@jinn-network/client 0.1.8 → 0.1.9-canary.023faefb

package/dist/trajectory/scrub/openredaction-stage.js

@@ -0,0 +1,269 @@
+import { OpenRedaction } from 'openredaction';
+import { classifyKey } from './key-policy.js';
+const VERSION = '0.4.0'; // 0.4.0: #1391 full-corpus denylist extensions (42-seed characterisation)
+/**
+ * Patterns excluded from the default detector (#1331). All three ship with a
+ * bare-word regex (`\b[a-zA-Z0-9._]{3,30}\b` or equivalent) that matches
+ * nearly every token of ordinary technical prose — "Update the staging
+ * bucket config" came back as `[IG_USER_…] the staging [IG_USER_…]
+ * [IG_USER_…]`, destroying the readability and distillation value of every
+ * published trajectory. A social handle has no shape of its own outside its
+ * platform context, so dropping these loses no genuine coverage: emails,
+ * keys, cards, SSNs, phones etc. all keep their dedicated patterns (pinned
+ * by test/trajectory/scrub/openredaction-tuning.test.ts and the
+ * harness-layer seeded-secrets fixture).
+ *
+ * `NAME` is denylisted for the same reason with an acknowledged trade-off:
+ * its follower branch accepts lowercase words (`[A-Z][a-z…]+ (\s+[a-z…]+){1,3}`),
+ * so ANY sentence-initial capitalised word plus 1–3 words matches — "Fix the
+ * failing test" is a "name" to it, which mangles the first sentence of
+ * essentially every task summary. Person-name detection is the ML PII
+ * stage's job (GLiNER, `mlPiiStage`), which the daemon wires when the model
+ * is available; a bare unlabelled name in prose is not regex-detectable at
+ * acceptable precision.
+ *
+ * `LAB_TEST_ID` and `EXAM_ID` are denylisted for the same reason (#1348):
+ * both trigger on ubiquitous software words (`\b(?:LAB|TEST|SAMPLE)…` and
+ * `\b(?:EXAM|TEST|QUIZ|ASSESSMENT)…`, case-insensitive, same bare
+ * `[A-Z0-9]{6,12}` tail) — "test-driven-development" came back as
+ * `test-[LAB_8465]-development` — and lab-specimen / exam IDs are not
+ * plausible in agent-trajectory content. Nothing in the seeded-secrets
+ * fixture pins either pattern.
+ *
+ * #1391 additions (full 42-seed characterisation) — bare-SHAPE patterns
+ * whose regex matches ordinary technical tokens with no trigger word at all:
+ *
+ * - `ZIP_CODE_US` — `\b\d{5}(…)?\b`: ANY 5-digit number. Fired on GitHub
+ *   issue numbers ("#26251", "#41417"), millisecond values ("60000"), quota
+ *   figures ("25000"), Lark error codes ("41050"). A bare 5-digit number in
+ *   trajectory content is overwhelmingly a count, id, or port, not a home
+ *   address component; street-level address detection is the ML PII stage's
+ *   job, where the surrounding words disambiguate.
+ * - `POSTCODE_UK` — matches hex colour literals ("#FF00FF" → `[POSTCODE]`).
+ *   Same rationale: a bare alphanumeric cluster is not a location without
+ *   context, which the ML PII stage has and this regex does not.
+ * - `SWIFT_BIC` — `\b[A-Z]{6}[A-Z0-9]{2}([A-Z0-9]{3})?\b`: ANY 8- or 11-char
+ *   uppercase word ("REQUIRED", from an HTTP header name). BIC codes are
+ *   public bank identifiers, not secrets, and the shape is indistinguishable
+ *   from an all-caps word.
+ * - `TIKTOK_USERNAME` / `SOCIAL_MEDIA_HANDLE` — the #1331 social-handle
+ *   family: `@`-prefixed bare words. Fired on npm scoped packages
+ *   ("@n8n/n8n-nodes-langchain…", "@github/copilot-sdk"), which are
+ *   ubiquitous in technical prose.
+ */
+export const BARE_WORD_PATTERN_DENYLIST = [
+    'INSTAGRAM_USERNAME',
+    'XBOX_GAMERTAG',
+    'PSN_ID',
+    'NAME',
+    'LAB_TEST_ID',
+    'EXAM_ID',
+    // #1391:
+    'ZIP_CODE_US',
+    'POSTCODE_UK',
+    'SWIFT_BIC',
+    'TIKTOK_USERNAME',
+    'SOCIAL_MEDIA_HANDLE',
+];
+/**
+ * Trigger-word patterns excluded for #1372 (kept as a separate block from the
+ * bare-word denylist above so parallel denylist additions merge cleanly).
+ *
+ * These share one pathology: an ordinary English trigger word (`TO`,
+ * `APPROVAL`, `PROJECT`, `ORDER`, `REVIEW`, `PASS`, `LOT`, `SO`, `REG`, `WO`,
+ * `MISSING`, `RETURN`, `user`, `prod`, `ice`…), case-insensitive, followed by
+ * a bare `[A-Z0-9]{n,m}` tail with no intrinsic shape. On the published seed
+ * skills' SKILL.md prose every one of them fired — all 42 seed bodies were
+ * defaced ("project context" → `project [PROJECT_3875]`, "get your approval
+ * before" → `approval [AUTH_5211]`), several mid-word ("something" →
+ * `so[SO_1826]`, "workflow" → `wo[WO_3602]`, "regressions" →
+ * `[REG]ressions`). Observed trigger words per pattern, from the #1372
+ * characterisation over five real seed bodies:
+ *
+ * - `USERNAME` — "user intent", "user has"; a bare word after "user"/"login"
+ *   is not a credential. Credentials keep their shaped patterns; person
+ *   names are the ML PII stage's job (see the `NAME` note above).
+ * - `PROJECT_CODE` — "project context", "project goes through".
+ * - `CARD_AUTH_CODE` — "approval before" (card auth codes travel with card
+ *   numbers, which `CREDIT_CARD` still catches).
+ * - `IATA_AIRPORT_CODE` — "to use" ("TO" + any 3 capitalisable letters).
+ * - `JUDGMENT_NUMBER` — "order should".
+ * - `STANDING_ORDER_REF` — "SO" matches inside "something"/"solution".
+ * - `PRODUCTION_ID` — "production classes"; nested self-replacement
+ *   corrupted "NO PRODUCTION CODE" into `PROD[PROD[PROD…`.
+ * - `WORK_ORDER_NUMBER` — "wo" matches inside "workflow"/"worktree".
+ * - `PERFORMANCE_REVIEW_ID` — "performance problems", "evaluation between".
+ * - `TNT_TRACKING` — every clause optional except the tail, so ANY 9- or
+ *   13-character word matches ("variation", "statement").
+ * - `THEME_PARK_TICKET` — "pass immediately".
+ * - `TOURNAMENT_REGISTRATION_ID` — "REG" matches inside "regressions".
+ * - `MISSING_PERSON_CASE` — "missing requirements".
+ * - `RMA_NUMBER` — "return expected".
+ * - `BATCH_LOT_NUMBER` — "a lot faster".
+ * - `EMERGENCY_CONTACT` — "ice" (unanchored, matches inside "practice")
+ *   followed by any 2–4 words.
+ *
+ * Lab-grade coverage loss is acceptable: these label niche reference numbers
+ * (parcel tracking, theme-park tickets, tournament brackets, standing
+ * orders, RMAs…) that are implausible in agent-trajectory content and carry
+ * no shape of their own beyond the trigger word. Genuinely secret-shaped
+ * content keeps its dedicated patterns (emails, cards, SSNs, API keys —
+ * pinned below and by the harness-layer seeded-secrets fixture), and the
+ * secretlint + plain-patterns stages still run behind this one.
+ *
+ * #1391 additions — the #1372 characterisation ran 5 sample bodies; the
+ * full-42-seed sweep surfaced the longer tail below (same pathology, same
+ * fix, observed trigger words in parentheses). One aggravator worth naming:
+ * openredaction substitutes a detection's captured VALUE case-insensitively
+ * across the whole document, so a single trigger FP defaces every other
+ * occurrence of that value. Every seed's frontmatter contains
+ * `license: MIT` — LICENSE_PLATE captures `MIT`, and every "limit(s)" /
+ * "submit" in the body came back as `li[PLATE_2299]s` / `Sub[PLATE_2299]`.
+ *
+ * - `LICENSE_PLATE` — "license: MIT" (frontmatter, all 42 seeds); `REG`
+ *   trigger mid-word ("registers" → `[PLATE]isters`).
+ * - `US_LICENSE_PLATE` / `INTERNATIONAL_LICENSE_PLATE` — same trigger family
+ *   (`PLATE|LICENSE|TAG|REGISTRATION`): "tag-driven", "tagged as data".
+ * - `EDITORIAL_TICKET` — "edit existing", "edit endpoints" (`EDIT` trigger).
+ * - `TRANSACTION_ID` — `TRANS` trigger mid-word: "transformations" →
+ *   `[TXN]formations`.
+ * - `AIRLINE_BOOKING_REFERENCE` — "reference images", "reference videos",
+ *   "node reference syntax" (`REFERENCE` trigger).
+ * - `SOURCE_ID` — "source images", "source directory", "multi-source
+ *   aggregation".
+ * - `SERVICE_REQUEST_NUMBER` — "service discovery", "app-service assessment".
+ * - `TERMINAL_ID` — "terminal status"; `POS` trigger mid-word: "false
+ *   positives", "PostToolUse".
+ * - `EXIT_INTERVIEW_ID` — "termination criterion/oracle", "separation
+ *   exists" (`EXIT|TERMINATION|SEPARATION` triggers).
+ * - `HOTEL_LOYALTY_NUMBER` — "member-remove" (wiki commands), "rewards
+ *   padding" (`MEMBER|LOYALTY|REWARDS` triggers).
+ * - `SEARCH_RESCUE_MISSION_ID` — "search operations", "web/search results"
+ *   (`SEARCH|RESCUE|MISSION` triggers).
+ * - `APPLICATION_ID` / `JOB_APPLICATION_ID` — "application gateway",
+ *   "candidate contradicts", "candidate regions" (`APPLICATION|CANDIDATE|
+ *   APPLICANT` triggers).
+ * - `ARTICLE_ID` — "user story should", "user-story-example" (`STORY`
+ *   trigger).
+ * - `EMERGENCY_CALL_REF` — "incident investigation" (`INCIDENT` trigger).
+ * - `CAMPAIGN_CODE` — "brand campaigns", "brand campaign jingle".
+ * - `INSTALLATION_REF` — "brew install imagemagick", "apt-get install".
+ * - `PRODUCT_SKU` — "SKU changes", "SKU upgrades" (Azure sizing prose).
+ * - `BAR_NUMBER` — "raises the bar because" (`BAR` trigger).
+ * - `PREMIUM_PAYMENT_REF` — "premium commercial cuts", "premium brand".
+ * - `HOUSING_ASSIGNMENT` — "ambient room tone" (`ROOM` trigger).
+ * - `MANUSCRIPT_ID` — `MS` trigger: "0.8 ms overhead" → `[MANUSCRIPT]`.
+ * - `STATEMENT_REF` — "return statement exists".
+ * - `QUOTE_REFERENCE` — "quote shortest decisive line".
+ * - `RESUME_ID` — "Resume caveman after" (`RESUME|CV` triggers).
+ * - `PAYMENT_REFERENCE` — `PAY` trigger mid-word: "paymentGateway" →
+ *   `pay[PAY_REF]`.
+ * - `ROUTING_NUMBER_MFG` — "routing convention".
+ * - `MICROSOFT_CERTIFICATION` — "Microsoft documentation" (`MICROSOFT|MS`
+ *   triggers).
+ *
+ * Revealed at fixpoint (iteration 2 — patterns previously shadowed by a
+ * higher-priority pattern that the first pass denylisted):
+ * - `INCIDENT_REPORT_NUMBER` — "Incident Investigation" (`INCIDENT` trigger,
+ *   surfaced once EMERGENCY_CALL_REF was gone).
+ * - `ENROLLMENT_NUMBER` — "registration succeeds" (`REGISTRATION` trigger).
+ * - `HOTEL_RESERVATION` — "Capacity Reservation Groups" (`RESERVATION`
+ *   trigger, surfaced once AIRLINE_BOOKING_REFERENCE was gone).
+ */
+export const PROSE_TRIGGER_PATTERN_DENYLIST = [
+    'USERNAME',
+    'PROJECT_CODE',
+    'CARD_AUTH_CODE',
+    'IATA_AIRPORT_CODE',
+    'JUDGMENT_NUMBER',
+    'STANDING_ORDER_REF',
+    'PRODUCTION_ID',
+    'WORK_ORDER_NUMBER',
+    'PERFORMANCE_REVIEW_ID',
+    'TNT_TRACKING',
+    'THEME_PARK_TICKET',
+    'TOURNAMENT_REGISTRATION_ID',
+    'MISSING_PERSON_CASE',
+    'RMA_NUMBER',
+    'BATCH_LOT_NUMBER',
+    'EMERGENCY_CONTACT',
+    // #1391:
+    'LICENSE_PLATE',
+    'US_LICENSE_PLATE',
+    'INTERNATIONAL_LICENSE_PLATE',
+    'EDITORIAL_TICKET',
+    'TRANSACTION_ID',
+    'AIRLINE_BOOKING_REFERENCE',
+    'SOURCE_ID',
+    'SERVICE_REQUEST_NUMBER',
+    'TERMINAL_ID',
+    'EXIT_INTERVIEW_ID',
+    'HOTEL_LOYALTY_NUMBER',
+    'SEARCH_RESCUE_MISSION_ID',
+    'APPLICATION_ID',
+    'JOB_APPLICATION_ID',
+    'ARTICLE_ID',
+    'EMERGENCY_CALL_REF',
+    'CAMPAIGN_CODE',
+    'INSTALLATION_REF',
+    'PRODUCT_SKU',
+    'BAR_NUMBER',
+    'PREMIUM_PAYMENT_REF',
+    'HOUSING_ASSIGNMENT',
+    'MANUSCRIPT_ID',
+    'STATEMENT_REF',
+    'QUOTE_REFERENCE',
+    'RESUME_ID',
+    'PAYMENT_REFERENCE',
+    'ROUTING_NUMBER_MFG',
+    'MICROSOFT_CERTIFICATION',
+    // #1391 fixpoint iteration 2:
+    'INCIDENT_REPORT_NUMBER',
+    'ENROLLMENT_NUMBER',
+    'HOTEL_RESERVATION',
+];
+/**
+ * Default detector: openredaction's full pattern set minus the audited
+ * bare-word matchers. Built via the `patterns` whitelist option (the
+ * library has no exclude option), so a version bump that renames patterns
+ * fails loudly in the tuning tests rather than silently re-enabling junk.
+ */
+export function buildDefaultDetector() {
+    const allTypes = [...new Set(new OpenRedaction().getPatterns().map((p) => p.type))];
+    return new OpenRedaction({
+        patterns: allTypes.filter((t) => !BARE_WORD_PATTERN_DENYLIST.includes(t) && !PROSE_TRIGGER_PATTERN_DENYLIST.includes(t)),
+    });
+}
+/**
+ * Structured-PII stage backed by `openredaction` (570+ curated regex patterns +
+ * checksum validation, e.g. Luhn for cards). Runs only on `content`-classified
+ * string attributes; `safe` and non-string values pass through untouched. Each
+ * detection is replaced inline (openredaction's placeholder substitution) and
+ * recorded as a `pii` redaction for the provenance manifest.
+ *
+ * The detector is constructed once at factory time and reused across spans
+ * (pattern compilation is not free).
+ */
+export function openredactionStage(policy, detector = buildDefaultDetector()) {
+    return {
+        name: 'openredaction',
+        version: VERSION,
+        async scrub(attributes) {
+            const out = {};
+            const redactions = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content') {
+                    out[key] = value;
+                    continue;
+                }
+                const result = await detector.detect(value);
+                out[key] = result.redacted;
+                for (const det of result.detections) {
+                    redactions.push({ key, stage: 'openredaction', kind: 'pii', detail: det.type });
+                }
+            }
+            return { attributes: out, redactions };
+        },
+    };
+}
+//# sourceMappingURL=openredaction-stage.js.map

package/dist/trajectory/scrub/openredaction-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openredaction-stage.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/openredaction-stage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAkB,MAAM,iBAAiB,CAAC;AAG9D,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,0EAA0E;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,oBAAoB;IACpB,eAAe;IACf,QAAQ;IACR,MAAM;IACN,aAAa;IACb,SAAS;IACT,SAAS;IACT,aAAa;IACb,aAAa;IACb,WAAW;IACX,iBAAiB;IACjB,qBAAqB;CACtB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC/D,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,mBAAmB;IACnB,iBAAiB;IACjB,oBAAoB;IACpB,eAAe;IACf,mBAAmB;IACnB,uBAAuB;IACvB,cAAc;IACd,mBAAmB;IACnB,4BAA4B;IAC5B,qBAAqB;IACrB,YAAY;IACZ,kBAAkB;IAClB,mBAAmB;IACnB,SAAS;IACT,eAAe;IACf,kBAAkB;IAClB,6BAA6B;IAC7B,kBAAkB;IAClB,gBAAgB;IAChB,2BAA2B;IAC3B,WAAW;IACX,wBAAwB;IACxB,aAAa;IACb,mBAAmB;IACnB,sBAAsB;IACtB,0BAA0B;IAC1B,gBAAgB;IAChB,oBAAoB;IACpB,YAAY;IACZ,oBAAoB;IACpB,eAAe;IACf,kBAAkB;IAClB,aAAa;IACb,YAAY;IACZ,qBAAqB;IACrB,oBAAoB;IACpB,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,WAAW;IACX,mBAAmB;IACnB,oBAAoB;IACpB,yBAAyB;IACzB,8BAA8B;IAC9B,wBAAwB;IACxB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,aAAa,CAAC;QACvB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC9F;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAiB,EACjB,WAA0B,oBAAoB,EAAE;IAEhD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,OAAO;QAChB,KAAK,CAAC,KAAK,CAAC,UAAsB;YAChC,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;oBACxE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;oBACjB,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBACpC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/trajectory/scrub/pii-build.d.ts

@@ -0,0 +1,31 @@
+import type { PiiDetector } from './ml-pii-stage.js';
+export interface PiiDetectionConfig {
+    enabled: boolean;
+    /** Optional Transformers.js NER model id (defaults to Xenova/bert-base-NER). */
+    model?: string;
+}
+/** Thrown by the fail-closed detector on every scrub call when ML PII was enabled but the model never loaded. */
+export declare class MlPiiUnavailableError extends Error {
+    constructor(cause: string);
+}
+/**
+ * Builds the ML PII detector (Transformers.js NER, in-process) when enabled,
+ * warming up the model.
+ *
+ * Failure altitude is **publish-time, not boot-time** (per
+ * `spec/2026-06-15-ts-trajectory-scrub-stack.md`, §"Failure posture": "if any
+ * stage errors or the model fails to load, the trajectory is **not**
+ * published"). Three cases:
+ *
+ * - Disabled (the default): returns `undefined` — the scrub pipeline runs the
+ *   structural key policy + openredaction + secretlint/entropy stages only, with
+ *   no ML PII tier and no error. Exactly the legacy behaviour.
+ * - Enabled and the model loads: returns the real detector.
+ * - Enabled but the model fails to load: does NOT throw at construction. Returns
+ *   a fail-closed detector that hard-throws on every scrub call, so each affected
+ *   publish aborts (fails closed — never publishes under-redacted/raw) while the
+ *   rest of the daemon keeps running. A loud one-time boot warning is emitted so
+ *   the degraded posture is visible in logs; the per-publish throw carries its own
+ *   clear error so aborted publishes are never silent.
+ */
+export declare function maybeBuildPiiDetector(cfg: PiiDetectionConfig, log?: (msg: string) => void): Promise<PiiDetector | undefined>;

package/dist/trajectory/scrub/pii-build.js

@@ -0,0 +1,64 @@
+import { TransformersPiiDetector } from './transformers-detector.js';
+/** Thrown by the fail-closed detector on every scrub call when ML PII was enabled but the model never loaded. */
+export class MlPiiUnavailableError extends Error {
+    constructor(cause) {
+        super('ML PII detection was enabled but the model failed to load; failing closed — ' +
+            `this trajectory is NOT published (disable captures.piiDetection or fix the model to publish): ${cause}`);
+        this.name = 'MlPiiUnavailableError';
+    }
+}
+/**
+ * A detector that hard-throws on every `detect()` call. Used when ML PII is
+ * enabled but the model failed to load: the failure is narrowed to **publish
+ * altitude** — the throw propagates through the ML scrub stage and aborts the
+ * one publish in flight (capture publish aborts; task-trajectory ref drops to
+ * null), so no raw trajectory is ever published. The daemon's other loops
+ * (earning, claim, engine, balance-topup) are unaffected because the failure
+ * is no longer raised at construction/boot.
+ */
+function failClosedDetector(cause) {
+    return {
+        detect() {
+            return Promise.reject(new MlPiiUnavailableError(cause));
+        },
+    };
+}
+/**
+ * Builds the ML PII detector (Transformers.js NER, in-process) when enabled,
+ * warming up the model.
+ *
+ * Failure altitude is **publish-time, not boot-time** (per
+ * `spec/2026-06-15-ts-trajectory-scrub-stack.md`, §"Failure posture": "if any
+ * stage errors or the model fails to load, the trajectory is **not**
+ * published"). Three cases:
+ *
+ * - Disabled (the default): returns `undefined` — the scrub pipeline runs the
+ *   structural key policy + openredaction + secretlint/entropy stages only, with
+ *   no ML PII tier and no error. Exactly the legacy behaviour.
+ * - Enabled and the model loads: returns the real detector.
+ * - Enabled but the model fails to load: does NOT throw at construction. Returns
+ *   a fail-closed detector that hard-throws on every scrub call, so each affected
+ *   publish aborts (fails closed — never publishes under-redacted/raw) while the
+ *   rest of the daemon keeps running. A loud one-time boot warning is emitted so
+ *   the degraded posture is visible in logs; the per-publish throw carries its own
+ *   clear error so aborted publishes are never silent.
+ */
+export async function maybeBuildPiiDetector(cfg, log = (m) => console.warn(m)) {
+    if (!cfg.enabled)
+        return undefined;
+    try {
+        const detector = new TransformersPiiDetector(cfg.model ? { model: cfg.model } : {});
+        await detector.init();
+        log('[scrub] ML PII detection (Transformers.js NER) enabled.');
+        return detector;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        log('[scrub] WARNING: ML PII detection is enabled but the model failed to load. ' +
+            'Failing closed at publish altitude: trajectory/capture publishing will ABORT ' +
+            '(no raw trajectories are published) until this is resolved or captures.piiDetection ' +
+            `is disabled. The daemon's other loops continue running. Cause: ${message}`);
+        return failClosedDetector(message);
+    }
+}
+//# sourceMappingURL=pii-build.js.map

package/dist/trajectory/scrub/pii-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-build.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/pii-build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AASrE,iHAAiH;AACjH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,KAAa;QACvB,KAAK,CACH,8EAA8E;YAC5E,iGAAiG,KAAK,EAAE,CAC3G,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO;QACL,MAAM;YACJ,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAuB,EACvB,MAA6B,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnD,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpF,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,yDAAyD,CAAC,CAAC;QAC/D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,GAAG,CACD,6EAA6E;YAC3E,+EAA+E;YAC/E,sFAAsF;YACtF,kEAAkE,OAAO,EAAE,CAC9E,CAAC;QACF,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/trajectory/scrub/pipeline.d.ts

@@ -0,0 +1,37 @@
+import type { Attributes, ScrubResult, ScrubStage } from './types.js';
+/**
+ * Runs scrub stages in order over a span's attributes: each stage's output
+ * attributes feed the next, and redaction records accumulate across the whole
+ * chain. Stages may be async (e.g. the ML PII stage). The `components` list
+ * (stage name + pinned version) is what the signed provenance manifest records.
+ *
+ * Nested values (#1378): the stages themselves operate on flat string values —
+ * a non-string attribute value (e.g. `tool.args` captured as an object) used
+ * to pass through every stage untouched and publish verbatim, leaking the
+ * exact strings the same pipeline redacted out of `tool.result`. `run()` now
+ * walks surviving object/array values after the flat pass and scrubs every
+ * string leaf through the same stage chain, keyed by the TOP-LEVEL attribute
+ * key so the key policy classifies leaves exactly like the flat value
+ * (`jinn.*` structural attributes stay raw; `drop` keys are already gone
+ * before the walk). Redactions from leaf runs carry the top-level key, so the
+ * redaction manifest and capture redaction diff report `tool.args` as the
+ * touched field.
+ */
+export declare class ScrubPipeline {
+    private readonly stages;
+    constructor(stages: ScrubStage[]);
+    get components(): Array<{
+        name: string;
+        version: string;
+    }>;
+    run(attributes: Attributes): Promise<ScrubResult>;
+    /** One pass of every stage over a flat attribute bag (the original `run`). */
+    private runStages;
+    /**
+     * Recursively scrub the string leaves of a nested attribute value through
+     * the full stage chain, using the top-level attribute key for policy
+     * classification. Non-container, non-string values (numbers, booleans,
+     * null) and non-plain objects pass through unchanged.
+     */
+    private scrubNested;
+}

package/dist/trajectory/scrub/pipeline.js

@@ -0,0 +1,83 @@
+/**
+ * Runs scrub stages in order over a span's attributes: each stage's output
+ * attributes feed the next, and redaction records accumulate across the whole
+ * chain. Stages may be async (e.g. the ML PII stage). The `components` list
+ * (stage name + pinned version) is what the signed provenance manifest records.
+ *
+ * Nested values (#1378): the stages themselves operate on flat string values —
+ * a non-string attribute value (e.g. `tool.args` captured as an object) used
+ * to pass through every stage untouched and publish verbatim, leaking the
+ * exact strings the same pipeline redacted out of `tool.result`. `run()` now
+ * walks surviving object/array values after the flat pass and scrubs every
+ * string leaf through the same stage chain, keyed by the TOP-LEVEL attribute
+ * key so the key policy classifies leaves exactly like the flat value
+ * (`jinn.*` structural attributes stay raw; `drop` keys are already gone
+ * before the walk). Redactions from leaf runs carry the top-level key, so the
+ * redaction manifest and capture redaction diff report `tool.args` as the
+ * touched field.
+ */
+export class ScrubPipeline {
+    stages;
+    constructor(stages) {
+        this.stages = stages;
+    }
+    get components() {
+        return this.stages.map((s) => ({ name: s.name, version: s.version }));
+    }
+    async run(attributes) {
+        const flat = await this.runStages(attributes);
+        const out = {};
+        const redactions = [...flat.redactions];
+        for (const [key, value] of Object.entries(flat.attributes)) {
+            // Flat strings were scrubbed by the pass above; only container values
+            // (objects/arrays) still hold unscrubbed string leaves.
+            out[key] = typeof value === 'string' ? value : await this.scrubNested(key, value, redactions);
+        }
+        return { attributes: out, redactions };
+    }
+    /** One pass of every stage over a flat attribute bag (the original `run`). */
+    async runStages(attributes) {
+        let current = attributes;
+        const redactions = [];
+        for (const stage of this.stages) {
+            const result = await stage.scrub(current);
+            current = result.attributes;
+            redactions.push(...result.redactions);
+        }
+        return { attributes: current, redactions };
+    }
+    /**
+     * Recursively scrub the string leaves of a nested attribute value through
+     * the full stage chain, using the top-level attribute key for policy
+     * classification. Non-container, non-string values (numbers, booleans,
+     * null) and non-plain objects pass through unchanged.
+     */
+    async scrubNested(key, value, redactions) {
+        if (typeof value === 'string') {
+            const result = await this.runStages({ [key]: value });
+            redactions.push(...result.redactions);
+            const scrubbed = result.attributes[key];
+            // Stages only rewrite strings; a `drop`-classified key never reaches
+            // here (dropped in the flat pass), so non-string means untouched.
+            return typeof scrubbed === 'string' ? scrubbed : value;
+        }
+        if (Array.isArray(value)) {
+            const items = [];
+            for (const item of value)
+                items.push(await this.scrubNested(key, item, redactions));
+            return items;
+        }
+        if (value !== null && typeof value === 'object') {
+            const proto = Object.getPrototypeOf(value);
+            if (proto !== Object.prototype && proto !== null)
+                return value; // non-plain: pass through
+            const entries = {};
+            for (const [k, v] of Object.entries(value)) {
+                entries[k] = await this.scrubNested(key, v, redactions);
+            }
+            return entries;
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/trajectory/scrub/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/pipeline.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAErD,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAAsB;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,sEAAsE;YACtE,wDAAwD;YACxD,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACzC,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,SAAS,CAAC,UAAsB;QAC5C,IAAI,OAAO,GAAG,UAAU,CAAC;QACzB,MAAM,UAAU,GAAsB,EAAE,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,WAAW,CACvB,GAAW,EACX,KAAc,EACd,UAA6B;QAE7B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACxC,qEAAqE;YACrE,kEAAkE;YAClE,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAc,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YACpF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC,CAAC,0BAA0B;YAC1F,MAAM,OAAO,GAA4B,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;gBACtE,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/trajectory/scrub/plain-patterns-stage.d.ts

@@ -0,0 +1,31 @@
+/**
+ * plain-patterns stage — deterministic regex redaction for two shapes the
+ * probabilistic stages demonstrably miss (issue #1330, found while building
+ * the harness-layer capture path in #1310):
+ *
+ *  - plain email addresses: openredaction's EMAIL pattern is unreliable
+ *    (misses e.g. `jane.doe@example-corp.com`);
+ *  - POSIX home-directory paths carrying a username
+ *    (`/Users/<name>/…`, `/home/<name>/…`) — nothing else touches paths.
+ *
+ * Graduated here from the harness-layer's capture-local stages so the daemon
+ * capture publish path and the harness layer share ONE implementation.
+ * Deliberately broad: over-redacting an email or a username is cheap; leaking
+ * one is not.
+ *
+ * An opt-in third set (`credentialIds`, #1415) adds deterministic cloud
+ * credential-ID prefixes for the seed profile, which runs without the entropy
+ * fallback that covers these shapes in the trace profile.
+ */
+import { type KeyPolicy } from './key-policy.js';
+import type { ScrubStage } from './types.js';
+export interface PlainPatternsOptions {
+    /**
+     * Adds the deterministic credential-ID prefixes above (#1415). Default false:
+     * the trace profile already catches these via secretlint's entropy fallback
+     * and must stay byte-identical. The seed profile (which runs without the
+     * fallback) turns this on.
+     */
+    credentialIds?: boolean;
+}
+export declare function plainPatternsStage(policy: KeyPolicy, opts?: PlainPatternsOptions): ScrubStage;

package/dist/trajectory/scrub/plain-patterns-stage.js

@@ -0,0 +1,85 @@
+/**
+ * plain-patterns stage — deterministic regex redaction for two shapes the
+ * probabilistic stages demonstrably miss (issue #1330, found while building
+ * the harness-layer capture path in #1310):
+ *
+ *  - plain email addresses: openredaction's EMAIL pattern is unreliable
+ *    (misses e.g. `jane.doe@example-corp.com`);
+ *  - POSIX home-directory paths carrying a username
+ *    (`/Users/<name>/…`, `/home/<name>/…`) — nothing else touches paths.
+ *
+ * Graduated here from the harness-layer's capture-local stages so the daemon
+ * capture publish path and the harness layer share ONE implementation.
+ * Deliberately broad: over-redacting an email or a username is cheap; leaking
+ * one is not.
+ *
+ * An opt-in third set (`credentialIds`, #1415) adds deterministic cloud
+ * credential-ID prefixes for the seed profile, which runs without the entropy
+ * fallback that covers these shapes in the trace profile.
+ */
+import { classifyKey } from './key-policy.js';
+const VERSION = '0.1.0';
+/** Plain email shape. */
+const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])+)+/g;
+/** POSIX home-dir path segment carrying a username. */
+const HOME_PATH_PATTERN = /\/(?:Users|home)\/[^/\s"'`]+/g;
+const PATTERNS = [
+    { pattern: EMAIL_PATTERN, replacement: '[EMAIL]', detail: 'email', kind: 'pii' },
+    { pattern: HOME_PATH_PATTERN, replacement: '/users/anon', detail: 'home-path', kind: 'pii' },
+];
+/**
+ * Bare AWS access-key ID — the fixed four-char prefixes + 16 key chars that
+ * secretlint's aws rule only scans for under `enableIDScanRule: true`, which
+ * preset-recommend leaves off (#1415).
+ */
+const AWS_KEY_ID_PATTERN = /\b(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b/g;
+/**
+ * GCP API key: fixed `AIza` prefix + 35 key chars. No trailing `\b` — the key
+ * charset includes `-`, which breaks word-boundary semantics at the end.
+ */
+const GCP_API_KEY_PATTERN = /\bAIza[0-9A-Za-z_-]{35}/g;
+const CREDENTIAL_ID_PATTERNS = [
+    {
+        pattern: AWS_KEY_ID_PATTERN,
+        replacement: '[SECRET:aws-access-key-id]',
+        detail: 'aws-access-key-id',
+        kind: 'secret',
+    },
+    {
+        pattern: GCP_API_KEY_PATTERN,
+        replacement: '[SECRET:gcp-api-key]',
+        detail: 'gcp-api-key',
+        kind: 'secret',
+    },
+];
+export function plainPatternsStage(policy, opts = {}) {
+    const patterns = opts.credentialIds ? [...PATTERNS, ...CREDENTIAL_ID_PATTERNS] : PATTERNS;
+    return {
+        name: 'plain-patterns',
+        version: VERSION,
+        scrub(attributes) {
+            const out = {};
+            const redactions = [];
+            for (const [key, value] of Object.entries(attributes)) {
+                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content') {
+                    out[key] = value;
+                    continue;
+                }
+                let scrubbed = value;
+                for (const { pattern, replacement, detail, kind } of patterns) {
+                    let hits = 0;
+                    scrubbed = scrubbed.replace(pattern, () => {
+                        hits += 1;
+                        return replacement;
+                    });
+                    for (let i = 0; i < hits; i += 1) {
+                        redactions.push({ key, stage: 'plain-patterns', kind, detail });
+                    }
+                }
+                out[key] = scrubbed;
+            }
+            return { attributes: out, redactions };
+        },
+    };
+}
+//# sourceMappingURL=plain-patterns-stage.js.map

package/dist/trajectory/scrub/plain-patterns-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plain-patterns-stage.js","sourceRoot":"","sources":["../../../src/trajectory/scrub/plain-patterns-stage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAkB,MAAM,iBAAiB,CAAC;AAG9D,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,yBAAyB;AACzB,MAAM,aAAa,GACjB,4GAA4G,CAAC;AAE/G,uDAAuD;AACvD,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAI1D,MAAM,QAAQ,GAAkB;IAC9B,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE;IAChF,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE;CAC7F,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GACtB,0EAA0E,CAAC;AAE7E;;;GAGG;AACH,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAEvD,MAAM,sBAAsB,GAAkB;IAC5C;QACE,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,4BAA4B;QACzC,MAAM,EAAE,mBAAmB;QAC3B,IAAI,EAAE,QAAQ;KACf;IACD;QACE,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,sBAAsB;QACnC,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,QAAQ;KACf;CACF,CAAC;AAYF,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,OAA6B,EAAE;IACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1F,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,OAAO;QAChB,KAAK,CAAC,UAAsB;YAC1B,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAsB,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;oBACxE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;oBACjB,SAAS;gBACX,CAAC;gBACD,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAC9D,IAAI,IAAI,GAAG,CAAC,CAAC;oBACb,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;wBACxC,IAAI,IAAI,CAAC,CAAC;wBACV,OAAO,WAAW,CAAC;oBACrB,CAAC,CAAC,CAAC;oBACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;wBACjC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;oBAClE,CAAC;gBACH,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACtB,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC"}