wotann 0.5.0

package/dist/security/command-sanitizer.js

@@ -0,0 +1,442 @@
+/**
+ * Command Sanitizer — validate shell commands from iOS/desktop frontends
+ * BEFORE executing them against the host system.
+ *
+ * This is layer 1 of defence-in-depth for shell execution:
+ *   - Blocks catastrophic patterns outright (rm -rf /, dd if=/dev/zero, forkbomb)
+ *   - Blocks pipe-to-shell payloads (curl | sh, wget | bash)
+ *   - Blocks writes to system-sensitive files (/etc/passwd, /etc/shadow)
+ *   - Blocks shell substitution (backtick, $(), process substitution)
+ *   - Blocks heredoc delivery of hidden payloads
+ *   - Blocks hex-escaped identifiers (e.g. \x72\x6d → "rm")
+ *   - Requires allowlist approval for privileged commands (sudo, chmod 777, ...)
+ *
+ * The sanitizer returns a typed verdict { safe, reason, severity } so callers
+ * can decide whether to execute, prompt the user, or reject.
+ *
+ * Layer 2 (audit log) and Layer 3 (sandbox/containment) live elsewhere.
+ *
+ * ── P0-9 parse-based upgrade (2026-04-20) ───────────────────
+ * Prior revision matched forbidden patterns against the raw input string.
+ * That allowed 7 empirically-confirmed bypasses where an adversarial
+ * caller split tokens, encoded bytes, or wrapped the payload in shell
+ * substitution so no substring regex matched. See
+ * tests/security/command-sanitizer.test.ts for the full bypass corpus.
+ *
+ * This revision parses the input via `shell-quote` and inspects the
+ * resulting token stream. Substitution operators (`<(`, `(`, `)`,
+ * `` ` ``), heredoc operators (`<<`), and hex escapes are REJECTED
+ * regardless of whether the post-parse tokens match a forbidden literal.
+ * Substring matching against the raw input is kept as a secondary layer
+ * — it catches additional shapes that the parser collapses (e.g. quoted
+ * fork bombs) without weakening any prior assertion.
+ */
+import { parse as parseShell } from "shell-quote";
+import { canonicalizePathForCheck } from "../utils/path-realpath.js";
+/**
+ * Catastrophic patterns — always block, no override. These represent commands
+ * that have no legitimate use from an AI agent frontend (rm -rf /, dd of raw
+ * device, fork bomb, pipe-to-shell from network sources).
+ */
+const BLOCKED_PATTERNS = [
+    // rm -rf on root or system paths
+    {
+        pattern: /\brm\s+(?:-[rRf]+|--recursive|--force)[^\n]*?\s\/(?:\s|$)/,
+        reason: "rm -rf on filesystem root",
+    },
+    {
+        pattern: /\brm\s+(?:-[rRf]+|--recursive|--force)[^\n]*?\s\/(?:etc|bin|boot|sbin|usr|var|sys|root|proc)\b/,
+        reason: "rm -rf on critical system path",
+    },
+    { pattern: /\brm\s+(?:-[rRf]+|--recursive|--force)\s+~\s*$/, reason: "rm -rf on home directory" },
+    { pattern: /\brm\s+(?:-[rRf]+|--recursive|--force)[^\n]*?\s\$HOME\b/, reason: "rm -rf on $HOME" },
+    {
+        pattern: /\brm\s+(?:-[rRf]+|--recursive|--force)[^\n]*?\s\*\s*$/,
+        reason: "rm -rf with bare glob",
+    },
+    // dd to raw devices / zero-write
+    {
+        pattern: /\bdd\s+[^\n]*?if=\/dev\/(?:zero|random|urandom)\b[^\n]*?of=\/dev\//,
+        reason: "dd from /dev/zero|random to raw device",
+    },
+    {
+        pattern: /\bdd\s+[^\n]*?of=\/dev\/(?:sd[a-z]|hd[a-z]|nvme\d|disk\d)/,
+        reason: "dd writing to raw block device",
+    },
+    // Fork bombs (bash :(){:|:&};: and common variants)
+    { pattern: /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/, reason: "bash fork bomb" },
+    { pattern: /\bbomb\s*\(\s*\)\s*\{[^}]*\}\s*;\s*bomb\b/, reason: "fork bomb variant" },
+    // Pipe-to-shell payloads (curl|sh, wget|bash, fetch|sh)
+    {
+        pattern: /\b(?:curl|wget|fetch)\s+[^\n|]*\|\s*(?:sh|bash|zsh|ksh|dash|fish|sudo\s+(?:sh|bash))\b/,
+        reason: "pipe-to-shell from network",
+    },
+    {
+        pattern: /\b(?:curl|wget)\s+[^\n|]*\|\s*sudo\s+-?\s*\w*\s*(?:sh|bash|zsh|ksh|dash|fish)\b/,
+        reason: "pipe-to-sudo-shell from network",
+    },
+    // Writes to system-sensitive files via redirection
+    { pattern: />>?\s*\/etc\/passwd\b/, reason: "write to /etc/passwd" },
+    { pattern: />>?\s*\/etc\/shadow\b/, reason: "write to /etc/shadow" },
+    { pattern: />>?\s*\/etc\/sudoers(?:\.d\/|\b)/, reason: "write to /etc/sudoers" },
+    { pattern: />>?\s*\/etc\/hosts\b/, reason: "write to /etc/hosts" },
+    // Obvious exfiltration patterns (cat /etc/shadow | nc)
+    {
+        pattern: /\bcat\s+\/etc\/(?:shadow|passwd)\b[^\n]*\|\s*(?:nc|netcat|curl|wget)\b/,
+        reason: "exfiltration of password file",
+    },
+    // Reverse shells (common netcat variants)
+    {
+        pattern: /\b(?:nc|netcat|ncat)\s+[^\n]*-[^\n]*e\s+\/bin\/(?:sh|bash)\b/,
+        reason: "reverse shell via netcat",
+    },
+    { pattern: /\bbash\s+-i\s+>&?\s*\/dev\/tcp\//, reason: "bash reverse shell" },
+    // Recursive chmod on sensitive paths
+    {
+        pattern: /\bchmod\s+-R\s+[0-9]{3,4}\s+\/(?:\s|etc|bin|sbin|usr|var|boot|sys|root)\b/,
+        reason: "recursive chmod on system path",
+    },
+    // Mass process kill
+    { pattern: /\bkill\s+-9?\s+-1\b/, reason: "kill -1 (all processes)" },
+    { pattern: /\bkillall\s+-9?\s*-u\s+root\b/, reason: "killall -u root" },
+];
+const PRIVILEGED_PATTERNS = [
+    { pattern: /\bsudo\b/, reason: "sudo requires allowlist approval" },
+    { pattern: /\bchmod\s+0?777\b/, reason: "chmod 777 requires allowlist approval" },
+    { pattern: /\bchown\b/, reason: "chown requires allowlist approval" },
+    { pattern: /\bmkfs(?:\.|\s)/, reason: "mkfs requires allowlist approval" },
+    { pattern: /\bformat\s+[A-Z]:/i, reason: "format (Windows) requires allowlist approval" },
+    {
+        pattern: /\bdiskutil\s+(?:erase|unmountDisk|eraseDisk)\b/,
+        reason: "diskutil erase requires allowlist approval",
+    },
+    {
+        pattern: /\bhdiutil\s+eraseVolume\b/,
+        reason: "hdiutil eraseVolume requires allowlist approval",
+    },
+];
+const WARN_PATTERNS = [
+    { pattern: /\brm\s+(?:-[rRf]+|--recursive|--force)\b/, reason: "recursive/forced delete" },
+    {
+        pattern: /\bgit\s+(?:reset\s+--hard|clean\s+-[fd]+|push\s+-f\b|push\s+--force)/,
+        reason: "destructive git operation",
+    },
+    { pattern: /\bDROP\s+(?:TABLE|DATABASE|SCHEMA)\b/i, reason: "destructive SQL DDL" },
+    { pattern: /\bTRUNCATE\s+TABLE\b/i, reason: "SQL TRUNCATE" },
+    {
+        pattern: /\bexport\s+(?:PATH|LD_LIBRARY_PATH|DYLD_[A-Z_]+)=/,
+        reason: "modifying library search path",
+    },
+];
+// ── Forbidden command names (token-level, post-parse) ────────
+//
+// Commands whose mere presence as a parsed token is grounds for
+// rejection. Unlike BLOCKED_PATTERNS these do not care about arg shape —
+// if the frontend submits one of these, it has no business running.
+// Keep this list conservative: only tokens that are destructive in
+// virtually every invocation belong here.
+const FORBIDDEN_TOKENS = new Set([
+// Shell interpreters invoked as pipe sinks (curl | bash, echo | bash) —
+// any command whose shape ends in one of these behind a pipe is a
+// pipe-to-shell payload. See substitution check below.
+]);
+// Shell interpreters that, when used as the tail of a pipe, indicate a
+// pipe-to-shell payload. Listed separately from FORBIDDEN_TOKENS because
+// they are legitimate at the head of a script (`bash build.sh`), only
+// dangerous at the tail.
+const PIPE_SHELL_SINKS = new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "ksh",
+    "dash",
+    "fish",
+    "csh",
+    "tcsh",
+]);
+/**
+ * Pre-parse string-level checks — look for shapes that shell-quote
+ * collapses before we can inspect them. Each returns a reject reason if
+ * triggered.
+ *
+ * Ordering: string-level checks run first so shell-quote is not given
+ * adversarial input. If the string contains a hex escape, a backtick,
+ * or an embedded empty-string literal inside a command name, we reject
+ * without even calling parseShell.
+ */
+/**
+ * Round 24 — detect `powershell.exe -Command "..."` / `pwsh -c "..."`
+ * wrappers and return the inner command string so the sanitizer can
+ * recursively check it. Returns null when the input isn't a recognized
+ * PS wrapper. The match is intentionally conservative — only handles
+ * the two canonical shapes (long form `-Command` and short form `-c`)
+ * with a quoted body. EncodedCommand (-EncodedCommand <base64>) is
+ * NOT unwrapped here; the caller falls through to existing prescan
+ * rules instead, because base64-encoded PowerShell is itself a strong
+ * attack signal.
+ *
+ * Returns the inner command verbatim — the caller re-runs the full
+ * sanitize pipeline on it.
+ */
+function unwrapPowerShellWrapper(raw) {
+    const psBinaryRe = /^(?:[A-Za-z]:[\\/])?(?:[^\s\\/]+[\\/])*?(?:powershell|pwsh)(?:\.exe)?(?=\s|$)/i;
+    if (!psBinaryRe.test(raw))
+        return null;
+    if (/\s-(?:EncodedCommand|enc|e)\b/i.test(raw))
+        return null;
+    const cmdRe = /\s-(?:Command|c)\s+(?:"([^"]*)"|'([^']*)'|([^\s].*))$/i;
+    const m = cmdRe.exec(raw);
+    if (!m)
+        return null;
+    const inner = (m[1] ?? m[2] ?? m[3] ?? "").trim();
+    if (inner.length === 0)
+        return null;
+    return inner;
+}
+function prescanForShellArtifacts(raw) {
+    // (5) hex-escaped bytes — `\xHH` anywhere in the command
+    if (/\\x[0-9a-fA-F]{2}/.test(raw)) {
+        return { reason: "hex-escape sequence (\\xHH) not permitted" };
+    }
+    // (6) backtick substitution — any unescaped backtick
+    // shell-quote silently treats backticks as literal word characters,
+    // so we must detect them pre-parse. A single backtick in the input
+    // is always grounds for rejection from an AI-frontend.
+    if (/[`]/.test(raw)) {
+        return { reason: "backtick substitution not permitted" };
+    }
+    // (1) empty-string literal embedded in a command name, e.g. `r""m` or
+    // `r''m`. Shell collapses the quotes, so the resulting token is "rm"
+    // and substring matching never sees it. We detect the pre-collapse
+    // shape: a word character immediately adjacent to a `""` or `''`.
+    if (/\w(?:""|'')/.test(raw) || /(?:""|'')\w/.test(raw)) {
+        return { reason: "empty-string literal embedded in identifier" };
+    }
+    // (4) heredoc operator `<<` — the string `<<` appearing outside a
+    // quoted context. shell-quote splits it into two `<` ops which we
+    // detect post-parse too, but catching pre-parse gives a clearer
+    // reason string and is a defence-in-depth layer.
+    //
+    // We only flag standalone `<<` (preceded/followed by whitespace or
+    // word boundary) so we don't false-positive on SQL-like `<<=`
+    // operators that are unlikely in a shell but cheap to allow.
+    if (/(?:^|\s)<<(?:\s|\w)/.test(raw)) {
+        return { reason: "heredoc (<<) not permitted" };
+    }
+    return null;
+}
+function isOp(token) {
+    return typeof token === "object" && token !== null && "op" in token;
+}
+function inspectTokens(tokens) {
+    // (2, 6, 7) substitution ops: `<(`, `>(`, `(`, `)` — shell-quote
+    // emits these verbatim for process substitution and `$(...)`.
+    // Any such op is grounds for rejection.
+    const SUBSTITUTION_OPS = new Set(["<(", ">(", "(", ")"]);
+    for (const t of tokens) {
+        if (isOp(t) && SUBSTITUTION_OPS.has(t.op)) {
+            return { reason: `shell substitution (${t.op}) not permitted` };
+        }
+    }
+    // (4) heredoc — two consecutive `<` ops indicate a heredoc. Catch
+    // this post-parse in case the pre-scan missed a variant form.
+    for (let i = 0; i < tokens.length - 1; i++) {
+        const a = tokens[i];
+        const b = tokens[i + 1];
+        if (a === undefined || b === undefined)
+            continue;
+        if (isOp(a) && a.op === "<" && isOp(b) && b.op === "<") {
+            return { reason: "heredoc (<<) not permitted" };
+        }
+    }
+    // (3) pipe-to-shell: any `|` op whose following command token is a
+    // shell interpreter. This catches `echo ... | bash`, `base64 -d |
+    // bash`, and any other decode-then-exec shape, regardless of whether
+    // the payload itself matches a substring.
+    for (let i = 0; i < tokens.length - 1; i++) {
+        const a = tokens[i];
+        if (a === undefined)
+            continue;
+        if (!isOp(a) || a.op !== "|")
+            continue;
+        const next = tokens[i + 1];
+        if (typeof next === "string" && PIPE_SHELL_SINKS.has(next)) {
+            return { reason: `pipe to shell interpreter (| ${next}) not permitted` };
+        }
+    }
+    // Forbidden token names — first-position token whose bare name is on
+    // the forbidden list. Kept separate from pattern matching so callers
+    // can extend it without writing a regex.
+    const first = tokens[0];
+    if (typeof first === "string" && FORBIDDEN_TOKENS.has(first)) {
+        return { reason: `forbidden command: ${first}` };
+    }
+    // CVE-2026-25724 defence: a redirection target like `>some_path` is
+    // tokenised as `[{op:">"}, "some_path"]`. The legacy regex layer only
+    // matches literal `/etc/passwd`, etc. — a symlink at `some_path`
+    // pointing to `/etc/passwd` evades it. We canonicalize each
+    // redirection target through realpath and reject if the resolved
+    // form lives in a system-sensitive location.
+    for (let i = 0; i < tokens.length - 1; i++) {
+        const op = tokens[i];
+        if (op === undefined || !isOp(op))
+            continue;
+        if (op.op !== ">" && op.op !== ">>")
+            continue;
+        const target = tokens[i + 1];
+        if (typeof target !== "string")
+            continue;
+        let canonical = target;
+        try {
+            canonical = canonicalizePathForCheck(target);
+        }
+        catch {
+            // Honest-fallback (QB#6): if canonicalization throws, be
+            // suspicious — a target we can't resolve safely is one we
+            // shouldn't write to. Reject.
+            return { reason: `redirect target unresolvable: ${target}` };
+        }
+        if (REDIRECT_DENY_REGEX.test(canonical)) {
+            return {
+                reason: `redirect to system-sensitive path: ${target} -> ${canonical}`,
+            };
+        }
+    }
+    return null;
+}
+// Sensitive paths that no shell-redirection should ever target. Match
+// against the CANONICAL (realpath-resolved) form so a symlink at the
+// raw target cannot evade the check. Also matches common admin paths
+// outside the legacy /etc/{passwd,shadow,sudoers,hosts} list — defence
+// in depth.
+const REDIRECT_DENY_REGEX = /^\/(?:etc\/(?:passwd|shadow|sudoers(?:\.d\/.*)?|hosts|crontab|cron\.[a-z]+\/.*|ssh\/.*|pam\.d\/.*)|root\/.*|boot\/.*|proc\/.*|sys\/.*|dev\/(?:mem|kmem|sd[a-z]|hd[a-z]|nvme\d|disk\d).*)$/;
+// ── Public API ─────────────────────────────────────────────
+/**
+ * Validate a shell command against the sanitizer's rule set.
+ * Returns a verdict describing whether the command is safe to run.
+ *
+ * The input is first pre-scanned for shell artifacts that `shell-quote`
+ * would collapse (hex escapes, backticks, embedded empty-string
+ * literals), then tokenized via `shell-quote` so we can inspect the
+ * structured token stream for substitution, heredoc, and pipe-to-shell
+ * shapes. Finally, a legacy regex layer catches substring-only shapes
+ * (fork bombs, quoted reverse shells) that the parser collapses.
+ *
+ * Callers should still use a sandbox (containerization, mac-seatbelt,
+ * or dedicated user) as a second layer.
+ */
+export function sanitizeCommand(cmd, options = {}) {
+    if (typeof cmd !== "string") {
+        return { safe: false, severity: "danger", reason: "command must be a string" };
+    }
+    const trimmed = cmd.trim();
+    if (trimmed.length === 0) {
+        return { safe: false, severity: "danger", reason: "empty command" };
+    }
+    // Reject commands that are too long (typical shell line is <4KB; >64KB indicates abuse)
+    if (trimmed.length > 65536) {
+        return { safe: false, severity: "danger", reason: "command exceeds 64KB" };
+    }
+    // Round 24 — PowerShell wrapper unwrap. When commands arrive as
+    //   `powershell.exe -NoProfile -Command "git push origin main"`
+    // or
+    //   `pwsh -c "rm -rf /"`,
+    // the rest of the pipeline only inspects "powershell.exe" / "pwsh"
+    // and never opens the inner string. That makes denylist rules
+    // like `["git", "push"]` or "rm -rf" silently bypassable on
+    // Windows/cross-platform. Detect the wrapper and recursively
+    // sanitize the unwrapped body so the inner command runs through
+    // every check (prescan, tokenize, BLOCKED/PRIVILEGED/WARN).
+    // Inspired by codex commit 4f96001f.
+    const unwrapped = unwrapPowerShellWrapper(trimmed);
+    if (unwrapped !== null && unwrapped !== trimmed) {
+        const innerVerdict = sanitizeCommand(unwrapped, options);
+        if (!innerVerdict.safe) {
+            return {
+                safe: false,
+                severity: innerVerdict.severity,
+                reason: `powershell-wrapped: ${innerVerdict.reason}`,
+            };
+        }
+        // Inner command is safe — still surface a warn so callers know
+        // the outer wrapper was unwrapped (helps with audit trails).
+        return innerVerdict.severity === "safe"
+            ? {
+                safe: true,
+                severity: "warn",
+                reason: "powershell-wrapped command (unwrapped + verified)",
+            }
+            : innerVerdict;
+    }
+    // 1. Pre-scan for shell artifacts that shell-quote collapses.
+    //    Catches bypasses (1) empty-string, (5) hex-escape, (6) backtick,
+    //    and (4) heredoc before parsing.
+    const prescanReject = prescanForShellArtifacts(trimmed);
+    if (prescanReject) {
+        return { safe: false, severity: "danger", reason: prescanReject.reason };
+    }
+    // 2. Tokenize via shell-quote. If parsing itself throws, we reject —
+    //    an unparseable command is not safe to hand to `/bin/sh -c`.
+    let tokens;
+    try {
+        tokens = parseShell(trimmed);
+    }
+    catch (err) {
+        return {
+            safe: false,
+            severity: "danger",
+            reason: `unparseable command: ${err.message}`,
+        };
+    }
+    // 3. Inspect the token stream for substitution, heredoc, and
+    //    pipe-to-shell shapes. Catches bypasses (2), (3), (7).
+    const tokenReject = inspectTokens(tokens);
+    if (tokenReject) {
+        return { safe: false, severity: "danger", reason: tokenReject.reason };
+    }
+    // 4. Legacy substring patterns — still run. The parse pass catches
+    //    novel shapes; these catch the obvious ones (fork bombs, reverse
+    //    shells, /etc/passwd writes) whose substring signatures are
+    //    already well-characterised and whose regexes have been audited.
+    for (const { pattern, reason } of BLOCKED_PATTERNS) {
+        if (pattern.test(trimmed)) {
+            return { safe: false, severity: "danger", reason };
+        }
+    }
+    // 5. Privileged patterns — block unless caller opts in.
+    for (const { pattern, reason } of PRIVILEGED_PATTERNS) {
+        if (pattern.test(trimmed)) {
+            if (options.allowPrivileged) {
+                // Allowed but still flag it
+                return { safe: true, severity: "warn", reason: `allowlisted: ${reason}` };
+            }
+            return { safe: false, severity: "danger", reason };
+        }
+    }
+    // 6. Warning patterns — allow but mark as warn.
+    for (const { pattern, reason } of WARN_PATTERNS) {
+        if (pattern.test(trimmed)) {
+            return { safe: true, severity: "warn", reason };
+        }
+    }
+    return { safe: true, severity: "safe" };
+}
+/**
+ * Predicate convenience — returns true iff the command is safe to run at the
+ * requested privilege level.
+ */
+export function isCommandSafe(cmd, options = {}) {
+    return sanitizeCommand(cmd, options).safe;
+}
+/**
+ * Exposed for testing — gives callers access to all pattern lists so unit tests
+ * can assert coverage (e.g. "every pattern in BLOCKED_PATTERNS is matched").
+ */
+export const sanitizerRules = {
+    blocked: BLOCKED_PATTERNS,
+    privileged: PRIVILEGED_PATTERNS,
+    warn: WARN_PATTERNS,
+    forbiddenTokens: FORBIDDEN_TOKENS,
+    pipeShellSinks: PIPE_SHELL_SINKS,
+};
+//# sourceMappingURL=command-sanitizer.js.map

package/dist/security/command-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-sanitizer.js","sourceRoot":"","sources":["../../src/security/command-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AA6BrE;;;;GAIG;AACH,MAAM,gBAAgB,GAA8B;IAClD,iCAAiC;IACjC;QACE,OAAO,EAAE,2DAA2D;QACpE,MAAM,EAAE,2BAA2B;KACpC;IACD;QACE,OAAO,EACL,gGAAgG;QAClG,MAAM,EAAE,gCAAgC;KACzC;IACD,EAAE,OAAO,EAAE,gDAAgD,EAAE,MAAM,EAAE,0BAA0B,EAAE;IACjG,EAAE,OAAO,EAAE,yDAAyD,EAAE,MAAM,EAAE,iBAAiB,EAAE;IACjG;QACE,OAAO,EAAE,uDAAuD;QAChE,MAAM,EAAE,uBAAuB;KAChC;IAED,iCAAiC;IACjC;QACE,OAAO,EAAE,oEAAoE;QAC7E,MAAM,EAAE,wCAAwC;KACjD;IACD;QACE,OAAO,EAAE,2DAA2D;QACpE,MAAM,EAAE,gCAAgC;KACzC;IAED,oDAAoD;IACpD,EAAE,OAAO,EAAE,gDAAgD,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACvF,EAAE,OAAO,EAAE,2CAA2C,EAAE,MAAM,EAAE,mBAAmB,EAAE;IAErF,wDAAwD;IACxD;QACE,OAAO,EACL,wFAAwF;QAC1F,MAAM,EAAE,4BAA4B;KACrC;IACD;QACE,OAAO,EAAE,iFAAiF;QAC1F,MAAM,EAAE,iCAAiC;KAC1C;IAED,mDAAmD;IACnD,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACpE,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACpE,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,uBAAuB,EAAE;IAChF,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,qBAAqB,EAAE;IAElE,uDAAuD;IACvD;QACE,OAAO,EAAE,wEAAwE;QACjF,MAAM,EAAE,+BAA+B;KACxC;IAED,0CAA0C;IAC1C;QACE,OAAO,EAAE,8DAA8D;QACvE,MAAM,EAAE,0BAA0B;KACnC;IACD,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,oBAAoB,EAAE;IAE7E,qCAAqC;IACrC;QACE,OAAO,EAAE,2EAA2E;QACpF,MAAM,EAAE,gCAAgC;KACzC;IAED,oBAAoB;IACpB,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,yBAAyB,EAAE;IACrE,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,iBAAiB,EAAE;CACxE,CAAC;AASF,MAAM,mBAAmB,GAAiC;IACxD,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,kCAAkC,EAAE;IACnE,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,uCAAuC,EAAE;IACjF,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,mCAAmC,EAAE;IACrE,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,kCAAkC,EAAE;IAC1E,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,8CAA8C,EAAE;IACzF;QACE,OAAO,EAAE,gDAAgD;QACzD,MAAM,EAAE,4CAA4C;KACrD;IACD;QACE,OAAO,EAAE,2BAA2B;QACpC,MAAM,EAAE,iDAAiD;KAC1D;CACF,CAAC;AASF,MAAM,aAAa,GAA2B;IAC5C,EAAE,OAAO,EAAE,0CAA0C,EAAE,MAAM,EAAE,yBAAyB,EAAE;IAC1F;QACE,OAAO,EAAE,sEAAsE;QAC/E,MAAM,EAAE,2BAA2B;KACpC;IACD,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,qBAAqB,EAAE;IACnF,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,cAAc,EAAE;IAC5D;QACE,OAAO,EAAE,mDAAmD;QAC5D,MAAM,EAAE,+BAA+B;KACxC;CACF,CAAC;AAEF,gEAAgE;AAChE,EAAE;AACF,gEAAgE;AAChE,yEAAyE;AACzE,oEAAoE;AACpE,mEAAmE;AACnE,0CAA0C;AAC1C,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;AACpD,wEAAwE;AACxE,kEAAkE;AAClE,uDAAuD;CACxD,CAAC,CAAC;AAEH,uEAAuE;AACvE,yEAAyE;AACzE,sEAAsE;AACtE,yBAAyB;AACzB,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,IAAI;IACJ,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;CACP,CAAC,CAAC;AAQH;;;;;;;;;GASG;AACH;;;;;;;;;;;;;GAaG;AACH,SAAS,uBAAuB,CAAC,GAAW;IAC1C,MAAM,UAAU,GACd,gFAAgF,CAAC;IACnF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,KAAK,GAAG,wDAAwD,CAAC;IACvE,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAW;IAC3C,yDAAyD;IACzD,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IACjE,CAAC;IAED,qDAAqD;IACrD,oEAAoE;IACpE,mEAAmE;IACnE,uDAAuD;IACvD,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAC3D,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACnE,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,gEAAgE;IAChE,iDAAiD;IACjD,EAAE;IACF,mEAAmE;IACnE,8DAA8D;IAC9D,6DAA6D;IAC7D,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAkBD,SAAS,IAAI,CAAC,KAAiB;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,MAA6B;IAClD,iEAAiE;IACjE,8DAA8D;IAC9D,wCAAwC;IACxC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE9E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,8DAA8D;IAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QACjD,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;YACvD,OAAO,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,0CAA0C;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,MAAM,EAAE,gCAAgC,IAAI,iBAAiB,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,yCAAyC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,MAAM,EAAE,sBAAsB,KAAK,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,iEAAiE;IACjE,4DAA4D;IAC5D,iEAAiE;IACjE,6CAA6C;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QAC5C,IAAI,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,CAAC,EAAE,KAAK,IAAI;YAAE,SAAS;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACzC,IAAI,SAAS,GAAG,MAAM,CAAC;QACvB,IAAI,CAAC;YACH,SAAS,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,0DAA0D;YAC1D,8BAA8B;YAC9B,OAAO,EAAE,MAAM,EAAE,iCAAiC,MAAM,EAAE,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,MAAM,EAAE,sCAAsC,MAAM,OAAO,SAAS,EAAE;aACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,qEAAqE;AACrE,qEAAqE;AACrE,uEAAuE;AACvE,YAAY;AACZ,MAAM,mBAAmB,GACvB,2LAA2L,CAAC;AAE9L,8DAA8D;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,UAA4B,EAAE;IACzE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACtE,CAAC;IAED,wFAAwF;IACxF,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC7E,CAAC;IAED,gEAAgE;IAChE,gEAAgE;IAChE,KAAK;IACL,0BAA0B;IAC1B,mEAAmE;IACnE,8DAA8D;IAC9D,4DAA4D;IAC5D,6DAA6D;IAC7D,gEAAgE;IAChE,4DAA4D;IAC5D,qCAAqC;IACrC,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,MAAM,EAAE,uBAAuB,YAAY,CAAC,MAAM,EAAE;aACrD,CAAC;QACJ,CAAC;QACD,+DAA+D;QAC/D,6DAA6D;QAC7D,OAAO,YAAY,CAAC,QAAQ,KAAK,MAAM;YACrC,CAAC,CAAC;gBACE,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,mDAAmD;aAC5D;YACH,CAAC,CAAC,YAAY,CAAC;IACnB,CAAC;IAED,8DAA8D;IAC9D,sEAAsE;IACtE,qCAAqC;IACrC,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC;IAC3E,CAAC;IAED,qEAAqE;IACrE,iEAAiE;IACjE,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAA0B,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,wBAAyB,GAAa,CAAC,OAAO,EAAE;SACzD,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,2DAA2D;IAC3D,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;IACzE,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,gEAAgE;IAChE,qEAAqE;IACrE,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC5B,4BAA4B;gBAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,MAAM,EAAE,EAAE,CAAC;YAC5E,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAChD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,UAA4B,EAAE;IACvE,OAAO,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,OAAO,EAAE,gBAAgB;IACzB,UAAU,EAAE,mBAAmB;IAC/B,IAAI,EAAE,aAAa;IACnB,eAAe,EAAE,gBAAgB;IACjC,cAAc,EAAE,gBAAgB;CACxB,CAAC"}

package/dist/security/confirm-action.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Confirm-Action Architectural Safety -- tool-level mandatory approval system.
+ * Unlike prompt-level guardrails, this cannot be bypassed by prompt injection.
+ *
+ * Every tool invocation is classified into a category (destructive, external,
+ * financial, credential, safe). Non-safe actions require explicit approval
+ * before execution. Safe actions (read, search, list) are auto-approved.
+ *
+ * The approval gate sits at the tool execution layer, not the prompt layer.
+ * A model cannot skip this check regardless of what the user prompt says.
+ */
+export type ActionCategory = "destructive" | "external" | "financial" | "credential" | "safe";
+export type RiskLevel = "low" | "medium" | "high" | "critical";
+export interface ActionRequest {
+    readonly id: string;
+    readonly action: string;
+    readonly category: ActionCategory;
+    readonly description: string;
+    readonly risk: RiskLevel;
+    readonly requiresApproval: boolean;
+    readonly autoApproveReason?: string;
+}
+export interface ActionApproval {
+    readonly requestId: string;
+    readonly approved: boolean;
+    readonly approvedBy: string;
+    readonly approvedAt: number;
+    readonly reason?: string;
+}
+export declare class ConfirmActionGate {
+    private readonly pendingRequests;
+    private readonly approvalHistory;
+    private readonly preApprovedPatterns;
+    /**
+     * Classify an action and determine if it needs approval.
+     * This is the core gate -- every tool invocation should pass through.
+     */
+    classify(toolName: string, args: Record<string, unknown>): ActionRequest;
+    /**
+     * Check if an action is pre-approved via safe patterns or user config.
+     */
+    isPreApproved(request: ActionRequest): boolean;
+    /**
+     * Record an approval decision for a pending action.
+     */
+    recordApproval(approval: ActionApproval): void;
+    /**
+     * Get all pending (unapproved) action requests.
+     */
+    getPendingApprovals(): readonly ActionRequest[];
+    /**
+     * Get approval history, newest first.
+     */
+    getHistory(limit?: number): readonly ActionApproval[];
+    /**
+     * Add a pre-approval pattern. Actions matching this pattern are
+     * auto-approved without user confirmation.
+     */
+    addPreApprovalPattern(pattern: RegExp): void;
+    /**
+     * Get classification statistics.
+     */
+    getStats(): {
+        readonly pendingCount: number;
+        readonly approvedCount: number;
+        readonly deniedCount: number;
+        readonly totalClassified: number;
+    };
+}
+//# sourceMappingURL=confirm-action.d.ts.map

package/dist/security/confirm-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-action.d.ts","sourceRoot":"","sources":["../../src/security/confirm-action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,UAAU,GACV,WAAW,GACX,YAAY,GACZ,MAAM,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA4FD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyC;IACzE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAwB;IACxD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgB;IAEpD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa;IAkDxE;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO;IAY9C;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI;IAK9C;;OAEG;IACH,mBAAmB,IAAI,SAAS,aAAa,EAAE;IAI/C;;OAEG;IACH,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,cAAc,EAAE;IAOrD;;;OAGG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAI5C;;OAEG;IACH,QAAQ,IAAI;QACV,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC;CAWF"}