@debugbundle/redaction 1.7.2 → 2.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +13 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -57
- package/dist/index.js.map +1 -1
- package/dist/keys.d.ts +3 -0
- package/dist/keys.d.ts.map +1 -0
- package/dist/keys.js +36 -0
- package/dist/keys.js.map +1 -0
- package/dist/telemetry-text.d.ts +3 -0
- package/dist/telemetry-text.d.ts.map +1 -0
- package/dist/telemetry-text.js +86 -0
- package/dist/telemetry-text.js.map +1 -0
- package/dist/telemetry.d.ts +17 -0
- package/dist/telemetry.d.ts.map +1 -0
- package/dist/telemetry.js +151 -0
- package/dist/telemetry.js.map +1 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -4,6 +4,8 @@ Sensitive-data redaction helpers used by DebugBundle SDKs and ingestion flows.
|
|
|
4
4
|
|
|
5
5
|
This package provides the shared payload scrubbing primitives that remove secrets and other unsafe fields before data leaves a process.
|
|
6
6
|
|
|
7
|
+
The legacy `redact(value, { sensitiveKeys })` helper keeps its existing replacement-list behavior for callers that use it directly. Production telemetry paths should use `sanitizeTelemetry`, whose extra keys are additive to the mandatory baseline. The SDKs and server must adopt that entry point at their own capture and storage boundaries; installing the library alone does not change an older SDK.
|
|
8
|
+
|
|
7
9
|
## Install
|
|
8
10
|
|
|
9
11
|
Published package:
|
|
@@ -22,9 +24,19 @@ const sanitized = redact({
|
|
|
22
24
|
password: "super-secret",
|
|
23
25
|
safe: "ok"
|
|
24
26
|
});
|
|
27
|
+
|
|
28
|
+
import { sanitizeTelemetry } from "@debugbundle/redaction";
|
|
29
|
+
|
|
30
|
+
const result = sanitizeTelemetry({ message: "Authorization: Bearer example" });
|
|
31
|
+
if (result.ok) {
|
|
32
|
+
// Use result.value only after validating the expected event schema.
|
|
33
|
+
} else {
|
|
34
|
+
// Withhold the unsafe event; result.reason is a fixed, payload-free code.
|
|
35
|
+
}
|
|
25
36
|
```
|
|
26
37
|
|
|
27
38
|
## Notes
|
|
28
39
|
|
|
29
40
|
- Published from the core-owned shared-package release workflow in `debugbundle/debugbundle`.
|
|
30
|
-
- Most applications consume this transitively through a DebugBundle SDK package.
|
|
41
|
+
- Most applications consume this transitively through a DebugBundle SDK package.
|
|
42
|
+
- The mandatory telemetry policy bounds depth, nodes, collection entries, each scanned string, total output, and field/query names. Field names longer than 128 UTF-16 code units and matching URL query pairs are omitted before segment matching. Applications should avoid collecting unnecessary data; this policy cannot recognize arbitrary private prose or encoded secrets.
|
package/dist/index.d.ts
CHANGED
|
@@ -11,5 +11,6 @@ export interface RedactionOptions {
|
|
|
11
11
|
sensitiveKeys?: string[];
|
|
12
12
|
replacement?: string;
|
|
13
13
|
}
|
|
14
|
+
export { sanitizeTelemetry, TELEMETRY_PRIVACY_POLICY_VERSION, type TelemetrySanitizationResult, type TelemetrySanitizationOptions } from "./telemetry.js";
|
|
14
15
|
export declare function redact<T extends JsonValue>(payload: T, options?: RedactionOptions): RedactionResult<T>;
|
|
15
16
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,EAAE,CAAC;AACjE,MAAM,MAAM,UAAU,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,SAAS;IAClD,QAAQ,EAAE,CAAC,CAAC;IACZ,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,EAAE,CAAC;AACjE,MAAM,MAAM,UAAU,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,SAAS;IAClD,QAAQ,EAAE,CAAC,CAAC;IACZ,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAGD,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAChC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,gBAAgB,CAAC;AAmDxB,wBAAgB,MAAM,CAAC,CAAC,SAAS,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,eAAe,CAAC,CAAC,CAAC,CAUtG"}
|
package/dist/index.js
CHANGED
|
@@ -1,60 +1,5 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
"secret",
|
|
4
|
-
"token",
|
|
5
|
-
"api_key",
|
|
6
|
-
"apikey",
|
|
7
|
-
"access_token",
|
|
8
|
-
"refresh_token",
|
|
9
|
-
"private_key",
|
|
10
|
-
"authorization",
|
|
11
|
-
"bearer",
|
|
12
|
-
"cookie",
|
|
13
|
-
"session_id",
|
|
14
|
-
"passwd",
|
|
15
|
-
"ssn",
|
|
16
|
-
"credit_card",
|
|
17
|
-
"card_number",
|
|
18
|
-
"cvv",
|
|
19
|
-
"cvc",
|
|
20
|
-
"pin",
|
|
21
|
-
"expiry",
|
|
22
|
-
"phone",
|
|
23
|
-
"otp",
|
|
24
|
-
"verification_code"
|
|
25
|
-
];
|
|
26
|
-
function canonicalizeSensitiveKey(value) {
|
|
27
|
-
return value.replace(/[^a-z0-9]+/g, "");
|
|
28
|
-
}
|
|
29
|
-
function splitKeyIntoSegments(key) {
|
|
30
|
-
return key
|
|
31
|
-
.trim()
|
|
32
|
-
.replace(/([a-z0-9])([A-Z])/g, "$1_$2")
|
|
33
|
-
.toLowerCase()
|
|
34
|
-
.split(/[^a-z0-9]+/)
|
|
35
|
-
.filter((segment) => segment.length > 0);
|
|
36
|
-
}
|
|
37
|
-
function buildKeyCandidates(key) {
|
|
38
|
-
const segments = splitKeyIntoSegments(key);
|
|
39
|
-
const candidates = new Set();
|
|
40
|
-
for (let start = 0; start < segments.length; start += 1) {
|
|
41
|
-
let combined = "";
|
|
42
|
-
for (let end = start; end < segments.length; end += 1) {
|
|
43
|
-
combined += segments[end];
|
|
44
|
-
candidates.add(combined);
|
|
45
|
-
}
|
|
46
|
-
}
|
|
47
|
-
return [...candidates];
|
|
48
|
-
}
|
|
49
|
-
function isSensitiveKey(key, sensitiveKeys) {
|
|
50
|
-
const normalized = key.trim().toLowerCase();
|
|
51
|
-
if (sensitiveKeys.includes(normalized)) {
|
|
52
|
-
return true;
|
|
53
|
-
}
|
|
54
|
-
const canonicalSensitiveKeys = new Set(sensitiveKeys.map(canonicalizeSensitiveKey));
|
|
55
|
-
const candidates = buildKeyCandidates(key);
|
|
56
|
-
return candidates.some((candidate) => canonicalSensitiveKeys.has(candidate));
|
|
57
|
-
}
|
|
1
|
+
import { DEFAULT_SENSITIVE_KEYS, isSensitiveKey } from "./keys.js";
|
|
2
|
+
export { sanitizeTelemetry, TELEMETRY_PRIVACY_POLICY_VERSION } from "./telemetry.js";
|
|
58
3
|
function redactInternal(value, path, sensitiveKeys, replacement, touchedPaths, seen) {
|
|
59
4
|
if (Array.isArray(value)) {
|
|
60
5
|
if (seen.has(value)) {
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAGjC,MAAM,gBAAgB,CAAC;AAExB,SAAS,cAAc,CACrB,KAAgB,EAChB,IAAY,EACZ,aAAgC,EAChC,WAAmB,EACnB,YAAsB,EACtB,IAAqB;IAErB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAC/C,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,CAC9H,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEhB,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;QAE5D,IAAI,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;YAC1B,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACtG,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,MAAM,CAAsB,OAAU,EAAE,OAA0B;IAChF,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,CAAC;IACpH,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,YAAY,CAAC;IACzD,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,OAAO,EAAU,CAAM,CAAC;IAEnH,OAAO;QACL,QAAQ;QACR,eAAe,EAAE,YAAY;KAC9B,CAAC;AACJ,CAAC"}
|
package/dist/keys.d.ts
ADDED
|
@@ -0,0 +1,3 @@
|
|
|
1
|
+
export declare const DEFAULT_SENSITIVE_KEYS: readonly ["password", "secret", "token", "api_key", "apikey", "access_token", "refresh_token", "private_key", "authorization", "bearer", "cookie", "session_id", "passwd", "ssn", "credit_card", "card_number", "cvv", "cvc", "pin", "expiry", "phone", "otp", "verification_code"];
|
|
2
|
+
export declare function isSensitiveKey(key: string, sensitiveKeys: readonly string[]): boolean;
|
|
3
|
+
//# sourceMappingURL=keys.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,qRAKzB,CAAC;AAeX,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAkBrF"}
|
package/dist/keys.js
ADDED
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
export const DEFAULT_SENSITIVE_KEYS = [
|
|
2
|
+
"password", "secret", "token", "api_key", "apikey", "access_token", "refresh_token",
|
|
3
|
+
"private_key", "authorization", "bearer", "cookie", "session_id", "passwd", "ssn",
|
|
4
|
+
"credit_card", "card_number", "cvv", "cvc", "pin", "expiry", "phone", "otp",
|
|
5
|
+
"verification_code"
|
|
6
|
+
];
|
|
7
|
+
function canonicalizeSensitiveKey(value) {
|
|
8
|
+
return value.toLowerCase().replace(/[^a-z0-9]+/g, "");
|
|
9
|
+
}
|
|
10
|
+
function splitKeyIntoSegments(key) {
|
|
11
|
+
return key
|
|
12
|
+
.trim()
|
|
13
|
+
.replace(/([a-z0-9])([A-Z])/g, "$1_$2")
|
|
14
|
+
.toLowerCase()
|
|
15
|
+
.split(/[^a-z0-9]+/)
|
|
16
|
+
.filter((segment) => segment.length > 0);
|
|
17
|
+
}
|
|
18
|
+
export function isSensitiveKey(key, sensitiveKeys) {
|
|
19
|
+
const normalized = key.trim().toLowerCase();
|
|
20
|
+
if (sensitiveKeys.includes(normalized)) {
|
|
21
|
+
return true;
|
|
22
|
+
}
|
|
23
|
+
const canonicalSensitiveKeys = new Set(sensitiveKeys.map(canonicalizeSensitiveKey));
|
|
24
|
+
const segments = splitKeyIntoSegments(key);
|
|
25
|
+
for (let start = 0; start < segments.length; start += 1) {
|
|
26
|
+
let combined = "";
|
|
27
|
+
for (let end = start; end < segments.length; end += 1) {
|
|
28
|
+
combined += segments[end];
|
|
29
|
+
if (canonicalSensitiveKeys.has(combined)) {
|
|
30
|
+
return true;
|
|
31
|
+
}
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
return false;
|
|
35
|
+
}
|
|
36
|
+
//# sourceMappingURL=keys.js.map
|
package/dist/keys.js.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe;IACnF,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK;IACjF,aAAa,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK;IAC3E,mBAAmB;CACX,CAAC;AAEX,SAAS,wBAAwB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,GAAG;SACP,IAAI,EAAE;SACN,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,aAAgC;IAC1E,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,KAAK,IAAI,GAAG,GAAG,KAAK,EAAE,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACtD,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"telemetry-text.d.ts","sourceRoot":"","sources":["../src/telemetry-text.ts"],"names":[],"mappings":"AAyDA,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,UAAO,GAAG,MAAM,CA2B7G"}
|
|
@@ -0,0 +1,86 @@
|
|
|
1
|
+
import { DEFAULT_SENSITIVE_KEYS, isSensitiveKey } from "./keys.js";
|
|
2
|
+
const REDACTED = "[REDACTED]";
|
|
3
|
+
const BUILTIN_LABELS = [...DEFAULT_SENSITIVE_KEYS, "client_secret", "x_api_key",
|
|
4
|
+
"accessToken", "refreshToken", "privateKey", "clientSecret"];
|
|
5
|
+
const ASSIGNMENT = new RegExp(`\\b(${BUILTIN_LABELS.join("|")})\\b(["']?\\s*[:=]\\s*)(?:"[^"]*"|'[^']*'|[^\\s&,;]+)`, "gi");
|
|
6
|
+
const HEADER = /\b(Authorization|Proxy-Authorization|Cookie|Set-Cookie)\s*:\s*[^\r\n]*/gi;
|
|
7
|
+
const PEM = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/gi;
|
|
8
|
+
const PEM_COMPLETE = new RegExp(PEM.source, "i");
|
|
9
|
+
const PEM_START = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/i;
|
|
10
|
+
const DEBUGBUNDLE_TOKEN = /\bdbundle_(?:proj|mem|probe|agent)_[A-Za-z0-9_-]+\b/g;
|
|
11
|
+
const BEARER = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+\/-]{6,}/gi;
|
|
12
|
+
const URL_TEXT = /\bhttps?:\/\/[^\s<>"']+/gi;
|
|
13
|
+
// Do not treat numeric substrings inside UUIDs, hashes, or identifier slugs as cards.
|
|
14
|
+
const CARD = /(?<![A-Za-z0-9_-])(?:\d[ -]?){12,18}\d(?![A-Za-z0-9_-])/g;
|
|
15
|
+
function isValidCard(value) {
|
|
16
|
+
const digits = value.replace(/[^0-9]/g, "");
|
|
17
|
+
if (digits.length < 13 || digits.length > 19 || /^(\d)\1+$/.test(digits)) {
|
|
18
|
+
return false;
|
|
19
|
+
}
|
|
20
|
+
let sum = 0;
|
|
21
|
+
for (let index = digits.length - 1; index >= 0; index -= 1) {
|
|
22
|
+
let digit = Number(digits[index]);
|
|
23
|
+
if ((digits.length - index) % 2 === 0) {
|
|
24
|
+
digit *= 2;
|
|
25
|
+
if (digit > 9)
|
|
26
|
+
digit -= 9;
|
|
27
|
+
}
|
|
28
|
+
sum += digit;
|
|
29
|
+
}
|
|
30
|
+
return sum % 10 === 0;
|
|
31
|
+
}
|
|
32
|
+
function scrubUrl(raw, keys) {
|
|
33
|
+
try {
|
|
34
|
+
const url = new URL(raw);
|
|
35
|
+
if (url.username || url.password) {
|
|
36
|
+
url.username = "REDACTED";
|
|
37
|
+
url.password = "";
|
|
38
|
+
}
|
|
39
|
+
const nextQuery = new URLSearchParams();
|
|
40
|
+
for (const [key, value] of url.searchParams) {
|
|
41
|
+
if (key.length > 128 || scrubCredentialText(key, keys, false) !== key)
|
|
42
|
+
continue;
|
|
43
|
+
nextQuery.append(key, isSensitiveKey(key, keys) || scrubCredentialText(value, keys, false) !== value ? REDACTED : value);
|
|
44
|
+
}
|
|
45
|
+
url.search = nextQuery.toString();
|
|
46
|
+
url.hash = "";
|
|
47
|
+
return url.toString();
|
|
48
|
+
}
|
|
49
|
+
catch {
|
|
50
|
+
// A malformed URL with a recognizable credential must not be emitted verbatim.
|
|
51
|
+
return REDACTED;
|
|
52
|
+
}
|
|
53
|
+
}
|
|
54
|
+
/** Bounded caller input only. Returns stable replacement text, never the matching secret. */
|
|
55
|
+
export function scrubCredentialText(input, additionalKeys, scanUrls = true) {
|
|
56
|
+
const keys = [...DEFAULT_SENSITIVE_KEYS, ...additionalKeys];
|
|
57
|
+
if (PEM_START.test(input) && !PEM_COMPLETE.test(input))
|
|
58
|
+
return REDACTED;
|
|
59
|
+
let output = input;
|
|
60
|
+
if (/(?:password|token|secret|authorization|cookie)%3[ad]/i.test(output)) {
|
|
61
|
+
try {
|
|
62
|
+
output = decodeURIComponent(output);
|
|
63
|
+
}
|
|
64
|
+
catch {
|
|
65
|
+
return REDACTED;
|
|
66
|
+
}
|
|
67
|
+
}
|
|
68
|
+
output = output.replace(PEM, REDACTED).replace(HEADER, "$1: [REDACTED]");
|
|
69
|
+
output = output.replace(BEARER, "$1 [REDACTED]").replace(DEBUGBUNDLE_TOKEN, REDACTED);
|
|
70
|
+
output = output.replace(ASSIGNMENT, "$1$2[REDACTED]");
|
|
71
|
+
if (additionalKeys.length > 0) {
|
|
72
|
+
for (const key of additionalKeys) {
|
|
73
|
+
const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
|
|
74
|
+
const named = new RegExp(`\\b(${escaped})\\b(["']?\\s*[:=]\\s*)(?:"[^"]*"|'[^']*'|[^\\s&,;]+)`, "gi");
|
|
75
|
+
output = output.replace(named, "$1$2[REDACTED]");
|
|
76
|
+
}
|
|
77
|
+
}
|
|
78
|
+
output = output.replace(CARD, (candidate) => isValidCard(candidate) ? REDACTED : candidate);
|
|
79
|
+
if (!scanUrls)
|
|
80
|
+
return output;
|
|
81
|
+
return output.replace(URL_TEXT, (matched) => {
|
|
82
|
+
const trailing = matched.match(/[).,;]+$/)?.[0] ?? "";
|
|
83
|
+
return scrubUrl(matched.slice(0, matched.length - trailing.length), keys) + trailing;
|
|
84
|
+
});
|
|
85
|
+
}
|
|
86
|
+
//# sourceMappingURL=telemetry-text.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"telemetry-text.js","sourceRoot":"","sources":["../src/telemetry-text.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,cAAc,GAAG,CAAC,GAAG,sBAAsB,EAAE,eAAe,EAAE,WAAW;IAC7E,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,IAAI,MAAM,CAC3B,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,uDAAuD,EACtF,IAAI,CACL,CAAC;AACF,MAAM,MAAM,GAAG,0EAA0E,CAAC;AAC1F,MAAM,GAAG,GAAG,4GAA4G,CAAC;AACzH,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACjD,MAAM,SAAS,GAAG,oDAAoD,CAAC;AACvE,MAAM,iBAAiB,GAAG,sDAAsD,CAAC;AACjF,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAC7D,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAC7C,sFAAsF;AACtF,MAAM,IAAI,GAAG,0DAA0D,CAAC;AAExE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,IAAI,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAuB;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC;YAC1B,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YAC5C,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,mBAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG;gBAAE,SAAS;YAChF,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3H,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,cAAiC,EAAE,QAAQ,GAAG,IAAI;IACnG,MAAM,IAAI,GAAG,CAAC,GAAG,sBAAsB,EAAE,GAAG,cAAc,CAAC,CAAC;IAC5D,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxE,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,uDAAuD,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACzE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACtF,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACtD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,OAAO,uDAAuD,EAAE,IAAI,CAAC,CAAC;YACtG,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5F,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;QAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
import type { JsonValue } from "./index.js";
|
|
2
|
+
export declare const TELEMETRY_PRIVACY_POLICY_VERSION = "telemetry-privacy-v1";
|
|
3
|
+
export interface TelemetrySanitizationOptions {
|
|
4
|
+
additionalKeys?: readonly string[];
|
|
5
|
+
maxTotalBytes?: number;
|
|
6
|
+
}
|
|
7
|
+
export type TelemetrySanitizationResult = {
|
|
8
|
+
ok: true;
|
|
9
|
+
value: JsonValue;
|
|
10
|
+
redactionCount: number;
|
|
11
|
+
} | {
|
|
12
|
+
ok: false;
|
|
13
|
+
reason: "unsafe_input" | "budget_exceeded";
|
|
14
|
+
};
|
|
15
|
+
/** Mandatory telemetry policy; unlike the legacy `redact` helper, custom keys are additive. */
|
|
16
|
+
export declare function sanitizeTelemetry(value: unknown, options?: TelemetrySanitizationOptions): TelemetrySanitizationResult;
|
|
17
|
+
//# sourceMappingURL=telemetry.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,eAAO,MAAM,gCAAgC,yBAAyB,CAAC;AAOvE,MAAM,WAAW,4BAA4B;IAC3C,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,GAAG,iBAAiB,CAAA;CAAE,CAAC;AA8G9D,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,4BAAiC,GAAG,2BAA2B,CA2BzH"}
|
|
@@ -0,0 +1,151 @@
|
|
|
1
|
+
import { DEFAULT_SENSITIVE_KEYS, isSensitiveKey } from "./keys.js";
|
|
2
|
+
import { scrubCredentialText } from "./telemetry-text.js";
|
|
3
|
+
const REDACTED = "[REDACTED]";
|
|
4
|
+
export const TELEMETRY_PRIVACY_POLICY_VERSION = "telemetry-privacy-v1";
|
|
5
|
+
const MAX_DEPTH = 16;
|
|
6
|
+
const MAX_NODES = 4096;
|
|
7
|
+
const MAX_ENTRIES = 256;
|
|
8
|
+
const MAX_STRING_BYTES = 16 * 1024;
|
|
9
|
+
const MAX_TOTAL_BYTES = 256 * 1024;
|
|
10
|
+
class BudgetExceeded extends Error {
|
|
11
|
+
}
|
|
12
|
+
function byteLength(value) {
|
|
13
|
+
return new TextEncoder().encode(value).length;
|
|
14
|
+
}
|
|
15
|
+
function mask(state) {
|
|
16
|
+
state.redactionCount += 1;
|
|
17
|
+
return REDACTED;
|
|
18
|
+
}
|
|
19
|
+
function sanitizeString(value, state, allowStructured) {
|
|
20
|
+
if (value.length > MAX_STRING_BYTES)
|
|
21
|
+
return mask(state);
|
|
22
|
+
const length = byteLength(value);
|
|
23
|
+
if (length > MAX_STRING_BYTES)
|
|
24
|
+
return mask(state);
|
|
25
|
+
state.textBytes += length;
|
|
26
|
+
if (state.textBytes > state.maxTotalBytes)
|
|
27
|
+
throw new BudgetExceeded();
|
|
28
|
+
if (allowStructured && (value.startsWith("{") || value.startsWith("["))) {
|
|
29
|
+
try {
|
|
30
|
+
const parsed = JSON.parse(value);
|
|
31
|
+
if (typeof parsed === "object" && parsed !== null) {
|
|
32
|
+
const nested = sanitizeValue(parsed, state, 0, false);
|
|
33
|
+
const encoded = JSON.stringify(nested);
|
|
34
|
+
if (encoded !== value)
|
|
35
|
+
state.redactionCount += 1;
|
|
36
|
+
return encoded;
|
|
37
|
+
}
|
|
38
|
+
}
|
|
39
|
+
catch (error) {
|
|
40
|
+
if (error instanceof BudgetExceeded)
|
|
41
|
+
throw error;
|
|
42
|
+
// Malformed structured content with a recognizable sensitive label is withheld below.
|
|
43
|
+
}
|
|
44
|
+
}
|
|
45
|
+
const result = scrubCredentialText(value, state.extra);
|
|
46
|
+
if (result !== value)
|
|
47
|
+
state.redactionCount += 1;
|
|
48
|
+
if ((value.startsWith("{") || value.startsWith("[")) && result === value &&
|
|
49
|
+
/(?:password|token|secret|authorization|cookie)["']?\s*[:=]/i.test(value)) {
|
|
50
|
+
return mask(state);
|
|
51
|
+
}
|
|
52
|
+
return result;
|
|
53
|
+
}
|
|
54
|
+
function sanitizeValue(value, state, depth, allowStructured) {
|
|
55
|
+
state.nodes += 1;
|
|
56
|
+
if (state.nodes > MAX_NODES)
|
|
57
|
+
throw new BudgetExceeded();
|
|
58
|
+
if (depth > MAX_DEPTH)
|
|
59
|
+
return mask(state);
|
|
60
|
+
if (typeof value === "string")
|
|
61
|
+
return sanitizeString(value, state, allowStructured);
|
|
62
|
+
if (value === null || typeof value === "boolean")
|
|
63
|
+
return value;
|
|
64
|
+
if (typeof value === "number" && Number.isFinite(value))
|
|
65
|
+
return value;
|
|
66
|
+
if (typeof value !== "object")
|
|
67
|
+
throw new TypeError("unsafe_input");
|
|
68
|
+
if (state.seen.has(value))
|
|
69
|
+
return "[Circular]";
|
|
70
|
+
state.seen.add(value);
|
|
71
|
+
try {
|
|
72
|
+
if (Array.isArray(value)) {
|
|
73
|
+
if (value.length > MAX_ENTRIES)
|
|
74
|
+
return mask(state);
|
|
75
|
+
return Array.from({ length: value.length }, (_, index) => {
|
|
76
|
+
const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
|
|
77
|
+
if (descriptor === undefined || !("value" in descriptor))
|
|
78
|
+
throw new TypeError("unsafe_input");
|
|
79
|
+
return sanitizeValue(descriptor.value, state, depth + 1, allowStructured);
|
|
80
|
+
});
|
|
81
|
+
}
|
|
82
|
+
if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {
|
|
83
|
+
throw new TypeError("unsafe_input");
|
|
84
|
+
}
|
|
85
|
+
const keys = Object.keys(value);
|
|
86
|
+
if (keys.length > MAX_ENTRIES)
|
|
87
|
+
return mask(state);
|
|
88
|
+
const result = {};
|
|
89
|
+
for (const key of keys) {
|
|
90
|
+
if (key.length > 128) {
|
|
91
|
+
state.redactionCount += 1;
|
|
92
|
+
continue;
|
|
93
|
+
}
|
|
94
|
+
state.textBytes += byteLength(key);
|
|
95
|
+
if (state.textBytes > state.maxTotalBytes)
|
|
96
|
+
throw new BudgetExceeded();
|
|
97
|
+
const safeKey = scrubCredentialText(key, state.extra);
|
|
98
|
+
if (safeKey !== key) {
|
|
99
|
+
state.redactionCount += 1;
|
|
100
|
+
continue;
|
|
101
|
+
}
|
|
102
|
+
const descriptor = Object.getOwnPropertyDescriptor(value, key);
|
|
103
|
+
if (descriptor === undefined || !("value" in descriptor))
|
|
104
|
+
throw new TypeError("unsafe_input");
|
|
105
|
+
const safeValue = isSensitiveKey(key, state.keys)
|
|
106
|
+
? mask(state)
|
|
107
|
+
: sanitizeValue(descriptor.value, state, depth + 1, allowStructured);
|
|
108
|
+
Object.defineProperty(result, key, {
|
|
109
|
+
value: safeValue,
|
|
110
|
+
enumerable: true,
|
|
111
|
+
configurable: true,
|
|
112
|
+
writable: true
|
|
113
|
+
});
|
|
114
|
+
}
|
|
115
|
+
return result;
|
|
116
|
+
}
|
|
117
|
+
finally {
|
|
118
|
+
state.seen.delete(value);
|
|
119
|
+
}
|
|
120
|
+
}
|
|
121
|
+
/** Mandatory telemetry policy; unlike the legacy `redact` helper, custom keys are additive. */
|
|
122
|
+
export function sanitizeTelemetry(value, options = {}) {
|
|
123
|
+
try {
|
|
124
|
+
const extra = options.additionalKeys ?? [];
|
|
125
|
+
if (extra.length > 128 || extra.some((key) => typeof key !== "string" || key.length > 64 || !key.trim())) {
|
|
126
|
+
return { ok: false, reason: "unsafe_input" };
|
|
127
|
+
}
|
|
128
|
+
const maxTotalBytes = options.maxTotalBytes ?? MAX_TOTAL_BYTES;
|
|
129
|
+
if (!Number.isInteger(maxTotalBytes) || maxTotalBytes < 1 || maxTotalBytes > 512 * 1024) {
|
|
130
|
+
return { ok: false, reason: "unsafe_input" };
|
|
131
|
+
}
|
|
132
|
+
const state = {
|
|
133
|
+
nodes: 0,
|
|
134
|
+
textBytes: 0,
|
|
135
|
+
redactionCount: 0,
|
|
136
|
+
seen: new WeakSet(),
|
|
137
|
+
keys: [...DEFAULT_SENSITIVE_KEYS, ...extra],
|
|
138
|
+
extra,
|
|
139
|
+
maxTotalBytes
|
|
140
|
+
};
|
|
141
|
+
const sanitized = sanitizeValue(value, state, 0, true);
|
|
142
|
+
if (byteLength(JSON.stringify(sanitized)) > maxTotalBytes) {
|
|
143
|
+
return { ok: false, reason: "budget_exceeded" };
|
|
144
|
+
}
|
|
145
|
+
return { ok: true, value: sanitized, redactionCount: state.redactionCount };
|
|
146
|
+
}
|
|
147
|
+
catch (error) {
|
|
148
|
+
return { ok: false, reason: error instanceof BudgetExceeded ? "budget_exceeded" : "unsafe_input" };
|
|
149
|
+
}
|
|
150
|
+
}
|
|
151
|
+
//# sourceMappingURL=telemetry.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,CAAC,MAAM,gCAAgC,GAAG,sBAAsB,CAAC;AACvE,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAC;AAqBnC,MAAM,cAAe,SAAQ,KAAK;CAAG;AAErC,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AAChD,CAAC;AAED,SAAS,IAAI,CAAC,KAAgB;IAC5B,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;IAC1B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,KAAgB,EAAE,eAAwB;IAC/E,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,GAAG,gBAAgB;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC;IAC1B,IAAI,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,aAAa;QAAE,MAAM,IAAI,cAAc,EAAE,CAAC;IAEtE,IAAI,eAAe,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;gBACtD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACvC,IAAI,OAAO,KAAK,KAAK;oBAAE,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;gBACjD,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,sFAAsF;QACxF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,KAAK;QAAE,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,KAAK,KAAK;QACpE,6DAA6D,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAgB,EAAE,KAAa,EAAE,eAAwB;IAC9F,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACjB,IAAI,KAAK,CAAC,KAAK,GAAG,SAAS;QAAE,MAAM,IAAI,cAAc,EAAE,CAAC;IACxD,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACpF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC;IAEnE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;gBACvD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC;oBAAE,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC;gBAC9F,OAAO,aAAa,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/F,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,MAAM,GAA8B,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACrB,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,KAAK,CAAC,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,aAAa;gBAAE,MAAM,IAAI,cAAc,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;gBACpB,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC;YAC9F,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;gBACb,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;YACvE,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;gBACjC,KAAK,EAAE,SAAS;gBAChB,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,IAAI;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,UAAwC,EAAE;IAC1F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;YACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,GAAc;YACvB,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;YACZ,cAAc,EAAE,CAAC;YACjB,IAAI,EAAE,IAAI,OAAO,EAAU;YAC3B,IAAI,EAAE,CAAC,GAAG,sBAAsB,EAAE,GAAG,KAAK,CAAC;YAC3C,KAAK;YACL,aAAa;SACd,CAAC;QACF,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,GAAG,aAAa,EAAE,CAAC;YAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,YAAY,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IACrG,CAAC;AACH,CAAC"}
|