRaspBlocked = isRaspBlocked;
+exports.sendBlocked = sendBlocked;
+exports.blockedResponse = blockedResponse;
+exports.sendNotFound = sendNotFound;
+exports.frameworkServes = frameworkServes;
+exports.sendExpressNotFound = sendExpressNotFound;
+exports.raspExpress = raspExpress;
+exports.raspExpressErrorHandler = raspExpressErrorHandler;
+exports.raspFastify = raspFastify;
+exports.raspKoa = raspKoa;
+exports.raspHttp = raspHttp;
+exports.recordRequestBody = recordRequestBody;
+exports.withRasp = withRasp;
+const capture_1 = require("./capture");
+Object.defineProperty(exports, "lowerHeaders", { enumerable: true, get: function () { return capture_1.lowerHeaders; } });
+const context_1 = require("./context");
+const deception_1 = require("./deception");
+const engine_1 = require("./engine");
+const types_1 = require("./types");
+function isRaspBlocked(e) {
+    return e instanceof types_1.RaspBlockedError;
+}
+const BLOCK_HEADERS = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' };
+/** Writes the 403 on a Node response (no-op once the headers are out). */
+function sendBlocked(res, e) {
+    try {
+        if (res.headersSent || res.writableEnded) {
+            if (!res.writableEnded)
+                res.end();
+            return;
+        }
+        res.statusCode = 403;
+        for (const [k, v] of Object.entries(BLOCK_HEADERS))
+            res.setHeader(k, v);
+        res.end(JSON.stringify((0, types_1.blockBody)(e)));
+    }
+    catch {
+        // the response is already gone
+    }
+}
+/** The 403 as a fetch Response (Next.js and other fetch-style handlers). */
+function blockedResponse(e) {
+    return new Response(JSON.stringify((0, types_1.blockBody)(e)), { status: 403, headers: BLOCK_HEADERS });
+}
+/** The client address: the framework's own (Express `req.ip` honors `trust proxy`), else the socket's peer. */
+const ipOf = (own, req) => {
+    const v = typeof own === 'string' && own ? own : req?.socket?.remoteAddress;
+    return typeof v === 'string' && v ? v : undefined;
+};
+/** Deception, unless the zero-code capture already ran it for this request (it answers decoys itself). */
+function deceive(r) {
+    return (0, context_1.currentContext)()?.deception ? {} : (0, deception_1.checkDeception)(r);
+}
+/**
+ * The 404 where a framework has no not-found of its own (raw `http`, the
+ * zero-code capture): `404 Not Found` as plain text.
+ */
+function sendNotFound(res) {
+    try {
+        if (res.headersSent || res.writableEnded) {
+            if (!res.writableEnded)
+                res.end();
+            return;
+        }
+        res.statusCode = 404;
+        res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+        res.setHeader('Content-Length', '9');
+        res.end('Not Found');
+    }
+    catch {
+        // the response is already gone
+    }
+}
+const FRAMEWORK_SERVER = Symbol.for('shield360.rasp.frameworkServer');
+/** Notes that a framework adapter serves this server, so the zero-code capture leaves deception to it. */
+function markFrameworkServer(server) {
+    try {
+        if (server && typeof server === 'object' && !server[FRAMEWORK_SERVER]) {
+            Object.defineProperty(server, FRAMEWORK_SERVER, { value: true, configurable: true });
+        }
+    }
+    catch {
+        // best effort
+    }
+}
+const socketServer = (req) => req?.socket?.server;
+/**
+ * Whether a server's `request` listener is a framework app, which resolves the
+ * client address itself (`trust proxy`) and has its own not-found: an Express
+ * 4/5 app (the app function, with `handle`, `use`, `set` and `settings`), Koa's
+ * `callback()` (`handleRequest`) or Fastify's router entry (`preRouting`); the
+ * last two are bare closures, so only their names tell. A server an adapter
+ * already served (`raspFastify` notes its server when registered, the others
+ * on their first request) counts too, which covers a renamed or wrapped app.
+ */
+function frameworkServes(server) {
+    try {
+        const s = server;
+        if (!s)
+            return false;
+        if (s[FRAMEWORK_SERVER])
+            return true;
+        for (const raw of s.rawListeners?.('request') ?? []) {
+            // once() listeners are wrapped; the app is the wrapper's `listener`.
+            const l = raw.listener ?? raw;
+            if (typeof l !== 'function')
+                continue;
+            const o = l;
+            if (typeof o.handle === 'function' && typeof o.use === 'function' && typeof o.set === 'function' && o.settings && typeof o.settings === 'object')
+                return true;
+            if (l.name === 'handleRequest' || l.name === 'preRouting')
+                return true;
+        }
+    }
+    catch {
+        // unknown: treat as plain
+    }
+    return false;
+}
+const contentTypeOf = (h) => {
+    const v = h?.['content-type'];
+    return typeof v === 'string' ? v : undefined;
+};
+/**
+ * Starts a request context. Returns the context, `blocked` with the error
+ * when a virtual patch blocks, or undefined when capture failed (fail open).
+ * `noBody` says the request has no body at all (its body is known, empty).
+ */
+function begin(make, body, noBody) {
+    let ctx;
+    try {
+        ctx = make();
+        const b = body();
+        if (b && b.body !== undefined && b.body !== null)
+            (0, capture_1.captureBody)(ctx, b);
+        else {
+            // A body that shows up anyway (an adapter that sent no length) is still captured late.
+            (0, capture_1.captureLater)(ctx, body);
+            if (noBody?.())
+                (0, capture_1.captureNoBody)(ctx);
+        }
+        (0, capture_1.runVirtualPatches)(ctx);
+        return { ctx };
+    }
+    catch (e) {
+        if (e instanceof types_1.RaspBlockedError)
+            return { blocked: e };
+        return { ctx: undefined };
+    }
+}
+const URL_UNSAFE = /(?:[^\x21\x23-\x3B\x3D\x3F-\x5F\x61-\x7A\x7C\x7E]|%(?:[^0-9A-Fa-f]|[0-9A-Fa-f][^0-9A-Fa-f]|$))+/g;
+const SURROGATE = /([\uD800-\uDBFF][\uDC00-\uDFFF])|[\uD800-\uDFFF]/g;
+const HTML_ESCAPES = { '"': '&quot;', '&': '&amp;', "'": '&#39;', '<': '&lt;', '>': '&gt;' };
+/**
+ * Express's own answer to an unknown path, byte for byte: finalhandler's 404
+ * (`Cannot GET /path` in its HTML page, with its security headers), which
+ * Express 4 and 5 send when no route matches. It is written here rather than
+ * reached with `next('router')`: that only leaves the router the middleware
+ * is mounted on, so mounted on a sub-router it would go on to the parent's
+ * handlers, and at the app level it skips the app's own 404 middleware just
+ * the same. An app with its own 404 page passes `raspExpress({ notFound })`.
+ */
+function sendExpressNotFound(req, res) {
+    try {
+        if (res.headersSent || res.writableEnded) {
+            if (!res.writableEnded)
+                res.end();
+            return;
+        }
+        // finalhandler: 'Cannot ' + method + ' ' + encodeUrl(pathname of the original URL), HTML-escaped.
+        const target = req.originalUrl || req.url || '/';
+        const end = target.search(/[?#]/);
+        const path = (end >= 0 ? target.slice(0, end) : target).replace(SURROGATE, (_, pair) => pair || '\uFFFD').replace(URL_UNSAFE, encodeURI);
+        const message = `Cannot ${req.method} ${path}`
+            .replace(/["&'<>]/g, (c) => HTML_ESCAPES[c])
+            .replace(/\n/g, '<br>')
+            .replace(/ {2}/g, ' &nbsp;');
+        const body = `<!DOCTYPE html>\n<html lang="en">\n<head>\n<meta charset="utf-8">\n<title>Error</title>\n</head>\n<body>\n<pre>${message}</pre>\n</body>\n</html>\n`;
+        res.statusCode = 404;
+        if (req.httpVersionMajor < 2)
+            res.statusMessage = 'Not Found';
+        res.removeHeader('Content-Encoding');
+        res.removeHeader('Content-Language');
+        res.removeHeader('Content-Range');
+        res.setHeader('Content-Security-Policy', "default-src 'none'");
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.setHeader('Content-Length', Buffer.byteLength(body, 'utf8'));
+        if (req.method === 'HEAD')
+            res.end();
+        else
+            res.end(body, 'utf8');
+    }
+    catch {
+        // the response is already gone
+    }
+}
+/**
+ * Express (4 and 5). Register it after the body parsers so the body is seen
+ * before the handler; registered earlier, the body is still captured when a
+ * sink first reads the inputs.
+ *
+ *   app.use(express.json());
+ *   app.use(raspExpress());
+ *   ...routes...
+ *   app.use(raspExpressErrorHandler());
+ */
+function raspExpress(options = {}) {
+    return function shield360Rasp(req, res, next) {
+        if (!(0, engine_1.isActive)())
+            return next();
+        markFrameworkServer(socketServer(req));
+        // The full target the client sent (`originalUrl`: a router mount does not strip it).
+        const d = deceive({ framework: 'express', method: req.method || 'GET', url: req.originalUrl || req.url || '/', ip: ipOf(req.ip, req) });
+        if (d.notFound) {
+            try {
+                if (options.notFound)
+                    return options.notFound(req, res);
+            }
+            catch {
+                // the app's page failed: Express's own 404 below
+            }
+            return sendExpressNotFound(req, res);
+        }
+        if (d.blocked)
+            return sendBlocked(res, d.blocked);
+        const r = begin(() => (0, capture_1.captureRequest)({
+            framework: 'express',
+            method: req.method || 'GET',
+            url: req.originalUrl || req.url || '/',
+            headers: req.headers,
+            query: req.query,
+            params: req.params,
+            ip: ipOf(req.ip, req),
+        }), () => {
+            const files = req.files ?? req.file;
+            return req.body === undefined && files === undefined ? undefined : { body: req.body ?? {}, contentType: contentTypeOf(req.headers), files };
+        }, () => (0, capture_1.bodyAbsent)(req.headers, req.httpVersionMajor));
+        if (r.blocked)
+            return sendBlocked(res, r.blocked);
+        if (!r.ctx)
+            return next();
+        context_1.storage.run(r.ctx, () => next());
+    };
+}
+/** Maps the block error from a handler to the 403; passes every other error on. */
+function raspExpressErrorHandler() {
+    return function shield360RaspErrors(err, _req, res, next) {
+        if (isRaspBlocked(err))
+            return sendBlocked(res, err);
+        next(err);
+    };
+}
+const FASTIFY_CTX = Symbol('shield360.rasp.context');
+function fastifyBlocked(reply, e) {
+    try {
+        let r = reply.code(403);
+        for (const [k, v] of Object.entries(BLOCK_HEADERS))
+            r = r.header(k, v);
+        r.send(JSON.stringify((0, types_1.blockBody)(e)));
+    }
+    catch {
+        // the reply is already gone
+    }
+}
+/**
+ * A decoy gets Fastify's not-found: `reply.callNotFound()` (the app's
+ * `setNotFoundHandler`, else Fastify's JSON 404). A decoy that matches no
+ * route is already on its way to that handler, so the request just goes on
+ * (callNotFound from there would send a bare 404 instead).
+ */
+function fastifyNotFound(request, reply, next) {
+    if (request.is404)
+        return next();
+    try {
+        if (typeof reply.callNotFound === 'function') {
+            reply.callNotFound();
+            return;
+        }
+        reply.code(404).send({ message: `Route ${request.method}:${request.url} not found`, error: 'Not Found', statusCode: 404 });
+    }
+    catch {
+        // the reply is already gone
+    }
+}
+function fastifyNoBody(method, headers) {
+    const m = method.toUpperCase();
+    if (m === 'GET' || m === 'HEAD')
+        return true;
+    if (!(0, capture_1.bodyAbsent)(headers))
+        return false;
+    const len = headers['content-length'];
+    return headers['content-type'] === undefined || (typeof len === 'string' && len.trim() === '0');
+}
+/**
+ * Fastify plugin: `fastify.register(raspFastify)`. Applies to every route
+ * (it skips encapsulation, as fastify-plugin would). Inputs are captured in
+ * `onRequest`, the body in `preHandler`. A handler that lets the block error
+ * through gets a 403 from Fastify's default error handler (`statusCode`).
+ */
+function raspFastify(fastify, _opts, done) {
+    markFrameworkServer(fastify.server);
+    fastify.addHook('onRequest', (request, reply, next) => {
+        if (!(0, engine_1.isActive)())
+            return next();
+        const d = deceive({ framework: 'fastify', method: request.method, url: request.url, ip: ipOf(request.ip) });
+        if (d.notFound)
+            return fastifyNotFound(request, reply, next);
+        if (d.blocked)
+            return fastifyBlocked(reply, d.blocked);
+        const route = request.routeOptions?.url ?? request.routerPath;
+        const r = begin(() => (0, capture_1.captureRequest)({
+            framework: 'fastify',
+            method: request.method,
+            url: request.url,
+            headers: request.headers,
+            query: request.query,
+            params: request.params,
+            route: typeof route === 'string' ? route : undefined,
+            ip: ipOf(request.ip),
+        }), () => undefined, 
+        // No body as Fastify judges it: it never parses a GET or HEAD body, an explicit
+        // Content-Length: 0 carries none whatever the content type, and without a content type
+        // it parses nothing when there is neither a length nor chunks.
+        () => fastifyNoBody(request.method, request.headers));
+        if (r.blocked)
+            return fastifyBlocked(reply, r.blocked);
+        if (!r.ctx)
+            return next();
+        r.ctx.late = undefined;
+        request[FASTIFY_CTX] = r.ctx;
+        context_1.storage.run(r.ctx, () => next());
+    });
+    fastify.addHook('preHandler', (request, reply, next) => {
+        const ctx = request[FASTIFY_CTX];
+        if (!ctx || !(0, engine_1.isActive)())
+            return next();
+        try {
+            if (request.body !== undefined && request.body !== null)
+                (0, capture_1.captureBody)(ctx, { body: request.body, contentType: contentTypeOf(request.headers) });
+            (0, capture_1.runVirtualPatches)(ctx);
+        }
+        catch (e) {
+            if (e instanceof types_1.RaspBlockedError)
+                return fastifyBlocked(reply, e);
+        }
+        context_1.storage.run(ctx, () => next());
+    });
+    done();
+}
+raspFastify[Symbol.for('skip-override')] = true;
+raspFastify[Symbol.for('fastify.display-name')] = 'shield360-rasp';
+function koaBlocked(k, e) {
+    k.status = 403;
+    try {
+        for (const [h, v] of Object.entries(BLOCK_HEADERS))
+            k.set?.(h, v);
+    }
+    catch {
+        // headers are best effort
+    }
+    k.body = (0, types_1.blockBody)(e);
+}
+/** Koa middleware: `app.use(raspKoa())`, ideally after the body parser. */
+function raspKoa() {
+    return async function shield360Rasp(k, next) {
+        if (!(0, engine_1.isActive)()) {
+            await next();
+            return;
+        }
+        markFrameworkServer(socketServer(k.req));
+        const d = deceive({ framework: 'koa', method: k.method, url: k.originalUrl || k.url || '/', ip: ipOf(k.ip) });
+        if (d.notFound) {
+            // What Koa does with a path nothing answers: status 404 and no body, so Koa sends "Not Found" as text/plain.
+            k.status = 404;
+            return;
+        }
+        if (d.blocked)
+            return koaBlocked(k, d.blocked);
+        const headers = k.headers ?? k.request?.headers ?? {};
+        const r = begin(() => (0, capture_1.captureRequest)({
+            framework: 'koa',
+            method: k.method,
+            url: k.originalUrl || k.url || '/',
+            headers,
+            query: k.query,
+            params: k.params,
+            route: typeof k._matchedRoute === 'string' ? k._matchedRoute : undefined,
+            ip: ipOf(k.ip),
+        }), () => (k.request?.body === undefined ? undefined : { body: k.request.body, contentType: contentTypeOf(headers) }), () => (0, capture_1.bodyAbsent)(headers, k.req?.httpVersionMajor));
+        if (r.blocked)
+            return koaBlocked(k, r.blocked);
+        if (!r.ctx) {
+            await next();
+            return;
+        }
+        try {
+            await context_1.storage.run(r.ctx, () => next());
+        }
+        catch (e) {
+            if (e instanceof types_1.RaspBlockedError)
+                return koaBlocked(k, e);
+            throw e;
+        }
+    };
+}
+/**
+ * Wraps a raw `http` request handler: `http.createServer(raspHttp(handler))`.
+ * The body is the handler's to read; once it has, `recordRequestBody(body)`
+ * adds it (and runs the virtual patches that read the body). A `req.body`
+ * set by a parser is picked up when a sink first reads the inputs.
+ */
+function raspHttp(handler) {
+    const wrapped = function (req, res) {
+        if (!(0, engine_1.isActive)())
+            return handler.call(this, req, res);
+        const d = deceive({ framework: 'http', method: req.method || 'GET', url: req.url || '/', ip: ipOf(undefined, req) });
+        if (d.notFound)
+            return sendNotFound(res);
+        if (d.blocked)
+            return sendBlocked(res, d.blocked);
+        const withBody = req;
+        const r = begin(() => (0, capture_1.captureRequest)({ framework: 'http', method: req.method || 'GET', url: req.url || '/', headers: req.headers, ip: ipOf(undefined, req) }), () => (withBody.body === undefined ? undefined : { body: withBody.body, contentType: contentTypeOf(req.headers) }), () => (0, capture_1.bodyAbsent)(req.headers, req.httpVersionMajor));
+        if (r.blocked)
+            return sendBlocked(res, r.blocked);
+        if (!r.ctx)
+            return handler.call(this, req, res);
+        return context_1.storage.run(r.ctx, () => {
+            try {
+                const out = handler.call(this, req, res);
+                if (out && typeof out.then === 'function') {
+                    return out.then(undefined, (e) => {
+                        if (e instanceof types_1.RaspBlockedError)
+                            return sendBlocked(res, e);
+                        throw e;
+                    });
+                }
+                return out;
+            }
+            catch (e) {
+                if (e instanceof types_1.RaspBlockedError)
+                    return sendBlocked(res, e);
+                throw e;
+            }
+        });
+    };
+    return wrapped;
+}
+/**
+ * Adds a body the app read itself to the current request's inputs and runs
+ * the virtual patches that read the body. Throws the block error when one
+ * blocks; otherwise never throws.
+ */
+function recordRequestBody(body, contentType) {
+    if (!(0, engine_1.isActive)())
+        return;
+    const ctx = (0, context_1.currentContext)();
+    // Once a body was captured; a body the SDK took to be absent is still added.
+    if (!ctx?.inRequest || ctx.headInputs !== undefined)
+        return;
+    try {
+        ctx.late = undefined;
+        (0, capture_1.captureBody)(ctx, { body, contentType });
+        (0, capture_1.runVirtualPatches)(ctx);
+    }
+    catch (e) {
+        if (e instanceof types_1.RaspBlockedError)
+            throw e;
+    }
+}
+// ---- Next.js route handlers ------------------------------------------------------
+const MAX_READ = 1024 * 1024;
+const BODY_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+/** Reads at most `max` bytes of a cloned request body as text. */
+async function readCapped(req, max) {
+    if (!req.body)
+        return undefined;
+    const reader = req.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (total < max) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            chunks.push(value);
+            total += value.byteLength;
+        }
+    }
+    finally {
+        reader.cancel().catch(() => undefined);
+    }
+    return Buffer.concat(chunks.map((c) => Buffer.from(c))).subarray(0, max).toString('utf8');
+}
+/**
+ * Wraps a Next.js App Router route handler (Node.js runtime):
+ *
+ *   export const POST = withRasp(async (request) => { ... });
+ *
+ * The body is read from a clone (up to 1 MiB), so the handler can still read it.
+ */
+function withRasp(handler) {
+    return async function shield360Rasp(request, context) {
+        if (!(0, engine_1.isActive)())
+            return handler(request, context);
+        let url;
+        try {
+            url = new URL(request.url);
+        }
+        catch {
+            return handler(request, context);
+        }
+        // Next.js gives only the parsed URL (dot segments already resolved) and no client address, so a hit marks nothing.
+        const d = deceive({ framework: 'nextjs', method: request.method, url: url.pathname + url.search });
+        // What `notFound()` gives in a route handler: an empty 404.
+        if (d.notFound)
+            return new Response(null, { status: 404 });
+        if (d.blocked)
+            return blockedResponse(d.blocked);
+        let ctx;
+        try {
+            const headers = {};
+            request.headers.forEach((v, k) => {
+                headers[k.toLowerCase()] = v;
+            });
+            let params;
+            try {
+                const p = context?.params;
+                params = p && typeof p.then === 'function' ? await p : p;
+            }
+            catch {
+                params = undefined;
+            }
+            ctx = (0, capture_1.captureRequest)({ framework: 'nextjs', method: request.method, url: url.pathname + url.search, headers, params });
+            (0, capture_1.runVirtualPatches)(ctx);
+            if (!request.body) {
+                // No body at all (a GET, an empty POST): the body is known and empty.
+                (0, capture_1.captureNoBody)(ctx);
+                (0, capture_1.runVirtualPatches)(ctx);
+            }
+            else if (BODY_METHODS.has(request.method.toUpperCase()) && !request.bodyUsed) {
+                const text = await readCapped(request.clone(), MAX_READ);
+                if (text !== undefined)
+                    (0, capture_1.captureBody)(ctx, { body: text, contentType: headers['content-type'] });
+                (0, capture_1.runVirtualPatches)(ctx);
+            }
+        }
+        catch (e) {
+            if (e instanceof types_1.RaspBlockedError)
+                return blockedResponse(e);
+            ctx = undefined;
+        }
+        if (!ctx)
+            return handler(request, context);
+        try {
+            return await context_1.storage.run(ctx, () => handler(request, context));
+        }
+        catch (e) {
+            if (e instanceof types_1.RaspBlockedError)
+                return blockedResponse(e);
+            throw e;
+        }
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/rasp/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/rasp/middleware.ts"],"names":[],"mappings":";;;AAgBA,sCAEC;AAKD,kCAYC;AAGD,0CAEC;AAiBD,oCAaC;AA0BD,0CAiBC;AAiDD,kDA6BC;AAqBD,kCAoCC;AAGD,0DAKC;AAkED,kCA4CC;AAiCD,0BA0CC;AAYD,4BA+BC;AAOD,8CAYC;AAmCD,4BAkDC;AAlkBD,uCAAkJ;AAokBzI,6FApkBsE,sBAAY,OAokBtE;AAnkBrB,uCAAsE;AACtE,2CAA2F;AAC3F,qCAAoC;AACpC,mCAAsD;AAEtD,SAAgB,aAAa,CAAC,CAAU;IACtC,OAAO,CAAC,YAAY,wBAAgB,CAAC;AACvC,CAAC;AAED,MAAM,aAAa,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAE1F,0EAA0E;AAC1E,SAAgB,WAAW,CAAC,GAAmB,EAAE,CAAmB;IAClE,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;YAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,iBAAS,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAgB,eAAe,CAAC,CAAmB;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,iBAAS,EAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,+GAA+G;AAC/G,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,GAA8C,EAAsB,EAAE;IAChG,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC;IAC5E,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC,CAAC;AAEF,0GAA0G;AAC1G,SAAS,OAAO,CAAC,CAAmB;IAClC,OAAO,IAAA,wBAAc,GAAE,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,0BAAc,EAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,GAAmB;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;QAC3D,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAEtE,0GAA0G;AAC1G,SAAS,mBAAmB,CAAC,MAAe;IAC1C,IAAI,CAAC;QACH,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAE,MAAkC,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnG,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,GAAqC,EAAW,EAAE,CAAE,GAAG,EAAE,MAA2C,EAAE,MAAM,CAAC;AAEnI;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAAC,MAAe;IAC7C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAA+E,CAAC;QAC1F,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,IAAI,CAAC,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YACpD,qEAAqE;YACrE,MAAM,CAAC,GAAI,GAA8B,CAAC,QAAQ,IAAI,GAAG,CAAC;YAC1D,IAAI,OAAO,CAAC,KAAK,UAAU;gBAAE,SAAS;YACtC,MAAM,CAAC,GAAG,CAAuC,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC9J,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,IAAI,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAsC,EAAsB,EAAE;IACnF,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;IAC9B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;GAIG;AACH,SAAS,KAAK,CAAC,IAAuB,EAAE,IAAiC,EAAE,MAAsB;IAC/F,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,IAAA,qBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;aACjE,CAAC;YACJ,uFAAuF;YACvF,IAAA,sBAAY,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,IAAI,MAAM,EAAE,EAAE;gBAAE,IAAA,uBAAa,EAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAA,2BAAiB,EAAC,GAAG,CAAC,CAAC;QACvB,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,wBAAgB;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,GAAG,kGAAkG,CAAC;AACtH,MAAM,SAAS,GAAG,mDAAmD,CAAC;AACtE,MAAM,YAAY,GAA2B,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAErH;;;;;;;;GAQG;AACH,SAAgB,mBAAmB,CAAC,GAA+C,EAAE,GAAmB;IACtG,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,kGAAkG;QAClG,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAwB,EAAE,EAAE,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC7J,MAAM,OAAO,GAAG,UAAU,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE;aAC3C,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;aAC3C,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,kHAAkH,OAAO,4BAA4B,CAAC;QACnK,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,IAAI,GAAG,CAAC,gBAAgB,GAAG,CAAC;YAAE,GAAG,CAAC,aAAa,GAAG,WAAW,CAAC;QAC9D,GAAG,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;QAClC,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;QAC/D,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC1D,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,GAAG,CAAC,GAAG,EAAE,CAAC;;YAChC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;AACH,CAAC;AAWD;;;;;;;;;GASG;AACH,SAAgB,WAAW,CAAC,UAA8B,EAAE;IAC1D,OAAO,SAAS,aAAa,CAAC,GAAe,EAAE,GAAmB,EAAE,IAAU;QAC5E,IAAI,CAAC,IAAA,iBAAQ,GAAE;YAAE,OAAO,IAAI,EAAE,CAAC;QAC/B,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,qFAAqF;QACrF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACxI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,IAAI,OAAO,CAAC,QAAQ;oBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,iDAAiD;YACnD,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,KAAK,CACb,GAAG,EAAE,CACH,IAAA,wBAAc,EAAC;YACb,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;YAC3B,GAAG,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG;YACtC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC;SACtB,CAAC,EACJ,GAAG,EAAE;YACH,MAAM,KAAK,GAAI,GAA2C,CAAC,KAAK,IAAK,GAA0B,CAAC,IAAI,CAAC;YACrG,OAAO,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;QAC9I,CAAC,EACD,GAAG,EAAE,CAAC,IAAA,oBAAU,EAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,CACpD,CAAC;QACF,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1B,iBAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAgB,uBAAuB;IACrC,OAAO,SAAS,mBAAmB,CAAC,GAAY,EAAE,IAAqB,EAAE,GAAmB,EAAE,IAAU;QACtG,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,CAAC,CAAC;AACJ,CAAC;AAqBD,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAErD,SAAS,cAAc,CAAC,KAAmB,EAAE,CAAmB;IAC9D,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,iBAAS,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAuB,EAAE,KAAmB,EAAE,IAAU;IAC/E,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YAC7C,KAAK,CAAC,YAAY,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7H,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,OAAsD;IAC3F,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC,IAAA,oBAAU,EAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,OAAoB,EAAE,KAAc,EAAE,IAAU;IAC1E,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACpD,IAAI,CAAC,IAAA,iBAAQ,GAAE;YAAE,OAAO,IAAI,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC;QAC9D,MAAM,CAAC,GAAG,KAAK,CACb,GAAG,EAAE,CACH,IAAA,wBAAc,EAAC;YACb,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACpD,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;SACrB,CAAC,EACJ,GAAG,EAAE,CAAC,SAAS;QACf,gFAAgF;QAChF,uFAAuF;QACvF,+DAA+D;QAC/D,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CACrD,CAAC;QACF,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1B,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC;QACvB,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;QAC7B,iBAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAA4B,CAAC;QAC5D,IAAI,CAAC,GAAG,IAAI,CAAC,IAAA,iBAAQ,GAAE;YAAE,OAAO,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC/I,IAAA,2BAAiB,EAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,wBAAgB;gBAAE,OAAO,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,iBAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,IAAI,EAAE,CAAC;AACT,CAAC;AACA,WAAkD,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,IAAI,CAAC;AACvF,WAAkD,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,GAAG,gBAAgB,CAAC;AAoB3G,SAAS,UAAU,CAAC,CAAa,EAAE,CAAmB;IACpD,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;IACf,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;YAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,CAAC,CAAC,IAAI,GAAG,IAAA,iBAAS,EAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,2EAA2E;AAC3E,SAAgB,OAAO;IACrB,OAAO,KAAK,UAAU,aAAa,CAAC,CAAa,EAAE,IAA4B;QAC7E,IAAI,CAAC,IAAA,iBAAQ,GAAE,EAAE,CAAC;YAChB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC,GAAuC,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9G,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,6GAA6G;YAC7G,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;YACf,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,KAAK,CACb,GAAG,EAAE,CACH,IAAA,wBAAc,EAAC;YACb,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG;YAClC,OAAO;YACP,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACxE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;SACf,CAAC,EACJ,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,EACjH,GAAG,EAAE,CAAC,IAAA,oBAAU,EAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CACnD,CAAC;QACF,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,iBAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,wBAAgB;gBAAE,OAAO,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAMD;;;;;GAKG;AACH,SAAgB,QAAQ,CAAwB,OAAU;IACxD,MAAM,OAAO,GAAG,UAAyB,GAAoB,EAAE,GAAmB;QAChF,IAAI,CAAC,IAAA,iBAAQ,GAAE;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACrH,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,GAA2C,CAAC;QAC7D,MAAM,CAAC,GAAG,KAAK,CACb,GAAG,EAAE,CAAC,IAAA,wBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,EAC7I,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAClH,GAAG,EAAE,CAAC,IAAA,oBAAU,EAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,CACpD,CAAC;QACF,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,CAAC,GAAG;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO,iBAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAY,CAAC;gBACpD,IAAI,GAAG,IAAI,OAAQ,GAAwB,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAChE,OAAQ,GAAwB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAU,EAAE,EAAE;wBAC9D,IAAI,CAAC,YAAY,wBAAgB;4BAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;wBAC9D,MAAM,CAAC,CAAC;oBACV,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,wBAAgB;oBAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC9D,MAAM,CAAC,CAAC;YACV,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,OAAuB,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,IAAa,EAAE,WAAoB;IACnE,IAAI,CAAC,IAAA,iBAAQ,GAAE;QAAE,OAAO;IACxB,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;IAC7B,6EAA6E;IAC7E,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO;IAC5D,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC;QACrB,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACxC,IAAA,2BAAiB,EAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,wBAAgB;YAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,qFAAqF;AAErF,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjE,kEAAkE;AAClE,KAAK,UAAU,UAAU,CAAC,GAAY,EAAE,GAAW;IACjD,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,KAAK,GAAG,GAAG,EAAE,CAAC;YACnB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC5B,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5F,CAAC;AAID;;;;;;GAMG;AACH,SAAgB,QAAQ,CAAc,OAAwB;IAC5D,OAAO,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,OAAU;QAC9D,IAAI,CAAC,IAAA,iBAAQ,GAAE;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,mHAAmH;QACnH,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnG,4DAA4D;QAC5D,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC/B,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAI,OAA4C,EAAE,MAAM,CAAC;gBAChE,MAAM,GAAG,CAAC,IAAI,OAAQ,CAAsB,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,GAAG,GAAG,IAAA,wBAAc,EAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACvH,IAAA,2BAAiB,EAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClB,sEAAsE;gBACtE,IAAA,uBAAa,EAAC,GAAG,CAAC,CAAC;gBACnB,IAAA,2BAAiB,EAAC,GAAG,CAAC,CAAC;YACzB,CAAC;iBAAM,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC/E,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACzD,IAAI,IAAI,KAAK,SAAS;oBAAE,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBAC/F,IAAA,2BAAiB,EAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,wBAAgB;gBAAE,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;YAC7D,GAAG,GAAG,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,OAAO,MAAM,iBAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,wBAAgB;gBAAE,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;YAC7D,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/rasp/model-output.d.ts

@@ -0,0 +1,14 @@
+/** Set by the engine: whether model output is recorded at all. */
+export declare function setModelOutputRecording(on: boolean): void;
+export declare function modelOutputRecording(): boolean;
+/** Registers completion text a model returned as untrusted input. Never throws. */
+export declare function recordModelOutput(text: unknown, key?: string): void;
+/** Registers tool-call arguments (a JSON string or an object) as untrusted input. Never throws. */
+export declare function recordToolArguments(args: unknown, toolName?: string): void;
+/**
+ * Records a provider response the instrumentation already holds: OpenAI chat
+ * completions (`choices[].message`), OpenAI Responses (`output[]`), Anthropic
+ * messages (`content[]`). Text becomes completion fragments; tool-call
+ * arguments become `model.tool.<name>` inputs. Never throws.
+ */
+export declare function recordModelResponse(result: unknown): void;