soloforge 1.1.42 → 1.1.44

package/dist/gate/privacy/scanning.js

@@ -0,0 +1,574 @@
+/**
+ * Privacy Scanning — 审计层模块。
+ *
+ * 职责边界：
+ * - 负责：detectSensitivity 等 审计层职责
+ * - 不负责：不属于本模块的职责由对应模块承担
+ *
+ * 被谁调用：发布门禁、质量检查
+ * 调用谁：node:crypto、logger、privacy_types、privacy_patterns、privacy_grants
+ *
+ * 数据流：审计输入（代码/配置） → 检查 → 评分/报告
+ * 持久化：无持久化（纯计算/内存态）
+ */
+import crypto from "node:crypto";
+import { debugLog } from "../../shared/logger.js";
+import { DEFAULT_HANDLING, CONTEXT_HANDLING, FORBIDDEN_READ_PATTERNS, CONFIRMATION_READ_PATTERNS, TEXT_SECRET_PATTERNS, } from "./patterns.js";
+import { isGrantValid, isGrantExpired, checkGrantPermission } from "./grants.js";
+// ── 检测辅助函数 ──
+/**
+ * 检测来源的敏感等级。
+ * @param sourceRef - 来源引用路径
+ * @param contentHints - 内容提示关键词（可选）
+ * @returns 数据敏感标签
+ */
+export function detectSensitivity(sourceRef, contentHints) {
+    debugLog(`隐私契约: 检测敏感等级 — ${sourceRef}`);
+    // 优先检查禁止模式
+    for (const { pattern, label } of FORBIDDEN_READ_PATTERNS) {
+        if (pattern.test(sourceRef)) {
+            return {
+                label,
+                source_ref: sourceRef,
+                detected_by: [`pattern: ${pattern.source}`],
+                confidence: 0.9,
+                handling: "forbidden",
+            };
+        }
+    }
+    // 检查确认模式
+    for (const { pattern, label } of CONFIRMATION_READ_PATTERNS) {
+        if (pattern.test(sourceRef)) {
+            return {
+                label,
+                source_ref: sourceRef,
+                detected_by: [`pattern: ${pattern.source}`],
+                confidence: 0.7,
+                handling: "require_human",
+            };
+        }
+    }
+    // 基于内容的检测
+    if (contentHints && contentHints.length > 0) {
+        const joined = contentHints.join(" ");
+        if (/token|api[_-]?key|secret[_-]?key|private[_-]?key/i.test(joined)) {
+            return {
+                label: "secret",
+                source_ref: sourceRef,
+                detected_by: ["content_keyword"],
+                confidence: 0.6,
+                handling: "forbidden",
+            };
+        }
+        if (/\bpassword\b|\bpasswd\b/i.test(joined)) {
+            return {
+                label: "credential",
+                source_ref: sourceRef,
+                detected_by: ["content_keyword"],
+                confidence: 0.6,
+                handling: "forbidden",
+            };
+        }
+        if (/\b\d{11}\b/.test(joined) || /\b[\w.+-]+@[\w-]+\.[\w.]+\b/.test(joined)) {
+            return {
+                label: "pii",
+                source_ref: sourceRef,
+                detected_by: ["content_pattern"],
+                confidence: 0.5,
+                handling: "require_human",
+            };
+        }
+    }
+    // 常规代码文件 (.ts, .js, .py, .go, .rs, .java, .tsx, .jsx) 默认为 internal
+    const codeExtensions = /\.(ts|tsx|js|jsx|py|go|rs|java|c|cpp|h|rb|php|swift|kt)$/i;
+    if (codeExtensions.test(sourceRef)) {
+        return {
+            label: "internal",
+            source_ref: sourceRef,
+            detected_by: ["file_extension"],
+            confidence: 0.7,
+            handling: "allow",
+        };
+    }
+    return {
+        label: "unknown",
+        source_ref: sourceRef,
+        detected_by: ["no_match"],
+        confidence: 0.3,
+        handling: DEFAULT_HANDLING["unknown"],
+    };
+}
+// ── 脱敏处理 ──
+/**
+ * 对内容进行脱敏处理。
+ * @param content - 原始内容
+ * @param label - 敏感标签
+ * @param sourceRef - 来源引用（可选）
+ * @returns 脱敏结果和脱敏记录
+ */
+export function redactContent(content, label, sourceRef) {
+    debugLog(`隐私契约: 开始内容脱敏 — 等级: ${label}, 来源: ${sourceRef ?? "未知"}`);
+    let redacted = content;
+    const fieldsRedacted = [];
+    if (label === "secret" || label === "credential") {
+        redacted = "***REDACTED***";
+        fieldsRedacted.push("all");
+    }
+    else if (label === "pii") {
+        redacted = redactPII(content);
+        fieldsRedacted.push("phone", "email", "id_number", "address");
+    }
+    else if (label === "customer_data" || label === "production_data") {
+        redacted = summarizeOnly(content);
+        fieldsRedacted.push("raw_data");
+    }
+    else if (label === "confidential") {
+        redacted = summarizeOnly(content);
+        fieldsRedacted.push("details");
+    }
+    return {
+        redacted,
+        record: {
+            source_ref: sourceRef ?? "",
+            redaction_type: labelToRedactionType(label),
+            after_hash: simpleHash(redacted),
+            fields_redacted: fieldsRedacted,
+        },
+    };
+}
+function redactPII(text) {
+    let result = text;
+    // 手机号: 138****1234
+    result = result.replace(/1[3-9]\d(\d{4})\d{4}/g, (m, last) => m.slice(0, 3) + "****" + last);
+    // 邮箱: a***@domain.com
+    result = result.replace(/([\w.+-])[\w.+-]*@([\w-]+\.[\w.]+)/g, (_, first, domain) => first + "***@" + domain);
+    // 身份证号: 保留后 4 位
+    result = result.replace(/\b\d{14}(\d{4})\b/g, "**************$1");
+    // Address: keep city-level (省/市 + following district, redact detail)
+    result = result.replace(/([一-龥]{2,6}(?:省|市|自治区|特别行政区))([一-龥]{2,6}(?:市|区|县|镇))([一-龥\d]+路?[一-龥\d]+)/g, "$1$2***");
+    return result;
+}
+function summarizeOnly(text) {
+    if (text.length <= 100)
+        return `[摘要] ${text.slice(0, 50)}...`;
+    return `[摘要] ${text.slice(0, 80)}... (共 ${text.length} 字符)`;
+}
+function labelToRedactionType(label) {
+    const map = {
+        secret: "secret_mask",
+        credential: "credential_removed",
+        pii: "pii_mask",
+        customer_data: "customer_data_summary",
+        production_data: "production_data_summary",
+        confidential: "path_only",
+    };
+    return map[label] ?? "hash_only";
+}
+function simpleHash(text) {
+    return crypto.createHash("sha256").update(text).digest("hex").slice(0, 16);
+}
+// ── 外发检查 ──
+/**
+ * 检查内容是否可以外部发送。
+ * @param content - 待发送内容
+ * @param sensitivity - 敏感标签
+ * @param grants - 授权列表
+ * @returns 外发检查结果
+ */
+export function checkExternalSend(content, sensitivity, grants) {
+    debugLog(`隐私契约: 检查外发许可 — 等级: ${sensitivity.label}`);
+    const handling = CONTEXT_HANDLING[sensitivity.label].external_send;
+    if (handling === "forbidden") {
+        debugLog(`隐私契约: 外发拒绝 — 等级 ${sensitivity.label} 禁止外发`);
+        return { allowed: false, reason: `敏感等级 ${sensitivity.label} 禁止外发`, requiresRedaction: false };
+    }
+    if (handling === "allow") {
+        return { allowed: true, reason: "", requiresRedaction: false };
+    }
+    // require_human — 检查授权
+    for (const grant of grants) {
+        const perm = checkGrantPermission(grant, "external_send", sensitivity.label);
+        if (perm.allowed) {
+            debugLog(`隐私契约: 外发通过 — 授权 ${grant.grant_id} 允许（已脱敏）`);
+            const { redacted } = redactContent(content, sensitivity.label);
+            return { allowed: true, reason: `授权 ${grant.grant_id} 允许外发（已脱敏）`, requiresRedaction: true, redactedContent: redacted };
+        }
+    }
+    debugLog(`隐私契约: 外发拒绝 — 等级 ${sensitivity.label} 需要人工授权`);
+    return {
+        allowed: false,
+        reason: `敏感等级 ${sensitivity.label} 需要人工授权才能外发`,
+        requiresRedaction: true,
+    };
+}
+// ── Prompt 注入检查 ──
+/**
+ * 检查数据是否可以注入 prompt。
+ * @param sensitivity - 敏感标签
+ * @param grants - 授权列表
+ * @returns 注入检查结果
+ */
+export function checkPromptInjection(sensitivity, grants) {
+    debugLog(`隐私契约: 检查 prompt 注入许可 — 等级: ${sensitivity.label}`);
+    const handling = CONTEXT_HANDLING[sensitivity.label].prompt_injection;
+    if (handling === "forbidden") {
+        debugLog(`隐私契约: 注入拒绝 — 等级 ${sensitivity.label} 禁止注入 prompt`);
+        return { allowed: false, reason: `敏感等级 ${sensitivity.label} 禁止注入 prompt`, handling };
+    }
+    if (handling === "allow") {
+        return { allowed: true, reason: "", handling };
+    }
+    // 检查 prompt_inject 授权
+    for (const grant of grants) {
+        const perm = checkGrantPermission(grant, "prompt_inject", sensitivity.label);
+        if (perm.allowed) {
+            return { allowed: true, reason: `授权 ${grant.grant_id} 允许注入（${handling}）`, handling };
+        }
+    }
+    debugLog(`隐私契约: 注入拒绝 — 等级 ${sensitivity.label} 需要 ${handling} 处理`);
+    return { allowed: false, reason: `敏感等级 ${sensitivity.label} 需要 ${handling} 处理`, handling };
+}
+// ── 中文反馈 ──
+/**
+ * 构建隐私处理反馈信息。
+ * @param options - 反馈选项
+ * @returns 格式化的反馈文本
+ */
+export function buildPrivacyFeedback(options) {
+    debugLog(`隐私契约: 构建隐私反馈 — 未读: ${options.notRead.length}, 脱敏: ${options.redacted.length}, 需授权: ${options.requiresAuth.length}`);
+    const lines = [];
+    if (options.notRead.length > 0) {
+        lines.push(`未读取的内容: ${options.notRead.join(", ")}`);
+    }
+    if (options.redacted.length > 0) {
+        lines.push(`已脱敏的内容: ${options.redacted.join(", ")}`);
+    }
+    if (options.requiresAuth.length > 0) {
+        lines.push(`需要授权的内容: ${options.requiresAuth.join(", ")}`);
+    }
+    if (options.notInPrompt.length > 0) {
+        lines.push(`未进入 prompt 的内容: ${options.notInPrompt.join(", ")}`);
+    }
+    if (options.blocked) {
+        lines.push(`⚠️ 存在敏感信息阻断`);
+    }
+    if (options.externalRedaction) {
+        lines.push(`外发前已完成 redaction check`);
+    }
+    return lines.join("\n");
+}
+// ── 治理验证 ──
+/**
+ * 验证隐私契约合规性。
+ * @param options.sensitivities - 敏感标签列表
+ * @param options.grants - 授权列表
+ * @param options.redactionRecords - 脱敏记录列表
+ * @param options.promptInjections - prompt 注入列表
+ * @param options.taskContextStores - 任务上下文存储列表
+ * @param options.artifactStores - 产物存储列表
+ * @param options.externalSends - 外部发送列表
+ * @returns 治理发现列表
+ */
+export function validatePrivacyContract(options) {
+    const findings = [];
+    debugLog(`隐私契约: 开始治理验证 — 检查 ${options.sensitivities.length} 个敏感来源`);
+    // 规则 1: secret 不得进入 prompt
+    for (const inj of options.promptInjections) {
+        if (inj.label === "secret" || inj.label === "credential") {
+            findings.push({
+                severity: "hard_fail",
+                rule: "gc-secret-no-prompt",
+                source_ref: inj.source_ref,
+                message: `secret/credential (${inj.label}) 不得注入 prompt — ${inj.source_ref}`,
+            });
+        }
+    }
+    // 规则 2: secret 不得写入 TaskContext
+    for (const store of options.taskContextStores) {
+        if (store.label === "secret" || store.label === "credential") {
+            findings.push({
+                severity: "hard_fail",
+                rule: "gc-secret-no-taskcontext",
+                source_ref: store.source_ref,
+                message: `secret/credential (${store.label}) 不得写入 TaskContext — ${store.source_ref}`,
+            });
+        }
+    }
+    // 规则 3: secret 不得写入 artifact/report
+    for (const art of options.artifactStores) {
+        if (art.label === "secret" || art.label === "credential") {
+            findings.push({
+                severity: "hard_fail",
+                rule: "gc-secret-no-artifact",
+                source_ref: art.source_ref,
+                message: `secret/credential (${art.label}) 不得写入 artifact — ${art.source_ref}`,
+            });
+        }
+    }
+    // 规则 4: PII 未脱敏外发
+    for (const ext of options.externalSends) {
+        if (ext.label === "pii" || ext.label === "customer_data" || ext.label === "production_data") {
+            const hasRedaction = options.redactionRecords.some((r) => r.source_ref === ext.source_ref);
+            if (!hasRedaction) {
+                findings.push({
+                    severity: "hard_fail",
+                    rule: "gc-pii-no-unredacted-external",
+                    source_ref: ext.source_ref,
+                    message: `${ext.label} 未脱敏不得外发 — ${ext.source_ref}`,
+                });
+            }
+        }
+    }
+    // 规则 5: secret 外发 hard fail
+    for (const ext of options.externalSends) {
+        if (ext.label === "secret" || ext.label === "credential") {
+            findings.push({
+                severity: "hard_fail",
+                rule: "gc-secret-no-external",
+                source_ref: ext.source_ref,
+                message: `secret/credential (${ext.label}) 外发 hard fail — ${ext.source_ref}`,
+            });
+        }
+    }
+    // 规则 6: DataAccessGrant 过期后不得使用
+    for (const grant of options.grants) {
+        if (isGrantExpired(grant)) {
+            findings.push({
+                severity: "hard_fail",
+                rule: "gc-grant-expired",
+                source_ref: grant.grant_id,
+                message: `授权 ${grant.grant_id} 已过期，不得继续使用`,
+            });
+        }
+    }
+    // 规则 7: unknown sensitivity 不能当 public
+    for (const s of options.sensitivities) {
+        if (s.label === "unknown" && s.handling === "allow") {
+            findings.push({
+                severity: "hard_fail",
+                rule: "gc-unknown-not-public",
+                source_ref: s.source_ref,
+                message: `unknown sensitivity 不能当做 public 处理 — ${s.source_ref}`,
+            });
+        }
+    }
+    // 规则 8: private evidence 不得注入 prompt
+    for (const s of options.sensitivities) {
+        if (s.label === "secret" || s.label === "credential") {
+            const injected = options.promptInjections.some((i) => i.source_ref === s.source_ref);
+            if (injected) {
+                findings.push({
+                    severity: "hard_fail",
+                    rule: "gc-private-no-prompt",
+                    source_ref: s.source_ref,
+                    message: `private evidence (${s.label}) 不得注入 prompt — ${s.source_ref}`,
+                });
+            }
+        }
+    }
+    // 规则 9: 每次脱敏必须有 RedactionRecord
+    const redactedSources = new Set(options.redactionRecords.map((r) => r.source_ref));
+    for (const s of options.sensitivities) {
+        if (s.handling === "redact" && !redactedSources.has(s.source_ref)) {
+            findings.push({
+                severity: "advisory",
+                rule: "gc-redaction-record-missing",
+                source_ref: s.source_ref,
+                message: `敏感来源 ${s.source_ref} 标记为脱敏但缺少 RedactionRecord`,
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * 扫描文本中的敏感信息。
+ * @param text - 待扫描文本
+ * @param sourceRef - 来源引用
+ * @returns 检测到的敏感标签列表
+ */
+export function scanTextSensitivity(text, sourceRef) {
+    debugLog(`隐私契约: 扫描文本敏感信息 — 来源: ${sourceRef}`);
+    const labels = [];
+    for (const { pattern, label, fields } of TEXT_SECRET_PATTERNS) {
+        if (pattern.test(text)) {
+            labels.push({
+                label,
+                source_ref: sourceRef,
+                detected_by: [`text_pattern:${fields.join(",")}`],
+                confidence: 0.85,
+                handling: (label === "pii" || label === "production_data" || label === "customer_data") ? "require_human" : "forbidden",
+            });
+        }
+    }
+    return labels;
+}
+/**
+ * 扫描来源引用的敏感等级。
+ * @param sourceRef - 来源引用路径
+ * @returns 数据敏感标签
+ */
+export function scanSourceRefSensitivity(sourceRef) {
+    debugLog(`隐私契约: 扫描来源敏感等级 — ${sourceRef}`);
+    return detectSensitivity(sourceRef);
+}
+/**
+ * 对文本中的敏感信息进行脱敏处理。
+ * @param text - 原始文本
+ * @param sourceRef - 来源引用（可选）
+ * @returns 脱敏结果和脱敏记录
+ */
+export function redactSensitiveText(text, sourceRef) {
+    let result = text;
+    const records = [];
+    const fieldsRedacted = [];
+    debugLog(`隐私契约: 开始文本脱敏 — 来源: ${sourceRef ?? '未知'}`);
+    // API 密钥 / 令牌
+    if (/sk-[a-zA-Z0-9]{32,}/.test(result)) {
+        result = result.replace(/sk-[a-zA-Z0-9]{32,}/g, "sk-****REDACTED****");
+        fieldsRedacted.push("api_key");
+    }
+    // AWS 访问密钥
+    if (/AKIA[0-9A-Z]{16}/.test(result)) {
+        result = result.replace(/AKIA[0-9A-Z]{16}/g, "AKIA****REDACTED****");
+        fieldsRedacted.push("aws_access_key");
+    }
+    // AWS 秘密访问密钥值
+    result = result.replace(/(aws_secret_access_key\s*=\s*['"])[^'"]+(['"])/g, "$1****REDACTED****$2");
+    // 密码值
+    result = result.replace(/(password\s*=\s*['"])[^'"]{4,}(['"])/gi, "$1****REDACTED****$2");
+    // 密钥值
+    result = result.replace(/(secret_key\s*=\s*['"])[^'"]+(['"])/gi, "$1****REDACTED****$2");
+    // JWT 密钥值
+    result = result.replace(/(jwt_secret\s*=\s*['"])[^'"]+(['"])/gi, "$1****REDACTED****$2");
+    // 个人身份信息
+    const piiResult = redactPII(result);
+    if (piiResult !== result) {
+        result = piiResult;
+        fieldsRedacted.push("phone", "email", "id_number", "address");
+    }
+    if (fieldsRedacted.length > 0) {
+        debugLog(`隐私契约: 文本脱敏完成 — 脱敏字段: ${fieldsRedacted.join(", ")}`);
+        records.push({
+            source_ref: sourceRef ?? "",
+            redaction_type: "secret_mask",
+            after_hash: simpleHash(result),
+            fields_redacted: [...new Set(fieldsRedacted)],
+        });
+    }
+    return { redacted: result, records };
+}
+/**
+ * 评估隐私门禁，决定是否阻断操作。
+ * @param options - 门禁评估选项
+ * @returns 门禁结果，包含是否通过、阻断源和警告
+ */
+export function evaluatePrivacyGate(params) {
+    const findings = [];
+    const blockedSources = [];
+    debugLog(`隐私契约: 开始隐私门禁评估`);
+    const allLabels = [];
+    const redactionRecords = [];
+    let hardFail = false;
+    // 扫描意图文本
+    if (params.intent) {
+        const intentLabels = scanTextSensitivity(params.intent, "intent");
+        for (const l of intentLabels) {
+            allLabels.push(l);
+            if (l.label === "secret" || l.label === "credential") {
+                hardFail = true;
+                blockedSources.push("intent");
+                findings.push({ severity: "hard_fail", rule: "gc-intent-secret", source_ref: "intent", message: `用户意图包含 ${l.label}（${l.detected_by.join(", ")}），禁止执行` });
+            }
+        }
+    }
+    // 按来源引用扫描输入材料
+    if (params.input_materials) {
+        for (const m of params.input_materials) {
+            const refLabel = scanSourceRefSensitivity(m.path_or_ref);
+            allLabels.push(refLabel);
+            if (refLabel.handling === "forbidden") {
+                hardFail = true;
+                blockedSources.push(m.path_or_ref);
+                findings.push({ severity: "hard_fail", rule: "gc-material-forbidden", source_ref: m.path_or_ref, message: `输入材料 ${m.path_or_ref} 匹配禁止模式（${refLabel.label}），禁止读取` });
+            }
+            else if (refLabel.handling === "require_human") {
+                const hasGrant = (params.grants ?? []).some(g => isGrantValid(g) && g.sensitivity_allowed.includes(refLabel.label) && g.allowed_operations.includes("read"));
+                if (!hasGrant) {
+                    blockedSources.push(m.path_or_ref);
+                    findings.push({ severity: "advisory", rule: "gc-material-requires-confirmation", source_ref: m.path_or_ref, message: `输入材料 ${m.path_or_ref} 标记为 ${refLabel.label}，需人工确认后读取` });
+                }
+            }
+            // 如果提供了内容也进行扫描
+            if (m.content) {
+                const contentLabels = scanTextSensitivity(m.content, m.path_or_ref);
+                for (const cl of contentLabels) {
+                    if (cl.label === "secret" || cl.label === "credential") {
+                        hardFail = true;
+                        blockedSources.push(m.path_or_ref);
+                        findings.push({ severity: "hard_fail", rule: "gc-content-secret", source_ref: m.path_or_ref, message: `输入材料内容包含 ${cl.label}（${cl.detected_by.join(", ")}），禁止执行` });
+                    }
+                    allLabels.push(cl);
+                }
+            }
+        }
+    }
+    // 检查 task_context_stores 是否包含敏感内容
+    if (params.task_context_stores) {
+        for (const s of params.task_context_stores) {
+            if (s.content) {
+                const labels = scanTextSensitivity(s.content, s.source_ref);
+                for (const l of labels) {
+                    if (l.label === "secret" || l.label === "credential") {
+                        hardFail = true;
+                        findings.push({ severity: "hard_fail", rule: "gc-taskcontext-secret", source_ref: s.source_ref, message: `TaskContext 写入内容包含 ${l.label}，禁止保存` });
+                    }
+                }
+            }
+        }
+    }
+    // 检查外发内容
+    if (params.external_sends) {
+        for (const e of params.external_sends) {
+            const labels = e.content ? scanTextSensitivity(e.content, e.source_ref) : [];
+            const refLabel = scanSourceRefSensitivity(e.source_ref);
+            if (refLabel.label === "secret" || refLabel.label === "credential") {
+                hardFail = true;
+                findings.push({ severity: "hard_fail", rule: "gc-external-secret", source_ref: e.source_ref, message: `外发来源 ${e.source_ref} 标记为 ${refLabel.label}，禁止外发` });
+            }
+            for (const l of labels) {
+                if (l.label === "secret" || l.label === "credential") {
+                    hardFail = true;
+                    findings.push({ severity: "hard_fail", rule: "gc-external-content-secret", source_ref: e.source_ref, message: `外发内容包含 ${l.label}，禁止外发` });
+                }
+            }
+        }
+    }
+    // 如有需要，脱敏意图文本
+    let redactedText;
+    if (params.intent) {
+        const { redacted, records } = redactSensitiveText(params.intent, "intent");
+        if (records.length > 0) {
+            redactedText = redacted;
+            redactionRecords.push(...records);
+        }
+    }
+    if (hardFail) {
+        debugLog(`隐私契约: 隐私门禁阻断 — 发现 ${blockedSources.length} 个阻断源`);
+    }
+    else if (findings.length > 0) {
+        debugLog(`隐私契约: 隐私门禁通过 — 但有 ${findings.length} 个警告`);
+    }
+    else {
+        debugLog(`隐私契约: 隐私门禁通过`);
+    }
+    return {
+        allowed: !hardFail,
+        hard_fail: hardFail,
+        blocked_sources: [...new Set(blockedSources)],
+        findings,
+        redacted_text: redactedText,
+        redaction_records: redactionRecords,
+        labels: allLabels,
+    };
+}
+//# sourceMappingURL=scanning.js.map

package/dist/gate/privacy/scanning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanning.js","sourceRoot":"","sources":["../../../src/gate/privacy/scanning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAUlD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEjF,eAAe;AAEf;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,YAAuB;IAEvB,QAAQ,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;IACxC,WAAW;IACX,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK;gBACL,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,CAAC,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC3C,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,WAAW;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,SAAS;IACT,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,0BAA0B,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK;gBACL,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,CAAC,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC3C,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,eAAe;aAC1B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,UAAU;IACV,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,mDAAmD,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,KAAK,EAAE,QAAQ;gBACf,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,CAAC,iBAAiB,CAAC;gBAChC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,WAAW;aACtB,CAAC;QACJ,CAAC;QACD,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,KAAK,EAAE,YAAY;gBACnB,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,CAAC,iBAAiB,CAAC;gBAChC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,WAAW;aACtB,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,CAAC,iBAAiB,CAAC;gBAChC,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,eAAe;aAC1B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,MAAM,cAAc,GAAG,2DAA2D,CAAC;IACnF,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,KAAK,EAAE,UAAU;YACjB,UAAU,EAAE,SAAS;YACrB,WAAW,EAAE,CAAC,gBAAgB,CAAC;YAC/B,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,OAAO;SAClB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,UAAU,EAAE,GAAG;QACf,QAAQ,EAAE,gBAAgB,CAAC,SAAS,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,aAAa;AAEb;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,KAAuB,EACvB,SAAkB;IAElB,QAAQ,CAAC,sBAAsB,KAAK,SAAS,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,QAAQ,GAAG,OAAO,CAAC;IACvB,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QACjD,QAAQ,GAAG,gBAAgB,CAAC;QAC5B,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;SAAM,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9B,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;QACpE,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAClC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;QACpC,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAClC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM,EAAE;YACN,UAAU,EAAE,SAAS,IAAI,EAAE;YAC3B,cAAc,EAAE,oBAAoB,CAAC,KAAK,CAAC;YAC3C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;YAChC,eAAe,EAAE,cAAc;SAChC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,mBAAmB;IACnB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7F,sBAAsB;IACtB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,qCAAqC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;IAC9G,gBAAgB;IAChB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;IAClE,qEAAqE;IACrE,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,2EAA2E,EAC3E,SAAS,CACV,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;IAC9D,OAAO,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,IAAI,CAAC,MAAM,MAAM,CAAC;AAC9D,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAuB;IACnD,MAAM,GAAG,GAAqD;QAC5D,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,oBAAoB;QAChC,GAAG,EAAE,UAAU;QACf,aAAa,EAAE,uBAAuB;QACtC,eAAe,EAAE,yBAAyB;QAC1C,YAAY,EAAE,WAAW;KAC1B,CAAC;IACF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,aAAa;AAEb;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,WAAiC,EACjC,MAAyB;IAEzB,QAAQ,CAAC,sBAAsB,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;IAEnE,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,QAAQ,CAAC,mBAAmB,WAAW,CAAC,KAAK,OAAO,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,WAAW,CAAC,KAAK,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IAChG,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IAED,uBAAuB;IACvB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,QAAQ,CAAC,mBAAmB,KAAK,CAAC,QAAQ,UAAU,CAAC,CAAC;YACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,QAAQ,YAAY,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QACzH,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,mBAAmB,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC;IACxD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,QAAQ,WAAW,CAAC,KAAK,aAAa;QAC9C,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED,oBAAoB;AAEpB;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAiC,EACjC,MAAyB;IAEzB,QAAQ,CAAC,8BAA8B,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAEtE,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,QAAQ,CAAC,mBAAmB,WAAW,CAAC,KAAK,cAAc,CAAC,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,WAAW,CAAC,KAAK,cAAc,EAAE,QAAQ,EAAE,CAAC;IACvF,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IAED,sBAAsB;IACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,QAAQ,SAAS,QAAQ,GAAG,EAAE,QAAQ,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,mBAAmB,WAAW,CAAC,KAAK,OAAO,QAAQ,KAAK,CAAC,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,WAAW,CAAC,KAAK,OAAO,QAAQ,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7F,CAAC;AAED,aAAa;AAEb;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAOpC;IACC,QAAQ,CAAC,sBAAsB,OAAO,CAAC,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,QAAQ,CAAC,MAAM,UAAU,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9H,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,aAAa;AAEb;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAQvC;IACC,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,QAAQ,CAAC,qBAAqB,OAAO,CAAC,aAAa,CAAC,MAAM,QAAQ,CAAC,CAAC;IAEpE,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,WAAW;gBACrB,IAAI,EAAE,qBAAqB;gBAC3B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,sBAAsB,GAAG,CAAC,KAAK,mBAAmB,GAAG,CAAC,UAAU,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,WAAW;gBACrB,IAAI,EAAE,0BAA0B;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,sBAAsB,KAAK,CAAC,KAAK,wBAAwB,KAAK,CAAC,UAAU,EAAE;aACrF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QACzC,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,WAAW;gBACrB,IAAI,EAAE,uBAAuB;gBAC7B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,sBAAsB,GAAG,CAAC,KAAK,qBAAqB,GAAG,CAAC,UAAU,EAAE;aAC9E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,eAAe,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;YAC5F,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3F,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,WAAW;oBACrB,IAAI,EAAE,+BAA+B;oBACrC,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,cAAc,GAAG,CAAC,UAAU,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,WAAW;gBACrB,IAAI,EAAE,uBAAuB;gBAC7B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,sBAAsB,GAAG,CAAC,KAAK,oBAAoB,GAAG,CAAC,UAAU,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,WAAW;gBACrB,IAAI,EAAE,kBAAkB;gBACxB,UAAU,EAAE,KAAK,CAAC,QAAQ;gBAC1B,OAAO,EAAE,MAAM,KAAK,CAAC,QAAQ,aAAa;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,WAAW;gBACrB,IAAI,EAAE,uBAAuB;gBAC7B,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,OAAO,EAAE,wCAAwC,CAAC,CAAC,UAAU,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;YACrF,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,WAAW;oBACrB,IAAI,EAAE,sBAAsB;oBAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,OAAO,EAAE,qBAAqB,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC,UAAU,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACnF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,6BAA6B;gBACnC,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,OAAO,EAAE,QAAQ,CAAC,CAAC,UAAU,2BAA2B;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,SAAiB;IACjE,QAAQ,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;QAC9D,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK;gBACL,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW;aACxH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,QAAQ,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;IAC1C,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,SAAkB;IAClE,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,QAAQ,CAAC,sBAAsB,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;IAEpD,cAAc;IACd,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;QACvE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IACD,WAAW;IACX,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;QACrE,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxC,CAAC;IACD,cAAc;IACd,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,iDAAiD,EAAE,sBAAsB,CAAC,CAAC;IACnG,MAAM;IACN,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,wCAAwC,EAAE,sBAAsB,CAAC,CAAC;IAC1F,MAAM;IACN,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,uCAAuC,EAAE,sBAAsB,CAAC,CAAC;IACzF,UAAU;IACV,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,uCAAuC,EAAE,sBAAsB,CAAC,CAAC;IACzF,SAAS;IACT,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,GAAG,SAAS,CAAC;QACnB,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,wBAAwB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC;YACX,UAAU,EAAE,SAAS,IAAI,EAAE;YAC3B,cAAc,EAAE,aAAa;YAC7B,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;YAC9B,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAQnC;IACC,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC3B,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,SAAS;IACT,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBACrD,QAAQ,GAAG,IAAI,CAAC;gBAChB,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3J,CAAC;QACH,CAAC;IACH,CAAC;IAED,cAAc;IACd,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACzD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,IAAI,QAAQ,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACtC,QAAQ,GAAG,IAAI,CAAC;gBAChB,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,uBAAuB,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,WAAW,WAAW,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;YACtK,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;gBACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC9C,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC3G,CAAC;gBACF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;oBACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,mCAAmC,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,WAAW,QAAQ,QAAQ,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC;gBACjL,CAAC;YACH,CAAC;YACD,eAAe;YACf,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,aAAa,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;gBACpE,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;oBAC/B,IAAI,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;wBACvD,QAAQ,GAAG,IAAI,CAAC;wBAChB,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;wBACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACrK,CAAC;oBACD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC3C,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;gBAC5D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;oBACvB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;wBACrD,QAAQ,GAAG,IAAI,CAAC;wBAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,uBAAuB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;oBACnJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS;IACT,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACxD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBACnE,QAAQ,GAAG,IAAI,CAAC;gBAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,UAAU,QAAQ,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YAC7J,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;oBACrD,QAAQ,GAAG,IAAI,CAAC;oBAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,4BAA4B,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;gBAC5I,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,cAAc;IACd,IAAI,YAAgC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,YAAY,GAAG,QAAQ,CAAC;YACxB,gBAAgB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,qBAAqB,cAAc,CAAC,MAAM,OAAO,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,qBAAqB,QAAQ,CAAC,MAAM,MAAM,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,QAAQ;QAClB,SAAS,EAAE,QAAQ;QACnB,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7C,QAAQ;QACR,aAAa,EAAE,YAAY;QAC3B,iBAAiB,EAAE,gBAAgB;QACnC,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC"}

package/dist/gate/privacy/types.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Privacy Types — 审计层模块。
+ *
+ * 职责边界：
+ * - 负责：SensitivityLabel 等 审计层职责
+ * - 不负责：不属于本模块的职责由对应模块承担
+ *
+ * 被谁调用：发布门禁、质量检查
+ * 调用谁：无外部依赖
+ *
+ * 数据流：审计输入（代码/配置） → 检查 → 评分/报告
+ * 持久化：无持久化（纯计算/内存态）
+ */
+export type SensitivityLabel = "public" | "internal" | "confidential" | "secret" | "credential" | "pii" | "customer_data" | "production_data" | "unknown";
+export type HandlingMode = "allow" | "redact" | "summarize_only" | "require_human" | "forbidden";
+export type RedactionType = "secret_mask" | "credential_removed" | "pii_mask" | "customer_data_summary" | "production_data_summary" | "path_only" | "hash_only";
+export type AllowedOperation = "read" | "summarize" | "redact" | "prompt_inject" | "store_private" | "external_send";
+export type CheckContext = "prompt_injection" | "task_context_store" | "artifact_store" | "evidence_store" | "external_send" | "read_operation";
+export interface DataSensitivityLabel {
+    label: SensitivityLabel;
+    source_ref: string;
+    detected_by: string[];
+    confidence: number;
+    handling: HandlingMode;
+}
+export interface DataAccessGrant {
+    grant_id: string;
+    granted_by: string;
+    scope_refs: string[];
+    sensitivity_allowed: SensitivityLabel[];
+    allowed_operations: AllowedOperation[];
+    purpose: string;
+    expires_at: string;
+    revocable: boolean;
+}
+export interface RedactionRecord {
+    source_ref: string;
+    redaction_type: RedactionType;
+    before_hash?: string;
+    after_hash: string;
+    fields_redacted: string[];
+}
+export interface PrivacyGovernanceFinding {
+    severity: "hard_fail" | "advisory";
+    rule: string;
+    source_ref?: string;
+    message: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/gate/privacy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/gate/privacy/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,MAAM,gBAAgB,GACxB,QAAQ,GACR,UAAU,GACV,cAAc,GACd,QAAQ,GACR,YAAY,GACZ,KAAK,GACL,eAAe,GACf,iBAAiB,GACjB,SAAS,CAAC;AAEd,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,QAAQ,GACR,gBAAgB,GAChB,eAAe,GACf,WAAW,CAAC;AAEhB,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,oBAAoB,GACpB,UAAU,GACV,uBAAuB,GACvB,yBAAyB,GACzB,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,gBAAgB,GACxB,MAAM,GACN,WAAW,GACX,QAAQ,GACR,eAAe,GACf,eAAe,GACf,eAAe,CAAC;AAEpB,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,eAAe,GACf,gBAAgB,CAAC;AAErB,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,gBAAgB,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mBAAmB,EAAE,gBAAgB,EAAE,CAAC;IACxC,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,aAAa,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,WAAW,GAAG,UAAU,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB"}