@agent-inspect/guardrails 6.17.6 → 6.17.7

package/dist/index.cjs

@@ -58,6 +58,17 @@ function isCredentialSensitiveKey(key, sensitiveKeys) {
   return false;
 }
 
+// packages/redact/src/key-value-secret.ts
+var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})`;
+var KEY_VALUE_SECRET_PATTERN = new RegExp(
+  KEY_VALUE_SECRET_PATTERN_SOURCE,
+  "i"
+);
+function valueContainsKeyValueSecret(value) {
+  KEY_VALUE_SECRET_PATTERN.lastIndex = 0;
+  return KEY_VALUE_SECRET_PATTERN.test(value);
+}
+
 // packages/redact/src/index.ts
 var DEFAULT_REDACT_KEYS = [
   "authorization",
@@ -264,6 +275,15 @@ var credentialDetectors = [
     pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/,
     severity: "error"
   }),
+  {
+    id: "value.keyValueSecret",
+    severity: "error",
+    matchKind: "value",
+    detect(input) {
+      if (typeof input.value !== "string") return [];
+      return valueContainsKeyValueSecret(input.value) ? [{ action: "replace", severity: "error", matchKind: "value" }] : [];
+    }
+  },
   {
     id: "value.creditCard",
     severity: "error",

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../redact/src/sensitive-key.ts","../../redact/src/index.ts","../src/rules.ts","../src/run.ts"],"names":["crypto"],"mappings":";;;;;;;;;;;AAMA,SAAS,wBAAwB,KAAA,EAAwB;AACvD,EAAA,OAAO,QAAA,CAAS,KAAK,KAAK,CAAA;AAC5B;AAOO,SAAS,sBAAsB,KAAA,EAAuB;AAC3D,EAAA,OAAO,KAAA,CACJ,OAAA,CAAQ,oBAAA,EAAsB,OAAO,CAAA,CACrC,WAAA,EAAY,CACZ,OAAA,CAAQ,aAAA,EAAe,GAAG,CAAA,CAC1B,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC3B;AAEO,IAAM,mCAAwD,IAAI,GAAA;AAAA,EACvE;AAAA,IACE,QAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA,eAAA;AAAA,IACA,aAAA;AAAA,IACA,aAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF,CAAE,IAAI,qBAAqB;AAC7B,CAAA;AAEA,SAAS,qBAAqB,UAAA,EAA6B;AACzD,EAAA,IAAI,gCAAA,CAAiC,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,KAAA;AAC7D,EAAA,IAAI,UAAA,KAAe,SAAS,OAAO,IAAA;AACnC,EAAA,IAAI,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,KAAA;AAC1C,EAAA,OAAO,UAAA,CAAW,SAAS,OAAO,CAAA;AACpC;AAUO,SAAS,wBAAA,CACd,KACA,aAAA,EACS;AACT,EAAA,IAAI,CAAC,KAAK,OAAO,KAAA;AACjB,EAAA,MAAM,UAAA,GAAa,sBAAsB,GAAG,CAAA;AAC5C,EAAA,IAAI,CAAC,YAAY,OAAO,KAAA;AACxB,EAAA,IAAI,gCAAA,CAAiC,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,KAAA;AAE7D,EAAA,MAAM,mBAAA,GAAsB,wBAAwB,GAAG,CAAA;AAEvD,EAAA,KAAA,MAAW,aAAa,aAAA,EAAe;AACrC,IAAA,MAAM,CAAA,GAAI,sBAAsB,SAAS,CAAA;AACzC,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,IAAI,MAAM,OAAA,EAAS;AACjB,MAAA,IAAI,oBAAA,CAAqB,UAAU,CAAA,EAAG,OAAO,IAAA;AAC7C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,UAAA,KAAe,GAAG,OAAO,IAAA;AAC7B,IAAA,IAAI,WAAW,QAAA,CAAS,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,GAAG,OAAO,IAAA;AACzC,IAAA,IAAI,uBAAuB,UAAA,CAAW,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA,CAAG,GAAG,OAAO,IAAA;AAAA,EACpE;AACA,EAAA,OAAO,KAAA;AACT;;;ACJO,IAAM,mBAAA,GAAsB;AAAA,EACjC,eAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,wBAAA,GAA2B;AAAA,EACtC,WAAA;AAAA,EACA,eAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,yBAAA,GAA4B;AAAA,EACvC,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA;AAkBA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGA,SAAS,MAAM,GAAA,EAAqB;AAClC,EAAA,OAAO,IAAI,WAAA,EAAY;AACzB;AAEA,SAAS,mBAAA,CACP,KACA,KAAA,EAC0B;AAC1B,EAAA,MAAM,KAAA,GAAQ,MAAM,GAAG,CAAA;AACvB,EAAA,MAAM,SAAS,KAAA,CAAM,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,QAAQ,KAAK,CAAA;AAChE,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,SAAA,KAAc,wBAAA,CAAyB,KAAK,CAAC,SAAA,CAAU,GAAG,CAAC,CAAC,CAAA;AACjF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,MAAM,IAAA,GAAOA,uBAAA,CAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,OAAO,KAAA,EAAO,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC3E,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AACxB;AAEA,SAAS,gBAAgB,KAAA,EAAoC;AAC3D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,OAAO,UAAU,SAAA,IAAa,OAAO,UAAU,QAAA,EAAU;AACxF,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,gBAAgB,OAAA,EAAoD;AAC3E,EAAA,OAAO;AAAA,IACL,IAAI,OAAA,CAAQ,EAAA;AAAA,IACZ,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA;AAAA,IAC9B,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAA,CAAQ,QAAQ,SAAA,GAAY,CAAA;AAC5B,MAAA,OAAO,QAAQ,OAAA,CAAQ,IAAA,CAAK,MAAM,KAAK,CAAA,GACnC,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA,EAAW,WAAW,OAAA,EAAS,IACnF,EAAC;AAAA,IACP;AAAA,GACF;AACF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAChC;AAEA,SAAS,WAAW,KAAA,EAAwB;AAC1C,EAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,IAAI,OAAO,KAAA;AAErD,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,IAAS,IAAI,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAC9C,IAAA,IAAI,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAA;AAC5B,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,IAAS,CAAA;AACT,MAAA,IAAI,KAAA,GAAQ,GAAG,KAAA,IAAS,CAAA;AAAA,IAC1B;AACA,IAAA,GAAA,IAAO,KAAA;AACP,IAAA,MAAA,GAAS,CAAC,MAAA;AAAA,EACZ;AACA,EAAA,OAAO,MAAM,EAAA,KAAO,CAAA;AACtB;AAEA,IAAM,OAAA,GACJ,4EAAA;AAGF,IAAM,WAAA,GAAc,cAAA;AAEpB,IAAM,QAAA,GAAW,6CAAA;AAEjB,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,MAAM,aAAa,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,gBAAgB,EAAE,CAAA;AAChE,EAAA,OACE,gCAAA,CAAiC,KAAK,UAAU,CAAA,IAChD,qEAAqE,IAAA,CAAK,UAAU,KACpF,8FAAA,CAA+F,IAAA;AAAA,IAC7F;AAAA,GACF,IACA,gBAAA,CAAiB,IAAA,CAAK,UAAU,CAAA;AAEpC;AAEA,SAAS,WAAW,KAAA,EAAwB;AAC1C,EAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA;AAClC;AAEA,SAAS,wBAAA,CAAyB,WAAmB,SAAA,EAA4B;AAC/E,EAAA,MAAM,MAAA,GAAS,WAAW,SAAS,CAAA;AACnC,EAAA,IAAI,OAAO,MAAA,GAAS,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,IAAI,OAAO,KAAA;AACrD,EAAA,IAAI,CAAC,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,KAAA;AAEnC,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAC/B,EAAA,IAAI,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,KAAA;AAGhC,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA,IAAK,UAAA,CAAW,OAAO,CAAA,KAAM,MAAA,IAAU,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACvF,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,OAAA,CAAQ,SAAS,CAAA;AACzC,EAAA,IAAI,SAAS,CAAA,EAAG;AACd,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,KAAA,GAAQ,CAAC,CAAA;AAClC,IAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,GAAQ,SAAA,CAAU,MAAM,CAAA;AAChD,IAAA,IAAI,MAAA,IAAU,cAAA,CAAe,IAAA,CAAK,MAAM,GAAG,OAAO,KAAA;AAClD,IAAA,IAAI,KAAA,IAAS,cAAA,CAAe,IAAA,CAAK,KAAK,GAAG,OAAO,KAAA;AAAA,EAClD;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,4BAA4B,KAAA,EAAwB;AAC3D,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,IAAI,+BAAA,CAAgC,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AAC1D,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,IAAI,uCAAA,CAAwC,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AAClE,EAAA,IAAI,iBAAA,CAAkB,KAAK,OAAO,CAAA,IAAK,SAAS,IAAA,CAAK,OAAO,GAAG,OAAO,IAAA;AAEtE,EAAA,IAAI,OAAA,CAAQ,KAAK,OAAO,CAAA,IAAK,CAAC,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AACzD,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,wBAAA,CAAyB,KAAA,EAAe,KAAA,EAAe,MAAA,EAAyB;AACvF,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,GAAQ,MAAM,CAAA;AAClC,EAAA,OAAO,WAAW,GAAA,IAAO,MAAA,KAAW,IAAA,IAAQ,KAAA,KAAU,OAAO,KAAA,KAAU,IAAA;AACzE;AAEA,SAAS,mBAAmB,KAAA,EAAwB;AAClD,EAAA,IAAI,2BAAA,CAA4B,KAAK,CAAA,EAAG,OAAO,KAAA;AAC/C,EAAA,QAAA,CAAS,SAAA,GAAY,CAAA;AACrB,EAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,QAAA,CAAS,QAAQ,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AACzB,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,CAAA;AAC7B,IAAA,IAAI,wBAAA,CAAyB,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACzD,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,2BAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,oCAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,cAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,WAAA;AAAA,IACJ,OAAA,EAAS,gEAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,sBAAA;AAAA,IACJ,OAAA,EAAS,0FAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,+CAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,oBAAA;AAAA,IACJ,OAAA,EAAS,+BAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,kBAAA;AAAA,IACJ,OAAA,EAAS,2EAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,IAAI,mBAAA,CAAoB,KAAA,CAAM,IAAI,CAAA,SAAU,EAAC;AAC7C,MAAA,IAAI,UAAA,CAAW,KAAA,CAAM,KAAK,CAAA,SAAU,EAAC;AACrC,MAAA,MAAM,gBAAA,GAAmB,qBAAA;AACzB,MAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,EAAG;AAC1D,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AAC9B,QAAA,IAAI,wBAAA,CAAyB,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,EAAG;AACpD,UAAA,OAAO,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,UAAU,OAAA,EAAS,SAAA,EAAW,SAAS,CAAA;AAAA,QACtE;AAAA,MACF;AACA,MAAA,OAAO,EAAC;AAAA,IACV;AAAA;AAEJ,CAAA;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD;AAAA,IACE,EAAA,EAAI,aAAA;AAAA,IACJ,QAAA,EAAU,SAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAO,kBAAA,CAAmB,KAAA,CAAM,KAAK,CAAA,GACjC,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,SAAA,EAAW,SAAA,EAAW,OAAA,EAAS,IAC/D,EAAC;AAAA,IACP;AAAA,GACF;AAAA,EACA,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,aAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV;AACH,CAAA;AAEA,SAAS,2BAA2B,OAAA,EAAyD;AAC3F,EAAA,IAAI,OAAA,KAAY,SAAS,OAAO,mBAAA;AAChC,EAAA,OAAO,CAAC,GAAG,mBAAA,EAAqB,GAAG,mBAAmB,CAAA;AACxD;AAEA,SAAS,YAAA,CACP,OACA,SAAA,EACgB;AAChB,EAAA,MAAM,GAAA,uBAAU,GAAA,EAA0B;AAE1C,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAuB;AAClC,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAC1B,IAAA,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,KAAqB,CAAA;AAAA,EAC/C,CAAA;AAEA,EAAA,KAAA,MAAW,OAAO,mBAAA,EAAqB;AACrC,IAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,EAC/B;AAEA,EAAA,KAAA,MAAW,GAAA,IAAO,SAAA,IAAa,EAAC,EAAG;AACjC,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,EAAG;AAC7C,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,IAC/B;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,IAAS,EAAC,EAAG;AAC9B,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,QAAQ,CAAA;AACnC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,MAAA,GAAA,CAAI;AAAA,QACF,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,QAAA,EAAU,QAAA;AAAA,QACV,MAAM,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO;AAAA,OACnD,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,GAAG,GAAA,CAAI,MAAA,EAAQ,CAAA;AACzB;AAEA,SAAS,cAAc,IAAA,EAAqC;AAC1D,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,SAAA;AACrC,EAAA,OAAO,IAAA,CAAK,QAAA;AACd;AAEA,SAAS,SAAA,CACP,IAAA,EACA,KAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,WAAA;AAErC,EAAA,MAAM,QAAA,GAAW,gBAAgB,KAAK,CAAA;AACtC,EAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,WAAA;AACnC,IAAA,MAAM,IAAA,GAAO,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAC9C,IAAA,OAAO,QAAA,CAAS,MAAA,IAAU,IAAA,GAAO,CAAA,EAAG,QAAQ,CAAA,MAAA,CAAA,GAAM,CAAA,EAAG,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,IAAI,CAAC,CAAA,MAAA,CAAA;AAAA,EAC9E;AAEA,EAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAQ;AAC5B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,gBAAA;AACnC,IAAA,OAAO,CAAA,MAAA,EAAS,UAAA,CAAW,QAAQ,CAAC,CAAA,CAAA,CAAA;AAAA,EACtC;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,SAAA,CAAU,MAAc,GAAA,EAAqB;AACpD,EAAA,IAAI,4BAAA,CAA6B,IAAA,CAAK,GAAG,CAAA,EAAG;AAC1C,IAAA,OAAO,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,GAAK,GAAA;AAAA,EACnC;AACA,EAAA,OAAO,GAAG,IAAA,IAAQ,GAAG,IAAI,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,CAAA;AAC9C;AAEA,SAAS,SAAA,CAAU,MAAc,KAAA,EAAuB;AACtD,EAAA,OAAO,CAAA,EAAG,IAAA,IAAQ,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,CAAA;AAChC;AAEA,SAAS,YACP,IAAA,EACA,QAAA,EACA,QACA,SAAA,EACA,QAAA,GAA8B,WAC9B,OAAA,EACkB;AAClB,EAAA,OAAO,OAAA,KAAY,MAAA,GACf,EAAE,IAAA,EAAM,UAAU,MAAA,EAAQ,QAAA,EAAU,SAAA,EAAU,GAC9C,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,QAAA,EAAU,WAAW,OAAA,EAAQ;AAC7D;AAEO,SAAS,sBAAA,CAAuB,UAA4B,OAAA,EAAmC;AACpG,EAAA,QAAQ,OAAA;AAAS,IACf,KAAK,OAAA;AACH,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,SAAA,EAAW,EAAC,EAAE;AAAA,IAC3C,KAAK,OAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,OAAA;AAAA,QACT,SAAA,EAAW,wBAAA;AAAA,QACX,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA,IACF,KAAK,QAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,QAAA;AAAA,QACT,SAAA,EAAW,CAAC,GAAG,wBAAA,EAA0B,GAAG,yBAAyB,CAAA;AAAA,QACrE,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA;AAEN;AAEO,IAAM,WAAN,MAAe;AAAA,EACX,MAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA;AAAA,EAET,YAAY,OAAA,EAA2B;AACrC,IAAA,MAAM,QAAA,GAAW,sBAAA,CAAuB,OAAA,EAAS,OAAA,IAAW,OAAO,CAAA;AACnE,IAAA,IAAA,CAAK,WAAW,QAAA,CAAS,OAAA;AACzB,IAAA,IAAA,CAAK,MAAA,GAAS,YAAA,CAAa,OAAA,EAAS,KAAA,EAAO;AAAA,MACzC,GAAG,QAAA,CAAS,SAAA;AAAA,MACZ,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC5B,CAAA;AACD,IAAA,IAAA,CAAK,UAAA,GAAa;AAAA,MAChB,GAAG,0BAAA,CAA2B,IAAA,CAAK,QAAQ,CAAA;AAAA,MAC3C,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC7B;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,SAAS,WAAA,IAAe,YAAA;AAC5C,IAAA,IAAA,CAAK,SAAA,GAAY,SAAS,QAAA,IAAY,EAAA;AACtC,IAAA,IAAA,CAAK,gBAAA,GAAmB,SAAS,eAAA,IAAmB,IAAA;AAAA,EACtD;AAAA,EAEA,WAAA,CAAY,KAAa,KAAA,EAAyB;AAChD,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,KAAA,EAAO,GAAA,EAAK,KAAK,CAAA,EAAG;AAAA,MAC3C,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACpC,CAAA;AAAA,EACH;AAAA,EAEA,aAAa,MAAA,EAA0D;AACrE,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA;AAAA,EAC7B;AAAA,EAEA,OAAoB,KAAA,EAA8B;AAChD,IAAA,MAAM,KAAA,GAAwB;AAAA,MAC5B,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACrC;AACA,IAAA,MAAM,WAAW,IAAA,CAAK,YAAA,CAAa,OAAO,MAAA,EAAW,GAAA,EAAK,GAAG,KAAK,CAAA;AAClE,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,QAAA;AAAA,MACP,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAA,EAAU,MAAM,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,WAAW,MAAM,CAAA;AAAA,MACpE,SAAS,IAAA,CAAK;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,cAAA,CAAe,OAAuB,OAAA,EAAiC;AACrE,IAAA,IAAI,IAAA,CAAK,gBAAA,EAAkB,KAAA,CAAM,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,EACxD;AAAA,EAEA,YAAA,CACE,KAAA,EACA,GAAA,EACA,IAAA,EACA,OACA,KAAA,EACS;AACT,IAAA,IAAI,KAAA,GAAQ,KAAK,SAAA,EAAW;AAC1B,MAAA,IAAA,CAAK,cAAA;AAAA,QACH,KAAA;AAAA,QACA,WAAA,CAAY,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,SAAS,SAAS;AAAA,OACxE;AACA,MAAA,OAAO,aAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,MAAM,IAAA,GAAO,mBAAA,CAAoB,GAAA,EAAK,IAAA,CAAK,MAAM,CAAA;AACjD,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA,CAAY,IAAA,EAAM,CAAA,IAAA,EAAO,IAAA,CAAK,GAAG,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS;AAAA,SAC5E;AACA,QAAA,OAAO,SAAA,CAAU,IAAA,EAAM,KAAA,EAAO,IAAA,CAAK,YAAY,CAAA;AAAA,MACjD;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,QAAA,IAAY,KAAK,UAAA,EAAY;AACtC,MAAA,MAAM,aAAa,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,GAAA,EAAK,OAAO,CAAA;AACvD,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,MAAM,MAAA,GAAS,UAAU,MAAA,IAAU,SAAA;AACnC,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA;AAAA,YACE,IAAA;AAAA,YACA,QAAA,CAAS,EAAA;AAAA,YACT,MAAA;AAAA,YACA,SAAA,CAAU,SAAA,IAAa,QAAA,CAAS,SAAA,IAAa,QAAA;AAAA,YAC7C,SAAA,CAAU,QAAA,IAAY,QAAA,CAAS,QAAA,IAAY,SAAA;AAAA,YAC3C,SAAA,CAAU;AAAA;AACZ,SACF;AACA,QAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,UAAA,OAAO,SAAA,CAAU,eAAe,IAAA,CAAK,YAAA;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAAiB,EAAC;AACxB,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,KAAA,KAAU;AAC7B,QAAA,GAAA,CAAI,KAAK,CAAA,GAAI,IAAA,CAAK,YAAA,CAAa,IAAA,EAAM,MAAA,EAAW,SAAA,CAAU,IAAA,EAAM,KAAK,CAAA,EAAG,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,MAC1F,CAAC,CAAA;AACD,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAA,CAAS,KAAK,CAAA,EAAG;AACnB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAA+B,EAAC;AACtC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,MAAW,CAAC,QAAA,EAAU,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1D,QAAA,GAAA,CAAI,QAAQ,IAAI,IAAA,CAAK,YAAA;AAAA,UACnB,UAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA,CAAU,IAAA,KAAS,GAAA,GAAM,EAAA,GAAK,MAAM,QAAQ,CAAA;AAAA,UAC5C,KAAA,GAAQ,CAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;AAEO,SAAS,eAAe,OAAA,EAAqC;AAClE,EAAA,OAAO,IAAI,SAAS,OAAO,CAAA;AAC7B;AAEO,SAAS,MAAA,CAAoB,OAAU,OAAA,EAA6C;AACzF,EAAA,OAAO,cAAA,CAAe,OAAO,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC7C;;;AC/mBA,IAAM,0BAAA,GAA6B;AAAA,EACjC,8BAAA;AAAA,EACA,kBAAA;AAAA,EACA,6BAAA;AAAA,EACA,eAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,IAAA,CAAK,QAAgB,OAAA,EAAkC;AAC9D,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAQ,MAAA,EAAQ,UAAU,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAU,EAAC,EAAE;AAC3E;AAEA,SAAS,IAAA,CACP,MAAA,EACA,OAAA,EACA,QAAA,EACA,WAAgC,OAAA,EACf;AACjB,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAQ,QAAA,KAAa,YAAY,MAAA,GAAS,MAAA,EAAQ,QAAA,EAAU,OAAA,EAAS,QAAA,EAAS;AACjG;AAEA,SAAS,cAAA,CAAe,KAAA,EAAe,GAAA,GAAM,EAAA,EAAY;AACvD,EAAA,IAAI,KAAA,CAAM,MAAA,IAAU,GAAA,EAAK,OAAO,KAAA;AAChC,EAAA,OAAO,GAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,GAAA,GAAM,CAAC,CAAC,CAAA,GAAA,CAAA;AACnC;AAEO,SAAS,oBAAA,CACd,MACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,yBAAA;AACf,EAAA,MAAM,WAAW,OAAA,CAAQ,eAAA,KAAoB,KAAA,GAAQ,IAAA,CAAK,aAAY,GAAI,IAAA;AAC1E,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,MAAA,IAAU,QAAQ,OAAA,EAAS;AACpC,IAAA,MAAM,SAAS,OAAA,CAAQ,eAAA,KAAoB,KAAA,GAAQ,MAAA,CAAO,aAAY,GAAI,MAAA;AAC1E,IAAA,IAAI,OAAO,MAAA,GAAS,CAAA,IAAK,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG;AAClD,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,QAAQ,OAAA,EAAS,cAAA,CAAe,IAAI,CAAA,EAAG,CAAA;AAAA,IACxE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,4BAA4B,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,QAAA,EAAW,QAAA,CAAS,MAAM,sBAAsB,QAAQ,CAAA;AAC9E;AAEA,IAAM,gBAAgB,EAAE,IAAA,EAAM,GAAG,OAAA,EAAS,CAAA,EAAG,OAAO,CAAA,EAAE;AAE/C,SAAS,eAAA,CAAgB,KAAA,EAAgB,OAAA,GAA0B,EAAC,EAAoB;AAC7F,EAAA,MAAM,MAAA,GAAS,oBAAA;AACf,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,SAAA;AAC3C,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,EAAO,EAAE,OAAA,EAAS,QAAQ,OAAA,IAAW,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,CAAA;AAC3F,EAAA,MAAM,QAAA,GAAW,OAAO,QAAA,CAAS,MAAA;AAAA,IAC/B,CAAC,OAAA,KAA8B,aAAA,CAAc,QAAQ,QAAQ,CAAA,IAAK,cAAc,WAAW;AAAA,GAC7F;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,kCAAkC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,QAAA,GAAgC,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,MAAa;AAAA,IAC/D,MAAA;AAAA,IACA,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,SAAS,OAAA,CAAQ;AAAA,GACnB,CAAE,CAAA;AACF,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,SAAA,EAAY,QAAA,CAAS,MAAM,0BAA0B,QAAQ,CAAA;AACnF;AAEA,SAAS,aAAa,KAAA,EAAwB;AAC5C,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,UAAU,OAAO,CAAA;AACxD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS,YAAA,CAAa,IAAI,CAAC,CAAC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,KAAgC,CAAA,CAAE,IAAI,CAAC,IAAA,KAAS,YAAA,CAAa,IAAI,CAAC,CAAA;AAC/F,EAAA,OAAO,CAAA,IAAK,OAAO,MAAA,KAAW,CAAA,GAAI,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,MAAM,CAAA,CAAA;AAC1D;AAEA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA,CAAM,MAAA;AAC5C,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,UAAU,OAAO,CAAA;AACxD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS,eAAA,CAAgB,IAAI,CAAC,CAAC,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,OAAO,MAAA,CAAO,KAAgC,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS,eAAA,CAAgB,IAAI,CAAC,CAAC,CAAA;AAC5G;AAEO,SAAS,sBAAA,CACd,QAAA,EACA,QAAA,EACA,OAAA,GAAiC,EAAC,EACjB;AACjB,EAAA,MAAM,MAAA,GAAS,4BAAA;AACf,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAA,CAAK,OAAA,CAAQ,YAAA,IAAgB,EAAC,EAAG,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,WAAA,EAAa,CAAC,CAAA;AACtF,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA,EAAG;AACvC,IAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,SAAS,QAAA,EAAU,KAAA,EAAO,UAAU,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,EAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,aAAa,QAAQ,CAAA;AACnC,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,QAAQ,OAAA,EAAS,CAAA,MAAA,EAAS,KAAK,CAAA,CAAA,EAAI,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,MAAA,GAAS,QAAQ,eAAA,IAAmB,KAAA;AAC1C,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,IAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,QAAQ,OAAA,EAAS,CAAA,gBAAA,EAAmB,OAAO,CAAA,CAAA,EAAI,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,0CAA0C,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,8CAAA,EAAgD,QAAQ,CAAA;AAC9E;AAEO,SAAS,uBAAA,CACd,IAAA,EACA,OAAA,GAAkC,EAAC,EAClB;AACjB,EAAA,MAAM,MAAA,GAAS,4BAAA;AACf,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,0BAAA;AACrC,EAAA,MAAM,QAAA,GAAW,KAAK,WAAA,EAAY;AAClC,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAM,MAAA,GAAS,QAAQ,WAAA,EAAY;AACnC,IAAA,IAAI,OAAO,MAAA,GAAS,CAAA,IAAK,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG;AAClD,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,SAAS,OAAA,EAAS,cAAA,CAAe,IAAI,CAAA,EAAG,CAAA;AAAA,IACzE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,uCAAuC,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,QAAA,EAAW,SAAS,MAAM,CAAA,sBAAA,CAAA,EAA0B,UAAU,SAAS,CAAA;AAC7F;AAEA,SAAS,mBAAA,CACP,KAAA,EACA,KAAA,EACA,IAAA,EACA,QAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,6BAAA;AACf,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,MAAM,MAAA,GACJ,UAAU,IAAA,GACN,MAAA,GACA,MAAM,OAAA,CAAQ,KAAK,CAAA,GACjB,OAAA,GACA,OAAO,KAAA;AACf,IAAA,IAAI,MAAA,KAAW,MAAM,IAAA,EAAM;AACzB,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAA,SAAA,EAAY,KAAA,CAAM,IAAI,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAI,CAAA;AAChF,MAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,IAAQ,CAAC,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,CAAC,IAAA,KAAS,MAAA,CAAO,EAAA,CAAG,IAAA,EAAM,KAAK,CAAC,CAAA,EAAG;AACpE,IAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,qBAAqB,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,QAAA,IAAY,KAAA,CAAM,QAAA,IAAY,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5G,IAAA,MAAM,MAAA,GAAS,KAAA;AACf,IAAA,KAAA,MAAW,GAAA,IAAO,MAAM,QAAA,EAAU;AAChC,MAAA,IAAI,EAAE,OAAO,MAAA,CAAA,EAAS;AACpB,QAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,OAAA,EAAS,sBAAA,EAAwB,CAAA;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wBAAA,CACd,OACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,6BAAA;AACf,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/D,IAAA,OAAO,IAAA,CAAK,QAAQ,sCAAA,EAAwC;AAAA,MAC1D,EAAE,MAAA,EAAQ,OAAA,EAAS,OAAO,KAAA;AAAM,KACjC,CAAA;AAAA,EACH;AACA,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzD,IAAA,mBAAA,CAAoB,MAAA,CAAO,GAAG,CAAA,EAAG,KAAA,EAAO,KAAK,QAAQ,CAAA;AAAA,EACvD;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,0CAA0C,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,qCAAA,EAAuC,QAAQ,CAAA;AACrE;AAEO,SAAS,sBAAA,CACd,KAAA,EACA,OAAA,GAAiC,EAAC,EACjB;AACjB,EAAA,MAAM,MAAA,GAAS,2BAAA;AACf,EAAA,MAAM,OAAO,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,IAAA,CAAK,UAAU,KAAK,CAAA;AACrE,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,mBAAA,IAAuB,KAAA;AACtE,EAAA,IAAI,IAAA,CAAK,UAAU,SAAA,EAAW;AAC5B,IAAA,OAAO,IAAA,CAAK,QAAQ,4BAA4B,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,2BAAA,EAA8B,KAAK,MAAM,CAAA,GAAA,EAAM,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,IAChF,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAG,GAC5C,CAAA;AACH;AAEO,SAAS,yBAAA,CACd,OACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,+BAAA;AACf,EAAA,IAAI,MAAA,GAAkB,KAAA;AACtB,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,0BAAA,EAA4B,CAAC,EAAE,MAAA,EAAQ,OAAA,EAAS,cAAA,CAAe,KAAK,CAAA,EAAG,CAAC,CAAA;AAAA,IAC9F;AAAA,EACF;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,IAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,+BAAA,EAAiC,CAAC,EAAE,QAAQ,OAAA,EAAS,OAAO,MAAA,EAAQ,CAAC,CAAA;AAAA,EAC3F;AACA,EAAA,MAAM,MAAA,GAAS,MAAA;AACf,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,GAAA,IAAO,QAAQ,YAAA,EAAc;AACtC,IAAA,IAAI,EAAE,OAAO,MAAA,CAAA,EAAS;AACpB,MAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,MAAM,GAAA,EAAK,OAAA,EAAS,wBAAwB,CAAA;AAAA,IACtE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,6BAA6B,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,6BAAA,EAA+B,QAAQ,CAAA;AAC7D;;;AChOA,IAAM,SAAA,GAA+B;AAAA,EACnC,yBAAA;AAAA,EACA,oBAAA;AAAA,EACA,4BAAA;AAAA,EACA,4BAAA;AAAA,EACA,6BAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACF;AAEA,SAAS,eAAe,MAAA,EAAkC;AACxD,EAAA,OAAO,MAAA,CAAO,MAAA,KAAW,MAAA,IAAU,MAAA,CAAO,QAAA,KAAa,OAAA;AACzD;AAEA,SAAS,OAAA,CAAQ,MAAA,EAAyB,KAAA,EAAuB,OAAA,EAA4D;AAC3H,EAAA,QAAQ,MAAA;AAAQ,IACd,KAAK,yBAAA,EAA2B;AAC9B,MAAA,IAAI,CAAC,OAAA,CAAQ,YAAA,IAAgB,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAC9D,MAAA,OAAO,oBAAA,CAAqB,KAAA,CAAM,IAAA,EAAM,OAAA,CAAQ,YAAY,CAAA;AAAA,IAC9D;AAAA,IACA,KAAK,oBAAA,EAAsB;AACzB,MAAA,IAAI,MAAM,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAClE,MAAA,OAAO,gBAAgB,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAM,QAAQ,OAAO,CAAA;AAAA,IACnE;AAAA,IACA,KAAK,4BAAA,EAA8B;AACjC,MAAA,IAAI,CAAC,KAAA,CAAM,QAAA,EAAU,OAAO,MAAA;AAC5B,MAAA,OAAO,sBAAA,CAAuB,MAAM,QAAA,EAAU,KAAA,CAAM,YAAY,EAAC,EAAG,QAAQ,cAAc,CAAA;AAAA,IAC5F;AAAA,IACA,KAAK,4BAAA,EAA8B;AACjC,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,EAAW,OAAO,MAAA;AACrC,MAAA,OAAO,uBAAA,CAAwB,KAAA,CAAM,IAAA,EAAM,OAAA,CAAQ,eAAe,CAAA;AAAA,IACpE;AAAA,IACA,KAAK,6BAAA,EAA+B;AAClC,MAAA,IAAI,CAAC,OAAA,CAAQ,gBAAA,IAAoB,KAAA,CAAM,KAAA,KAAU,QAAW,OAAO,MAAA;AACnE,MAAA,OAAO,wBAAA,CAAyB,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,gBAAgB,CAAA;AAAA,IACvE;AAAA,IACA,KAAK,2BAAA,EAA6B;AAChC,MAAA,IAAI,MAAM,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAClE,MAAA,OAAO,uBAAuB,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAM,QAAQ,cAAc,CAAA;AAAA,IACjF;AAAA,IACA,KAAK,+BAAA,EAAiC;AACpC,MAAA,IAAI,CAAC,QAAQ,iBAAA,IAAsB,KAAA,CAAM,UAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,MAAA,EAAY,OAAO,MAAA;AAClG,MAAA,OAAO,0BAA0B,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAO,QAAQ,iBAAiB,CAAA;AAAA,IACxF;AAAA,IACA;AACE,MAAA,OAAO,MAAA;AAAA;AAEb;AAEO,SAAS,aAAA,CAAc,KAAA,EAAuB,OAAA,GAAgC,EAAC,EAAuB;AAC3G,EAAA,MAAM,QAAA,GAAW,QAAQ,KAAA,IAAS,SAAA;AAClC,EAAA,MAAM,UAA6B,EAAC;AACpC,EAAA,KAAA,MAAW,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA;AAAA,EACjC;AACA,EAAA,MAAM,EAAA,GAAK,CAAC,OAAA,CAAQ,IAAA,CAAK,cAAc,CAAA;AACvC,EAAA,OAAO,EAAE,IAAI,OAAA,EAAQ;AACvB","file":"index.cjs","sourcesContent":["/**\n * Mirrors `packages/core/src/safety/sensitive-key.ts` for dependency-light\n * @agent-inspect/redact consumers. Keep both copies in sync (6.14.2 parity).\n */\n\n/** True when the original key already uses an explicit separator. */\nfunction keyHasExplicitSeparator(value: string): boolean {\n  return /[_\\-.]/.test(value);\n}\n\n/**\n * Canonicalize field names so camelCase / kebab / dot / snake forms share a\n * snake_case shape the compound matcher can recognize (`userPassword` →\n * `user_password`).\n */\nexport function normalizeSensitiveKey(value: string): string {\n  return value\n    .replace(/([a-z0-9])([A-Z])/g, \"$1_$2\")\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n}\n\nexport const NON_CREDENTIAL_TOKEN_CONFIG_KEYS: ReadonlySet<string> = new Set(\n  [\n    \"tokens\",\n    \"max_tokens\",\n    \"min_tokens\",\n    \"ls_max_tokens\",\n    \"token_count\",\n    \"token_limit\",\n    \"token_budget\",\n    \"input_tokens\",\n    \"output_tokens\",\n    \"total_tokens\",\n    \"cached_tokens\",\n    \"prompt_tokens\",\n    \"completion_tokens\",\n  ].map(normalizeSensitiveKey),\n);\n\nfunction isTokenCredentialKey(normalized: string): boolean {\n  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;\n  if (normalized === \"token\") return true;\n  if (normalized.endsWith(\"tokens\")) return false;\n  return normalized.endsWith(\"token\");\n}\n\n/**\n * True when the field name looks credential-sensitive under the shared policy.\n *\n * Suffix compounds (`user_password`, `userPassword`) always match. Prefix\n * compounds (`email_note`) match only when the original key already contained\n * an explicit separator, so camelCase topic fields like `emailNote` stay for\n * value detectors instead of key redaction.\n */\nexport function isCredentialSensitiveKey(\n  key: string | undefined,\n  sensitiveKeys: readonly string[],\n): boolean {\n  if (!key) return false;\n  const normalized = normalizeSensitiveKey(key);\n  if (!normalized) return false;\n  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;\n\n  const allowPrefixCompound = keyHasExplicitSeparator(key);\n\n  for (const sensitive of sensitiveKeys) {\n    const s = normalizeSensitiveKey(sensitive);\n    if (!s) continue;\n    if (s === \"token\") {\n      if (isTokenCredentialKey(normalized)) return true;\n      continue;\n    }\n    if (normalized === s) return true;\n    if (normalized.endsWith(`_${s}`)) return true;\n    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;\n  }\n  return false;\n}\n","import crypto from \"node:crypto\";\nimport { isCredentialSensitiveKey } from \"./sensitive-key.js\";\n\nexport type RedactionProfile = \"local\" | \"share\" | \"strict\";\n\nexport type RedactionAction = \"replace\" | \"hash\" | \"prefix\" | \"truncate\" | \"keep\";\n\nexport type RedactionSeverity = \"info\" | \"warning\" | \"error\";\n\nexport type RedactionMatchKind = \"key\" | \"value\" | \"custom\";\n\nexport type RedactionRule =\n  | string\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep?: number }\n  | { key: string; strategy: \"hash\" };\n\nexport interface RedactionFinding {\n  path: string;\n  detector: string;\n  action: RedactionAction;\n  severity: RedactionSeverity;\n  matchKind: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetection {\n  action?: RedactionAction;\n  replacement?: unknown;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetectorInput {\n  path: string;\n  key?: string;\n  value: unknown;\n}\n\nexport interface RedactionDetector {\n  id: string;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  detect(input: RedactionDetectorInput): RedactionDetection[];\n}\n\nexport interface RedactionResult<T = unknown> {\n  value: T;\n  findings: RedactionFinding[];\n  redacted: boolean;\n  profile: RedactionProfile;\n}\n\nexport interface ResolvedRedactionProfile {\n  profile: RedactionProfile;\n  extraKeys: readonly string[];\n  maxMetadataValueLengthCap?: number;\n  maxPreviewLengthCap?: number;\n}\n\nexport interface RedactOptions {\n  profile?: RedactionProfile;\n  detectors?: RedactionDetector[];\n  rules?: RedactionRule[];\n  replacement?: string;\n  maxDepth?: number;\n  maxStringLength?: number;\n  collectFindings?: boolean;\n}\n\nexport interface RedactorOptions extends RedactOptions {\n  extraKeys?: readonly string[];\n}\n\nexport const DEFAULT_REDACT_KEYS = [\n  \"authorization\",\n  \"cookie\",\n  \"token\",\n  \"apiKey\",\n  \"password\",\n  \"secret\",\n  \"email\",\n] as const;\n\nexport const SHARE_PROFILE_EXTRA_KEYS = [\n  \"userEmail\",\n  \"customerEmail\",\n  \"phone\",\n  \"phoneNumber\",\n  \"address\",\n  \"ip\",\n  \"ipAddress\",\n  \"sessionId\",\n  \"requestId\",\n  \"correlationId\",\n  \"decisionId\",\n  \"groupId\",\n  \"customerId\",\n  \"userId\",\n  \"accountId\",\n  \"tenantId\",\n  \"orgId\",\n  \"organizationId\",\n  \"traceId\",\n  \"spanId\",\n  \"parentSpanId\",\n  \"currentTask\",\n  \"task\",\n  \"userInput\",\n  \"requestText\",\n  \"conversationText\",\n] as const;\n\nexport const STRICT_PROFILE_EXTRA_KEYS = [\n  \"prompt\",\n  \"completion\",\n  \"input\",\n  \"output\",\n  \"inputPreview\",\n  \"outputPreview\",\n  \"message\",\n  \"messages\",\n  \"transcript\",\n  \"context\",\n  \"document\",\n  \"documents\",\n  \"chunk\",\n  \"chunks\",\n  \"retrieval\",\n  \"query\",\n] as const;\n\ntype CompiledRule =\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep: number }\n  | { key: string; strategy: \"hash\" };\n\ninterface RedactionState {\n  findings: RedactionFinding[];\n  seen: WeakMap<object, unknown>;\n}\n\ninterface PatternDetectorOptions {\n  id: string;\n  pattern: RegExp;\n  severity?: RedactionSeverity;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n\nfunction toKey(key: string): string {\n  return key.toLowerCase();\n}\n\nfunction findCompiledKeyRule(\n  key: string,\n  rules: readonly CompiledRule[],\n): CompiledRule | undefined {\n  const exact = toKey(key);\n  const direct = rules.find((candidate) => candidate.key === exact);\n  if (direct) return direct;\n  return rules.find((candidate) => isCredentialSensitiveKey(key, [candidate.key]));\n}\n\nfunction stableHash(value: string): string {\n  const hash = crypto.createHash(\"sha256\").update(value, \"utf8\").digest(\"hex\");\n  return hash.slice(0, 8);\n}\n\nfunction stringifyScalar(value: unknown): string | undefined {\n  if (typeof value === \"string\") return value;\n  if (typeof value === \"number\" || typeof value === \"boolean\" || typeof value === \"bigint\") {\n    return String(value);\n  }\n  return undefined;\n}\n\nfunction patternDetector(options: PatternDetectorOptions): RedactionDetector {\n  return {\n    id: options.id,\n    severity: options.severity ?? \"warning\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      options.pattern.lastIndex = 0;\n      return options.pattern.test(input.value)\n        ? [{ action: \"replace\", severity: options.severity ?? \"warning\", matchKind: \"value\" }]\n        : [];\n    },\n  };\n}\n\nfunction digitsOnly(value: string): string {\n  return value.replace(/\\D/g, \"\");\n}\n\nfunction passesLuhn(value: string): boolean {\n  const digits = digitsOnly(value);\n  if (digits.length < 13 || digits.length > 19) return false;\n\n  let sum = 0;\n  let double = false;\n  for (let i = digits.length - 1; i >= 0; i -= 1) {\n    let digit = Number(digits[i]);\n    if (double) {\n      digit *= 2;\n      if (digit > 9) digit -= 9;\n    }\n    sum += digit;\n    double = !double;\n  }\n  return sum % 10 === 0;\n}\n\nconst UUID_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\n/** 13-digit Unix epoch milliseconds in a plausible modern range. */\nconst EPOCH_MS_RE = /^1[0-9]{12}$/;\n\nconst EMAIL_RE = /\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b/gi;\n\nfunction pathSuggestsNonCard(path: string): boolean {\n  const normalized = path.toLowerCase().replace(/[^a-z0-9._]/g, \"\");\n  return (\n    /(^|\\.)(tokenusage|usage)(\\.|$)/.test(normalized) ||\n    /(startedat|endedat|durationms|timestamp|createdat|updatedat)(\\.|$)/.test(normalized) ||\n    /(^|\\.)(runid|traceid|spanid|eventid|sessionid|userid|parentid|requestid|correlationid)(\\.|$)/.test(\n      normalized,\n    ) ||\n    /(^|\\.)ts(\\.|$)/.test(normalized)\n  );\n}\n\nfunction isUuidLike(value: string): boolean {\n  return UUID_RE.test(value.trim());\n}\n\nfunction isPlausibleCardCandidate(candidate: string, fullValue: string): boolean {\n  const digits = digitsOnly(candidate);\n  if (digits.length < 13 || digits.length > 19) return false;\n  if (!passesLuhn(candidate)) return false;\n\n  const trimmed = fullValue.trim();\n  if (isUuidLike(trimmed)) return false;\n\n  // Naked epoch-ms timestamps are not PANs.\n  if (EPOCH_MS_RE.test(digits) && digitsOnly(trimmed) === digits && /^\\d+$/.test(trimmed)) {\n    return false;\n  }\n\n  // Reject candidates glued inside longer alphanumeric IDs without card separators.\n  const start = fullValue.indexOf(candidate);\n  if (start >= 0) {\n    const before = fullValue[start - 1];\n    const after = fullValue[start + candidate.length];\n    if (before && /[A-Za-z0-9_]/.test(before)) return false;\n    if (after && /[A-Za-z0-9_]/.test(after)) return false;\n  }\n\n  return true;\n}\n\nfunction looksLikePathOrPackageOrUrl(value: string): boolean {\n  const trimmed = value.trim();\n  if (/^(?:[a-z][a-z0-9+.-]*:)?\\/\\//i.test(trimmed)) return true;\n  if (/^webpack:/i.test(trimmed)) return true;\n  if (/^@[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.@/-]+$/.test(trimmed)) return true;\n  if (/^[A-Za-z]:[\\\\/]/.test(trimmed) || /^[/\\\\]/.test(trimmed)) return true;\n  // Path-like single token (slashes, no whitespace).\n  if (/[\\\\/]/.test(trimmed) && !/\\s/.test(trimmed)) return true;\n  return false;\n}\n\nfunction emailMatchIsPathAdjacent(value: string, index: number, length: number): boolean {\n  const before = value[index - 1];\n  const after = value[index + length];\n  return before === \"/\" || before === \"\\\\\" || after === \"/\" || after === \"\\\\\";\n}\n\nfunction valueContainsEmail(value: string): boolean {\n  if (looksLikePathOrPackageOrUrl(value)) return false;\n  EMAIL_RE.lastIndex = 0;\n  for (const match of value.matchAll(EMAIL_RE)) {\n    const text = match[0] ?? \"\";\n    const index = match.index ?? 0;\n    if (emailMatchIsPathAdjacent(value, index, text.length)) continue;\n    return true;\n  }\n  return false;\n}\n\nconst credentialDetectors: readonly RedactionDetector[] = [\n  patternDetector({\n    id: \"value.authorizationHeader\",\n    pattern: /^(?:basic|bearer|digest|apikey)\\s+[a-z0-9._~+/=-]+$/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.bearerToken\",\n    pattern: /\\bbearer\\s+[a-z0-9._~+/=-]{12,}\\b/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.cookie\",\n    pattern: /\\b[a-z0-9_.-]+=[^;\\s]+(?:;\\s*[a-z0-9_.-]+=[^;\\s]+)+/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.jwt\",\n    pattern: /\\beyJ[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.providerApiKey\",\n    pattern: /\\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.githubToken\",\n    pattern: /\\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.awsAccessKey\",\n    pattern: /\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.privateKey\",\n    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*-----END [A-Z ]*PRIVATE KEY-----/,\n    severity: \"error\",\n  }),\n  {\n    id: \"value.creditCard\",\n    severity: \"error\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      if (pathSuggestsNonCard(input.path)) return [];\n      if (isUuidLike(input.value)) return [];\n      const candidatePattern = /(?:\\d[ -]?){13,19}/g;\n      for (const match of input.value.matchAll(candidatePattern)) {\n        const candidate = match[0] ?? \"\";\n        if (isPlausibleCardCandidate(candidate, input.value)) {\n          return [{ action: \"replace\", severity: \"error\", matchKind: \"value\" }];\n        }\n      }\n      return [];\n    },\n  },\n];\n\nconst identifierDetectors: readonly RedactionDetector[] = [\n  {\n    id: \"value.email\",\n    severity: \"warning\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      return valueContainsEmail(input.value)\n        ? [{ action: \"replace\", severity: \"warning\", matchKind: \"value\" }]\n        : [];\n    },\n  },\n  patternDetector({\n    id: \"value.phone\",\n    pattern: /\\b(?:\\+\\d{1,3}[\\s.-]?)?(?:\\(?\\d{3}\\)?[\\s.-])\\d{3}[\\s.-]\\d{4}\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv4\",\n    pattern: /\\b(?:(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv6\",\n    pattern: /\\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\\b/i,\n  }),\n];\n\nfunction builtInDetectorsForProfile(profile: RedactionProfile): readonly RedactionDetector[] {\n  if (profile === \"local\") return credentialDetectors;\n  return [...credentialDetectors, ...identifierDetectors];\n}\n\nfunction compileRules(\n  rules?: RedactionRule[],\n  extraKeys?: readonly string[],\n): CompiledRule[] {\n  const out = new Map<string, CompiledRule>();\n\n  const set = (rule: CompiledRule) => {\n    const key = toKey(rule.key);\n    out.set(key, { ...rule, key } as CompiledRule);\n  };\n\n  for (const key of DEFAULT_REDACT_KEYS) {\n    set({ key, strategy: \"full\" });\n  }\n\n  for (const key of extraKeys ?? []) {\n    if (typeof key === \"string\" && key.length > 0) {\n      set({ key, strategy: \"full\" });\n    }\n  }\n\n  for (const rule of rules ?? []) {\n    if (typeof rule === \"string\") {\n      set({ key: rule, strategy: \"full\" });\n      continue;\n    }\n\n    if (rule.strategy === \"full\") set({ key: rule.key, strategy: \"full\" });\n    if (rule.strategy === \"hash\") set({ key: rule.key, strategy: \"hash\" });\n    if (rule.strategy === \"prefix\") {\n      set({\n        key: rule.key,\n        strategy: \"prefix\",\n        keep: typeof rule.keep === \"number\" ? rule.keep : 8,\n      });\n    }\n  }\n\n  return [...out.values()];\n}\n\nfunction actionForRule(rule: CompiledRule): RedactionAction {\n  if (rule.strategy === \"full\") return \"replace\";\n  return rule.strategy;\n}\n\nfunction applyRule(\n  rule: CompiledRule,\n  value: unknown,\n  replacement: string,\n): unknown {\n  if (rule.strategy === \"full\") return replacement;\n\n  const asString = stringifyScalar(value);\n  if (rule.strategy === \"prefix\") {\n    if (asString === undefined) return replacement;\n    const keep = Math.max(0, Math.floor(rule.keep));\n    return asString.length <= keep ? `${asString}…` : `${asString.slice(0, keep)}…`;\n  }\n\n  if (rule.strategy === \"hash\") {\n    if (asString === undefined) return \"[HASH:unknown]\";\n    return `[HASH:${stableHash(asString)}]`;\n  }\n\n  return value;\n}\n\nfunction childPath(path: string, key: string): string {\n  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {\n    return path ? `${path}.${key}` : key;\n  }\n  return `${path || \"$\"}[${JSON.stringify(key)}]`;\n}\n\nfunction indexPath(path: string, index: number): string {\n  return `${path || \"$\"}[${index}]`;\n}\n\nfunction makeFinding(\n  path: string,\n  detector: string,\n  action: RedactionAction,\n  matchKind: RedactionMatchKind,\n  severity: RedactionSeverity = \"warning\",\n  preview?: string,\n): RedactionFinding {\n  return preview === undefined\n    ? { path, detector, action, severity, matchKind }\n    : { path, detector, action, severity, matchKind, preview };\n}\n\nexport function createRedactionProfile(profile: RedactionProfile = \"local\"): ResolvedRedactionProfile {\n  switch (profile) {\n    case \"local\":\n      return { profile: \"local\", extraKeys: [] };\n    case \"share\":\n      return {\n        profile: \"share\",\n        extraKeys: SHARE_PROFILE_EXTRA_KEYS,\n        maxMetadataValueLengthCap: 500,\n        maxPreviewLengthCap: 200,\n      };\n    case \"strict\":\n      return {\n        profile: \"strict\",\n        extraKeys: [...SHARE_PROFILE_EXTRA_KEYS, ...STRICT_PROFILE_EXTRA_KEYS],\n        maxMetadataValueLengthCap: 200,\n        maxPreviewLengthCap: 80,\n      };\n  }\n}\n\nexport class Redactor {\n  readonly #rules: CompiledRule[];\n  readonly #detectors: readonly RedactionDetector[];\n  readonly #profile: RedactionProfile;\n  readonly #replacement: string;\n  readonly #maxDepth: number;\n  readonly #collectFindings: boolean;\n\n  constructor(options?: RedactorOptions) {\n    const resolved = createRedactionProfile(options?.profile ?? \"local\");\n    this.#profile = resolved.profile;\n    this.#rules = compileRules(options?.rules, [\n      ...resolved.extraKeys,\n      ...(options?.extraKeys ?? []),\n    ]);\n    this.#detectors = [\n      ...builtInDetectorsForProfile(this.#profile),\n      ...(options?.detectors ?? []),\n    ];\n    this.#replacement = options?.replacement ?? \"[REDACTED]\";\n    this.#maxDepth = options?.maxDepth ?? 32;\n    this.#collectFindings = options?.collectFindings ?? true;\n  }\n\n  redactValue(key: string, value: unknown): unknown {\n    return this.#redactValue(value, key, key, 0, {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    });\n  }\n\n  redactRecord(record: Record<string, unknown>): Record<string, unknown> {\n    return this.redact(record).value as Record<string, unknown>;\n  }\n\n  redact<T = unknown>(value: T): RedactionResult<T> {\n    const state: RedactionState = {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    };\n    const redacted = this.#redactValue(value, undefined, \"$\", 0, state);\n    return {\n      value: redacted as T,\n      findings: state.findings,\n      redacted: state.findings.some((finding) => finding.action !== \"keep\"),\n      profile: this.#profile,\n    };\n  }\n\n  #recordFinding(state: RedactionState, finding: RedactionFinding): void {\n    if (this.#collectFindings) state.findings.push(finding);\n  }\n\n  #redactValue(\n    value: unknown,\n    key: string | undefined,\n    path: string,\n    depth: number,\n    state: RedactionState,\n  ): unknown {\n    if (depth > this.#maxDepth) {\n      this.#recordFinding(\n        state,\n        makeFinding(path, \"structure.maxDepth\", \"truncate\", \"value\", \"warning\"),\n      );\n      return \"[Truncated]\";\n    }\n\n    if (key !== undefined) {\n      const rule = findCompiledKeyRule(key, this.#rules);\n      if (rule) {\n        this.#recordFinding(\n          state,\n          makeFinding(path, `key.${rule.key}`, actionForRule(rule), \"key\", \"warning\"),\n        );\n        return applyRule(rule, value, this.#replacement);\n      }\n    }\n\n    for (const detector of this.#detectors) {\n      const detections = detector.detect({ path, key, value });\n      for (const detection of detections) {\n        const action = detection.action ?? \"replace\";\n        this.#recordFinding(\n          state,\n          makeFinding(\n            path,\n            detector.id,\n            action,\n            detection.matchKind ?? detector.matchKind ?? \"custom\",\n            detection.severity ?? detector.severity ?? \"warning\",\n            detection.preview,\n          ),\n        );\n        if (action !== \"keep\") {\n          return detection.replacement ?? this.#replacement;\n        }\n      }\n    }\n\n    if (Array.isArray(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: unknown[] = [];\n      state.seen.set(value, out);\n      value.forEach((item, index) => {\n        out[index] = this.#redactValue(item, undefined, indexPath(path, index), depth + 1, state);\n      });\n      return out;\n    }\n\n    if (isRecord(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: Record<string, unknown> = {};\n      state.seen.set(value, out);\n      for (const [entryKey, entryValue] of Object.entries(value)) {\n        out[entryKey] = this.#redactValue(\n          entryValue,\n          entryKey,\n          childPath(path === \"$\" ? \"\" : path, entryKey),\n          depth + 1,\n          state,\n        );\n      }\n      return out;\n    }\n\n    return value;\n  }\n}\n\nexport function createRedactor(options?: RedactorOptions): Redactor {\n  return new Redactor(options);\n}\n\nexport function redact<T = unknown>(value: T, options?: RedactOptions): RedactionResult<T> {\n  return createRedactor(options).redact(value);\n}\n","import { redact, type RedactionFinding } from \"@agent-inspect/redact\";\n\nimport type {\n  BannedPhraseOptions,\n  GuardrailEvidence,\n  GuardrailResult,\n  OversizeOutputOptions,\n  PiiLeakOptions,\n  PromptInjectionOptions,\n  RequiredJsonShapeOptions,\n  StructuredOutputOptions,\n  UnsafeToolArgsOptions,\n} from \"./types.js\";\n\nconst DEFAULT_INJECTION_PATTERNS = [\n  \"ignore previous instructions\",\n  \"ignore all prior\",\n  \"disregard your instructions\",\n  \"system prompt\",\n  \"you are now\",\n  \"jailbreak\",\n] as const;\n\nfunction pass(ruleId: string, message: string): GuardrailResult {\n  return { ruleId, status: \"pass\", severity: \"info\", message, evidence: [] };\n}\n\nfunction fail(\n  ruleId: string,\n  message: string,\n  evidence: GuardrailEvidence[],\n  severity: \"error\" | \"warning\" = \"error\",\n): GuardrailResult {\n  return { ruleId, status: severity === \"warning\" ? \"warn\" : \"fail\", severity, message, evidence };\n}\n\nfunction boundedPreview(value: string, max = 80): string {\n  if (value.length <= max) return value;\n  return `${value.slice(0, max - 3)}...`;\n}\n\nexport function evaluateBannedPhrase(\n  text: string,\n  options: BannedPhraseOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.banned-phrase\";\n  const haystack = options.caseInsensitive !== false ? text.toLowerCase() : text;\n  const evidence: GuardrailEvidence[] = [];\n  for (const phrase of options.phrases) {\n    const needle = options.caseInsensitive !== false ? phrase.toLowerCase() : phrase;\n    if (needle.length > 0 && haystack.includes(needle)) {\n      evidence.push({ ruleId, match: phrase, preview: boundedPreview(text) });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"No banned phrases matched.\");\n  }\n  return fail(ruleId, `Matched ${evidence.length} banned phrase(s).`, evidence);\n}\n\nconst SEVERITY_RANK = { info: 0, warning: 1, error: 2 } as const;\n\nexport function evaluatePiiLeak(value: unknown, options: PiiLeakOptions = {}): GuardrailResult {\n  const ruleId = \"guardrail.pii-leak\";\n  const minSeverity = options.minSeverity ?? \"warning\";\n  const result = redact(value, { profile: options.profile ?? \"share\", collectFindings: true });\n  const findings = result.findings.filter(\n    (finding: RedactionFinding) => SEVERITY_RANK[finding.severity] >= SEVERITY_RANK[minSeverity],\n  );\n  if (findings.length === 0) {\n    return pass(ruleId, \"No PII-style redaction findings.\");\n  }\n  const evidence: GuardrailEvidence[] = findings.map((finding) => ({\n    ruleId,\n    path: finding.path,\n    detector: finding.detector,\n    preview: finding.preview,\n  }));\n  return fail(ruleId, `Detected ${findings.length} PII-style finding(s).`, evidence);\n}\n\nfunction measureDepth(value: unknown): number {\n  if (value === null || typeof value !== \"object\") return 0;\n  if (Array.isArray(value)) {\n    return 1 + Math.max(0, ...value.map((item) => measureDepth(item)));\n  }\n  const depths = Object.values(value as Record<string, unknown>).map((item) => measureDepth(item));\n  return 1 + (depths.length === 0 ? 0 : Math.max(...depths));\n}\n\nfunction maxStringLength(value: unknown): number {\n  if (typeof value === \"string\") return value.length;\n  if (value === null || typeof value !== \"object\") return 0;\n  if (Array.isArray(value)) {\n    return Math.max(0, ...value.map((item) => maxStringLength(item)));\n  }\n  return Math.max(0, ...Object.values(value as Record<string, unknown>).map((item) => maxStringLength(item)));\n}\n\nexport function evaluateUnsafeToolArgs(\n  toolName: string,\n  toolArgs: unknown,\n  options: UnsafeToolArgsOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.unsafe-tool-args\";\n  const blocked = new Set((options.blockedTools ?? []).map((name) => name.toLowerCase()));\n  const evidence: GuardrailEvidence[] = [];\n  if (blocked.has(toolName.toLowerCase())) {\n    evidence.push({ ruleId, preview: toolName, match: toolName });\n  }\n  const maxDepth = options.maxDepth ?? 12;\n  const depth = measureDepth(toolArgs);\n  if (depth > maxDepth) {\n    evidence.push({ ruleId, path: \"args\", preview: `depth=${depth}` });\n  }\n  const maxLen = options.maxStringLength ?? 16_384;\n  const longest = maxStringLength(toolArgs);\n  if (longest > maxLen) {\n    evidence.push({ ruleId, path: \"args\", preview: `maxStringLength=${longest}` });\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Tool arguments within configured bounds.\");\n  }\n  return fail(ruleId, \"Unsafe or oversized tool arguments detected.\", evidence);\n}\n\nexport function evaluatePromptInjection(\n  text: string,\n  options: PromptInjectionOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.prompt-injection\";\n  const patterns = options.patterns ?? DEFAULT_INJECTION_PATTERNS;\n  const haystack = text.toLowerCase();\n  const evidence: GuardrailEvidence[] = [];\n  for (const pattern of patterns) {\n    const needle = pattern.toLowerCase();\n    if (needle.length > 0 && haystack.includes(needle)) {\n      evidence.push({ ruleId, match: pattern, preview: boundedPreview(text) });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"No prompt-injection patterns matched.\");\n  }\n  return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, \"warning\");\n}\n\nfunction validateSchemaField(\n  value: unknown,\n  field: StructuredOutputOptions[\"schema\"][string],\n  path: string,\n  evidence: GuardrailEvidence[],\n): void {\n  const ruleId = \"guardrail.structured-output\";\n  if (field.type) {\n    const actual =\n      value === null\n        ? \"null\"\n        : Array.isArray(value)\n          ? \"array\"\n          : typeof value;\n    if (actual !== field.type) {\n      evidence.push({ ruleId, path, preview: `expected ${field.type}, got ${actual}` });\n      return;\n    }\n  }\n  if (field.enum && !field.enum.some((item) => Object.is(item, value))) {\n    evidence.push({ ruleId, path, preview: \"value not in enum\" });\n  }\n  if (field.type === \"object\" && field.required && value && typeof value === \"object\" && !Array.isArray(value)) {\n    const record = value as Record<string, unknown>;\n    for (const key of field.required) {\n      if (!(key in record)) {\n        evidence.push({ ruleId, path: `${path}.${key}`, preview: \"missing required key\" });\n      }\n    }\n  }\n}\n\nexport function evaluateStructuredOutput(\n  value: unknown,\n  options: StructuredOutputOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.structured-output\";\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    return fail(ruleId, \"Structured output must be an object.\", [\n      { ruleId, preview: typeof value },\n    ]);\n  }\n  const record = value as Record<string, unknown>;\n  const evidence: GuardrailEvidence[] = [];\n  for (const [key, field] of Object.entries(options.schema)) {\n    validateSchemaField(record[key], field, key, evidence);\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Structured output matches schema subset.\");\n  }\n  return fail(ruleId, \"Structured output schema violation.\", evidence);\n}\n\nexport function evaluateOversizeOutput(\n  value: unknown,\n  options: OversizeOutputOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.oversize-output\";\n  const text = typeof value === \"string\" ? value : JSON.stringify(value);\n  const maxLength = options.maxLength ?? options.maxSerializedLength ?? 32_768;\n  if (text.length <= maxLength) {\n    return pass(ruleId, \"Output within size limits.\");\n  }\n  return fail(ruleId, `Output exceeds max length (${text.length} > ${maxLength}).`, [\n    { ruleId, preview: `length=${text.length}` },\n  ]);\n}\n\nexport function evaluateRequiredJsonShape(\n  value: unknown,\n  options: RequiredJsonShapeOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.required-json-shape\";\n  let parsed: unknown = value;\n  if (typeof value === \"string\") {\n    try {\n      parsed = JSON.parse(value);\n    } catch {\n      return fail(ruleId, \"Value is not valid JSON.\", [{ ruleId, preview: boundedPreview(value) }]);\n    }\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    return fail(ruleId, \"JSON value must be an object.\", [{ ruleId, preview: typeof parsed }]);\n  }\n  const record = parsed as Record<string, unknown>;\n  const evidence: GuardrailEvidence[] = [];\n  for (const key of options.requiredKeys) {\n    if (!(key in record)) {\n      evidence.push({ ruleId, path: key, preview: \"missing required key\" });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Required JSON keys present.\");\n  }\n  return fail(ruleId, \"Missing required JSON keys.\", evidence);\n}\n","import {\n  evaluateBannedPhrase,\n  evaluateOversizeOutput,\n  evaluatePiiLeak,\n  evaluatePromptInjection,\n  evaluateRequiredJsonShape,\n  evaluateStructuredOutput,\n  evaluateUnsafeToolArgs,\n} from \"./rules.js\";\nimport type {\n  GuardrailInput,\n  GuardrailResult,\n  GuardrailRuleId,\n  GuardrailRunResult,\n  RunGuardrailsOptions,\n} from \"./types.js\";\n\nconst ALL_RULES: GuardrailRuleId[] = [\n  \"guardrail.banned-phrase\",\n  \"guardrail.pii-leak\",\n  \"guardrail.unsafe-tool-args\",\n  \"guardrail.prompt-injection\",\n  \"guardrail.structured-output\",\n  \"guardrail.oversize-output\",\n  \"guardrail.required-json-shape\",\n];\n\nfunction isErrorFailure(result: GuardrailResult): boolean {\n  return result.status === \"fail\" && result.severity === \"error\";\n}\n\nfunction runRule(ruleId: GuardrailRuleId, input: GuardrailInput, options: RunGuardrailsOptions): GuardrailResult | undefined {\n  switch (ruleId) {\n    case \"guardrail.banned-phrase\": {\n      if (!options.bannedPhrase || input.text === undefined) return undefined;\n      return evaluateBannedPhrase(input.text, options.bannedPhrase);\n    }\n    case \"guardrail.pii-leak\": {\n      if (input.value === undefined && input.text === undefined) return undefined;\n      return evaluatePiiLeak(input.value ?? input.text, options.piiLeak);\n    }\n    case \"guardrail.unsafe-tool-args\": {\n      if (!input.toolName) return undefined;\n      return evaluateUnsafeToolArgs(input.toolName, input.toolArgs ?? {}, options.unsafeToolArgs);\n    }\n    case \"guardrail.prompt-injection\": {\n      if (input.text === undefined) return undefined;\n      return evaluatePromptInjection(input.text, options.promptInjection);\n    }\n    case \"guardrail.structured-output\": {\n      if (!options.structuredOutput || input.value === undefined) return undefined;\n      return evaluateStructuredOutput(input.value, options.structuredOutput);\n    }\n    case \"guardrail.oversize-output\": {\n      if (input.value === undefined && input.text === undefined) return undefined;\n      return evaluateOversizeOutput(input.value ?? input.text, options.oversizeOutput);\n    }\n    case \"guardrail.required-json-shape\": {\n      if (!options.requiredJsonShape || (input.value === undefined && input.text === undefined)) return undefined;\n      return evaluateRequiredJsonShape(input.value ?? input.text!, options.requiredJsonShape);\n    }\n    default:\n      return undefined;\n  }\n}\n\nexport function runGuardrails(input: GuardrailInput, options: RunGuardrailsOptions = {}): GuardrailRunResult {\n  const selected = options.rules ?? ALL_RULES;\n  const results: GuardrailResult[] = [];\n  for (const ruleId of selected) {\n    const result = runRule(ruleId, input, options);\n    if (result) results.push(result);\n  }\n  const ok = !results.some(isErrorFailure);\n  return { ok, results };\n}\n\nexport { ALL_RULES as DEFAULT_GUARDRAIL_RULES };\n"]}
+{"version":3,"sources":["../../redact/src/sensitive-key.ts","../../redact/src/key-value-secret.ts","../../redact/src/index.ts","../src/rules.ts","../src/run.ts"],"names":["crypto"],"mappings":";;;;;;;;;;;AAMA,SAAS,wBAAwB,KAAA,EAAwB;AACvD,EAAA,OAAO,QAAA,CAAS,KAAK,KAAK,CAAA;AAC5B;AAOO,SAAS,sBAAsB,KAAA,EAAuB;AAC3D,EAAA,OAAO,KAAA,CACJ,OAAA,CAAQ,oBAAA,EAAsB,OAAO,CAAA,CACrC,WAAA,EAAY,CACZ,OAAA,CAAQ,aAAA,EAAe,GAAG,CAAA,CAC1B,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC3B;AAEO,IAAM,mCAAwD,IAAI,GAAA;AAAA,EACvE;AAAA,IACE,QAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA,eAAA;AAAA,IACA,aAAA;AAAA,IACA,aAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF,CAAE,IAAI,qBAAqB;AAC7B,CAAA;AAEA,SAAS,qBAAqB,UAAA,EAA6B;AACzD,EAAA,IAAI,gCAAA,CAAiC,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,KAAA;AAC7D,EAAA,IAAI,UAAA,KAAe,SAAS,OAAO,IAAA;AACnC,EAAA,IAAI,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,KAAA;AAC1C,EAAA,OAAO,UAAA,CAAW,SAAS,OAAO,CAAA;AACpC;AAUO,SAAS,wBAAA,CACd,KACA,aAAA,EACS;AACT,EAAA,IAAI,CAAC,KAAK,OAAO,KAAA;AACjB,EAAA,MAAM,UAAA,GAAa,sBAAsB,GAAG,CAAA;AAC5C,EAAA,IAAI,CAAC,YAAY,OAAO,KAAA;AACxB,EAAA,IAAI,gCAAA,CAAiC,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,KAAA;AAE7D,EAAA,MAAM,mBAAA,GAAsB,wBAAwB,GAAG,CAAA;AAEvD,EAAA,KAAA,MAAW,aAAa,aAAA,EAAe;AACrC,IAAA,MAAM,CAAA,GAAI,sBAAsB,SAAS,CAAA;AACzC,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,IAAI,MAAM,OAAA,EAAS;AACjB,MAAA,IAAI,oBAAA,CAAqB,UAAU,CAAA,EAAG,OAAO,IAAA;AAC7C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,UAAA,KAAe,GAAG,OAAO,IAAA;AAC7B,IAAA,IAAI,WAAW,QAAA,CAAS,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,GAAG,OAAO,IAAA;AACzC,IAAA,IAAI,uBAAuB,UAAA,CAAW,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA,CAAG,GAAG,OAAO,IAAA;AAAA,EACpE;AACA,EAAA,OAAO,KAAA;AACT;;;ACnEO,IAAM,kCACX,MAAA,CAAO,GAAA,CAAA,0GAAA,CAAA;AAEF,IAAM,2BAA2B,IAAI,MAAA;AAAA,EAC1C,+BAAA;AAAA,EACA;AACF,CAAA;AAEO,SAAS,4BAA4B,KAAA,EAAwB;AAClE,EAAA,wBAAA,CAAyB,SAAA,GAAY,CAAA;AACrC,EAAA,OAAO,wBAAA,CAAyB,KAAK,KAAK,CAAA;AAC5C;;;ACqDO,IAAM,mBAAA,GAAsB;AAAA,EACjC,eAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,wBAAA,GAA2B;AAAA,EACtC,WAAA;AAAA,EACA,eAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,yBAAA,GAA4B;AAAA,EACvC,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA;AAkBA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGA,SAAS,MAAM,GAAA,EAAqB;AAClC,EAAA,OAAO,IAAI,WAAA,EAAY;AACzB;AAEA,SAAS,mBAAA,CACP,KACA,KAAA,EAC0B;AAC1B,EAAA,MAAM,KAAA,GAAQ,MAAM,GAAG,CAAA;AACvB,EAAA,MAAM,SAAS,KAAA,CAAM,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,QAAQ,KAAK,CAAA;AAChE,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,SAAA,KAAc,wBAAA,CAAyB,KAAK,CAAC,SAAA,CAAU,GAAG,CAAC,CAAC,CAAA;AACjF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,MAAM,IAAA,GAAOA,uBAAA,CAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,OAAO,KAAA,EAAO,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC3E,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AACxB;AAEA,SAAS,gBAAgB,KAAA,EAAoC;AAC3D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,OAAO,UAAU,SAAA,IAAa,OAAO,UAAU,QAAA,EAAU;AACxF,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,gBAAgB,OAAA,EAAoD;AAC3E,EAAA,OAAO;AAAA,IACL,IAAI,OAAA,CAAQ,EAAA;AAAA,IACZ,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA;AAAA,IAC9B,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAA,CAAQ,QAAQ,SAAA,GAAY,CAAA;AAC5B,MAAA,OAAO,QAAQ,OAAA,CAAQ,IAAA,CAAK,MAAM,KAAK,CAAA,GACnC,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA,EAAW,WAAW,OAAA,EAAS,IACnF,EAAC;AAAA,IACP;AAAA,GACF;AACF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAChC;AAEA,SAAS,WAAW,KAAA,EAAwB;AAC1C,EAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,IAAI,OAAO,KAAA;AAErD,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,IAAS,IAAI,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAC9C,IAAA,IAAI,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAA;AAC5B,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,IAAS,CAAA;AACT,MAAA,IAAI,KAAA,GAAQ,GAAG,KAAA,IAAS,CAAA;AAAA,IAC1B;AACA,IAAA,GAAA,IAAO,KAAA;AACP,IAAA,MAAA,GAAS,CAAC,MAAA;AAAA,EACZ;AACA,EAAA,OAAO,MAAM,EAAA,KAAO,CAAA;AACtB;AAEA,IAAM,OAAA,GACJ,4EAAA;AAGF,IAAM,WAAA,GAAc,cAAA;AAEpB,IAAM,QAAA,GAAW,6CAAA;AAEjB,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,MAAM,aAAa,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,gBAAgB,EAAE,CAAA;AAChE,EAAA,OACE,gCAAA,CAAiC,KAAK,UAAU,CAAA,IAChD,qEAAqE,IAAA,CAAK,UAAU,KACpF,8FAAA,CAA+F,IAAA;AAAA,IAC7F;AAAA,GACF,IACA,gBAAA,CAAiB,IAAA,CAAK,UAAU,CAAA;AAEpC;AAEA,SAAS,WAAW,KAAA,EAAwB;AAC1C,EAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA;AAClC;AAEA,SAAS,wBAAA,CAAyB,WAAmB,SAAA,EAA4B;AAC/E,EAAA,MAAM,MAAA,GAAS,WAAW,SAAS,CAAA;AACnC,EAAA,IAAI,OAAO,MAAA,GAAS,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,IAAI,OAAO,KAAA;AACrD,EAAA,IAAI,CAAC,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,KAAA;AAEnC,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAC/B,EAAA,IAAI,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,KAAA;AAGhC,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA,IAAK,UAAA,CAAW,OAAO,CAAA,KAAM,MAAA,IAAU,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACvF,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,OAAA,CAAQ,SAAS,CAAA;AACzC,EAAA,IAAI,SAAS,CAAA,EAAG;AACd,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,KAAA,GAAQ,CAAC,CAAA;AAClC,IAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,GAAQ,SAAA,CAAU,MAAM,CAAA;AAChD,IAAA,IAAI,MAAA,IAAU,cAAA,CAAe,IAAA,CAAK,MAAM,GAAG,OAAO,KAAA;AAClD,IAAA,IAAI,KAAA,IAAS,cAAA,CAAe,IAAA,CAAK,KAAK,GAAG,OAAO,KAAA;AAAA,EAClD;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,4BAA4B,KAAA,EAAwB;AAC3D,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,IAAI,+BAAA,CAAgC,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AAC1D,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,IAAI,uCAAA,CAAwC,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AAClE,EAAA,IAAI,iBAAA,CAAkB,KAAK,OAAO,CAAA,IAAK,SAAS,IAAA,CAAK,OAAO,GAAG,OAAO,IAAA;AAEtE,EAAA,IAAI,OAAA,CAAQ,KAAK,OAAO,CAAA,IAAK,CAAC,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AACzD,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,wBAAA,CAAyB,KAAA,EAAe,KAAA,EAAe,MAAA,EAAyB;AACvF,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,GAAQ,MAAM,CAAA;AAClC,EAAA,OAAO,WAAW,GAAA,IAAO,MAAA,KAAW,IAAA,IAAQ,KAAA,KAAU,OAAO,KAAA,KAAU,IAAA;AACzE;AAEA,SAAS,mBAAmB,KAAA,EAAwB;AAClD,EAAA,IAAI,2BAAA,CAA4B,KAAK,CAAA,EAAG,OAAO,KAAA;AAC/C,EAAA,QAAA,CAAS,SAAA,GAAY,CAAA;AACrB,EAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,QAAA,CAAS,QAAQ,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AACzB,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,CAAA;AAC7B,IAAA,IAAI,wBAAA,CAAyB,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACzD,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,2BAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,oCAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,cAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,WAAA;AAAA,IACJ,OAAA,EAAS,gEAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,sBAAA;AAAA,IACJ,OAAA,EAAS,0FAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,+CAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,oBAAA;AAAA,IACJ,OAAA,EAAS,+BAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,kBAAA;AAAA,IACJ,OAAA,EAAS,2EAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD;AAAA,IACE,EAAA,EAAI,sBAAA;AAAA,IACJ,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAO,2BAAA,CAA4B,KAAA,CAAM,KAAK,CAAA,GAC1C,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,OAAA,EAAS,IAC7D,EAAC;AAAA,IACP;AAAA,GACF;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,IAAI,mBAAA,CAAoB,KAAA,CAAM,IAAI,CAAA,SAAU,EAAC;AAC7C,MAAA,IAAI,UAAA,CAAW,KAAA,CAAM,KAAK,CAAA,SAAU,EAAC;AACrC,MAAA,MAAM,gBAAA,GAAmB,qBAAA;AACzB,MAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,EAAG;AAC1D,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AAC9B,QAAA,IAAI,wBAAA,CAAyB,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,EAAG;AACpD,UAAA,OAAO,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,UAAU,OAAA,EAAS,SAAA,EAAW,SAAS,CAAA;AAAA,QACtE;AAAA,MACF;AACA,MAAA,OAAO,EAAC;AAAA,IACV;AAAA;AAEJ,CAAA;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD;AAAA,IACE,EAAA,EAAI,aAAA;AAAA,IACJ,QAAA,EAAU,SAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAO,kBAAA,CAAmB,KAAA,CAAM,KAAK,CAAA,GACjC,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,SAAA,EAAW,SAAA,EAAW,OAAA,EAAS,IAC/D,EAAC;AAAA,IACP;AAAA,GACF;AAAA,EACA,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,aAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV;AACH,CAAA;AAEA,SAAS,2BAA2B,OAAA,EAAyD;AAC3F,EAAA,IAAI,OAAA,KAAY,SAAS,OAAO,mBAAA;AAChC,EAAA,OAAO,CAAC,GAAG,mBAAA,EAAqB,GAAG,mBAAmB,CAAA;AACxD;AAEA,SAAS,YAAA,CACP,OACA,SAAA,EACgB;AAChB,EAAA,MAAM,GAAA,uBAAU,GAAA,EAA0B;AAE1C,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAuB;AAClC,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAC1B,IAAA,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,KAAqB,CAAA;AAAA,EAC/C,CAAA;AAEA,EAAA,KAAA,MAAW,OAAO,mBAAA,EAAqB;AACrC,IAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,EAC/B;AAEA,EAAA,KAAA,MAAW,GAAA,IAAO,SAAA,IAAa,EAAC,EAAG;AACjC,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,EAAG;AAC7C,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,IAC/B;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,IAAS,EAAC,EAAG;AAC9B,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,QAAQ,CAAA;AACnC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,MAAA,GAAA,CAAI;AAAA,QACF,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,QAAA,EAAU,QAAA;AAAA,QACV,MAAM,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO;AAAA,OACnD,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,GAAG,GAAA,CAAI,MAAA,EAAQ,CAAA;AACzB;AAEA,SAAS,cAAc,IAAA,EAAqC;AAC1D,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,SAAA;AACrC,EAAA,OAAO,IAAA,CAAK,QAAA;AACd;AAEA,SAAS,SAAA,CACP,IAAA,EACA,KAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,WAAA;AAErC,EAAA,MAAM,QAAA,GAAW,gBAAgB,KAAK,CAAA;AACtC,EAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,WAAA;AACnC,IAAA,MAAM,IAAA,GAAO,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAC9C,IAAA,OAAO,QAAA,CAAS,MAAA,IAAU,IAAA,GAAO,CAAA,EAAG,QAAQ,CAAA,MAAA,CAAA,GAAM,CAAA,EAAG,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,IAAI,CAAC,CAAA,MAAA,CAAA;AAAA,EAC9E;AAEA,EAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAQ;AAC5B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,gBAAA;AACnC,IAAA,OAAO,CAAA,MAAA,EAAS,UAAA,CAAW,QAAQ,CAAC,CAAA,CAAA,CAAA;AAAA,EACtC;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,SAAA,CAAU,MAAc,GAAA,EAAqB;AACpD,EAAA,IAAI,4BAAA,CAA6B,IAAA,CAAK,GAAG,CAAA,EAAG;AAC1C,IAAA,OAAO,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,GAAK,GAAA;AAAA,EACnC;AACA,EAAA,OAAO,GAAG,IAAA,IAAQ,GAAG,IAAI,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,CAAA;AAC9C;AAEA,SAAS,SAAA,CAAU,MAAc,KAAA,EAAuB;AACtD,EAAA,OAAO,CAAA,EAAG,IAAA,IAAQ,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,CAAA;AAChC;AAEA,SAAS,YACP,IAAA,EACA,QAAA,EACA,QACA,SAAA,EACA,QAAA,GAA8B,WAC9B,OAAA,EACkB;AAClB,EAAA,OAAO,OAAA,KAAY,MAAA,GACf,EAAE,IAAA,EAAM,UAAU,MAAA,EAAQ,QAAA,EAAU,SAAA,EAAU,GAC9C,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,QAAA,EAAU,WAAW,OAAA,EAAQ;AAC7D;AAEO,SAAS,sBAAA,CAAuB,UAA4B,OAAA,EAAmC;AACpG,EAAA,QAAQ,OAAA;AAAS,IACf,KAAK,OAAA;AACH,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,SAAA,EAAW,EAAC,EAAE;AAAA,IAC3C,KAAK,OAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,OAAA;AAAA,QACT,SAAA,EAAW,wBAAA;AAAA,QACX,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA,IACF,KAAK,QAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,QAAA;AAAA,QACT,SAAA,EAAW,CAAC,GAAG,wBAAA,EAA0B,GAAG,yBAAyB,CAAA;AAAA,QACrE,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA;AAEN;AAEO,IAAM,WAAN,MAAe;AAAA,EACX,MAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA;AAAA,EAET,YAAY,OAAA,EAA2B;AACrC,IAAA,MAAM,QAAA,GAAW,sBAAA,CAAuB,OAAA,EAAS,OAAA,IAAW,OAAO,CAAA;AACnE,IAAA,IAAA,CAAK,WAAW,QAAA,CAAS,OAAA;AACzB,IAAA,IAAA,CAAK,MAAA,GAAS,YAAA,CAAa,OAAA,EAAS,KAAA,EAAO;AAAA,MACzC,GAAG,QAAA,CAAS,SAAA;AAAA,MACZ,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC5B,CAAA;AACD,IAAA,IAAA,CAAK,UAAA,GAAa;AAAA,MAChB,GAAG,0BAAA,CAA2B,IAAA,CAAK,QAAQ,CAAA;AAAA,MAC3C,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC7B;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,SAAS,WAAA,IAAe,YAAA;AAC5C,IAAA,IAAA,CAAK,SAAA,GAAY,SAAS,QAAA,IAAY,EAAA;AACtC,IAAA,IAAA,CAAK,gBAAA,GAAmB,SAAS,eAAA,IAAmB,IAAA;AAAA,EACtD;AAAA,EAEA,WAAA,CAAY,KAAa,KAAA,EAAyB;AAChD,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,KAAA,EAAO,GAAA,EAAK,KAAK,CAAA,EAAG;AAAA,MAC3C,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACpC,CAAA;AAAA,EACH;AAAA,EAEA,aAAa,MAAA,EAA0D;AACrE,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA;AAAA,EAC7B;AAAA,EAEA,OAAoB,KAAA,EAA8B;AAChD,IAAA,MAAM,KAAA,GAAwB;AAAA,MAC5B,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACrC;AACA,IAAA,MAAM,WAAW,IAAA,CAAK,YAAA,CAAa,OAAO,MAAA,EAAW,GAAA,EAAK,GAAG,KAAK,CAAA;AAClE,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,QAAA;AAAA,MACP,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAA,EAAU,MAAM,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,WAAW,MAAM,CAAA;AAAA,MACpE,SAAS,IAAA,CAAK;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,cAAA,CAAe,OAAuB,OAAA,EAAiC;AACrE,IAAA,IAAI,IAAA,CAAK,gBAAA,EAAkB,KAAA,CAAM,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,EACxD;AAAA,EAEA,YAAA,CACE,KAAA,EACA,GAAA,EACA,IAAA,EACA,OACA,KAAA,EACS;AACT,IAAA,IAAI,KAAA,GAAQ,KAAK,SAAA,EAAW;AAC1B,MAAA,IAAA,CAAK,cAAA;AAAA,QACH,KAAA;AAAA,QACA,WAAA,CAAY,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,SAAS,SAAS;AAAA,OACxE;AACA,MAAA,OAAO,aAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,MAAM,IAAA,GAAO,mBAAA,CAAoB,GAAA,EAAK,IAAA,CAAK,MAAM,CAAA;AACjD,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA,CAAY,IAAA,EAAM,CAAA,IAAA,EAAO,IAAA,CAAK,GAAG,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS;AAAA,SAC5E;AACA,QAAA,OAAO,SAAA,CAAU,IAAA,EAAM,KAAA,EAAO,IAAA,CAAK,YAAY,CAAA;AAAA,MACjD;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,QAAA,IAAY,KAAK,UAAA,EAAY;AACtC,MAAA,MAAM,aAAa,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,GAAA,EAAK,OAAO,CAAA;AACvD,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,MAAM,MAAA,GAAS,UAAU,MAAA,IAAU,SAAA;AACnC,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA;AAAA,YACE,IAAA;AAAA,YACA,QAAA,CAAS,EAAA;AAAA,YACT,MAAA;AAAA,YACA,SAAA,CAAU,SAAA,IAAa,QAAA,CAAS,SAAA,IAAa,QAAA;AAAA,YAC7C,SAAA,CAAU,QAAA,IAAY,QAAA,CAAS,QAAA,IAAY,SAAA;AAAA,YAC3C,SAAA,CAAU;AAAA;AACZ,SACF;AACA,QAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,UAAA,OAAO,SAAA,CAAU,eAAe,IAAA,CAAK,YAAA;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAAiB,EAAC;AACxB,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,KAAA,KAAU;AAC7B,QAAA,GAAA,CAAI,KAAK,CAAA,GAAI,IAAA,CAAK,YAAA,CAAa,IAAA,EAAM,MAAA,EAAW,SAAA,CAAU,IAAA,EAAM,KAAK,CAAA,EAAG,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,MAC1F,CAAC,CAAA;AACD,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAA,CAAS,KAAK,CAAA,EAAG;AACnB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAA+B,EAAC;AACtC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,MAAW,CAAC,QAAA,EAAU,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1D,QAAA,GAAA,CAAI,QAAQ,IAAI,IAAA,CAAK,YAAA;AAAA,UACnB,UAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA,CAAU,IAAA,KAAS,GAAA,GAAM,EAAA,GAAK,MAAM,QAAQ,CAAA;AAAA,UAC5C,KAAA,GAAQ,CAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;AAEO,SAAS,eAAe,OAAA,EAAqC;AAClE,EAAA,OAAO,IAAI,SAAS,OAAO,CAAA;AAC7B;AAEO,SAAS,MAAA,CAAoB,OAAU,OAAA,EAA6C;AACzF,EAAA,OAAO,cAAA,CAAe,OAAO,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC7C;;;AC3nBA,IAAM,0BAAA,GAA6B;AAAA,EACjC,8BAAA;AAAA,EACA,kBAAA;AAAA,EACA,6BAAA;AAAA,EACA,eAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,IAAA,CAAK,QAAgB,OAAA,EAAkC;AAC9D,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAQ,MAAA,EAAQ,UAAU,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAU,EAAC,EAAE;AAC3E;AAEA,SAAS,IAAA,CACP,MAAA,EACA,OAAA,EACA,QAAA,EACA,WAAgC,OAAA,EACf;AACjB,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAQ,QAAA,KAAa,YAAY,MAAA,GAAS,MAAA,EAAQ,QAAA,EAAU,OAAA,EAAS,QAAA,EAAS;AACjG;AAEA,SAAS,cAAA,CAAe,KAAA,EAAe,GAAA,GAAM,EAAA,EAAY;AACvD,EAAA,IAAI,KAAA,CAAM,MAAA,IAAU,GAAA,EAAK,OAAO,KAAA;AAChC,EAAA,OAAO,GAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,GAAA,GAAM,CAAC,CAAC,CAAA,GAAA,CAAA;AACnC;AAEO,SAAS,oBAAA,CACd,MACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,yBAAA;AACf,EAAA,MAAM,WAAW,OAAA,CAAQ,eAAA,KAAoB,KAAA,GAAQ,IAAA,CAAK,aAAY,GAAI,IAAA;AAC1E,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,MAAA,IAAU,QAAQ,OAAA,EAAS;AACpC,IAAA,MAAM,SAAS,OAAA,CAAQ,eAAA,KAAoB,KAAA,GAAQ,MAAA,CAAO,aAAY,GAAI,MAAA;AAC1E,IAAA,IAAI,OAAO,MAAA,GAAS,CAAA,IAAK,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG;AAClD,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,QAAQ,OAAA,EAAS,cAAA,CAAe,IAAI,CAAA,EAAG,CAAA;AAAA,IACxE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,4BAA4B,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,QAAA,EAAW,QAAA,CAAS,MAAM,sBAAsB,QAAQ,CAAA;AAC9E;AAEA,IAAM,gBAAgB,EAAE,IAAA,EAAM,GAAG,OAAA,EAAS,CAAA,EAAG,OAAO,CAAA,EAAE;AAE/C,SAAS,eAAA,CAAgB,KAAA,EAAgB,OAAA,GAA0B,EAAC,EAAoB;AAC7F,EAAA,MAAM,MAAA,GAAS,oBAAA;AACf,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,SAAA;AAC3C,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,EAAO,EAAE,OAAA,EAAS,QAAQ,OAAA,IAAW,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,CAAA;AAC3F,EAAA,MAAM,QAAA,GAAW,OAAO,QAAA,CAAS,MAAA;AAAA,IAC/B,CAAC,OAAA,KAA8B,aAAA,CAAc,QAAQ,QAAQ,CAAA,IAAK,cAAc,WAAW;AAAA,GAC7F;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,kCAAkC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,QAAA,GAAgC,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,MAAa;AAAA,IAC/D,MAAA;AAAA,IACA,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,SAAS,OAAA,CAAQ;AAAA,GACnB,CAAE,CAAA;AACF,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,SAAA,EAAY,QAAA,CAAS,MAAM,0BAA0B,QAAQ,CAAA;AACnF;AAEA,SAAS,aAAa,KAAA,EAAwB;AAC5C,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,UAAU,OAAO,CAAA;AACxD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS,YAAA,CAAa,IAAI,CAAC,CAAC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,KAAgC,CAAA,CAAE,IAAI,CAAC,IAAA,KAAS,YAAA,CAAa,IAAI,CAAC,CAAA;AAC/F,EAAA,OAAO,CAAA,IAAK,OAAO,MAAA,KAAW,CAAA,GAAI,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,MAAM,CAAA,CAAA;AAC1D;AAEA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA,CAAM,MAAA;AAC5C,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,UAAU,OAAO,CAAA;AACxD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS,eAAA,CAAgB,IAAI,CAAC,CAAC,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,OAAO,MAAA,CAAO,KAAgC,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS,eAAA,CAAgB,IAAI,CAAC,CAAC,CAAA;AAC5G;AAEO,SAAS,sBAAA,CACd,QAAA,EACA,QAAA,EACA,OAAA,GAAiC,EAAC,EACjB;AACjB,EAAA,MAAM,MAAA,GAAS,4BAAA;AACf,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAA,CAAK,OAAA,CAAQ,YAAA,IAAgB,EAAC,EAAG,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,WAAA,EAAa,CAAC,CAAA;AACtF,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA,EAAG;AACvC,IAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,SAAS,QAAA,EAAU,KAAA,EAAO,UAAU,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,EAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,aAAa,QAAQ,CAAA;AACnC,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,QAAQ,OAAA,EAAS,CAAA,MAAA,EAAS,KAAK,CAAA,CAAA,EAAI,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,MAAA,GAAS,QAAQ,eAAA,IAAmB,KAAA;AAC1C,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,IAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,QAAQ,OAAA,EAAS,CAAA,gBAAA,EAAmB,OAAO,CAAA,CAAA,EAAI,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,0CAA0C,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,8CAAA,EAAgD,QAAQ,CAAA;AAC9E;AAEO,SAAS,uBAAA,CACd,IAAA,EACA,OAAA,GAAkC,EAAC,EAClB;AACjB,EAAA,MAAM,MAAA,GAAS,4BAAA;AACf,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,0BAAA;AACrC,EAAA,MAAM,QAAA,GAAW,KAAK,WAAA,EAAY;AAClC,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAM,MAAA,GAAS,QAAQ,WAAA,EAAY;AACnC,IAAA,IAAI,OAAO,MAAA,GAAS,CAAA,IAAK,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG;AAClD,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,SAAS,OAAA,EAAS,cAAA,CAAe,IAAI,CAAA,EAAG,CAAA;AAAA,IACzE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,uCAAuC,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,QAAA,EAAW,SAAS,MAAM,CAAA,sBAAA,CAAA,EAA0B,UAAU,SAAS,CAAA;AAC7F;AAEA,SAAS,mBAAA,CACP,KAAA,EACA,KAAA,EACA,IAAA,EACA,QAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,6BAAA;AACf,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,MAAM,MAAA,GACJ,UAAU,IAAA,GACN,MAAA,GACA,MAAM,OAAA,CAAQ,KAAK,CAAA,GACjB,OAAA,GACA,OAAO,KAAA;AACf,IAAA,IAAI,MAAA,KAAW,MAAM,IAAA,EAAM;AACzB,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAA,SAAA,EAAY,KAAA,CAAM,IAAI,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAI,CAAA;AAChF,MAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,IAAQ,CAAC,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,CAAC,IAAA,KAAS,MAAA,CAAO,EAAA,CAAG,IAAA,EAAM,KAAK,CAAC,CAAA,EAAG;AACpE,IAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,qBAAqB,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,QAAA,IAAY,KAAA,CAAM,QAAA,IAAY,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5G,IAAA,MAAM,MAAA,GAAS,KAAA;AACf,IAAA,KAAA,MAAW,GAAA,IAAO,MAAM,QAAA,EAAU;AAChC,MAAA,IAAI,EAAE,OAAO,MAAA,CAAA,EAAS;AACpB,QAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,OAAA,EAAS,sBAAA,EAAwB,CAAA;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wBAAA,CACd,OACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,6BAAA;AACf,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/D,IAAA,OAAO,IAAA,CAAK,QAAQ,sCAAA,EAAwC;AAAA,MAC1D,EAAE,MAAA,EAAQ,OAAA,EAAS,OAAO,KAAA;AAAM,KACjC,CAAA;AAAA,EACH;AACA,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzD,IAAA,mBAAA,CAAoB,MAAA,CAAO,GAAG,CAAA,EAAG,KAAA,EAAO,KAAK,QAAQ,CAAA;AAAA,EACvD;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,0CAA0C,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,qCAAA,EAAuC,QAAQ,CAAA;AACrE;AAEO,SAAS,sBAAA,CACd,KAAA,EACA,OAAA,GAAiC,EAAC,EACjB;AACjB,EAAA,MAAM,MAAA,GAAS,2BAAA;AACf,EAAA,MAAM,OAAO,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,IAAA,CAAK,UAAU,KAAK,CAAA;AACrE,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,mBAAA,IAAuB,KAAA;AACtE,EAAA,IAAI,IAAA,CAAK,UAAU,SAAA,EAAW;AAC5B,IAAA,OAAO,IAAA,CAAK,QAAQ,4BAA4B,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,2BAAA,EAA8B,KAAK,MAAM,CAAA,GAAA,EAAM,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,IAChF,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAG,GAC5C,CAAA;AACH;AAEO,SAAS,yBAAA,CACd,OACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,+BAAA;AACf,EAAA,IAAI,MAAA,GAAkB,KAAA;AACtB,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,0BAAA,EAA4B,CAAC,EAAE,MAAA,EAAQ,OAAA,EAAS,cAAA,CAAe,KAAK,CAAA,EAAG,CAAC,CAAA;AAAA,IAC9F;AAAA,EACF;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,IAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,+BAAA,EAAiC,CAAC,EAAE,QAAQ,OAAA,EAAS,OAAO,MAAA,EAAQ,CAAC,CAAA;AAAA,EAC3F;AACA,EAAA,MAAM,MAAA,GAAS,MAAA;AACf,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,GAAA,IAAO,QAAQ,YAAA,EAAc;AACtC,IAAA,IAAI,EAAE,OAAO,MAAA,CAAA,EAAS;AACpB,MAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,MAAM,GAAA,EAAK,OAAA,EAAS,wBAAwB,CAAA;AAAA,IACtE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,6BAA6B,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,6BAAA,EAA+B,QAAQ,CAAA;AAC7D;;;AChOA,IAAM,SAAA,GAA+B;AAAA,EACnC,yBAAA;AAAA,EACA,oBAAA;AAAA,EACA,4BAAA;AAAA,EACA,4BAAA;AAAA,EACA,6BAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACF;AAEA,SAAS,eAAe,MAAA,EAAkC;AACxD,EAAA,OAAO,MAAA,CAAO,MAAA,KAAW,MAAA,IAAU,MAAA,CAAO,QAAA,KAAa,OAAA;AACzD;AAEA,SAAS,OAAA,CAAQ,MAAA,EAAyB,KAAA,EAAuB,OAAA,EAA4D;AAC3H,EAAA,QAAQ,MAAA;AAAQ,IACd,KAAK,yBAAA,EAA2B;AAC9B,MAAA,IAAI,CAAC,OAAA,CAAQ,YAAA,IAAgB,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAC9D,MAAA,OAAO,oBAAA,CAAqB,KAAA,CAAM,IAAA,EAAM,OAAA,CAAQ,YAAY,CAAA;AAAA,IAC9D;AAAA,IACA,KAAK,oBAAA,EAAsB;AACzB,MAAA,IAAI,MAAM,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAClE,MAAA,OAAO,gBAAgB,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAM,QAAQ,OAAO,CAAA;AAAA,IACnE;AAAA,IACA,KAAK,4BAAA,EAA8B;AACjC,MAAA,IAAI,CAAC,KAAA,CAAM,QAAA,EAAU,OAAO,MAAA;AAC5B,MAAA,OAAO,sBAAA,CAAuB,MAAM,QAAA,EAAU,KAAA,CAAM,YAAY,EAAC,EAAG,QAAQ,cAAc,CAAA;AAAA,IAC5F;AAAA,IACA,KAAK,4BAAA,EAA8B;AACjC,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,EAAW,OAAO,MAAA;AACrC,MAAA,OAAO,uBAAA,CAAwB,KAAA,CAAM,IAAA,EAAM,OAAA,CAAQ,eAAe,CAAA;AAAA,IACpE;AAAA,IACA,KAAK,6BAAA,EAA+B;AAClC,MAAA,IAAI,CAAC,OAAA,CAAQ,gBAAA,IAAoB,KAAA,CAAM,KAAA,KAAU,QAAW,OAAO,MAAA;AACnE,MAAA,OAAO,wBAAA,CAAyB,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,gBAAgB,CAAA;AAAA,IACvE;AAAA,IACA,KAAK,2BAAA,EAA6B;AAChC,MAAA,IAAI,MAAM,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAClE,MAAA,OAAO,uBAAuB,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAM,QAAQ,cAAc,CAAA;AAAA,IACjF;AAAA,IACA,KAAK,+BAAA,EAAiC;AACpC,MAAA,IAAI,CAAC,QAAQ,iBAAA,IAAsB,KAAA,CAAM,UAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,MAAA,EAAY,OAAO,MAAA;AAClG,MAAA,OAAO,0BAA0B,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAO,QAAQ,iBAAiB,CAAA;AAAA,IACxF;AAAA,IACA;AACE,MAAA,OAAO,MAAA;AAAA;AAEb;AAEO,SAAS,aAAA,CAAc,KAAA,EAAuB,OAAA,GAAgC,EAAC,EAAuB;AAC3G,EAAA,MAAM,QAAA,GAAW,QAAQ,KAAA,IAAS,SAAA;AAClC,EAAA,MAAM,UAA6B,EAAC;AACpC,EAAA,KAAA,MAAW,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA;AAAA,EACjC;AACA,EAAA,MAAM,EAAA,GAAK,CAAC,OAAA,CAAQ,IAAA,CAAK,cAAc,CAAA;AACvC,EAAA,OAAO,EAAE,IAAI,OAAA,EAAQ;AACvB","file":"index.cjs","sourcesContent":["/**\n * Mirrors `packages/core/src/safety/sensitive-key.ts` for dependency-light\n * @agent-inspect/redact consumers. Keep both copies in sync (6.14.2 parity).\n */\n\n/** True when the original key already uses an explicit separator. */\nfunction keyHasExplicitSeparator(value: string): boolean {\n  return /[_\\-.]/.test(value);\n}\n\n/**\n * Canonicalize field names so camelCase / kebab / dot / snake forms share a\n * snake_case shape the compound matcher can recognize (`userPassword` →\n * `user_password`).\n */\nexport function normalizeSensitiveKey(value: string): string {\n  return value\n    .replace(/([a-z0-9])([A-Z])/g, \"$1_$2\")\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n}\n\nexport const NON_CREDENTIAL_TOKEN_CONFIG_KEYS: ReadonlySet<string> = new Set(\n  [\n    \"tokens\",\n    \"max_tokens\",\n    \"min_tokens\",\n    \"ls_max_tokens\",\n    \"token_count\",\n    \"token_limit\",\n    \"token_budget\",\n    \"input_tokens\",\n    \"output_tokens\",\n    \"total_tokens\",\n    \"cached_tokens\",\n    \"prompt_tokens\",\n    \"completion_tokens\",\n  ].map(normalizeSensitiveKey),\n);\n\nfunction isTokenCredentialKey(normalized: string): boolean {\n  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;\n  if (normalized === \"token\") return true;\n  if (normalized.endsWith(\"tokens\")) return false;\n  return normalized.endsWith(\"token\");\n}\n\n/**\n * True when the field name looks credential-sensitive under the shared policy.\n *\n * Suffix compounds (`user_password`, `userPassword`) always match. Prefix\n * compounds (`email_note`) match only when the original key already contained\n * an explicit separator, so camelCase topic fields like `emailNote` stay for\n * value detectors instead of key redaction.\n */\nexport function isCredentialSensitiveKey(\n  key: string | undefined,\n  sensitiveKeys: readonly string[],\n): boolean {\n  if (!key) return false;\n  const normalized = normalizeSensitiveKey(key);\n  if (!normalized) return false;\n  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;\n\n  const allowPrefixCompound = keyHasExplicitSeparator(key);\n\n  for (const sensitive of sensitiveKeys) {\n    const s = normalizeSensitiveKey(sensitive);\n    if (!s) continue;\n    if (s === \"token\") {\n      if (isTokenCredentialKey(normalized)) return true;\n      continue;\n    }\n    if (normalized === s) return true;\n    if (normalized.endsWith(`_${s}`)) return true;\n    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;\n  }\n  return false;\n}\n","/**\n * High-confidence key/value credential forms shared with core\n * `safety.secretPattern` / `key-value-secret` (keep sources in sync).\n *\n * Matches house-format credentials such as:\n *   internal_token=<credential>\n *   token=<credential>\n *   api_key=<credential>\n *\n * Intentionally does **not** match metric/config lookalikes such as\n * maxTokens=, tokenCount=, secret=false, or short placeholders.\n */\nexport const KEY_VALUE_SECRET_PATTERN_SOURCE =\n  String.raw`\\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\\s\"'\\\\]{8,})`;\n\nexport const KEY_VALUE_SECRET_PATTERN = new RegExp(\n  KEY_VALUE_SECRET_PATTERN_SOURCE,\n  \"i\",\n);\n\nexport function valueContainsKeyValueSecret(value: string): boolean {\n  KEY_VALUE_SECRET_PATTERN.lastIndex = 0;\n  return KEY_VALUE_SECRET_PATTERN.test(value);\n}\n","import crypto from \"node:crypto\";\nimport { isCredentialSensitiveKey } from \"./sensitive-key.js\";\nimport { valueContainsKeyValueSecret } from \"./key-value-secret.js\";\n\nexport type RedactionProfile = \"local\" | \"share\" | \"strict\";\n\nexport type RedactionAction = \"replace\" | \"hash\" | \"prefix\" | \"truncate\" | \"keep\";\n\nexport type RedactionSeverity = \"info\" | \"warning\" | \"error\";\n\nexport type RedactionMatchKind = \"key\" | \"value\" | \"custom\";\n\nexport type RedactionRule =\n  | string\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep?: number }\n  | { key: string; strategy: \"hash\" };\n\nexport interface RedactionFinding {\n  path: string;\n  detector: string;\n  action: RedactionAction;\n  severity: RedactionSeverity;\n  matchKind: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetection {\n  action?: RedactionAction;\n  replacement?: unknown;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetectorInput {\n  path: string;\n  key?: string;\n  value: unknown;\n}\n\nexport interface RedactionDetector {\n  id: string;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  detect(input: RedactionDetectorInput): RedactionDetection[];\n}\n\nexport interface RedactionResult<T = unknown> {\n  value: T;\n  findings: RedactionFinding[];\n  redacted: boolean;\n  profile: RedactionProfile;\n}\n\nexport interface ResolvedRedactionProfile {\n  profile: RedactionProfile;\n  extraKeys: readonly string[];\n  maxMetadataValueLengthCap?: number;\n  maxPreviewLengthCap?: number;\n}\n\nexport interface RedactOptions {\n  profile?: RedactionProfile;\n  detectors?: RedactionDetector[];\n  rules?: RedactionRule[];\n  replacement?: string;\n  maxDepth?: number;\n  maxStringLength?: number;\n  collectFindings?: boolean;\n}\n\nexport interface RedactorOptions extends RedactOptions {\n  extraKeys?: readonly string[];\n}\n\nexport const DEFAULT_REDACT_KEYS = [\n  \"authorization\",\n  \"cookie\",\n  \"token\",\n  \"apiKey\",\n  \"password\",\n  \"secret\",\n  \"email\",\n] as const;\n\nexport const SHARE_PROFILE_EXTRA_KEYS = [\n  \"userEmail\",\n  \"customerEmail\",\n  \"phone\",\n  \"phoneNumber\",\n  \"address\",\n  \"ip\",\n  \"ipAddress\",\n  \"sessionId\",\n  \"requestId\",\n  \"correlationId\",\n  \"decisionId\",\n  \"groupId\",\n  \"customerId\",\n  \"userId\",\n  \"accountId\",\n  \"tenantId\",\n  \"orgId\",\n  \"organizationId\",\n  \"traceId\",\n  \"spanId\",\n  \"parentSpanId\",\n  \"currentTask\",\n  \"task\",\n  \"userInput\",\n  \"requestText\",\n  \"conversationText\",\n] as const;\n\nexport const STRICT_PROFILE_EXTRA_KEYS = [\n  \"prompt\",\n  \"completion\",\n  \"input\",\n  \"output\",\n  \"inputPreview\",\n  \"outputPreview\",\n  \"message\",\n  \"messages\",\n  \"transcript\",\n  \"context\",\n  \"document\",\n  \"documents\",\n  \"chunk\",\n  \"chunks\",\n  \"retrieval\",\n  \"query\",\n] as const;\n\ntype CompiledRule =\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep: number }\n  | { key: string; strategy: \"hash\" };\n\ninterface RedactionState {\n  findings: RedactionFinding[];\n  seen: WeakMap<object, unknown>;\n}\n\ninterface PatternDetectorOptions {\n  id: string;\n  pattern: RegExp;\n  severity?: RedactionSeverity;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n\nfunction toKey(key: string): string {\n  return key.toLowerCase();\n}\n\nfunction findCompiledKeyRule(\n  key: string,\n  rules: readonly CompiledRule[],\n): CompiledRule | undefined {\n  const exact = toKey(key);\n  const direct = rules.find((candidate) => candidate.key === exact);\n  if (direct) return direct;\n  return rules.find((candidate) => isCredentialSensitiveKey(key, [candidate.key]));\n}\n\nfunction stableHash(value: string): string {\n  const hash = crypto.createHash(\"sha256\").update(value, \"utf8\").digest(\"hex\");\n  return hash.slice(0, 8);\n}\n\nfunction stringifyScalar(value: unknown): string | undefined {\n  if (typeof value === \"string\") return value;\n  if (typeof value === \"number\" || typeof value === \"boolean\" || typeof value === \"bigint\") {\n    return String(value);\n  }\n  return undefined;\n}\n\nfunction patternDetector(options: PatternDetectorOptions): RedactionDetector {\n  return {\n    id: options.id,\n    severity: options.severity ?? \"warning\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      options.pattern.lastIndex = 0;\n      return options.pattern.test(input.value)\n        ? [{ action: \"replace\", severity: options.severity ?? \"warning\", matchKind: \"value\" }]\n        : [];\n    },\n  };\n}\n\nfunction digitsOnly(value: string): string {\n  return value.replace(/\\D/g, \"\");\n}\n\nfunction passesLuhn(value: string): boolean {\n  const digits = digitsOnly(value);\n  if (digits.length < 13 || digits.length > 19) return false;\n\n  let sum = 0;\n  let double = false;\n  for (let i = digits.length - 1; i >= 0; i -= 1) {\n    let digit = Number(digits[i]);\n    if (double) {\n      digit *= 2;\n      if (digit > 9) digit -= 9;\n    }\n    sum += digit;\n    double = !double;\n  }\n  return sum % 10 === 0;\n}\n\nconst UUID_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\n/** 13-digit Unix epoch milliseconds in a plausible modern range. */\nconst EPOCH_MS_RE = /^1[0-9]{12}$/;\n\nconst EMAIL_RE = /\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b/gi;\n\nfunction pathSuggestsNonCard(path: string): boolean {\n  const normalized = path.toLowerCase().replace(/[^a-z0-9._]/g, \"\");\n  return (\n    /(^|\\.)(tokenusage|usage)(\\.|$)/.test(normalized) ||\n    /(startedat|endedat|durationms|timestamp|createdat|updatedat)(\\.|$)/.test(normalized) ||\n    /(^|\\.)(runid|traceid|spanid|eventid|sessionid|userid|parentid|requestid|correlationid)(\\.|$)/.test(\n      normalized,\n    ) ||\n    /(^|\\.)ts(\\.|$)/.test(normalized)\n  );\n}\n\nfunction isUuidLike(value: string): boolean {\n  return UUID_RE.test(value.trim());\n}\n\nfunction isPlausibleCardCandidate(candidate: string, fullValue: string): boolean {\n  const digits = digitsOnly(candidate);\n  if (digits.length < 13 || digits.length > 19) return false;\n  if (!passesLuhn(candidate)) return false;\n\n  const trimmed = fullValue.trim();\n  if (isUuidLike(trimmed)) return false;\n\n  // Naked epoch-ms timestamps are not PANs.\n  if (EPOCH_MS_RE.test(digits) && digitsOnly(trimmed) === digits && /^\\d+$/.test(trimmed)) {\n    return false;\n  }\n\n  // Reject candidates glued inside longer alphanumeric IDs without card separators.\n  const start = fullValue.indexOf(candidate);\n  if (start >= 0) {\n    const before = fullValue[start - 1];\n    const after = fullValue[start + candidate.length];\n    if (before && /[A-Za-z0-9_]/.test(before)) return false;\n    if (after && /[A-Za-z0-9_]/.test(after)) return false;\n  }\n\n  return true;\n}\n\nfunction looksLikePathOrPackageOrUrl(value: string): boolean {\n  const trimmed = value.trim();\n  if (/^(?:[a-z][a-z0-9+.-]*:)?\\/\\//i.test(trimmed)) return true;\n  if (/^webpack:/i.test(trimmed)) return true;\n  if (/^@[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.@/-]+$/.test(trimmed)) return true;\n  if (/^[A-Za-z]:[\\\\/]/.test(trimmed) || /^[/\\\\]/.test(trimmed)) return true;\n  // Path-like single token (slashes, no whitespace).\n  if (/[\\\\/]/.test(trimmed) && !/\\s/.test(trimmed)) return true;\n  return false;\n}\n\nfunction emailMatchIsPathAdjacent(value: string, index: number, length: number): boolean {\n  const before = value[index - 1];\n  const after = value[index + length];\n  return before === \"/\" || before === \"\\\\\" || after === \"/\" || after === \"\\\\\";\n}\n\nfunction valueContainsEmail(value: string): boolean {\n  if (looksLikePathOrPackageOrUrl(value)) return false;\n  EMAIL_RE.lastIndex = 0;\n  for (const match of value.matchAll(EMAIL_RE)) {\n    const text = match[0] ?? \"\";\n    const index = match.index ?? 0;\n    if (emailMatchIsPathAdjacent(value, index, text.length)) continue;\n    return true;\n  }\n  return false;\n}\n\nconst credentialDetectors: readonly RedactionDetector[] = [\n  patternDetector({\n    id: \"value.authorizationHeader\",\n    pattern: /^(?:basic|bearer|digest|apikey)\\s+[a-z0-9._~+/=-]+$/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.bearerToken\",\n    pattern: /\\bbearer\\s+[a-z0-9._~+/=-]{12,}\\b/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.cookie\",\n    pattern: /\\b[a-z0-9_.-]+=[^;\\s]+(?:;\\s*[a-z0-9_.-]+=[^;\\s]+)+/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.jwt\",\n    pattern: /\\beyJ[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.providerApiKey\",\n    pattern: /\\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.githubToken\",\n    pattern: /\\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.awsAccessKey\",\n    pattern: /\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.privateKey\",\n    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*-----END [A-Z ]*PRIVATE KEY-----/,\n    severity: \"error\",\n  }),\n  {\n    id: \"value.keyValueSecret\",\n    severity: \"error\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      return valueContainsKeyValueSecret(input.value)\n        ? [{ action: \"replace\", severity: \"error\", matchKind: \"value\" }]\n        : [];\n    },\n  },\n  {\n    id: \"value.creditCard\",\n    severity: \"error\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      if (pathSuggestsNonCard(input.path)) return [];\n      if (isUuidLike(input.value)) return [];\n      const candidatePattern = /(?:\\d[ -]?){13,19}/g;\n      for (const match of input.value.matchAll(candidatePattern)) {\n        const candidate = match[0] ?? \"\";\n        if (isPlausibleCardCandidate(candidate, input.value)) {\n          return [{ action: \"replace\", severity: \"error\", matchKind: \"value\" }];\n        }\n      }\n      return [];\n    },\n  },\n];\n\nconst identifierDetectors: readonly RedactionDetector[] = [\n  {\n    id: \"value.email\",\n    severity: \"warning\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      return valueContainsEmail(input.value)\n        ? [{ action: \"replace\", severity: \"warning\", matchKind: \"value\" }]\n        : [];\n    },\n  },\n  patternDetector({\n    id: \"value.phone\",\n    pattern: /\\b(?:\\+\\d{1,3}[\\s.-]?)?(?:\\(?\\d{3}\\)?[\\s.-])\\d{3}[\\s.-]\\d{4}\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv4\",\n    pattern: /\\b(?:(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv6\",\n    pattern: /\\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\\b/i,\n  }),\n];\n\nfunction builtInDetectorsForProfile(profile: RedactionProfile): readonly RedactionDetector[] {\n  if (profile === \"local\") return credentialDetectors;\n  return [...credentialDetectors, ...identifierDetectors];\n}\n\nfunction compileRules(\n  rules?: RedactionRule[],\n  extraKeys?: readonly string[],\n): CompiledRule[] {\n  const out = new Map<string, CompiledRule>();\n\n  const set = (rule: CompiledRule) => {\n    const key = toKey(rule.key);\n    out.set(key, { ...rule, key } as CompiledRule);\n  };\n\n  for (const key of DEFAULT_REDACT_KEYS) {\n    set({ key, strategy: \"full\" });\n  }\n\n  for (const key of extraKeys ?? []) {\n    if (typeof key === \"string\" && key.length > 0) {\n      set({ key, strategy: \"full\" });\n    }\n  }\n\n  for (const rule of rules ?? []) {\n    if (typeof rule === \"string\") {\n      set({ key: rule, strategy: \"full\" });\n      continue;\n    }\n\n    if (rule.strategy === \"full\") set({ key: rule.key, strategy: \"full\" });\n    if (rule.strategy === \"hash\") set({ key: rule.key, strategy: \"hash\" });\n    if (rule.strategy === \"prefix\") {\n      set({\n        key: rule.key,\n        strategy: \"prefix\",\n        keep: typeof rule.keep === \"number\" ? rule.keep : 8,\n      });\n    }\n  }\n\n  return [...out.values()];\n}\n\nfunction actionForRule(rule: CompiledRule): RedactionAction {\n  if (rule.strategy === \"full\") return \"replace\";\n  return rule.strategy;\n}\n\nfunction applyRule(\n  rule: CompiledRule,\n  value: unknown,\n  replacement: string,\n): unknown {\n  if (rule.strategy === \"full\") return replacement;\n\n  const asString = stringifyScalar(value);\n  if (rule.strategy === \"prefix\") {\n    if (asString === undefined) return replacement;\n    const keep = Math.max(0, Math.floor(rule.keep));\n    return asString.length <= keep ? `${asString}…` : `${asString.slice(0, keep)}…`;\n  }\n\n  if (rule.strategy === \"hash\") {\n    if (asString === undefined) return \"[HASH:unknown]\";\n    return `[HASH:${stableHash(asString)}]`;\n  }\n\n  return value;\n}\n\nfunction childPath(path: string, key: string): string {\n  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {\n    return path ? `${path}.${key}` : key;\n  }\n  return `${path || \"$\"}[${JSON.stringify(key)}]`;\n}\n\nfunction indexPath(path: string, index: number): string {\n  return `${path || \"$\"}[${index}]`;\n}\n\nfunction makeFinding(\n  path: string,\n  detector: string,\n  action: RedactionAction,\n  matchKind: RedactionMatchKind,\n  severity: RedactionSeverity = \"warning\",\n  preview?: string,\n): RedactionFinding {\n  return preview === undefined\n    ? { path, detector, action, severity, matchKind }\n    : { path, detector, action, severity, matchKind, preview };\n}\n\nexport function createRedactionProfile(profile: RedactionProfile = \"local\"): ResolvedRedactionProfile {\n  switch (profile) {\n    case \"local\":\n      return { profile: \"local\", extraKeys: [] };\n    case \"share\":\n      return {\n        profile: \"share\",\n        extraKeys: SHARE_PROFILE_EXTRA_KEYS,\n        maxMetadataValueLengthCap: 500,\n        maxPreviewLengthCap: 200,\n      };\n    case \"strict\":\n      return {\n        profile: \"strict\",\n        extraKeys: [...SHARE_PROFILE_EXTRA_KEYS, ...STRICT_PROFILE_EXTRA_KEYS],\n        maxMetadataValueLengthCap: 200,\n        maxPreviewLengthCap: 80,\n      };\n  }\n}\n\nexport class Redactor {\n  readonly #rules: CompiledRule[];\n  readonly #detectors: readonly RedactionDetector[];\n  readonly #profile: RedactionProfile;\n  readonly #replacement: string;\n  readonly #maxDepth: number;\n  readonly #collectFindings: boolean;\n\n  constructor(options?: RedactorOptions) {\n    const resolved = createRedactionProfile(options?.profile ?? \"local\");\n    this.#profile = resolved.profile;\n    this.#rules = compileRules(options?.rules, [\n      ...resolved.extraKeys,\n      ...(options?.extraKeys ?? []),\n    ]);\n    this.#detectors = [\n      ...builtInDetectorsForProfile(this.#profile),\n      ...(options?.detectors ?? []),\n    ];\n    this.#replacement = options?.replacement ?? \"[REDACTED]\";\n    this.#maxDepth = options?.maxDepth ?? 32;\n    this.#collectFindings = options?.collectFindings ?? true;\n  }\n\n  redactValue(key: string, value: unknown): unknown {\n    return this.#redactValue(value, key, key, 0, {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    });\n  }\n\n  redactRecord(record: Record<string, unknown>): Record<string, unknown> {\n    return this.redact(record).value as Record<string, unknown>;\n  }\n\n  redact<T = unknown>(value: T): RedactionResult<T> {\n    const state: RedactionState = {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    };\n    const redacted = this.#redactValue(value, undefined, \"$\", 0, state);\n    return {\n      value: redacted as T,\n      findings: state.findings,\n      redacted: state.findings.some((finding) => finding.action !== \"keep\"),\n      profile: this.#profile,\n    };\n  }\n\n  #recordFinding(state: RedactionState, finding: RedactionFinding): void {\n    if (this.#collectFindings) state.findings.push(finding);\n  }\n\n  #redactValue(\n    value: unknown,\n    key: string | undefined,\n    path: string,\n    depth: number,\n    state: RedactionState,\n  ): unknown {\n    if (depth > this.#maxDepth) {\n      this.#recordFinding(\n        state,\n        makeFinding(path, \"structure.maxDepth\", \"truncate\", \"value\", \"warning\"),\n      );\n      return \"[Truncated]\";\n    }\n\n    if (key !== undefined) {\n      const rule = findCompiledKeyRule(key, this.#rules);\n      if (rule) {\n        this.#recordFinding(\n          state,\n          makeFinding(path, `key.${rule.key}`, actionForRule(rule), \"key\", \"warning\"),\n        );\n        return applyRule(rule, value, this.#replacement);\n      }\n    }\n\n    for (const detector of this.#detectors) {\n      const detections = detector.detect({ path, key, value });\n      for (const detection of detections) {\n        const action = detection.action ?? \"replace\";\n        this.#recordFinding(\n          state,\n          makeFinding(\n            path,\n            detector.id,\n            action,\n            detection.matchKind ?? detector.matchKind ?? \"custom\",\n            detection.severity ?? detector.severity ?? \"warning\",\n            detection.preview,\n          ),\n        );\n        if (action !== \"keep\") {\n          return detection.replacement ?? this.#replacement;\n        }\n      }\n    }\n\n    if (Array.isArray(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: unknown[] = [];\n      state.seen.set(value, out);\n      value.forEach((item, index) => {\n        out[index] = this.#redactValue(item, undefined, indexPath(path, index), depth + 1, state);\n      });\n      return out;\n    }\n\n    if (isRecord(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: Record<string, unknown> = {};\n      state.seen.set(value, out);\n      for (const [entryKey, entryValue] of Object.entries(value)) {\n        out[entryKey] = this.#redactValue(\n          entryValue,\n          entryKey,\n          childPath(path === \"$\" ? \"\" : path, entryKey),\n          depth + 1,\n          state,\n        );\n      }\n      return out;\n    }\n\n    return value;\n  }\n}\n\nexport function createRedactor(options?: RedactorOptions): Redactor {\n  return new Redactor(options);\n}\n\nexport function redact<T = unknown>(value: T, options?: RedactOptions): RedactionResult<T> {\n  return createRedactor(options).redact(value);\n}\n\nexport {\n  KEY_VALUE_SECRET_PATTERN,\n  KEY_VALUE_SECRET_PATTERN_SOURCE,\n  valueContainsKeyValueSecret,\n} from \"./key-value-secret.js\";\n\n","import { redact, type RedactionFinding } from \"@agent-inspect/redact\";\n\nimport type {\n  BannedPhraseOptions,\n  GuardrailEvidence,\n  GuardrailResult,\n  OversizeOutputOptions,\n  PiiLeakOptions,\n  PromptInjectionOptions,\n  RequiredJsonShapeOptions,\n  StructuredOutputOptions,\n  UnsafeToolArgsOptions,\n} from \"./types.js\";\n\nconst DEFAULT_INJECTION_PATTERNS = [\n  \"ignore previous instructions\",\n  \"ignore all prior\",\n  \"disregard your instructions\",\n  \"system prompt\",\n  \"you are now\",\n  \"jailbreak\",\n] as const;\n\nfunction pass(ruleId: string, message: string): GuardrailResult {\n  return { ruleId, status: \"pass\", severity: \"info\", message, evidence: [] };\n}\n\nfunction fail(\n  ruleId: string,\n  message: string,\n  evidence: GuardrailEvidence[],\n  severity: \"error\" | \"warning\" = \"error\",\n): GuardrailResult {\n  return { ruleId, status: severity === \"warning\" ? \"warn\" : \"fail\", severity, message, evidence };\n}\n\nfunction boundedPreview(value: string, max = 80): string {\n  if (value.length <= max) return value;\n  return `${value.slice(0, max - 3)}...`;\n}\n\nexport function evaluateBannedPhrase(\n  text: string,\n  options: BannedPhraseOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.banned-phrase\";\n  const haystack = options.caseInsensitive !== false ? text.toLowerCase() : text;\n  const evidence: GuardrailEvidence[] = [];\n  for (const phrase of options.phrases) {\n    const needle = options.caseInsensitive !== false ? phrase.toLowerCase() : phrase;\n    if (needle.length > 0 && haystack.includes(needle)) {\n      evidence.push({ ruleId, match: phrase, preview: boundedPreview(text) });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"No banned phrases matched.\");\n  }\n  return fail(ruleId, `Matched ${evidence.length} banned phrase(s).`, evidence);\n}\n\nconst SEVERITY_RANK = { info: 0, warning: 1, error: 2 } as const;\n\nexport function evaluatePiiLeak(value: unknown, options: PiiLeakOptions = {}): GuardrailResult {\n  const ruleId = \"guardrail.pii-leak\";\n  const minSeverity = options.minSeverity ?? \"warning\";\n  const result = redact(value, { profile: options.profile ?? \"share\", collectFindings: true });\n  const findings = result.findings.filter(\n    (finding: RedactionFinding) => SEVERITY_RANK[finding.severity] >= SEVERITY_RANK[minSeverity],\n  );\n  if (findings.length === 0) {\n    return pass(ruleId, \"No PII-style redaction findings.\");\n  }\n  const evidence: GuardrailEvidence[] = findings.map((finding) => ({\n    ruleId,\n    path: finding.path,\n    detector: finding.detector,\n    preview: finding.preview,\n  }));\n  return fail(ruleId, `Detected ${findings.length} PII-style finding(s).`, evidence);\n}\n\nfunction measureDepth(value: unknown): number {\n  if (value === null || typeof value !== \"object\") return 0;\n  if (Array.isArray(value)) {\n    return 1 + Math.max(0, ...value.map((item) => measureDepth(item)));\n  }\n  const depths = Object.values(value as Record<string, unknown>).map((item) => measureDepth(item));\n  return 1 + (depths.length === 0 ? 0 : Math.max(...depths));\n}\n\nfunction maxStringLength(value: unknown): number {\n  if (typeof value === \"string\") return value.length;\n  if (value === null || typeof value !== \"object\") return 0;\n  if (Array.isArray(value)) {\n    return Math.max(0, ...value.map((item) => maxStringLength(item)));\n  }\n  return Math.max(0, ...Object.values(value as Record<string, unknown>).map((item) => maxStringLength(item)));\n}\n\nexport function evaluateUnsafeToolArgs(\n  toolName: string,\n  toolArgs: unknown,\n  options: UnsafeToolArgsOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.unsafe-tool-args\";\n  const blocked = new Set((options.blockedTools ?? []).map((name) => name.toLowerCase()));\n  const evidence: GuardrailEvidence[] = [];\n  if (blocked.has(toolName.toLowerCase())) {\n    evidence.push({ ruleId, preview: toolName, match: toolName });\n  }\n  const maxDepth = options.maxDepth ?? 12;\n  const depth = measureDepth(toolArgs);\n  if (depth > maxDepth) {\n    evidence.push({ ruleId, path: \"args\", preview: `depth=${depth}` });\n  }\n  const maxLen = options.maxStringLength ?? 16_384;\n  const longest = maxStringLength(toolArgs);\n  if (longest > maxLen) {\n    evidence.push({ ruleId, path: \"args\", preview: `maxStringLength=${longest}` });\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Tool arguments within configured bounds.\");\n  }\n  return fail(ruleId, \"Unsafe or oversized tool arguments detected.\", evidence);\n}\n\nexport function evaluatePromptInjection(\n  text: string,\n  options: PromptInjectionOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.prompt-injection\";\n  const patterns = options.patterns ?? DEFAULT_INJECTION_PATTERNS;\n  const haystack = text.toLowerCase();\n  const evidence: GuardrailEvidence[] = [];\n  for (const pattern of patterns) {\n    const needle = pattern.toLowerCase();\n    if (needle.length > 0 && haystack.includes(needle)) {\n      evidence.push({ ruleId, match: pattern, preview: boundedPreview(text) });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"No prompt-injection patterns matched.\");\n  }\n  return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, \"warning\");\n}\n\nfunction validateSchemaField(\n  value: unknown,\n  field: StructuredOutputOptions[\"schema\"][string],\n  path: string,\n  evidence: GuardrailEvidence[],\n): void {\n  const ruleId = \"guardrail.structured-output\";\n  if (field.type) {\n    const actual =\n      value === null\n        ? \"null\"\n        : Array.isArray(value)\n          ? \"array\"\n          : typeof value;\n    if (actual !== field.type) {\n      evidence.push({ ruleId, path, preview: `expected ${field.type}, got ${actual}` });\n      return;\n    }\n  }\n  if (field.enum && !field.enum.some((item) => Object.is(item, value))) {\n    evidence.push({ ruleId, path, preview: \"value not in enum\" });\n  }\n  if (field.type === \"object\" && field.required && value && typeof value === \"object\" && !Array.isArray(value)) {\n    const record = value as Record<string, unknown>;\n    for (const key of field.required) {\n      if (!(key in record)) {\n        evidence.push({ ruleId, path: `${path}.${key}`, preview: \"missing required key\" });\n      }\n    }\n  }\n}\n\nexport function evaluateStructuredOutput(\n  value: unknown,\n  options: StructuredOutputOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.structured-output\";\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    return fail(ruleId, \"Structured output must be an object.\", [\n      { ruleId, preview: typeof value },\n    ]);\n  }\n  const record = value as Record<string, unknown>;\n  const evidence: GuardrailEvidence[] = [];\n  for (const [key, field] of Object.entries(options.schema)) {\n    validateSchemaField(record[key], field, key, evidence);\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Structured output matches schema subset.\");\n  }\n  return fail(ruleId, \"Structured output schema violation.\", evidence);\n}\n\nexport function evaluateOversizeOutput(\n  value: unknown,\n  options: OversizeOutputOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.oversize-output\";\n  const text = typeof value === \"string\" ? value : JSON.stringify(value);\n  const maxLength = options.maxLength ?? options.maxSerializedLength ?? 32_768;\n  if (text.length <= maxLength) {\n    return pass(ruleId, \"Output within size limits.\");\n  }\n  return fail(ruleId, `Output exceeds max length (${text.length} > ${maxLength}).`, [\n    { ruleId, preview: `length=${text.length}` },\n  ]);\n}\n\nexport function evaluateRequiredJsonShape(\n  value: unknown,\n  options: RequiredJsonShapeOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.required-json-shape\";\n  let parsed: unknown = value;\n  if (typeof value === \"string\") {\n    try {\n      parsed = JSON.parse(value);\n    } catch {\n      return fail(ruleId, \"Value is not valid JSON.\", [{ ruleId, preview: boundedPreview(value) }]);\n    }\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    return fail(ruleId, \"JSON value must be an object.\", [{ ruleId, preview: typeof parsed }]);\n  }\n  const record = parsed as Record<string, unknown>;\n  const evidence: GuardrailEvidence[] = [];\n  for (const key of options.requiredKeys) {\n    if (!(key in record)) {\n      evidence.push({ ruleId, path: key, preview: \"missing required key\" });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Required JSON keys present.\");\n  }\n  return fail(ruleId, \"Missing required JSON keys.\", evidence);\n}\n","import {\n  evaluateBannedPhrase,\n  evaluateOversizeOutput,\n  evaluatePiiLeak,\n  evaluatePromptInjection,\n  evaluateRequiredJsonShape,\n  evaluateStructuredOutput,\n  evaluateUnsafeToolArgs,\n} from \"./rules.js\";\nimport type {\n  GuardrailInput,\n  GuardrailResult,\n  GuardrailRuleId,\n  GuardrailRunResult,\n  RunGuardrailsOptions,\n} from \"./types.js\";\n\nconst ALL_RULES: GuardrailRuleId[] = [\n  \"guardrail.banned-phrase\",\n  \"guardrail.pii-leak\",\n  \"guardrail.unsafe-tool-args\",\n  \"guardrail.prompt-injection\",\n  \"guardrail.structured-output\",\n  \"guardrail.oversize-output\",\n  \"guardrail.required-json-shape\",\n];\n\nfunction isErrorFailure(result: GuardrailResult): boolean {\n  return result.status === \"fail\" && result.severity === \"error\";\n}\n\nfunction runRule(ruleId: GuardrailRuleId, input: GuardrailInput, options: RunGuardrailsOptions): GuardrailResult | undefined {\n  switch (ruleId) {\n    case \"guardrail.banned-phrase\": {\n      if (!options.bannedPhrase || input.text === undefined) return undefined;\n      return evaluateBannedPhrase(input.text, options.bannedPhrase);\n    }\n    case \"guardrail.pii-leak\": {\n      if (input.value === undefined && input.text === undefined) return undefined;\n      return evaluatePiiLeak(input.value ?? input.text, options.piiLeak);\n    }\n    case \"guardrail.unsafe-tool-args\": {\n      if (!input.toolName) return undefined;\n      return evaluateUnsafeToolArgs(input.toolName, input.toolArgs ?? {}, options.unsafeToolArgs);\n    }\n    case \"guardrail.prompt-injection\": {\n      if (input.text === undefined) return undefined;\n      return evaluatePromptInjection(input.text, options.promptInjection);\n    }\n    case \"guardrail.structured-output\": {\n      if (!options.structuredOutput || input.value === undefined) return undefined;\n      return evaluateStructuredOutput(input.value, options.structuredOutput);\n    }\n    case \"guardrail.oversize-output\": {\n      if (input.value === undefined && input.text === undefined) return undefined;\n      return evaluateOversizeOutput(input.value ?? input.text, options.oversizeOutput);\n    }\n    case \"guardrail.required-json-shape\": {\n      if (!options.requiredJsonShape || (input.value === undefined && input.text === undefined)) return undefined;\n      return evaluateRequiredJsonShape(input.value ?? input.text!, options.requiredJsonShape);\n    }\n    default:\n      return undefined;\n  }\n}\n\nexport function runGuardrails(input: GuardrailInput, options: RunGuardrailsOptions = {}): GuardrailRunResult {\n  const selected = options.rules ?? ALL_RULES;\n  const results: GuardrailResult[] = [];\n  for (const ruleId of selected) {\n    const result = runRule(ruleId, input, options);\n    if (result) results.push(result);\n  }\n  const ok = !results.some(isErrorFailure);\n  return { ok, results };\n}\n\nexport { ALL_RULES as DEFAULT_GUARDRAIL_RULES };\n"]}

package/dist/index.mjs

@@ -52,6 +52,17 @@ function isCredentialSensitiveKey(key, sensitiveKeys) {
   return false;
 }
 
+// packages/redact/src/key-value-secret.ts
+var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})`;
+var KEY_VALUE_SECRET_PATTERN = new RegExp(
+  KEY_VALUE_SECRET_PATTERN_SOURCE,
+  "i"
+);
+function valueContainsKeyValueSecret(value) {
+  KEY_VALUE_SECRET_PATTERN.lastIndex = 0;
+  return KEY_VALUE_SECRET_PATTERN.test(value);
+}
+
 // packages/redact/src/index.ts
 var DEFAULT_REDACT_KEYS = [
   "authorization",
@@ -258,6 +269,15 @@ var credentialDetectors = [
     pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/,
     severity: "error"
   }),
+  {
+    id: "value.keyValueSecret",
+    severity: "error",
+    matchKind: "value",
+    detect(input) {
+      if (typeof input.value !== "string") return [];
+      return valueContainsKeyValueSecret(input.value) ? [{ action: "replace", severity: "error", matchKind: "value" }] : [];
+    }
+  },
   {
     id: "value.creditCard",
     severity: "error",

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../redact/src/sensitive-key.ts","../../redact/src/index.ts","../src/rules.ts","../src/run.ts"],"names":[],"mappings":";;;;;AAMA,SAAS,wBAAwB,KAAA,EAAwB;AACvD,EAAA,OAAO,QAAA,CAAS,KAAK,KAAK,CAAA;AAC5B;AAOO,SAAS,sBAAsB,KAAA,EAAuB;AAC3D,EAAA,OAAO,KAAA,CACJ,OAAA,CAAQ,oBAAA,EAAsB,OAAO,CAAA,CACrC,WAAA,EAAY,CACZ,OAAA,CAAQ,aAAA,EAAe,GAAG,CAAA,CAC1B,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC3B;AAEO,IAAM,mCAAwD,IAAI,GAAA;AAAA,EACvE;AAAA,IACE,QAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA,eAAA;AAAA,IACA,aAAA;AAAA,IACA,aAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF,CAAE,IAAI,qBAAqB;AAC7B,CAAA;AAEA,SAAS,qBAAqB,UAAA,EAA6B;AACzD,EAAA,IAAI,gCAAA,CAAiC,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,KAAA;AAC7D,EAAA,IAAI,UAAA,KAAe,SAAS,OAAO,IAAA;AACnC,EAAA,IAAI,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,KAAA;AAC1C,EAAA,OAAO,UAAA,CAAW,SAAS,OAAO,CAAA;AACpC;AAUO,SAAS,wBAAA,CACd,KACA,aAAA,EACS;AACT,EAAA,IAAI,CAAC,KAAK,OAAO,KAAA;AACjB,EAAA,MAAM,UAAA,GAAa,sBAAsB,GAAG,CAAA;AAC5C,EAAA,IAAI,CAAC,YAAY,OAAO,KAAA;AACxB,EAAA,IAAI,gCAAA,CAAiC,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,KAAA;AAE7D,EAAA,MAAM,mBAAA,GAAsB,wBAAwB,GAAG,CAAA;AAEvD,EAAA,KAAA,MAAW,aAAa,aAAA,EAAe;AACrC,IAAA,MAAM,CAAA,GAAI,sBAAsB,SAAS,CAAA;AACzC,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,IAAI,MAAM,OAAA,EAAS;AACjB,MAAA,IAAI,oBAAA,CAAqB,UAAU,CAAA,EAAG,OAAO,IAAA;AAC7C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,UAAA,KAAe,GAAG,OAAO,IAAA;AAC7B,IAAA,IAAI,WAAW,QAAA,CAAS,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,GAAG,OAAO,IAAA;AACzC,IAAA,IAAI,uBAAuB,UAAA,CAAW,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA,CAAG,GAAG,OAAO,IAAA;AAAA,EACpE;AACA,EAAA,OAAO,KAAA;AACT;;;ACJO,IAAM,mBAAA,GAAsB;AAAA,EACjC,eAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,wBAAA,GAA2B;AAAA,EACtC,WAAA;AAAA,EACA,eAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,yBAAA,GAA4B;AAAA,EACvC,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA;AAkBA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGA,SAAS,MAAM,GAAA,EAAqB;AAClC,EAAA,OAAO,IAAI,WAAA,EAAY;AACzB;AAEA,SAAS,mBAAA,CACP,KACA,KAAA,EAC0B;AAC1B,EAAA,MAAM,KAAA,GAAQ,MAAM,GAAG,CAAA;AACvB,EAAA,MAAM,SAAS,KAAA,CAAM,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,QAAQ,KAAK,CAAA;AAChE,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,SAAA,KAAc,wBAAA,CAAyB,KAAK,CAAC,SAAA,CAAU,GAAG,CAAC,CAAC,CAAA;AACjF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,OAAO,KAAA,EAAO,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC3E,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AACxB;AAEA,SAAS,gBAAgB,KAAA,EAAoC;AAC3D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,OAAO,UAAU,SAAA,IAAa,OAAO,UAAU,QAAA,EAAU;AACxF,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,gBAAgB,OAAA,EAAoD;AAC3E,EAAA,OAAO;AAAA,IACL,IAAI,OAAA,CAAQ,EAAA;AAAA,IACZ,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA;AAAA,IAC9B,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAA,CAAQ,QAAQ,SAAA,GAAY,CAAA;AAC5B,MAAA,OAAO,QAAQ,OAAA,CAAQ,IAAA,CAAK,MAAM,KAAK,CAAA,GACnC,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA,EAAW,WAAW,OAAA,EAAS,IACnF,EAAC;AAAA,IACP;AAAA,GACF;AACF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAChC;AAEA,SAAS,WAAW,KAAA,EAAwB;AAC1C,EAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,IAAI,OAAO,KAAA;AAErD,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,IAAS,IAAI,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAC9C,IAAA,IAAI,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAA;AAC5B,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,IAAS,CAAA;AACT,MAAA,IAAI,KAAA,GAAQ,GAAG,KAAA,IAAS,CAAA;AAAA,IAC1B;AACA,IAAA,GAAA,IAAO,KAAA;AACP,IAAA,MAAA,GAAS,CAAC,MAAA;AAAA,EACZ;AACA,EAAA,OAAO,MAAM,EAAA,KAAO,CAAA;AACtB;AAEA,IAAM,OAAA,GACJ,4EAAA;AAGF,IAAM,WAAA,GAAc,cAAA;AAEpB,IAAM,QAAA,GAAW,6CAAA;AAEjB,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,MAAM,aAAa,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,gBAAgB,EAAE,CAAA;AAChE,EAAA,OACE,gCAAA,CAAiC,KAAK,UAAU,CAAA,IAChD,qEAAqE,IAAA,CAAK,UAAU,KACpF,8FAAA,CAA+F,IAAA;AAAA,IAC7F;AAAA,GACF,IACA,gBAAA,CAAiB,IAAA,CAAK,UAAU,CAAA;AAEpC;AAEA,SAAS,WAAW,KAAA,EAAwB;AAC1C,EAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA;AAClC;AAEA,SAAS,wBAAA,CAAyB,WAAmB,SAAA,EAA4B;AAC/E,EAAA,MAAM,MAAA,GAAS,WAAW,SAAS,CAAA;AACnC,EAAA,IAAI,OAAO,MAAA,GAAS,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,IAAI,OAAO,KAAA;AACrD,EAAA,IAAI,CAAC,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,KAAA;AAEnC,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAC/B,EAAA,IAAI,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,KAAA;AAGhC,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA,IAAK,UAAA,CAAW,OAAO,CAAA,KAAM,MAAA,IAAU,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACvF,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,OAAA,CAAQ,SAAS,CAAA;AACzC,EAAA,IAAI,SAAS,CAAA,EAAG;AACd,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,KAAA,GAAQ,CAAC,CAAA;AAClC,IAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,GAAQ,SAAA,CAAU,MAAM,CAAA;AAChD,IAAA,IAAI,MAAA,IAAU,cAAA,CAAe,IAAA,CAAK,MAAM,GAAG,OAAO,KAAA;AAClD,IAAA,IAAI,KAAA,IAAS,cAAA,CAAe,IAAA,CAAK,KAAK,GAAG,OAAO,KAAA;AAAA,EAClD;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,4BAA4B,KAAA,EAAwB;AAC3D,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,IAAI,+BAAA,CAAgC,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AAC1D,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,IAAI,uCAAA,CAAwC,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AAClE,EAAA,IAAI,iBAAA,CAAkB,KAAK,OAAO,CAAA,IAAK,SAAS,IAAA,CAAK,OAAO,GAAG,OAAO,IAAA;AAEtE,EAAA,IAAI,OAAA,CAAQ,KAAK,OAAO,CAAA,IAAK,CAAC,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AACzD,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,wBAAA,CAAyB,KAAA,EAAe,KAAA,EAAe,MAAA,EAAyB;AACvF,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,GAAQ,MAAM,CAAA;AAClC,EAAA,OAAO,WAAW,GAAA,IAAO,MAAA,KAAW,IAAA,IAAQ,KAAA,KAAU,OAAO,KAAA,KAAU,IAAA;AACzE;AAEA,SAAS,mBAAmB,KAAA,EAAwB;AAClD,EAAA,IAAI,2BAAA,CAA4B,KAAK,CAAA,EAAG,OAAO,KAAA;AAC/C,EAAA,QAAA,CAAS,SAAA,GAAY,CAAA;AACrB,EAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,QAAA,CAAS,QAAQ,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AACzB,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,CAAA;AAC7B,IAAA,IAAI,wBAAA,CAAyB,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACzD,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,2BAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,oCAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,cAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,WAAA;AAAA,IACJ,OAAA,EAAS,gEAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,sBAAA;AAAA,IACJ,OAAA,EAAS,0FAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,+CAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,oBAAA;AAAA,IACJ,OAAA,EAAS,+BAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,kBAAA;AAAA,IACJ,OAAA,EAAS,2EAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,IAAI,mBAAA,CAAoB,KAAA,CAAM,IAAI,CAAA,SAAU,EAAC;AAC7C,MAAA,IAAI,UAAA,CAAW,KAAA,CAAM,KAAK,CAAA,SAAU,EAAC;AACrC,MAAA,MAAM,gBAAA,GAAmB,qBAAA;AACzB,MAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,EAAG;AAC1D,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AAC9B,QAAA,IAAI,wBAAA,CAAyB,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,EAAG;AACpD,UAAA,OAAO,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,UAAU,OAAA,EAAS,SAAA,EAAW,SAAS,CAAA;AAAA,QACtE;AAAA,MACF;AACA,MAAA,OAAO,EAAC;AAAA,IACV;AAAA;AAEJ,CAAA;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD;AAAA,IACE,EAAA,EAAI,aAAA;AAAA,IACJ,QAAA,EAAU,SAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAO,kBAAA,CAAmB,KAAA,CAAM,KAAK,CAAA,GACjC,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,SAAA,EAAW,SAAA,EAAW,OAAA,EAAS,IAC/D,EAAC;AAAA,IACP;AAAA,GACF;AAAA,EACA,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,aAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV;AACH,CAAA;AAEA,SAAS,2BAA2B,OAAA,EAAyD;AAC3F,EAAA,IAAI,OAAA,KAAY,SAAS,OAAO,mBAAA;AAChC,EAAA,OAAO,CAAC,GAAG,mBAAA,EAAqB,GAAG,mBAAmB,CAAA;AACxD;AAEA,SAAS,YAAA,CACP,OACA,SAAA,EACgB;AAChB,EAAA,MAAM,GAAA,uBAAU,GAAA,EAA0B;AAE1C,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAuB;AAClC,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAC1B,IAAA,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,KAAqB,CAAA;AAAA,EAC/C,CAAA;AAEA,EAAA,KAAA,MAAW,OAAO,mBAAA,EAAqB;AACrC,IAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,EAC/B;AAEA,EAAA,KAAA,MAAW,GAAA,IAAO,SAAA,IAAa,EAAC,EAAG;AACjC,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,EAAG;AAC7C,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,IAC/B;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,IAAS,EAAC,EAAG;AAC9B,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,QAAQ,CAAA;AACnC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,MAAA,GAAA,CAAI;AAAA,QACF,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,QAAA,EAAU,QAAA;AAAA,QACV,MAAM,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO;AAAA,OACnD,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,GAAG,GAAA,CAAI,MAAA,EAAQ,CAAA;AACzB;AAEA,SAAS,cAAc,IAAA,EAAqC;AAC1D,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,SAAA;AACrC,EAAA,OAAO,IAAA,CAAK,QAAA;AACd;AAEA,SAAS,SAAA,CACP,IAAA,EACA,KAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,WAAA;AAErC,EAAA,MAAM,QAAA,GAAW,gBAAgB,KAAK,CAAA;AACtC,EAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,WAAA;AACnC,IAAA,MAAM,IAAA,GAAO,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAC9C,IAAA,OAAO,QAAA,CAAS,MAAA,IAAU,IAAA,GAAO,CAAA,EAAG,QAAQ,CAAA,MAAA,CAAA,GAAM,CAAA,EAAG,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,IAAI,CAAC,CAAA,MAAA,CAAA;AAAA,EAC9E;AAEA,EAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAQ;AAC5B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,gBAAA;AACnC,IAAA,OAAO,CAAA,MAAA,EAAS,UAAA,CAAW,QAAQ,CAAC,CAAA,CAAA,CAAA;AAAA,EACtC;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,SAAA,CAAU,MAAc,GAAA,EAAqB;AACpD,EAAA,IAAI,4BAAA,CAA6B,IAAA,CAAK,GAAG,CAAA,EAAG;AAC1C,IAAA,OAAO,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,GAAK,GAAA;AAAA,EACnC;AACA,EAAA,OAAO,GAAG,IAAA,IAAQ,GAAG,IAAI,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,CAAA;AAC9C;AAEA,SAAS,SAAA,CAAU,MAAc,KAAA,EAAuB;AACtD,EAAA,OAAO,CAAA,EAAG,IAAA,IAAQ,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,CAAA;AAChC;AAEA,SAAS,YACP,IAAA,EACA,QAAA,EACA,QACA,SAAA,EACA,QAAA,GAA8B,WAC9B,OAAA,EACkB;AAClB,EAAA,OAAO,OAAA,KAAY,MAAA,GACf,EAAE,IAAA,EAAM,UAAU,MAAA,EAAQ,QAAA,EAAU,SAAA,EAAU,GAC9C,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,QAAA,EAAU,WAAW,OAAA,EAAQ;AAC7D;AAEO,SAAS,sBAAA,CAAuB,UAA4B,OAAA,EAAmC;AACpG,EAAA,QAAQ,OAAA;AAAS,IACf,KAAK,OAAA;AACH,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,SAAA,EAAW,EAAC,EAAE;AAAA,IAC3C,KAAK,OAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,OAAA;AAAA,QACT,SAAA,EAAW,wBAAA;AAAA,QACX,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA,IACF,KAAK,QAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,QAAA;AAAA,QACT,SAAA,EAAW,CAAC,GAAG,wBAAA,EAA0B,GAAG,yBAAyB,CAAA;AAAA,QACrE,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA;AAEN;AAEO,IAAM,WAAN,MAAe;AAAA,EACX,MAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA;AAAA,EAET,YAAY,OAAA,EAA2B;AACrC,IAAA,MAAM,QAAA,GAAW,sBAAA,CAAuB,OAAA,EAAS,OAAA,IAAW,OAAO,CAAA;AACnE,IAAA,IAAA,CAAK,WAAW,QAAA,CAAS,OAAA;AACzB,IAAA,IAAA,CAAK,MAAA,GAAS,YAAA,CAAa,OAAA,EAAS,KAAA,EAAO;AAAA,MACzC,GAAG,QAAA,CAAS,SAAA;AAAA,MACZ,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC5B,CAAA;AACD,IAAA,IAAA,CAAK,UAAA,GAAa;AAAA,MAChB,GAAG,0BAAA,CAA2B,IAAA,CAAK,QAAQ,CAAA;AAAA,MAC3C,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC7B;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,SAAS,WAAA,IAAe,YAAA;AAC5C,IAAA,IAAA,CAAK,SAAA,GAAY,SAAS,QAAA,IAAY,EAAA;AACtC,IAAA,IAAA,CAAK,gBAAA,GAAmB,SAAS,eAAA,IAAmB,IAAA;AAAA,EACtD;AAAA,EAEA,WAAA,CAAY,KAAa,KAAA,EAAyB;AAChD,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,KAAA,EAAO,GAAA,EAAK,KAAK,CAAA,EAAG;AAAA,MAC3C,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACpC,CAAA;AAAA,EACH;AAAA,EAEA,aAAa,MAAA,EAA0D;AACrE,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA;AAAA,EAC7B;AAAA,EAEA,OAAoB,KAAA,EAA8B;AAChD,IAAA,MAAM,KAAA,GAAwB;AAAA,MAC5B,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACrC;AACA,IAAA,MAAM,WAAW,IAAA,CAAK,YAAA,CAAa,OAAO,MAAA,EAAW,GAAA,EAAK,GAAG,KAAK,CAAA;AAClE,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,QAAA;AAAA,MACP,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAA,EAAU,MAAM,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,WAAW,MAAM,CAAA;AAAA,MACpE,SAAS,IAAA,CAAK;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,cAAA,CAAe,OAAuB,OAAA,EAAiC;AACrE,IAAA,IAAI,IAAA,CAAK,gBAAA,EAAkB,KAAA,CAAM,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,EACxD;AAAA,EAEA,YAAA,CACE,KAAA,EACA,GAAA,EACA,IAAA,EACA,OACA,KAAA,EACS;AACT,IAAA,IAAI,KAAA,GAAQ,KAAK,SAAA,EAAW;AAC1B,MAAA,IAAA,CAAK,cAAA;AAAA,QACH,KAAA;AAAA,QACA,WAAA,CAAY,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,SAAS,SAAS;AAAA,OACxE;AACA,MAAA,OAAO,aAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,MAAM,IAAA,GAAO,mBAAA,CAAoB,GAAA,EAAK,IAAA,CAAK,MAAM,CAAA;AACjD,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA,CAAY,IAAA,EAAM,CAAA,IAAA,EAAO,IAAA,CAAK,GAAG,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS;AAAA,SAC5E;AACA,QAAA,OAAO,SAAA,CAAU,IAAA,EAAM,KAAA,EAAO,IAAA,CAAK,YAAY,CAAA;AAAA,MACjD;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,QAAA,IAAY,KAAK,UAAA,EAAY;AACtC,MAAA,MAAM,aAAa,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,GAAA,EAAK,OAAO,CAAA;AACvD,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,MAAM,MAAA,GAAS,UAAU,MAAA,IAAU,SAAA;AACnC,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA;AAAA,YACE,IAAA;AAAA,YACA,QAAA,CAAS,EAAA;AAAA,YACT,MAAA;AAAA,YACA,SAAA,CAAU,SAAA,IAAa,QAAA,CAAS,SAAA,IAAa,QAAA;AAAA,YAC7C,SAAA,CAAU,QAAA,IAAY,QAAA,CAAS,QAAA,IAAY,SAAA;AAAA,YAC3C,SAAA,CAAU;AAAA;AACZ,SACF;AACA,QAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,UAAA,OAAO,SAAA,CAAU,eAAe,IAAA,CAAK,YAAA;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAAiB,EAAC;AACxB,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,KAAA,KAAU;AAC7B,QAAA,GAAA,CAAI,KAAK,CAAA,GAAI,IAAA,CAAK,YAAA,CAAa,IAAA,EAAM,MAAA,EAAW,SAAA,CAAU,IAAA,EAAM,KAAK,CAAA,EAAG,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,MAC1F,CAAC,CAAA;AACD,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAA,CAAS,KAAK,CAAA,EAAG;AACnB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAA+B,EAAC;AACtC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,MAAW,CAAC,QAAA,EAAU,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1D,QAAA,GAAA,CAAI,QAAQ,IAAI,IAAA,CAAK,YAAA;AAAA,UACnB,UAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA,CAAU,IAAA,KAAS,GAAA,GAAM,EAAA,GAAK,MAAM,QAAQ,CAAA;AAAA,UAC5C,KAAA,GAAQ,CAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;AAEO,SAAS,eAAe,OAAA,EAAqC;AAClE,EAAA,OAAO,IAAI,SAAS,OAAO,CAAA;AAC7B;AAEO,SAAS,MAAA,CAAoB,OAAU,OAAA,EAA6C;AACzF,EAAA,OAAO,cAAA,CAAe,OAAO,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC7C;;;AC/mBA,IAAM,0BAAA,GAA6B;AAAA,EACjC,8BAAA;AAAA,EACA,kBAAA;AAAA,EACA,6BAAA;AAAA,EACA,eAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,IAAA,CAAK,QAAgB,OAAA,EAAkC;AAC9D,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAQ,MAAA,EAAQ,UAAU,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAU,EAAC,EAAE;AAC3E;AAEA,SAAS,IAAA,CACP,MAAA,EACA,OAAA,EACA,QAAA,EACA,WAAgC,OAAA,EACf;AACjB,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAQ,QAAA,KAAa,YAAY,MAAA,GAAS,MAAA,EAAQ,QAAA,EAAU,OAAA,EAAS,QAAA,EAAS;AACjG;AAEA,SAAS,cAAA,CAAe,KAAA,EAAe,GAAA,GAAM,EAAA,EAAY;AACvD,EAAA,IAAI,KAAA,CAAM,MAAA,IAAU,GAAA,EAAK,OAAO,KAAA;AAChC,EAAA,OAAO,GAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,GAAA,GAAM,CAAC,CAAC,CAAA,GAAA,CAAA;AACnC;AAEO,SAAS,oBAAA,CACd,MACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,yBAAA;AACf,EAAA,MAAM,WAAW,OAAA,CAAQ,eAAA,KAAoB,KAAA,GAAQ,IAAA,CAAK,aAAY,GAAI,IAAA;AAC1E,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,MAAA,IAAU,QAAQ,OAAA,EAAS;AACpC,IAAA,MAAM,SAAS,OAAA,CAAQ,eAAA,KAAoB,KAAA,GAAQ,MAAA,CAAO,aAAY,GAAI,MAAA;AAC1E,IAAA,IAAI,OAAO,MAAA,GAAS,CAAA,IAAK,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG;AAClD,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,QAAQ,OAAA,EAAS,cAAA,CAAe,IAAI,CAAA,EAAG,CAAA;AAAA,IACxE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,4BAA4B,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,QAAA,EAAW,QAAA,CAAS,MAAM,sBAAsB,QAAQ,CAAA;AAC9E;AAEA,IAAM,gBAAgB,EAAE,IAAA,EAAM,GAAG,OAAA,EAAS,CAAA,EAAG,OAAO,CAAA,EAAE;AAE/C,SAAS,eAAA,CAAgB,KAAA,EAAgB,OAAA,GAA0B,EAAC,EAAoB;AAC7F,EAAA,MAAM,MAAA,GAAS,oBAAA;AACf,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,SAAA;AAC3C,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,EAAO,EAAE,OAAA,EAAS,QAAQ,OAAA,IAAW,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,CAAA;AAC3F,EAAA,MAAM,QAAA,GAAW,OAAO,QAAA,CAAS,MAAA;AAAA,IAC/B,CAAC,OAAA,KAA8B,aAAA,CAAc,QAAQ,QAAQ,CAAA,IAAK,cAAc,WAAW;AAAA,GAC7F;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,kCAAkC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,QAAA,GAAgC,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,MAAa;AAAA,IAC/D,MAAA;AAAA,IACA,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,SAAS,OAAA,CAAQ;AAAA,GACnB,CAAE,CAAA;AACF,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,SAAA,EAAY,QAAA,CAAS,MAAM,0BAA0B,QAAQ,CAAA;AACnF;AAEA,SAAS,aAAa,KAAA,EAAwB;AAC5C,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,UAAU,OAAO,CAAA;AACxD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS,YAAA,CAAa,IAAI,CAAC,CAAC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,KAAgC,CAAA,CAAE,IAAI,CAAC,IAAA,KAAS,YAAA,CAAa,IAAI,CAAC,CAAA;AAC/F,EAAA,OAAO,CAAA,IAAK,OAAO,MAAA,KAAW,CAAA,GAAI,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,MAAM,CAAA,CAAA;AAC1D;AAEA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA,CAAM,MAAA;AAC5C,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,UAAU,OAAO,CAAA;AACxD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS,eAAA,CAAgB,IAAI,CAAC,CAAC,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,OAAO,MAAA,CAAO,KAAgC,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS,eAAA,CAAgB,IAAI,CAAC,CAAC,CAAA;AAC5G;AAEO,SAAS,sBAAA,CACd,QAAA,EACA,QAAA,EACA,OAAA,GAAiC,EAAC,EACjB;AACjB,EAAA,MAAM,MAAA,GAAS,4BAAA;AACf,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAA,CAAK,OAAA,CAAQ,YAAA,IAAgB,EAAC,EAAG,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,WAAA,EAAa,CAAC,CAAA;AACtF,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA,EAAG;AACvC,IAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,SAAS,QAAA,EAAU,KAAA,EAAO,UAAU,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,EAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,aAAa,QAAQ,CAAA;AACnC,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,QAAQ,OAAA,EAAS,CAAA,MAAA,EAAS,KAAK,CAAA,CAAA,EAAI,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,MAAA,GAAS,QAAQ,eAAA,IAAmB,KAAA;AAC1C,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,IAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,QAAQ,OAAA,EAAS,CAAA,gBAAA,EAAmB,OAAO,CAAA,CAAA,EAAI,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,0CAA0C,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,8CAAA,EAAgD,QAAQ,CAAA;AAC9E;AAEO,SAAS,uBAAA,CACd,IAAA,EACA,OAAA,GAAkC,EAAC,EAClB;AACjB,EAAA,MAAM,MAAA,GAAS,4BAAA;AACf,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,0BAAA;AACrC,EAAA,MAAM,QAAA,GAAW,KAAK,WAAA,EAAY;AAClC,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAM,MAAA,GAAS,QAAQ,WAAA,EAAY;AACnC,IAAA,IAAI,OAAO,MAAA,GAAS,CAAA,IAAK,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG;AAClD,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,SAAS,OAAA,EAAS,cAAA,CAAe,IAAI,CAAA,EAAG,CAAA;AAAA,IACzE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,uCAAuC,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,QAAA,EAAW,SAAS,MAAM,CAAA,sBAAA,CAAA,EAA0B,UAAU,SAAS,CAAA;AAC7F;AAEA,SAAS,mBAAA,CACP,KAAA,EACA,KAAA,EACA,IAAA,EACA,QAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,6BAAA;AACf,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,MAAM,MAAA,GACJ,UAAU,IAAA,GACN,MAAA,GACA,MAAM,OAAA,CAAQ,KAAK,CAAA,GACjB,OAAA,GACA,OAAO,KAAA;AACf,IAAA,IAAI,MAAA,KAAW,MAAM,IAAA,EAAM;AACzB,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAA,SAAA,EAAY,KAAA,CAAM,IAAI,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAI,CAAA;AAChF,MAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,IAAQ,CAAC,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,CAAC,IAAA,KAAS,MAAA,CAAO,EAAA,CAAG,IAAA,EAAM,KAAK,CAAC,CAAA,EAAG;AACpE,IAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,qBAAqB,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,QAAA,IAAY,KAAA,CAAM,QAAA,IAAY,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5G,IAAA,MAAM,MAAA,GAAS,KAAA;AACf,IAAA,KAAA,MAAW,GAAA,IAAO,MAAM,QAAA,EAAU;AAChC,MAAA,IAAI,EAAE,OAAO,MAAA,CAAA,EAAS;AACpB,QAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,OAAA,EAAS,sBAAA,EAAwB,CAAA;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wBAAA,CACd,OACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,6BAAA;AACf,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/D,IAAA,OAAO,IAAA,CAAK,QAAQ,sCAAA,EAAwC;AAAA,MAC1D,EAAE,MAAA,EAAQ,OAAA,EAAS,OAAO,KAAA;AAAM,KACjC,CAAA;AAAA,EACH;AACA,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzD,IAAA,mBAAA,CAAoB,MAAA,CAAO,GAAG,CAAA,EAAG,KAAA,EAAO,KAAK,QAAQ,CAAA;AAAA,EACvD;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,0CAA0C,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,qCAAA,EAAuC,QAAQ,CAAA;AACrE;AAEO,SAAS,sBAAA,CACd,KAAA,EACA,OAAA,GAAiC,EAAC,EACjB;AACjB,EAAA,MAAM,MAAA,GAAS,2BAAA;AACf,EAAA,MAAM,OAAO,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,IAAA,CAAK,UAAU,KAAK,CAAA;AACrE,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,mBAAA,IAAuB,KAAA;AACtE,EAAA,IAAI,IAAA,CAAK,UAAU,SAAA,EAAW;AAC5B,IAAA,OAAO,IAAA,CAAK,QAAQ,4BAA4B,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,2BAAA,EAA8B,KAAK,MAAM,CAAA,GAAA,EAAM,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,IAChF,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAG,GAC5C,CAAA;AACH;AAEO,SAAS,yBAAA,CACd,OACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,+BAAA;AACf,EAAA,IAAI,MAAA,GAAkB,KAAA;AACtB,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,0BAAA,EAA4B,CAAC,EAAE,MAAA,EAAQ,OAAA,EAAS,cAAA,CAAe,KAAK,CAAA,EAAG,CAAC,CAAA;AAAA,IAC9F;AAAA,EACF;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,IAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,+BAAA,EAAiC,CAAC,EAAE,QAAQ,OAAA,EAAS,OAAO,MAAA,EAAQ,CAAC,CAAA;AAAA,EAC3F;AACA,EAAA,MAAM,MAAA,GAAS,MAAA;AACf,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,GAAA,IAAO,QAAQ,YAAA,EAAc;AACtC,IAAA,IAAI,EAAE,OAAO,MAAA,CAAA,EAAS;AACpB,MAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,MAAM,GAAA,EAAK,OAAA,EAAS,wBAAwB,CAAA;AAAA,IACtE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,6BAA6B,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,6BAAA,EAA+B,QAAQ,CAAA;AAC7D;;;AChOA,IAAM,SAAA,GAA+B;AAAA,EACnC,yBAAA;AAAA,EACA,oBAAA;AAAA,EACA,4BAAA;AAAA,EACA,4BAAA;AAAA,EACA,6BAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACF;AAEA,SAAS,eAAe,MAAA,EAAkC;AACxD,EAAA,OAAO,MAAA,CAAO,MAAA,KAAW,MAAA,IAAU,MAAA,CAAO,QAAA,KAAa,OAAA;AACzD;AAEA,SAAS,OAAA,CAAQ,MAAA,EAAyB,KAAA,EAAuB,OAAA,EAA4D;AAC3H,EAAA,QAAQ,MAAA;AAAQ,IACd,KAAK,yBAAA,EAA2B;AAC9B,MAAA,IAAI,CAAC,OAAA,CAAQ,YAAA,IAAgB,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAC9D,MAAA,OAAO,oBAAA,CAAqB,KAAA,CAAM,IAAA,EAAM,OAAA,CAAQ,YAAY,CAAA;AAAA,IAC9D;AAAA,IACA,KAAK,oBAAA,EAAsB;AACzB,MAAA,IAAI,MAAM,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAClE,MAAA,OAAO,gBAAgB,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAM,QAAQ,OAAO,CAAA;AAAA,IACnE;AAAA,IACA,KAAK,4BAAA,EAA8B;AACjC,MAAA,IAAI,CAAC,KAAA,CAAM,QAAA,EAAU,OAAO,MAAA;AAC5B,MAAA,OAAO,sBAAA,CAAuB,MAAM,QAAA,EAAU,KAAA,CAAM,YAAY,EAAC,EAAG,QAAQ,cAAc,CAAA;AAAA,IAC5F;AAAA,IACA,KAAK,4BAAA,EAA8B;AACjC,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,EAAW,OAAO,MAAA;AACrC,MAAA,OAAO,uBAAA,CAAwB,KAAA,CAAM,IAAA,EAAM,OAAA,CAAQ,eAAe,CAAA;AAAA,IACpE;AAAA,IACA,KAAK,6BAAA,EAA+B;AAClC,MAAA,IAAI,CAAC,OAAA,CAAQ,gBAAA,IAAoB,KAAA,CAAM,KAAA,KAAU,QAAW,OAAO,MAAA;AACnE,MAAA,OAAO,wBAAA,CAAyB,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,gBAAgB,CAAA;AAAA,IACvE;AAAA,IACA,KAAK,2BAAA,EAA6B;AAChC,MAAA,IAAI,MAAM,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAClE,MAAA,OAAO,uBAAuB,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAM,QAAQ,cAAc,CAAA;AAAA,IACjF;AAAA,IACA,KAAK,+BAAA,EAAiC;AACpC,MAAA,IAAI,CAAC,QAAQ,iBAAA,IAAsB,KAAA,CAAM,UAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,MAAA,EAAY,OAAO,MAAA;AAClG,MAAA,OAAO,0BAA0B,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAO,QAAQ,iBAAiB,CAAA;AAAA,IACxF;AAAA,IACA;AACE,MAAA,OAAO,MAAA;AAAA;AAEb;AAEO,SAAS,aAAA,CAAc,KAAA,EAAuB,OAAA,GAAgC,EAAC,EAAuB;AAC3G,EAAA,MAAM,QAAA,GAAW,QAAQ,KAAA,IAAS,SAAA;AAClC,EAAA,MAAM,UAA6B,EAAC;AACpC,EAAA,KAAA,MAAW,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA;AAAA,EACjC;AACA,EAAA,MAAM,EAAA,GAAK,CAAC,OAAA,CAAQ,IAAA,CAAK,cAAc,CAAA;AACvC,EAAA,OAAO,EAAE,IAAI,OAAA,EAAQ;AACvB","file":"index.mjs","sourcesContent":["/**\n * Mirrors `packages/core/src/safety/sensitive-key.ts` for dependency-light\n * @agent-inspect/redact consumers. Keep both copies in sync (6.14.2 parity).\n */\n\n/** True when the original key already uses an explicit separator. */\nfunction keyHasExplicitSeparator(value: string): boolean {\n  return /[_\\-.]/.test(value);\n}\n\n/**\n * Canonicalize field names so camelCase / kebab / dot / snake forms share a\n * snake_case shape the compound matcher can recognize (`userPassword` →\n * `user_password`).\n */\nexport function normalizeSensitiveKey(value: string): string {\n  return value\n    .replace(/([a-z0-9])([A-Z])/g, \"$1_$2\")\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n}\n\nexport const NON_CREDENTIAL_TOKEN_CONFIG_KEYS: ReadonlySet<string> = new Set(\n  [\n    \"tokens\",\n    \"max_tokens\",\n    \"min_tokens\",\n    \"ls_max_tokens\",\n    \"token_count\",\n    \"token_limit\",\n    \"token_budget\",\n    \"input_tokens\",\n    \"output_tokens\",\n    \"total_tokens\",\n    \"cached_tokens\",\n    \"prompt_tokens\",\n    \"completion_tokens\",\n  ].map(normalizeSensitiveKey),\n);\n\nfunction isTokenCredentialKey(normalized: string): boolean {\n  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;\n  if (normalized === \"token\") return true;\n  if (normalized.endsWith(\"tokens\")) return false;\n  return normalized.endsWith(\"token\");\n}\n\n/**\n * True when the field name looks credential-sensitive under the shared policy.\n *\n * Suffix compounds (`user_password`, `userPassword`) always match. Prefix\n * compounds (`email_note`) match only when the original key already contained\n * an explicit separator, so camelCase topic fields like `emailNote` stay for\n * value detectors instead of key redaction.\n */\nexport function isCredentialSensitiveKey(\n  key: string | undefined,\n  sensitiveKeys: readonly string[],\n): boolean {\n  if (!key) return false;\n  const normalized = normalizeSensitiveKey(key);\n  if (!normalized) return false;\n  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;\n\n  const allowPrefixCompound = keyHasExplicitSeparator(key);\n\n  for (const sensitive of sensitiveKeys) {\n    const s = normalizeSensitiveKey(sensitive);\n    if (!s) continue;\n    if (s === \"token\") {\n      if (isTokenCredentialKey(normalized)) return true;\n      continue;\n    }\n    if (normalized === s) return true;\n    if (normalized.endsWith(`_${s}`)) return true;\n    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;\n  }\n  return false;\n}\n","import crypto from \"node:crypto\";\nimport { isCredentialSensitiveKey } from \"./sensitive-key.js\";\n\nexport type RedactionProfile = \"local\" | \"share\" | \"strict\";\n\nexport type RedactionAction = \"replace\" | \"hash\" | \"prefix\" | \"truncate\" | \"keep\";\n\nexport type RedactionSeverity = \"info\" | \"warning\" | \"error\";\n\nexport type RedactionMatchKind = \"key\" | \"value\" | \"custom\";\n\nexport type RedactionRule =\n  | string\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep?: number }\n  | { key: string; strategy: \"hash\" };\n\nexport interface RedactionFinding {\n  path: string;\n  detector: string;\n  action: RedactionAction;\n  severity: RedactionSeverity;\n  matchKind: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetection {\n  action?: RedactionAction;\n  replacement?: unknown;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetectorInput {\n  path: string;\n  key?: string;\n  value: unknown;\n}\n\nexport interface RedactionDetector {\n  id: string;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  detect(input: RedactionDetectorInput): RedactionDetection[];\n}\n\nexport interface RedactionResult<T = unknown> {\n  value: T;\n  findings: RedactionFinding[];\n  redacted: boolean;\n  profile: RedactionProfile;\n}\n\nexport interface ResolvedRedactionProfile {\n  profile: RedactionProfile;\n  extraKeys: readonly string[];\n  maxMetadataValueLengthCap?: number;\n  maxPreviewLengthCap?: number;\n}\n\nexport interface RedactOptions {\n  profile?: RedactionProfile;\n  detectors?: RedactionDetector[];\n  rules?: RedactionRule[];\n  replacement?: string;\n  maxDepth?: number;\n  maxStringLength?: number;\n  collectFindings?: boolean;\n}\n\nexport interface RedactorOptions extends RedactOptions {\n  extraKeys?: readonly string[];\n}\n\nexport const DEFAULT_REDACT_KEYS = [\n  \"authorization\",\n  \"cookie\",\n  \"token\",\n  \"apiKey\",\n  \"password\",\n  \"secret\",\n  \"email\",\n] as const;\n\nexport const SHARE_PROFILE_EXTRA_KEYS = [\n  \"userEmail\",\n  \"customerEmail\",\n  \"phone\",\n  \"phoneNumber\",\n  \"address\",\n  \"ip\",\n  \"ipAddress\",\n  \"sessionId\",\n  \"requestId\",\n  \"correlationId\",\n  \"decisionId\",\n  \"groupId\",\n  \"customerId\",\n  \"userId\",\n  \"accountId\",\n  \"tenantId\",\n  \"orgId\",\n  \"organizationId\",\n  \"traceId\",\n  \"spanId\",\n  \"parentSpanId\",\n  \"currentTask\",\n  \"task\",\n  \"userInput\",\n  \"requestText\",\n  \"conversationText\",\n] as const;\n\nexport const STRICT_PROFILE_EXTRA_KEYS = [\n  \"prompt\",\n  \"completion\",\n  \"input\",\n  \"output\",\n  \"inputPreview\",\n  \"outputPreview\",\n  \"message\",\n  \"messages\",\n  \"transcript\",\n  \"context\",\n  \"document\",\n  \"documents\",\n  \"chunk\",\n  \"chunks\",\n  \"retrieval\",\n  \"query\",\n] as const;\n\ntype CompiledRule =\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep: number }\n  | { key: string; strategy: \"hash\" };\n\ninterface RedactionState {\n  findings: RedactionFinding[];\n  seen: WeakMap<object, unknown>;\n}\n\ninterface PatternDetectorOptions {\n  id: string;\n  pattern: RegExp;\n  severity?: RedactionSeverity;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n\nfunction toKey(key: string): string {\n  return key.toLowerCase();\n}\n\nfunction findCompiledKeyRule(\n  key: string,\n  rules: readonly CompiledRule[],\n): CompiledRule | undefined {\n  const exact = toKey(key);\n  const direct = rules.find((candidate) => candidate.key === exact);\n  if (direct) return direct;\n  return rules.find((candidate) => isCredentialSensitiveKey(key, [candidate.key]));\n}\n\nfunction stableHash(value: string): string {\n  const hash = crypto.createHash(\"sha256\").update(value, \"utf8\").digest(\"hex\");\n  return hash.slice(0, 8);\n}\n\nfunction stringifyScalar(value: unknown): string | undefined {\n  if (typeof value === \"string\") return value;\n  if (typeof value === \"number\" || typeof value === \"boolean\" || typeof value === \"bigint\") {\n    return String(value);\n  }\n  return undefined;\n}\n\nfunction patternDetector(options: PatternDetectorOptions): RedactionDetector {\n  return {\n    id: options.id,\n    severity: options.severity ?? \"warning\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      options.pattern.lastIndex = 0;\n      return options.pattern.test(input.value)\n        ? [{ action: \"replace\", severity: options.severity ?? \"warning\", matchKind: \"value\" }]\n        : [];\n    },\n  };\n}\n\nfunction digitsOnly(value: string): string {\n  return value.replace(/\\D/g, \"\");\n}\n\nfunction passesLuhn(value: string): boolean {\n  const digits = digitsOnly(value);\n  if (digits.length < 13 || digits.length > 19) return false;\n\n  let sum = 0;\n  let double = false;\n  for (let i = digits.length - 1; i >= 0; i -= 1) {\n    let digit = Number(digits[i]);\n    if (double) {\n      digit *= 2;\n      if (digit > 9) digit -= 9;\n    }\n    sum += digit;\n    double = !double;\n  }\n  return sum % 10 === 0;\n}\n\nconst UUID_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\n/** 13-digit Unix epoch milliseconds in a plausible modern range. */\nconst EPOCH_MS_RE = /^1[0-9]{12}$/;\n\nconst EMAIL_RE = /\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b/gi;\n\nfunction pathSuggestsNonCard(path: string): boolean {\n  const normalized = path.toLowerCase().replace(/[^a-z0-9._]/g, \"\");\n  return (\n    /(^|\\.)(tokenusage|usage)(\\.|$)/.test(normalized) ||\n    /(startedat|endedat|durationms|timestamp|createdat|updatedat)(\\.|$)/.test(normalized) ||\n    /(^|\\.)(runid|traceid|spanid|eventid|sessionid|userid|parentid|requestid|correlationid)(\\.|$)/.test(\n      normalized,\n    ) ||\n    /(^|\\.)ts(\\.|$)/.test(normalized)\n  );\n}\n\nfunction isUuidLike(value: string): boolean {\n  return UUID_RE.test(value.trim());\n}\n\nfunction isPlausibleCardCandidate(candidate: string, fullValue: string): boolean {\n  const digits = digitsOnly(candidate);\n  if (digits.length < 13 || digits.length > 19) return false;\n  if (!passesLuhn(candidate)) return false;\n\n  const trimmed = fullValue.trim();\n  if (isUuidLike(trimmed)) return false;\n\n  // Naked epoch-ms timestamps are not PANs.\n  if (EPOCH_MS_RE.test(digits) && digitsOnly(trimmed) === digits && /^\\d+$/.test(trimmed)) {\n    return false;\n  }\n\n  // Reject candidates glued inside longer alphanumeric IDs without card separators.\n  const start = fullValue.indexOf(candidate);\n  if (start >= 0) {\n    const before = fullValue[start - 1];\n    const after = fullValue[start + candidate.length];\n    if (before && /[A-Za-z0-9_]/.test(before)) return false;\n    if (after && /[A-Za-z0-9_]/.test(after)) return false;\n  }\n\n  return true;\n}\n\nfunction looksLikePathOrPackageOrUrl(value: string): boolean {\n  const trimmed = value.trim();\n  if (/^(?:[a-z][a-z0-9+.-]*:)?\\/\\//i.test(trimmed)) return true;\n  if (/^webpack:/i.test(trimmed)) return true;\n  if (/^@[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.@/-]+$/.test(trimmed)) return true;\n  if (/^[A-Za-z]:[\\\\/]/.test(trimmed) || /^[/\\\\]/.test(trimmed)) return true;\n  // Path-like single token (slashes, no whitespace).\n  if (/[\\\\/]/.test(trimmed) && !/\\s/.test(trimmed)) return true;\n  return false;\n}\n\nfunction emailMatchIsPathAdjacent(value: string, index: number, length: number): boolean {\n  const before = value[index - 1];\n  const after = value[index + length];\n  return before === \"/\" || before === \"\\\\\" || after === \"/\" || after === \"\\\\\";\n}\n\nfunction valueContainsEmail(value: string): boolean {\n  if (looksLikePathOrPackageOrUrl(value)) return false;\n  EMAIL_RE.lastIndex = 0;\n  for (const match of value.matchAll(EMAIL_RE)) {\n    const text = match[0] ?? \"\";\n    const index = match.index ?? 0;\n    if (emailMatchIsPathAdjacent(value, index, text.length)) continue;\n    return true;\n  }\n  return false;\n}\n\nconst credentialDetectors: readonly RedactionDetector[] = [\n  patternDetector({\n    id: \"value.authorizationHeader\",\n    pattern: /^(?:basic|bearer|digest|apikey)\\s+[a-z0-9._~+/=-]+$/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.bearerToken\",\n    pattern: /\\bbearer\\s+[a-z0-9._~+/=-]{12,}\\b/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.cookie\",\n    pattern: /\\b[a-z0-9_.-]+=[^;\\s]+(?:;\\s*[a-z0-9_.-]+=[^;\\s]+)+/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.jwt\",\n    pattern: /\\beyJ[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.providerApiKey\",\n    pattern: /\\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.githubToken\",\n    pattern: /\\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.awsAccessKey\",\n    pattern: /\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.privateKey\",\n    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*-----END [A-Z ]*PRIVATE KEY-----/,\n    severity: \"error\",\n  }),\n  {\n    id: \"value.creditCard\",\n    severity: \"error\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      if (pathSuggestsNonCard(input.path)) return [];\n      if (isUuidLike(input.value)) return [];\n      const candidatePattern = /(?:\\d[ -]?){13,19}/g;\n      for (const match of input.value.matchAll(candidatePattern)) {\n        const candidate = match[0] ?? \"\";\n        if (isPlausibleCardCandidate(candidate, input.value)) {\n          return [{ action: \"replace\", severity: \"error\", matchKind: \"value\" }];\n        }\n      }\n      return [];\n    },\n  },\n];\n\nconst identifierDetectors: readonly RedactionDetector[] = [\n  {\n    id: \"value.email\",\n    severity: \"warning\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      return valueContainsEmail(input.value)\n        ? [{ action: \"replace\", severity: \"warning\", matchKind: \"value\" }]\n        : [];\n    },\n  },\n  patternDetector({\n    id: \"value.phone\",\n    pattern: /\\b(?:\\+\\d{1,3}[\\s.-]?)?(?:\\(?\\d{3}\\)?[\\s.-])\\d{3}[\\s.-]\\d{4}\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv4\",\n    pattern: /\\b(?:(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv6\",\n    pattern: /\\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\\b/i,\n  }),\n];\n\nfunction builtInDetectorsForProfile(profile: RedactionProfile): readonly RedactionDetector[] {\n  if (profile === \"local\") return credentialDetectors;\n  return [...credentialDetectors, ...identifierDetectors];\n}\n\nfunction compileRules(\n  rules?: RedactionRule[],\n  extraKeys?: readonly string[],\n): CompiledRule[] {\n  const out = new Map<string, CompiledRule>();\n\n  const set = (rule: CompiledRule) => {\n    const key = toKey(rule.key);\n    out.set(key, { ...rule, key } as CompiledRule);\n  };\n\n  for (const key of DEFAULT_REDACT_KEYS) {\n    set({ key, strategy: \"full\" });\n  }\n\n  for (const key of extraKeys ?? []) {\n    if (typeof key === \"string\" && key.length > 0) {\n      set({ key, strategy: \"full\" });\n    }\n  }\n\n  for (const rule of rules ?? []) {\n    if (typeof rule === \"string\") {\n      set({ key: rule, strategy: \"full\" });\n      continue;\n    }\n\n    if (rule.strategy === \"full\") set({ key: rule.key, strategy: \"full\" });\n    if (rule.strategy === \"hash\") set({ key: rule.key, strategy: \"hash\" });\n    if (rule.strategy === \"prefix\") {\n      set({\n        key: rule.key,\n        strategy: \"prefix\",\n        keep: typeof rule.keep === \"number\" ? rule.keep : 8,\n      });\n    }\n  }\n\n  return [...out.values()];\n}\n\nfunction actionForRule(rule: CompiledRule): RedactionAction {\n  if (rule.strategy === \"full\") return \"replace\";\n  return rule.strategy;\n}\n\nfunction applyRule(\n  rule: CompiledRule,\n  value: unknown,\n  replacement: string,\n): unknown {\n  if (rule.strategy === \"full\") return replacement;\n\n  const asString = stringifyScalar(value);\n  if (rule.strategy === \"prefix\") {\n    if (asString === undefined) return replacement;\n    const keep = Math.max(0, Math.floor(rule.keep));\n    return asString.length <= keep ? `${asString}…` : `${asString.slice(0, keep)}…`;\n  }\n\n  if (rule.strategy === \"hash\") {\n    if (asString === undefined) return \"[HASH:unknown]\";\n    return `[HASH:${stableHash(asString)}]`;\n  }\n\n  return value;\n}\n\nfunction childPath(path: string, key: string): string {\n  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {\n    return path ? `${path}.${key}` : key;\n  }\n  return `${path || \"$\"}[${JSON.stringify(key)}]`;\n}\n\nfunction indexPath(path: string, index: number): string {\n  return `${path || \"$\"}[${index}]`;\n}\n\nfunction makeFinding(\n  path: string,\n  detector: string,\n  action: RedactionAction,\n  matchKind: RedactionMatchKind,\n  severity: RedactionSeverity = \"warning\",\n  preview?: string,\n): RedactionFinding {\n  return preview === undefined\n    ? { path, detector, action, severity, matchKind }\n    : { path, detector, action, severity, matchKind, preview };\n}\n\nexport function createRedactionProfile(profile: RedactionProfile = \"local\"): ResolvedRedactionProfile {\n  switch (profile) {\n    case \"local\":\n      return { profile: \"local\", extraKeys: [] };\n    case \"share\":\n      return {\n        profile: \"share\",\n        extraKeys: SHARE_PROFILE_EXTRA_KEYS,\n        maxMetadataValueLengthCap: 500,\n        maxPreviewLengthCap: 200,\n      };\n    case \"strict\":\n      return {\n        profile: \"strict\",\n        extraKeys: [...SHARE_PROFILE_EXTRA_KEYS, ...STRICT_PROFILE_EXTRA_KEYS],\n        maxMetadataValueLengthCap: 200,\n        maxPreviewLengthCap: 80,\n      };\n  }\n}\n\nexport class Redactor {\n  readonly #rules: CompiledRule[];\n  readonly #detectors: readonly RedactionDetector[];\n  readonly #profile: RedactionProfile;\n  readonly #replacement: string;\n  readonly #maxDepth: number;\n  readonly #collectFindings: boolean;\n\n  constructor(options?: RedactorOptions) {\n    const resolved = createRedactionProfile(options?.profile ?? \"local\");\n    this.#profile = resolved.profile;\n    this.#rules = compileRules(options?.rules, [\n      ...resolved.extraKeys,\n      ...(options?.extraKeys ?? []),\n    ]);\n    this.#detectors = [\n      ...builtInDetectorsForProfile(this.#profile),\n      ...(options?.detectors ?? []),\n    ];\n    this.#replacement = options?.replacement ?? \"[REDACTED]\";\n    this.#maxDepth = options?.maxDepth ?? 32;\n    this.#collectFindings = options?.collectFindings ?? true;\n  }\n\n  redactValue(key: string, value: unknown): unknown {\n    return this.#redactValue(value, key, key, 0, {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    });\n  }\n\n  redactRecord(record: Record<string, unknown>): Record<string, unknown> {\n    return this.redact(record).value as Record<string, unknown>;\n  }\n\n  redact<T = unknown>(value: T): RedactionResult<T> {\n    const state: RedactionState = {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    };\n    const redacted = this.#redactValue(value, undefined, \"$\", 0, state);\n    return {\n      value: redacted as T,\n      findings: state.findings,\n      redacted: state.findings.some((finding) => finding.action !== \"keep\"),\n      profile: this.#profile,\n    };\n  }\n\n  #recordFinding(state: RedactionState, finding: RedactionFinding): void {\n    if (this.#collectFindings) state.findings.push(finding);\n  }\n\n  #redactValue(\n    value: unknown,\n    key: string | undefined,\n    path: string,\n    depth: number,\n    state: RedactionState,\n  ): unknown {\n    if (depth > this.#maxDepth) {\n      this.#recordFinding(\n        state,\n        makeFinding(path, \"structure.maxDepth\", \"truncate\", \"value\", \"warning\"),\n      );\n      return \"[Truncated]\";\n    }\n\n    if (key !== undefined) {\n      const rule = findCompiledKeyRule(key, this.#rules);\n      if (rule) {\n        this.#recordFinding(\n          state,\n          makeFinding(path, `key.${rule.key}`, actionForRule(rule), \"key\", \"warning\"),\n        );\n        return applyRule(rule, value, this.#replacement);\n      }\n    }\n\n    for (const detector of this.#detectors) {\n      const detections = detector.detect({ path, key, value });\n      for (const detection of detections) {\n        const action = detection.action ?? \"replace\";\n        this.#recordFinding(\n          state,\n          makeFinding(\n            path,\n            detector.id,\n            action,\n            detection.matchKind ?? detector.matchKind ?? \"custom\",\n            detection.severity ?? detector.severity ?? \"warning\",\n            detection.preview,\n          ),\n        );\n        if (action !== \"keep\") {\n          return detection.replacement ?? this.#replacement;\n        }\n      }\n    }\n\n    if (Array.isArray(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: unknown[] = [];\n      state.seen.set(value, out);\n      value.forEach((item, index) => {\n        out[index] = this.#redactValue(item, undefined, indexPath(path, index), depth + 1, state);\n      });\n      return out;\n    }\n\n    if (isRecord(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: Record<string, unknown> = {};\n      state.seen.set(value, out);\n      for (const [entryKey, entryValue] of Object.entries(value)) {\n        out[entryKey] = this.#redactValue(\n          entryValue,\n          entryKey,\n          childPath(path === \"$\" ? \"\" : path, entryKey),\n          depth + 1,\n          state,\n        );\n      }\n      return out;\n    }\n\n    return value;\n  }\n}\n\nexport function createRedactor(options?: RedactorOptions): Redactor {\n  return new Redactor(options);\n}\n\nexport function redact<T = unknown>(value: T, options?: RedactOptions): RedactionResult<T> {\n  return createRedactor(options).redact(value);\n}\n","import { redact, type RedactionFinding } from \"@agent-inspect/redact\";\n\nimport type {\n  BannedPhraseOptions,\n  GuardrailEvidence,\n  GuardrailResult,\n  OversizeOutputOptions,\n  PiiLeakOptions,\n  PromptInjectionOptions,\n  RequiredJsonShapeOptions,\n  StructuredOutputOptions,\n  UnsafeToolArgsOptions,\n} from \"./types.js\";\n\nconst DEFAULT_INJECTION_PATTERNS = [\n  \"ignore previous instructions\",\n  \"ignore all prior\",\n  \"disregard your instructions\",\n  \"system prompt\",\n  \"you are now\",\n  \"jailbreak\",\n] as const;\n\nfunction pass(ruleId: string, message: string): GuardrailResult {\n  return { ruleId, status: \"pass\", severity: \"info\", message, evidence: [] };\n}\n\nfunction fail(\n  ruleId: string,\n  message: string,\n  evidence: GuardrailEvidence[],\n  severity: \"error\" | \"warning\" = \"error\",\n): GuardrailResult {\n  return { ruleId, status: severity === \"warning\" ? \"warn\" : \"fail\", severity, message, evidence };\n}\n\nfunction boundedPreview(value: string, max = 80): string {\n  if (value.length <= max) return value;\n  return `${value.slice(0, max - 3)}...`;\n}\n\nexport function evaluateBannedPhrase(\n  text: string,\n  options: BannedPhraseOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.banned-phrase\";\n  const haystack = options.caseInsensitive !== false ? text.toLowerCase() : text;\n  const evidence: GuardrailEvidence[] = [];\n  for (const phrase of options.phrases) {\n    const needle = options.caseInsensitive !== false ? phrase.toLowerCase() : phrase;\n    if (needle.length > 0 && haystack.includes(needle)) {\n      evidence.push({ ruleId, match: phrase, preview: boundedPreview(text) });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"No banned phrases matched.\");\n  }\n  return fail(ruleId, `Matched ${evidence.length} banned phrase(s).`, evidence);\n}\n\nconst SEVERITY_RANK = { info: 0, warning: 1, error: 2 } as const;\n\nexport function evaluatePiiLeak(value: unknown, options: PiiLeakOptions = {}): GuardrailResult {\n  const ruleId = \"guardrail.pii-leak\";\n  const minSeverity = options.minSeverity ?? \"warning\";\n  const result = redact(value, { profile: options.profile ?? \"share\", collectFindings: true });\n  const findings = result.findings.filter(\n    (finding: RedactionFinding) => SEVERITY_RANK[finding.severity] >= SEVERITY_RANK[minSeverity],\n  );\n  if (findings.length === 0) {\n    return pass(ruleId, \"No PII-style redaction findings.\");\n  }\n  const evidence: GuardrailEvidence[] = findings.map((finding) => ({\n    ruleId,\n    path: finding.path,\n    detector: finding.detector,\n    preview: finding.preview,\n  }));\n  return fail(ruleId, `Detected ${findings.length} PII-style finding(s).`, evidence);\n}\n\nfunction measureDepth(value: unknown): number {\n  if (value === null || typeof value !== \"object\") return 0;\n  if (Array.isArray(value)) {\n    return 1 + Math.max(0, ...value.map((item) => measureDepth(item)));\n  }\n  const depths = Object.values(value as Record<string, unknown>).map((item) => measureDepth(item));\n  return 1 + (depths.length === 0 ? 0 : Math.max(...depths));\n}\n\nfunction maxStringLength(value: unknown): number {\n  if (typeof value === \"string\") return value.length;\n  if (value === null || typeof value !== \"object\") return 0;\n  if (Array.isArray(value)) {\n    return Math.max(0, ...value.map((item) => maxStringLength(item)));\n  }\n  return Math.max(0, ...Object.values(value as Record<string, unknown>).map((item) => maxStringLength(item)));\n}\n\nexport function evaluateUnsafeToolArgs(\n  toolName: string,\n  toolArgs: unknown,\n  options: UnsafeToolArgsOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.unsafe-tool-args\";\n  const blocked = new Set((options.blockedTools ?? []).map((name) => name.toLowerCase()));\n  const evidence: GuardrailEvidence[] = [];\n  if (blocked.has(toolName.toLowerCase())) {\n    evidence.push({ ruleId, preview: toolName, match: toolName });\n  }\n  const maxDepth = options.maxDepth ?? 12;\n  const depth = measureDepth(toolArgs);\n  if (depth > maxDepth) {\n    evidence.push({ ruleId, path: \"args\", preview: `depth=${depth}` });\n  }\n  const maxLen = options.maxStringLength ?? 16_384;\n  const longest = maxStringLength(toolArgs);\n  if (longest > maxLen) {\n    evidence.push({ ruleId, path: \"args\", preview: `maxStringLength=${longest}` });\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Tool arguments within configured bounds.\");\n  }\n  return fail(ruleId, \"Unsafe or oversized tool arguments detected.\", evidence);\n}\n\nexport function evaluatePromptInjection(\n  text: string,\n  options: PromptInjectionOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.prompt-injection\";\n  const patterns = options.patterns ?? DEFAULT_INJECTION_PATTERNS;\n  const haystack = text.toLowerCase();\n  const evidence: GuardrailEvidence[] = [];\n  for (const pattern of patterns) {\n    const needle = pattern.toLowerCase();\n    if (needle.length > 0 && haystack.includes(needle)) {\n      evidence.push({ ruleId, match: pattern, preview: boundedPreview(text) });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"No prompt-injection patterns matched.\");\n  }\n  return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, \"warning\");\n}\n\nfunction validateSchemaField(\n  value: unknown,\n  field: StructuredOutputOptions[\"schema\"][string],\n  path: string,\n  evidence: GuardrailEvidence[],\n): void {\n  const ruleId = \"guardrail.structured-output\";\n  if (field.type) {\n    const actual =\n      value === null\n        ? \"null\"\n        : Array.isArray(value)\n          ? \"array\"\n          : typeof value;\n    if (actual !== field.type) {\n      evidence.push({ ruleId, path, preview: `expected ${field.type}, got ${actual}` });\n      return;\n    }\n  }\n  if (field.enum && !field.enum.some((item) => Object.is(item, value))) {\n    evidence.push({ ruleId, path, preview: \"value not in enum\" });\n  }\n  if (field.type === \"object\" && field.required && value && typeof value === \"object\" && !Array.isArray(value)) {\n    const record = value as Record<string, unknown>;\n    for (const key of field.required) {\n      if (!(key in record)) {\n        evidence.push({ ruleId, path: `${path}.${key}`, preview: \"missing required key\" });\n      }\n    }\n  }\n}\n\nexport function evaluateStructuredOutput(\n  value: unknown,\n  options: StructuredOutputOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.structured-output\";\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    return fail(ruleId, \"Structured output must be an object.\", [\n      { ruleId, preview: typeof value },\n    ]);\n  }\n  const record = value as Record<string, unknown>;\n  const evidence: GuardrailEvidence[] = [];\n  for (const [key, field] of Object.entries(options.schema)) {\n    validateSchemaField(record[key], field, key, evidence);\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Structured output matches schema subset.\");\n  }\n  return fail(ruleId, \"Structured output schema violation.\", evidence);\n}\n\nexport function evaluateOversizeOutput(\n  value: unknown,\n  options: OversizeOutputOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.oversize-output\";\n  const text = typeof value === \"string\" ? value : JSON.stringify(value);\n  const maxLength = options.maxLength ?? options.maxSerializedLength ?? 32_768;\n  if (text.length <= maxLength) {\n    return pass(ruleId, \"Output within size limits.\");\n  }\n  return fail(ruleId, `Output exceeds max length (${text.length} > ${maxLength}).`, [\n    { ruleId, preview: `length=${text.length}` },\n  ]);\n}\n\nexport function evaluateRequiredJsonShape(\n  value: unknown,\n  options: RequiredJsonShapeOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.required-json-shape\";\n  let parsed: unknown = value;\n  if (typeof value === \"string\") {\n    try {\n      parsed = JSON.parse(value);\n    } catch {\n      return fail(ruleId, \"Value is not valid JSON.\", [{ ruleId, preview: boundedPreview(value) }]);\n    }\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    return fail(ruleId, \"JSON value must be an object.\", [{ ruleId, preview: typeof parsed }]);\n  }\n  const record = parsed as Record<string, unknown>;\n  const evidence: GuardrailEvidence[] = [];\n  for (const key of options.requiredKeys) {\n    if (!(key in record)) {\n      evidence.push({ ruleId, path: key, preview: \"missing required key\" });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Required JSON keys present.\");\n  }\n  return fail(ruleId, \"Missing required JSON keys.\", evidence);\n}\n","import {\n  evaluateBannedPhrase,\n  evaluateOversizeOutput,\n  evaluatePiiLeak,\n  evaluatePromptInjection,\n  evaluateRequiredJsonShape,\n  evaluateStructuredOutput,\n  evaluateUnsafeToolArgs,\n} from \"./rules.js\";\nimport type {\n  GuardrailInput,\n  GuardrailResult,\n  GuardrailRuleId,\n  GuardrailRunResult,\n  RunGuardrailsOptions,\n} from \"./types.js\";\n\nconst ALL_RULES: GuardrailRuleId[] = [\n  \"guardrail.banned-phrase\",\n  \"guardrail.pii-leak\",\n  \"guardrail.unsafe-tool-args\",\n  \"guardrail.prompt-injection\",\n  \"guardrail.structured-output\",\n  \"guardrail.oversize-output\",\n  \"guardrail.required-json-shape\",\n];\n\nfunction isErrorFailure(result: GuardrailResult): boolean {\n  return result.status === \"fail\" && result.severity === \"error\";\n}\n\nfunction runRule(ruleId: GuardrailRuleId, input: GuardrailInput, options: RunGuardrailsOptions): GuardrailResult | undefined {\n  switch (ruleId) {\n    case \"guardrail.banned-phrase\": {\n      if (!options.bannedPhrase || input.text === undefined) return undefined;\n      return evaluateBannedPhrase(input.text, options.bannedPhrase);\n    }\n    case \"guardrail.pii-leak\": {\n      if (input.value === undefined && input.text === undefined) return undefined;\n      return evaluatePiiLeak(input.value ?? input.text, options.piiLeak);\n    }\n    case \"guardrail.unsafe-tool-args\": {\n      if (!input.toolName) return undefined;\n      return evaluateUnsafeToolArgs(input.toolName, input.toolArgs ?? {}, options.unsafeToolArgs);\n    }\n    case \"guardrail.prompt-injection\": {\n      if (input.text === undefined) return undefined;\n      return evaluatePromptInjection(input.text, options.promptInjection);\n    }\n    case \"guardrail.structured-output\": {\n      if (!options.structuredOutput || input.value === undefined) return undefined;\n      return evaluateStructuredOutput(input.value, options.structuredOutput);\n    }\n    case \"guardrail.oversize-output\": {\n      if (input.value === undefined && input.text === undefined) return undefined;\n      return evaluateOversizeOutput(input.value ?? input.text, options.oversizeOutput);\n    }\n    case \"guardrail.required-json-shape\": {\n      if (!options.requiredJsonShape || (input.value === undefined && input.text === undefined)) return undefined;\n      return evaluateRequiredJsonShape(input.value ?? input.text!, options.requiredJsonShape);\n    }\n    default:\n      return undefined;\n  }\n}\n\nexport function runGuardrails(input: GuardrailInput, options: RunGuardrailsOptions = {}): GuardrailRunResult {\n  const selected = options.rules ?? ALL_RULES;\n  const results: GuardrailResult[] = [];\n  for (const ruleId of selected) {\n    const result = runRule(ruleId, input, options);\n    if (result) results.push(result);\n  }\n  const ok = !results.some(isErrorFailure);\n  return { ok, results };\n}\n\nexport { ALL_RULES as DEFAULT_GUARDRAIL_RULES };\n"]}
+{"version":3,"sources":["../../redact/src/sensitive-key.ts","../../redact/src/key-value-secret.ts","../../redact/src/index.ts","../src/rules.ts","../src/run.ts"],"names":[],"mappings":";;;;;AAMA,SAAS,wBAAwB,KAAA,EAAwB;AACvD,EAAA,OAAO,QAAA,CAAS,KAAK,KAAK,CAAA;AAC5B;AAOO,SAAS,sBAAsB,KAAA,EAAuB;AAC3D,EAAA,OAAO,KAAA,CACJ,OAAA,CAAQ,oBAAA,EAAsB,OAAO,CAAA,CACrC,WAAA,EAAY,CACZ,OAAA,CAAQ,aAAA,EAAe,GAAG,CAAA,CAC1B,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC3B;AAEO,IAAM,mCAAwD,IAAI,GAAA;AAAA,EACvE;AAAA,IACE,QAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA,eAAA;AAAA,IACA,aAAA;AAAA,IACA,aAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF,CAAE,IAAI,qBAAqB;AAC7B,CAAA;AAEA,SAAS,qBAAqB,UAAA,EAA6B;AACzD,EAAA,IAAI,gCAAA,CAAiC,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,KAAA;AAC7D,EAAA,IAAI,UAAA,KAAe,SAAS,OAAO,IAAA;AACnC,EAAA,IAAI,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,KAAA;AAC1C,EAAA,OAAO,UAAA,CAAW,SAAS,OAAO,CAAA;AACpC;AAUO,SAAS,wBAAA,CACd,KACA,aAAA,EACS;AACT,EAAA,IAAI,CAAC,KAAK,OAAO,KAAA;AACjB,EAAA,MAAM,UAAA,GAAa,sBAAsB,GAAG,CAAA;AAC5C,EAAA,IAAI,CAAC,YAAY,OAAO,KAAA;AACxB,EAAA,IAAI,gCAAA,CAAiC,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,KAAA;AAE7D,EAAA,MAAM,mBAAA,GAAsB,wBAAwB,GAAG,CAAA;AAEvD,EAAA,KAAA,MAAW,aAAa,aAAA,EAAe;AACrC,IAAA,MAAM,CAAA,GAAI,sBAAsB,SAAS,CAAA;AACzC,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,IAAI,MAAM,OAAA,EAAS;AACjB,MAAA,IAAI,oBAAA,CAAqB,UAAU,CAAA,EAAG,OAAO,IAAA;AAC7C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,UAAA,KAAe,GAAG,OAAO,IAAA;AAC7B,IAAA,IAAI,WAAW,QAAA,CAAS,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,GAAG,OAAO,IAAA;AACzC,IAAA,IAAI,uBAAuB,UAAA,CAAW,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA,CAAG,GAAG,OAAO,IAAA;AAAA,EACpE;AACA,EAAA,OAAO,KAAA;AACT;;;ACnEO,IAAM,kCACX,MAAA,CAAO,GAAA,CAAA,0GAAA,CAAA;AAEF,IAAM,2BAA2B,IAAI,MAAA;AAAA,EAC1C,+BAAA;AAAA,EACA;AACF,CAAA;AAEO,SAAS,4BAA4B,KAAA,EAAwB;AAClE,EAAA,wBAAA,CAAyB,SAAA,GAAY,CAAA;AACrC,EAAA,OAAO,wBAAA,CAAyB,KAAK,KAAK,CAAA;AAC5C;;;ACqDO,IAAM,mBAAA,GAAsB;AAAA,EACjC,eAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,wBAAA,GAA2B;AAAA,EACtC,WAAA;AAAA,EACA,eAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAEO,IAAM,yBAAA,GAA4B;AAAA,EACvC,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA;AAkBA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGA,SAAS,MAAM,GAAA,EAAqB;AAClC,EAAA,OAAO,IAAI,WAAA,EAAY;AACzB;AAEA,SAAS,mBAAA,CACP,KACA,KAAA,EAC0B;AAC1B,EAAA,MAAM,KAAA,GAAQ,MAAM,GAAG,CAAA;AACvB,EAAA,MAAM,SAAS,KAAA,CAAM,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,QAAQ,KAAK,CAAA;AAChE,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,SAAA,KAAc,wBAAA,CAAyB,KAAK,CAAC,SAAA,CAAU,GAAG,CAAC,CAAC,CAAA;AACjF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,OAAO,KAAA,EAAO,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC3E,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AACxB;AAEA,SAAS,gBAAgB,KAAA,EAAoC;AAC3D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,OAAO,UAAU,SAAA,IAAa,OAAO,UAAU,QAAA,EAAU;AACxF,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,gBAAgB,OAAA,EAAoD;AAC3E,EAAA,OAAO;AAAA,IACL,IAAI,OAAA,CAAQ,EAAA;AAAA,IACZ,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA;AAAA,IAC9B,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAA,CAAQ,QAAQ,SAAA,GAAY,CAAA;AAC5B,MAAA,OAAO,QAAQ,OAAA,CAAQ,IAAA,CAAK,MAAM,KAAK,CAAA,GACnC,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,QAAQ,QAAA,IAAY,SAAA,EAAW,WAAW,OAAA,EAAS,IACnF,EAAC;AAAA,IACP;AAAA,GACF;AACF;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAChC;AAEA,SAAS,WAAW,KAAA,EAAwB;AAC1C,EAAA,MAAM,MAAA,GAAS,WAAW,KAAK,CAAA;AAC/B,EAAA,IAAI,OAAO,MAAA,GAAS,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,IAAI,OAAO,KAAA;AAErD,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,IAAS,IAAI,MAAA,CAAO,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAC9C,IAAA,IAAI,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,CAAC,CAAA;AAC5B,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,KAAA,IAAS,CAAA;AACT,MAAA,IAAI,KAAA,GAAQ,GAAG,KAAA,IAAS,CAAA;AAAA,IAC1B;AACA,IAAA,GAAA,IAAO,KAAA;AACP,IAAA,MAAA,GAAS,CAAC,MAAA;AAAA,EACZ;AACA,EAAA,OAAO,MAAM,EAAA,KAAO,CAAA;AACtB;AAEA,IAAM,OAAA,GACJ,4EAAA;AAGF,IAAM,WAAA,GAAc,cAAA;AAEpB,IAAM,QAAA,GAAW,6CAAA;AAEjB,SAAS,oBAAoB,IAAA,EAAuB;AAClD,EAAA,MAAM,aAAa,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,gBAAgB,EAAE,CAAA;AAChE,EAAA,OACE,gCAAA,CAAiC,KAAK,UAAU,CAAA,IAChD,qEAAqE,IAAA,CAAK,UAAU,KACpF,8FAAA,CAA+F,IAAA;AAAA,IAC7F;AAAA,GACF,IACA,gBAAA,CAAiB,IAAA,CAAK,UAAU,CAAA;AAEpC;AAEA,SAAS,WAAW,KAAA,EAAwB;AAC1C,EAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA;AAClC;AAEA,SAAS,wBAAA,CAAyB,WAAmB,SAAA,EAA4B;AAC/E,EAAA,MAAM,MAAA,GAAS,WAAW,SAAS,CAAA;AACnC,EAAA,IAAI,OAAO,MAAA,GAAS,EAAA,IAAM,MAAA,CAAO,MAAA,GAAS,IAAI,OAAO,KAAA;AACrD,EAAA,IAAI,CAAC,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,KAAA;AAEnC,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAC/B,EAAA,IAAI,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,KAAA;AAGhC,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA,IAAK,UAAA,CAAW,OAAO,CAAA,KAAM,MAAA,IAAU,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACvF,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,OAAA,CAAQ,SAAS,CAAA;AACzC,EAAA,IAAI,SAAS,CAAA,EAAG;AACd,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,KAAA,GAAQ,CAAC,CAAA;AAClC,IAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,GAAQ,SAAA,CAAU,MAAM,CAAA;AAChD,IAAA,IAAI,MAAA,IAAU,cAAA,CAAe,IAAA,CAAK,MAAM,GAAG,OAAO,KAAA;AAClD,IAAA,IAAI,KAAA,IAAS,cAAA,CAAe,IAAA,CAAK,KAAK,GAAG,OAAO,KAAA;AAAA,EAClD;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,4BAA4B,KAAA,EAAwB;AAC3D,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,IAAI,+BAAA,CAAgC,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AAC1D,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,IAAI,uCAAA,CAAwC,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AAClE,EAAA,IAAI,iBAAA,CAAkB,KAAK,OAAO,CAAA,IAAK,SAAS,IAAA,CAAK,OAAO,GAAG,OAAO,IAAA;AAEtE,EAAA,IAAI,OAAA,CAAQ,KAAK,OAAO,CAAA,IAAK,CAAC,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AACzD,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,wBAAA,CAAyB,KAAA,EAAe,KAAA,EAAe,MAAA,EAAyB;AACvF,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,GAAQ,MAAM,CAAA;AAClC,EAAA,OAAO,WAAW,GAAA,IAAO,MAAA,KAAW,IAAA,IAAQ,KAAA,KAAU,OAAO,KAAA,KAAU,IAAA;AACzE;AAEA,SAAS,mBAAmB,KAAA,EAAwB;AAClD,EAAA,IAAI,2BAAA,CAA4B,KAAK,CAAA,EAAG,OAAO,KAAA;AAC/C,EAAA,QAAA,CAAS,SAAA,GAAY,CAAA;AACrB,EAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,QAAA,CAAS,QAAQ,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AACzB,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,CAAA;AAC7B,IAAA,IAAI,wBAAA,CAAyB,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACzD,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,2BAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,oCAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,cAAA;AAAA,IACJ,OAAA,EAAS,sDAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,WAAA;AAAA,IACJ,OAAA,EAAS,gEAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,sBAAA;AAAA,IACJ,OAAA,EAAS,0FAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,mBAAA;AAAA,IACJ,OAAA,EAAS,+CAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,oBAAA;AAAA,IACJ,OAAA,EAAS,+BAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,kBAAA;AAAA,IACJ,OAAA,EAAS,2EAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACX,CAAA;AAAA,EACD;AAAA,IACE,EAAA,EAAI,sBAAA;AAAA,IACJ,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAO,2BAAA,CAA4B,KAAA,CAAM,KAAK,CAAA,GAC1C,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,OAAA,EAAS,IAC7D,EAAC;AAAA,IACP;AAAA,GACF;AAAA,EACA;AAAA,IACE,EAAA,EAAI,kBAAA;AAAA,IACJ,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,IAAI,mBAAA,CAAoB,KAAA,CAAM,IAAI,CAAA,SAAU,EAAC;AAC7C,MAAA,IAAI,UAAA,CAAW,KAAA,CAAM,KAAK,CAAA,SAAU,EAAC;AACrC,MAAA,MAAM,gBAAA,GAAmB,qBAAA;AACzB,MAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,gBAAgB,CAAA,EAAG;AAC1D,QAAA,MAAM,SAAA,GAAY,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AAC9B,QAAA,IAAI,wBAAA,CAAyB,SAAA,EAAW,KAAA,CAAM,KAAK,CAAA,EAAG;AACpD,UAAA,OAAO,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,UAAU,OAAA,EAAS,SAAA,EAAW,SAAS,CAAA;AAAA,QACtE;AAAA,MACF;AACA,MAAA,OAAO,EAAC;AAAA,IACV;AAAA;AAEJ,CAAA;AAEA,IAAM,mBAAA,GAAoD;AAAA,EACxD;AAAA,IACE,EAAA,EAAI,aAAA;AAAA,IACJ,QAAA,EAAU,SAAA;AAAA,IACV,SAAA,EAAW,OAAA;AAAA,IACX,OAAO,KAAA,EAAO;AACZ,MAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,SAAiB,EAAC;AAC7C,MAAA,OAAO,kBAAA,CAAmB,KAAA,CAAM,KAAK,CAAA,GACjC,CAAC,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,SAAA,EAAW,SAAA,EAAW,OAAA,EAAS,IAC/D,EAAC;AAAA,IACP;AAAA,GACF;AAAA,EACA,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,aAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,eAAA,CAAgB;AAAA,IACd,EAAA,EAAI,YAAA;AAAA,IACJ,OAAA,EAAS;AAAA,GACV;AACH,CAAA;AAEA,SAAS,2BAA2B,OAAA,EAAyD;AAC3F,EAAA,IAAI,OAAA,KAAY,SAAS,OAAO,mBAAA;AAChC,EAAA,OAAO,CAAC,GAAG,mBAAA,EAAqB,GAAG,mBAAmB,CAAA;AACxD;AAEA,SAAS,YAAA,CACP,OACA,SAAA,EACgB;AAChB,EAAA,MAAM,GAAA,uBAAU,GAAA,EAA0B;AAE1C,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAuB;AAClC,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AAC1B,IAAA,GAAA,CAAI,IAAI,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,KAAqB,CAAA;AAAA,EAC/C,CAAA;AAEA,EAAA,KAAA,MAAW,OAAO,mBAAA,EAAqB;AACrC,IAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,EAC/B;AAEA,EAAA,KAAA,MAAW,GAAA,IAAO,SAAA,IAAa,EAAC,EAAG;AACjC,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,EAAG;AAC7C,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,IAC/B;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,IAAS,EAAC,EAAG;AAC9B,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,IAAA,EAAM,QAAA,EAAU,QAAQ,CAAA;AACnC,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,KAAK,IAAA,CAAK,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,CAAA;AACrE,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,MAAA,GAAA,CAAI;AAAA,QACF,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,QAAA,EAAU,QAAA;AAAA,QACV,MAAM,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO;AAAA,OACnD,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,GAAG,GAAA,CAAI,MAAA,EAAQ,CAAA;AACzB;AAEA,SAAS,cAAc,IAAA,EAAqC;AAC1D,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,SAAA;AACrC,EAAA,OAAO,IAAA,CAAK,QAAA;AACd;AAEA,SAAS,SAAA,CACP,IAAA,EACA,KAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,WAAA;AAErC,EAAA,MAAM,QAAA,GAAW,gBAAgB,KAAK,CAAA;AACtC,EAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,WAAA;AACnC,IAAA,MAAM,IAAA,GAAO,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAC9C,IAAA,OAAO,QAAA,CAAS,MAAA,IAAU,IAAA,GAAO,CAAA,EAAG,QAAQ,CAAA,MAAA,CAAA,GAAM,CAAA,EAAG,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,IAAI,CAAC,CAAA,MAAA,CAAA;AAAA,EAC9E;AAEA,EAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAQ;AAC5B,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,gBAAA;AACnC,IAAA,OAAO,CAAA,MAAA,EAAS,UAAA,CAAW,QAAQ,CAAC,CAAA,CAAA,CAAA;AAAA,EACtC;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,SAAA,CAAU,MAAc,GAAA,EAAqB;AACpD,EAAA,IAAI,4BAAA,CAA6B,IAAA,CAAK,GAAG,CAAA,EAAG;AAC1C,IAAA,OAAO,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,GAAK,GAAA;AAAA,EACnC;AACA,EAAA,OAAO,GAAG,IAAA,IAAQ,GAAG,IAAI,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,CAAA;AAC9C;AAEA,SAAS,SAAA,CAAU,MAAc,KAAA,EAAuB;AACtD,EAAA,OAAO,CAAA,EAAG,IAAA,IAAQ,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,CAAA;AAChC;AAEA,SAAS,YACP,IAAA,EACA,QAAA,EACA,QACA,SAAA,EACA,QAAA,GAA8B,WAC9B,OAAA,EACkB;AAClB,EAAA,OAAO,OAAA,KAAY,MAAA,GACf,EAAE,IAAA,EAAM,UAAU,MAAA,EAAQ,QAAA,EAAU,SAAA,EAAU,GAC9C,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,QAAA,EAAU,WAAW,OAAA,EAAQ;AAC7D;AAEO,SAAS,sBAAA,CAAuB,UAA4B,OAAA,EAAmC;AACpG,EAAA,QAAQ,OAAA;AAAS,IACf,KAAK,OAAA;AACH,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,SAAA,EAAW,EAAC,EAAE;AAAA,IAC3C,KAAK,OAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,OAAA;AAAA,QACT,SAAA,EAAW,wBAAA;AAAA,QACX,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA,IACF,KAAK,QAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,QAAA;AAAA,QACT,SAAA,EAAW,CAAC,GAAG,wBAAA,EAA0B,GAAG,yBAAyB,CAAA;AAAA,QACrE,yBAAA,EAA2B,GAAA;AAAA,QAC3B,mBAAA,EAAqB;AAAA,OACvB;AAAA;AAEN;AAEO,IAAM,WAAN,MAAe;AAAA,EACX,MAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA;AAAA,EAET,YAAY,OAAA,EAA2B;AACrC,IAAA,MAAM,QAAA,GAAW,sBAAA,CAAuB,OAAA,EAAS,OAAA,IAAW,OAAO,CAAA;AACnE,IAAA,IAAA,CAAK,WAAW,QAAA,CAAS,OAAA;AACzB,IAAA,IAAA,CAAK,MAAA,GAAS,YAAA,CAAa,OAAA,EAAS,KAAA,EAAO;AAAA,MACzC,GAAG,QAAA,CAAS,SAAA;AAAA,MACZ,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC5B,CAAA;AACD,IAAA,IAAA,CAAK,UAAA,GAAa;AAAA,MAChB,GAAG,0BAAA,CAA2B,IAAA,CAAK,QAAQ,CAAA;AAAA,MAC3C,GAAI,OAAA,EAAS,SAAA,IAAa;AAAC,KAC7B;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,SAAS,WAAA,IAAe,YAAA;AAC5C,IAAA,IAAA,CAAK,SAAA,GAAY,SAAS,QAAA,IAAY,EAAA;AACtC,IAAA,IAAA,CAAK,gBAAA,GAAmB,SAAS,eAAA,IAAmB,IAAA;AAAA,EACtD;AAAA,EAEA,WAAA,CAAY,KAAa,KAAA,EAAyB;AAChD,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,KAAA,EAAO,GAAA,EAAK,KAAK,CAAA,EAAG;AAAA,MAC3C,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACpC,CAAA;AAAA,EACH;AAAA,EAEA,aAAa,MAAA,EAA0D;AACrE,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,CAAE,KAAA;AAAA,EAC7B;AAAA,EAEA,OAAoB,KAAA,EAA8B;AAChD,IAAA,MAAM,KAAA,GAAwB;AAAA,MAC5B,UAAU,EAAC;AAAA,MACX,IAAA,sBAAU,OAAA;AAAyB,KACrC;AACA,IAAA,MAAM,WAAW,IAAA,CAAK,YAAA,CAAa,OAAO,MAAA,EAAW,GAAA,EAAK,GAAG,KAAK,CAAA;AAClE,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,QAAA;AAAA,MACP,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,QAAA,EAAU,MAAM,QAAA,CAAS,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,WAAW,MAAM,CAAA;AAAA,MACpE,SAAS,IAAA,CAAK;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,cAAA,CAAe,OAAuB,OAAA,EAAiC;AACrE,IAAA,IAAI,IAAA,CAAK,gBAAA,EAAkB,KAAA,CAAM,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,EACxD;AAAA,EAEA,YAAA,CACE,KAAA,EACA,GAAA,EACA,IAAA,EACA,OACA,KAAA,EACS;AACT,IAAA,IAAI,KAAA,GAAQ,KAAK,SAAA,EAAW;AAC1B,MAAA,IAAA,CAAK,cAAA;AAAA,QACH,KAAA;AAAA,QACA,WAAA,CAAY,IAAA,EAAM,oBAAA,EAAsB,UAAA,EAAY,SAAS,SAAS;AAAA,OACxE;AACA,MAAA,OAAO,aAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,MAAM,IAAA,GAAO,mBAAA,CAAoB,GAAA,EAAK,IAAA,CAAK,MAAM,CAAA;AACjD,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA,CAAY,IAAA,EAAM,CAAA,IAAA,EAAO,IAAA,CAAK,GAAG,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS;AAAA,SAC5E;AACA,QAAA,OAAO,SAAA,CAAU,IAAA,EAAM,KAAA,EAAO,IAAA,CAAK,YAAY,CAAA;AAAA,MACjD;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,QAAA,IAAY,KAAK,UAAA,EAAY;AACtC,MAAA,MAAM,aAAa,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,GAAA,EAAK,OAAO,CAAA;AACvD,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,MAAM,MAAA,GAAS,UAAU,MAAA,IAAU,SAAA;AACnC,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,KAAA;AAAA,UACA,WAAA;AAAA,YACE,IAAA;AAAA,YACA,QAAA,CAAS,EAAA;AAAA,YACT,MAAA;AAAA,YACA,SAAA,CAAU,SAAA,IAAa,QAAA,CAAS,SAAA,IAAa,QAAA;AAAA,YAC7C,SAAA,CAAU,QAAA,IAAY,QAAA,CAAS,QAAA,IAAY,SAAA;AAAA,YAC3C,SAAA,CAAU;AAAA;AACZ,SACF;AACA,QAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,UAAA,OAAO,SAAA,CAAU,eAAe,IAAA,CAAK,YAAA;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAAiB,EAAC;AACxB,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,KAAA,KAAU;AAC7B,QAAA,GAAA,CAAI,KAAK,CAAA,GAAI,IAAA,CAAK,YAAA,CAAa,IAAA,EAAM,MAAA,EAAW,SAAA,CAAU,IAAA,EAAM,KAAK,CAAA,EAAG,KAAA,GAAQ,CAAA,EAAG,KAAK,CAAA;AAAA,MAC1F,CAAC,CAAA;AACD,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,IAAI,QAAA,CAAS,KAAK,CAAA,EAAG;AACnB,MAAA,IAAI,KAAA,CAAM,KAAK,GAAA,CAAI,KAAK,GAAG,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAK,CAAA;AACtD,MAAA,MAAM,MAA+B,EAAC;AACtC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,GAAG,CAAA;AACzB,MAAA,KAAA,MAAW,CAAC,QAAA,EAAU,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1D,QAAA,GAAA,CAAI,QAAQ,IAAI,IAAA,CAAK,YAAA;AAAA,UACnB,UAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA,CAAU,IAAA,KAAS,GAAA,GAAM,EAAA,GAAK,MAAM,QAAQ,CAAA;AAAA,UAC5C,KAAA,GAAQ,CAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;AAEO,SAAS,eAAe,OAAA,EAAqC;AAClE,EAAA,OAAO,IAAI,SAAS,OAAO,CAAA;AAC7B;AAEO,SAAS,MAAA,CAAoB,OAAU,OAAA,EAA6C;AACzF,EAAA,OAAO,cAAA,CAAe,OAAO,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC7C;;;AC3nBA,IAAM,0BAAA,GAA6B;AAAA,EACjC,8BAAA;AAAA,EACA,kBAAA;AAAA,EACA,6BAAA;AAAA,EACA,eAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,IAAA,CAAK,QAAgB,OAAA,EAAkC;AAC9D,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAQ,MAAA,EAAQ,UAAU,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAU,EAAC,EAAE;AAC3E;AAEA,SAAS,IAAA,CACP,MAAA,EACA,OAAA,EACA,QAAA,EACA,WAAgC,OAAA,EACf;AACjB,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAQ,QAAA,KAAa,YAAY,MAAA,GAAS,MAAA,EAAQ,QAAA,EAAU,OAAA,EAAS,QAAA,EAAS;AACjG;AAEA,SAAS,cAAA,CAAe,KAAA,EAAe,GAAA,GAAM,EAAA,EAAY;AACvD,EAAA,IAAI,KAAA,CAAM,MAAA,IAAU,GAAA,EAAK,OAAO,KAAA;AAChC,EAAA,OAAO,GAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,GAAA,GAAM,CAAC,CAAC,CAAA,GAAA,CAAA;AACnC;AAEO,SAAS,oBAAA,CACd,MACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,yBAAA;AACf,EAAA,MAAM,WAAW,OAAA,CAAQ,eAAA,KAAoB,KAAA,GAAQ,IAAA,CAAK,aAAY,GAAI,IAAA;AAC1E,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,MAAA,IAAU,QAAQ,OAAA,EAAS;AACpC,IAAA,MAAM,SAAS,OAAA,CAAQ,eAAA,KAAoB,KAAA,GAAQ,MAAA,CAAO,aAAY,GAAI,MAAA;AAC1E,IAAA,IAAI,OAAO,MAAA,GAAS,CAAA,IAAK,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG;AAClD,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,QAAQ,OAAA,EAAS,cAAA,CAAe,IAAI,CAAA,EAAG,CAAA;AAAA,IACxE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,4BAA4B,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,QAAA,EAAW,QAAA,CAAS,MAAM,sBAAsB,QAAQ,CAAA;AAC9E;AAEA,IAAM,gBAAgB,EAAE,IAAA,EAAM,GAAG,OAAA,EAAS,CAAA,EAAG,OAAO,CAAA,EAAE;AAE/C,SAAS,eAAA,CAAgB,KAAA,EAAgB,OAAA,GAA0B,EAAC,EAAoB;AAC7F,EAAA,MAAM,MAAA,GAAS,oBAAA;AACf,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,SAAA;AAC3C,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,EAAO,EAAE,OAAA,EAAS,QAAQ,OAAA,IAAW,OAAA,EAAS,eAAA,EAAiB,IAAA,EAAM,CAAA;AAC3F,EAAA,MAAM,QAAA,GAAW,OAAO,QAAA,CAAS,MAAA;AAAA,IAC/B,CAAC,OAAA,KAA8B,aAAA,CAAc,QAAQ,QAAQ,CAAA,IAAK,cAAc,WAAW;AAAA,GAC7F;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,kCAAkC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,QAAA,GAAgC,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,MAAa;AAAA,IAC/D,MAAA;AAAA,IACA,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,SAAS,OAAA,CAAQ;AAAA,GACnB,CAAE,CAAA;AACF,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,SAAA,EAAY,QAAA,CAAS,MAAM,0BAA0B,QAAQ,CAAA;AACnF;AAEA,SAAS,aAAa,KAAA,EAAwB;AAC5C,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,UAAU,OAAO,CAAA;AACxD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS,YAAA,CAAa,IAAI,CAAC,CAAC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,KAAgC,CAAA,CAAE,IAAI,CAAC,IAAA,KAAS,YAAA,CAAa,IAAI,CAAC,CAAA;AAC/F,EAAA,OAAO,CAAA,IAAK,OAAO,MAAA,KAAW,CAAA,GAAI,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,MAAM,CAAA,CAAA;AAC1D;AAEA,SAAS,gBAAgB,KAAA,EAAwB;AAC/C,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA,CAAM,MAAA;AAC5C,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,UAAU,OAAO,CAAA;AACxD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS,eAAA,CAAgB,IAAI,CAAC,CAAC,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAG,OAAO,MAAA,CAAO,KAAgC,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS,eAAA,CAAgB,IAAI,CAAC,CAAC,CAAA;AAC5G;AAEO,SAAS,sBAAA,CACd,QAAA,EACA,QAAA,EACA,OAAA,GAAiC,EAAC,EACjB;AACjB,EAAA,MAAM,MAAA,GAAS,4BAAA;AACf,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAA,CAAK,OAAA,CAAQ,YAAA,IAAgB,EAAC,EAAG,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,WAAA,EAAa,CAAC,CAAA;AACtF,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA,EAAG;AACvC,IAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,SAAS,QAAA,EAAU,KAAA,EAAO,UAAU,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,EAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,aAAa,QAAQ,CAAA;AACnC,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,QAAQ,OAAA,EAAS,CAAA,MAAA,EAAS,KAAK,CAAA,CAAA,EAAI,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,MAAA,GAAS,QAAQ,eAAA,IAAmB,KAAA;AAC1C,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,IAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,QAAQ,OAAA,EAAS,CAAA,gBAAA,EAAmB,OAAO,CAAA,CAAA,EAAI,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,0CAA0C,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,8CAAA,EAAgD,QAAQ,CAAA;AAC9E;AAEO,SAAS,uBAAA,CACd,IAAA,EACA,OAAA,GAAkC,EAAC,EAClB;AACjB,EAAA,MAAM,MAAA,GAAS,4BAAA;AACf,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,0BAAA;AACrC,EAAA,MAAM,QAAA,GAAW,KAAK,WAAA,EAAY;AAClC,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAM,MAAA,GAAS,QAAQ,WAAA,EAAY;AACnC,IAAA,IAAI,OAAO,MAAA,GAAS,CAAA,IAAK,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG;AAClD,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,KAAA,EAAO,SAAS,OAAA,EAAS,cAAA,CAAe,IAAI,CAAA,EAAG,CAAA;AAAA,IACzE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,uCAAuC,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,QAAA,EAAW,SAAS,MAAM,CAAA,sBAAA,CAAA,EAA0B,UAAU,SAAS,CAAA;AAC7F;AAEA,SAAS,mBAAA,CACP,KAAA,EACA,KAAA,EACA,IAAA,EACA,QAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,6BAAA;AACf,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,MAAM,MAAA,GACJ,UAAU,IAAA,GACN,MAAA,GACA,MAAM,OAAA,CAAQ,KAAK,CAAA,GACjB,OAAA,GACA,OAAO,KAAA;AACf,IAAA,IAAI,MAAA,KAAW,MAAM,IAAA,EAAM;AACzB,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAA,SAAA,EAAY,KAAA,CAAM,IAAI,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAI,CAAA;AAChF,MAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,IAAQ,CAAC,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,CAAC,IAAA,KAAS,MAAA,CAAO,EAAA,CAAG,IAAA,EAAM,KAAK,CAAC,CAAA,EAAG;AACpE,IAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,qBAAqB,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,QAAA,IAAY,KAAA,CAAM,QAAA,IAAY,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC5G,IAAA,MAAM,MAAA,GAAS,KAAA;AACf,IAAA,KAAA,MAAW,GAAA,IAAO,MAAM,QAAA,EAAU;AAChC,MAAA,IAAI,EAAE,OAAO,MAAA,CAAA,EAAS;AACpB,QAAA,QAAA,CAAS,IAAA,CAAK,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,OAAA,EAAS,sBAAA,EAAwB,CAAA;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wBAAA,CACd,OACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,6BAAA;AACf,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/D,IAAA,OAAO,IAAA,CAAK,QAAQ,sCAAA,EAAwC;AAAA,MAC1D,EAAE,MAAA,EAAQ,OAAA,EAAS,OAAO,KAAA;AAAM,KACjC,CAAA;AAAA,EACH;AACA,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzD,IAAA,mBAAA,CAAoB,MAAA,CAAO,GAAG,CAAA,EAAG,KAAA,EAAO,KAAK,QAAQ,CAAA;AAAA,EACvD;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,0CAA0C,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,qCAAA,EAAuC,QAAQ,CAAA;AACrE;AAEO,SAAS,sBAAA,CACd,KAAA,EACA,OAAA,GAAiC,EAAC,EACjB;AACjB,EAAA,MAAM,MAAA,GAAS,2BAAA;AACf,EAAA,MAAM,OAAO,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,IAAA,CAAK,UAAU,KAAK,CAAA;AACrE,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,mBAAA,IAAuB,KAAA;AACtE,EAAA,IAAI,IAAA,CAAK,UAAU,SAAA,EAAW;AAC5B,IAAA,OAAO,IAAA,CAAK,QAAQ,4BAA4B,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,KAAK,MAAA,EAAQ,CAAA,2BAAA,EAA8B,KAAK,MAAM,CAAA,GAAA,EAAM,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,IAChF,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAG,GAC5C,CAAA;AACH;AAEO,SAAS,yBAAA,CACd,OACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,+BAAA;AACf,EAAA,IAAI,MAAA,GAAkB,KAAA;AACtB,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,0BAAA,EAA4B,CAAC,EAAE,MAAA,EAAQ,OAAA,EAAS,cAAA,CAAe,KAAK,CAAA,EAAG,CAAC,CAAA;AAAA,IAC9F;AAAA,EACF;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,IAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,+BAAA,EAAiC,CAAC,EAAE,QAAQ,OAAA,EAAS,OAAO,MAAA,EAAQ,CAAC,CAAA;AAAA,EAC3F;AACA,EAAA,MAAM,MAAA,GAAS,MAAA;AACf,EAAA,MAAM,WAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,GAAA,IAAO,QAAQ,YAAA,EAAc;AACtC,IAAA,IAAI,EAAE,OAAO,MAAA,CAAA,EAAS;AACpB,MAAA,QAAA,CAAS,KAAK,EAAE,MAAA,EAAQ,MAAM,GAAA,EAAK,OAAA,EAAS,wBAAwB,CAAA;AAAA,IACtE;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,IAAA,OAAO,IAAA,CAAK,QAAQ,6BAA6B,CAAA;AAAA,EACnD;AACA,EAAA,OAAO,IAAA,CAAK,MAAA,EAAQ,6BAAA,EAA+B,QAAQ,CAAA;AAC7D;;;AChOA,IAAM,SAAA,GAA+B;AAAA,EACnC,yBAAA;AAAA,EACA,oBAAA;AAAA,EACA,4BAAA;AAAA,EACA,4BAAA;AAAA,EACA,6BAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACF;AAEA,SAAS,eAAe,MAAA,EAAkC;AACxD,EAAA,OAAO,MAAA,CAAO,MAAA,KAAW,MAAA,IAAU,MAAA,CAAO,QAAA,KAAa,OAAA;AACzD;AAEA,SAAS,OAAA,CAAQ,MAAA,EAAyB,KAAA,EAAuB,OAAA,EAA4D;AAC3H,EAAA,QAAQ,MAAA;AAAQ,IACd,KAAK,yBAAA,EAA2B;AAC9B,MAAA,IAAI,CAAC,OAAA,CAAQ,YAAA,IAAgB,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAC9D,MAAA,OAAO,oBAAA,CAAqB,KAAA,CAAM,IAAA,EAAM,OAAA,CAAQ,YAAY,CAAA;AAAA,IAC9D;AAAA,IACA,KAAK,oBAAA,EAAsB;AACzB,MAAA,IAAI,MAAM,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAClE,MAAA,OAAO,gBAAgB,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAM,QAAQ,OAAO,CAAA;AAAA,IACnE;AAAA,IACA,KAAK,4BAAA,EAA8B;AACjC,MAAA,IAAI,CAAC,KAAA,CAAM,QAAA,EAAU,OAAO,MAAA;AAC5B,MAAA,OAAO,sBAAA,CAAuB,MAAM,QAAA,EAAU,KAAA,CAAM,YAAY,EAAC,EAAG,QAAQ,cAAc,CAAA;AAAA,IAC5F;AAAA,IACA,KAAK,4BAAA,EAA8B;AACjC,MAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,EAAW,OAAO,MAAA;AACrC,MAAA,OAAO,uBAAA,CAAwB,KAAA,CAAM,IAAA,EAAM,OAAA,CAAQ,eAAe,CAAA;AAAA,IACpE;AAAA,IACA,KAAK,6BAAA,EAA+B;AAClC,MAAA,IAAI,CAAC,OAAA,CAAQ,gBAAA,IAAoB,KAAA,CAAM,KAAA,KAAU,QAAW,OAAO,MAAA;AACnE,MAAA,OAAO,wBAAA,CAAyB,KAAA,CAAM,KAAA,EAAO,OAAA,CAAQ,gBAAgB,CAAA;AAAA,IACvE;AAAA,IACA,KAAK,2BAAA,EAA6B;AAChC,MAAA,IAAI,MAAM,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,QAAW,OAAO,MAAA;AAClE,MAAA,OAAO,uBAAuB,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAM,QAAQ,cAAc,CAAA;AAAA,IACjF;AAAA,IACA,KAAK,+BAAA,EAAiC;AACpC,MAAA,IAAI,CAAC,QAAQ,iBAAA,IAAsB,KAAA,CAAM,UAAU,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,MAAA,EAAY,OAAO,MAAA;AAClG,MAAA,OAAO,0BAA0B,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,IAAA,EAAO,QAAQ,iBAAiB,CAAA;AAAA,IACxF;AAAA,IACA;AACE,MAAA,OAAO,MAAA;AAAA;AAEb;AAEO,SAAS,aAAA,CAAc,KAAA,EAAuB,OAAA,GAAgC,EAAC,EAAuB;AAC3G,EAAA,MAAM,QAAA,GAAW,QAAQ,KAAA,IAAS,SAAA;AAClC,EAAA,MAAM,UAA6B,EAAC;AACpC,EAAA,KAAA,MAAW,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,EAAQ,KAAA,EAAO,OAAO,CAAA;AAC7C,IAAA,IAAI,MAAA,EAAQ,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA;AAAA,EACjC;AACA,EAAA,MAAM,EAAA,GAAK,CAAC,OAAA,CAAQ,IAAA,CAAK,cAAc,CAAA;AACvC,EAAA,OAAO,EAAE,IAAI,OAAA,EAAQ;AACvB","file":"index.mjs","sourcesContent":["/**\n * Mirrors `packages/core/src/safety/sensitive-key.ts` for dependency-light\n * @agent-inspect/redact consumers. Keep both copies in sync (6.14.2 parity).\n */\n\n/** True when the original key already uses an explicit separator. */\nfunction keyHasExplicitSeparator(value: string): boolean {\n  return /[_\\-.]/.test(value);\n}\n\n/**\n * Canonicalize field names so camelCase / kebab / dot / snake forms share a\n * snake_case shape the compound matcher can recognize (`userPassword` →\n * `user_password`).\n */\nexport function normalizeSensitiveKey(value: string): string {\n  return value\n    .replace(/([a-z0-9])([A-Z])/g, \"$1_$2\")\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n}\n\nexport const NON_CREDENTIAL_TOKEN_CONFIG_KEYS: ReadonlySet<string> = new Set(\n  [\n    \"tokens\",\n    \"max_tokens\",\n    \"min_tokens\",\n    \"ls_max_tokens\",\n    \"token_count\",\n    \"token_limit\",\n    \"token_budget\",\n    \"input_tokens\",\n    \"output_tokens\",\n    \"total_tokens\",\n    \"cached_tokens\",\n    \"prompt_tokens\",\n    \"completion_tokens\",\n  ].map(normalizeSensitiveKey),\n);\n\nfunction isTokenCredentialKey(normalized: string): boolean {\n  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;\n  if (normalized === \"token\") return true;\n  if (normalized.endsWith(\"tokens\")) return false;\n  return normalized.endsWith(\"token\");\n}\n\n/**\n * True when the field name looks credential-sensitive under the shared policy.\n *\n * Suffix compounds (`user_password`, `userPassword`) always match. Prefix\n * compounds (`email_note`) match only when the original key already contained\n * an explicit separator, so camelCase topic fields like `emailNote` stay for\n * value detectors instead of key redaction.\n */\nexport function isCredentialSensitiveKey(\n  key: string | undefined,\n  sensitiveKeys: readonly string[],\n): boolean {\n  if (!key) return false;\n  const normalized = normalizeSensitiveKey(key);\n  if (!normalized) return false;\n  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;\n\n  const allowPrefixCompound = keyHasExplicitSeparator(key);\n\n  for (const sensitive of sensitiveKeys) {\n    const s = normalizeSensitiveKey(sensitive);\n    if (!s) continue;\n    if (s === \"token\") {\n      if (isTokenCredentialKey(normalized)) return true;\n      continue;\n    }\n    if (normalized === s) return true;\n    if (normalized.endsWith(`_${s}`)) return true;\n    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;\n  }\n  return false;\n}\n","/**\n * High-confidence key/value credential forms shared with core\n * `safety.secretPattern` / `key-value-secret` (keep sources in sync).\n *\n * Matches house-format credentials such as:\n *   internal_token=<credential>\n *   token=<credential>\n *   api_key=<credential>\n *\n * Intentionally does **not** match metric/config lookalikes such as\n * maxTokens=, tokenCount=, secret=false, or short placeholders.\n */\nexport const KEY_VALUE_SECRET_PATTERN_SOURCE =\n  String.raw`\\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\\s\"'\\\\]{8,})`;\n\nexport const KEY_VALUE_SECRET_PATTERN = new RegExp(\n  KEY_VALUE_SECRET_PATTERN_SOURCE,\n  \"i\",\n);\n\nexport function valueContainsKeyValueSecret(value: string): boolean {\n  KEY_VALUE_SECRET_PATTERN.lastIndex = 0;\n  return KEY_VALUE_SECRET_PATTERN.test(value);\n}\n","import crypto from \"node:crypto\";\nimport { isCredentialSensitiveKey } from \"./sensitive-key.js\";\nimport { valueContainsKeyValueSecret } from \"./key-value-secret.js\";\n\nexport type RedactionProfile = \"local\" | \"share\" | \"strict\";\n\nexport type RedactionAction = \"replace\" | \"hash\" | \"prefix\" | \"truncate\" | \"keep\";\n\nexport type RedactionSeverity = \"info\" | \"warning\" | \"error\";\n\nexport type RedactionMatchKind = \"key\" | \"value\" | \"custom\";\n\nexport type RedactionRule =\n  | string\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep?: number }\n  | { key: string; strategy: \"hash\" };\n\nexport interface RedactionFinding {\n  path: string;\n  detector: string;\n  action: RedactionAction;\n  severity: RedactionSeverity;\n  matchKind: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetection {\n  action?: RedactionAction;\n  replacement?: unknown;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  preview?: string;\n}\n\nexport interface RedactionDetectorInput {\n  path: string;\n  key?: string;\n  value: unknown;\n}\n\nexport interface RedactionDetector {\n  id: string;\n  severity?: RedactionSeverity;\n  matchKind?: RedactionMatchKind;\n  detect(input: RedactionDetectorInput): RedactionDetection[];\n}\n\nexport interface RedactionResult<T = unknown> {\n  value: T;\n  findings: RedactionFinding[];\n  redacted: boolean;\n  profile: RedactionProfile;\n}\n\nexport interface ResolvedRedactionProfile {\n  profile: RedactionProfile;\n  extraKeys: readonly string[];\n  maxMetadataValueLengthCap?: number;\n  maxPreviewLengthCap?: number;\n}\n\nexport interface RedactOptions {\n  profile?: RedactionProfile;\n  detectors?: RedactionDetector[];\n  rules?: RedactionRule[];\n  replacement?: string;\n  maxDepth?: number;\n  maxStringLength?: number;\n  collectFindings?: boolean;\n}\n\nexport interface RedactorOptions extends RedactOptions {\n  extraKeys?: readonly string[];\n}\n\nexport const DEFAULT_REDACT_KEYS = [\n  \"authorization\",\n  \"cookie\",\n  \"token\",\n  \"apiKey\",\n  \"password\",\n  \"secret\",\n  \"email\",\n] as const;\n\nexport const SHARE_PROFILE_EXTRA_KEYS = [\n  \"userEmail\",\n  \"customerEmail\",\n  \"phone\",\n  \"phoneNumber\",\n  \"address\",\n  \"ip\",\n  \"ipAddress\",\n  \"sessionId\",\n  \"requestId\",\n  \"correlationId\",\n  \"decisionId\",\n  \"groupId\",\n  \"customerId\",\n  \"userId\",\n  \"accountId\",\n  \"tenantId\",\n  \"orgId\",\n  \"organizationId\",\n  \"traceId\",\n  \"spanId\",\n  \"parentSpanId\",\n  \"currentTask\",\n  \"task\",\n  \"userInput\",\n  \"requestText\",\n  \"conversationText\",\n] as const;\n\nexport const STRICT_PROFILE_EXTRA_KEYS = [\n  \"prompt\",\n  \"completion\",\n  \"input\",\n  \"output\",\n  \"inputPreview\",\n  \"outputPreview\",\n  \"message\",\n  \"messages\",\n  \"transcript\",\n  \"context\",\n  \"document\",\n  \"documents\",\n  \"chunk\",\n  \"chunks\",\n  \"retrieval\",\n  \"query\",\n] as const;\n\ntype CompiledRule =\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep: number }\n  | { key: string; strategy: \"hash\" };\n\ninterface RedactionState {\n  findings: RedactionFinding[];\n  seen: WeakMap<object, unknown>;\n}\n\ninterface PatternDetectorOptions {\n  id: string;\n  pattern: RegExp;\n  severity?: RedactionSeverity;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n\nfunction toKey(key: string): string {\n  return key.toLowerCase();\n}\n\nfunction findCompiledKeyRule(\n  key: string,\n  rules: readonly CompiledRule[],\n): CompiledRule | undefined {\n  const exact = toKey(key);\n  const direct = rules.find((candidate) => candidate.key === exact);\n  if (direct) return direct;\n  return rules.find((candidate) => isCredentialSensitiveKey(key, [candidate.key]));\n}\n\nfunction stableHash(value: string): string {\n  const hash = crypto.createHash(\"sha256\").update(value, \"utf8\").digest(\"hex\");\n  return hash.slice(0, 8);\n}\n\nfunction stringifyScalar(value: unknown): string | undefined {\n  if (typeof value === \"string\") return value;\n  if (typeof value === \"number\" || typeof value === \"boolean\" || typeof value === \"bigint\") {\n    return String(value);\n  }\n  return undefined;\n}\n\nfunction patternDetector(options: PatternDetectorOptions): RedactionDetector {\n  return {\n    id: options.id,\n    severity: options.severity ?? \"warning\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      options.pattern.lastIndex = 0;\n      return options.pattern.test(input.value)\n        ? [{ action: \"replace\", severity: options.severity ?? \"warning\", matchKind: \"value\" }]\n        : [];\n    },\n  };\n}\n\nfunction digitsOnly(value: string): string {\n  return value.replace(/\\D/g, \"\");\n}\n\nfunction passesLuhn(value: string): boolean {\n  const digits = digitsOnly(value);\n  if (digits.length < 13 || digits.length > 19) return false;\n\n  let sum = 0;\n  let double = false;\n  for (let i = digits.length - 1; i >= 0; i -= 1) {\n    let digit = Number(digits[i]);\n    if (double) {\n      digit *= 2;\n      if (digit > 9) digit -= 9;\n    }\n    sum += digit;\n    double = !double;\n  }\n  return sum % 10 === 0;\n}\n\nconst UUID_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\n/** 13-digit Unix epoch milliseconds in a plausible modern range. */\nconst EPOCH_MS_RE = /^1[0-9]{12}$/;\n\nconst EMAIL_RE = /\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b/gi;\n\nfunction pathSuggestsNonCard(path: string): boolean {\n  const normalized = path.toLowerCase().replace(/[^a-z0-9._]/g, \"\");\n  return (\n    /(^|\\.)(tokenusage|usage)(\\.|$)/.test(normalized) ||\n    /(startedat|endedat|durationms|timestamp|createdat|updatedat)(\\.|$)/.test(normalized) ||\n    /(^|\\.)(runid|traceid|spanid|eventid|sessionid|userid|parentid|requestid|correlationid)(\\.|$)/.test(\n      normalized,\n    ) ||\n    /(^|\\.)ts(\\.|$)/.test(normalized)\n  );\n}\n\nfunction isUuidLike(value: string): boolean {\n  return UUID_RE.test(value.trim());\n}\n\nfunction isPlausibleCardCandidate(candidate: string, fullValue: string): boolean {\n  const digits = digitsOnly(candidate);\n  if (digits.length < 13 || digits.length > 19) return false;\n  if (!passesLuhn(candidate)) return false;\n\n  const trimmed = fullValue.trim();\n  if (isUuidLike(trimmed)) return false;\n\n  // Naked epoch-ms timestamps are not PANs.\n  if (EPOCH_MS_RE.test(digits) && digitsOnly(trimmed) === digits && /^\\d+$/.test(trimmed)) {\n    return false;\n  }\n\n  // Reject candidates glued inside longer alphanumeric IDs without card separators.\n  const start = fullValue.indexOf(candidate);\n  if (start >= 0) {\n    const before = fullValue[start - 1];\n    const after = fullValue[start + candidate.length];\n    if (before && /[A-Za-z0-9_]/.test(before)) return false;\n    if (after && /[A-Za-z0-9_]/.test(after)) return false;\n  }\n\n  return true;\n}\n\nfunction looksLikePathOrPackageOrUrl(value: string): boolean {\n  const trimmed = value.trim();\n  if (/^(?:[a-z][a-z0-9+.-]*:)?\\/\\//i.test(trimmed)) return true;\n  if (/^webpack:/i.test(trimmed)) return true;\n  if (/^@[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.@/-]+$/.test(trimmed)) return true;\n  if (/^[A-Za-z]:[\\\\/]/.test(trimmed) || /^[/\\\\]/.test(trimmed)) return true;\n  // Path-like single token (slashes, no whitespace).\n  if (/[\\\\/]/.test(trimmed) && !/\\s/.test(trimmed)) return true;\n  return false;\n}\n\nfunction emailMatchIsPathAdjacent(value: string, index: number, length: number): boolean {\n  const before = value[index - 1];\n  const after = value[index + length];\n  return before === \"/\" || before === \"\\\\\" || after === \"/\" || after === \"\\\\\";\n}\n\nfunction valueContainsEmail(value: string): boolean {\n  if (looksLikePathOrPackageOrUrl(value)) return false;\n  EMAIL_RE.lastIndex = 0;\n  for (const match of value.matchAll(EMAIL_RE)) {\n    const text = match[0] ?? \"\";\n    const index = match.index ?? 0;\n    if (emailMatchIsPathAdjacent(value, index, text.length)) continue;\n    return true;\n  }\n  return false;\n}\n\nconst credentialDetectors: readonly RedactionDetector[] = [\n  patternDetector({\n    id: \"value.authorizationHeader\",\n    pattern: /^(?:basic|bearer|digest|apikey)\\s+[a-z0-9._~+/=-]+$/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.bearerToken\",\n    pattern: /\\bbearer\\s+[a-z0-9._~+/=-]{12,}\\b/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.cookie\",\n    pattern: /\\b[a-z0-9_.-]+=[^;\\s]+(?:;\\s*[a-z0-9_.-]+=[^;\\s]+)+/i,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.jwt\",\n    pattern: /\\beyJ[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\.[a-zA-Z0-9_-]{8,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.providerApiKey\",\n    pattern: /\\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.githubToken\",\n    pattern: /\\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.awsAccessKey\",\n    pattern: /\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b/,\n    severity: \"error\",\n  }),\n  patternDetector({\n    id: \"value.privateKey\",\n    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*-----END [A-Z ]*PRIVATE KEY-----/,\n    severity: \"error\",\n  }),\n  {\n    id: \"value.keyValueSecret\",\n    severity: \"error\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      return valueContainsKeyValueSecret(input.value)\n        ? [{ action: \"replace\", severity: \"error\", matchKind: \"value\" }]\n        : [];\n    },\n  },\n  {\n    id: \"value.creditCard\",\n    severity: \"error\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      if (pathSuggestsNonCard(input.path)) return [];\n      if (isUuidLike(input.value)) return [];\n      const candidatePattern = /(?:\\d[ -]?){13,19}/g;\n      for (const match of input.value.matchAll(candidatePattern)) {\n        const candidate = match[0] ?? \"\";\n        if (isPlausibleCardCandidate(candidate, input.value)) {\n          return [{ action: \"replace\", severity: \"error\", matchKind: \"value\" }];\n        }\n      }\n      return [];\n    },\n  },\n];\n\nconst identifierDetectors: readonly RedactionDetector[] = [\n  {\n    id: \"value.email\",\n    severity: \"warning\",\n    matchKind: \"value\",\n    detect(input) {\n      if (typeof input.value !== \"string\") return [];\n      return valueContainsEmail(input.value)\n        ? [{ action: \"replace\", severity: \"warning\", matchKind: \"value\" }]\n        : [];\n    },\n  },\n  patternDetector({\n    id: \"value.phone\",\n    pattern: /\\b(?:\\+\\d{1,3}[\\s.-]?)?(?:\\(?\\d{3}\\)?[\\s.-])\\d{3}[\\s.-]\\d{4}\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv4\",\n    pattern: /\\b(?:(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\b/,\n  }),\n  patternDetector({\n    id: \"value.ipv6\",\n    pattern: /\\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\\b/i,\n  }),\n];\n\nfunction builtInDetectorsForProfile(profile: RedactionProfile): readonly RedactionDetector[] {\n  if (profile === \"local\") return credentialDetectors;\n  return [...credentialDetectors, ...identifierDetectors];\n}\n\nfunction compileRules(\n  rules?: RedactionRule[],\n  extraKeys?: readonly string[],\n): CompiledRule[] {\n  const out = new Map<string, CompiledRule>();\n\n  const set = (rule: CompiledRule) => {\n    const key = toKey(rule.key);\n    out.set(key, { ...rule, key } as CompiledRule);\n  };\n\n  for (const key of DEFAULT_REDACT_KEYS) {\n    set({ key, strategy: \"full\" });\n  }\n\n  for (const key of extraKeys ?? []) {\n    if (typeof key === \"string\" && key.length > 0) {\n      set({ key, strategy: \"full\" });\n    }\n  }\n\n  for (const rule of rules ?? []) {\n    if (typeof rule === \"string\") {\n      set({ key: rule, strategy: \"full\" });\n      continue;\n    }\n\n    if (rule.strategy === \"full\") set({ key: rule.key, strategy: \"full\" });\n    if (rule.strategy === \"hash\") set({ key: rule.key, strategy: \"hash\" });\n    if (rule.strategy === \"prefix\") {\n      set({\n        key: rule.key,\n        strategy: \"prefix\",\n        keep: typeof rule.keep === \"number\" ? rule.keep : 8,\n      });\n    }\n  }\n\n  return [...out.values()];\n}\n\nfunction actionForRule(rule: CompiledRule): RedactionAction {\n  if (rule.strategy === \"full\") return \"replace\";\n  return rule.strategy;\n}\n\nfunction applyRule(\n  rule: CompiledRule,\n  value: unknown,\n  replacement: string,\n): unknown {\n  if (rule.strategy === \"full\") return replacement;\n\n  const asString = stringifyScalar(value);\n  if (rule.strategy === \"prefix\") {\n    if (asString === undefined) return replacement;\n    const keep = Math.max(0, Math.floor(rule.keep));\n    return asString.length <= keep ? `${asString}…` : `${asString.slice(0, keep)}…`;\n  }\n\n  if (rule.strategy === \"hash\") {\n    if (asString === undefined) return \"[HASH:unknown]\";\n    return `[HASH:${stableHash(asString)}]`;\n  }\n\n  return value;\n}\n\nfunction childPath(path: string, key: string): string {\n  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {\n    return path ? `${path}.${key}` : key;\n  }\n  return `${path || \"$\"}[${JSON.stringify(key)}]`;\n}\n\nfunction indexPath(path: string, index: number): string {\n  return `${path || \"$\"}[${index}]`;\n}\n\nfunction makeFinding(\n  path: string,\n  detector: string,\n  action: RedactionAction,\n  matchKind: RedactionMatchKind,\n  severity: RedactionSeverity = \"warning\",\n  preview?: string,\n): RedactionFinding {\n  return preview === undefined\n    ? { path, detector, action, severity, matchKind }\n    : { path, detector, action, severity, matchKind, preview };\n}\n\nexport function createRedactionProfile(profile: RedactionProfile = \"local\"): ResolvedRedactionProfile {\n  switch (profile) {\n    case \"local\":\n      return { profile: \"local\", extraKeys: [] };\n    case \"share\":\n      return {\n        profile: \"share\",\n        extraKeys: SHARE_PROFILE_EXTRA_KEYS,\n        maxMetadataValueLengthCap: 500,\n        maxPreviewLengthCap: 200,\n      };\n    case \"strict\":\n      return {\n        profile: \"strict\",\n        extraKeys: [...SHARE_PROFILE_EXTRA_KEYS, ...STRICT_PROFILE_EXTRA_KEYS],\n        maxMetadataValueLengthCap: 200,\n        maxPreviewLengthCap: 80,\n      };\n  }\n}\n\nexport class Redactor {\n  readonly #rules: CompiledRule[];\n  readonly #detectors: readonly RedactionDetector[];\n  readonly #profile: RedactionProfile;\n  readonly #replacement: string;\n  readonly #maxDepth: number;\n  readonly #collectFindings: boolean;\n\n  constructor(options?: RedactorOptions) {\n    const resolved = createRedactionProfile(options?.profile ?? \"local\");\n    this.#profile = resolved.profile;\n    this.#rules = compileRules(options?.rules, [\n      ...resolved.extraKeys,\n      ...(options?.extraKeys ?? []),\n    ]);\n    this.#detectors = [\n      ...builtInDetectorsForProfile(this.#profile),\n      ...(options?.detectors ?? []),\n    ];\n    this.#replacement = options?.replacement ?? \"[REDACTED]\";\n    this.#maxDepth = options?.maxDepth ?? 32;\n    this.#collectFindings = options?.collectFindings ?? true;\n  }\n\n  redactValue(key: string, value: unknown): unknown {\n    return this.#redactValue(value, key, key, 0, {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    });\n  }\n\n  redactRecord(record: Record<string, unknown>): Record<string, unknown> {\n    return this.redact(record).value as Record<string, unknown>;\n  }\n\n  redact<T = unknown>(value: T): RedactionResult<T> {\n    const state: RedactionState = {\n      findings: [],\n      seen: new WeakMap<object, unknown>(),\n    };\n    const redacted = this.#redactValue(value, undefined, \"$\", 0, state);\n    return {\n      value: redacted as T,\n      findings: state.findings,\n      redacted: state.findings.some((finding) => finding.action !== \"keep\"),\n      profile: this.#profile,\n    };\n  }\n\n  #recordFinding(state: RedactionState, finding: RedactionFinding): void {\n    if (this.#collectFindings) state.findings.push(finding);\n  }\n\n  #redactValue(\n    value: unknown,\n    key: string | undefined,\n    path: string,\n    depth: number,\n    state: RedactionState,\n  ): unknown {\n    if (depth > this.#maxDepth) {\n      this.#recordFinding(\n        state,\n        makeFinding(path, \"structure.maxDepth\", \"truncate\", \"value\", \"warning\"),\n      );\n      return \"[Truncated]\";\n    }\n\n    if (key !== undefined) {\n      const rule = findCompiledKeyRule(key, this.#rules);\n      if (rule) {\n        this.#recordFinding(\n          state,\n          makeFinding(path, `key.${rule.key}`, actionForRule(rule), \"key\", \"warning\"),\n        );\n        return applyRule(rule, value, this.#replacement);\n      }\n    }\n\n    for (const detector of this.#detectors) {\n      const detections = detector.detect({ path, key, value });\n      for (const detection of detections) {\n        const action = detection.action ?? \"replace\";\n        this.#recordFinding(\n          state,\n          makeFinding(\n            path,\n            detector.id,\n            action,\n            detection.matchKind ?? detector.matchKind ?? \"custom\",\n            detection.severity ?? detector.severity ?? \"warning\",\n            detection.preview,\n          ),\n        );\n        if (action !== \"keep\") {\n          return detection.replacement ?? this.#replacement;\n        }\n      }\n    }\n\n    if (Array.isArray(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: unknown[] = [];\n      state.seen.set(value, out);\n      value.forEach((item, index) => {\n        out[index] = this.#redactValue(item, undefined, indexPath(path, index), depth + 1, state);\n      });\n      return out;\n    }\n\n    if (isRecord(value)) {\n      if (state.seen.has(value)) return state.seen.get(value);\n      const out: Record<string, unknown> = {};\n      state.seen.set(value, out);\n      for (const [entryKey, entryValue] of Object.entries(value)) {\n        out[entryKey] = this.#redactValue(\n          entryValue,\n          entryKey,\n          childPath(path === \"$\" ? \"\" : path, entryKey),\n          depth + 1,\n          state,\n        );\n      }\n      return out;\n    }\n\n    return value;\n  }\n}\n\nexport function createRedactor(options?: RedactorOptions): Redactor {\n  return new Redactor(options);\n}\n\nexport function redact<T = unknown>(value: T, options?: RedactOptions): RedactionResult<T> {\n  return createRedactor(options).redact(value);\n}\n\nexport {\n  KEY_VALUE_SECRET_PATTERN,\n  KEY_VALUE_SECRET_PATTERN_SOURCE,\n  valueContainsKeyValueSecret,\n} from \"./key-value-secret.js\";\n\n","import { redact, type RedactionFinding } from \"@agent-inspect/redact\";\n\nimport type {\n  BannedPhraseOptions,\n  GuardrailEvidence,\n  GuardrailResult,\n  OversizeOutputOptions,\n  PiiLeakOptions,\n  PromptInjectionOptions,\n  RequiredJsonShapeOptions,\n  StructuredOutputOptions,\n  UnsafeToolArgsOptions,\n} from \"./types.js\";\n\nconst DEFAULT_INJECTION_PATTERNS = [\n  \"ignore previous instructions\",\n  \"ignore all prior\",\n  \"disregard your instructions\",\n  \"system prompt\",\n  \"you are now\",\n  \"jailbreak\",\n] as const;\n\nfunction pass(ruleId: string, message: string): GuardrailResult {\n  return { ruleId, status: \"pass\", severity: \"info\", message, evidence: [] };\n}\n\nfunction fail(\n  ruleId: string,\n  message: string,\n  evidence: GuardrailEvidence[],\n  severity: \"error\" | \"warning\" = \"error\",\n): GuardrailResult {\n  return { ruleId, status: severity === \"warning\" ? \"warn\" : \"fail\", severity, message, evidence };\n}\n\nfunction boundedPreview(value: string, max = 80): string {\n  if (value.length <= max) return value;\n  return `${value.slice(0, max - 3)}...`;\n}\n\nexport function evaluateBannedPhrase(\n  text: string,\n  options: BannedPhraseOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.banned-phrase\";\n  const haystack = options.caseInsensitive !== false ? text.toLowerCase() : text;\n  const evidence: GuardrailEvidence[] = [];\n  for (const phrase of options.phrases) {\n    const needle = options.caseInsensitive !== false ? phrase.toLowerCase() : phrase;\n    if (needle.length > 0 && haystack.includes(needle)) {\n      evidence.push({ ruleId, match: phrase, preview: boundedPreview(text) });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"No banned phrases matched.\");\n  }\n  return fail(ruleId, `Matched ${evidence.length} banned phrase(s).`, evidence);\n}\n\nconst SEVERITY_RANK = { info: 0, warning: 1, error: 2 } as const;\n\nexport function evaluatePiiLeak(value: unknown, options: PiiLeakOptions = {}): GuardrailResult {\n  const ruleId = \"guardrail.pii-leak\";\n  const minSeverity = options.minSeverity ?? \"warning\";\n  const result = redact(value, { profile: options.profile ?? \"share\", collectFindings: true });\n  const findings = result.findings.filter(\n    (finding: RedactionFinding) => SEVERITY_RANK[finding.severity] >= SEVERITY_RANK[minSeverity],\n  );\n  if (findings.length === 0) {\n    return pass(ruleId, \"No PII-style redaction findings.\");\n  }\n  const evidence: GuardrailEvidence[] = findings.map((finding) => ({\n    ruleId,\n    path: finding.path,\n    detector: finding.detector,\n    preview: finding.preview,\n  }));\n  return fail(ruleId, `Detected ${findings.length} PII-style finding(s).`, evidence);\n}\n\nfunction measureDepth(value: unknown): number {\n  if (value === null || typeof value !== \"object\") return 0;\n  if (Array.isArray(value)) {\n    return 1 + Math.max(0, ...value.map((item) => measureDepth(item)));\n  }\n  const depths = Object.values(value as Record<string, unknown>).map((item) => measureDepth(item));\n  return 1 + (depths.length === 0 ? 0 : Math.max(...depths));\n}\n\nfunction maxStringLength(value: unknown): number {\n  if (typeof value === \"string\") return value.length;\n  if (value === null || typeof value !== \"object\") return 0;\n  if (Array.isArray(value)) {\n    return Math.max(0, ...value.map((item) => maxStringLength(item)));\n  }\n  return Math.max(0, ...Object.values(value as Record<string, unknown>).map((item) => maxStringLength(item)));\n}\n\nexport function evaluateUnsafeToolArgs(\n  toolName: string,\n  toolArgs: unknown,\n  options: UnsafeToolArgsOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.unsafe-tool-args\";\n  const blocked = new Set((options.blockedTools ?? []).map((name) => name.toLowerCase()));\n  const evidence: GuardrailEvidence[] = [];\n  if (blocked.has(toolName.toLowerCase())) {\n    evidence.push({ ruleId, preview: toolName, match: toolName });\n  }\n  const maxDepth = options.maxDepth ?? 12;\n  const depth = measureDepth(toolArgs);\n  if (depth > maxDepth) {\n    evidence.push({ ruleId, path: \"args\", preview: `depth=${depth}` });\n  }\n  const maxLen = options.maxStringLength ?? 16_384;\n  const longest = maxStringLength(toolArgs);\n  if (longest > maxLen) {\n    evidence.push({ ruleId, path: \"args\", preview: `maxStringLength=${longest}` });\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Tool arguments within configured bounds.\");\n  }\n  return fail(ruleId, \"Unsafe or oversized tool arguments detected.\", evidence);\n}\n\nexport function evaluatePromptInjection(\n  text: string,\n  options: PromptInjectionOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.prompt-injection\";\n  const patterns = options.patterns ?? DEFAULT_INJECTION_PATTERNS;\n  const haystack = text.toLowerCase();\n  const evidence: GuardrailEvidence[] = [];\n  for (const pattern of patterns) {\n    const needle = pattern.toLowerCase();\n    if (needle.length > 0 && haystack.includes(needle)) {\n      evidence.push({ ruleId, match: pattern, preview: boundedPreview(text) });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"No prompt-injection patterns matched.\");\n  }\n  return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, \"warning\");\n}\n\nfunction validateSchemaField(\n  value: unknown,\n  field: StructuredOutputOptions[\"schema\"][string],\n  path: string,\n  evidence: GuardrailEvidence[],\n): void {\n  const ruleId = \"guardrail.structured-output\";\n  if (field.type) {\n    const actual =\n      value === null\n        ? \"null\"\n        : Array.isArray(value)\n          ? \"array\"\n          : typeof value;\n    if (actual !== field.type) {\n      evidence.push({ ruleId, path, preview: `expected ${field.type}, got ${actual}` });\n      return;\n    }\n  }\n  if (field.enum && !field.enum.some((item) => Object.is(item, value))) {\n    evidence.push({ ruleId, path, preview: \"value not in enum\" });\n  }\n  if (field.type === \"object\" && field.required && value && typeof value === \"object\" && !Array.isArray(value)) {\n    const record = value as Record<string, unknown>;\n    for (const key of field.required) {\n      if (!(key in record)) {\n        evidence.push({ ruleId, path: `${path}.${key}`, preview: \"missing required key\" });\n      }\n    }\n  }\n}\n\nexport function evaluateStructuredOutput(\n  value: unknown,\n  options: StructuredOutputOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.structured-output\";\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    return fail(ruleId, \"Structured output must be an object.\", [\n      { ruleId, preview: typeof value },\n    ]);\n  }\n  const record = value as Record<string, unknown>;\n  const evidence: GuardrailEvidence[] = [];\n  for (const [key, field] of Object.entries(options.schema)) {\n    validateSchemaField(record[key], field, key, evidence);\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Structured output matches schema subset.\");\n  }\n  return fail(ruleId, \"Structured output schema violation.\", evidence);\n}\n\nexport function evaluateOversizeOutput(\n  value: unknown,\n  options: OversizeOutputOptions = {},\n): GuardrailResult {\n  const ruleId = \"guardrail.oversize-output\";\n  const text = typeof value === \"string\" ? value : JSON.stringify(value);\n  const maxLength = options.maxLength ?? options.maxSerializedLength ?? 32_768;\n  if (text.length <= maxLength) {\n    return pass(ruleId, \"Output within size limits.\");\n  }\n  return fail(ruleId, `Output exceeds max length (${text.length} > ${maxLength}).`, [\n    { ruleId, preview: `length=${text.length}` },\n  ]);\n}\n\nexport function evaluateRequiredJsonShape(\n  value: unknown,\n  options: RequiredJsonShapeOptions,\n): GuardrailResult {\n  const ruleId = \"guardrail.required-json-shape\";\n  let parsed: unknown = value;\n  if (typeof value === \"string\") {\n    try {\n      parsed = JSON.parse(value);\n    } catch {\n      return fail(ruleId, \"Value is not valid JSON.\", [{ ruleId, preview: boundedPreview(value) }]);\n    }\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    return fail(ruleId, \"JSON value must be an object.\", [{ ruleId, preview: typeof parsed }]);\n  }\n  const record = parsed as Record<string, unknown>;\n  const evidence: GuardrailEvidence[] = [];\n  for (const key of options.requiredKeys) {\n    if (!(key in record)) {\n      evidence.push({ ruleId, path: key, preview: \"missing required key\" });\n    }\n  }\n  if (evidence.length === 0) {\n    return pass(ruleId, \"Required JSON keys present.\");\n  }\n  return fail(ruleId, \"Missing required JSON keys.\", evidence);\n}\n","import {\n  evaluateBannedPhrase,\n  evaluateOversizeOutput,\n  evaluatePiiLeak,\n  evaluatePromptInjection,\n  evaluateRequiredJsonShape,\n  evaluateStructuredOutput,\n  evaluateUnsafeToolArgs,\n} from \"./rules.js\";\nimport type {\n  GuardrailInput,\n  GuardrailResult,\n  GuardrailRuleId,\n  GuardrailRunResult,\n  RunGuardrailsOptions,\n} from \"./types.js\";\n\nconst ALL_RULES: GuardrailRuleId[] = [\n  \"guardrail.banned-phrase\",\n  \"guardrail.pii-leak\",\n  \"guardrail.unsafe-tool-args\",\n  \"guardrail.prompt-injection\",\n  \"guardrail.structured-output\",\n  \"guardrail.oversize-output\",\n  \"guardrail.required-json-shape\",\n];\n\nfunction isErrorFailure(result: GuardrailResult): boolean {\n  return result.status === \"fail\" && result.severity === \"error\";\n}\n\nfunction runRule(ruleId: GuardrailRuleId, input: GuardrailInput, options: RunGuardrailsOptions): GuardrailResult | undefined {\n  switch (ruleId) {\n    case \"guardrail.banned-phrase\": {\n      if (!options.bannedPhrase || input.text === undefined) return undefined;\n      return evaluateBannedPhrase(input.text, options.bannedPhrase);\n    }\n    case \"guardrail.pii-leak\": {\n      if (input.value === undefined && input.text === undefined) return undefined;\n      return evaluatePiiLeak(input.value ?? input.text, options.piiLeak);\n    }\n    case \"guardrail.unsafe-tool-args\": {\n      if (!input.toolName) return undefined;\n      return evaluateUnsafeToolArgs(input.toolName, input.toolArgs ?? {}, options.unsafeToolArgs);\n    }\n    case \"guardrail.prompt-injection\": {\n      if (input.text === undefined) return undefined;\n      return evaluatePromptInjection(input.text, options.promptInjection);\n    }\n    case \"guardrail.structured-output\": {\n      if (!options.structuredOutput || input.value === undefined) return undefined;\n      return evaluateStructuredOutput(input.value, options.structuredOutput);\n    }\n    case \"guardrail.oversize-output\": {\n      if (input.value === undefined && input.text === undefined) return undefined;\n      return evaluateOversizeOutput(input.value ?? input.text, options.oversizeOutput);\n    }\n    case \"guardrail.required-json-shape\": {\n      if (!options.requiredJsonShape || (input.value === undefined && input.text === undefined)) return undefined;\n      return evaluateRequiredJsonShape(input.value ?? input.text!, options.requiredJsonShape);\n    }\n    default:\n      return undefined;\n  }\n}\n\nexport function runGuardrails(input: GuardrailInput, options: RunGuardrailsOptions = {}): GuardrailRunResult {\n  const selected = options.rules ?? ALL_RULES;\n  const results: GuardrailResult[] = [];\n  for (const ruleId of selected) {\n    const result = runRule(ruleId, input, options);\n    if (result) results.push(result);\n  }\n  const ok = !results.some(isErrorFailure);\n  return { ok, results };\n}\n\nexport { ALL_RULES as DEFAULT_GUARDRAIL_RULES };\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-inspect/guardrails",
-  "version": "6.17.6",
+  "version": "6.17.7",
   "license": "MIT",
   "type": "module",
   "description": "Deterministic local guardrail utilities for AgentInspect workflows",
@@ -34,7 +34,7 @@
     "dist"
   ],
   "dependencies": {
-    "@agent-inspect/redact": "6.17.6"
+    "@agent-inspect/redact": "6.17.7"
   },
   "peerDependencies": {},
   "publishConfig": {