@agent-beam/beam 0.2.27 → 0.2.29

package/dist/monitor-pipeline.d.ts

@@ -0,0 +1,101 @@
+import type { MonitorFinding, MonitorLevel, MonitorSeverity } from "./monitor-client.js";
+import type { CustomDetector } from "./data-detectors.js";
+import { type LineSource, type MonitorRule } from "./monitor-rules.js";
+/** A short, stable fingerprint (two seeded 53-bit hashes); not cryptographic, only used for dedupe ids. */
+export declare function fingerprint(text: string): string;
+/** light: critical only · standard: high and up · strict: medium and up (same thresholds as the server). */
+export declare const meetsLevel: (severity: MonitorSeverity, level: MonitorLevel) => boolean;
+export declare const DEDUPE_WINDOW_MS: Record<MonitorLevel, number>;
+export declare const BRUTE_FORCE_THRESHOLD: Record<MonitorLevel, number>;
+export declare const LLM_FLOOD_THRESHOLD: Record<MonitorLevel, number>;
+export declare const MAX_NEW_FINDINGS_PER_10_MIN = 200;
+export type SendOutcome = "sent" | "retry" | "drop";
+export interface IngestOptions {
+    /** What the text is. Default: worked out from the line (an access-log line or an app log line). */
+    source?: LineSource;
+    /** Who sent it (client address or user id): groups repeats and counts floods. Default: the line's client address. */
+    client?: string;
+    /** Rules for this text only, like the SDK's canary check. */
+    rules?: MonitorRule[];
+    /** False sends the rule, count and sender without the text excerpt. */
+    excerpt?: boolean;
+}
+export interface PipelineOptions {
+    /** The active level, or null while capture is off (not enabled, or the allowance is spent). */
+    level: () => MonitorLevel | null;
+    customDetectors?: () => CustomDetector[];
+    now?: () => number;
+    /** Detection time allowed per minute; past it, lines are skipped (and counted) until the next minute. */
+    cpuBudgetMsPerMinute?: number;
+    /** Or a budget shared with other work (the SDK's prompt and output checks). */
+    budget?: CpuBudget;
+}
+/**
+ * A hard cap on detection time per minute, so monitoring can never take more than a fixed share of
+ * a CPU, whatever the traffic or input. Work over the cap is skipped and counted, not queued.
+ */
+export declare class CpuBudget {
+    private readonly msPerMinute;
+    private minute;
+    private spent;
+    private skippedSince;
+    constructor(msPerMinute: number);
+    /** Runs `work` if this minute's budget isn't spent; otherwise skips it and returns undefined. */
+    run<T>(work: () => T): T | undefined;
+    /** How many were skipped since the last call (for a diagnostic). */
+    takeSkipped(): number;
+}
+/**
+ * Events per key over the last few minutes, in one-minute buckets: a fixed few numbers per key
+ * however busy the key is, and at most `maxKeys` keys (the least recently active go first).
+ */
+export declare class WindowCounter {
+    private readonly windowMinutes;
+    private readonly maxKeys;
+    private keys;
+    constructor(windowMinutes: number, maxKeys?: number);
+    get size(): number;
+    /** Records one event and returns the count over the window, this one included. */
+    add(key: string, now: number): number;
+    /** Drops keys with nothing in the window. */
+    prune(now: number): void;
+}
+export declare class MonitorPipeline {
+    private readonly opts;
+    private seen;
+    private queue;
+    private queued;
+    private authFailures;
+    private llmCalls;
+    private floodBucket;
+    private floodCount;
+    private suppressed;
+    private maintainedMinute;
+    readonly budget: CpuBudget | null;
+    constructor(opts: PipelineOptions);
+    private now;
+    get pending(): MonitorFinding[];
+    /** Sizes of everything the pipeline keeps, for tests and diagnostics: all of them are bounded. */
+    get footprint(): {
+        seen: number;
+        queue: number;
+        queued: number;
+        authFailures: number;
+        llmCalls: number;
+    };
+    /** Once a minute: forget dedupe entries and counters that can no longer matter. */
+    private maintain;
+    /**
+     * Matches one line and queues any findings at or above the level. Returns the rule ids raised.
+     * Over the CPU budget, the line is skipped (see budget.takeSkipped()).
+     */
+    ingestLine(line: string, file?: string, options?: IngestOptions): string[];
+    private ingest;
+    /** Queues a finding produced elsewhere (dependency checks) under its own stable id, once. */
+    addFinding(finding: MonitorFinding): boolean;
+    private raise;
+    private emitSuppressed;
+    private enqueue;
+    /** Sends queued findings in batches; a "retry" outcome keeps the batch for the next flush. */
+    flush(send: (batch: MonitorFinding[]) => Promise<SendOutcome>): Promise<void>;
+}

package/dist/monitor-pipeline.js

@@ -0,0 +1,291 @@
+import { clientIp, isAuthFailure, isLlmRequest, lineSource, matchLine, redactLine } from "./monitor-rules.js";
+/** A short, stable fingerprint (two seeded 53-bit hashes); not cryptographic, only used for dedupe ids. */
+export function fingerprint(text) {
+    const h = (seed) => {
+        let h1 = 0xdeadbeef ^ seed, h2 = 0x41c6ce57 ^ seed;
+        for (let i = 0; i < text.length; i++) {
+            const ch = text.charCodeAt(i);
+            h1 = Math.imul(h1 ^ ch, 2654435761);
+            h2 = Math.imul(h2 ^ ch, 1597334677);
+        }
+        h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^ Math.imul(h2 ^ (h2 >>> 13), 3266489909);
+        h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^ Math.imul(h1 ^ (h1 >>> 13), 3266489909);
+        return (4294967296 * (2097151 & h2) + (h1 >>> 0)).toString(16).padStart(14, "0");
+    };
+    return `${h(1)}${h(2)}`.slice(0, 24);
+}
+const RANK = { critical: 3, high: 2, medium: 1, low: 0 };
+const MIN_RANK = { light: 3, standard: 2, strict: 1 };
+/** light: critical only · standard: high and up · strict: medium and up (same thresholds as the server). */
+export const meetsLevel = (severity, level) => RANK[severity] >= MIN_RANK[level];
+// One finding absorbs repeats (its `count` goes up) for this long before a new one is raised.
+export const DEDUPE_WINDOW_MS = { light: 60 * 60_000, standard: 15 * 60_000, strict: 5 * 60_000 };
+// Failed sign-ins from one address within five minutes before it counts as brute forcing.
+export const BRUTE_FORCE_THRESHOLD = { light: 50, standard: 20, strict: 10 };
+const BRUTE_FORCE_WINDOW_MS = 5 * 60_000;
+// Paid model calls from one sender within five minutes before it counts as abuse: scripted use
+// that runs up the app's LLM bill ("denial of wallet") or scrapes the model through the app.
+export const LLM_FLOOD_THRESHOLD = { light: 1500, standard: 300, strict: 120 };
+const LLM_FLOOD_WINDOW_MS = 5 * 60_000;
+// A scan or a log loop can match thousands of distinct lines; past this many new findings in ten
+// minutes the rest are folded into one summary finding so a flood can't spend the month's allowance.
+export const MAX_NEW_FINDINGS_PER_10_MIN = 200;
+const FLOOD_WINDOW_MS = 10 * 60_000;
+const MAX_QUEUE = 1000;
+const BATCH_SIZE = 100;
+/** Groups lines that differ only in ids, numbers, addresses or timestamps. */
+function normalizeForGrouping(line) {
+    return line.toLowerCase()
+        .replace(/\b(?:\d{1,3}\.){3}\d{1,3}\b/g, "<ip>")
+        .replace(/\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g, "<id>")
+        .replace(/\b[0-9a-f]{16,}\b/g, "<hex>")
+        .replace(/\d+/g, "0")
+        .replace(/\s+/g, " ")
+        .slice(0, 300);
+}
+const clock = () => (globalThis.performance?.now?.() ?? Date.now());
+/**
+ * A hard cap on detection time per minute, so monitoring can never take more than a fixed share of
+ * a CPU, whatever the traffic or input. Work over the cap is skipped and counted, not queued.
+ */
+export class CpuBudget {
+    msPerMinute;
+    minute = -1;
+    spent = 0;
+    skippedSince = 0;
+    constructor(msPerMinute) {
+        this.msPerMinute = msPerMinute;
+    }
+    /** Runs `work` if this minute's budget isn't spent; otherwise skips it and returns undefined. */
+    run(work) {
+        const minute = Math.floor(Date.now() / 60_000);
+        if (minute !== this.minute) {
+            this.minute = minute;
+            this.spent = 0;
+        }
+        if (this.spent >= this.msPerMinute) {
+            this.skippedSince++;
+            return undefined;
+        }
+        const start = clock();
+        try {
+            return work();
+        }
+        finally {
+            this.spent += clock() - start;
+        }
+    }
+    /** How many were skipped since the last call (for a diagnostic). */
+    takeSkipped() { const n = this.skippedSince; this.skippedSince = 0; return n; }
+}
+/**
+ * Events per key over the last few minutes, in one-minute buckets: a fixed few numbers per key
+ * however busy the key is, and at most `maxKeys` keys (the least recently active go first).
+ */
+export class WindowCounter {
+    windowMinutes;
+    maxKeys;
+    keys = new Map();
+    constructor(windowMinutes, maxKeys = 10_000) {
+        this.windowMinutes = windowMinutes;
+        this.maxKeys = maxKeys;
+    }
+    get size() { return this.keys.size; }
+    /** Records one event and returns the count over the window, this one included. */
+    add(key, now) {
+        const minute = Math.floor(now / 60_000);
+        let entry = this.keys.get(key);
+        if (entry)
+            this.keys.delete(key); // re-inserted below: Map order is then least recently active first
+        else
+            entry = { minutes: new Array(this.windowMinutes).fill(-1), counts: new Array(this.windowMinutes).fill(0) };
+        const slot = minute % this.windowMinutes;
+        if (entry.minutes[slot] !== minute) {
+            entry.minutes[slot] = minute;
+            entry.counts[slot] = 0;
+        }
+        entry.counts[slot]++;
+        this.keys.set(key, entry);
+        if (this.keys.size > this.maxKeys)
+            this.keys.delete(this.keys.keys().next().value);
+        let total = 0;
+        for (let i = 0; i < this.windowMinutes; i++)
+            if (minute - entry.minutes[i] < this.windowMinutes)
+                total += entry.counts[i];
+        return total;
+    }
+    /** Drops keys with nothing in the window. */
+    prune(now) {
+        const minute = Math.floor(now / 60_000);
+        for (const [key, entry] of this.keys)
+            if (Math.max(...entry.minutes) <= minute - this.windowMinutes)
+                this.keys.delete(key);
+    }
+}
+export class MonitorPipeline {
+    opts;
+    seen = new Map();
+    queue = [];
+    queued = new Set();
+    authFailures = new WindowCounter(BRUTE_FORCE_WINDOW_MS / 60_000);
+    llmCalls = new WindowCounter(LLM_FLOOD_WINDOW_MS / 60_000);
+    floodBucket = -1;
+    floodCount = 0;
+    suppressed = null;
+    maintainedMinute = -1;
+    budget;
+    constructor(opts) {
+        this.opts = opts;
+        this.budget = opts.budget ?? (opts.cpuBudgetMsPerMinute ? new CpuBudget(opts.cpuBudgetMsPerMinute) : null);
+    }
+    now() { return this.opts.now?.() ?? Date.now(); }
+    get pending() { return [...this.queue]; }
+    /** Sizes of everything the pipeline keeps, for tests and diagnostics: all of them are bounded. */
+    get footprint() {
+        return { seen: this.seen.size, queue: this.queue.length, queued: this.queued.size, authFailures: this.authFailures.size, llmCalls: this.llmCalls.size };
+    }
+    /** Once a minute: forget dedupe entries and counters that can no longer matter. */
+    maintain(now) {
+        const minute = Math.floor(now / 60_000);
+        if (minute === this.maintainedMinute)
+            return;
+        this.maintainedMinute = minute;
+        const cutoff = now - 2 * DEDUPE_WINDOW_MS.light;
+        for (const [fp, entry] of this.seen)
+            if (entry.at < cutoff)
+                this.seen.delete(fp);
+        this.authFailures.prune(now);
+        this.llmCalls.prune(now);
+        if (this.queued.size > 5000)
+            this.queued.clear(); // dependency ids; a repeat is deduped by the server too
+    }
+    /**
+     * Matches one line and queues any findings at or above the level. Returns the rule ids raised.
+     * Over the CPU budget, the line is skipped (see budget.takeSkipped()).
+     */
+    ingestLine(line, file, options = {}) {
+        if (!this.budget)
+            return this.ingest(line, file, options);
+        return this.budget.run(() => this.ingest(line, file, options)) ?? [];
+    }
+    ingest(line, file, options) {
+        const level = this.opts.level();
+        if (!level || !line.trim())
+            return [];
+        const custom = this.opts.customDetectors?.() ?? [];
+        const source = options.source ?? lineSource(line);
+        // Prompts and model output travel as "log" findings, which every workspace version accepts.
+        const wire = source === "http" ? "http" : "log";
+        const ip = options.client ? redactLine(options.client, custom).slice(0, 80) : source === "http" ? clientIp(line) : undefined;
+        this.maintain(this.now());
+        const excerpt = options.excerpt === false ? "(the app withheld the text)" : redactLine(line, custom);
+        const raised = [];
+        const seenRules = new Set();
+        for (const rule of matchLine(line, source, options.rules)) {
+            if (!meetsLevel(rule.severity, level) || seenRules.has(rule.id))
+                continue;
+            seenRules.add(rule.id);
+            // Traffic groups by client address (one scan = one finding); app logs group by line shape.
+            this.raise(level, ip ?? normalizeForGrouping(line), {
+                ruleId: rule.id, title: ip ? `${rule.title} from ${ip}` : rule.title, severity: rule.severity,
+                category: rule.category, source: wire, file, evidence: options.excerpt === false ? `Matched "${rule.title}"; the app withheld the text.` : excerpt,
+            });
+            raised.push(rule.id);
+        }
+        if (isAuthFailure(line, source) && meetsLevel("high", level)) {
+            const key = clientIp(line) ?? "unknown address";
+            const recent = this.authFailures.add(key, this.now());
+            if (recent >= BRUTE_FORCE_THRESHOLD[level]) {
+                this.raise(level, key, {
+                    ruleId: "app.auth_bruteforce", title: `Repeated failed sign-ins from ${key}`, severity: "high", category: "recon",
+                    source: wire, file, evidence: `${recent} failures in 5 minutes. Latest: ${redactLine(line, custom)}`.slice(0, 600),
+                });
+                raised.push("app.auth_bruteforce");
+            }
+        }
+        // Only a known sender counts: behind a proxy that hides addresses, all traffic would look like one client.
+        if (ip && meetsLevel("high", level) && (source === "prompt" || (source === "http" && isLlmRequest(line)))) {
+            const recent = this.llmCalls.add(`${source}\0${ip}`, this.now());
+            if (recent >= LLM_FLOOD_THRESHOLD[level]) {
+                this.raise(level, ip, {
+                    ruleId: "llm.denial_of_wallet", title: `Unusual volume of LLM requests from ${ip}`, severity: "high", category: "llm",
+                    source: wire, file, evidence: `${recent} ${source === "prompt" ? "prompts" : "requests to LLM endpoints"} in 5 minutes. Scripted use runs up the model bill. Latest: ${excerpt}`.slice(0, 600),
+                });
+                raised.push("llm.denial_of_wallet");
+            }
+        }
+        return raised;
+    }
+    /** Queues a finding produced elsewhere (dependency checks) under its own stable id, once. */
+    addFinding(finding) {
+        const level = this.opts.level();
+        if (!level || !meetsLevel(finding.severity, level) || this.queued.has(finding.id))
+            return false;
+        this.maintain(this.now());
+        this.queued.add(finding.id);
+        this.enqueue(finding);
+        return true;
+    }
+    raise(level, groupKey, partial) {
+        const now = this.now();
+        const bucket = Math.floor(now / DEDUPE_WINDOW_MS[level]);
+        const fp = fingerprint(`${partial.ruleId}\0${groupKey}`);
+        const existing = this.seen.get(fp);
+        if (existing && existing.bucket === bucket) {
+            existing.finding.count++; // still queued: the batch carries the new count
+            return;
+        }
+        const flood = Math.floor(now / FLOOD_WINDOW_MS);
+        if (flood !== this.floodBucket) {
+            this.emitSuppressed();
+            this.floodBucket = flood;
+            this.floodCount = 0;
+        }
+        if (this.floodCount >= MAX_NEW_FINDINGS_PER_10_MIN) {
+            const worst = this.suppressed && RANK[this.suppressed.severity] >= RANK[partial.severity] ? this.suppressed.severity : partial.severity;
+            this.suppressed = { count: (this.suppressed?.count ?? 0) + 1, severity: worst };
+            return;
+        }
+        this.floodCount++;
+        const finding = { id: `${fp}-${bucket}`, ...partial, count: 1, firstSeen: new Date(now).toISOString() };
+        this.seen.set(fp, { bucket, finding, at: now });
+        this.enqueue(finding);
+    }
+    emitSuppressed() {
+        if (!this.suppressed)
+            return;
+        const { count, severity } = this.suppressed;
+        this.suppressed = null;
+        this.enqueue({
+            id: `flood-${this.floodBucket}`, ruleId: "beam.monitor.flood", title: "Too many findings to send individually", severity,
+            category: "integrity", source: "log", count,
+            evidence: `${count} more findings within 10 minutes were not sent one by one, to protect the monthly allowance. Check this server's logs.`,
+            firstSeen: new Date(this.floodBucket * FLOOD_WINDOW_MS).toISOString(),
+        });
+    }
+    enqueue(finding) {
+        if (this.queue.length >= MAX_QUEUE) {
+            // Full (usually: the workspace is unreachable). Make room by dropping the least severe, oldest.
+            let drop = 0;
+            for (let i = 1; i < this.queue.length; i++)
+                if (RANK[this.queue[i].severity] < RANK[this.queue[drop].severity])
+                    drop = i;
+            this.queue.splice(drop, 1);
+        }
+        this.queue.push(finding);
+    }
+    /** Sends queued findings in batches; a "retry" outcome keeps the batch for the next flush. */
+    async flush(send) {
+        if (this.suppressed && Math.floor(this.now() / FLOOD_WINDOW_MS) !== this.floodBucket)
+            this.emitSuppressed();
+        while (this.queue.length) {
+            const batch = this.queue.splice(0, BATCH_SIZE);
+            if ((await send(batch)) === "retry") {
+                this.queue.unshift(...batch);
+                break;
+            }
+        }
+        this.maintain(this.now());
+    }
+}
+//# sourceMappingURL=monitor-pipeline.js.map

package/dist/monitor-pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor-pipeline.js","sourceRoot":"","sources":["../src/monitor-pipeline.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAqC,MAAM,oBAAoB,CAAC;AAEjJ,2GAA2G;AAC3G,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE;QACzB,IAAI,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;YACpC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;QACtC,CAAC;QACD,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QACvF,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QACvF,OAAO,CAAC,UAAU,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC,CAAC;IACF,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,IAAI,GAAoC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAC1F,MAAM,QAAQ,GAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACpF,4GAA4G;AAC5G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAyB,EAAE,KAAmB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;AAEhH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAiC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC;AAChI,0FAA0F;AAC1F,MAAM,CAAC,MAAM,qBAAqB,GAAiC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC3G,MAAM,qBAAqB,GAAG,CAAC,GAAG,MAAM,CAAC;AACzC,+FAA+F;AAC/F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,mBAAmB,GAAiC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC7G,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AACvC,iGAAiG;AACjG,qGAAqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,UAAU,GAAG,GAAG,CAAC;AAIvB,8EAA8E;AAC9E,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,WAAW,EAAE;SACtB,OAAO,CAAC,8BAA8B,EAAE,MAAM,CAAC;SAC/C,OAAO,CAAC,mEAAmE,EAAE,MAAM,CAAC;SACpF,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AAwBD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAEpE;;;GAGG;AACH,MAAM,OAAO,SAAS;IAIS;IAHrB,MAAM,GAAG,CAAC,CAAC,CAAC;IACZ,KAAK,GAAG,CAAC,CAAC;IACV,YAAY,GAAG,CAAC,CAAC;IACzB,YAA6B,WAAmB;QAAnB,gBAAW,GAAX,WAAW,CAAQ;IAAG,CAAC;IACpD,iGAAiG;IACjG,GAAG,CAAI,IAAa;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAAC,CAAC;QACrE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YAAC,OAAO,IAAI,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,GAAG,KAAK,CAAC;QAAC,CAAC;IACnE,CAAC;IACD,oEAAoE;IACpE,WAAW,KAAa,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;CACxF;AAED;;;GAGG;AACH,MAAM,OAAO,aAAa;IAEK;IAAwC;IAD7D,IAAI,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC1E,YAA6B,aAAqB,EAAmB,UAAU,MAAM;QAAxD,kBAAa,GAAb,aAAa,CAAQ;QAAmB,YAAO,GAAP,OAAO,CAAS;IAAG,CAAC;IACzF,IAAI,IAAI,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,kFAAkF;IAClF,GAAG,CAAC,GAAW,EAAE,GAAW;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;QACxC,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,mEAAmE;;YAChG,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,KAAK,CAAS,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,CAAS,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChI,MAAM,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;YAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAC7F,KAAK,CAAC,MAAM,CAAC,IAAI,CAAE,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QACpF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE;YAAE,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,aAAa;gBAAE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;QAC5H,OAAO,KAAK,CAAC;IACf,CAAC;IACD,6CAA6C;IAC7C,KAAK,CAAC,GAAW;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7H,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IAYG;IAXrB,IAAI,GAAG,IAAI,GAAG,EAAmE,CAAC;IAClF,KAAK,GAAqB,EAAE,CAAC;IAC7B,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3B,YAAY,GAAG,IAAI,aAAa,CAAC,qBAAqB,GAAG,MAAM,CAAC,CAAC;IACjE,QAAQ,GAAG,IAAI,aAAa,CAAC,mBAAmB,GAAG,MAAM,CAAC,CAAC;IAC3D,WAAW,GAAG,CAAC,CAAC,CAAC;IACjB,UAAU,GAAG,CAAC,CAAC;IACf,UAAU,GAAwD,IAAI,CAAC;IACvE,gBAAgB,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,CAAmB;IAElC,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7G,CAAC;IAEO,GAAG,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAEjE,IAAI,OAAO,KAAuB,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3D,kGAAkG;IAClG,IAAI,SAAS;QACX,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1J,CAAC;IAED,mFAAmF;IAC3E,QAAQ,CAAC,GAAW;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAC7C,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;QAC/B,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC;QAChD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,KAAK,CAAC,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,wDAAwD;IAC5G,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,IAAY,EAAE,IAAa,EAAE,UAAyB,EAAE;QACjE,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAEO,MAAM,CAAC,IAAY,EAAE,IAAwB,EAAE,OAAsB;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;QAClD,4FAA4F;QAC5F,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAChD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7H,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrG,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC1E,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvB,2FAA2F;YAC3F,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE;gBAClD,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBAC7F,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,+BAA+B,CAAC,CAAC,CAAC,OAAO;aACnJ,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC;YAChD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtD,IAAI,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE;oBACrB,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,iCAAiC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;oBACjH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,mCAAmC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBACnH,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,2GAA2G;QAC3G,IAAI,EAAE,IAAI,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACjE,IAAI,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;oBACpB,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK;oBACrH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,+DAA+D,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC/L,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6FAA6F;IAC7F,UAAU,CAAC,OAAuB;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAChG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,KAAmB,EAAE,QAAgB,EAAE,OAA2D;QAC9G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3C,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,gDAAgD;YAC1E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YACzB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,IAAI,2BAA2B,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxI,IAAI,CAAC,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,OAAO,GAAmB,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACxH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAC7B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC;YACX,EAAE,EAAE,SAAS,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ;YACxH,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;YAC3C,QAAQ,EAAE,GAAG,KAAK,wHAAwH;YAC1I,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC,WAAW,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,OAAuB;QACrC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YACnC,gGAAgG;YAChG,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,QAAQ,CAAC;oBAAE,IAAI,GAAG,CAAC,CAAC;YAC3H,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,KAAK,CAAC,IAAuD;QACjE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,KAAK,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5G,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;gBAC7B,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/monitor-rules.d.ts

@@ -1,13 +1,14 @@
-import { type RuleCategory } from "./core.js";
+import { type RuleCategory } from "./rule-catalog.js";
 import type { CustomDetector } from "./data-detectors.js";
 import type { MonitorSeverity } from "./monitor-client.js";
-export type LineSource = "log" | "http";
+/** log/http: lines from log files and traffic. prompt/output: text going into, or coming out of, an LLM (SDK). */
+export type LineSource = "log" | "http" | "prompt" | "output";
 export interface MonitorRule {
     id: string;
     title: string;
     severity: MonitorSeverity;
-    category: RuleCategory | "exploit";
-    /** Restricts the rule to access-log lines; omitted means every line. */
+    category: RuleCategory | "exploit" | "llm";
+    /** Where the rule applies; omitted means log and http lines (never prompts or model output). */
     sources?: LineSource[];
     /** `decoded` is URL-decoded (twice, for double encoding); `raw` is the line as written. */
     match: (decoded: string, raw: string) => boolean;
@@ -16,7 +17,8 @@ export declare const monitorRules: MonitorRule[];
 export declare function lineSource(line: string): LineSource;
 /** URL-decodes up to twice so `%252e%252e%252f` (double-encoded `../`) is matched too. */
 export declare function decodeForMatch(line: string): string;
-export declare function matchLine(line: string, source?: LineSource): MonitorRule[];
+/** The rules a line matches. Prompts and model output aren't URL-decoded: they aren't URLs. */
+export declare function matchLine(line: string, source?: LineSource, extra?: MonitorRule[]): MonitorRule[];
 /**
  * Redaction for evidence that leaves the machine. Unlike the agent-hook redaction it keeps query
  * strings -- for an access log the query usually *is* the attack -- but removes credentials,
@@ -28,5 +30,7 @@ export declare function redactLine(line: string, custom?: CustomDetector[]): str
  * nginx/Apache/Caddy common log format, otherwise the first standalone IPv4 address.
  */
 export declare function clientIp(line: string): string | undefined;
+/** A POST to what looks like an LLM endpoint (chat, completions, generate…), each one a paid model call. */
+export declare function isLlmRequest(line: string): boolean;
 /** A failed sign-in: a 401/403 on an auth path in an access log, or an app's own "login failed" line. */
 export declare function isAuthFailure(line: string, source: LineSource): boolean;

package/dist/monitor-rules.js

@@ -2,11 +2,49 @@
 // HTTP access logs. Separate from the agent-hook catalog in core.ts on purpose -- application logs
 // are full of words like "env", "token" and "production" that would drown those rules -- but a few
 // built-in rules that mean the same thing anywhere (reverse shells, piped remote code, cloud
-// metadata access, prompt injection) are reused as-is. Heuristic, like everything else in Beam.
-import { builtinRulesById } from "./core.js";
+// metadata access) are reused as-is. Attacks on LLM features (prompt injection and friends) come
+// from prompt-attacks.ts. Heuristic, like everything else in Beam.
+import { builtinRulesById } from "./rule-catalog.js";
+import { promptAttack, revealHidden } from "./prompt-attacks.js";
 // Trailing boundary for shell commands, so `| id=5` in a log line isn't read as running `id`.
 const END = String.raw `(?=$|[\s;'"&|)\x60])`;
 const commandInjection = new RegExp(String.raw `(?:[;|\x60]|\$\(|&&)\s*(?:id|whoami|uname\s+-a|cat\s+/etc/(?:passwd|shadow)|(?:curl|wget)\s+\S+|nc\s+-\w|bash\s+-[ic]|sh\s+-c|ping\s+-c\s*\d+)${END}`, "i");
+// A URL-like parameter pointing the server at itself, its network or its cloud metadata, or a
+// scheme only an attacker wants fetched. LLM agents with browsing or fetch tools are a common way
+// in. Parameters are split and checked one by one: as one regex this backtracked quadratically on
+// long hostile query strings, and it runs inside customer apps.
+const SSRF_NAME = /url|uri|link|src|dest|target|redirect|callback|webhook|feed|host|endpoint|proxy|image|fetch|next|return/i;
+const SSRF_SCHEME = /^(?:gopher|dict|ldap|tftp|jar|netdoc):\/\//i;
+const SSRF_INTERNAL = /^(?:(?:https?|ftp):\/\/(?:localhost|127\.\d+\.\d+\.\d+|0\.0\.0\.0|0x7f\w*|2130706433|\[::(?:1|ffff:[^\]]{0,40})?\]|10\.\d+\.\d+\.\d+|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|100\.100\.100\.200|metadata\.google\.internal)|file:\/)/i;
+function ssrf(s) {
+    const query = s.indexOf("?");
+    if (query < 0)
+        return false;
+    let seen = 0;
+    for (const param of s.slice(query + 1).split(/[&?\s"]/)) {
+        const eq = param.indexOf("=");
+        if (eq < 0)
+            continue;
+        if (++seen > 100)
+            break;
+        const name = param.slice(0, eq);
+        const value = param.slice(eq + 1);
+        if (SSRF_SCHEME.test(value) || (name.length <= 64 && SSRF_NAME.test(name) && SSRF_INTERNAL.test(value)))
+            return true;
+    }
+    return false;
+}
+// Credentials, by format. LLM provider keys are worth the most to an attacker right now.
+const SECRET = /-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:sk-(?:proj-|ant-|or-v1-)?[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9_]{30,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[A-Z0-9]{16}|xox[baprs]-[\w-]{10,}|AIza[0-9A-Za-z_-]{35}|gsk_[A-Za-z0-9]{40,}|hf_[A-Za-z0-9]{30,}|r8_[A-Za-z0-9]{30,}|xai-[A-Za-z0-9]{40,}|pplx-[A-Za-z0-9]{40,}|beam_app_[\w-]{20,})\b|\bauthorization:\s*bearer\s+[A-Za-z0-9._~+/-]{20,}/i;
+const XSS = /<script[\s>]|javascript:\s*[a-z(]|<(?:img|svg|body|iframe)\b[^>]{0,200}\son(?:error|load)\s*=|\bdocument\.cookie\b/i;
+const EVERYWHERE = ["log", "http", "prompt", "output"];
+const SENSITIVE_FILE = /\/(?:\.env(?:\.[\w-]+)?|\.git\/(?:config|HEAD)|\.aws\/credentials|\.ssh\/id_\w+|wp-config\.php(?:\.bak)?|\.htpasswd|server-status|actuator\/(?:env|heapdump)|\.DS_Store)(?=[\s?"'#]|$)/i;
+const ACCESS_STATUS = /"[A-Z]+ \S+ HTTP\/[\d.]+" (\d{3})\b|"(?:status|httpStatus|status_code|statusCode|response_status)"\s*:\s*"?(\d{3})\b/;
+/** The response status in an access-log line was 2xx. */
+function isSuccess(line) {
+    const m = line.match(ACCESS_STATUS);
+    return (m?.[1] ?? m?.[2] ?? "").startsWith("2");
+}
 const appRules = [
     { id: "web.jndi_injection", title: "JNDI lookup (Log4Shell-style) injection", severity: "critical", category: "exploit",
         match: s => /\$\{\s*jndi\s*:|\$\{\s*\$\{\s*(?:::-|lower:|upper:|env:)/i.test(s) },
@@ -22,20 +60,61 @@ const appRules = [
         match: s => /\/(?:c99|r57|wso|b374k|webshell|cmd|shell)\.(?:php|jsp|aspx?)\b|[?&](?:cmd|exec|command)=(?:whoami|id|ls|uname|cat)\b/i.test(s) },
     { id: "web.deserialization", title: "Serialized object payload", severity: "high", category: "exploit",
         match: s => /\brO0AB[A-Za-z0-9+/=]{8,}|\bO:\d+:"[A-Za-z_\\]+":\d+:\{/.test(s) },
+    { id: "web.ssrf", title: "Server-side request forgery attempt", severity: "high", category: "exploit", sources: ["http"],
+        match: s => ssrf(s) },
     { id: "app.secret_in_log", title: "Credential written to logs", severity: "high", category: "secrets",
-        match: (_s, raw) => /-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:sk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9_]{30,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[A-Z0-9]{16}|xox[baprs]-[\w-]{10,}|AIza[0-9A-Za-z_-]{35}|beam_app_[\w-]{20,})\b|\bauthorization:\s*bearer\s+[A-Za-z0-9._~+/-]{20,}/i.test(raw) },
+        match: (_s, raw) => SECRET.test(raw) },
     { id: "web.xss", title: "Cross-site scripting attempt", severity: "medium", category: "exploit",
-        match: s => /<script[\s>]|javascript:\s*[a-z(]|<(?:img|svg|body|iframe)\b[^>]{0,200}\son(?:error|load)\s*=|\bdocument\.cookie\b/i.test(s) },
+        match: s => XSS.test(s) },
     { id: "web.prototype_pollution", title: "Prototype pollution attempt", severity: "medium", category: "exploit",
         match: s => /\b__proto__\b\s*[\]["'=:.]|constructor\s*\[\s*["']?prototype/i.test(s) },
+    // Bots ask every site for /.env all day, so a probe alone is medium. One that got a 2xx back
+    // may have handed over the app's keys: high. (An app that answers 200 to every path, like a
+    // single-page app's catch-all, can trip the second.)
     { id: "web.sensitive_file_probe", title: "Probe for secrets or config files", severity: "medium", category: "recon", sources: ["http"],
-        match: s => /\/(?:\.env(?:\.[\w-]+)?|\.git\/(?:config|HEAD)|\.aws\/credentials|\.ssh\/id_\w+|wp-config\.php(?:\.bak)?|\.htpasswd|server-status|actuator\/(?:env|heapdump)|\.DS_Store)(?=[\s?"'#]|$)/i.test(s) },
+        match: s => SENSITIVE_FILE.test(s) },
+    { id: "web.secret_file_exposed", title: "Secret or config file served to a client", severity: "high", category: "secrets", sources: ["http"],
+        match: (s, raw) => SENSITIVE_FILE.test(s) && isSuccess(raw) },
     { id: "web.scanner", title: "Known attack tool", severity: "medium", category: "recon", sources: ["http"],
         match: s => /\b(?:sqlmap|nikto|nuclei|masscan|zgrab|acunetix|nessus|wpscan|dirbuster|gobuster|feroxbuster|ffuf|hydra|openvas|commix|xsstrike)\b/i.test(s) },
 ];
-const sharedRules = builtinRulesById(["network.reverse-shell", "execution.remote", "execution.obfuscated", "network.metadata", "instructions.override"])
-    .map(r => ({ id: r.id, title: r.title, severity: r.severity === "info" ? "medium" : r.severity, category: r.category, match: (s) => r.match(s) }));
-export const monitorRules = [...appRules, ...sharedRules];
+// Attacks on the app's LLM features. Prompt-side rules also read traffic and logs, because
+// prompts arrive in query strings and apps log them; forged chat markers only count where a
+// client wrote them (a model server's own logs are full of its template).
+const llmRules = [
+    { id: "llm.prompt_injection", title: "Prompt injection attempt", severity: "high", category: "llm", sources: EVERYWHERE,
+        match: s => promptAttack.override(s) },
+    { id: "llm.reviewer_manipulation", title: "Attempt to sway an AI reviewer", severity: "high", category: "llm", sources: EVERYWHERE,
+        match: s => promptAttack.reviewer(s) },
+    { id: "llm.hidden_instructions", title: "Hidden instructions in invisible Unicode", severity: "high", category: "llm", sources: EVERYWHERE,
+        match: s => promptAttack.hidden(s) },
+    { id: "llm.chat_template_injection", title: "Forged system or chat-template markers", severity: "high", category: "llm", sources: ["http", "prompt"],
+        match: s => promptAttack.chatTemplate(s) },
+    { id: "llm.secret_extraction", title: "Attempt to extract API keys or secrets", severity: "high", category: "llm", sources: ["log"],
+        match: s => promptAttack.secretRequest(s) },
+    { id: "llm.secret_extraction", title: "Attempt to extract API keys or secrets", severity: "high", category: "llm", sources: ["http", "prompt"],
+        match: s => promptAttack.secretRequest(s) || promptAttack.secretCommand(s) },
+    { id: "llm.jailbreak", title: "Jailbreak attempt", severity: "medium", category: "llm", sources: ["log", "http", "prompt"],
+        match: s => promptAttack.jailbreak(s) },
+    { id: "llm.prompt_extraction", title: "System prompt or data extraction attempt", severity: "medium", category: "llm", sources: ["log", "http", "prompt"],
+        match: s => promptAttack.extraction(s) },
+    { id: "llm.output_exfiltration", title: "Data exfiltration link in model output", severity: "high", category: "llm", sources: ["log"],
+        match: (_s, raw) => promptAttack.markdownExfil(raw) },
+    { id: "llm.output_exfiltration", title: "Data exfiltration link in model output", severity: "high", category: "llm", sources: ["output"],
+        match: (_s, raw) => promptAttack.htmlExfil(raw) },
+    { id: "llm.output_secret", title: "Credential in model output", severity: "high", category: "llm", sources: ["output"],
+        match: (_s, raw) => SECRET.test(raw) || promptAttack.envSecret(raw) },
+    { id: "llm.output_script", title: "Script or active HTML in model output", severity: "medium", category: "llm", sources: ["output"],
+        match: (_s, raw) => XSS.test(raw) },
+];
+const sharedRules = builtinRulesById(["network.reverse-shell", "execution.remote", "execution.obfuscated", "network.metadata"])
+    .map(r => ({
+    id: r.id, title: r.title, severity: r.severity === "info" ? "medium" : r.severity, category: r.category, match: (s) => r.match(s),
+    // An agent asked to fetch the metadata endpoint is the same attack as a request for it.
+    ...(r.id === "network.metadata" ? { sources: EVERYWHERE } : {}),
+}));
+export const monitorRules = [...appRules, ...llmRules, ...sharedRules];
+const CLASSIC = ["log", "http"];
 const HTTP_LINE = /"(?:GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS|CONNECT|TRACE) \S+ HTTP\/[\d.]+"|^\S+ \S+ \S+ \[[^\]]+\] "|"(?:method|http_method|request_method)"\s*:\s*"[A-Z]+"/;
 export function lineSource(line) {
     return HTTP_LINE.test(line) ? "http" : "log";
@@ -59,10 +138,11 @@ export function decodeForMatch(line) {
     }
     return s;
 }
-export function matchLine(line, source = lineSource(line)) {
-    const decoded = decodeForMatch(line);
+/** The rules a line matches. Prompts and model output aren't URL-decoded: they aren't URLs. */
+export function matchLine(line, source = lineSource(line), extra = []) {
     const raw = line.length > 16_384 ? line.slice(0, 16_384) : line;
-    return monitorRules.filter(r => (!r.sources || r.sources.includes(source)) && r.match(decoded, raw));
+    const decoded = source === "prompt" || source === "output" ? raw : decodeForMatch(line);
+    return [...monitorRules, ...extra].filter(r => (r.sources ?? CLASSIC).includes(source) && r.match(decoded, raw));
 }
 /**
  * Redaction for evidence that leaves the machine. Unlike the agent-hook redaction it keeps query
@@ -70,9 +150,10 @@ export function matchLine(line, source = lineSource(line)) {
  * bearer tokens, URL userinfo, email addresses and the policy's custom detector matches.
  */
 export function redactLine(line, custom = []) {
-    let out = line.slice(0, 4000)
+    // Hidden Unicode text is made readable first, so it is redacted like the rest and a reviewer can see it.
+    let out = revealHidden(line.slice(0, 4000))
         .replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g, "[REDACTED PRIVATE KEY]")
-        .replace(/\b(?:sk-(?:proj-|ant-)?[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9_]{16,}|github_pat_[A-Za-z0-9_]{16,}|AKIA[A-Z0-9]{16}|xox[baprs]-[\w-]{10,}|AIza[0-9A-Za-z_-]{35}|beam_app_[\w-]{20,})\b/g, "[REDACTED TOKEN]")
+        .replace(/\b(?:sk-(?:proj-|ant-|or-v1-)?[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9_]{16,}|github_pat_[A-Za-z0-9_]{16,}|AKIA[A-Z0-9]{16}|xox[baprs]-[\w-]{10,}|AIza[0-9A-Za-z_-]{35}|gsk_[A-Za-z0-9]{20,}|hf_[A-Za-z0-9]{20,}|r8_[A-Za-z0-9]{20,}|xai-[A-Za-z0-9]{20,}|pplx-[A-Za-z0-9]{20,}|beam_app_[\w-]{20,})\b/g, "[REDACTED TOKEN]")
         .replace(/(bearer\s+)[A-Za-z0-9._~+/-]{8,}/gi, "$1[REDACTED]")
         .replace(/(\b(?:[\w-]*(?:api[_-]?key|token|secret|password|passwd|pwd|authorization|session|cookie)[\w-]*)["']?\s*[:=]\s*)["']?[^\s,"';&}\]]+/gi, "$1[REDACTED]")
         .replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/gi, "$1[REDACTED]@")
@@ -99,8 +180,21 @@ export function clientIp(line) {
 }
 const AUTH_PATH = /\/(?:login|signin|sign-in|auth|oauth|token|session|api\/v\d+\/auth|wp-login\.php|admin)\b/i;
 const AUTH_FAIL_TEXT = /\b(?:login|authentication|auth|sign[- ]?in)\s+(?:failed|failure|denied)|\binvalid\s+(?:password|credentials|username or password|api key|token)|\bfailed\s+password\b|\bincorrect\s+password\b|\bunauthori[sz]ed\b/i;
+const REQUEST_LINE = /"([A-Z]+) (\S+) HTTP\/[\d.]+"/;
+const JSON_METHOD = /"(?:method|http_method|request_method)"\s*:\s*"([A-Z]+)"/;
+const JSON_PATH = /"(?:path|uri|url|request_uri|requestPath)"\s*:\s*"([^"]+)"/;
+const LLM_PATH = /\/(?:chat|completions?|generate|llm|ai|assistant|agents?|ask|prompt|inference|copilot)(?:[/?#]|$)|\/v1\/(?:messages|responses|embeddings)(?:[/?#]|$)/i;
+/** A POST to what looks like an LLM endpoint (chat, completions, generate…), each one a paid model call. */
+export function isLlmRequest(line) {
+    const request = line.match(REQUEST_LINE);
+    const method = request?.[1] ?? line.match(JSON_METHOD)?.[1];
+    const path = request?.[2] ?? line.match(JSON_PATH)?.[1];
+    return method === "POST" && Boolean(path && LLM_PATH.test(path.split("?")[0]));
+}
 /** A failed sign-in: a 401/403 on an auth path in an access log, or an app's own "login failed" line. */
 export function isAuthFailure(line, source) {
+    if (source === "prompt" || source === "output")
+        return false; // a chat message saying "login failed" isn't one
     if (source === "http")
         return (/"\s(?:401|403)\s/.test(line) || /"(?:status|httpStatus|status_code|statusCode|response_status)"\s*:\s*"?(?:401|403)\b/.test(line)) && AUTH_PATH.test(line);
     return AUTH_FAIL_TEXT.test(line);