shield360 1.1.0 → 1.2.1

package/dist/ai-security/index.js

@@ -0,0 +1,587 @@
+"use strict";
+/**
+ * Shield360 AI security pack: checks an app runs on its own AI traffic,
+ * mapped to the OWASP Top 10 for LLM Applications (2025).
+ *
+ *   scanContext()        LLM01 indirect prompt injection in tool results,
+ *                        retrieved chunks, fetched pages and files
+ *   checkPrompt()        LLM01 jailbreaks, single and multi-turn
+ *   scanOutput() /       LLM02, LLM05, LLM07: PII, secrets, own kinds of
+ *   streamScanner()      data, cross-tenant data, exfiltration links, system
+ *                        prompt leakage and canaries, in whole or streamed answers
+ *   defineTool()         LLM06 per end-user tool permissions
+ *   checkLimits() /      LLM10 per end-user and per-tenant request, token
+ *   recordUsage()        and cost limits
+ *   checkMcpTools()      LLM03 MCP server and tool pinning, rug pulls, poisoning
+ *   checkRetrieval()     LLM08 RAG tenant isolation and hub chunks
+ *
+ * Every check monitors by default and enforces only when its mode says so;
+ * every check fails open: an error inside a check never fails the call.
+ * setupAiSecurity() wires the checks into the providers and frameworks the
+ * SDK knows (see ./hooks).
+ *
+ * Must stay in sync with: sdk/python/src/shield360/ai_security/__init__.py
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aiSecurity = exports.WITHHELD_MESSAGE = exports.STRIPPED_NOTICE = exports.AiSecurityBlockedError = exports.schemaHash = exports.descriptionHash = exports.scanToolDescription = exports.scanForInjection = exports.getEndUser = exports.setEndUser = exports.withEndUser = void 0;
+exports.configureAiSecurity = configureAiSecurity;
+exports.currentPolicy = currentPolicy;
+exports.applyPlatformPolicy = applyPlatformPolicy;
+exports.stripSpans = stripSpans;
+exports.scanContext = scanContext;
+exports.checkPrompt = checkPrompt;
+exports.scanOutput = scanOutput;
+exports.streamScanner = streamScanner;
+exports.withCanary = withCanary;
+exports.tagContext = tagContext;
+exports.authorizeTool = authorizeTool;
+exports.defineTool = defineTool;
+exports.checkLimits = checkLimits;
+exports.recordUsage = recordUsage;
+exports.syncLimitsNow = syncLimitsNow;
+exports.checkMcpTools = checkMcpTools;
+exports.mcpCallRefused = mcpCallRefused;
+exports.checkRetrieval = checkRetrieval;
+exports.flushAiSecurity = flushAiSecurity;
+exports.resetAiSecurity = resetAiSecurity;
+const injection_1 = require("./injection");
+const policy_1 = require("./policy");
+const events_1 = require("./events");
+const output_1 = require("./output");
+const jailbreak_1 = require("./jailbreak");
+const tools_1 = require("./tools");
+const limits_1 = require("./limits");
+const mcp_1 = require("./mcp");
+const rag_1 = require("./rag");
+const config_1 = require("./config");
+const context_1 = require("./context");
+const customer_1 = require("../customer");
+var context_2 = require("./context");
+Object.defineProperty(exports, "withEndUser", { enumerable: true, get: function () { return context_2.withEndUser; } });
+Object.defineProperty(exports, "setEndUser", { enumerable: true, get: function () { return context_2.setEndUser; } });
+Object.defineProperty(exports, "getEndUser", { enumerable: true, get: function () { return context_2.getEndUser; } });
+var injection_2 = require("./injection");
+Object.defineProperty(exports, "scanForInjection", { enumerable: true, get: function () { return injection_2.scanForInjection; } });
+var mcp_2 = require("./mcp");
+Object.defineProperty(exports, "scanToolDescription", { enumerable: true, get: function () { return mcp_2.scanToolDescription; } });
+Object.defineProperty(exports, "descriptionHash", { enumerable: true, get: function () { return mcp_2.descriptionHash; } });
+Object.defineProperty(exports, "schemaHash", { enumerable: true, get: function () { return mcp_2.schemaHash; } });
+class AiSecurityBlockedError extends Error {
+    constructor(check, kind, message) {
+        super(message);
+        this.check = check;
+        this.kind = kind;
+        this.name = 'AiSecurityBlockedError';
+    }
+}
+exports.AiSecurityBlockedError = AiSecurityBlockedError;
+let state = fresh({});
+function fresh(o) {
+    const code = (0, policy_1.mergePolicy)(policy_1.DEFAULT_POLICY, o.policy || {});
+    const s = {
+        code,
+        policy: code,
+        sink: o.sink || new events_1.MemorySink(),
+        app: o.app || 'default',
+        url: o.url,
+        apiKey: o.apiKey,
+        fetch: o.fetch || ((...args) => fetch(...args)),
+        recordAllowed: !!o.recordAllowed,
+        limits: undefined,
+        hubs: new rag_1.HubnessMonitor(),
+        config: null,
+        toolRules: new Map(),
+        observed: new Set(),
+        refusedTools: new Map(),
+    };
+    s.limits = new limits_1.LimitEngine(() => state.policy.limits, o.url && o.apiKey ? (entries) => syncLimits(s, entries) : null);
+    return s;
+}
+/** Sets the pack up. Called by Shield360.init({ aiSecurity }); callable on its own. */
+function configureAiSecurity(o = {}) {
+    void state.sink.close();
+    state.limits.stop();
+    state.config?.stop();
+    const s = fresh(o);
+    if (o.url && o.apiKey && !o.sink) {
+        s.sink = new events_1.EventReporter(`${o.url.replace(/\/+$/, '')}/api/ai-security/events`, o.apiKey, s.app, o.environment || 'default', s.fetch);
+    }
+    state = s;
+    s.limits.start();
+    if (o.url && o.apiKey && o.remoteConfig !== false) {
+        s.config = new config_1.ConfigClient({
+            url: o.url,
+            apiKey: o.apiKey,
+            app: s.app,
+            publicKey: o.configPublicKey,
+            allowUnpinned: o.allowUnpinnedConfig,
+            cacheFile: o.configCacheFile,
+            fetch: s.fetch,
+            onPolicy: (signed) => {
+                if (state === s)
+                    s.policy = (0, policy_1.mergePolicy)(s.code, signed.policy);
+            },
+        });
+        if (s.config.usable)
+            void s.config.start();
+        else {
+            // No pinned key: the platform's policy is not applied; the policy from code runs. Reported once.
+            s.sink.add({ check: 'config', kind: 'config_unpinned', mode: 'monitor', action: 'reported', detail: 'no pinned config key; set configPublicKey or SHIELD360_CONFIG_PUBLIC_KEY' });
+            console.warn('[shield360] AI security: no pinned config key (configPublicKey or SHIELD360_CONFIG_PUBLIC_KEY); the platform policy is not applied, checks run in monitor mode with the policy from code.');
+        }
+    }
+}
+/** The policy in effect (code merged with the platform's). */
+function currentPolicy() {
+    return state.policy;
+}
+/** Applies a platform policy directly (tests, or a policy delivered another way). */
+function applyPlatformPolicy(input) {
+    state.policy = (0, policy_1.mergePolicy)(state.code, input);
+}
+function emit(event) {
+    try {
+        state.sink.add(event);
+    }
+    catch {
+        // never breaks a call
+    }
+}
+const modeOf = (m) => (m === 'enforce' ? 'enforce' : 'monitor');
+/** Runs a check, failing open: an error inside it returns the fallback. */
+function safely(fallback, fn) {
+    try {
+        return fn();
+    }
+    catch (e) {
+        if (e instanceof AiSecurityBlockedError)
+            throw e;
+        return fallback;
+    }
+}
+exports.STRIPPED_NOTICE = '[Shield360 removed instructions from this content]';
+/** UTF-16 index of each code point index of a string. */
+function utf16Offsets(text) {
+    const out = [];
+    for (let i = 0; i < text.length; i++) {
+        out.push(i);
+        const c = text.charCodeAt(i);
+        if (c >= 0xd800 && c <= 0xdbff && i + 1 < text.length)
+            i++;
+    }
+    out.push(text.length);
+    return out;
+}
+/** Removes the spans the detector matched (code-point spans), merged, and says so at the top. */
+function stripSpans(text, spans) {
+    if (!spans.length)
+        return text;
+    const at = utf16Offsets(text);
+    const sorted = spans.slice().sort((a, b) => a[0] - b[0]);
+    const merged = [];
+    for (const s of sorted) {
+        const last = merged[merged.length - 1];
+        if (last && s[0] <= last[1])
+            last[1] = Math.max(last[1], s[1]);
+        else
+            merged.push([s[0], s[1]]);
+    }
+    let out = text;
+    for (let i = merged.length - 1; i >= 0; i--) {
+        const a = at[Math.min(merged[i][0], at.length - 1)];
+        const b = at[Math.min(merged[i][1], at.length - 1)];
+        out = `${out.slice(0, a)}[removed]${out.slice(b)}`;
+    }
+    return `${exports.STRIPPED_NOTICE}\n${out}`;
+}
+/**
+ * Checks untrusted content before it reaches the model: a tool result, a
+ * retrieved chunk, a fetched page, a file. Enforce mode strips what matched
+ * (action strip) or throws AiSecurityBlockedError (action block).
+ */
+function scanContext(text, opts = {}) {
+    const pass = { text, detected: false, score: 0, rules: [], action: 'none' };
+    const p = state.policy.indirectInjection;
+    if (p.mode === 'off' || typeof text !== 'string' || !text)
+        return pass;
+    const source = opts.source || 'context';
+    const res = safely(null, () => (0, injection_1.scanForInjection)(text, { source }));
+    if (!res)
+        return pass;
+    const threshold = p.threshold ?? res.threshold;
+    const detected = res.matches.length > 0 && res.score >= threshold;
+    if (!detected)
+        return { ...pass, score: res.score };
+    const rules = res.matches.map((m) => m.rule);
+    const enforce = p.mode === 'enforce';
+    const action = !enforce ? 'reported' : p.action === 'block' ? 'blocked' : 'stripped';
+    emit({
+        check: 'indirect_injection',
+        kind: 'injection',
+        mode: modeOf(p.mode),
+        action,
+        source,
+        tool: opts.tool,
+        score: res.score,
+        rules,
+        categories: res.categories,
+        rulesVersion: injection_1.INJECTION_RULES_VERSION,
+        findings: res.matches.slice(0, 10).map((m) => ({ rule: m.rule, category: m.category, snippet: m.snippet, ...(m.fingerprint ? { fingerprint: m.fingerprint } : {}) })),
+    });
+    if (action === 'blocked')
+        throw new AiSecurityBlockedError('indirect_injection', 'injection', 'Shield360 blocked content that carries instructions for the model (possible prompt injection).');
+    const out = action === 'stripped' ? stripSpans(text, res.matches.flatMap((m) => m.spans)) : text;
+    return { text: out, detected: true, score: res.score, rules, action };
+}
+// ---------------------------------------------------------------------------
+// Jailbreaks.
+/** Checks the user's turns (oldest first). Enforce mode throws on a jailbreak. */
+function checkPrompt(turns) {
+    const p = state.policy.jailbreak;
+    const none = { detected: false, how: 'none', score: 0, rules: [], categories: [] };
+    if (p.mode === 'off')
+        return none;
+    const list = typeof turns === 'string' ? [turns] : turns;
+    const v = safely(none, () => (0, jailbreak_1.assessTurns)(p.multiTurn ? list : list.slice(-1)));
+    if (!v.detected)
+        return v;
+    const enforce = p.mode === 'enforce';
+    emit({ check: 'jailbreak', kind: v.how === 'single_turn' ? 'jailbreak' : `jailbreak_${v.how}`, mode: modeOf(p.mode), action: enforce ? 'blocked' : 'reported', source: 'prompt', score: v.score, rules: v.rules, categories: v.categories, rulesVersion: injection_1.INJECTION_RULES_VERSION });
+    if (enforce)
+        throw new AiSecurityBlockedError('jailbreak', v.how, 'Shield360 blocked this request: it reads like an attempt to get around the assistant\'s rules.');
+    return v;
+}
+exports.WITHHELD_MESSAGE = 'Shield360 withheld this response because it may expose information it should not.';
+function reportOutput(findings, mode, action) {
+    const byKind = new Map();
+    for (const f of findings)
+        byKind.set(f.kind, [...(byKind.get(f.kind) || []), f]);
+    byKind.forEach((list, kind) => emit({
+        check: 'output',
+        kind,
+        mode,
+        action,
+        source: 'output',
+        detail: kind === 'system_prompt_leak' ? `shingles ${list[0].label}` : undefined,
+        findings: list.slice(0, 10).map((f) => ({ kind: f.label, masked: f.masked, ...(f.fingerprint ? { fingerprint: f.fingerprint } : {}) })),
+        count: list.length,
+    }));
+}
+/**
+ * Checks a model's answer before the app returns it. Enforce mode redacts
+ * (action redact) or throws AiSecurityBlockedError (action block, and any
+ * system prompt or canary leak).
+ */
+function scanOutput(text, opts = {}) {
+    const p = state.policy.output;
+    const pass = { text, findings: [], action: 'none' };
+    if (p.mode === 'off' || typeof text !== 'string' || !text)
+        return pass;
+    const res = safely(null, () => (0, output_1.scanOutput)(text, { policy: p, customKinds: state.policy.customDataKinds, systemPrompt: opts.systemPrompt, foreign: (0, context_1.foreignIdentifiers)() }));
+    if (!res || !res.findings.length)
+        return pass;
+    const enforce = p.mode === 'enforce';
+    const block = enforce && (p.action === 'block' || res.mustBlock);
+    const action = !enforce ? 'reported' : block ? 'blocked' : 'redacted';
+    reportOutput(res.findings, modeOf(p.mode), action);
+    if (block)
+        throw new AiSecurityBlockedError('output', res.findings[0].kind, exports.WITHHELD_MESSAGE);
+    return { text: action === 'redacted' ? res.redacted : text, findings: res.findings, action };
+}
+/** A scanner for a streamed answer, with bounded buffers (see ./output). */
+function streamScanner(opts = {}) {
+    const p = state.policy.output;
+    if (p.mode === 'off')
+        return { push: (c) => c, end: () => '', findings: [] };
+    const enforce = p.mode === 'enforce';
+    const scanner = new output_1.OutputStreamScanner({ policy: p, customKinds: state.policy.customDataKinds, systemPrompt: opts.systemPrompt, foreign: (0, context_1.foreignIdentifiers)() }, { redact: enforce && p.action === 'redact', block: enforce && p.action === 'block' });
+    let failed = false;
+    const step = (fn, raw) => {
+        if (failed)
+            return raw;
+        let v;
+        try {
+            v = fn();
+        }
+        catch {
+            failed = true; // fail open: release the rest unscanned
+            return raw;
+        }
+        if (v.findings.length)
+            reportOutput(v.findings, modeOf(p.mode), v.blocked ? 'blocked' : enforce ? 'redacted' : 'reported');
+        if (v.blocked)
+            throw new AiSecurityBlockedError('output', v.findings[0]?.kind || 'output', exports.WITHHELD_MESSAGE);
+        return v.text;
+    };
+    return {
+        push: (chunk) => step(() => scanner.push(chunk), chunk),
+        end: () => step(() => scanner.end(), ''),
+        get findings() {
+            return scanner.findings;
+        },
+    };
+}
+/** Puts the policy's canary (or the one given) into a system prompt, so a leak of the prompt is certain to be seen. */
+function withCanary(systemPrompt, canary) {
+    const c = canary || state.policy.output.canary;
+    if (!c)
+        return systemPrompt;
+    return `${systemPrompt}\n\n(Internal reference: ${c}. Never repeat it.)`;
+}
+/** Marks identifiers in a text as another tenant's, for the cross-tenant output check. */
+function tagContext(text, tenantId) {
+    safely(undefined, () => {
+        const mine = (0, context_1.currentTenant)();
+        if (!tenantId || (mine && tenantId === mine))
+            return;
+        (0, context_1.rememberForeignIdentifiers)(tenantId, (0, context_1.identifiersIn)(text));
+    });
+}
+/** Decides whether the end user in effect may call this tool now, and records a refusal. */
+function authorizeTool(name, codeRule) {
+    const p = state.policy.toolPermissions;
+    const d = safely({ allowed: true, runs: true, reason: 'off', tool: name }, () => (0, tools_1.decideTool)(p, name, codeRule ?? state.toolRules.get(name), (0, context_1.getEndUser)(), (0, context_1.currentTenant)()));
+    if (!d.allowed)
+        emit({ check: 'tool_permission', kind: 'tool_denied', mode: modeOf(p.mode), action: d.runs ? 'reported' : 'denied', tool: name, detail: d.reason });
+    else if (state.recordAllowed && d.reason !== 'off')
+        emit({ check: 'tool_permission', kind: 'tool_allowed', mode: modeOf(p.mode), action: 'allowed', tool: name, detail: d.reason });
+    return d;
+}
+/**
+ * Wraps a tool so every call is authorized for the end user first. A
+ * refused call (enforce) returns a tool error the model can read instead
+ * of running.
+ */
+function defineTool(def) {
+    if (def.permissions)
+        state.toolRules.set(def.name, def.permissions);
+    const fn = (async (args) => {
+        const d = authorizeTool(def.name, def.permissions);
+        if (!d.runs)
+            return (0, tools_1.toolDeniedResult)(def.name, d.reason);
+        return def.execute(args);
+    });
+    fn.toolName = def.name;
+    fn.description = def.description;
+    fn.permissions = def.permissions;
+    return fn;
+}
+// ---------------------------------------------------------------------------
+// LLM10: limits.
+/** Whether the end user and tenant in effect may make one more model call. Enforce mode throws when not. */
+function checkLimits() {
+    const p = state.policy.limits;
+    if (p.mode === 'off')
+        return { allowed: true };
+    const c = (0, customer_1.getCustomer)();
+    const keys = limits_1.LimitEngine.keysFor(c?.tenantId, c?.userId);
+    const v = safely({ allowed: true }, () => state.limits.check(keys));
+    if (v.allowed)
+        return v;
+    const enforce = p.mode === 'enforce';
+    emit({ check: 'limits', kind: 'rate_limited', mode: modeOf(p.mode), action: enforce ? 'blocked' : 'reported', detail: `${v.scope}:${v.limit} ${Math.round((v.used || 0) * 100) / 100}/${v.max}` });
+    if (enforce)
+        throw new AiSecurityBlockedError('limits', v.limit || 'limit', 'Usage limit reached for this account. Try again later.');
+    return v;
+}
+/** Counts what a model call used against the end user and tenant in effect. */
+function recordUsage(usage) {
+    safely(undefined, () => {
+        const c = (0, customer_1.getCustomer)();
+        state.limits.record(limits_1.LimitEngine.keysFor(c?.tenantId, c?.userId), {
+            requests: usage.requests ?? 1,
+            tokens: usage.tokens ?? 0,
+            costMicros: (usage.costUsd ?? 0) * 1e6,
+        });
+    });
+}
+/** Merges local counts with the platform's now (tests, and before a short script exits). */
+function syncLimitsNow() {
+    return state.limits.syncNow();
+}
+async function syncLimits(s, entries) {
+    try {
+        const res = await s.fetch(`${s.url.replace(/\/+$/, '')}/api/ai-security/limits/sync`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${s.apiKey}` },
+            body: JSON.stringify({ app: s.app, entries }),
+        });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// LLM03: MCP pinning.
+/**
+ * Checks the tools a server listed against the pins, reports what is new or
+ * changed, and returns the tools the model may see (all of them unless
+ * enforce mode refuses some).
+ */
+function checkMcpTools(server, tools) {
+    const p = state.policy.mcp;
+    if (p.mode === 'off' || !Array.isArray(tools))
+        return { tools: [...(tools || [])], verdict: null };
+    const verdict = safely(null, () => (0, mcp_1.checkServerTools)(p, server, tools));
+    if (!verdict)
+        return { tools: [...tools], verdict: null };
+    const mode = modeOf(p.mode);
+    const enforce = p.mode === 'enforce';
+    if (!verdict.allowed) {
+        const refused = verdict.tools.some((t) => t.refuse);
+        emit({ check: 'mcp', kind: 'mcp_unknown_server', mode, action: refused ? 'blocked' : 'reported', server: server.name, detail: `${verdict.reason}${server.version ? ` version ${server.version}` : ''}${server.publisher ? ` publisher ${server.publisher}` : ''}` });
+    }
+    for (const t of verdict.tools) {
+        const action = t.refuse ? 'blocked' : 'reported';
+        if (t.poisoning.detected)
+            emit({ check: 'mcp', kind: 'mcp_tool_poisoned', mode, action, server: server.name, tool: t.tool, score: t.poisoning.score, rules: t.poisoning.rules, source: 'tool_description' });
+        if (t.status === 'changed')
+            emit({ check: 'mcp', kind: 'mcp_tool_changed', mode, action, server: server.name, tool: t.tool, detail: `changed: ${t.changed?.join(',')}; description ${t.descriptionHash.slice(0, 12)} schema ${t.schemaHash.slice(0, 12)}` });
+        else if (t.status === 'unknown' && verdict.allowed)
+            emit({ check: 'mcp', kind: 'mcp_unknown_tool', mode, action, server: server.name, tool: t.tool });
+    }
+    observeTools(server, tools, verdict);
+    const refused = new Set(verdict.tools.filter((t) => t.refuse).map((t) => t.tool));
+    state.refusedTools.set(server.name, refused);
+    return { tools: enforce ? tools.filter((t) => !refused.has(t.name)) : [...tools], verdict };
+}
+/** Whether enforce mode refuses a call to this tool (from the last list check of its server). */
+function mcpCallRefused(server, tool) {
+    return state.policy.mcp.mode === 'enforce' && !!state.refusedTools.get(server)?.has(tool);
+}
+/** Sends tools that are new or changed to the platform, for approval; once per tool version per process. */
+function observeTools(server, tools, verdict) {
+    if (!state.url || !state.apiKey)
+        return;
+    const fresh = verdict.tools.filter((t) => t.status !== 'pinned' || !verdict.allowed).filter((t) => {
+        const id = `${server.name}\u0000${t.tool}\u0000${t.descriptionHash}\u0000${t.schemaHash}`;
+        if (state.observed.has(id))
+            return false;
+        state.observed.add(id);
+        return true;
+    });
+    if (!fresh.length)
+        return;
+    const byName = new Map(tools.map((t) => [t.name, t]));
+    const body = JSON.stringify({
+        app: state.app,
+        server: { name: server.name, version: server.version || null, publisher: server.publisher || null },
+        tools: fresh.slice(0, 200).map((t) => ({
+            name: t.tool,
+            descriptionHash: t.descriptionHash,
+            schemaHash: t.schemaHash,
+            description: (byName.get(t.tool)?.description || '').slice(0, 4000),
+            poisoningScore: t.poisoning.score,
+            poisoningRules: t.poisoning.rules,
+        })),
+    });
+    const s = state;
+    void s
+        .fetch(`${s.url.replace(/\/+$/, '')}/api/ai-security/mcp/observe`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${s.apiKey}` },
+        body,
+    })
+        .catch(() => undefined);
+}
+/**
+ * Checks retrieved chunks: tenant isolation (enforce drops or blocks),
+ * hub chunks (reported), and prompt injection in each chunk (the indirect
+ * injection check, source document).
+ */
+function checkRetrieval(chunks, opts = {}) {
+    const p = state.policy.rag;
+    const list = Array.isArray(chunks) ? [...chunks] : [];
+    const result = { chunks: list, foreign: 0, hubs: 0, injected: 0 };
+    if (!list.length)
+        return result;
+    const toChunk = opts.toChunk || ((c) => c);
+    const views = safely(null, () => list.map(toChunk));
+    if (!views)
+        return result;
+    let kept = list;
+    if (p.mode !== 'off') {
+        const mode = modeOf(p.mode);
+        const enforce = p.mode === 'enforce';
+        const tenant = (0, context_1.currentTenant)();
+        const verdicts = safely([], () => (0, rag_1.tenantVerdicts)(views, tenant, p.tenantField, opts.tenantOf));
+        const foreign = verdicts.filter((v) => v.foreign);
+        result.foreign = foreign.length;
+        if (foreign.length) {
+            const action = !enforce ? 'reported' : p.action === 'block' ? 'blocked' : 'dropped';
+            emit({ check: 'rag', kind: 'rag_cross_tenant', mode, action, source: 'document', count: foreign.length, detail: `${foreign.length} of ${views.length} chunks` });
+            if (action === 'blocked')
+                throw new AiSecurityBlockedError('rag', 'rag_cross_tenant', 'Shield360 blocked a retrieval that returned another customer\'s data.');
+            if (action === 'dropped') {
+                const drop = new Set(foreign.map((v) => v.index));
+                kept = list.filter((_c, i) => !drop.has(i));
+            }
+            else {
+                for (const v of foreign)
+                    (0, context_1.rememberForeignIdentifiers)(v.tenant, (0, context_1.identifiersIn)(views[v.index].text || ''));
+            }
+        }
+        if (p.hubness) {
+            const hubs = safely([], () => state.hubs.observe(opts.query || '', views.map(rag_1.chunkId)));
+            result.hubs = hubs.length;
+            for (const h of hubs)
+                emit({ check: 'rag', kind: 'rag_hub', mode, action: 'reported', source: 'document', score: h.z, detail: `chunk ${h.chunk} in ${Math.round(h.rate * 100)}% of ${h.retrievals} retrievals across ${h.groups} unrelated query groups` });
+        }
+    }
+    if (state.policy.indirectInjection.mode !== 'off' && opts.setText) {
+        const keptViews = kept.map(toChunk);
+        kept = kept.map((c, i) => {
+            const scan = scanContext(keptViews[i].text || '', { source: 'document' });
+            if (scan.detected)
+                result.injected++;
+            return scan.action === 'stripped' ? opts.setText(c, scan.text) : c;
+        });
+    }
+    else if (state.policy.indirectInjection.mode !== 'off') {
+        for (const v of kept.map(toChunk))
+            if (scanContext(v.text || '', { source: 'document' }).detected)
+                result.injected++;
+    }
+    result.chunks = kept;
+    return result;
+}
+// ---------------------------------------------------------------------------
+/** Sends queued events now (tests, short scripts). */
+function flushAiSecurity() {
+    return state.sink.flush();
+}
+/** Back to defaults, events to memory; for tests. */
+function resetAiSecurity(o = {}) {
+    void state.sink.close();
+    state.limits.stop();
+    state.config?.stop();
+    const sink = new events_1.MemorySink();
+    state = fresh({ ...o, sink });
+    return sink;
+}
+/** The namespace exposed as Shield360.aiSecurity. */
+exports.aiSecurity = {
+    configure: configureAiSecurity,
+    policy: currentPolicy,
+    scanContext,
+    checkPrompt,
+    scanOutput,
+    streamScanner,
+    withCanary,
+    tagContext,
+    defineTool,
+    authorizeTool,
+    checkLimits,
+    recordUsage,
+    syncLimitsNow,
+    checkMcpTools,
+    checkRetrieval,
+    withEndUser: context_1.withEndUser,
+    setEndUser: context_1.setEndUser,
+    flush: flushAiSecurity,
+    BlockedError: AiSecurityBlockedError,
+};
+//# sourceMappingURL=index.js.map

package/dist/ai-security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ai-security/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AA+GH,kDA8BC;AAGD,sCAEC;AAGD,kDAEC;AAiDD,gCAiBC;AAOD,kCA6BC;AAMD,kCAWC;AA+BD,gCAYC;AAWD,sCA6BC;AAGD,gCAIC;AAGD,gCAMC;AAmBD,sCAQC;AAOD,gCAWC;AAMD,kCAWC;AAGD,kCASC;AAGD,sCAEC;AAwBD,sCAqBC;AAGD,wCAEC;AA6CD,wCAgDC;AAKD,0CAEC;AAGD,0CAOC;AA9lBD,2CAA8F;AAC9F,qCAAyH;AACzH,qCAA2F;AAC3F,qCAAiG;AACjG,2CAAiE;AACjE,mCAA0E;AAC1E,qCAA0E;AAC1E,+BAA+F;AAC/F,+BAA4E;AAC5E,qCAAwC;AACxC,uCASmB;AACnB,0CAA0C;AAE1C,qCAAgE;AAAvD,sGAAA,WAAW,OAAA;AAAE,qGAAA,UAAU,OAAA;AAAE,qGAAA,UAAU,OAAA;AAI5C,yCAA+C;AAAtC,6GAAA,gBAAgB,OAAA;AACzB,6BAAyE;AAAhE,0GAAA,mBAAmB,OAAA;AAAE,sGAAA,eAAe,OAAA;AAAE,iGAAA,UAAU,OAAA;AAEzD,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YACW,KAA+B,EAC/B,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAA0B;QAC/B,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AATD,wDASC;AA8CD,IAAI,KAAK,GAAU,KAAK,CAAC,EAAE,CAAC,CAAC;AAE7B,SAAS,KAAK,CAAC,CAAoB;IACjC,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,uBAAkC,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAU;QACf,IAAI;QACJ,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,mBAAU,EAAE;QAChC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,SAAS;QACvB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAA8B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QACzE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa;QAChC,MAAM,EAAE,SAAmC;QAC3C,IAAI,EAAE,IAAI,oBAAc,EAAE;QAC1B,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,GAAG,EAAE;QACpB,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,YAAY,EAAE,IAAI,GAAG,EAAE;KACxB,CAAC;IACF,CAAC,CAAC,MAAM,GAAG,IAAI,oBAAW,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,uFAAuF;AACvF,SAAgB,mBAAmB,CAAC,IAAuB,EAAE;IAC3D,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACxB,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpB,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,IAAI,GAAG,IAAI,sBAAa,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1I,CAAC;IACD,KAAK,GAAG,CAAC,CAAC;IACV,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QAClD,CAAC,CAAC,MAAM,GAAG,IAAI,qBAAY,CAAC;YAC1B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,SAAS,EAAE,CAAC,CAAC,eAAe;YAC5B,aAAa,EAAE,CAAC,CAAC,mBAAmB;YACpC,SAAS,EAAE,CAAC,CAAC,eAAe;YAC5B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;gBACnB,IAAI,KAAK,KAAK,CAAC;oBAAE,CAAC,CAAC,MAAM,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACjE,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM;YAAE,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;aACtC,CAAC;YACJ,iGAAiG;YACjG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,0EAA0E,EAAE,CAAC,CAAC;YAClL,OAAO,CAAC,IAAI,CAAC,2LAA2L,CAAC,CAAC;QAC5M,CAAC;IACH,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAgB,aAAa;IAC3B,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,qFAAqF;AACrF,SAAgB,mBAAmB,CAAC,KAAc;IAChD,KAAK,CAAC,MAAM,GAAG,IAAA,oBAAW,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,IAAI,CAAC,KAAsB;IAClC,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAA0B,CAAC;AAEjG,2EAA2E;AAC3E,SAAS,MAAM,CAAI,QAAW,EAAE,EAAW;IACzC,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,sBAAsB;YAAE,MAAM,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAcY,QAAA,eAAe,GAAG,oDAAoD,CAAC;AAEpF,yDAAyD;AACzD,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iGAAiG;AACjG,SAAgB,UAAU,CAAC,IAAY,EAAE,KAAyB;IAChE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;YAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,uBAAe,KAAK,GAAG,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,IAAY,EAAE,OAAoD,EAAE;IAC9F,MAAM,IAAI,GAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACzF,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC;IACzC,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,4BAAgB,EAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC;IAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,SAAS,CAAC;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;IACrC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACrF,IAAI,CAAC;QACH,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM;QACN,MAAM;QACN,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,YAAY,EAAE,mCAAuB;QACrC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;KACtK,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,sBAAsB,CAAC,oBAAoB,EAAE,WAAW,EAAE,gGAAgG,CAAC,CAAC;IAChM,MAAM,GAAG,GAAG,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,cAAc;AAEd,kFAAkF;AAClF,SAAgB,WAAW,CAAC,KAAiC;IAC3D,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;IACjC,MAAM,IAAI,GAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACrG,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,uBAAW,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;IACrC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,mCAAuB,EAAE,CAAC,CAAC;IACpR,IAAI,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,gGAAgG,CAAC,CAAC;IACpK,OAAO,CAAC,CAAC;AACX,CAAC;AAOY,QAAA,gBAAgB,GAAG,mFAAmF,CAAC;AAEpH,SAAS,YAAY,CAAC,QAAkC,EAAE,IAA2B,EAAE,MAAiC;IACtH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAC5B,IAAI,CAAC;QACH,KAAK,EAAE,QAAQ;QACf,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;QAC/E,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvI,KAAK,EAAE,IAAI,CAAC,MAAM;KACnB,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,IAAY,EAAE,OAAyC,EAAE;IAClF,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IAC9B,MAAM,IAAI,GAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjE,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,mBAAc,EAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAA,4BAAkB,GAAE,EAAE,CAAC,CAAC,CAAC;IAC/K,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACtE,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,KAAK;QAAE,MAAM,IAAI,sBAAsB,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,wBAAgB,CAAC,CAAC;IAC9F,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC/F,CAAC;AAUD,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,OAAyC,EAAE;IACvE,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,4BAAmB,CACrC,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAA,4BAAkB,GAAE,EAAE,EACxH,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,EAAE,CACrF,CAAC;IACF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,EAAuE,EAAE,GAAW,EAAU,EAAE;QAC5G,IAAI,MAAM;YAAE,OAAO,GAAG,CAAC;QACvB,IAAI,CAAC,CAAC;QACN,IAAI,CAAC;YACH,CAAC,GAAG,EAAE,EAAE,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC,CAAC,wCAAwC;YACvD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM;YAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3H,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAsB,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,QAAQ,EAAE,wBAAgB,CAAC,CAAC;QAC7G,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QACvD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;QACxC,IAAI,QAAQ;YACV,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uHAAuH;AACvH,SAAgB,UAAU,CAAC,YAAoB,EAAE,MAAe;IAC9D,MAAM,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,YAAY,CAAC;IAC5B,OAAO,GAAG,YAAY,4BAA4B,CAAC,qBAAqB,CAAC;AAC3E,CAAC;AAED,0FAA0F;AAC1F,SAAgB,UAAU,CAAC,IAAY,EAAE,QAAgB;IACvD,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE;QACrB,MAAM,IAAI,GAAG,IAAA,uBAAa,GAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,QAAQ,KAAK,IAAI,CAAC;YAAE,OAAO;QACrD,IAAA,oCAA0B,EAAC,QAAQ,EAAE,IAAA,uBAAa,EAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAkBD,4FAA4F;AAC5F,SAAgB,aAAa,CAAC,IAAY,EAAE,QAAmB;IAC7D,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAe,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAC5F,IAAA,kBAAU,EAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAA,oBAAU,GAAE,EAAE,IAAA,uBAAa,GAAE,CAAC,CAC1F,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAC/J,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK;QAAE,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpL,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAA2B,GAAyB;IAC5E,IAAI,GAAG,CAAC,WAAW;QAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,IAAO,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,OAAO,IAAA,wBAAgB,EAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAsB,CAAC;IACxB,EAAE,CAAC,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC;IACvB,EAAE,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACjC,EAAE,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACjC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AAEjB,4GAA4G;AAC5G,SAAgB,WAAW;IACzB,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,CAAC,GAAG,IAAA,sBAAW,GAAE,CAAC;IACxB,MAAM,IAAI,GAAG,oBAAW,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,MAAM,CAAe,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;IACrC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnM,IAAI,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,IAAI,OAAO,EAAE,wDAAwD,CAAC,CAAC;IACtI,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+EAA+E;AAC/E,SAAgB,WAAW,CAAC,KAA+D;IACzF,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE;QACrB,MAAM,CAAC,GAAG,IAAA,sBAAW,GAAE,CAAC;QACxB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAW,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE;YAC/D,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC;YAC7B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;YACzB,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,GAAG;SACvC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,SAAgB,aAAa;IAC3B,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAQ,EAAE,OAAoB;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC,GAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,8BAA8B,EAAE;YAChG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE;YACpF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AAEtB;;;;GAIG;AACH,SAAgB,aAAa,CAAoB,MAAqB,EAAE,KAAmB;IACzF,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;IAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnG,MAAM,OAAO,GAAG,MAAM,CAAuB,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,sBAAgB,EAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACvQ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACjD,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ;YAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC7M,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;aACxP,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO;YAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxJ,CAAC;IACD,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC9F,CAAC;AAED,iGAAiG;AACjG,SAAgB,cAAc,CAAC,MAAc,EAAE,IAAY;IACzD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED,4GAA4G;AAC5G,SAAS,YAAY,CAAC,MAAqB,EAAE,KAAyB,EAAE,OAAsB;IAC5F,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAChG,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,eAAe,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QAC1F,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE;QACnG,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;YACnE,cAAc,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK;YACjC,cAAc,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK;SAClC,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,KAAK,CAAC;IAChB,KAAK,CAAC;SACH,KAAK,CAAC,GAAI,CAAC,CAAC,GAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,8BAA8B,EAAE;QAC7E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE;QACpF,IAAI;KACL,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAOD;;;;GAIG;AACH,SAAgB,cAAc,CAC5B,MAAoB,EACpB,OAA6H,EAAE;IAE/H,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,MAAM,GAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACrF,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAI,EAAE,EAAE,CAAC,CAAqB,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,CAAiB,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;QACrC,MAAM,MAAM,GAAG,IAAA,uBAAa,GAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,oBAAc,EAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/F,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;YACjK,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAI,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,EAAE,uEAAuE,CAAC,CAAC;YAC/J,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,OAAO;oBAAE,IAAA,oCAA0B,EAAC,CAAC,CAAC,MAAgB,EAAE,IAAA,uBAAa,EAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YACpH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,aAAO,CAAC,CAAC,CAAC,CAAC;YACxF,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,UAAU,sBAAsB,CAAC,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9P,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvB,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1E,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAE,IAAI,CAAC,OAAkC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ;gBAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACvH,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,sDAAsD;AACtD,SAAgB,eAAe;IAC7B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,qDAAqD;AACrD,SAAgB,eAAe,CAAC,IAAuB,EAAE;IACvD,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACxB,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpB,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,mBAAU,EAAE,CAAC;IAC9B,KAAK,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qDAAqD;AACxC,QAAA,UAAU,GAAG;IACxB,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,aAAa;IACrB,WAAW;IACX,WAAW;IACX,UAAU;IACV,aAAa;IACb,UAAU;IACV,UAAU;IACV,UAAU;IACV,aAAa;IACb,WAAW;IACX,WAAW;IACX,aAAa;IACb,aAAa;IACb,cAAc;IACd,WAAW,EAAE,qBAA+D;IAC5E,UAAU,EAAV,oBAAU;IACV,KAAK,EAAE,eAAe;IACtB,YAAY,EAAE,sBAAsB;CACrC,CAAC"}