@discretion/core 0.1.0

package/dist/src/protect.d.ts

@@ -0,0 +1,146 @@
+/**
+ * protect.ts — the one-call entry point: text in, masked text and a report out.
+ *
+ * ─────────────────────────────────────────────────────────────────────────
+ * WHY THIS EXISTS (M12)
+ *
+ * Every stage of the pipeline was already exported, and that is not the same
+ * as being usable. Getting from a string to "here is the masked text and what
+ * was found" meant composing eight core calls in a specific order, holding an
+ * identity map between two of them, and importing the fitted calibration model
+ * from a SECOND package through an unchecked cast. The extension's
+ * `analyzeText` does exactly that in about ninety lines.
+ *
+ * SPEC's M12 acceptance test is that "a developer who has never seen this repo
+ * can npm install the package and run detection and masking from the docs
+ * alone". Documenting those ninety lines would satisfy the letter of it and
+ * miss the point: the order matters for correctness, not just for convenience,
+ * and a consumer who gets it wrong gets quietly worse results rather than an
+ * error. Two of the orderings below were bugs found in earlier milestones.
+ *
+ * The individual stages remain exported. This is the supported path, not the
+ * only one.
+ *
+ * ─────────────────────────────────────────────────────────────────────────
+ * WHAT `mask()` IS, AND WHY IT IS NOT THIS
+ *
+ * `mask()` in `mask/masker.ts` also takes a string and returns masked text,
+ * and it looks like this function's smaller sibling. It runs STAGE 1 ONLY —
+ * no context scoring, no calibration, no profile decision, no NER. It exists
+ * for tests and for the playground's Stage-1 baseline. A consumer who reached
+ * for it expecting the full engine would get uncalibrated confidences and none
+ * of Stage 3's false-positive suppression, with nothing to indicate the
+ * difference. `stagesRun` on this function's result is what makes the
+ * distinction legible.
+ *
+ * ─────────────────────────────────────────────────────────────────────────
+ * FAIL-CLOSED IS THE CALLER'S JOB, AND THIS FUNCTION PRESERVES IT
+ *
+ * Nothing here catches an error from a stage. `detect` propagates
+ * `DetectionTimeoutError` and `DetectorError` deliberately, and so does this.
+ * A caller that wrapped it in a try/catch and treated the failure as "nothing
+ * found" would have built the exact failure SPEC.md calls a critical bug, so
+ * the failure is left where it cannot be mistaken for a result.
+ */
+import { type CalibrationModel } from './fuse/calibrate.js';
+import { type ProfileName, type SensitivityProfile, type UserLists } from './fuse/profiles.js';
+import { Vault } from './mask/vault.js';
+import type { ExposureReport } from './exposure/index.js';
+import type { NerRecognizer } from './ner/types.js';
+import type { DetectionStage, EntityExplanation, EntityType, SubstitutionMode } from './types.js';
+export interface ProtectOptions {
+    /**
+     * Which findings are worth reporting. A `ProfileName` selects one of the
+     * three SPEC profiles; a `SensitivityProfile` supplies your own.
+     * Default: `'balanced'`.
+     */
+    readonly profile?: ProfileName | SensitivityProfile;
+    /** Values to always report (`deny`) or never report (`allow`). */
+    readonly lists?: UserLists;
+    /**
+     * The region used for identifiers that are ambiguous without one.
+     *
+     * Not a tie-breaker: a phone number written in national form cannot be
+     * validated at all without a region, so leaving this unset does not lower
+     * its confidence — the detector reports nothing.
+     */
+    readonly defaultRegion?: string;
+    /** Per-type opt-out, applied before a surrogate is minted. */
+    readonly typeAllowed?: (type: EntityType) => boolean;
+    /** `'surrogate'` (realistic stand-ins, default) or `'token'` (`[EMAIL_1]`). */
+    readonly mode?: SubstitutionMode;
+    /** Varies surrogate selection. Fixed input plus fixed seed is reproducible. */
+    readonly seed?: number;
+    /**
+     * The vault that remembers which surrogate stood in for which value.
+     *
+     * REQUIRED FOR RESTORATION, and required for consistency across calls: pass
+     * the same vault to every `protect()` in a conversation and a value seen
+     * twice gets the same surrogate. Omit it and a fresh vault is created for
+     * this call alone, which is correct for one-shot masking and wrong for
+     * anything that restores a reply later.
+     */
+    readonly vault?: Vault;
+    /**
+     * Stage 2. Omit to run Stages 0, 1, 3 and 4 only.
+     *
+     * Not defaulted to a model on purpose: the recogniser pulls in the ONNX
+     * runtime, which this package does not depend on. See the "Stage 2" section
+     * of the usage guide.
+     */
+    readonly ner?: NerRecognizer;
+    /** Overrides the shipped calibration model. For eval work, not for use. */
+    readonly calibration?: CalibrationModel;
+}
+/** One finding, with everything needed to show it and nothing that leaks it. */
+export interface ProtectedEntity {
+    /**
+     * The vault id, stable across re-analyses of the same value.
+     *
+     * Derived from the value rather than from position, so a caller tracking a
+     * user's per-item decisions keeps them when text is edited earlier in the
+     * document. An index-based id would silently move the decision.
+     */
+    readonly id: string;
+    readonly type: EntityType;
+    /** Calibrated, comparable across types. Never the raw detector score. */
+    readonly confidence: number;
+    /** Which evidence fired. Structured, so callers can render it in any language. */
+    readonly explanation: EntityExplanation;
+    /** What replaced it in `maskedText`. */
+    readonly surrogate: string;
+    /** Offsets into the ORIGINAL text, not the normalized text. */
+    readonly originalStart: number;
+    readonly originalEnd: number;
+}
+export interface ProtectResult {
+    /** The input with every reported value replaced. Safe to send. */
+    readonly maskedText: string;
+    readonly entities: readonly ProtectedEntity[];
+    /** How exposed the document was, before masking. */
+    readonly exposure: ExposureReport;
+    /**
+     * Which stages actually ran.
+     *
+     * DERIVED from the options, never declared, so "Stage 2 ran" is a claim the
+     * code supports rather than a comment. Absence of `'stage2-ner'` is how a
+     * caller knows names were not looked for.
+     */
+    readonly stagesRun: readonly DetectionStage[];
+    /**
+     * The vault holding the originals. Pass it to `restore()` to reverse this.
+     *
+     * The same instance passed in `options.vault`, or the one created for this
+     * call. It holds plaintext originals in memory: SPEC.md forbids persisting
+     * it, and the extension clears it per tab session.
+     */
+    readonly vault: Vault;
+}
+/**
+ * Detect sensitive values in `text` and replace them with stand-ins.
+ *
+ * Throws on any stage failure rather than returning an empty result. See the
+ * fail-closed note in this file's header.
+ */
+export declare function protect(text: string, options?: ProtectOptions): Promise<ProtectResult>;
+//# sourceMappingURL=protect.d.ts.map

package/dist/src/protect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protect.d.ts","sourceRoot":"","sources":["../../src/protect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAKH,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,EAAoB,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGjH,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAIxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAKpB,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,kBAAkB,CAAC;IACpD,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC;IACrD,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;CACzC;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,wCAAwC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB;AAaD;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAyGhG"}

package/dist/src/protect.js

@@ -0,0 +1,161 @@
+/**
+ * protect.ts — the one-call entry point: text in, masked text and a report out.
+ *
+ * ─────────────────────────────────────────────────────────────────────────
+ * WHY THIS EXISTS (M12)
+ *
+ * Every stage of the pipeline was already exported, and that is not the same
+ * as being usable. Getting from a string to "here is the masked text and what
+ * was found" meant composing eight core calls in a specific order, holding an
+ * identity map between two of them, and importing the fitted calibration model
+ * from a SECOND package through an unchecked cast. The extension's
+ * `analyzeText` does exactly that in about ninety lines.
+ *
+ * SPEC's M12 acceptance test is that "a developer who has never seen this repo
+ * can npm install the package and run detection and masking from the docs
+ * alone". Documenting those ninety lines would satisfy the letter of it and
+ * miss the point: the order matters for correctness, not just for convenience,
+ * and a consumer who gets it wrong gets quietly worse results rather than an
+ * error. Two of the orderings below were bugs found in earlier milestones.
+ *
+ * The individual stages remain exported. This is the supported path, not the
+ * only one.
+ *
+ * ─────────────────────────────────────────────────────────────────────────
+ * WHAT `mask()` IS, AND WHY IT IS NOT THIS
+ *
+ * `mask()` in `mask/masker.ts` also takes a string and returns masked text,
+ * and it looks like this function's smaller sibling. It runs STAGE 1 ONLY —
+ * no context scoring, no calibration, no profile decision, no NER. It exists
+ * for tests and for the playground's Stage-1 baseline. A consumer who reached
+ * for it expecting the full engine would get uncalibrated confidences and none
+ * of Stage 3's false-positive suppression, with nothing to indicate the
+ * difference. `stagesRun` on this function's result is what makes the
+ * distinction legible.
+ *
+ * ─────────────────────────────────────────────────────────────────────────
+ * FAIL-CLOSED IS THE CALLER'S JOB, AND THIS FUNCTION PRESERVES IT
+ *
+ * Nothing here catches an error from a stage. `detect` propagates
+ * `DetectionTimeoutError` and `DetectorError` deliberately, and so does this.
+ * A caller that wrapped it in a try/catch and treated the failure as "nothing
+ * found" would have built the exact failure SPEC.md calls a critical bug, so
+ * the failure is left where it cannot be mistaken for a result.
+ */
+import { CALIBRATION_MODEL } from '@discretion/data';
+import { computeExposure } from './exposure/index.js';
+import { calibrate } from './fuse/calibrate.js';
+import { toCalibrationModel } from './fuse/defaultCalibration.js';
+import { toDetectedEntity } from './fuse/explain.js';
+import { PROFILES, decide } from './fuse/profiles.js';
+import { resolveOverlaps } from './fuse/resolve.js';
+import { maskOriginal } from './mask/masker.js';
+import { Vault } from './mask/vault.js';
+import { normalize } from './normalization.js';
+import { detect } from './pipeline.js';
+/** The shipped model, converted once and checked rather than cast. */
+const DEFAULT_CALIBRATION = toCalibrationModel(CALIBRATION_MODEL).model;
+function resolveProfile(profile) {
+    if (profile === undefined)
+        return PROFILES.balanced;
+    if (typeof profile !== 'string')
+        return profile;
+    if (profile === 'custom') {
+        throw new Error("protect: profile 'custom' names a shape, not a policy - pass a SensitivityProfile");
+    }
+    return PROFILES[profile];
+}
+/**
+ * Detect sensitive values in `text` and replace them with stand-ins.
+ *
+ * Throws on any stage failure rather than returning an empty result. See the
+ * fail-closed note in this file's header.
+ */
+export async function protect(text, options = {}) {
+    const profile = resolveProfile(options.profile);
+    const calibration = options.calibration ?? DEFAULT_CALIBRATION;
+    const vault = options.vault ?? new Vault();
+    const normalization = normalize(text);
+    const outcome = await detect(normalization, {
+        ...(options.ner === undefined ? {} : { ner: options.ner }),
+        ...(options.defaultRegion === undefined
+            ? {}
+            : { stage1: { defaultRegion: options.defaultRegion } }),
+    });
+    // Resolve overlaps BEFORE calibrating or scoring exposure. An unresolved set
+    // double-counts every overlap, so one credential matched by three detectors
+    // would appear three times and inflate the exposure score threefold.
+    const resolution = resolveOverlaps(outcome.emitted
+        .filter((scored) => scored.candidate.sensitive)
+        .map((scored) => ({ candidate: scored.candidate, confidence: scored.contextConfidence })));
+    // Keyed by object identity: `resolveOverlaps` returns the same candidate
+    // objects it was given, and the scored record carries the Stage 3
+    // contributions the explanation needs.
+    const scoredByCandidate = new Map();
+    for (const scored of outcome.emitted)
+        scoredByCandidate.set(scored.candidate, scored);
+    const reported = [];
+    for (const item of resolution.emitted) {
+        const scored = scoredByCandidate.get(item.candidate);
+        if (scored === undefined)
+            continue;
+        const confidence = calibrate(calibration, item.candidate.type, item.confidence);
+        const decision = decide({ type: item.candidate.type, text: item.candidate.text, calibratedConfidence: confidence }, profile, options.lists ?? {});
+        if (!decision.report)
+            continue;
+        if (options.typeAllowed?.(item.candidate.type) === false)
+            continue;
+        reported.push({ scored, confidence });
+    }
+    // Surrogates come from the masker rather than from `chooseSurrogate`
+    // directly, because the masker enforces the properties a surrogate must
+    // have before it is shown: consistency through the vault, and the collision
+    // check that stops a surrogate from containing the very value it replaces.
+    // Computing them any other way shows the user one string and substitutes
+    // another.
+    const masked = maskOriginal(text, reported.map((entry) => entry.scored.candidate), vault, {
+        ...(options.mode === undefined ? {} : { mode: options.mode }),
+        ...(options.seed === undefined ? {} : { seed: options.seed }),
+    });
+    const surrogateAt = new Map();
+    for (const entity of masked.entities) {
+        surrogateAt.set(entity.originalStart, {
+            replacement: entity.replacement,
+            vaultId: entity.vaultId,
+        });
+    }
+    const entities = [];
+    for (const { scored, confidence } of reported) {
+        const candidate = scored.candidate;
+        const surrogate = surrogateAt.get(candidate.originalStart);
+        if (surrogate === undefined)
+            continue;
+        entities.push({
+            id: surrogate.vaultId,
+            type: candidate.type,
+            confidence,
+            explanation: toDetectedEntity({ scored, calibratedConfidence: confidence }).explanation,
+            surrogate: surrogate.replacement,
+            originalStart: candidate.originalStart,
+            originalEnd: candidate.originalEnd,
+        });
+    }
+    // Not a warning. A reported detection with no surrogate is one the caller
+    // cannot show and cannot let the user revert, while the masker substitutes
+    // it anyway.
+    if (entities.length !== reported.length) {
+        throw new Error(`protect: masking produced ${String(entities.length)} surrogates for ${String(reported.length)} reported detections`);
+    }
+    const stagesRun = ['stage1-validated-identifier'];
+    if (options.ner !== undefined)
+        stagesRun.push('stage2-ner');
+    stagesRun.push('stage3-context', 'stage4-fusion');
+    return {
+        maskedText: masked.maskedText,
+        entities,
+        exposure: computeExposure(entities.map((entity) => ({ type: entity.type, calibratedConfidence: entity.confidence }))),
+        stagesRun,
+        vault,
+    };
+}
+//# sourceMappingURL=protect.js.map

package/dist/src/protect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protect.js","sourceRoot":"","sources":["../../src/protect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAyB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAA6D,MAAM,oBAAoB,CAAC;AACjH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAWvC,sEAAsE;AACtE,MAAM,mBAAmB,GAAqB,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC;AA6F1F,SAAS,cAAc,CAAC,OAAkC;IACxD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,UAA0B,EAAE;IACtE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,EAAE,CAAC;IAE3C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE;QAC1C,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;KAC1D,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,UAAU,GAAG,eAAe,CAChC,OAAO,CAAC,OAAO;SACZ,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC;SAC9C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAC5F,CAAC;IAEF,yEAAyE;IACzE,kEAAkE;IAClE,uCAAuC;IACvC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC/E,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO;QAAE,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEtF,MAAM,QAAQ,GAA6D,EAAE,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAG,MAAM,CACrB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,EAC1F,OAAO,EACP,OAAO,CAAC,KAAK,IAAI,EAAE,CACpB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,SAAS;QAC/B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,SAAS;QACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,WAAW;IACX,MAAM,MAAM,GAAG,YAAY,CACzB,IAAI,EACJ,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAC/C,KAAK,EACL;QACE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;KAC9D,CACF,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoD,CAAC;IAChF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE;YACpC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,SAAS,CAAC,OAAO;YACrB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,UAAU;YACV,WAAW,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW;YACvF,SAAS,EAAE,SAAS,CAAC,WAAW;YAChC,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,WAAW,EAAE,SAAS,CAAC,WAAW;SACnC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,aAAa;IACb,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CACrH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAqB,CAAC,6BAA6B,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5D,SAAS,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAElD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ;QACR,QAAQ,EAAE,eAAe,CACvB,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAC3F;QACD,SAAS;QACT,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/src/scripts.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Script detection using native Unicode property escapes (\p{Script=...}).
+ * No external library.
+ *
+ * Characters are classified by CODE POINT (never by UTF-16 code unit), so
+ * astral-plane characters — e.g. CJK Extension B ideographs — are handled
+ * correctly.
+ */
+import type { ScriptInfo, ScriptName } from './types.js';
+/**
+ * Classification of one code point:
+ *  - 'neutral'   — not a letter (whitespace, digits, punctuation, symbols,
+ *                  combining marks, controls). Ignored for dominance because
+ *                  it would skew the result.
+ *  - a ScriptName — a letter of that script ('other' for unsupported scripts).
+ */
+export type CodePointClass = ScriptName | 'neutral';
+/** Classify a single code point. Exported for use by the fold transform. */
+export declare function classifyCodePoint(cp: number): CodePointClass;
+/**
+ * The ScriptName for a single character (the first code point of `char`).
+ * Script-neutral characters and letters of unsupported scripts both report
+ * 'other'.
+ */
+export declare function getCharScript(char: string): ScriptName;
+/**
+ * Whether two scripts may legitimately co-occur in one token (same script,
+ * or both members of a compatibility group).
+ */
+export declare function scriptsCompatible(a: ScriptName, b: ScriptName): boolean;
+/**
+ * Per-script letter counts, the dominant script, and whether the text mixes
+ * scripts. Whitespace, digits, and punctuation are ignored — they are
+ * script-neutral and would skew dominance.
+ */
+export declare function detectScripts(text: string): ScriptInfo;
+//# sourceMappingURL=scripts.d.ts.map

package/dist/src/scripts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripts.d.ts","sourceRoot":"","sources":["../../src/scripts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAkCzD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,SAAS,CAAC;AAYpD,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,CAsB5D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKtD;AAeD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAIvE;AASD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CA8BtD"}

package/dist/src/scripts.js

@@ -0,0 +1,145 @@
+/**
+ * Script membership tests, checked in this order. Kana merges Hiragana and
+ * Katakana into one bucket because the pipeline treats Japanese syllabaries
+ * as a unit.
+ */
+const SCRIPT_PATTERNS = [
+    ['latin', /\p{Script=Latin}/u],
+    ['cyrillic', /\p{Script=Cyrillic}/u],
+    ['greek', /\p{Script=Greek}/u],
+    ['arabic', /\p{Script=Arabic}/u],
+    ['hebrew', /\p{Script=Hebrew}/u],
+    // Han and Kana use Script_Extensions, not Script: CJK letters like ー
+    // (U+30FC, the prolonged sound mark) and 々 (U+3005, the iteration mark)
+    // have Script=Common but scx of {Hiragana,Katakana} / {Han}. Classifying
+    // them 'other' made them look script-anomalous inside ordinary Japanese
+    // words — and anomalous letters are folding candidates, which is exactly
+    // wrong for these.
+    ['han', /\p{Script_Extensions=Han}/u],
+    ['kana', /[\p{Script_Extensions=Hiragana}\p{Script_Extensions=Katakana}]/u],
+    ['hangul', /\p{Script=Hangul}/u],
+    ['devanagari', /\p{Script=Devanagari}/u],
+    ['thai', /\p{Script=Thai}/u],
+    ['armenian', /\p{Script=Armenian}/u],
+    ['georgian', /\p{Script=Georgian}/u],
+    ['ethiopic', /\p{Script=Ethiopic}/u],
+];
+const LETTER = /\p{L}/u;
+/** All supported scripts, i.e. every ScriptName except 'other'. */
+const REAL_SCRIPTS = SCRIPT_PATTERNS.map(([name]) => name);
+/**
+ * Memo of code point → class. Script property lookups go through regexes,
+ * which is too slow to repeat per character on large inputs; real-world text
+ * has few distinct code points, so a memo makes classification ~O(1).
+ * Capped so adversarial input (e.g. fuzzing across the whole Unicode range)
+ * cannot grow it without bound.
+ */
+const classMemo = new Map();
+const CLASS_MEMO_MAX = 0x10000;
+/** Classify a single code point. Exported for use by the fold transform. */
+export function classifyCodePoint(cp) {
+    // ASCII fast path — the overwhelmingly common case.
+    if (cp < 0x80) {
+        if ((cp >= 0x41 && cp <= 0x5a) || (cp >= 0x61 && cp <= 0x7a))
+            return 'latin';
+        return 'neutral';
+    }
+    const memoized = classMemo.get(cp);
+    if (memoized !== undefined)
+        return memoized;
+    const char = String.fromCodePoint(cp);
+    let result = 'neutral';
+    if (LETTER.test(char)) {
+        result = 'other';
+        for (const [name, pattern] of SCRIPT_PATTERNS) {
+            if (pattern.test(char)) {
+                result = name;
+                break;
+            }
+        }
+    }
+    if (classMemo.size < CLASS_MEMO_MAX)
+        classMemo.set(cp, result);
+    return result;
+}
+/**
+ * The ScriptName for a single character (the first code point of `char`).
+ * Script-neutral characters and letters of unsupported scripts both report
+ * 'other'.
+ */
+export function getCharScript(char) {
+    const cp = char.codePointAt(0);
+    if (cp === undefined)
+        return 'other';
+    const cls = classifyCodePoint(cp);
+    return cls === 'neutral' ? 'other' : cls;
+}
+/**
+ * Script compatibility groups for token-level dominance decisions (ratified):
+ * ordinary Japanese prose freely mixes Han, Hiragana/Katakana, and embedded
+ * Latin (acronyms, romaji), and Korean prose mixes Hangul with Han (hanja).
+ * Characters of co-occurring scripts within one group are NEVER treated as
+ * script-anomalous with respect to each other, so such text is never a
+ * homoglyph-folding candidate.
+ */
+const COMPATIBLE_GROUPS = [
+    new Set(['han', 'kana', 'latin']),
+    new Set(['hangul', 'han']),
+];
+/**
+ * Whether two scripts may legitimately co-occur in one token (same script,
+ * or both members of a compatibility group).
+ */
+export function scriptsCompatible(a, b) {
+    if (a === b)
+        return true;
+    if (a === 'other' || b === 'other')
+        return false;
+    return COMPATIBLE_GROUPS.some((group) => group.has(a) && group.has(b));
+}
+function emptyCounts() {
+    const counts = {};
+    for (const name of REAL_SCRIPTS)
+        counts[name] = 0;
+    counts.other = 0;
+    return counts;
+}
+/**
+ * Per-script letter counts, the dominant script, and whether the text mixes
+ * scripts. Whitespace, digits, and punctuation are ignored — they are
+ * script-neutral and would skew dominance.
+ */
+export function detectScripts(text) {
+    const counts = emptyCounts();
+    // for..of iterates CODE POINTS, so surrogate pairs are never split.
+    for (const char of text) {
+        const cls = classifyCodePoint(char.codePointAt(0));
+        if (cls === 'neutral')
+            continue;
+        counts[cls] += 1;
+    }
+    let dominant = null;
+    let best = 0;
+    let tied = false;
+    let present = 0;
+    for (const name of REAL_SCRIPTS) {
+        const count = counts[name];
+        if (count > 0)
+            present += 1;
+        if (count > best) {
+            best = count;
+            dominant = name;
+            tied = false;
+        }
+        else if (count === best && count > 0) {
+            tied = true;
+        }
+    }
+    return {
+        counts,
+        // Dominance requires a strict maximum; a tie means "no dominant script".
+        dominant: tied ? null : dominant,
+        mixed: present > 1,
+    };
+}
+//# sourceMappingURL=scripts.js.map

package/dist/src/scripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripts.js","sourceRoot":"","sources":["../../src/scripts.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,MAAM,eAAe,GAAiD;IACpE,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAC9B,CAAC,UAAU,EAAE,sBAAsB,CAAC;IACpC,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAC9B,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IAChC,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IAChC,qEAAqE;IACrE,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,mBAAmB;IACnB,CAAC,KAAK,EAAE,4BAA4B,CAAC;IACrC,CAAC,MAAM,EAAE,iEAAiE,CAAC;IAC3E,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IAChC,CAAC,YAAY,EAAE,wBAAwB,CAAC;IACxC,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAC5B,CAAC,UAAU,EAAE,sBAAsB,CAAC;IACpC,CAAC,UAAU,EAAE,sBAAsB,CAAC;IACpC,CAAC,UAAU,EAAE,sBAAsB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,mEAAmE;AACnE,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAW3D;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;AACpD,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,oDAAoD;IACpD,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QACd,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;QAC7E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAE5C,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,MAAM,GAAmB,SAAS,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,GAAG,OAAO,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,eAAe,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,GAAG,cAAc;QAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACrC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAA2C;IAChE,IAAI,GAAG,CAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;CACvC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAa,EAAE,CAAa;IAC5D,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,MAAM,GAAG,EAAgC,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IACjB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,oEAAoE;IACpE,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,QAAQ,GAAsB,IAAI,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,GAAG,KAAK,CAAC;YACb,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM;QACN,yEAAyE;QACzE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;QAChC,KAAK,EAAE,OAAO,GAAG,CAAC;KACnB,CAAC;AACJ,CAAC"}

package/dist/src/transforms/foldDigits.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Transform 5: DECIMAL DIGIT FOLDING.
+ *
+ * Every Unicode decimal digit is folded to its ASCII equivalent: Arabic-Indic
+ * ٠١٢, Extended Arabic-Indic ۰۱۲, Devanagari ०१२, Bengali ০১২, Thai ๐๑๒,
+ * Tamil, Telugu, Myanmar, Khmer, and the rest.
+ *
+ * WHY THIS EXISTS. NFKC folds FULLWIDTH digits, because those are
+ * compatibility variants of ASCII — but Arabic-Indic and Devanagari digits are
+ * not compatibility variants of anything. They are the ordinary digits of
+ * living scripts, and NFKC leaves them exactly as they are, correctly.
+ *
+ * The consequence for this pipeline was silent un-redaction. Every Stage 1
+ * detector matches `\d` or an explicit `[0-9]` class, so before this transform
+ * existed a Turkish national identity number written `٣٠٢١٤٥٦٤٦٤١٢`, an
+ * Iranian phone number in Extended Arabic-Indic, a Hindi Aadhaar number in
+ * Devanagari, a Thai national ID and a Bengali credit card were ALL reported
+ * as clean documents — measured, not assumed. That is the same class of
+ * failure as an identifier hidden inside HTML markup, and it landed on
+ * precisely the Arabic, Persian, Urdu, Hindi, Bengali and Thai users the
+ * multilingual work exists to serve.
+ *
+ * WHERE IT RUNS, and why last. After homoglyph folding, not before. Folding
+ * digits changes a token's script census — Arabic-Indic digits are Arabic,
+ * ASCII digits are not — so folding them earlier would alter the
+ * dominant-script decision that homoglyph folding depends on, and could flip
+ * a fold that D3 deliberately declines to make. Running afterwards leaves
+ * that decision on the original scripts. ASCII digits are NFKC-stable, so no
+ * further normalization pass is owed.
+ *
+ * THE USER'S TEXT IS NOT REWRITTEN. Folding happens in the NORMALIZED text
+ * only; masking edits the ORIGINAL through the offset map, so a Persian user
+ * sees their own digits back. That separation is the entire point of the
+ * offset-map contract.
+ */
+import { type TransformStepResult } from '../offsetMap.js';
+/** The ASCII digit for a code point, or undefined if it is not a decimal digit. */
+export declare function asciiDigitFor(codePoint: number): string | undefined;
+/**
+ * Fold every non-ASCII decimal digit to ASCII.
+ *
+ * Most blocks are BMP and fold one code unit to one, leaving offsets
+ * untouched. A few are astral (Osmanya, Brahmi, mathematical digits) and fold
+ * a surrogate PAIR to a single character, so this is not a 1:1 transform and
+ * goes through `MappedTextBuilder` rather than assuming equal lengths — the
+ * same machinery NFKC's expansions use.
+ */
+export declare function foldDigits(text: string): TransformStepResult | null;
+//# sourceMappingURL=foldDigits.d.ts.map

package/dist/src/transforms/foldDigits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"foldDigits.d.ts","sourceRoot":"","sources":["../../../src/transforms/foldDigits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAsC,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AA0C/F,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAInE;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CA2CnE"}