@aion0/bastion 0.1.12 → 0.1.14

package/README.md

@@ -104,6 +104,15 @@ Monitors and blocks dangerous tool calls made by AI agents in real-time. Interce
 
 Action modes: `audit` (log and alert) or `block` (intercept in real-time, including streaming responses). Desktop notifications and webhook alerts (Slack, Discord) for high-severity matches.
 
+### 🔍 Threat Intelligence
+
+Session-level threat scoring with multi-signal correlation. Aggregates events from DLP, Tool Guard, and Prompt Injection detection into a unified threat score per session.
+
+- **Chain detection** — detects multi-step attack patterns (e.g., credential access followed by network exfiltration)
+- **Taint tracking** — tracks sensitive data fingerprints across tool calls to detect data flow violations
+- **Threat levels** — normal / elevated / high / critical with exponential decay scoring
+- **3 built-in chain rules** — credential→exfil, execution→destruction, credential→publish
+
 ### 📝 Audit Logger
 
 Full request/response history for every AI interaction, encrypted at rest. Session-based timeline with DLP and Tool Guard tags. Any security event automatically creates an audit entry — even if the audit plugin is disabled.
@@ -116,11 +125,11 @@ Configurable retention with automatic purge. Formatted viewer in the dashboard f
 
 Real-time security dashboard at `http://127.0.0.1:8420/dashboard`:
 
-- **Overview** — Request metrics, cost, tokens, per-provider/model/session breakdown
+- **Overview** — Request metrics, cost, tokens, per-provider/model/session breakdown, threat gauge
 - **DLP** — Findings, config, signature management, standalone test scanner with trace log
-- **Tool Guard** — Tool call history, severity, rule management (built-in + custom)
+- **Tool Guard** — Tool call history, severity, rule management (built-in + custom), threat sessions, chain detections
 - **Audit** — Session timeline, security-tagged entries, formatted request/response viewer
-- **Settings** — Toggle plugins, configure rules — all changes apply without restart
+- **Settings** — Toggle plugins, optional features management — all changes apply without restart
 
 ## How It Works
 
@@ -168,6 +177,20 @@ bash ~/.openclaw/skills/bastion/scripts/docker-setup.sh
 
 See [@aion0/bastion-skills on GitHub](https://github.com/aiwatching/bastion-skills)
 
+## Optional Plugins
+
+Bastion's core detection is fully free. For ML-based detection with heavier dependencies (ONNX Runtime, ~436 MB models), install the optional plugin pack:
+
+```bash
+bastion plugins install          # auto-detects sibling bastion-plugin-api
+bastion plugins list             # show installed plugins
+bastion plugins uninstall        # remove (prompts to also delete models)
+```
+
+Or via the Dashboard → Settings → Optional Features.
+
+See [@aiwatching/bastion-pro](https://github.com/aiwatching/bastion-plugin-api) for details.
+
 ## Documentation
 
 | Doc | Description |
@@ -191,6 +214,7 @@ Everything stays on your machine in `~/.bastion/`:
   config.yaml   # Your config overrides
   ca.key / ca.crt / certs/   # Local CA & certificates
   .key          # AES encryption key for audit data
+  models/       # ML models (optional, ~436 MB if plugins installed)
 ```
 
 ## Contributing

package/README.zh.md

@@ -207,12 +207,12 @@ bastion trust-ca
 网关运行时，在浏览器中打开 `http://127.0.0.1:8420/dashboard`。
 
 6 个标签页：
-- **Overview** — 请求指标、费用、token 数、按提供商/模型/会话分类的统计
+- **Overview** — 请求指标、费用、token 数、按提供商/模型/会话分类的统计、威胁仪表盘
 - **DLP** — 子标签：Findings（方向、片段、钻取至审计记录）、Config（引擎开关、动作模式、AI 验证、语义规则）、Signatures（远程同步状态、版本追踪、变更日志、模式管理）、Test（独立扫描器，含预设、trace 日志）
-- **Tool Guard** — 子标签：Calls（最近工具调用历史，含严重级别、规则匹配、执行动作）、Rules（26 条内置规则 + 自定义规则管理，可逐条启用/禁用）
+- **Tool Guard** — 子标签：Calls（最近工具调用历史，含严重级别、规则匹配、执行动作）、Rules（26 条内置规则 + 自定义规则管理，可逐条启用/禁用）、威胁会话、链式检测
 - **Optimizer** — 缓存命中率、节省的 token 数
 - **Audit** — 基于会话的时间线、DLP/Tool Guard 标记条目、摘要预览、格式化请求/响应查看器
-- **Settings** — 切换 plugin、配置 AI 验证、语义规则，运行时修改无需重启
+- **Settings** — 切换 plugin、可选功能管理，运行时修改无需重启
 
 ## 工作原理
 
@@ -329,6 +329,14 @@ plugins:
 - **响应缓存** — 对相同请求进行精确匹配缓存（AES-256-GCM 加密）
 - **空白压缩** — 折叠多余空白以节省 token
 
+### 威胁情报
+会话级威胁评分，多信号关联分析。聚合 DLP、Tool Guard、Prompt Injection 检测事件，为每个会话生成统一威胁分数。
+
+- **链式检测** — 检测多步攻击模式（如凭证访问后跟网络外泄）
+- **污点追踪** — 跟踪敏感数据指纹在工具调用间的流动，检测数据流违规
+- **威胁等级** — normal / elevated / high / critical，指数衰减评分
+- **3 条内置链式规则** — 凭证→外泄、执行→破坏、凭证→发布
+
 ### Audit Logger
 存储请求/响应内容（静态加密）以供在 Dashboard 中查看。可配置保留期限，自动清理。即使此 plugin 未启用，DLP 命中也会自动记录审计日志。
 
@@ -443,6 +451,20 @@ BASTION_LOG_LEVEL=debug bastion start
 | `GET` | `/api/config` | Current configuration + plugin status |
 | `PUT` | `/api/config` | Update configuration at runtime |
 
+## 可选插件
+
+Bastion 核心检测能力完全免费。如需基于 ML 的检测（ONNX Runtime，~436 MB 模型），可安装可选插件包：
+
+```bash
+bastion plugins install          # 自动检测同级 bastion-plugin-api 目录
+bastion plugins list             # 查看已安装插件
+bastion plugins uninstall        # 卸载（会提示是否同时删除模型文件）
+```
+
+也可通过 Dashboard → Settings → Optional Features 管理。
+
+详见 [@aiwatching/bastion-pro](https://github.com/aiwatching/bastion-plugin-api)。
+
 ## 文档
 
 - [DLP 引擎架构](docs/dlp.zh.md) — 5 层检测管线详解
@@ -468,4 +490,5 @@ BASTION_LOG_LEVEL=debug bastion start
   .key          # AES encryption key for cache & audit
   bastion.pid   # Daemon PID file
   bastion.log   # Daemon log file
+  models/       # ML 模型（可选，安装插件后 ~436 MB）
 ```

package/dist/classifier/model-manager.d.ts

@@ -0,0 +1,43 @@
+export interface ModelInfo {
+    modelId: string;
+    dir: string;
+    ready: boolean;
+    files: string[];
+}
+export interface DownloadProgress {
+    file: string;
+    received: number;
+    total: number;
+    percent: number;
+}
+export type ProgressCallback = (progress: DownloadProgress) => void;
+/**
+ * Resolve the local directory for a given model ID.
+ * Model IDs use '/' which gets replaced with '--' for filesystem safety.
+ */
+export declare function getModelDir(modelId: string): string;
+/**
+ * Check if a model is already downloaded and complete.
+ */
+export declare function isModelReady(modelId: string): Promise<boolean>;
+/**
+ * Get info about a local model.
+ */
+export declare function getModelInfo(modelId: string): Promise<ModelInfo>;
+/**
+ * Download model files from Hugging Face Hub.
+ * Files: model.onnx (from onnx/ subdirectory), tokenizer.json, config.json
+ */
+export declare function downloadModel(modelId: string, onProgress?: ProgressCallback, options?: {
+    onnxSubdir?: string;
+}): Promise<string>;
+/**
+ * Ensure a model is available locally. Downloads if missing.
+ */
+export declare function ensureModel(modelId: string, onProgress?: ProgressCallback, options?: {
+    onnxSubdir?: string;
+    logger?: {
+        info: (msg: string, meta?: Record<string, unknown>) => void;
+    };
+}): Promise<string>;
+//# sourceMappingURL=model-manager.d.ts.map

package/dist/classifier/model-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-manager.d.ts","sourceRoot":"","sources":["../../src/classifier/model-manager.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAEpE;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWpE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAiBtE;AAoFD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CA8BjB;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC1G,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/dist/classifier/model-manager.js

@@ -0,0 +1,161 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getModelDir = getModelDir;
+exports.isModelReady = isModelReady;
+exports.getModelInfo = getModelInfo;
+exports.downloadModel = downloadModel;
+exports.ensureModel = ensureModel;
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+const promises_1 = require("node:fs/promises");
+const node_https_1 = __importDefault(require("node:https"));
+const MODELS_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), '.bastion', 'models');
+const REQUIRED_FILES = ['model.onnx', 'tokenizer.json', 'config.json'];
+/**
+ * Resolve the local directory for a given model ID.
+ * Model IDs use '/' which gets replaced with '--' for filesystem safety.
+ */
+function getModelDir(modelId) {
+    const safeName = modelId.replace(/\//g, '--');
+    return (0, node_path_1.join)(MODELS_DIR, safeName);
+}
+/**
+ * Check if a model is already downloaded and complete.
+ */
+async function isModelReady(modelId) {
+    const dir = getModelDir(modelId);
+    for (const file of REQUIRED_FILES) {
+        try {
+            const s = await (0, promises_1.stat)((0, node_path_1.join)(dir, file));
+            if (s.size === 0)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Get info about a local model.
+ */
+async function getModelInfo(modelId) {
+    const dir = getModelDir(modelId);
+    const files = [];
+    for (const file of REQUIRED_FILES) {
+        try {
+            await (0, promises_1.stat)((0, node_path_1.join)(dir, file));
+            files.push(file);
+        }
+        catch {
+            // file missing
+        }
+    }
+    return {
+        modelId,
+        dir,
+        ready: files.length === REQUIRED_FILES.length,
+        files,
+    };
+}
+/**
+ * Download a single file from Hugging Face Hub.
+ */
+function getHfToken() {
+    return process.env['HF_TOKEN'] ?? process.env['HUGGING_FACE_HUB_TOKEN'];
+}
+function downloadFile(url, destPath, onProgress, fileName) {
+    return new Promise((resolve, reject) => {
+        const request = (targetUrl) => {
+            const headers = { 'User-Agent': 'bastion-pro/0.1.0' };
+            const hfToken = getHfToken();
+            if (hfToken && targetUrl.includes('huggingface.co')) {
+                headers['Authorization'] = `Bearer ${hfToken}`;
+            }
+            node_https_1.default.get(targetUrl, { headers }, (res) => {
+                // Follow redirects (HF Hub returns 302 to CDN)
+                if (res.statusCode && res.statusCode >= 301 && res.statusCode <= 308 && res.statusCode !== 304) {
+                    let location = res.headers.location;
+                    if (!location)
+                        return reject(new Error(`Redirect without location for ${url}`));
+                    // Handle relative redirects — resolve against current URL
+                    if (location.startsWith('/')) {
+                        const base = new URL(targetUrl);
+                        location = `${base.protocol}//${base.host}${location}`;
+                    }
+                    res.resume();
+                    request(location);
+                    return;
+                }
+                if (res.statusCode !== 200) {
+                    res.resume();
+                    return reject(new Error(`HTTP ${res.statusCode} downloading ${url}`));
+                }
+                const total = parseInt(res.headers['content-length'] ?? '0', 10);
+                let received = 0;
+                const chunks = [];
+                res.on('data', (chunk) => {
+                    chunks.push(chunk);
+                    received += chunk.length;
+                    if (onProgress) {
+                        onProgress({
+                            file: fileName ?? destPath,
+                            received,
+                            total,
+                            percent: total > 0 ? Math.round((received / total) * 100) : 0,
+                        });
+                    }
+                });
+                res.on('end', async () => {
+                    try {
+                        await (0, promises_1.writeFile)(destPath, Buffer.concat(chunks));
+                        resolve();
+                    }
+                    catch (err) {
+                        reject(err);
+                    }
+                });
+                res.on('error', reject);
+            }).on('error', reject);
+        };
+        request(url);
+    });
+}
+/**
+ * Build a Hugging Face Hub download URL for a file in a model repo.
+ * Format: https://huggingface.co/{model_id}/resolve/main/{filename}
+ */
+function hfFileUrl(modelId, filename) {
+    return `https://huggingface.co/${modelId}/resolve/main/${filename}`;
+}
+/**
+ * Download model files from Hugging Face Hub.
+ * Files: model.onnx (from onnx/ subdirectory), tokenizer.json, config.json
+ */
+async function downloadModel(modelId, onProgress, options) {
+    const dir = getModelDir(modelId);
+    await (0, promises_1.mkdir)(dir, { recursive: true });
+    const onnxSubdir = options?.onnxSubdir ?? 'onnx';
+    // Download config.json and tokenizer.json from repo root
+    await downloadFile(hfFileUrl(modelId, 'config.json'), (0, node_path_1.join)(dir, 'config.json'), onProgress, 'config.json');
+    await downloadFile(hfFileUrl(modelId, 'tokenizer.json'), (0, node_path_1.join)(dir, 'tokenizer.json'), onProgress, 'tokenizer.json');
+    // Download model.onnx from onnx subdirectory
+    await downloadFile(hfFileUrl(modelId, `${onnxSubdir}/model.onnx`), (0, node_path_1.join)(dir, 'model.onnx'), onProgress, 'model.onnx');
+    return dir;
+}
+/**
+ * Ensure a model is available locally. Downloads if missing.
+ */
+async function ensureModel(modelId, onProgress, options) {
+    if (await isModelReady(modelId)) {
+        const dir = getModelDir(modelId);
+        options?.logger?.info('Model already downloaded, skipping', { modelId, dir });
+        return dir;
+    }
+    options?.logger?.info('Model not found locally, downloading...', { modelId });
+    return downloadModel(modelId, onProgress, { onnxSubdir: options?.onnxSubdir });
+}
+//# sourceMappingURL=model-manager.js.map

package/dist/classifier/model-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-manager.js","sourceRoot":"","sources":["../../src/classifier/model-manager.ts"],"names":[],"mappings":";;;;;AA6BA,kCAGC;AAKD,oCAWC;AAKD,oCAiBC;AAwFD,sCAkCC;AAKD,kCAYC;AAjND,yCAAiC;AACjC,qCAAkC;AAClC,+CAA0D;AAC1D,4DAA+B;AAE/B,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAEzD,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;AAkBvE;;;GAGG;AACH,SAAgB,WAAW,CAAC,OAAe;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,OAAO,IAAA,gBAAI,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAA,eAAI,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAA,eAAI,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO;QACP,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAC7C,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,YAAY,CACnB,GAAW,EACX,QAAgB,EAChB,UAA6B,EAC7B,QAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAE;YACpC,MAAM,OAAO,GAA2B,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;YAC9E,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,IAAI,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpD,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,OAAO,EAAE,CAAC;YACjD,CAAC;YACD,oBAAK,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxC,+CAA+C;gBAC/C,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC/F,IAAI,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACpC,IAAI,CAAC,QAAQ;wBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC,CAAC;oBAChF,0DAA0D;oBAC1D,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;wBAChC,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;oBACzD,CAAC;oBACD,GAAG,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO,CAAC,QAAQ,CAAC,CAAC;oBAClB,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,GAAG,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,UAAU,gBAAgB,GAAG,EAAE,CAAC,CAAC,CAAC;gBACxE,CAAC;gBAED,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;gBACjE,IAAI,QAAQ,GAAG,CAAC,CAAC;gBACjB,MAAM,MAAM,GAAa,EAAE,CAAC;gBAE5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnB,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;oBACzB,IAAI,UAAU,EAAE,CAAC;wBACf,UAAU,CAAC;4BACT,IAAI,EAAE,QAAQ,IAAI,QAAQ;4BAC1B,QAAQ;4BACR,KAAK;4BACL,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;yBAC9D,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;oBACvB,IAAI,CAAC;wBACH,MAAM,IAAA,oBAAS,EAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;wBACjD,OAAO,EAAE,CAAC;oBACZ,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,GAAG,CAAC,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,QAAgB;IAClD,OAAO,0BAA0B,OAAO,iBAAiB,QAAQ,EAAE,CAAC;AACtE,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,UAA6B,EAC7B,OAAiC;IAEjC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,IAAA,gBAAK,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtC,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC;IAEjD,yDAAyD;IACzD,MAAM,YAAY,CAChB,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,EACjC,IAAA,gBAAI,EAAC,GAAG,EAAE,aAAa,CAAC,EACxB,UAAU,EACV,aAAa,CACd,CAAC;IAEF,MAAM,YAAY,CAChB,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,EACpC,IAAA,gBAAI,EAAC,GAAG,EAAE,gBAAgB,CAAC,EAC3B,UAAU,EACV,gBAAgB,CACjB,CAAC;IAEF,6CAA6C;IAC7C,MAAM,YAAY,CAChB,SAAS,CAAC,OAAO,EAAE,GAAG,UAAU,aAAa,CAAC,EAC9C,IAAA,gBAAI,EAAC,GAAG,EAAE,YAAY,CAAC,EACvB,UAAU,EACV,YAAY,CACb,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,UAA6B,EAC7B,OAA2G;IAE3G,IAAI,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,yCAAyC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9E,OAAO,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AACjF,CAAC"}

package/dist/classifier/onnx-provider.d.ts

@@ -0,0 +1,22 @@
+import type { ClassifierProvider, ClassificationResult } from '../plugin-api/types.js';
+export interface OnnxProviderConfig {
+    modelDir: string;
+    maxLength?: number;
+}
+export declare class OnnxClassifierProvider implements ClassifierProvider {
+    readonly name = "onnx";
+    private config;
+    private maxLength;
+    private session;
+    private tokenizer;
+    private labels;
+    private _modelName;
+    constructor(config: OnnxProviderConfig);
+    get modelName(): string;
+    get ready(): boolean;
+    initialize(): Promise<void>;
+    classify(text: string): Promise<ClassificationResult>;
+    classifyBatch(texts: string[]): Promise<ClassificationResult[]>;
+    destroy(): Promise<void>;
+}
+//# sourceMappingURL=onnx-provider.d.ts.map

package/dist/classifier/onnx-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onnx-provider.d.ts","sourceRoot":"","sources":["../../src/classifier/onnx-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAaD,qBAAa,sBAAuB,YAAW,kBAAkB;IAC/D,QAAQ,CAAC,IAAI,UAAU;IACvB,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,OAAO,CAA4D;IAC3E,OAAO,CAAC,SAAS,CAA4D;IAC7E,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAAM;gBAEZ,MAAM,EAAE,kBAAkB;IAKtC,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,KAAK,IAAI,OAAO,CAEnB;IAEK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA0C3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA6DrD,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAK/D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAO/B"}

package/dist/classifier/onnx-provider.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OnnxClassifierProvider = void 0;
+// Lazy-loaded native dependencies (only imported when initialize() is called)
+let ort = null;
+let TokenizerModule = null;
+function softmax(logits) {
+    const max = logits.reduce((a, b) => Math.max(a, b), -Infinity);
+    const exps = logits.map(v => Math.exp(v - max));
+    const sum = exps.reduce((a, b) => a + b, 0);
+    return exps.map(v => v / sum);
+}
+class OnnxClassifierProvider {
+    name = 'onnx';
+    config;
+    maxLength;
+    session = null;
+    tokenizer = null;
+    labels = [];
+    _modelName = '';
+    constructor(config) {
+        this.config = config;
+        this.maxLength = config.maxLength ?? 512;
+    }
+    get modelName() {
+        return this._modelName;
+    }
+    get ready() {
+        return this.session !== null && this.tokenizer !== null;
+    }
+    async initialize() {
+        const { join } = await import('node:path');
+        const { readFile } = await import('node:fs/promises');
+        // Lazy-load native modules
+        if (!ort)
+            ort = await import('onnxruntime-node');
+        if (!TokenizerModule)
+            TokenizerModule = await import('@huggingface/tokenizers');
+        const modelPath = join(this.config.modelDir, 'model.onnx');
+        const tokenizerPath = join(this.config.modelDir, 'tokenizer.json');
+        const configPath = join(this.config.modelDir, 'config.json');
+        // Load model config for label mapping
+        let modelConfig = {};
+        try {
+            const configRaw = await readFile(configPath, 'utf-8');
+            modelConfig = JSON.parse(configRaw);
+            if (modelConfig.id2label) {
+                const id2label = modelConfig.id2label;
+                const maxId = Math.max(...Object.keys(id2label).map(Number));
+                this.labels = new Array(maxId + 1);
+                for (const [id, label] of Object.entries(id2label)) {
+                    this.labels[Number(id)] = label;
+                }
+            }
+            this._modelName = (modelConfig._name_or_path ?? modelConfig.model_type ?? 'unknown');
+        }
+        catch {
+            this.labels = ['SAFE', 'INJECTION'];
+            this._modelName = 'unknown';
+        }
+        // Load tokenizer — @huggingface/tokenizers v0.1.x uses new Tokenizer(tokenizerJson, configJson)
+        const tokenizerRaw = await readFile(tokenizerPath, 'utf-8');
+        const tokenizerJson = JSON.parse(tokenizerRaw);
+        this.tokenizer = new TokenizerModule.Tokenizer(tokenizerJson, modelConfig);
+        // Create ONNX inference session
+        this.session = await ort.InferenceSession.create(modelPath, {
+            executionProviders: ['cpu'],
+        });
+    }
+    async classify(text) {
+        if (!this.session || !this.tokenizer) {
+            throw new Error('OnnxClassifierProvider not initialized — call initialize() first');
+        }
+        const start = performance.now();
+        // Tokenize — @huggingface/tokenizers v0.1.x returns plain object { ids, attention_mask }
+        const encoded = this.tokenizer.encode(text);
+        const inputIds = encoded.ids;
+        const attentionMask = encoded.attention_mask;
+        // Truncate to maxLength
+        const length = Math.min(inputIds.length, this.maxLength);
+        const ids = BigInt64Array.from(inputIds.slice(0, length).map((v) => BigInt(v)));
+        const mask = BigInt64Array.from(attentionMask.slice(0, length).map((v) => BigInt(v)));
+        // Create tensors
+        const inputIdsTensor = new ort.Tensor('int64', ids, [1, length]);
+        const attentionMaskTensor = new ort.Tensor('int64', mask, [1, length]);
+        // Run inference
+        const feeds = {
+            input_ids: inputIdsTensor,
+            attention_mask: attentionMaskTensor,
+        };
+        const output = await this.session.run(feeds);
+        // Get logits from first output
+        const outputName = this.session.outputNames[0];
+        const logits = output[outputName].data;
+        // Apply softmax
+        const probs = softmax(logits);
+        // Build label scores
+        const labels = [];
+        let bestIdx = 0;
+        let bestScore = 0;
+        for (let i = 0; i < probs.length; i++) {
+            const label = this.labels[i] ?? `CLASS_${i}`;
+            const score = probs[i];
+            labels.push({ label, score });
+            if (score > bestScore) {
+                bestScore = score;
+                bestIdx = i;
+            }
+        }
+        const latencyMs = Math.round(performance.now() - start);
+        return {
+            label: this.labels[bestIdx] ?? `CLASS_${bestIdx}`,
+            score: bestScore,
+            labels,
+            latencyMs,
+        };
+    }
+    async classifyBatch(texts) {
+        // Simple sequential batch — ONNX batch inference requires padding and is more complex
+        return Promise.all(texts.map(text => this.classify(text)));
+    }
+    async destroy() {
+        if (this.session) {
+            await this.session.release();
+            this.session = null;
+        }
+        this.tokenizer = null;
+    }
+}
+exports.OnnxClassifierProvider = OnnxClassifierProvider;
+//# sourceMappingURL=onnx-provider.js.map

package/dist/classifier/onnx-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onnx-provider.js","sourceRoot":"","sources":["../../src/classifier/onnx-provider.ts"],"names":[],"mappings":";;;AAOA,8EAA8E;AAC9E,IAAI,GAAG,GAA6C,IAAI,CAAC;AACzD,IAAI,eAAe,GAAoD,IAAI,CAAC;AAE5E,SAAS,OAAO,CAAC,MAAoB;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAA4B,CAAC;AAC3D,CAAC;AAED,MAAa,sBAAsB;IACxB,IAAI,GAAG,MAAM,CAAC;IACf,MAAM,CAAqB;IAC3B,SAAS,CAAS;IAClB,OAAO,GAAuD,IAAI,CAAC;IACnE,SAAS,GAAuD,IAAI,CAAC;IACrE,MAAM,GAAa,EAAE,CAAC;IACtB,UAAU,GAAG,EAAE,CAAC;IAExB,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC;IAC3C,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAEtD,2BAA2B;QAC3B,IAAI,CAAC,GAAG;YAAE,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACjD,IAAI,CAAC,eAAe;YAAE,eAAe,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAEhF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAE7D,sCAAsC;QACtC,IAAI,WAAW,GAA4B,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACtD,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAkC,CAAC;gBAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7D,IAAI,CAAC,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACnC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,UAAU,GAAG,CAAC,WAAW,CAAC,aAAa,IAAI,WAAW,CAAC,UAAU,IAAI,SAAS,CAAW,CAAC;QACjG,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACpC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC;QAED,gGAAgG;QAChG,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAE3E,gCAAgC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE;YAC1D,kBAAkB,EAAE,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEhC,yFAAyF;QACzF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAgD,CAAC;QAC3F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;QAC7B,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;QAE7C,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9F,iBAAiB;QACjB,MAAM,cAAc,GAAG,IAAI,GAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,mBAAmB,GAAG,IAAI,GAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAExE,gBAAgB;QAChB,MAAM,KAAK,GAAsD;YAC/D,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,mBAAmB;SACpC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAE7C,+BAA+B;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,IAAoB,CAAC;QAEvD,gBAAgB;QAChB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAE9B,qBAAqB;QACrB,MAAM,MAAM,GAA4C,EAAE,CAAC;QAC3D,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9B,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;gBACtB,SAAS,GAAG,KAAK,CAAC;gBAClB,OAAO,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAExD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,OAAO,EAAE;YACjD,KAAK,EAAE,SAAS;YAChB,MAAM;YACN,SAAS;SACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAe;QACjC,sFAAsF;QACtF,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;CACF;AAzID,wDAyIC"}

package/dist/cli/commands/plugins.d.ts

@@ -0,0 +1,3 @@
+import { type Command } from 'commander';
+export declare function registerPluginsCommand(program: Command): void;
+//# sourceMappingURL=plugins.d.ts.map

package/dist/cli/commands/plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/plugins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AA0DzC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0J7D"}