ysagc-agent 0.2.0 → 0.4.0

package/dist/security.js

@@ -0,0 +1,228 @@
+"use strict";
+/**
+ * Security helpers: dangerous-command detection, sensitive-path detection and
+ * secret masking. These are intentionally conservative — when in doubt the
+ * path/command is treated as unsafe.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MASK = void 0;
+exports.isDangerCommand = isDangerCommand;
+exports.isSensitivePath = isSensitivePath;
+exports.maskSecrets = maskSecrets;
+/**
+ * Rules that flag destructive / privilege-escalating commands. Matching is
+ * case-insensitive and uses word boundaries so ordinary words ("removal",
+ * "formatting") do not trigger a false positive. Rules are cross-platform:
+ * bash, powershell and cmd are all covered.
+ */
+const DANGER_RULES = [
+    // rm -rf / rm -fr / rm -fir etc. (any order of r/f flags)
+    {
+        severity: 'critical',
+        reason: 'recursive/force delete (rm -rf, rm -fr)',
+        re: /\brm\b[^\n]*\s+-[a-z]*r[a-z]*f[a-z]*\b|\brm\b[^\n]*\s+-[a-z]*f[a-z]*r[a-z]*\b/i,
+    },
+    // rm -r on the filesystem root or a system-ish path
+    {
+        severity: 'critical',
+        reason: 'recursive delete targeting a system path (/ , ~, /var, /etc, /dev, /usr, /tmp)',
+        re: /\brm\b[^\n]*\s+-[a-z]*r[a-z]*\s+(?:\\|~\/|\$HOME|\/tmp|\/var|\/etc|\/dev|\/usr|\/boot|\/home)\b/i,
+    },
+    {
+        severity: 'critical',
+        reason: 'privilege escalation (sudo)',
+        re: /\bsudo\b/i,
+    },
+    {
+        severity: 'critical',
+        reason: 'disk format',
+        re: /\bformat\b/i,
+    },
+    // Windows: del /f /q /s (force/quiet/subdirs)
+    {
+        severity: 'critical',
+        reason: 'forced recursive delete (del /f, del /s, del /q)',
+        re: /\bdel\b[^\n]*\s+\/[a-z]*[fsq][a-z]*\b/i,
+    },
+    {
+        severity: 'critical',
+        reason: 'system shutdown',
+        re: /\bshutdown\b/i,
+    },
+    {
+        severity: 'critical',
+        reason: 'system reboot',
+        re: /\breboot\b/i,
+    },
+    {
+        severity: 'danger',
+        reason: 'git hard reset (git reset --hard)',
+        re: /\bgit\b[^\n]*\breset\b[^\n]*--hard\b/i,
+    },
+    {
+        severity: 'danger',
+        reason: 'git clean (git clean -fdx)',
+        re: /\bgit\b[^\n]*\bclean\b[^\n]*-(?:fd?x?|xfd?|dxf|fx)\b/i,
+    },
+    {
+        severity: 'danger',
+        reason: 'find ... -delete',
+        re: /\bfind\b[^\n]*\s-delete\b/i,
+    },
+    {
+        severity: 'critical',
+        reason: 'Remove-Item -Recurse -Force',
+        re: /\bRemove-Item\b[^\n]*-Recurse\b[^\n]*-Force\b/i,
+    },
+    {
+        severity: 'critical',
+        reason: 'move /y to a drive root',
+        re: /\bmove\b[^\n]*\/y\b[^\n]*[a-z]:\\/i,
+    },
+    {
+        severity: 'critical',
+        reason: 'diskpart',
+        re: /\bdiskpart\b/i,
+    },
+    {
+        severity: 'critical',
+        reason: 'registry delete',
+        re: /\breg\b[^\n]*\bdelete\b/i,
+    },
+    {
+        severity: 'danger',
+        reason: 'chmod -R 777 /',
+        re: /\bchmod\b[^\n]*\s+-R\b[^\n]*777\b[^\n]*(?:\\|~|\$HOME|\/etc|\/var|\/dev|\/usr|\/home)\b/i,
+    },
+    {
+        severity: 'danger',
+        reason: 'mkfs (filesystem creation)',
+        re: /\bmkfs\b/i,
+    },
+    {
+        severity: 'critical',
+        reason: 'dd writing to a block device',
+        re: /\bdd\b[^\n]*\bof=\/dev\/\S+/i,
+    },
+    {
+        severity: 'critical',
+        reason: 'redirection to a block device',
+        re: />>?\s*\/dev\/(?:sda|sdb|sd\w|nvme\w*|mmcblk\w*|disk\w*)\b/i,
+    },
+    {
+        severity: 'danger',
+        reason: 'force-kill all processes',
+        re: /\b(?:killall|pkill)\b[^\n]*\s+-9\b|\bkill\b[^\n]*\s+-9\b[^\n]*-?\d+\b/i,
+    },
+    {
+        severity: 'danger',
+        reason: 'fork bomb',
+        re: /:\(\)\s*\{\s*:\|:&\s*\};:/i,
+    },
+    // Truncating the filesystem root or a system file.
+    {
+        severity: 'critical',
+        reason: 'truncate a system path',
+        re: />>?\s*(?:\/etc\/(?:passwd|shadow|hosts)|\/var\/log\b|\/dev\/null\b)/i,
+    },
+];
+/**
+ * Assess whether a shell command is too dangerous to run automatically.
+ * Cross-platform (bash / powershell / cmd). Returns a severity and reason.
+ */
+function isDangerCommand(command) {
+    if (typeof command !== 'string' || command.trim() === '') {
+        return { danger: false, severity: 'none', reason: 'empty command' };
+    }
+    const trimmedTrimmed = command.trim();
+    for (const rule of DANGER_RULES) {
+        if (rule.re.test(trimmedTrimmed)) {
+            return {
+                danger: rule.severity === 'critical' || rule.severity === 'danger',
+                severity: rule.severity,
+                reason: rule.reason,
+            };
+        }
+    }
+    return { danger: false, severity: 'none', reason: 'allowed' };
+}
+/**
+ * High-value / credential paths that are blocked regardless of authorisation
+ * mode. Matched against the lower-cased, slash-normalised path so both POSIX
+ * and Windows spellings are covered.
+ */
+const SENSITIVE_PATTERN = [
+    // System config / credential stores
+    /(^|\/)(etc\/passwd|etc\/shadow|etc\/sudoers|etc\/hosts|etc\/group|etc\/fstab)$/,
+    /(^|\/)(etc\/ssh|etc\/ssl\/private|etc\/ssl\/certs|etc\/pkcs11)/,
+    /(^|\/)(dev\/(sda|sdb|sd[a-z]|nvme[0-9n]+|mmcblk[0-9]+|disk[a-z0-9]+|mem|kmem|initctl|loop[0-9]+|tty))$/,
+    /(^|\/)(proc|sys|boot|run|sbin|bin|usr\/lib|usr\/share|lib|lib64|var\/log|var\/lib|var\/run)\b/,
+    /(^|\/)(system\/library|library\/keychains|library\/preferences|applications)\b/,
+    // Windows system directories
+    /^([a-z]:)?\/(windows|winnt|program files|programdata|users\/(?:default|public)\/appdata)/,
+    /\/windows\/(system32|syswow64|system|security|systemroot|boot)\b/,
+    // Private keys and credential files
+    /(^|\/)(id_rsa|id_dsa|id_ecdsa|id_ed25519)(\.pub)?$/,
+    /(^|\/)\.(ssh|gnupg|aws|azure|kube|docker-npm|config)\b/,
+    /(^|\/)\.env(\.|$)/i,
+    /(^|\/)\.npmrc$/,
+    /(^|\/)(\.netrc|\.pgpass|\.htpasswd|\.htaccess|\.git-credentials|\.boto|\.s3cfg)$/,
+    /(^|\/)(credentials|credentials\.json|secrets?\.json|service-account[^/]*\.json|google-credentials[^/]*\.json|application_default_credentials[^/]*\.json)$/,
+    /(^|\/)(keystore|\.keystore|\.jks|\.p12|\.pfx|\.pem|\.key|cert\.pem|server\.pem)$/,
+    /(^|\/)(\.npmrc|\.yarnrc|\.pypirc|\.gemrc|\.dockerconfigjson)$/,
+    // Files that typically bundle tokens/config keys
+    /(^|\/)(config\.json|settings\.json|secrets\.yml|secrets\.yaml|\.env\.(local|prod|production|dev|development|test))$/,
+];
+/**
+ * Whether a (canonical absolute) path should never be read/written by a tool.
+ * These are blocked no matter what permission mode is in effect.
+ */
+function isSensitivePath(p) {
+    if (typeof p !== 'string' || p === '')
+        return false;
+    const norm = p.replace(/\\/g, '/').toLowerCase();
+    for (const re of SENSITIVE_PATTERN) {
+        if (re.test(norm))
+            return true;
+    }
+    return false;
+}
+/** Emitted value when any secret has been redacted. */
+exports.MASK = '***';
+/**
+ * Redact secrets from a string: provider keys, bearer tokens, JWTs, private
+ * keys, and `key=value` / `key: value` pairs for obvious secret names. Used
+ * before logging or returning tool output so internal keys never leak.
+ */
+function maskSecrets(text) {
+    if (typeof text !== 'string' || text === '')
+        return text;
+    let out = text;
+    // Named secret pairs: password=..., token=..., api_key=..., authorization: ...
+    out = out.replace(/(password|passwd|secret|token|api[_-]?key|access[_-]?key|auth(?:orization)?|session|refresh[_-]?token|private[_-]?key|cookie|client[_-]?secret)\s*(?:[:=]\s*|["']?\s+)(["']?)([^\s,;'"&]+)\2/gi, (_m, _key, _q, value) => {
+        // Never redact a placeholder already present.
+        if (value === exports.MASK)
+            return _m;
+        return `${_q}${exports.MASK}${_q}`;
+    });
+    // Bearer / Basic auth headers.
+    out = out.replace(/\b(Bearer|Basic)\s+[A-Za-z0-9+/=_-]{8,}/gi, `$1 ${exports.MASK}`);
+    // OpenAI / Anthropic style sk- keys.
+    out = out.replace(/\bsk-[A-Za-z0-9_-]{16,}\b/g, `sk-${exports.MASK}`);
+    // Stripe live/test keys.
+    out = out.replace(/\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/g, `sk_${exports.MASK}`);
+    // GitHub tokens.
+    out = out.replace(/\bgh[pousr]_[A-Za-z0-9]{16,}\b/g, `gh${exports.MASK}`.replace('***', exports.MASK));
+    // Slack tokens.
+    out = out.replace(/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, `xox${exports.MASK}`.replace('***', exports.MASK));
+    // Google API keys.
+    out = out.replace(/\bAIza[0-9A-Za-z_-]{30,}\b/g, `AIza${exports.MASK}`);
+    // AWS access key ID.
+    out = out.replace(/\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, `$1${exports.MASK}`);
+    // JWT.
+    out = out.replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, `eyJ${exports.MASK}`);
+    // PEM / OpenSSH private-key blocks.
+    out = out.replace(/-----BEGIN ([A-Z ]*)?PRIVATE KEY-----[\s\S]*?-----END ([A-Z ]*)?PRIVATE KEY-----/g, '-----BEGIN PRIVATE KEY-----\n' + exports.MASK + '\n-----END PRIVATE KEY-----');
+    return out;
+}
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AA4IH,0CAeC;AAkCD,0CAOC;AAUD,kCAwCC;AApOD;;;;;GAKG;AACH,MAAM,YAAY,GAAiB;IACjC,0DAA0D;IAC1D;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,yCAAyC;QACjD,EAAE,EAAE,gFAAgF;KACrF;IACD,oDAAoD;IACpD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,gFAAgF;QACxF,EAAE,EAAE,kGAAkG;KACvG;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,6BAA6B;QACrC,EAAE,EAAE,WAAW;KAChB;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,aAAa;QACrB,EAAE,EAAE,aAAa;KAClB;IACD,8CAA8C;IAC9C;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,kDAAkD;QAC1D,EAAE,EAAE,wCAAwC;KAC7C;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,iBAAiB;QACzB,EAAE,EAAE,eAAe;KACpB;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,eAAe;QACvB,EAAE,EAAE,aAAa;KAClB;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,mCAAmC;QAC3C,EAAE,EAAE,uCAAuC;KAC5C;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,4BAA4B;QACpC,EAAE,EAAE,uDAAuD;KAC5D;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,kBAAkB;QAC1B,EAAE,EAAE,4BAA4B;KACjC;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,6BAA6B;QACrC,EAAE,EAAE,gDAAgD;KACrD;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,yBAAyB;QACjC,EAAE,EAAE,oCAAoC;KACzC;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,UAAU;QAClB,EAAE,EAAE,eAAe;KACpB;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,iBAAiB;QACzB,EAAE,EAAE,0BAA0B;KAC/B;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;QACxB,EAAE,EAAE,0FAA0F;KAC/F;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,4BAA4B;QACpC,EAAE,EAAE,WAAW;KAChB;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,8BAA8B;QACtC,EAAE,EAAE,8BAA8B;KACnC;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,+BAA+B;QACvC,EAAE,EAAE,4DAA4D;KACjE;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,0BAA0B;QAClC,EAAE,EAAE,wEAAwE;KAC7E;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW;QACnB,EAAE,EAAE,4BAA4B;KACjC;IACD,mDAAmD;IACnD;QACE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,wBAAwB;QAChC,EAAE,EAAE,sEAAsE;KAC3E;CACF,CAAC;AAEF;;;GAGG;AACH,SAAgB,eAAe,CAAC,OAAe;IAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAClE,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,iBAAiB,GAAa;IAClC,oCAAoC;IACpC,gFAAgF;IAChF,gEAAgE;IAChE,wGAAwG;IACxG,+FAA+F;IAC/F,gFAAgF;IAChF,6BAA6B;IAC7B,0FAA0F;IAC1F,kEAAkE;IAClE,oCAAoC;IACpC,oDAAoD;IACpD,wDAAwD;IACxD,oBAAoB;IACpB,gBAAgB;IAChB,kFAAkF;IAClF,2JAA2J;IAC3J,kFAAkF;IAClF,+DAA+D;IAC/D,iDAAiD;IACjD,qHAAqH;CACtH,CAAC;AAEF;;;GAGG;AACH,SAAgB,eAAe,CAAC,CAAS;IACvC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uDAAuD;AAC1C,QAAA,IAAI,GAAG,KAAK,CAAC;AAE1B;;;;GAIG;AACH,SAAgB,WAAW,CAAC,IAAY;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzD,IAAI,GAAG,GAAG,IAAI,CAAC;IAEf,+EAA+E;IAC/E,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,gMAAgM,EAChM,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;QACtB,8CAA8C;QAC9C,IAAI,KAAK,KAAK,YAAI;YAAE,OAAO,EAAE,CAAC;QAC9B,OAAO,GAAG,EAAE,GAAG,YAAI,GAAG,EAAE,EAAE,CAAC;IAC7B,CAAC,CACF,CAAC;IAEF,+BAA+B;IAC/B,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,2CAA2C,EAAE,MAAM,YAAI,EAAE,CAAC,CAAC;IAE7E,qCAAqC;IACrC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,MAAM,YAAI,EAAE,CAAC,CAAC;IAC9D,yBAAyB;IACzB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,wCAAwC,EAAE,MAAM,YAAI,EAAE,CAAC,CAAC;IAC1E,iBAAiB;IACjB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iCAAiC,EAAE,KAAK,YAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,YAAI,CAAC,CAAC,CAAC;IACvF,gBAAgB;IAChB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mCAAmC,EAAE,MAAM,YAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,YAAI,CAAC,CAAC,CAAC;IAC1F,mBAAmB;IACnB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,6BAA6B,EAAE,OAAO,YAAI,EAAE,CAAC,CAAC;IAChE,qBAAqB;IACrB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,8BAA8B,EAAG,KAAK,YAAI,EAAa,CAAC,CAAC;IAC3E,OAAO;IACP,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,oEAAoE,EAAE,MAAM,YAAI,EAAE,CAAC,CAAC;IAEtG,oCAAoC;IACpC,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,mFAAmF,EACnF,+BAA+B,GAAG,YAAI,GAAG,6BAA6B,CACvE,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/tools.d.ts

@@ -0,0 +1,36 @@
+import type { PermissionMode } from './config';
+import type { Logger } from './logger';
+/** Thrown when a tool invocation is invalid or unsafe. */
+export declare class ToolError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export interface ToolContext {
+    /** Canonical authorised root; all file operations stay inside it. */
+    root: string;
+    mode: PermissionMode;
+    webEnabled: boolean;
+    timeoutMs: number;
+    maxBytes: number;
+    logger: Logger;
+}
+export interface ToolOutcome {
+    ok: boolean;
+    result?: unknown;
+    error?: string;
+}
+export interface ToolResult extends ToolOutcome {
+    durationMs: number;
+    /** Set when the result came from the idempotency cache. */
+    cached?: boolean;
+}
+export type ToolExecutor = (ctx: ToolContext, args: Record<string, unknown>, signal?: AbortSignal) => Promise<ToolOutcome>;
+export interface ToolRegistry {
+    readonly ctx: ToolContext;
+    readonly tools: readonly string[];
+    has(name: string): boolean;
+    dispatch(name: string, args: Record<string, unknown>, signal?: AbortSignal): Promise<ToolResult>;
+}
+/** Build a tool registry bound to a single execution context. */
+export declare function createToolRegistry(ctx: ToolContext): ToolRegistry;
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC,0DAA0D;AAC1D,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,WAAW,CAAC,CAAC;AA8b1B,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAClG;AAED,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,YAAY,CA6BjE"}