@guardbee/mcp-security-proxy 0.3.1 → 1.0.0

package/dist/gateway/gateway.js

@@ -0,0 +1,376 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Gateway = void 0;
+const guard_core_1 = require("@guardbee/guard-core");
+const mcp_telemetry_1 = require("@guardbee/mcp-telemetry");
+const definition_drift_js_1 = require("../interceptors/definition-drift.js");
+const fields_js_1 = require("./fields.js");
+const labels_js_1 = require("./labels.js");
+const policy_js_1 = require("./policy.js");
+const taint_js_1 = require("./taint.js");
+const tokens_js_1 = require("./tokens.js");
+const SEPARATOR = "__";
+const PREFIX = "[GuardBee Security Proxy]";
+function errorResult(text) {
+    return { content: [{ type: "text", text: `${PREFIX} ${text}` }], isError: true };
+}
+/**
+ * The policy pipeline between the agent and its MCP servers. Transport-free:
+ * proxy.ts wires it to stdio, tests drive it directly.
+ *
+ * A tool call runs: input injection scan → definition drift → policy rules
+ * (incl. approval) → toxic-flow check → detokenize → upstream → result
+ * injection scan → PII masking / tokenizing → field masking → taint update.
+ */
+class Gateway {
+    constructor(upstreams, config, audit, approver) {
+        this.upstreams = upstreams;
+        this.config = config;
+        this.audit = audit;
+        this.approver = approver;
+        this.taint = new taint_js_1.TaintTracker();
+        this.vault = new tokens_js_1.PiiVault();
+        this.pins = new Map();
+        this.tools = new Map();
+        this.resources = new Map();
+        this.prompts = new Map();
+        /** Upstreams that announced tools/list_changed since the agent last listed tools. */
+        this.stale = new Set();
+        this.toolListeners = [];
+        for (const upstream of upstreams) {
+            upstream.onToolsChanged?.(() => {
+                this.stale.add(upstream.name);
+                for (const listener of this.toolListeners)
+                    listener();
+            });
+        }
+    }
+    /** Called when any upstream's tool list changed; proxy.ts relays it to the agent. */
+    onToolsChanged(listener) {
+        this.toolListeners.push(listener);
+    }
+    get interceptors() {
+        return this.config.interceptors;
+    }
+    exposed(upstream, name) {
+        return this.config.namespaced ? `${upstream.name}${SEPARATOR}${name}` : name;
+    }
+    pinFor(upstream) {
+        let pin = this.pins.get(upstream.name);
+        if (!pin)
+            this.pins.set(upstream.name, (pin = new definition_drift_js_1.ToolDefinitionPin()));
+        return pin;
+    }
+    log(event) {
+        this.audit.log({ ts: new Date().toISOString(), ...event, taint: this.taint.snapshot() });
+    }
+    get driftEnabled() {
+        return this.interceptors.definitionDrift?.enabled !== false;
+    }
+    get driftAction() {
+        return this.interceptors.definitionDrift?.action ?? this.interceptors.promptInjection?.action ?? "block";
+    }
+    get resultAction() {
+        return this.interceptors.toolResultInjection?.action ?? this.interceptors.promptInjection?.action ?? "block";
+    }
+    /**
+     * Find PII in a value (it taints the session either way) and hide it unless
+     * masking is off. `force` comes from a `mask` rule and overrides "off".
+     */
+    protect(value, force = false) {
+        const redacted = (0, guard_core_1.maskPiiInValue)(value);
+        const piiFound = (0, definition_drift_js_1.stable)(redacted) !== (0, definition_drift_js_1.stable)(value);
+        const enabled = this.interceptors.piiMasking?.enabled !== false || force;
+        if (!piiFound || !enabled)
+            return { value, piiFound };
+        const tokenize = this.interceptors.piiMasking?.mode === "tokenize";
+        return { value: tokenize ? this.vault.tokenize(value) : redacted, piiFound };
+    }
+    async listTools() {
+        const listed = [];
+        for (const upstream of this.upstreams) {
+            let tools;
+            try {
+                tools = await upstream.listTools();
+            }
+            catch (err) {
+                // One broken server must not take the others' tools away.
+                this.log({ type: "warn", upstream: upstream.name, reason: `tools/list failed: ${err instanceof Error ? err.message : String(err)}` });
+                continue;
+            }
+            this.stale.delete(upstream.name);
+            if (this.driftEnabled) {
+                const observed = this.pinFor(upstream).observe(tools, this.driftAction);
+                for (const finding of observed.findings) {
+                    this.log({
+                        type: this.driftAction === "block" ? "blocked" : "warn",
+                        tool: this.exposed(upstream, finding.toolName),
+                        server: upstream.name,
+                        upstream: upstream.name,
+                        reason: finding.reason,
+                    });
+                }
+                tools = observed.tools;
+            }
+            for (const tool of tools) {
+                const name = this.exposed(upstream, tool.name);
+                const labels = this.config.labels[name] ?? (0, labels_js_1.labelTool)(tool);
+                this.tools.set(name, { upstream, name: tool.name, labels });
+                listed.push({ ...tool, name });
+            }
+        }
+        return listed;
+    }
+    async callTool(name, args) {
+        const started = Date.now();
+        let route = this.tools.get(name);
+        if (!route) {
+            await this.listTools();
+            route = this.tools.get(name);
+        }
+        if (!route)
+            return errorResult(`Unknown tool: ${name}`);
+        const { upstream, labels } = route;
+        const base = { tool: name, server: upstream.name, upstream: upstream.name, labels };
+        const block = (reason, extra = {}) => {
+            this.log({ ...base, type: "blocked", input: args, reason, ...extra });
+            void (0, mcp_telemetry_1.recordEvent)({
+                server: "security-proxy",
+                tool: name,
+                params: args,
+                success: false,
+                durationMs: Date.now() - started,
+                error: `blocked: ${reason}`,
+            });
+            return errorResult(`Tool call blocked: ${reason}`);
+        };
+        /** null = approved, go on; otherwise the result to return. */
+        const askApproval = async (reason, extra = {}) => {
+            const outcome = this.approver
+                ? await this.approver({ tool: name, upstream: upstream.name, args, reason })
+                : "unavailable";
+            this.log({ ...base, type: "approval", input: args, reason: `${outcome}: ${reason}`, ...extra });
+            if (outcome === "approved")
+                return null;
+            if (outcome === "unavailable") {
+                return errorResult(`Tool call blocked: it needs a person's approval, but this client cannot show an approval prompt (MCP elicitation). ${reason}`);
+            }
+            return errorResult(`Tool call not approved (${outcome}): ${reason}`);
+        };
+        // 1. Prompt injection in the arguments
+        if (this.interceptors.promptInjection?.enabled !== false) {
+            const scan = (0, guard_core_1.scanForPromptInjection)(args, this.interceptors.promptInjection?.action ?? "block");
+            if (scan.action === "block")
+                return block(scan.reason);
+            if (scan.action === "warn")
+                this.log({ ...base, type: "warn", input: args, reason: scan.reason });
+        }
+        // 2. The live definition must still match the session pin
+        const recheck = this.interceptors.definitionDrift?.recheck ?? "every-call";
+        if (this.driftEnabled && (recheck === "every-call" || this.stale.has(upstream.name))) {
+            try {
+                const live = (await upstream.listTools());
+                const pin = this.pinFor(upstream);
+                pin.ensurePinned(live);
+                const drift = pin.drifted(route.name, live);
+                if (drift && this.driftAction === "block")
+                    return block(drift.reason);
+                if (drift)
+                    this.log({ ...base, type: "warn", input: args, reason: drift.reason });
+            }
+            catch (err) {
+                this.log({ ...base, type: "warn", reason: `definition re-check failed: ${err instanceof Error ? err.message : String(err)}` });
+            }
+        }
+        // 3. Policy rules
+        const decision = (0, policy_js_1.evaluatePolicy)(this.config.rules, this.config.defaults.action, {
+            tool: name,
+            upstream: upstream.name,
+            labels,
+            tainted: this.taint.tainted,
+            args,
+        });
+        const rule = decision.ruleId ?? "defaults.action";
+        if (decision.action === "deny")
+            return block(`denied by policy rule ${rule}`, { ruleId: decision.ruleId });
+        if (decision.action === "warn") {
+            this.log({ ...base, type: "warn", ruleId: decision.ruleId, input: args, reason: `policy rule ${rule}` });
+        }
+        if (decision.action === "approve") {
+            const refused = await askApproval(`policy rule ${rule} requires approval`, { ruleId: decision.ruleId });
+            if (refused)
+                return refused;
+        }
+        // 4. Toxic flow: untrusted + sensitive already in context, and this call can send data out
+        const taintMode = this.config.taint.mode;
+        if (taintMode !== "off" && this.taint.completesTrifecta(labels)) {
+            const reason = this.taint.describe(name);
+            if (taintMode === "strict") {
+                this.log({ ...base, type: "toxic_flow", input: args, reason: `${reason} — blocked (taint.mode=strict)` });
+                return errorResult(`Tool call blocked: ${reason}. Start a new session to use this tool, or relabel it in the proxy config.`);
+            }
+            if (taintMode === "approve") {
+                this.log({ ...base, type: "toxic_flow", input: args, reason: `${reason} — asking for approval (taint.mode=approve)` });
+                const refused = await askApproval(reason);
+                if (refused)
+                    return refused;
+            }
+            else {
+                this.log({ ...base, type: "toxic_flow", input: args, reason: `${reason} — allowed (taint.mode=warn)` });
+            }
+        }
+        // 5. PII tokens go back to real values — but not into a tool that can send them out
+        let forwardArgs = args;
+        if (this.vault.holdsTokens(args)) {
+            if (labels.includes("egress") && !this.interceptors.piiMasking?.detokenizeForEgress) {
+                this.log({ ...base, type: "warn", reason: "PII tokens passed on as-is: the tool can send data out (piiMasking.detokenizeForEgress is off)" });
+            }
+            else {
+                forwardArgs = this.vault.detokenize(args);
+            }
+        }
+        // 6. Forward
+        this.log({ ...base, type: "tool_call", ruleId: decision.ruleId, input: args });
+        const result = await upstream.callTool(route.name, forwardArgs);
+        // 7. Indirect injection in the result (text and structured)
+        let content = result.content;
+        if (this.interceptors.toolResultInjection?.enabled !== false) {
+            const scan = (0, guard_core_1.scanToolResult)([content, result.structuredContent ?? null], this.resultAction);
+            if (scan.action === "block") {
+                this.log({ ...base, type: "blocked", output: content, reason: scan.reason });
+                void (0, mcp_telemetry_1.recordEvent)({
+                    server: "security-proxy",
+                    tool: name,
+                    params: args,
+                    success: false,
+                    durationMs: Date.now() - started,
+                    error: `blocked: ${scan.reason}`,
+                });
+                return errorResult(`Tool result blocked: ${scan.reason}`);
+            }
+            if (scan.action === "warn") {
+                this.log({ ...base, type: "warn", output: content, reason: scan.reason });
+                content = [{ type: "text", text: `${PREFIX} Warning: ${scan.reason}` }, ...content];
+            }
+        }
+        // 8. PII: always detected (it taints the session), masked unless turned off — a `mask` rule forces it
+        const force = decision.action === "mask";
+        const text = this.protect(content, force);
+        let out = { ...result, content: text.value };
+        let piiFound = text.piiFound;
+        if (result.structuredContent) {
+            const structured = this.protect(result.structuredContent, force);
+            out.structuredContent = structured.value;
+            piiFound || (piiFound = structured.piiFound);
+        }
+        if (decision.maskFields)
+            out = (0, fields_js_1.maskFields)(out, decision.maskFields);
+        this.taint.observe(name, labels, piiFound);
+        this.log({ ...base, type: "tool_response", output: out.content });
+        void (0, mcp_telemetry_1.recordEvent)({
+            server: "security-proxy",
+            tool: name,
+            params: args,
+            success: !result.isError,
+            durationMs: Date.now() - started,
+        });
+        return out;
+    }
+    async listResources() {
+        const listed = [];
+        for (const upstream of this.upstreams) {
+            try {
+                for (const resource of await upstream.listResources()) {
+                    if (!this.resources.has(resource.uri))
+                        this.resources.set(resource.uri, upstream);
+                    listed.push(resource);
+                }
+            }
+            catch (err) {
+                this.log({ type: "warn", upstream: upstream.name, reason: `resources/list failed: ${err instanceof Error ? err.message : String(err)}` });
+            }
+        }
+        return listed;
+    }
+    /** Resource contents come from outside the agent's control: they taint the session like an untrusted tool. */
+    async readResource(uri) {
+        let upstream = this.resources.get(uri);
+        if (!upstream) {
+            await this.listResources();
+            upstream = this.resources.get(uri) ?? (this.upstreams.length === 1 ? this.upstreams[0] : undefined);
+        }
+        if (!upstream)
+            throw new Error(`${PREFIX} Unknown resource: ${uri}`);
+        const result = await upstream.readResource(uri);
+        const texts = result.contents.flatMap((item) => ("text" in item && typeof item.text === "string" ? [item.text] : []));
+        const source = `resource:${uri}`;
+        if (this.interceptors.toolResultInjection?.enabled !== false) {
+            const scan = (0, guard_core_1.scanToolResult)(texts, this.resultAction);
+            if (scan.action === "block") {
+                this.log({ type: "blocked", tool: source, upstream: upstream.name, reason: scan.reason });
+                throw new Error(`${PREFIX} Resource blocked: ${scan.reason}`);
+            }
+            if (scan.action === "warn")
+                this.log({ type: "warn", tool: source, upstream: upstream.name, reason: scan.reason });
+        }
+        let piiFound = false;
+        const contents = result.contents.map((item) => {
+            if (!("text" in item) || typeof item.text !== "string")
+                return item;
+            const text = this.protect(item.text);
+            piiFound || (piiFound = text.piiFound);
+            return { ...item, text: text.value };
+        });
+        this.taint.observe(source, ["untrusted"], piiFound);
+        this.log({ type: "resource_read", tool: source, upstream: upstream.name });
+        return { ...result, contents };
+    }
+    async listPrompts() {
+        const listed = [];
+        for (const upstream of this.upstreams) {
+            try {
+                for (const prompt of await upstream.listPrompts()) {
+                    const name = this.exposed(upstream, prompt.name);
+                    this.prompts.set(name, { upstream, name: prompt.name });
+                    listed.push({ ...prompt, name });
+                }
+            }
+            catch (err) {
+                this.log({ type: "warn", upstream: upstream.name, reason: `prompts/list failed: ${err instanceof Error ? err.message : String(err)}` });
+            }
+        }
+        return listed;
+    }
+    /**
+     * A prompt template is text a server puts straight into the conversation, so
+     * it gets the same injection scan and PII masking as a tool result. It does
+     * not taint the session: the person picked it.
+     */
+    async getPrompt(name, args) {
+        let route = this.prompts.get(name);
+        if (!route) {
+            await this.listPrompts();
+            route = this.prompts.get(name);
+        }
+        if (!route)
+            throw new Error(`${PREFIX} Unknown prompt: ${name}`);
+        const result = await route.upstream.getPrompt(route.name, args);
+        const source = `prompt:${name}`;
+        if (this.interceptors.toolResultInjection?.enabled !== false) {
+            const scan = (0, guard_core_1.scanToolResult)(result.messages, this.resultAction);
+            if (scan.action === "block") {
+                this.log({ type: "blocked", tool: source, upstream: route.upstream.name, reason: scan.reason });
+                throw new Error(`${PREFIX} Prompt blocked: ${scan.reason}`);
+            }
+            if (scan.action === "warn")
+                this.log({ type: "warn", tool: source, upstream: route.upstream.name, reason: scan.reason });
+        }
+        return { ...result, messages: this.protect(result.messages).value };
+    }
+    async close() {
+        this.audit.close();
+        await Promise.allSettled(this.upstreams.map((upstream) => upstream.close()));
+    }
+}
+exports.Gateway = Gateway;
+//# sourceMappingURL=gateway.js.map

package/dist/gateway/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/gateway/gateway.ts"],"names":[],"mappings":";;;AAQA,qDAA8F;AAC9F,2DAAsD;AAEtD,6EAAiG;AAIjG,2CAAyC;AACzC,2CAAoD;AACpD,2CAA6C;AAC7C,yCAA0C;AAC1C,2CAAuC;AAGvC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,MAAM,GAAG,2BAA2B,CAAC;AAS3C,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAa,OAAO;IAWlB,YACmB,SAA8B,EAC9B,MAAqB,EACrB,KAAkB,EAClB,QAAmB;QAHnB,cAAS,GAAT,SAAS,CAAqB;QAC9B,WAAM,GAAN,MAAM,CAAe;QACrB,UAAK,GAAL,KAAK,CAAa;QAClB,aAAQ,GAAR,QAAQ,CAAW;QAd7B,UAAK,GAAG,IAAI,uBAAY,EAAE,CAAC;QAC3B,UAAK,GAAG,IAAI,oBAAQ,EAAE,CAAC;QACf,SAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;QAC5C,UAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;QACrC,cAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;QACxC,YAAO,GAAG,IAAI,GAAG,EAAgD,CAAC;QACnF,qFAAqF;QACpE,UAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1B,kBAAa,GAAmB,EAAE,CAAC;QAQlD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,QAAQ,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE;gBAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC9B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,aAAa;oBAAE,QAAQ,EAAE,CAAC;YACxD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,cAAc,CAAC,QAAoB;QACjC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;IAClC,CAAC;IAEO,OAAO,CAAC,QAAkB,EAAE,IAAY;QAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,CAAC;IAEO,MAAM,CAAC,QAAkB;QAC/B,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,IAAI,uCAAiB,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,GAAG,CAAC,KAAuC;QACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,KAAK,KAAK,CAAC;IAC9D,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,IAAI,OAAO,CAAC;IAC3G,CAAC;IAED,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,IAAI,OAAO,CAAC;IAC/G,CAAC;IAED;;;OAGG;IACK,OAAO,CAAI,KAAQ,EAAE,KAAK,GAAG,KAAK;QACxC,MAAM,QAAQ,GAAG,IAAA,2BAAc,EAAC,KAAK,CAAM,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAA,4BAAM,EAAC,QAAQ,CAAC,KAAK,IAAA,4BAAM,EAAC,KAAK,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC;QACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,KAAK,UAAU,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAW,EAAE,CAAC;QAC1B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0DAA0D;gBAC1D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtI,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAqB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACxF,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBACxC,IAAI,CAAC,GAAG,CAAC;wBACP,IAAI,EAAE,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;wBACvD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;wBAC9C,MAAM,EAAE,QAAQ,CAAC,IAAI;wBACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,MAAM,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,GAAG,QAAQ,CAAC,KAAe,CAAC;YACnC,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAA,qBAAS,EAAC,IAAI,CAAC,CAAC;gBAC3D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAA6B;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACvB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAExD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QACnC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,QAA6B,EAAE,EAAkB,EAAE;YAChF,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YACtE,KAAK,IAAA,2BAAW,EAAC;gBACf,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,KAAK,EAAE,YAAY,MAAM,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC;QACF,8DAA8D;QAC9D,MAAM,WAAW,GAAG,KAAK,EAAE,MAAc,EAAE,QAA6B,EAAE,EAAkC,EAAE;YAC5G,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ;gBAC3B,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC5E,CAAC,CAAC,aAAa,CAAC;YAClB,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,KAAK,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAChG,IAAI,OAAO,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YACxC,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;gBAC9B,OAAO,WAAW,CAChB,sHAAsH,MAAM,EAAE,CAC/H,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC,2BAA2B,OAAO,MAAM,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC;QAEF,uCAAuC;QACvC,IAAI,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,IAAA,mCAAsB,EAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,IAAI,OAAO,CAAC,CAAC;YAChG,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,0DAA0D;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,IAAI,YAAY,CAAC;QAC3E,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrF,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAiB,CAAC;gBAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAClC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACvB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC5C,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO;oBAAE,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACtE,IAAI,KAAK;oBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACjI,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,MAAM,QAAQ,GAAG,IAAA,0BAAc,EAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC9E,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAC3B,IAAI;SACL,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,IAAI,iBAAiB,CAAC;QAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC,yBAAyB,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3G,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,eAAe,IAAI,oBAAoB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACxG,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;QAED,2FAA2F;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACzC,IAAI,SAAS,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,gCAAgC,EAAE,CAAC,CAAC;gBAC1G,OAAO,WAAW,CAChB,sBAAsB,MAAM,4EAA4E,CACzG,CAAC;YACJ,CAAC;YACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,6CAA6C,EAAE,CAAC,CAAC;gBACvH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,8BAA8B,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QAED,oFAAoF;QACpF,IAAI,WAAW,GAAG,IAAI,CAAC;QACvB,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,mBAAmB,EAAE,CAAC;gBACpF,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,gGAAgG,EAAE,CAAC,CAAC;YAChJ,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,aAAa;QACb,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEhE,4DAA4D;QAC5D,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7B,IAAI,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAA,2BAAc,EAAC,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5F,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC7E,KAAK,IAAA,2BAAW,EAAC;oBACf,MAAM,EAAE,gBAAgB;oBACxB,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,KAAK;oBACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;oBAChC,KAAK,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE;iBACjC,CAAC,CAAC;gBACH,OAAO,WAAW,CAAC,wBAAwB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1E,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAED,sGAAsG;QACtG,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAmB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YACjE,GAAG,CAAC,iBAAiB,GAAG,UAAU,CAAC,KAAK,CAAC;YACzC,QAAQ,KAAR,QAAQ,GAAK,UAAU,CAAC,QAAQ,EAAC;QACnC,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU;YAAE,GAAG,GAAG,IAAA,sBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAElE,KAAK,IAAA,2BAAW,EAAC;YACf,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACjC,CAAC,CAAC;QAEH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,KAAK,MAAM,QAAQ,IAAI,MAAM,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;oBACtD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBAClF,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5I,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8GAA8G;IAC9G,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,IAAI,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,sBAAsB,GAAG,EAAE,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtH,MAAM,MAAM,GAAG,YAAY,GAAG,EAAE,CAAC;QAEjC,IAAI,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAA,2BAAc,EAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACtD,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1F,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,sBAAsB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrH,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5C,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,QAAQ,KAAR,QAAQ,GAAK,IAAI,CAAC,QAAQ,EAAC;YAC3B,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,KAAK,MAAM,MAAM,IAAI,MAAM,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;oBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;oBACjD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;oBACxD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1I,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,IAA6B;QACzD,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACzB,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,UAAU,IAAI,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAA,2BAAc,EAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAChE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChG,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,oBAAoB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;CACF;AA3WD,0BA2WC"}

package/dist/gateway/labels.d.ts

@@ -0,0 +1,10 @@
+/** The three legs of the lethal trifecta, plus destructive tools. */
+export type Label = "untrusted" | "sensitive" | "egress" | "destructive";
+export declare const LABELS: readonly ["untrusted", "sensitive", "egress", "destructive"];
+/** Heuristic labels from the tool's name, description and schema (same rules as toxic-flow-auditor). */
+export declare function labelTool(tool: {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+}): Label[];
+//# sourceMappingURL=labels.d.ts.map

package/dist/gateway/labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"labels.d.ts","sourceRoot":"","sources":["../../src/gateway/labels.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,MAAM,MAAM,KAAK,GAAG,WAAW,GAAG,WAAW,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEzE,eAAO,MAAM,MAAM,8DAA+D,CAAC;AASnF,wGAAwG;AACxG,wBAAgB,SAAS,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,KAAK,EAAE,CAEtG"}

package/dist/gateway/labels.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LABELS = void 0;
+exports.labelTool = labelTool;
+const guard_core_1 = require("@guardbee/guard-core");
+exports.LABELS = ["untrusted", "sensitive", "egress", "destructive"];
+const FROM_CAPABILITY = {
+    "untrusted-content": "untrusted",
+    "sensitive-data": "sensitive",
+    exfiltration: "egress",
+    destructive: "destructive",
+};
+/** Heuristic labels from the tool's name, description and schema (same rules as toxic-flow-auditor). */
+function labelTool(tool) {
+    return (0, guard_core_1.classifyTool)(tool).map((capability) => FROM_CAPABILITY[capability]);
+}
+//# sourceMappingURL=labels.js.map

package/dist/gateway/labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"labels.js","sourceRoot":"","sources":["../../src/gateway/labels.ts"],"names":[],"mappings":";;;AAeA,8BAEC;AAjBD,qDAAqE;AAKxD,QAAA,MAAM,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAEnF,MAAM,eAAe,GAA8B;IACjD,mBAAmB,EAAE,WAAW;IAChC,gBAAgB,EAAE,WAAW;IAC7B,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF,wGAAwG;AACxG,SAAgB,SAAS,CAAC,IAAmE;IAC3F,OAAO,IAAA,yBAAY,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/gateway/policy.d.ts

@@ -0,0 +1,37 @@
+import type { Label } from "./labels.js";
+export type PolicyAction = "allow" | "deny" | "mask" | "warn" | "approve";
+export type ArgMatcher = string | number | boolean;
+export interface PolicyRule {
+    id?: string;
+    match: {
+        /** Glob on the tool name the agent sees (`*` any run, `?` one character). */
+        tool?: string;
+        upstream?: string;
+        label?: Label;
+        session?: "clean" | "tainted";
+        /** Dotted path into the call arguments → expected value; strings are globs. */
+        args?: Record<string, ArgMatcher>;
+    };
+    action: PolicyAction;
+    /** For `mask`: also blank these JSON keys in the result (case-insensitive). */
+    mask?: {
+        fields: string[];
+    };
+}
+export interface PolicyContext {
+    tool: string;
+    upstream: string;
+    labels: readonly Label[];
+    tainted: boolean;
+    args?: Record<string, unknown>;
+}
+export interface PolicyDecision {
+    action: PolicyAction;
+    /** The rule's `id`, or `rules[<index>]`; absent when the default applied. */
+    ruleId?: string;
+    maskFields?: string[];
+}
+export declare function globToRegExp(glob: string): RegExp;
+/** Rules are checked top to bottom; the first match wins. No match → `defaultAction`. */
+export declare function evaluatePolicy(rules: readonly PolicyRule[], defaultAction: PolicyAction, ctx: PolicyContext): PolicyDecision;
+//# sourceMappingURL=policy.d.ts.map

package/dist/gateway/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/gateway/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEnD,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE;QACL,6EAA6E;QAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,KAAK,CAAC;QACd,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC9B,+EAA+E;QAC/E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;KACnC,CAAC;IACF,MAAM,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjD;AAgCD,yFAAyF;AACzF,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,aAAa,EAAE,YAAY,EAC3B,GAAG,EAAE,aAAa,GACjB,cAAc,CAShB"}

package/dist/gateway/policy.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globToRegExp = globToRegExp;
+exports.evaluatePolicy = evaluatePolicy;
+function globToRegExp(glob) {
+    const source = glob
+        .split("")
+        .map((ch) => (ch === "*" ? ".*" : ch === "?" ? "." : ch.replace(/[.+^${}()|[\]\\]/g, "\\$&")))
+        .join("");
+    return new RegExp(`^${source}$`);
+}
+function valueAt(root, dotted) {
+    let current = root;
+    for (const key of dotted.split(".")) {
+        if (current === null || typeof current !== "object")
+            return undefined;
+        current = current[key];
+    }
+    return current;
+}
+function argMatches(actual, expected) {
+    if (typeof expected === "string") {
+        return (typeof actual === "string" || typeof actual === "number") && globToRegExp(expected).test(String(actual));
+    }
+    return actual === expected;
+}
+function matches(rule, ctx) {
+    const { tool, upstream, label, session, args } = rule.match;
+    if (tool !== undefined && !globToRegExp(tool).test(ctx.tool))
+        return false;
+    if (upstream !== undefined && upstream !== ctx.upstream)
+        return false;
+    if (label !== undefined && !ctx.labels.includes(label))
+        return false;
+    if (session !== undefined && (session === "tainted") !== ctx.tainted)
+        return false;
+    if (args !== undefined) {
+        for (const [dotted, expected] of Object.entries(args)) {
+            if (!argMatches(valueAt(ctx.args, dotted), expected))
+                return false;
+        }
+    }
+    return true;
+}
+/** Rules are checked top to bottom; the first match wins. No match → `defaultAction`. */
+function evaluatePolicy(rules, defaultAction, ctx) {
+    for (const [index, rule] of rules.entries()) {
+        if (matches(rule, ctx)) {
+            const decision = { action: rule.action, ruleId: rule.id ?? `rules[${index}]` };
+            if (rule.mask)
+                decision.maskFields = rule.mask.fields;
+            return decision;
+        }
+    }
+    return { action: defaultAction };
+}
+//# sourceMappingURL=policy.js.map

package/dist/gateway/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/gateway/policy.ts"],"names":[],"mappings":";;AAqCA,oCAMC;AAiCD,wCAaC;AApDD,SAAgB,YAAY,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,IAAI;SAChB,KAAK,CAAC,EAAE,CAAC;SACT,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC;SAC7F,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,OAAO,CAAC,IAAa,EAAE,MAAc;IAC5C,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtE,OAAO,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,MAAe,EAAE,QAAoB;IACvD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,MAAM,KAAK,QAAQ,CAAC;AAC7B,CAAC;AAED,SAAS,OAAO,CAAC,IAAgB,EAAE,GAAkB;IACnD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IAC5D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,GAAG,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yFAAyF;AACzF,SAAgB,cAAc,CAC5B,KAA4B,EAC5B,aAA2B,EAC3B,GAAkB;IAElB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAC/F,IAAI,IAAI,CAAC,IAAI;gBAAE,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACnC,CAAC"}

package/dist/gateway/taint.d.ts

@@ -0,0 +1,25 @@
+import type { Label } from "./labels.js";
+export type TaintMode = "strict" | "approve" | "warn" | "off";
+export interface TaintSnapshot {
+    sawUntrusted: boolean;
+    sawSensitive: boolean;
+}
+/**
+ * Tracks which legs of the lethal trifecta a session has already touched.
+ * Flags only ever turn on: once the model has read untrusted content, every
+ * later decision it makes may be steered by that content.
+ */
+export declare class TaintTracker {
+    private untrustedFrom;
+    private sensitiveFrom;
+    get sawUntrusted(): boolean;
+    get sawSensitive(): boolean;
+    /** Both data legs are open: an egress call now would complete the trifecta. */
+    get tainted(): boolean;
+    /** Record what a tool result (or resource read) brought into the model's context. */
+    observe(source: string, labels: readonly Label[], piiFound: boolean): void;
+    completesTrifecta(labels: readonly Label[]): boolean;
+    describe(egressTool: string): string;
+    snapshot(): TaintSnapshot;
+}
+//# sourceMappingURL=taint.d.ts.map

package/dist/gateway/taint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint.d.ts","sourceRoot":"","sources":["../../src/gateway/taint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,aAAa,CAAuB;IAE5C,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED,+EAA+E;IAC/E,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,qFAAqF;IACrF,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI;IAK1E,iBAAiB,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,GAAG,OAAO;IAIpD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAOpC,QAAQ,IAAI,aAAa;CAG1B"}

package/dist/gateway/taint.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TaintTracker = void 0;
+/**
+ * Tracks which legs of the lethal trifecta a session has already touched.
+ * Flags only ever turn on: once the model has read untrusted content, every
+ * later decision it makes may be steered by that content.
+ */
+class TaintTracker {
+    constructor() {
+        this.untrustedFrom = null;
+        this.sensitiveFrom = null;
+    }
+    get sawUntrusted() {
+        return this.untrustedFrom !== null;
+    }
+    get sawSensitive() {
+        return this.sensitiveFrom !== null;
+    }
+    /** Both data legs are open: an egress call now would complete the trifecta. */
+    get tainted() {
+        return this.sawUntrusted && this.sawSensitive;
+    }
+    /** Record what a tool result (or resource read) brought into the model's context. */
+    observe(source, labels, piiFound) {
+        if (labels.includes("untrusted") && !this.untrustedFrom)
+            this.untrustedFrom = source;
+        if ((labels.includes("sensitive") || piiFound) && !this.sensitiveFrom)
+            this.sensitiveFrom = source;
+    }
+    completesTrifecta(labels) {
+        return labels.includes("egress") && this.tainted;
+    }
+    describe(egressTool) {
+        return (`Toxic flow (lethal trifecta): untrusted content from "${this.untrustedFrom}" and ` +
+            `sensitive data from "${this.sensitiveFrom}" are in this session, and "${egressTool}" can send data out`);
+    }
+    snapshot() {
+        return { sawUntrusted: this.sawUntrusted, sawSensitive: this.sawSensitive };
+    }
+}
+exports.TaintTracker = TaintTracker;
+//# sourceMappingURL=taint.js.map

package/dist/gateway/taint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint.js","sourceRoot":"","sources":["../../src/gateway/taint.ts"],"names":[],"mappings":";;;AASA;;;;GAIG;AACH,MAAa,YAAY;IAAzB;QACU,kBAAa,GAAkB,IAAI,CAAC;QACpC,kBAAa,GAAkB,IAAI,CAAC;IAmC9C,CAAC;IAjCC,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;IACrC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;IACrC,CAAC;IAED,+EAA+E;IAC/E,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;IAChD,CAAC;IAED,qFAAqF;IACrF,OAAO,CAAC,MAAc,EAAE,MAAwB,EAAE,QAAiB;QACjE,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;IACrG,CAAC;IAED,iBAAiB,CAAC,MAAwB;QACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC;IACnD,CAAC;IAED,QAAQ,CAAC,UAAkB;QACzB,OAAO,CACL,yDAAyD,IAAI,CAAC,aAAa,QAAQ;YACnF,wBAAwB,IAAI,CAAC,aAAa,+BAA+B,UAAU,qBAAqB,CACzG,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IAC9E,CAAC;CACF;AArCD,oCAqCC"}

package/dist/gateway/tokens.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Session-scoped reversible PII tokens. The model sees `<pii:tc_kimlik:7f3a9b21>`
+ * instead of the value, and can still pass that token to another tool; the
+ * gateway puts the real value back on the way to the upstream. The table lives
+ * only in memory and dies with the session.
+ */
+export declare class PiiVault {
+    private readonly byToken;
+    private readonly byValue;
+    get size(): number;
+    /** Replace validated PII in any JSON-like value with tokens; the same value always gets the same token. */
+    tokenize<T>(value: T): T;
+    /** Put real values back for tokens this session issued; unknown tokens stay as they are. */
+    detokenize<T>(value: T): T;
+    /** True if the value carries a token this session issued. */
+    holdsTokens(value: unknown): boolean;
+}
+//# sourceMappingURL=tokens.d.ts.map