@cello-protocol/gateway 0.0.41 → 0.0.43
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bin/cello-gateway.js +24 -2
- package/dist/bin/cello-gateway.js.map +1 -1
- package/dist/detect/injection-classifier-onnx.d.ts +14 -0
- package/dist/detect/injection-classifier-onnx.d.ts.map +1 -0
- package/dist/detect/injection-classifier-onnx.js +110 -0
- package/dist/detect/injection-classifier-onnx.js.map +1 -0
- package/dist/detect/injection-scanner.d.ts.map +1 -1
- package/dist/detect/injection-scanner.js +15 -1
- package/dist/detect/injection-scanner.js.map +1 -1
- package/dist/detect/model-installer.d.ts +11 -0
- package/dist/detect/model-installer.d.ts.map +1 -1
- package/dist/detect/model-installer.js +11 -0
- package/dist/detect/model-installer.js.map +1 -1
- package/dist/detect/sanitize.d.ts +25 -0
- package/dist/detect/sanitize.d.ts.map +1 -1
- package/dist/detect/sanitize.js +31 -2
- package/dist/detect/sanitize.js.map +1 -1
- package/dist/index.d.ts +4 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +5 -1
- package/dist/index.js.map +1 -1
- package/dist/screen/inbound.d.ts +7 -0
- package/dist/screen/inbound.d.ts.map +1 -1
- package/dist/screen/inbound.js +8 -1
- package/dist/screen/inbound.js.map +1 -1
- package/dist/spawn.d.ts +9 -0
- package/dist/spawn.d.ts.map +1 -1
- package/dist/spawn.js +9 -1
- package/dist/spawn.js.map +1 -1
- package/package.json +1 -1
|
@@ -21,6 +21,10 @@ import { GatewayConfigStore } from "../config/config-store.js";
|
|
|
21
21
|
import { stderrStoreEventSink } from "../store/encrypted-db.js";
|
|
22
22
|
import { GatewayRecordStore } from "../records/record-store.js";
|
|
23
23
|
import { createHash } from "node:crypto";
|
|
24
|
+
import { join } from "node:path";
|
|
25
|
+
import { homedir } from "node:os";
|
|
26
|
+
import { InjectionScanner } from "../detect/injection-scanner.js";
|
|
27
|
+
import { loadInjectionClassifier } from "../detect/injection-classifier-onnx.js";
|
|
24
28
|
/**
|
|
25
29
|
* Fold the WAL into the main database without CLOSING the connection.
|
|
26
30
|
*
|
|
@@ -105,7 +109,25 @@ async function main() {
|
|
|
105
109
|
? { maxPerWindow: rateMax, windowMs: rateWindowMs }
|
|
106
110
|
: undefined;
|
|
107
111
|
const outbound = new OutboundScreener({ piiWhitelist, autonomousOverride, ...(rateLimit ? { rateLimit } : {}) });
|
|
108
|
-
|
|
112
|
+
// DOD-DOC-SCREEN-CLASSIFIER-1 — Layer 2, wired at last.
|
|
113
|
+
//
|
|
114
|
+
// This line was `new InboundScreener()` with no arguments, so the scanner fell back to its null
|
|
115
|
+
// classifier, reported itself unavailable, and the semantic check short-circuited on every
|
|
116
|
+
// inbound frame in every shipped build — while the gateway announced mode `enforcing`. Layer 1
|
|
117
|
+
// (the deterministic sanitizer) and Layer 3 (the pattern matcher) were live throughout; the layer
|
|
118
|
+
// that judges MEANING was not, and nothing said so.
|
|
119
|
+
//
|
|
120
|
+
// The state is ANNOUNCED either way, on stderr, at startup. "Is semantic screening on?" must be
|
|
121
|
+
// answerable by reading a log line rather than by reading this file — that is the whole reason
|
|
122
|
+
// the gap survived as long as it did.
|
|
123
|
+
const modelDir = process.env["CELLO_GATEWAY_MODEL_DIR"] || join(homedir(), ".cello", "gateway-model");
|
|
124
|
+
const load = await loadInjectionClassifier(modelDir);
|
|
125
|
+
// ON STDOUT, and specifically on the line the PARENT reads. Written to stderr this was drained
|
|
126
|
+
// into an in-memory tail that the spawner only ever surfaces when the spawn FAILS — so on a
|
|
127
|
+
// successful boot the answer to "is semantic screening on?" was captured and thrown away. That is
|
|
128
|
+
// the exact shape of the defect this whole unit exists to fix: a state nothing can report.
|
|
129
|
+
const layer2 = load.classifier ? "active" : `off:${load.reason ?? "unknown"}`;
|
|
130
|
+
const inbound = new InboundScreener(load.classifier ? { injectionScanner: new InjectionScanner(load.classifier) } : {});
|
|
109
131
|
// M9-REC-001 (INV-4): the gateway records what it did to EVERY message, hash-chained for
|
|
110
132
|
// tamper-evidence, in the same encrypted store as the config (M9B-D9). The verdict's disposition
|
|
111
133
|
// maps to the record: allow → clean (a clean pass IS recorded — an absent record is itself
|
|
@@ -199,7 +221,7 @@ async function main() {
|
|
|
199
221
|
// was false — the id reached `applied` and stopped there.
|
|
200
222
|
process.stderr.write(`${JSON.stringify({ level: "info", event: "gateway.boot", correlationId: bootCorrelationId, socketPath })}\n`);
|
|
201
223
|
}
|
|
202
|
-
process.stdout.write(`${GATEWAY_READY_TOKEN} ${socketPath} regex-engine=${engine}\n`);
|
|
224
|
+
process.stdout.write(`${GATEWAY_READY_TOKEN} ${socketPath} regex-engine=${engine} layer2=${layer2.replace(/\s+/g, " ")}\n`);
|
|
203
225
|
let stopping = false;
|
|
204
226
|
const shutdown = (signal) => {
|
|
205
227
|
if (stopping)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cello-gateway.js","sourceRoot":"","sources":["../../src/bin/cello-gateway.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAA0B,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"cello-gateway.js","sourceRoot":"","sources":["../../src/bin/cello-gateway.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAA0B,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAGjF;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAG,MAAsD;IAChF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC;YAAC,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC;QAAC,CAAC;QAC1B,OAAO,GAAG,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IAClI,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,gGAAgG;IAChG,6FAA6F;IAC7F,6DAA6D;IAC7D,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,wBAAwB,EAAE,CAAC;IAC3B,kBAAkB,EAAE,CAAC;IAErB,4FAA4F;IAC5F,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,wFAAwF;IACxF,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,4DAA4D;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,SAAS,CAAC;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,SAAS,CAAC;IAC9E,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE,CAAC;QACjE,0FAA0F;QAC1F,uEAAuE;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+FAA+F,CAAC,CAAC;QACtH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,iGAAiG;IACjG,uFAAuF;IACvF,EAAE;IACF,4EAA4E;IAC5E,kGAAkG;IAClG,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,2CAA2C;IAC3C,EAAE;IACF,kGAAkG;IAClG,mFAAmF;IACnF,MAAM,MAAM,GAAG,WAAW,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjI,MAAM,GAAG,GAAG,CAAI,GAAW,EAAE,eAAkB,EAAK,EAAE;QACpD,MAAM,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAE,CAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACtD,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,CAAW,eAAe,EAAE,EAAE,CAAC,CAAC;IACxD,oGAAoG;IACpG,sFAAsF;IACtF,MAAM,kBAAkB,GAAG,GAAG,CAAU,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACtE,uGAAuG;IACvG,qGAAqG;IACrG,sGAAsG;IACtG,gEAAgE;IAChE,MAAM,sBAAsB,GAAG,MAAM,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAS,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACtG,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QACvD,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjH,wDAAwD;IACxD,EAAE;IACF,gGAAgG;IAChG,2FAA2F;IAC3F,+FAA+F;IAC/F,kGAAkG;IAClG,oDAAoD;IACpD,EAAE;IACF,gGAAgG;IAChG,+FAA+F;IAC/F,sCAAsC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACrD,+FAA+F;IAC/F,4FAA4F;IAC5F,kGAAkG;IAClG,2FAA2F;IAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,eAAe,CACjC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CACnF,CAAC;IAEF,yFAAyF;IACzF,iGAAiG;IACjG,2FAA2F;IAC3F,wDAAwD;IACxD,MAAM,OAAO,GAAG,WAAW,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClI,MAAM,aAAa,GAAG,CAAC,SAAiC,EAAE,CAAgB,EAAE,OAAmB,EAAE,aAAsB,EAAQ,EAAE;QAC/H,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,WAAW,GAAsB,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3F,gGAAgG;QAChG,oGAAoG;QACpG,iGAAiG;QACjG,MAAM,MAAM,GAAG,WAAW,KAAK,OAAO;YACpC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QAC5G,OAAO,CAAC,MAAM,CAAC;YACb,SAAS;YACT,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,6DAA6D;SACzH,CAAC,CAAC;IACL,CAAC,CAAC;IACF,0GAA0G;IAC1G,MAAM,uBAAuB,GAAG,CAAC,SAAiC,EAAE,CAAgB,EAAE,OAAmB,EAAE,aAAsB,EAAQ,EAAE;QACzI,IAAI,CAAC;YAAC,aAAa,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QAAC,CAAC;QAC5D,OAAO,GAAG,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACpJ,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,UAAU;QACV,MAAM,EAAE,KAAK,EAAE,GAAG,EAA0B,EAAE;YAC5C,6FAA6F;YAC7F,kGAAkG;YAClG,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE;wBACrC,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,GAAG,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnG,CAAC,CAAC;oBACH,MAAM,OAAO,GAAkB;wBAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvD,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9D,CAAC;oBACF,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;oBACnE,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,6FAA6F;gBAC7F,+FAA+F;gBAC/F,oGAAoG;gBACpG,MAAM,OAAO,GAAkB;oBAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC;gBACF,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,+FAA+F;gBAC/F,gGAAgG;gBAChG,2EAA2E;gBAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,GAAG,CAAC,SAAS,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9H,MAAM,OAAO,GAAkB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,cAAc;oBACtB,QAAQ,EAAE,2EAA2E;wBACnF,wDAAwD;iBAC3D,CAAC;gBACF,uBAAuB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAChF,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACnE,IAAI,iBAAiB,EAAE,CAAC;QACtB,8FAA8F;QAC9F,6FAA6F;QAC7F,0DAA0D;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IACtI,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,mBAAmB,IAAI,UAAU,iBAAiB,MAAM,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAE5H,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YAC3B,wBAAwB;YACxB,EAAE;YACF,0FAA0F;YAC1F,6FAA6F;YAC7F,6FAA6F;YAC7F,4FAA4F;YAC5F,mEAAmE;YACnE,EAAE;YACF,qFAAqF;YACrF,4FAA4F;YAC5F,6FAA6F;YAC7F,4FAA4F;YAC5F,2FAA2F;YAC3F,uDAAuD;YACvD,EAAE;YACF,4EAA4E;YAC5E,EAAE;YACF,0FAA0F;YAC1F,0FAA0F;YAC1F,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,KAAK,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/C,+FAA+F;IAC/F,gGAAgG;IAChG,0FAA0F;IAC1F,+FAA+F;IAC/F,iDAAiD;IACjD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,4FAA4F;IAC5F,4FAA4F;IAC5F,kDAAkD;IAClD,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAC;IACrD,MAAM,QAAQ,GAAI,GAAoC,EAAE,QAAQ,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,CAAC;IACrF,IAAI,QAAQ;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
import type { InjectionClassifier } from "./injection-scanner.js";
|
|
2
|
+
export interface ClassifierLoad {
|
|
3
|
+
classifier: InjectionClassifier | null;
|
|
4
|
+
/** Why Layer 2 is off, when it is. Always set when `classifier` is null — never a silent null. */
|
|
5
|
+
reason?: string;
|
|
6
|
+
}
|
|
7
|
+
/**
|
|
8
|
+
* Build the classifier, or say why not.
|
|
9
|
+
*
|
|
10
|
+
* @param modelDir where `installModel` put the weights.
|
|
11
|
+
* @param importImpl injectable for tests — production passes nothing and gets the real import.
|
|
12
|
+
*/
|
|
13
|
+
export declare function loadInjectionClassifier(modelDir: string, importImpl?: (specifier: string) => Promise<unknown>): Promise<ClassifierLoad>;
|
|
14
|
+
//# sourceMappingURL=injection-classifier-onnx.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"injection-classifier-onnx.d.ts","sourceRoot":"","sources":["../../src/detect/injection-classifier-onnx.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAKlE,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACvC,kGAAkG;IAClG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACnD,OAAO,CAAC,cAAc,CAAC,CAyEzB"}
|
|
@@ -0,0 +1,110 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* DOD-DOC-SCREEN-CLASSIFIER-1 — the production classifier, and the reason it loads lazily.
|
|
3
|
+
*
|
|
4
|
+
* `InjectionScanner` has always taken an `InjectionClassifier` and has always been unit-tested with
|
|
5
|
+
* a fake one. What never existed was an implementation backed by the real model, and — more to the
|
|
6
|
+
* point — nothing ever CONSTRUCTED one: the gateway built `new InboundScreener()` with no
|
|
7
|
+
* arguments, so the scanner fell back to its null classifier, reported itself unavailable, and the
|
|
8
|
+
* call site short-circuited. Layer 2 was off in every shipped build, for messages and documents
|
|
9
|
+
* alike, while the gateway announced mode `enforcing`.
|
|
10
|
+
*
|
|
11
|
+
* ── WHY THE RUNTIME IS AN OPTIONAL, LAZY IMPORT ───────────────────────────────────────────────
|
|
12
|
+
*
|
|
13
|
+
* The weights are already opt-in: ~568 MB, downloaded once, only on explicit operator consent. A
|
|
14
|
+
* runtime that every operator installs to support a model most of them have not downloaded is the
|
|
15
|
+
* same cost in a place they cannot decline it — and install size is a user-facing cost here, not an
|
|
16
|
+
* abstract metric, because cello-mcp is a local node that operators reinstall on every version bump.
|
|
17
|
+
*
|
|
18
|
+
* So the ONNX runtime is imported dynamically, inside a try, and its absence is a NAMED, LOGGED
|
|
19
|
+
* degradation rather than a crash. That mirrors what the installer already promises: "the gateway
|
|
20
|
+
* never fails closed on a missing OPTIONAL model."
|
|
21
|
+
*
|
|
22
|
+
* ── WHAT THIS DELIBERATELY DOES NOT DO ────────────────────────────────────────────────────────
|
|
23
|
+
*
|
|
24
|
+
* It does not silently decide the answer. Every path returns either a working classifier or `null`
|
|
25
|
+
* WITH a reason the caller logs. A classifier that quietly scored everything 0 would be worse than
|
|
26
|
+
* no classifier at all: the gateway would report Layer 2 available and block nothing.
|
|
27
|
+
*/
|
|
28
|
+
import { join } from "node:path";
|
|
29
|
+
import { isModelInstalled } from "./model-installer.js";
|
|
30
|
+
/** The transformers.js entry point, resolved at runtime. Absent in a default install by design. */
|
|
31
|
+
const RUNTIME_MODULE = "@huggingface/transformers";
|
|
32
|
+
/**
|
|
33
|
+
* Build the classifier, or say why not.
|
|
34
|
+
*
|
|
35
|
+
* @param modelDir where `installModel` put the weights.
|
|
36
|
+
* @param importImpl injectable for tests — production passes nothing and gets the real import.
|
|
37
|
+
*/
|
|
38
|
+
export async function loadInjectionClassifier(modelDir, importImpl) {
|
|
39
|
+
if (!(await isModelInstalled(modelDir))) {
|
|
40
|
+
return {
|
|
41
|
+
classifier: null,
|
|
42
|
+
// NAMES WHAT EXISTS. Pointing at a command nobody built is the same defect this branch fixed in
|
|
43
|
+
// cello_doc_remove's tool description; the installer has no CLI caller yet, so say so.
|
|
44
|
+
reason: `no model at ${modelDir} — semantic injection screening is OFF. The weights are not fetched ` +
|
|
45
|
+
`by any command yet (DOD-DOC-SCREEN-CLASSIFIER-1 owes one); set CELLO_GATEWAY_MODEL_DIR to a ` +
|
|
46
|
+
`directory holding them to enable it`,
|
|
47
|
+
};
|
|
48
|
+
}
|
|
49
|
+
let mod;
|
|
50
|
+
try {
|
|
51
|
+
// Indirection through a variable: a bare dynamic import of a name that is not a dependency is
|
|
52
|
+
// resolved eagerly by some bundlers, which would turn an optional runtime into a hard one.
|
|
53
|
+
const doImport = importImpl ?? ((s) => import(/* @vite-ignore */ s));
|
|
54
|
+
mod = await doImport(RUNTIME_MODULE);
|
|
55
|
+
}
|
|
56
|
+
catch (err) {
|
|
57
|
+
return {
|
|
58
|
+
classifier: null,
|
|
59
|
+
reason: `the model is installed but its runtime (${RUNTIME_MODULE}) is not: ${err instanceof Error ? err.message : String(err)}`,
|
|
60
|
+
};
|
|
61
|
+
}
|
|
62
|
+
// THE GLOBAL SWITCH, not just the per-call option. "No network call during inference" (SI-001 /
|
|
63
|
+
// INV-1) rested entirely on `local_files_only` below — one option, on one call, in a library whose
|
|
64
|
+
// default is to fetch from the hub. `allowRemoteModels = false` is the library's own kill switch
|
|
65
|
+
// and it is what makes the property hold rather than a comment claiming it does.
|
|
66
|
+
const env = mod.env;
|
|
67
|
+
if (env && typeof env === "object") {
|
|
68
|
+
env["allowRemoteModels"] = false;
|
|
69
|
+
env["allowLocalModels"] = true;
|
|
70
|
+
}
|
|
71
|
+
const factory = mod.pipeline;
|
|
72
|
+
if (typeof factory !== "function") {
|
|
73
|
+
return { classifier: null, reason: `${RUNTIME_MODULE} exports no 'pipeline' — refusing to guess at its shape` };
|
|
74
|
+
}
|
|
75
|
+
let pipe;
|
|
76
|
+
try {
|
|
77
|
+
// LOCAL FILES ONLY. The scanner's contract is "no network call during inference" (SI-001 /
|
|
78
|
+
// INV-1); letting the runtime fall back to fetching from the hub would break it silently, and
|
|
79
|
+
// would also bypass the installer's integrity checks entirely.
|
|
80
|
+
pipe = await factory("text-classification", join(modelDir), { local_files_only: true });
|
|
81
|
+
}
|
|
82
|
+
catch (err) {
|
|
83
|
+
return {
|
|
84
|
+
classifier: null,
|
|
85
|
+
reason: `the model failed to load from ${modelDir}: ${err instanceof Error ? err.message : String(err)}`,
|
|
86
|
+
};
|
|
87
|
+
}
|
|
88
|
+
return {
|
|
89
|
+
classifier: {
|
|
90
|
+
async classify(text) {
|
|
91
|
+
// EVERY label, not the top one. `scoreToVerdict` is governed by P(injection), and asking
|
|
92
|
+
// for only the winner returns SAFE's score when the text is benign — which would read as a
|
|
93
|
+
// LOW injection probability for exactly the same reason it read as a high one. The scanner
|
|
94
|
+
// already documents that the score governs and a disagreeing label never overrides it;
|
|
95
|
+
// that only holds if the score handed to it is the injection score.
|
|
96
|
+
const scores = await pipe(text, { top_k: 0 });
|
|
97
|
+
const injection = scores.find((s) => s.label.toUpperCase() === "INJECTION");
|
|
98
|
+
if (injection)
|
|
99
|
+
return { injectionProbability: injection.score, label: injection.label };
|
|
100
|
+
const safe = scores.find((s) => s.label.toUpperCase() === "SAFE");
|
|
101
|
+
if (safe)
|
|
102
|
+
return { injectionProbability: 1 - safe.score, label: safe.label };
|
|
103
|
+
// A label set this build does not recognise. REFUSE TO SCORE rather than invent one: a
|
|
104
|
+
// fabricated 0 would report Layer 2 as working while blocking nothing.
|
|
105
|
+
throw new Error(`classifier returned no INJECTION or SAFE label (got: ${scores.map((s) => s.label).join(", ")})`);
|
|
106
|
+
},
|
|
107
|
+
},
|
|
108
|
+
};
|
|
109
|
+
}
|
|
110
|
+
//# sourceMappingURL=injection-classifier-onnx.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"injection-classifier-onnx.js","sourceRoot":"","sources":["../../src/detect/injection-classifier-onnx.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,mGAAmG;AACnG,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAiBnD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,UAAoD;IAEpD,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,gGAAgG;YAClG,uFAAuF;YACvF,MAAM,EACJ,eAAe,QAAQ,sEAAsE;gBAC7F,8FAA8F;gBAC9F,qCAAqC;SACtC,CAAC;IACJ,CAAC;IAED,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,2CAA2C,cAAc,aAAa,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACjI,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,mGAAmG;IACnG,iGAAiG;IACjG,iFAAiF;IACjF,MAAM,GAAG,GAAI,GAAyC,CAAC,GAAG,CAAC;IAC3D,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,GAAG,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC;QACjC,GAAG,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAI,GAAsC,CAAC,QAAQ,CAAC;IACjE,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,yDAAyD,EAAE,CAAC;IAClH,CAAC;IAED,IAAI,IAAU,CAAC;IACf,IAAI,CAAC;QACH,2FAA2F;QAC3F,8FAA8F;QAC9F,+DAA+D;QAC/D,IAAI,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,iCAAiC,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACzG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE;YACV,KAAK,CAAC,QAAQ,CAAC,IAAY;gBACzB,yFAAyF;gBACzF,2FAA2F;gBAC3F,2FAA2F;gBAC3F,uFAAuF;gBACvF,oEAAoE;gBACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,CAAC;gBAC5E,IAAI,SAAS;oBAAE,OAAO,EAAE,oBAAoB,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;gBACxF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;gBAClE,IAAI,IAAI;oBAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC7E,uFAAuF;gBACvF,uEAAuE;gBACvE,MAAM,IAAI,KAAK,CAAC,wDAAwD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpH,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"injection-scanner.d.ts","sourceRoot":"","sources":["../../src/detect/injection-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzD,uGAAuG;AACvG,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAI9D;AAED,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,UAAU;IACzB,yGAAyG;IACzG,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,gBAAgB;;IAG3B,sGAAsG;gBAC1F,UAAU,EAAE,mBAAmB,GAAG,IAAI;IAIlD,SAAS,IAAI,OAAO;IAId,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"injection-scanner.d.ts","sourceRoot":"","sources":["../../src/detect/injection-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzD,uGAAuG;AACvG,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAI9D;AAED,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,UAAU;IACzB,yGAAyG;IACzG,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,gBAAgB;;IAG3B,sGAAsG;gBAC1F,UAAU,EAAE,mBAAmB,GAAG,IAAI;IAIlD,SAAS,IAAI,OAAO;IAId,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAsB9C"}
|
|
@@ -36,7 +36,21 @@ export class InjectionScanner {
|
|
|
36
36
|
async scan(text) {
|
|
37
37
|
if (!this.#classifier)
|
|
38
38
|
return { available: false };
|
|
39
|
-
|
|
39
|
+
// A CLASSIFIER FAULT DEGRADES LAYER 2; it does not jam the path. The production classifier
|
|
40
|
+
// throws deliberately on a label set it does not recognise, and an uncaught throw here reaches
|
|
41
|
+
// the gateway's outer catch as `screen_error` — a block with no `terminal`, which the daemon
|
|
42
|
+
// reads as TRANSIENT and redelivers forever, on a condition that is permanent and identical on
|
|
43
|
+
// every retry. Unavailable-and-announced is the honest answer to a broken model.
|
|
44
|
+
let classified;
|
|
45
|
+
try {
|
|
46
|
+
classified = await this.#classifier.classify(text);
|
|
47
|
+
}
|
|
48
|
+
catch (err) {
|
|
49
|
+
process.stderr.write(`cello-gateway: semantic injection scan FAILED, Layer 2 degraded for this message: ` +
|
|
50
|
+
`${err instanceof Error ? err.message : String(err)}\n`);
|
|
51
|
+
return { available: false };
|
|
52
|
+
}
|
|
53
|
+
const { injectionProbability, label } = classified;
|
|
40
54
|
const score = Math.round(Math.max(0, Math.min(1, injectionProbability)) * 100);
|
|
41
55
|
// The score governs the verdict (AC-003): a model `label` of SAFE with a high score still blocks.
|
|
42
56
|
return { available: true, score, verdict: scoreToVerdict(score), label };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"injection-scanner.js","sourceRoot":"","sources":["../../src/detect/injection-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,uGAAuG;AACvG,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,KAAK,IAAI,eAAe;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,KAAK,IAAI,cAAc;QAAE,OAAO,MAAM,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAgBD,MAAM,OAAO,gBAAgB;IAClB,WAAW,CAA6B;IAEjD,sGAAsG;IACtG,YAAY,UAAsC;QAChD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;IAChC,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACnD,
|
|
1
|
+
{"version":3,"file":"injection-scanner.js","sourceRoot":"","sources":["../../src/detect/injection-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,uGAAuG;AACvG,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,KAAK,IAAI,eAAe;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,KAAK,IAAI,cAAc;QAAE,OAAO,MAAM,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAgBD,MAAM,OAAO,gBAAgB;IAClB,WAAW,CAA6B;IAEjD,sGAAsG;IACtG,YAAY,UAAsC;QAChD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;IAChC,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACnD,2FAA2F;QAC3F,+FAA+F;QAC/F,6FAA6F;QAC7F,+FAA+F;QAC/F,iFAAiF;QACjF,IAAI,UAA4D,CAAC;QACjE,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oFAAoF;gBACpF,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACxD,CAAC;YACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAC/E,kGAAkG;QAClG,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;IAC3E,CAAC;CACF"}
|
|
@@ -19,6 +19,17 @@ export interface InstallOptions {
|
|
|
19
19
|
dir: string;
|
|
20
20
|
/** The operator's explicit consent to download ~568 MB. Without it, nothing is fetched. */
|
|
21
21
|
consent: boolean;
|
|
22
|
+
/**
|
|
23
|
+
* DOD-DOC-SCREEN-CLASSIFIER-1. Every file in the manifest currently carries `sha256: null` — the
|
|
24
|
+
* digests were stripped by this environment's secret redaction and never restored out-of-band —
|
|
25
|
+
* so integrity rests on the committed SIZE and on the transport, and the manifest pins a moving
|
|
26
|
+
* `revision: "main"` rather than a commit. Installing 568 MB of executable model weights from a
|
|
27
|
+
* third-party mirror under those terms is a decision, so it must be TAKEN, not defaulted into.
|
|
28
|
+
*
|
|
29
|
+
* Defaults to refusing, which is the tightest value — the same posture the gateway's config store
|
|
30
|
+
* takes for every policy key. Set true only with that trade in view.
|
|
31
|
+
*/
|
|
32
|
+
allowUnpinnedDigests?: boolean;
|
|
22
33
|
/** Injectable fetch (defaults to global fetch) — tests pass a fake; production uses the network. */
|
|
23
34
|
fetchImpl?: typeof fetch;
|
|
24
35
|
onProgress?: (file: string, index: number, total: number) => void;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"model-installer.d.ts","sourceRoot":"","sources":["../../src/detect/model-installer.ts"],"names":[],"mappings":"AAiBA,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxD;AAED,mGAAmG;AACnG,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASpE;AAED,kGAAkG;AAClG,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAOrG;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,wFAAwF;IACxF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,2FAA2F;IAC3F,OAAO,EAAE,OAAO,CAAC;IACjB,oGAAoG;IACpG,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnE;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,
|
|
1
|
+
{"version":3,"file":"model-installer.d.ts","sourceRoot":"","sources":["../../src/detect/model-installer.ts"],"names":[],"mappings":"AAiBA,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxD;AAED,mGAAmG;AACnG,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASpE;AAED,kGAAkG;AAClG,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAOrG;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,wFAAwF;IACxF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,2FAA2F;IAC3F,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,oGAAoG;IACpG,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnE;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAgD/E"}
|
|
@@ -57,6 +57,17 @@ export async function installModel(opts) {
|
|
|
57
57
|
return { installed: true };
|
|
58
58
|
if (!opts.consent)
|
|
59
59
|
return { installed: false, needsConsent: true };
|
|
60
|
+
const unpinned = DEBERTA_MODEL.files.filter((f) => !f.sha256).map((f) => f.path);
|
|
61
|
+
if (unpinned.length > 0 && opts.allowUnpinnedDigests !== true) {
|
|
62
|
+
return {
|
|
63
|
+
installed: false,
|
|
64
|
+
error: `refusing to install: ${unpinned.length} of ${DEBERTA_MODEL.files.length} model files carry no ` +
|
|
65
|
+
`pinned SHA-256 (${unpinned.slice(0, 3).join(", ")}${unpinned.length > 3 ? ", …" : ""}), and the ` +
|
|
66
|
+
`manifest pins revision "${DEBERTA_MODEL.revision}" rather than a commit. Size and HTTPS are the ` +
|
|
67
|
+
`only integrity left, which does not stop a compromised mirror swapping the weights. Restore the ` +
|
|
68
|
+
`digests, or pass allowUnpinnedDigests to take that risk deliberately.`,
|
|
69
|
+
};
|
|
70
|
+
}
|
|
60
71
|
const doFetch = opts.fetchImpl ?? fetch;
|
|
61
72
|
const total = DEBERTA_MODEL.files.length;
|
|
62
73
|
for (let i = 0; i < total; i++) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"model-installer.js","sourceRoot":"","sources":["../../src/detect/model-installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAClC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;
|
|
1
|
+
{"version":3,"file":"model-installer.js","sourceRoot":"","sources":["../../src/detect/model-installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAClC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AA6BD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAoB;IACrD,IAAI,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAEnE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,KAAK,EACH,wBAAwB,QAAQ,CAAC,MAAM,OAAO,aAAa,CAAC,KAAK,CAAC,MAAM,wBAAwB;gBAChG,mBAAmB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa;gBAClG,2BAA2B,aAAa,CAAC,QAAQ,iDAAiD;gBAClG,kGAAkG;gBAClG,uEAAuE;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC3H,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAClH,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAA8C,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9G,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,SAAS,UAAU,CAAC,IAAI,YAAY,EAAE,CAAC;QAC1H,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;gBACrB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC,IAAI,kDAAkD,EAAE,CAAC;YACxH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC"}
|
|
@@ -33,5 +33,30 @@ export declare function stripInvisible(text: string): {
|
|
|
33
33
|
};
|
|
34
34
|
/** The space-free, encoded-alphabet, high-entropy tokens (encoded-blob candidates) in `text`. */
|
|
35
35
|
export declare function highEntropyTokens(text: string): string[];
|
|
36
|
+
/**
|
|
37
|
+
* The privileged-turn markers, shared with the DOCUMENT content rule (DOD-DOC-SCREEN-CONTENT-1).
|
|
38
|
+
*
|
|
39
|
+
* Exported because the two paths must refuse the same set and cannot own separate copies. The
|
|
40
|
+
* message path STRIPS them; a document is a signed CRDT replica, so the document path REFUSES them
|
|
41
|
+
* instead — same list, different remedy. Traced 2026-08-19: the document rule had its own four
|
|
42
|
+
* literals, matched case-sensitively, so `[SYSTEM]`, `<<SYS>>`, `[INST]`, `SYSTEM PROMPT:` and
|
|
43
|
+
* `<|IM_START|>` reached an operator's agent through a shared document while being stripped from
|
|
44
|
+
* every message.
|
|
45
|
+
*/
|
|
46
|
+
export declare const PRIVILEGED_TURN_MARKERS: readonly ["[SYSTEM]", "[/SYSTEM]", "<<SYS>>", "<</SYS>>", "[INST]", "[/INST]", "SYSTEM PROMPT:", "<system>", "</system>", "[cello security layer, local]"];
|
|
47
|
+
/**
|
|
48
|
+
* Any pipe-delimited chat-template marker — `<|im_start|>`, `<|assistant|>`, `<|user|>`, whatever a
|
|
49
|
+
* model family names its turns. Shared for the same reason as the literals above: the document rule
|
|
50
|
+
* enumerated four of these by hand, so every other one passed.
|
|
51
|
+
*
|
|
52
|
+
* A SOURCE STRING, not a `RegExp`. A shared `/g` regex object carries `lastIndex` between callers:
|
|
53
|
+
* one `.test()` anywhere seeds it, `matchAll` copies that seed into its clone, and every subsequent
|
|
54
|
+
* scan silently starts mid-string. Screening that quietly stops screening — no error, no red test —
|
|
55
|
+
* is the worst failure this module can have, and exporting a mutable object invites it across a
|
|
56
|
+
* published package boundary.
|
|
57
|
+
*/
|
|
58
|
+
export declare const PIPE_TURN_MARKER_SOURCE = "<\\|[a-z0-9_]+\\|>";
|
|
59
|
+
/** A fresh matcher per call — see `PIPE_TURN_MARKER_SOURCE` for why this is not a shared object. */
|
|
60
|
+
export declare function pipeTurnMarkerRegex(): RegExp;
|
|
36
61
|
export declare function sanitizeInbound(content: Uint8Array, opts?: SanitizeOptions): SanitizeResult;
|
|
37
62
|
//# sourceMappingURL=sanitize.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/detect/sanitize.ts"],"names":[],"mappings":"AAeA,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,iBAAiB,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAmBD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAQ9E;AAwED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQxD;
|
|
1
|
+
{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/detect/sanitize.ts"],"names":[],"mappings":"AAeA,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,iBAAiB,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAmBD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAQ9E;AAwED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQxD;AAgBD;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,4JAA+I,CAAC;AAEpL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D,oGAAoG;AACpG,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAqBD,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,GAAE,eAAoB,GAAG,cAAc,CA4C/F"}
|
package/dist/detect/sanitize.js
CHANGED
|
@@ -157,7 +157,34 @@ function scoreEntropy(text) {
|
|
|
157
157
|
// the real thing. Stripped here, case-insensitively, the property holds: inbound text cannot carry
|
|
158
158
|
// the marker. The `special_tokens` note that fires is itself the evidence someone tried.
|
|
159
159
|
// Imported, not re-spelled — two copies of a security literal drift apart.
|
|
160
|
-
|
|
160
|
+
/**
|
|
161
|
+
* The privileged-turn markers, shared with the DOCUMENT content rule (DOD-DOC-SCREEN-CONTENT-1).
|
|
162
|
+
*
|
|
163
|
+
* Exported because the two paths must refuse the same set and cannot own separate copies. The
|
|
164
|
+
* message path STRIPS them; a document is a signed CRDT replica, so the document path REFUSES them
|
|
165
|
+
* instead — same list, different remedy. Traced 2026-08-19: the document rule had its own four
|
|
166
|
+
* literals, matched case-sensitively, so `[SYSTEM]`, `<<SYS>>`, `[INST]`, `SYSTEM PROMPT:` and
|
|
167
|
+
* `<|IM_START|>` reached an operator's agent through a shared document while being stripped from
|
|
168
|
+
* every message.
|
|
169
|
+
*/
|
|
170
|
+
export const PRIVILEGED_TURN_MARKERS = ["[SYSTEM]", "[/SYSTEM]", "<<SYS>>", "<</SYS>>", "[INST]", "[/INST]", "SYSTEM PROMPT:", "<system>", "</system>", AFFORDANCE_PREFIX];
|
|
171
|
+
/**
|
|
172
|
+
* Any pipe-delimited chat-template marker — `<|im_start|>`, `<|assistant|>`, `<|user|>`, whatever a
|
|
173
|
+
* model family names its turns. Shared for the same reason as the literals above: the document rule
|
|
174
|
+
* enumerated four of these by hand, so every other one passed.
|
|
175
|
+
*
|
|
176
|
+
* A SOURCE STRING, not a `RegExp`. A shared `/g` regex object carries `lastIndex` between callers:
|
|
177
|
+
* one `.test()` anywhere seeds it, `matchAll` copies that seed into its clone, and every subsequent
|
|
178
|
+
* scan silently starts mid-string. Screening that quietly stops screening — no error, no red test —
|
|
179
|
+
* is the worst failure this module can have, and exporting a mutable object invites it across a
|
|
180
|
+
* published package boundary.
|
|
181
|
+
*/
|
|
182
|
+
export const PIPE_TURN_MARKER_SOURCE = "<\\|[a-z0-9_]+\\|>";
|
|
183
|
+
/** A fresh matcher per call — see `PIPE_TURN_MARKER_SOURCE` for why this is not a shared object. */
|
|
184
|
+
export function pipeTurnMarkerRegex() {
|
|
185
|
+
return new RegExp(PIPE_TURN_MARKER_SOURCE, "gi");
|
|
186
|
+
}
|
|
187
|
+
const LITERAL_MARKERS = PRIVILEGED_TURN_MARKERS;
|
|
161
188
|
function stripSpecialTokens(text) {
|
|
162
189
|
let out = text;
|
|
163
190
|
let removed = 0;
|
|
@@ -170,7 +197,9 @@ function stripSpecialTokens(text) {
|
|
|
170
197
|
out = parts.join(" ");
|
|
171
198
|
}
|
|
172
199
|
}
|
|
173
|
-
|
|
200
|
+
// THE SHARED PATTERN, not a second spelling of it. A hand-copied duplicate sat here twelve lines
|
|
201
|
+
// below the constant whose whole purpose is that two copies of a security literal drift apart.
|
|
202
|
+
out = out.replace(pipeTurnMarkerRegex(), () => { removed++; return " "; });
|
|
174
203
|
out = out.replace(/###\s*(instruction|response|system|human|assistant)\b:?/gi, () => { removed++; return " "; });
|
|
175
204
|
out = out.replace(/<\/?s>/gi, () => { removed++; return " "; });
|
|
176
205
|
return { text: out, removed };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/detect/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AA6B3C,gFAAgF;AAChF,4FAA4F;AAC5F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yCAAyC;IACjE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yCAAyC;IACjF,MAAM,EAAE,kCAAkC;IAC1C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oCAAoC;IAC5E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB;CACjD,CAAC,CAAC;AACH,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,EAAE,IAAI,OAAO,IAAI,EAAE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IAC9D,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,sBAAsB;IACrE,IAAI,EAAE,IAAI,OAAO,IAAI,EAAE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAAC,OAAO,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,iGAAiG;AACjG,gGAAgG;AAChG,kGAAkG;AAClG,yEAAyE;AACzE,MAAM,0BAA0B,GAA2B;IACzD,mBAAmB;IACnB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAClB,gBAAgB;IAChB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CACvC,CAAC;AACF,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAC3C,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,kGAAkG;AAClG,8FAA8F;AAC9F,+EAA+E;AAC/E,MAAM,cAAc,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC/G,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;QACpD,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,KAAK,EAAE,CAAC;QAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC;AACD,SAAS,iBAAiB,CAAC,EAAU;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,QAAQ,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACjG,IAAI,CAAC;QAAC,OAAO,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,iGAAiG;AACjG,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC;AACD,8FAA8F;AAC9F,gGAAgG;AAChG,wFAAwF;AACxF,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB;YAAE,SAAS;QACnD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAC3C,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,sBAAsB;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC;AAED,gFAAgF;AAChF,iGAAiG;AACjG,kGAAkG;AAClG,oFAAoF;AACpF,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,kGAAkG;AAClG,mGAAmG;AACnG,yFAAyF;AACzF,2EAA2E;AAC3E,MAAM,
|
|
1
|
+
{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/detect/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AA6B3C,gFAAgF;AAChF,4FAA4F;AAC5F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yCAAyC;IACjE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yCAAyC;IACjF,MAAM,EAAE,kCAAkC;IAC1C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oCAAoC;IAC5E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB;CACjD,CAAC,CAAC;AACH,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,EAAE,IAAI,OAAO,IAAI,EAAE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IAC9D,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,sBAAsB;IACrE,IAAI,EAAE,IAAI,OAAO,IAAI,EAAE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAAC,OAAO,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,iGAAiG;AACjG,gGAAgG;AAChG,kGAAkG;AAClG,yEAAyE;AACzE,MAAM,0BAA0B,GAA2B;IACzD,mBAAmB;IACnB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAClB,gBAAgB;IAChB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CACvC,CAAC;AACF,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAC3C,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,kGAAkG;AAClG,8FAA8F;AAC9F,+EAA+E;AAC/E,MAAM,cAAc,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC/G,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;QACpD,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,KAAK,EAAE,CAAC;QAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC;AACD,SAAS,iBAAiB,CAAC,EAAU;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,QAAQ,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACjG,IAAI,CAAC;QAAC,OAAO,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,iGAAiG;AACjG,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC;AACD,8FAA8F;AAC9F,gGAAgG;AAChG,wFAAwF;AACxF,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB;YAAE,SAAS;QACnD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAC3C,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,sBAAsB;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC;AAED,gFAAgF;AAChF,iGAAiG;AACjG,kGAAkG;AAClG,oFAAoF;AACpF,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,kGAAkG;AAClG,mGAAmG;AACnG,yFAAyF;AACzF,2EAA2E;AAC3E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAU,CAAC;AAEpL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D,oGAAoG;AACpG,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,MAAM,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,eAAe,GAAsB,uBAAuB,CAAC;AACnE,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,+FAA+F;QAC/F,8FAA8F;QAC9F,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAAC,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IAC/E,CAAC;IACD,iGAAiG;IACjG,+FAA+F;IAC/F,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,2DAA2D,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,OAAmB,EAAE,OAAwB,EAAE;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACpD,MAAM,KAAK,GAAuB,EAAE,CAAC;IAErC,6DAA6D;IAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,EAAE;YACR,cAAc,EAAE,EAAE;YAClB,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,CAAC;YACnB,OAAO,EAAE;gBACP,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,sBAAsB,OAAO,CAAC,MAAM,oBAAoB,QAAQ,aAAa;oBACrF,sFAAsF;aACzF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEtE,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gDAAgD,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3I,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAEhB,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,oDAAoD,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAEjB,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,gDAAgD,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1I,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAEhB,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,yEAAyE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACrJ,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC;IAEhC,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IACtD,IAAI,gBAAgB,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,+CAA+C,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAE5I,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;AAC3D,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -9,12 +9,13 @@ export type { GatewayMode } from "./types.js";
|
|
|
9
9
|
export type { ScreenDirection, ScreenDisposition, GovernanceDisposition, GovernanceEvent, ScreenContext, ScreenVerdict, SecurityGatewayClient, } from "./types.js";
|
|
10
10
|
export { OutboundScreener } from "./screen/outbound.js";
|
|
11
11
|
export type { OutboundVerdict, OutboundScreenerOptions, OutboundScreenContext } from "./screen/outbound.js";
|
|
12
|
-
export { InboundScreener } from "./screen/inbound.js";
|
|
12
|
+
export { InboundScreener, INBOUND_INJECTION_BLOCKED } from "./screen/inbound.js";
|
|
13
13
|
export type { InboundVerdict, InboundScreenerOptions } from "./screen/inbound.js";
|
|
14
14
|
export { initLinearRegex, linearRegexEngine, LinearRegex } from "./detect/linear-regex.js";
|
|
15
15
|
export { compileInjectionPatterns, scanInjectionPatterns, injectionPatternsReady } from "./detect/injection-patterns.js";
|
|
16
16
|
export { compileSecretRules, redactSecrets, secretRulesReady } from "./detect/secrets.js";
|
|
17
17
|
export type { SecretFinding, SecretScanResult } from "./detect/secrets.js";
|
|
18
|
+
export { PRIVILEGED_TURN_MARKERS, PIPE_TURN_MARKER_SOURCE, pipeTurnMarkerRegex, sanitizeInbound } from "./detect/sanitize.js";
|
|
18
19
|
export { screenInboundLanguage } from "./detect/language.js";
|
|
19
20
|
export type { LanguageVerdict, LanguageOptions, Script } from "./detect/language.js";
|
|
20
21
|
export { InjectionScanner, scoreToVerdict, BLOCK_THRESHOLD, FLAG_THRESHOLD } from "./detect/injection-scanner.js";
|
|
@@ -22,6 +23,8 @@ export type { InjectionClassifier, InjectionVerdict, ScanResult } from "./detect
|
|
|
22
23
|
export { isModelInstalled, installModel, verifyModel, sha256File } from "./detect/model-installer.js";
|
|
23
24
|
export type { InstallResult, InstallOptions } from "./detect/model-installer.js";
|
|
24
25
|
export { DEBERTA_MODEL } from "./detect/deberta-model-manifest.js";
|
|
26
|
+
export { loadInjectionClassifier } from "./detect/injection-classifier-onnx.js";
|
|
27
|
+
export type { ClassifierLoad } from "./detect/injection-classifier-onnx.js";
|
|
25
28
|
export { GatewayConfigStore } from "./config/config-store.js";
|
|
26
29
|
export type { ConfigDirection, SetResult, ConfigVersionRow } from "./config/config-store.js";
|
|
27
30
|
export { GatewayStoreError, stderrStoreEventSink, openEncryptedStoreDb } from "./store/encrypted-db.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AACjF,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIlF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC9H,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAClH,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACtG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,YAAY,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACxG,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACjH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAKxF,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAM3E,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,15 +1,19 @@
|
|
|
1
1
|
// The composed inbound/outbound screens (the gateway runs these; M9-FEED-001 renders the verdict).
|
|
2
2
|
export { OutboundScreener } from "./screen/outbound.js";
|
|
3
|
-
export { InboundScreener } from "./screen/inbound.js";
|
|
3
|
+
export { InboundScreener, INBOUND_INJECTION_BLOCKED } from "./screen/inbound.js";
|
|
4
4
|
// The RE2 linear-time regex engine (native re2 preferred, re2-wasm fallback) + the injection
|
|
5
5
|
// pattern scanner (M9-IN-001 Step-9). initLinearRegex() must be awaited once before use.
|
|
6
6
|
export { initLinearRegex, linearRegexEngine, LinearRegex } from "./detect/linear-regex.js";
|
|
7
7
|
export { compileInjectionPatterns, scanInjectionPatterns, injectionPatternsReady } from "./detect/injection-patterns.js";
|
|
8
8
|
export { compileSecretRules, redactSecrets, secretRulesReady } from "./detect/secrets.js";
|
|
9
|
+
// Shared with the document content rule — the message path strips these, the document path refuses
|
|
10
|
+
// them, and neither may own a private copy of the list (DOD-DOC-SCREEN-CONTENT-1).
|
|
11
|
+
export { PRIVILEGED_TURN_MARKERS, PIPE_TURN_MARKER_SOURCE, pipeTurnMarkerRegex, sanitizeInbound } from "./detect/sanitize.js";
|
|
9
12
|
export { screenInboundLanguage } from "./detect/language.js";
|
|
10
13
|
export { InjectionScanner, scoreToVerdict, BLOCK_THRESHOLD, FLAG_THRESHOLD } from "./detect/injection-scanner.js";
|
|
11
14
|
export { isModelInstalled, installModel, verifyModel, sha256File } from "./detect/model-installer.js";
|
|
12
15
|
export { DEBERTA_MODEL } from "./detect/deberta-model-manifest.js";
|
|
16
|
+
export { loadInjectionClassifier } from "./detect/injection-classifier-onnx.js";
|
|
13
17
|
export { GatewayConfigStore } from "./config/config-store.js";
|
|
14
18
|
export { GatewayStoreError, stderrStoreEventSink, openEncryptedStoreDb } from "./store/encrypted-db.js";
|
|
15
19
|
export { GatewayRecordStore } from "./records/record-store.js";
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkBA,mGAAmG;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkBA,mGAAmG;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAGjF,6FAA6F;AAC7F,yFAAyF;AACzF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE1F,mGAAmG;AACnG,mFAAmF;AACnF,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC9H,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAElH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEtG,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAExG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACxF,gGAAgG;AAChG,oGAAoG;AACpG,6FAA6F;AAC7F,mGAAmG;AACnG,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC3E,gGAAgG;AAChG,8FAA8F;AAC9F,gFAAgF;AAEhF,2FAA2F;AAC3F,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,oFAAoF;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAQlD,sCAAsC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAGxD,mEAAmE;AACnE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}
|
package/dist/screen/inbound.d.ts
CHANGED
|
@@ -21,6 +21,13 @@ export interface InboundScreenerOptions {
|
|
|
21
21
|
/** IN-002 semantic injection scanner. Default: a null scanner (Layer-2 off — graceful degrade). */
|
|
22
22
|
injectionScanner?: InjectionScanner;
|
|
23
23
|
}
|
|
24
|
+
/**
|
|
25
|
+
* The reason a SEMANTIC injection block carries. Exported because consumers must be able to tell it
|
|
26
|
+
* apart from this screener's other terminal blocks — the language allowlist and the size cap — which
|
|
27
|
+
* are correct for a message and wrong for a document (a shared document written in Japanese is
|
|
28
|
+
* ordinary use). Matching on the string in two places is how those get conflated.
|
|
29
|
+
*/
|
|
30
|
+
export declare const INBOUND_INJECTION_BLOCKED = "inbound_injection_blocked";
|
|
24
31
|
export declare class InboundScreener {
|
|
25
32
|
#private;
|
|
26
33
|
constructor(opts?: InboundScreenerOptions);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"inbound.d.ts","sourceRoot":"","sources":["../../src/screen/inbound.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC1C,+FAA+F;IAC/F,OAAO,EAAE,UAAU,CAAC;IACpB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B;sFACkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;
|
|
1
|
+
{"version":3,"file":"inbound.d.ts","sourceRoot":"","sources":["../../src/screen/inbound.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC1C,+FAA+F;IAC/F,OAAO,EAAE,UAAU,CAAC;IACpB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B;sFACkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAIrE,qBAAa,eAAe;;gBAKd,IAAI,GAAE,sBAA2B;IAOvC,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;CA0G3D"}
|
package/dist/screen/inbound.js
CHANGED
|
@@ -21,6 +21,13 @@ import { sanitizeInbound } from "../detect/sanitize.js";
|
|
|
21
21
|
import { scanInjectionPatterns } from "../detect/injection-patterns.js";
|
|
22
22
|
import { screenInboundLanguage } from "../detect/language.js";
|
|
23
23
|
import { InjectionScanner } from "../detect/injection-scanner.js";
|
|
24
|
+
/**
|
|
25
|
+
* The reason a SEMANTIC injection block carries. Exported because consumers must be able to tell it
|
|
26
|
+
* apart from this screener's other terminal blocks — the language allowlist and the size cap — which
|
|
27
|
+
* are correct for a message and wrong for a document (a shared document written in Japanese is
|
|
28
|
+
* ordinary use). Matching on the string in two places is how those get conflated.
|
|
29
|
+
*/
|
|
30
|
+
export const INBOUND_INJECTION_BLOCKED = "inbound_injection_blocked";
|
|
24
31
|
const TEXT_ENCODER = new TextEncoder();
|
|
25
32
|
export class InboundScreener {
|
|
26
33
|
#maxBytes;
|
|
@@ -92,7 +99,7 @@ export class InboundScreener {
|
|
|
92
99
|
reason: `semantic injection score ${scan.score} ≥ block threshold`,
|
|
93
100
|
}],
|
|
94
101
|
terminal: true,
|
|
95
|
-
reason:
|
|
102
|
+
reason: INBOUND_INJECTION_BLOCKED,
|
|
96
103
|
guidance: "This message was classified as a prompt-injection attempt and was not delivered.\n" +
|
|
97
104
|
noOperatorOverride("If you believe it is legitimate, ask the sender to rephrase it without instruction-like " +
|
|
98
105
|
"framing, or have the operator inspect it directly."),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"inbound.js","sourceRoot":"","sources":["../../src/screen/inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAwB,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAyBlE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAEvC,MAAM,OAAO,eAAe;IACjB,SAAS,CAAU;IACnB,SAAS,CAAmB;IAC5B,UAAU,CAAmB;IAEtC,YAAY,OAA+B,EAAE;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,4FAA4F;QAC5F,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAmB;QAC9B,MAAM,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAErG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,+FAA+F;YAC/F,kGAAkG;YAClG,OAAO;gBACL,WAAW,EAAE,OAAO;gBACpB,OAAO;gBACP,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC3H,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE;gBACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ;aAC7B,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAsB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACxD,QAAQ,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE;YAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CAAC;QAEJ,mGAAmG;QACnG,+FAA+F;QAC/F,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;QAE7B,+FAA+F;QAC/F,kGAAkG;QAClG,MAAM,IAAI,GAAG,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;gBACL,WAAW,EAAE,OAAO;gBACpB,OAAO;gBACP,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE;wBAClB,KAAK,EAAE,UAAU;wBACjB,WAAW,EAAE,OAAO;wBACpB,QAAQ,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE;wBACnC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,0BAA0B;qBAClD,CAAC;gBACF,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,0BAA0B;gBAClC,QAAQ,EACN,CAAC,IAAI,CAAC,MAAM,IAAI,4EAA4E,CAAC;oBAC7F,IAAI,GAAG,cAAc,CAAC,gBAAgB,EAAE,6BAA6B,CAAC;aACzE,CAAC;QACJ,CAAC;QAED,mGAAmG;QACnG,8FAA8F;QAC9F,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC7B,OAAO;oBACL,WAAW,EAAE,OAAO;oBACpB,OAAO;oBACP,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE;4BAClB,KAAK,EAAE,gBAAgB;4BACvB,WAAW,EAAE,OAAO;4BACpB,QAAQ,EAAE,oBAAoB;4BAC9B,MAAM,EAAE,4BAA4B,IAAI,CAAC,KAAK,oBAAoB;yBACnE,CAAC;oBACF,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,
|
|
1
|
+
{"version":3,"file":"inbound.js","sourceRoot":"","sources":["../../src/screen/inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAwB,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAyBlE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAErE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAEvC,MAAM,OAAO,eAAe;IACjB,SAAS,CAAU;IACnB,SAAS,CAAmB;IAC5B,UAAU,CAAmB;IAEtC,YAAY,OAA+B,EAAE;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,4FAA4F;QAC5F,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAmB;QAC9B,MAAM,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAErG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,+FAA+F;YAC/F,kGAAkG;YAClG,OAAO;gBACL,WAAW,EAAE,OAAO;gBACpB,OAAO;gBACP,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC3H,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE;gBACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ;aAC7B,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAsB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACxD,QAAQ,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE;YAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CAAC;QAEJ,mGAAmG;QACnG,+FAA+F;QAC/F,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;QAE7B,+FAA+F;QAC/F,kGAAkG;QAClG,MAAM,IAAI,GAAG,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;gBACL,WAAW,EAAE,OAAO;gBACpB,OAAO;gBACP,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE;wBAClB,KAAK,EAAE,UAAU;wBACjB,WAAW,EAAE,OAAO;wBACpB,QAAQ,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE;wBACnC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,0BAA0B;qBAClD,CAAC;gBACF,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,0BAA0B;gBAClC,QAAQ,EACN,CAAC,IAAI,CAAC,MAAM,IAAI,4EAA4E,CAAC;oBAC7F,IAAI,GAAG,cAAc,CAAC,gBAAgB,EAAE,6BAA6B,CAAC;aACzE,CAAC;QACJ,CAAC;QAED,mGAAmG;QACnG,8FAA8F;QAC9F,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC7B,OAAO;oBACL,WAAW,EAAE,OAAO;oBACpB,OAAO;oBACP,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE;4BAClB,KAAK,EAAE,gBAAgB;4BACvB,WAAW,EAAE,OAAO;4BACpB,QAAQ,EAAE,oBAAoB;4BAC9B,MAAM,EAAE,4BAA4B,IAAI,CAAC,KAAK,oBAAoB;yBACnE,CAAC;oBACF,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,yBAAyB;oBACjC,QAAQ,EACN,oFAAoF;wBACpF,kBAAkB,CAChB,0FAA0F;4BAC1F,oDAAoD,CACrD;iBACJ,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC5B,8FAA8F;gBAC9F,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,gBAAgB;oBACvB,WAAW,EAAE,SAAS;oBACtB,QAAQ,EAAE,oBAAoB;oBAC9B,MAAM,EAAE,4BAA4B,IAAI,CAAC,KAAK,mCAAmC;iBAClF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,6FAA6F;QAC7F,iGAAiG;QACjG,6FAA6F;QAC7F,yEAAyE;QACzE,KAAK,MAAM,EAAE,IAAI,qBAAqB,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,gBAAgB;gBACvB,WAAW,EAAE,SAAS;gBACtB,QAAQ,EAAE,aAAa,EAAE,EAAE;gBAC3B,MAAM,EAAE,oCAAoC,EAAE,0BAA0B;aACzE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;YACzC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO;YAC/D,MAAM;SACP,CAAC;IACJ,CAAC;CACF"}
|
package/dist/spawn.d.ts
CHANGED
|
@@ -21,6 +21,15 @@ export interface SpawnGatewayOptions {
|
|
|
21
21
|
readyTimeoutMs?: number;
|
|
22
22
|
}
|
|
23
23
|
export interface SpawnedGateway {
|
|
24
|
+
/**
|
|
25
|
+
* What the child reported about Layer 2 on its ready line — `active`, or `off:<reason>`.
|
|
26
|
+
*
|
|
27
|
+
* Carried out of the child DELIBERATELY. It used to be written to the gateway's stderr, which is
|
|
28
|
+
* drained into a tail this module only surfaces when the spawn FAILS — so on a successful boot
|
|
29
|
+
* the state was captured and discarded, and "is semantic screening on?" had no answer anywhere.
|
|
30
|
+
* The parent logs this; that log line is the whole point.
|
|
31
|
+
*/
|
|
32
|
+
readonly layer2: string;
|
|
24
33
|
readonly socketPath: string;
|
|
25
34
|
readonly pid: number | undefined;
|
|
26
35
|
readonly process: ChildProcess;
|
package/dist/spawn.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9D,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AASD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,
|
|
1
|
+
{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9D,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AASD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoG5F"}
|
package/dist/spawn.js
CHANGED
|
@@ -31,6 +31,7 @@ export async function spawnGatewaySidecar(opts) {
|
|
|
31
31
|
},
|
|
32
32
|
});
|
|
33
33
|
const readyTimeoutMs = opts.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS;
|
|
34
|
+
let layer2 = "unreported";
|
|
34
35
|
// DRAIN the child's stderr and keep the tail. Two reasons, and the first one is the whole point:
|
|
35
36
|
// every refusal the gateway can produce — a missing key file, a locked store, a leftover
|
|
36
37
|
// plaintext store, each with its own code and its own guidance — is written HERE. Without a
|
|
@@ -59,12 +60,18 @@ export async function spawnGatewaySidecar(opts) {
|
|
|
59
60
|
reject(new Error(withChildStderr(`gateway sidecar did not become ready within ${readyTimeoutMs}ms`)));
|
|
60
61
|
}, readyTimeoutMs);
|
|
61
62
|
const onStdout = (chunk) => {
|
|
62
|
-
|
|
63
|
+
const text = chunk.toString("utf8");
|
|
64
|
+
if (text.includes(GATEWAY_READY_TOKEN)) {
|
|
63
65
|
if (settled)
|
|
64
66
|
return;
|
|
65
67
|
settled = true;
|
|
66
68
|
clearTimeout(timer);
|
|
67
69
|
child.stdout?.off("data", onStdout);
|
|
70
|
+
// ABSENT IS NOT FINE, and it is not "off" either: an older child that does not report at
|
|
71
|
+
// all is a different fact from one reporting Layer 2 disabled, and calling it `off` would
|
|
72
|
+
// invent a state nobody observed.
|
|
73
|
+
const m = /layer2=(\S+)/.exec(text);
|
|
74
|
+
layer2 = m?.[1] ?? "unreported";
|
|
68
75
|
resolve();
|
|
69
76
|
}
|
|
70
77
|
};
|
|
@@ -82,6 +89,7 @@ export async function spawnGatewaySidecar(opts) {
|
|
|
82
89
|
child.once("error", (err) => fail(`gateway sidecar could not be spawned: ${err.message}`));
|
|
83
90
|
});
|
|
84
91
|
return {
|
|
92
|
+
layer2,
|
|
85
93
|
socketPath: opts.socketPath,
|
|
86
94
|
pid: child.pid,
|
|
87
95
|
process: child,
|
package/dist/spawn.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AA+BnD,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC,SAAS,gBAAgB;IACvB,4CAA4C;IAC5C,OAAO,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;QAC7C,+FAA+F;QAC/F,yFAAyF;QACzF,8FAA8F;QAC9F,gGAAgG;QAChG,2FAA2F;QAC3F,gDAAgD;QAChD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,GAAG,IAAI,CAAC,GAAG;YACX,oBAAoB,EAAE,IAAI,CAAC,UAAU;SACtC;KACF,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;IACvE,IAAI,MAAM,GAAG,YAAY,CAAC;IAE1B,iGAAiG;IACjG,yFAAyF;IACzF,4FAA4F;IAC5F,uFAAuF;IACvF,+FAA+F;IAC/F,4FAA4F;IAC5F,wFAAwF;IACxF,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,MAAM,eAAe,GAAG,KAAK,CAAC;IAC9B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,UAAU,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IACH,0FAA0F;IAC1F,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAClD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,6BAA6B,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAE3F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,+CAA+C,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC;QACxG,CAAC,EAAE,cAAc,CAAC,CAAC;QAEnB,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE;YACjC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACpC,yFAAyF;gBACzF,0FAA0F;gBAC1F,kCAAkC;gBAClC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;gBAChC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,OAAe,EAAQ,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,6CAA6C,IAAI,GAAG,CAAC,CAAC,CAAC;QACzF,+FAA+F;QAC/F,iCAAiC;QACjC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,yCAAyC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO,EAAE,KAAK;QACd,KAAK,CAAC,IAAI;YACR,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO;YACjE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,2FAA2F;YAC3F,sCAAsC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACnC,IAAI,UAAqD,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC3C,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC5E,IAAI,OAAQ,UAAqC,CAAC,KAAK,KAAK,UAAU;oBAAG,UAAoC,CAAC,KAAK,EAAE,CAAC;YACxH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACvC,CAAC;oBAAS,CAAC;gBACT,IAAI,UAAU;oBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
|