@datafog/fogclaw 0.1.6 → 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,42 @@
+# Changelog
+
+## 0.3.0
+
+### Added
+
+- **PII access request backlog** — agents can request access to redacted data via `fogclaw_request_access`, users review via `fogclaw_requests`, and resolve (approve/deny/follow-up) via `fogclaw_resolve`. Full async workflow with batch resolve support.
+- **RedactionMapStore** — captures placeholder-to-original text mappings from all three scanning hooks, enabling backlog approvals to reveal original data.
+- **Configurable `maxPendingRequests`** — caps the number of pending access requests per session (default: 50). Configurable in `fogclaw.config.json` and `openclaw.plugin.json`.
+- **FIFO eviction for redaction mappings** — `RedactionMapStore` caps at 10,000 entries by default with oldest-first eviction to prevent unbounded PII accumulation in memory.
+- **Access request audit events** — `access_request_created` and `access_request_resolved` structured audit log entries when `auditEnabled: true`. Never includes raw PII.
+- **ARCHITECTURE.md** — top-level architecture document covering components, scanning layers, tools, data flow, and key invariants.
+
+## 0.2.0
+
+### Added
+
+- **Tool result PII scanning** — new `tool_result_persist` hook scans file reads, API responses, and web fetches for PII before they enter the session transcript. Uses regex engine (sync) for <1ms latency on the hot path.
+- **Outbound message PII scanning** — new `message_sending` hook provides a last-chance gate that catches PII in agent replies before delivery to Telegram, Slack, Discord, and other external channels. Uses full Scanner (regex + GLiNER).
+- **Policy allowlist** — whitelist exact strings, regex patterns, or per-entity-type values to skip enforcement on known-safe content (e.g., `noreply@example.com`).
+- **Per-entity confidence thresholds** — tune GLiNER detection sensitivity per label (e.g., require 0.7 for PERSON, 0.85 for ORGANIZATION).
+- **Audit trail logging** — structured audit log entries with `source` field (`guardrail`, `tool_result`, `outbound`) when `auditEnabled: true`. Logs entity counts and labels without raw PII.
+- **Policy preview tool** — `fogclaw_preview` shows which entities would be blocked, warned, or redacted without changing runtime behavior.
+- **Scanning architecture documentation** — README now includes a comparison matrix showing engine trade-offs across all three hooks.
+- **Control UI hints** — `openclaw.plugin.json` includes `uiHints` for policy configuration in OpenClaw's Control UI.
+
+### Changed
+
+- `resolveAction` extracted to shared `types.ts` module (was duplicated across files).
+- README updated with three-layer scanning overview and defense-in-depth flow diagram.
+
+## 0.1.6
+
+Initial scoped release as `@datafog/fogclaw`.
+
+- Dual-engine PII detection (regex + GLiNER via ONNX)
+- `before_agent_start` hook for automatic prompt guardrail
+- `fogclaw_scan` and `fogclaw_redact` tools
+- Configurable per-entity actions (`redact`, `block`, `warn`)
+- Multiple redaction strategies (`token`, `mask`, `hash`)
+- Custom entity types via GLiNER zero-shot NER
+- Graceful degradation to regex-only when GLiNER unavailable

package/README.md

@@ -6,7 +6,10 @@ FogClaw uses a dual-engine approach: battle-tested regex patterns for structured
 
 ## Features
 
+- **Three-layer scanning** — inbound prompts, tool results, and outbound messages are all scanned for PII before they cross trust boundaries
 - **Automatic guardrail** — intercepts messages before they reach the LLM via OpenClaw's `before_agent_start` hook
+- **Tool result scanning** — redacts PII in file reads, API responses, and web fetches before they enter the session transcript (`tool_result_persist`)
+- **Outbound message scanning** — last-chance gate that catches PII in agent replies before delivery to external channels (`message_sending`)
 - **On-demand tools** — `fogclaw_scan`, `fogclaw_preview`, and `fogclaw_redact`
 - **Dual detection engine** — regex for structured PII (<1ms), GLiNER for zero-shot NER (~50-200ms)
 - **Custom entity types** — define any entity label (e.g., "project codename", "competitor name") and GLiNER detects them with zero training
@@ -141,6 +144,42 @@ Incoming message
   Apply action per entity type (redact / block / warn)
 ```
 
+## Scanning Architecture
+
+FogClaw hooks into three points in the OpenClaw message lifecycle. Each hook uses the detection engine best suited to its runtime constraints:
+
+| Hook | Direction | Engine | Latency | Async | Entity Coverage |
+|------|-----------|--------|---------|-------|-----------------|
+| `before_agent_start` | Inbound (user prompt) | Regex + GLiNER | ~50-200ms | Yes | Full — structured PII + names, orgs, custom entities |
+| `tool_result_persist` | Internal (tool results) | Regex only | <1ms | No (sync) | Structured PII — emails, SSNs, phones, credit cards, IPs |
+| `message_sending` | Outbound (agent reply) | Regex + GLiNER | ~50-200ms | Yes | Full — structured PII + names, orgs, custom entities |
+
+**Why regex-only for tool results?** OpenClaw's `tool_result_persist` hook requires synchronous handlers — async returns are rejected. GLiNER inference runs a synchronous ONNX native call that blocks the event loop for 100-500ms per invocation, which would degrade gateway responsiveness (delayed heartbeats, WebSocket pings, HTTP responses). Regex covers the high-confidence structured patterns most common in tool output (credentials in file reads, contact info in API responses). Person names and organization names are caught on the async inbound and outbound paths, providing defense-in-depth without hot-path latency.
+
+```
+User prompt ──► before_agent_start (regex + GLiNER)
+                        │
+                        ▼
+                   Agent + LLM
+                        │
+              ┌─────────┼─────────┐
+              ▼         ▼         ▼
+         Tool call  Tool call  Tool call
+              │         │         │
+              ▼         ▼         ▼
+     tool_result_persist (regex only, sync)
+                        │
+                        ▼
+                   Agent reply
+                        │
+                        ▼
+              message_sending (regex + GLiNER)
+                        │
+                        ▼
+                  External channel
+              (Telegram, Slack, etc.)
+```
+
 ## Detected Entity Types
 
 ### Regex Engine (structured PII)

package/dist/backlog-tools.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Tool handler factories for the PII access request backlog.
+ *
+ * Three tools:
+ * - fogclaw_request_access: agent submits a request for redacted data
+ * - fogclaw_requests: list/filter backlog requests
+ * - fogclaw_resolve: user approves, denies, or asks follow-up
+ */
+import type { BacklogStore } from "./backlog.js";
+import type { FogClawConfig } from "./types.js";
+interface Logger {
+    info(msg: string): void;
+    warn(msg: string): void;
+}
+interface ToolResponse {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}
+/**
+ * Create handler for fogclaw_request_access tool.
+ *
+ * Agent calls this when it encounters redacted content and wants
+ * to request access to the original text.
+ */
+export declare function createRequestAccessHandler(backlog: BacklogStore, config: FogClawConfig, logger?: Logger): (params: {
+    placeholder: string;
+    entity_type: string;
+    reason: string;
+    context?: string;
+}) => ToolResponse;
+/**
+ * Create handler for fogclaw_requests tool.
+ *
+ * Lists backlog requests, optionally filtered by status.
+ * For approved requests, includes the original text.
+ */
+export declare function createRequestsListHandler(backlog: BacklogStore, config: FogClawConfig, logger?: Logger): (params: {
+    status?: string;
+}) => ToolResponse;
+/**
+ * Create handler for fogclaw_resolve tool.
+ *
+ * User resolves a request: approve (reveals original text),
+ * deny, or follow_up (asks agent for more context).
+ *
+ * Supports single request_id or batch request_ids.
+ */
+export declare function createResolveHandler(backlog: BacklogStore, config: FogClawConfig, logger?: Logger): (params: {
+    request_id?: string;
+    request_ids?: string[];
+    action: string;
+    message?: string;
+}) => ToolResponse;
+export {};
+//# sourceMappingURL=backlog-tools.d.ts.map

package/dist/backlog-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backlog-tools.d.ts","sourceRoot":"","sources":["../src/backlog-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,UAAU,MAAM;IACd,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,UAAU,YAAY;IACpB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAYD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,aAAa,EACrB,MAAM,CAAC,EAAE,MAAM,GACd,CAAC,MAAM,EAAE;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,KAAK,YAAY,CA6BjB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,aAAa,EACrB,MAAM,CAAC,EAAE,MAAM,GACd,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,YAAY,CAoD/C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,aAAa,EACrB,MAAM,CAAC,EAAE,MAAM,GACd,CAAC,MAAM,EAAE;IACV,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,KAAK,YAAY,CAkGjB"}

package/dist/backlog-tools.js

@@ -0,0 +1,173 @@
+/**
+ * Tool handler factories for the PII access request backlog.
+ *
+ * Three tools:
+ * - fogclaw_request_access: agent submits a request for redacted data
+ * - fogclaw_requests: list/filter backlog requests
+ * - fogclaw_resolve: user approves, denies, or asks follow-up
+ */
+function jsonResponse(data) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+    };
+}
+function errorResponse(message) {
+    return jsonResponse({ error: message });
+}
+/**
+ * Create handler for fogclaw_request_access tool.
+ *
+ * Agent calls this when it encounters redacted content and wants
+ * to request access to the original text.
+ */
+export function createRequestAccessHandler(backlog, config, logger) {
+    return (params) => {
+        try {
+            const request = backlog.createRequest(params.placeholder, params.entity_type, params.reason, params.context);
+            if (config.auditEnabled && logger) {
+                logger.info(`[FOGCLAW AUDIT] access_request_created ${JSON.stringify({
+                    request_id: request.id,
+                    entity_type: request.entityType,
+                    source: "backlog",
+                })}`);
+            }
+            return jsonResponse({
+                request_id: request.id,
+                status: request.status,
+                message: `Access request ${request.id} created for ${params.entity_type} entity "${params.placeholder}". A user must review and approve this request before the original text is revealed.`,
+            });
+        }
+        catch (err) {
+            return errorResponse(err.message);
+        }
+    };
+}
+/**
+ * Create handler for fogclaw_requests tool.
+ *
+ * Lists backlog requests, optionally filtered by status.
+ * For approved requests, includes the original text.
+ */
+export function createRequestsListHandler(backlog, config, logger) {
+    return (params) => {
+        const validStatuses = ["pending", "approved", "denied", "follow_up"];
+        const statusFilter = params.status;
+        if (statusFilter && !validStatuses.includes(statusFilter)) {
+            return errorResponse(`Invalid status filter "${params.status}". Must be one of: ${validStatuses.join(", ")}`);
+        }
+        const requests = backlog.listRequests(statusFilter);
+        const items = requests.map((req) => {
+            const item = {
+                id: req.id,
+                placeholder: req.placeholder,
+                entity_type: req.entityType,
+                reason: req.reason,
+                context: req.context,
+                status: req.status,
+                created_at: req.createdAt,
+            };
+            if (req.status === "approved") {
+                item.original_text = req.originalText;
+                item.resolved_at = req.resolvedAt;
+            }
+            if (req.status === "denied") {
+                item.resolved_at = req.resolvedAt;
+                item.response_message = req.responseMessage;
+            }
+            if (req.status === "follow_up") {
+                item.follow_up_message = req.followUpMessage;
+            }
+            return item;
+        });
+        return jsonResponse({
+            requests: items,
+            total: items.length,
+            filter: statusFilter ?? "all",
+        });
+    };
+}
+/**
+ * Create handler for fogclaw_resolve tool.
+ *
+ * User resolves a request: approve (reveals original text),
+ * deny, or follow_up (asks agent for more context).
+ *
+ * Supports single request_id or batch request_ids.
+ */
+export function createResolveHandler(backlog, config, logger) {
+    return (params) => {
+        const validActions = ["approve", "deny", "follow_up"];
+        if (!validActions.includes(params.action)) {
+            return errorResponse(`Invalid action "${params.action}". Must be one of: ${validActions.join(", ")}`);
+        }
+        const action = params.action;
+        // Batch resolve
+        if (params.request_ids && params.request_ids.length > 0) {
+            const results = backlog.resolveMultiple(params.request_ids, action, params.message);
+            if (config.auditEnabled && logger) {
+                for (const r of results) {
+                    if (r.result) {
+                        logger.info(`[FOGCLAW AUDIT] access_request_resolved ${JSON.stringify({
+                            request_id: r.id,
+                            action,
+                            entity_type: r.result.entityType,
+                            source: "backlog",
+                        })}`);
+                    }
+                }
+            }
+            return jsonResponse({
+                results: results.map((r) => {
+                    if (r.error) {
+                        return { id: r.id, error: r.error };
+                    }
+                    const item = {
+                        id: r.id,
+                        status: r.result.status,
+                    };
+                    if (action === "approve") {
+                        item.original_text = r.result.originalText;
+                    }
+                    return item;
+                }),
+                action,
+            });
+        }
+        // Single resolve
+        if (!params.request_id) {
+            return errorResponse("Either request_id or request_ids must be provided.");
+        }
+        try {
+            const resolved = backlog.resolveRequest(params.request_id, action, params.message);
+            if (config.auditEnabled && logger) {
+                logger.info(`[FOGCLAW AUDIT] access_request_resolved ${JSON.stringify({
+                    request_id: resolved.id,
+                    action,
+                    entity_type: resolved.entityType,
+                    source: "backlog",
+                })}`);
+            }
+            const result = {
+                request_id: resolved.id,
+                status: resolved.status,
+            };
+            if (action === "approve") {
+                result.original_text = resolved.originalText;
+                result.message = resolved.originalText
+                    ? `Access approved. Original text: ${resolved.originalText}`
+                    : "Access approved, but original text was not captured during redaction.";
+            }
+            else if (action === "deny") {
+                result.message = params.message ?? "Access denied.";
+            }
+            else if (action === "follow_up") {
+                result.message = `Follow-up question sent to agent: "${params.message ?? ""}"`;
+            }
+            return jsonResponse(result);
+        }
+        catch (err) {
+            return errorResponse(err.message);
+        }
+    };
+}
+//# sourceMappingURL=backlog-tools.js.map

package/dist/backlog-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backlog-tools.js","sourceRoot":"","sources":["../src/backlog-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,SAAS,YAAY,CAAC,IAAa;IACjC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAqB,EACrB,MAAqB,EACrB,MAAe;IAOf,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CACnC,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,CACf,CAAC;YAEF,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CACT,0CAA0C,IAAI,CAAC,SAAS,CAAC;oBACvD,UAAU,EAAE,OAAO,CAAC,EAAE;oBACtB,WAAW,EAAE,OAAO,CAAC,UAAU;oBAC/B,MAAM,EAAE,SAAS;iBAClB,CAAC,EAAE,CACL,CAAC;YACJ,CAAC;YAED,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,OAAO,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,kBAAkB,OAAO,CAAC,EAAE,gBAAgB,MAAM,CAAC,WAAW,YAAY,MAAM,CAAC,WAAW,sFAAsF;aAC5L,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAqB,EACrB,MAAqB,EACrB,MAAe;IAEf,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,MAAM,CAAC,MAKf,CAAC;QAEd,IAAI,YAAY,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1D,OAAO,aAAa,CAClB,0BAA0B,MAAM,CAAC,MAAM,sBAAsB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAEpD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,MAAM,IAAI,GAA4B;gBACpC,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,WAAW,EAAE,GAAG,CAAC,UAAU;gBAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,SAAS;aAC1B,CAAC;YAEF,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC9B,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC;gBACtC,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC;YACpC,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC;gBAClC,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,eAAe,CAAC;YAC9C,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,eAAe,CAAC;YAC/C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;YAClB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,MAAM,EAAE,YAAY,IAAI,KAAK;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAqB,EACrB,MAAqB,EACrB,MAAe;IAOf,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO,aAAa,CAClB,mBAAmB,MAAM,CAAC,MAAM,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAA0C,CAAC;QAEjE,gBAAgB;QAChB,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CACrC,MAAM,CAAC,WAAW,EAClB,MAAM,EACN,MAAM,CAAC,OAAO,CACf,CAAC;YAEF,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;gBAClC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CACT,2CAA2C,IAAI,CAAC,SAAS,CAAC;4BACxD,UAAU,EAAE,CAAC,CAAC,EAAE;4BAChB,MAAM;4BACN,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU;4BAChC,MAAM,EAAE,SAAS;yBAClB,CAAC,EAAE,CACL,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,YAAY,CAAC;gBAClB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACzB,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;wBACZ,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;oBACtC,CAAC;oBACD,MAAM,IAAI,GAA4B;wBACpC,EAAE,EAAE,CAAC,CAAC,EAAE;wBACR,MAAM,EAAE,CAAC,CAAC,MAAO,CAAC,MAAM;qBACzB,CAAC;oBACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,MAAO,CAAC,YAAY,CAAC;oBAC9C,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC,CAAC;gBACF,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,aAAa,CAClB,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CACrC,MAAM,CAAC,UAAU,EACjB,MAAM,EACN,MAAM,CAAC,OAAO,CACf,CAAC;YAEF,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CACT,2CAA2C,IAAI,CAAC,SAAS,CAAC;oBACxD,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,MAAM;oBACN,WAAW,EAAE,QAAQ,CAAC,UAAU;oBAChC,MAAM,EAAE,SAAS;iBAClB,CAAC,EAAE,CACL,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAA4B;gBACtC,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;YAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,CAAC,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC;gBAC7C,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,YAAY;oBACpC,CAAC,CAAC,mCAAmC,QAAQ,CAAC,YAAY,EAAE;oBAC5D,CAAC,CAAC,uEAAuE,CAAC;YAC9E,CAAC;iBAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC;YACtD,CAAC;iBAAM,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,CAAC,OAAO,GAAG,sCAAsC,MAAM,CAAC,OAAO,IAAI,EAAE,GAAG,CAAC;YACjF,CAAC;YAED,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/backlog.d.ts

@@ -0,0 +1,82 @@
+/**
+ * In-memory backlog store for PII access requests.
+ *
+ * RedactionMapStore captures placeholder → original text mappings from hooks.
+ * BacklogStore manages the access request lifecycle (create, list, resolve).
+ *
+ * Both are session-scoped: state lives in runtime memory only and is
+ * discarded when the process exits.
+ */
+import type { AccessRequest, RequestStatus } from "./types.js";
+/**
+ * Stores redaction mappings from hook handlers so that access request
+ * approvals can retrieve the original pre-redaction text.
+ *
+ * Each time a hook redacts text, it calls addMapping() with the
+ * redactor's mapping (placeholder → original). When an access request
+ * is approved, the backlog looks up the original text here.
+ */
+export declare class RedactionMapStore {
+    private store;
+    private maxMappings;
+    constructor(maxMappings?: number);
+    /** Merge new placeholder → original entries into the store. */
+    addMapping(mapping: Record<string, string>): void;
+    /** Look up the original text for a redacted placeholder. */
+    getOriginal(placeholder: string): string | undefined;
+    /** Reset all stored mappings. */
+    clear(): void;
+    /** Number of stored mappings. */
+    get size(): number;
+    /** Evict oldest entries (FIFO by Map insertion order) when over capacity. */
+    private evict;
+}
+/**
+ * Manages PII access requests throughout their lifecycle.
+ *
+ * Requests transition through: pending → approved | denied | follow_up.
+ * A follow_up request can later be resolved to approved or denied.
+ */
+export declare class BacklogStore {
+    private requests;
+    private counter;
+    private redactionMap;
+    private maxPending;
+    constructor(redactionMap: RedactionMapStore, maxPending?: number);
+    /** Number of pending requests. */
+    get pendingCount(): number;
+    /** Total number of requests in any status. */
+    get totalCount(): number;
+    /**
+     * Create a new access request.
+     *
+     * Looks up the original text from the RedactionMapStore automatically.
+     * Throws if the pending request limit is reached.
+     */
+    createRequest(placeholder: string, entityType: string, reason: string, context?: string): AccessRequest;
+    /** Get a single request by ID. */
+    getRequest(id: string): AccessRequest | undefined;
+    /** List requests, optionally filtered by status. */
+    listRequests(statusFilter?: RequestStatus): AccessRequest[];
+    /**
+     * Resolve a single request.
+     *
+     * - approve: marks as approved, stores response message
+     * - deny: marks as denied, stores response message
+     * - follow_up: marks as follow_up, stores the follow-up question
+     *
+     * A follow_up request can be resolved again to approved or denied.
+     * Throws if request not found or already in a terminal state (approved/denied).
+     */
+    resolveRequest(id: string, action: "approve" | "deny" | "follow_up", message?: string): AccessRequest;
+    /**
+     * Resolve multiple requests with the same action.
+     * Returns an array of results (resolved request or error message per ID).
+     */
+    resolveMultiple(ids: string[], action: "approve" | "deny" | "follow_up", message?: string): Array<{
+        id: string;
+        result: AccessRequest | null;
+        error: string | null;
+    }>;
+}
+//# sourceMappingURL=backlog.d.ts.map

package/dist/backlog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backlog.d.ts","sourceRoot":"","sources":["../src/backlog.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,WAAW,CAAS;gBAEhB,WAAW,SAAS;IAIhC,+DAA+D;IAC/D,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAOjD,4DAA4D;IAC5D,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIpD,iCAAiC;IACjC,KAAK,IAAI,IAAI;IAIb,iCAAiC;IACjC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,6EAA6E;IAC7E,OAAO,CAAC,KAAK;CASd;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,UAAU,CAAS;gBAEf,YAAY,EAAE,iBAAiB,EAAE,UAAU,SAAK;IAK5D,kCAAkC;IAClC,IAAI,YAAY,IAAI,MAAM,CAMzB;IAED,8CAA8C;IAC9C,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;;OAKG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,aAAa;IA6BhB,kCAAkC;IAClC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIjD,oDAAoD;IACpD,YAAY,CAAC,YAAY,CAAC,EAAE,aAAa,GAAG,aAAa,EAAE;IAM3D;;;;;;;;;OASG;IACH,cAAc,CACZ,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,EACxC,OAAO,CAAC,EAAE,MAAM,GACf,aAAa;IA0BhB;;;OAGG;IACH,eAAe,CACb,GAAG,EAAE,MAAM,EAAE,EACb,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,EACxC,OAAO,CAAC,EAAE,MAAM,GACf,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAU7E"}

package/dist/backlog.js

@@ -0,0 +1,169 @@
+/**
+ * In-memory backlog store for PII access requests.
+ *
+ * RedactionMapStore captures placeholder → original text mappings from hooks.
+ * BacklogStore manages the access request lifecycle (create, list, resolve).
+ *
+ * Both are session-scoped: state lives in runtime memory only and is
+ * discarded when the process exits.
+ */
+/**
+ * Stores redaction mappings from hook handlers so that access request
+ * approvals can retrieve the original pre-redaction text.
+ *
+ * Each time a hook redacts text, it calls addMapping() with the
+ * redactor's mapping (placeholder → original). When an access request
+ * is approved, the backlog looks up the original text here.
+ */
+export class RedactionMapStore {
+    store = new Map();
+    maxMappings;
+    constructor(maxMappings = 10_000) {
+        this.maxMappings = maxMappings;
+    }
+    /** Merge new placeholder → original entries into the store. */
+    addMapping(mapping) {
+        for (const [placeholder, original] of Object.entries(mapping)) {
+            this.store.set(placeholder, original);
+        }
+        this.evict();
+    }
+    /** Look up the original text for a redacted placeholder. */
+    getOriginal(placeholder) {
+        return this.store.get(placeholder);
+    }
+    /** Reset all stored mappings. */
+    clear() {
+        this.store.clear();
+    }
+    /** Number of stored mappings. */
+    get size() {
+        return this.store.size;
+    }
+    /** Evict oldest entries (FIFO by Map insertion order) when over capacity. */
+    evict() {
+        if (this.store.size <= this.maxMappings)
+            return;
+        const excess = this.store.size - this.maxMappings;
+        const iter = this.store.keys();
+        for (let i = 0; i < excess; i++) {
+            const key = iter.next().value;
+            if (key !== undefined)
+                this.store.delete(key);
+        }
+    }
+}
+/**
+ * Manages PII access requests throughout their lifecycle.
+ *
+ * Requests transition through: pending → approved | denied | follow_up.
+ * A follow_up request can later be resolved to approved or denied.
+ */
+export class BacklogStore {
+    requests = new Map();
+    counter = 0;
+    redactionMap;
+    maxPending;
+    constructor(redactionMap, maxPending = 50) {
+        this.redactionMap = redactionMap;
+        this.maxPending = maxPending;
+    }
+    /** Number of pending requests. */
+    get pendingCount() {
+        let count = 0;
+        for (const req of this.requests.values()) {
+            if (req.status === "pending" || req.status === "follow_up")
+                count++;
+        }
+        return count;
+    }
+    /** Total number of requests in any status. */
+    get totalCount() {
+        return this.requests.size;
+    }
+    /**
+     * Create a new access request.
+     *
+     * Looks up the original text from the RedactionMapStore automatically.
+     * Throws if the pending request limit is reached.
+     */
+    createRequest(placeholder, entityType, reason, context) {
+        if (this.pendingCount >= this.maxPending) {
+            throw new Error(`Maximum pending requests reached (${this.maxPending}). Resolve existing requests before submitting new ones.`);
+        }
+        this.counter++;
+        const id = `REQ-${this.counter}`;
+        const originalText = this.redactionMap.getOriginal(placeholder) ?? null;
+        const request = {
+            id,
+            placeholder,
+            entityType,
+            originalText,
+            reason,
+            context: context ?? null,
+            status: "pending",
+            createdAt: new Date().toISOString(),
+            resolvedAt: null,
+            followUpMessage: null,
+            responseMessage: null,
+        };
+        this.requests.set(id, request);
+        return request;
+    }
+    /** Get a single request by ID. */
+    getRequest(id) {
+        return this.requests.get(id);
+    }
+    /** List requests, optionally filtered by status. */
+    listRequests(statusFilter) {
+        const all = Array.from(this.requests.values());
+        if (!statusFilter)
+            return all;
+        return all.filter((req) => req.status === statusFilter);
+    }
+    /**
+     * Resolve a single request.
+     *
+     * - approve: marks as approved, stores response message
+     * - deny: marks as denied, stores response message
+     * - follow_up: marks as follow_up, stores the follow-up question
+     *
+     * A follow_up request can be resolved again to approved or denied.
+     * Throws if request not found or already in a terminal state (approved/denied).
+     */
+    resolveRequest(id, action, message) {
+        const request = this.requests.get(id);
+        if (!request) {
+            throw new Error(`Request "${id}" not found.`);
+        }
+        if (request.status === "approved" || request.status === "denied") {
+            throw new Error(`Request "${id}" is already ${request.status}. Cannot resolve again.`);
+        }
+        const now = new Date().toISOString();
+        if (action === "follow_up") {
+            request.status = "follow_up";
+            request.followUpMessage = message ?? null;
+            return request;
+        }
+        request.status = action === "approve" ? "approved" : "denied";
+        request.resolvedAt = now;
+        request.responseMessage = message ?? null;
+        return request;
+    }
+    /**
+     * Resolve multiple requests with the same action.
+     * Returns an array of results (resolved request or error message per ID).
+     */
+    resolveMultiple(ids, action, message) {
+        return ids.map((id) => {
+            try {
+                const resolved = this.resolveRequest(id, action, message);
+                return { id, result: resolved, error: null };
+            }
+            catch (err) {
+                return { id, result: null, error: err.message };
+            }
+        });
+    }
+}
+//# sourceMappingURL=backlog.js.map

package/dist/backlog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backlog.js","sourceRoot":"","sources":["../src/backlog.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACpB,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,WAAW,CAAS;IAE5B,YAAY,WAAW,GAAG,MAAM;QAC9B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,+DAA+D;IAC/D,UAAU,CAAC,OAA+B;QACxC,KAAK,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,4DAA4D;IAC5D,WAAW,CAAC,WAAmB;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAED,iCAAiC;IACjC,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,iCAAiC;IACjC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,6EAA6E;IACrE,KAAK;QACX,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9B,IAAI,GAAG,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACf,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,OAAO,GAAG,CAAC,CAAC;IACZ,YAAY,CAAoB;IAChC,UAAU,CAAS;IAE3B,YAAY,YAA+B,EAAE,UAAU,GAAG,EAAE;QAC1D,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,kCAAkC;IAClC,IAAI,YAAY;QACd,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;gBAAE,KAAK,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8CAA8C;IAC9C,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,aAAa,CACX,WAAmB,EACnB,UAAkB,EAClB,MAAc,EACd,OAAgB;QAEhB,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,UAAU,0DAA0D,CAC/G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAExE,MAAM,OAAO,GAAkB;YAC7B,EAAE;YACF,WAAW;YACX,UAAU;YACV,YAAY;YACZ,MAAM;YACN,OAAO,EAAE,OAAO,IAAI,IAAI;YACxB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;SACtB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kCAAkC;IAClC,UAAU,CAAC,EAAU;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,oDAAoD;IACpD,YAAY,CAAC,YAA4B;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAY;YAAE,OAAO,GAAG,CAAC;QAC9B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACH,cAAc,CACZ,EAAU,EACV,MAAwC,EACxC,OAAgB;QAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,YAAY,EAAE,gBAAgB,OAAO,CAAC,MAAM,yBAAyB,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC;YAC7B,OAAO,CAAC,eAAe,GAAG,OAAO,IAAI,IAAI,CAAC;YAC1C,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9D,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC;QACzB,OAAO,CAAC,eAAe,GAAG,OAAO,IAAI,IAAI,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,eAAe,CACb,GAAa,EACb,MAAwC,EACxC,OAAgB;QAEhB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;YACpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC1D,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,YAAY,CAAC;AAoGpB,eAAO,MAAM,cAAc,EAAE,aAe5B,CAAC;AAEF,wBAAgB,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CA2D3E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,YAAY,CAAC;AAoGpB,eAAO,MAAM,cAAc,EAAE,aAgB5B,CAAC;AAEF,wBAAgB,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAqE3E"}

package/dist/config.js

@@ -84,6 +84,7 @@ export const DEFAULT_CONFIG = {
         entities: {},
     },
     auditEnabled: true,
+    maxPendingRequests: 50,
 };
 export function loadConfig(overrides) {
     const config = {
@@ -115,6 +116,11 @@ export function loadConfig(overrides) {
     if (typeof config.auditEnabled !== "boolean") {
         throw new Error(`auditEnabled must be true or false`);
     }
+    if (typeof config.maxPendingRequests !== "number" ||
+        !Number.isInteger(config.maxPendingRequests) ||
+        config.maxPendingRequests < 1) {
+        throw new Error(`maxPendingRequests must be a positive integer, got ${String(config.maxPendingRequests)}`);
+    }
     const normalizedActions = {};
     for (const [entityType, action] of Object.entries(config.entityActions)) {
         if (!VALID_GUARDRAIL_MODES.includes(action)) {

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAKd,MAAM,YAAY,CAAC;AAEpB,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAC7E,MAAM,uBAAuB,GAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5E,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAE5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,OAAO,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IACzC,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5B,aAAa,KAAK,IAAI,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACjD,QAAQ,CAAC,cAAc,CAAC,GAAG,gBAAgB,CAAC,UAAU,EAAE,sBAAsB,UAAU,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,KAAc;IAEd,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,4CAA4C,MAAM,CACzF,YAAY,CACb,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,mCAAmC,YAAY,EAAE,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACnD,UAAU,CAAC,gBAAgB,CAAC,GAAG,YAAY,CAAC;IAC9C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,QAAQ;IACxB,cAAc,EAAE,OAAO;IACvB,KAAK,EAAE,kCAAkC;IACzC,oBAAoB,EAAE,GAAG;IACzB,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,EAAE;IACjB,0BAA0B,EAAE,EAAE;IAC9B,SAAS,EAAE;QACT,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;KACb;IACD,YAAY,EAAE,IAAI;CACnB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,SAAiC;IAC1D,MAAM,MAAM,GAAkB;QAC5B,GAAG,cAAc;QACjB,GAAG,SAAS;QACZ,aAAa,EAAE;YACb,GAAG,cAAc,CAAC,aAAa;YAC/B,GAAG,CAAC,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC;SACnC;QACD,0BAA0B,EAAE;YAC1B,GAAG,cAAc,CAAC,0BAA0B;YAC5C,GAAG,CAAC,SAAS,CAAC,0BAA0B,IAAI,EAAE,CAAC;SAChD;KACF,CAAC;IAEF,MAAM,CAAC,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1F,MAAM,CAAC,0BAA0B,GAAG,gCAAgC,CAClE,MAAM,CAAC,0BAA0B,CAClC,CAAC;IAEF,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,cAAc,sBAAsB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,cAAc,sBAAsB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,CAAC,oBAAoB,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,iBAAiB,GAAoC,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,sBAAsB,UAAU,sBAAsB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClH,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACjD,iBAAiB,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,aAAa,GAAG,iBAAiB,CAAC;IAEzC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAKd,MAAM,YAAY,CAAC;AAEpB,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAC7E,MAAM,uBAAuB,GAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5E,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAE5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,OAAO,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IACzC,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5B,aAAa,KAAK,IAAI,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACjD,QAAQ,CAAC,cAAc,CAAC,GAAG,gBAAgB,CAAC,UAAU,EAAE,sBAAsB,UAAU,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,KAAc;IAEd,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,4CAA4C,MAAM,CACzF,YAAY,CACb,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,mCAAmC,YAAY,EAAE,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACnD,UAAU,CAAC,gBAAgB,CAAC,GAAG,YAAY,CAAC;IAC9C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,QAAQ;IACxB,cAAc,EAAE,OAAO;IACvB,KAAK,EAAE,kCAAkC;IACzC,oBAAoB,EAAE,GAAG;IACzB,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,EAAE;IACjB,0BAA0B,EAAE,EAAE;IAC9B,SAAS,EAAE;QACT,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;KACb;IACD,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,EAAE;CACvB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,SAAiC;IAC1D,MAAM,MAAM,GAAkB;QAC5B,GAAG,cAAc;QACjB,GAAG,SAAS;QACZ,aAAa,EAAE;YACb,GAAG,cAAc,CAAC,aAAa;YAC/B,GAAG,CAAC,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC;SACnC;QACD,0BAA0B,EAAE;YAC1B,GAAG,cAAc,CAAC,0BAA0B;YAC5C,GAAG,CAAC,SAAS,CAAC,0BAA0B,IAAI,EAAE,CAAC;SAChD;KACF,CAAC;IAEF,MAAM,CAAC,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1F,MAAM,CAAC,0BAA0B,GAAG,gCAAgC,CAClE,MAAM,CAAC,0BAA0B,CAClC,CAAC;IAEF,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,cAAc,sBAAsB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,cAAc,sBAAsB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,CAAC,oBAAoB,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,IACE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ;QAC7C,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC5C,MAAM,CAAC,kBAAkB,GAAG,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sDAAsD,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAoC,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,sBAAsB,UAAU,sBAAsB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClH,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACjD,iBAAiB,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,aAAa,GAAG,iBAAiB,CAAC;IAEzC,OAAO,MAAM,CAAC;AAChB,CAAC"}