@mnemonik/shared 7.141.0 → 7.141.2

package/dist/redactCredentials.js

@@ -0,0 +1,491 @@
+const REDACTED = '<redacted credential>';
+const PEM_BEGIN = '-----BEGIN ';
+const MAX_PEM_LABEL_LENGTH = 64;
+const MAX_PEM_BODY_LENGTH = 8 * 1024;
+/**
+ * A password redacted where a rule recognised it (an sshpass command) is also
+ * redacted where the same string recurs (the same password named in prose),
+ * but only from this length up: a short value recurs in ordinary words by
+ * chance. See isDistinctiveValue for the other condition.
+ */
+const MIN_REPEATED_VALUE_LENGTH = 6;
+/**
+ * A value worth chasing mixes at least two of lower case, upper case, digits
+ * and other characters. A password that is a plain word ("postgres" in a local
+ * connection string, a project name) recurs as that word, in URLs and prose
+ * that are not about the password at all.
+ */
+function isDistinctiveValue(value) {
+    const classes = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/].filter((re) => re.test(value));
+    return value.length >= MIN_REPEATED_VALUE_LENGTH && classes.length >= 2;
+}
+/**
+ * Every rule's value must hold a letter or a digit. Prose and code put
+ * punctuation where a value would go ("--password=; repeated copies",
+ * "API_KEY = ================", "Bearer ...", "user:***@"), and a run of
+ * punctuation is never a credential. Placeholders are judged separately, as
+ * before.
+ */
+const LETTER_OR_DIGIT = /[A-Za-z0-9]/;
+function hasLetterOrDigit(value) {
+    return LETTER_OR_DIGIT.test(value);
+}
+/** Replace the value of a `<context><value>` match, unless the value holds no letter or digit. */
+function redactContextValue(match, head = '', value = '') {
+    return hasLetterOrDigit(value) ? `${head}${REDACTED}` : match;
+}
+// A URL password (connection string or HTTP basic auth), or a value found
+// elsewhere, that is documentation, not a credential: a marker another redactor
+// left, a template variable, a mask, a stock word, or a "your-api-key-here"
+// phrase (production held one in consolidation history, 2026-10-13; chased, it
+// would have replaced the phrase in a memory, a fact and two versions).
+const PLACEHOLDER_PASSWORD = /^(?:\[REDACTED(?::[A-Za-z0-9_-]+)?\]|redacted|<[^<>]*>|\{\{[^{}]*\}\}|\$\{[^{}]+\}|%[A-Za-z_][A-Za-z0-9_]*%|\*+|x{3,}|\.\.\.|\u2026|password|passwd|pass|pwd|pw|secret|changeme|change[_-]me|example|test|(?:your|my)[a-z_-]*?(?:password|passwd|pass|pwd|secret|key|token|here))$/i;
+// $VAR is matched case-sensitively: an upper-case name is an environment
+// variable; a lower-case `$ecret1` could be a real password.
+const PLACEHOLDER_ENV_VAR = /^\$[A-Z_][A-Z0-9_]*$/;
+function isPlaceholderPassword(password) {
+    return PLACEHOLDER_PASSWORD.test(password) || PLACEHOLDER_ENV_VAR.test(password);
+}
+/** Replace the password of a `scheme://user:password@` match, keeping the rest. */
+function redactUrlPassword(match, head = '', password = '') {
+    return isPlaceholderPassword(password) || !hasLetterOrDigit(password)
+        ? match
+        : `${head}${REDACTED}@`;
+}
+// A shell word in a password position: single-quoted, double-quoted, or bare.
+// A bare word stops at whitespace, quotes, backticks and shell operators. It
+// never starts on a marker this module left, so a second pass changes nothing,
+// nor on a bracket, brace, slash, backslash or comma, which in that position is
+// code (a regex or template under construction, an awk pattern such as
+// `/^PGPASSWORD=/`), not a password.
+const SHELL_WORD = String.raw `'[^'\n]*'|"[^"\n]*"|(?!${REDACTED})[^\s'"\`;|&()[\]{}\\,/][^\s'"\`;|&]*`;
+// A quote that may open a string around the whole assignment or command
+// (`"PGPASSWORD=" pw` in awk, `"--password=" + pw` in code).
+const OPENING_QUOTE = String.raw `(["'\`]?)`;
+// Trailing punctuation of a bare word in prose ("... sshpass -p <password>.").
+const TRAILING_PUNCTUATION = /[.,:;!?)\]}]+$/;
+// Words that follow a password flag in prose about the flag, not a password:
+// "sshpass -p is unsafe", "pass it with sshpass -p in a script".
+const PROSE_WORDS = new Set([
+    'a',
+    'an',
+    'and',
+    'as',
+    'for',
+    'in',
+    'is',
+    'it',
+    'on',
+    'or',
+    'the',
+    'to',
+    'with',
+    'flag',
+    'option',
+    'argument',
+    'instead',
+    'which',
+    'that',
+    'this',
+    'puts',
+    'passes',
+    'leaks',
+    'exposes',
+]);
+// A regex delimiter inside a bare word: a `/` that ends it or that code
+// punctuation follows (`abc/ {`, `abc/{print`, `abc/)`). An awk or sed pattern
+// such as `/^PGPASSWORD=abc/ { ... }`, not a password.
+const REGEX_DELIMITER = /\/(?:[{}()[\];]|$)/;
+/**
+ * The password a shell word carries, or null when it carries none: an
+ * expansion (`$PASS`, `"$PASS"`, `"$(cat file)"`; only single quotes make `$`
+ * literal), a documentation placeholder, a word with no letter or digit (code
+ * punctuation, an ellipsis), a quoted word that starts or ends with whitespace
+ * (its first quote closed a string, as in `"PGPASSWORD=" pw; ... "`), a bare
+ * word ending at a regex delimiter, or a prose word.
+ */
+function shellWordSecret(word) {
+    const quote = word[0];
+    if ((quote === "'" || quote === '"') && word.length >= 2 && word.endsWith(quote)) {
+        const inner = word.slice(1, -1);
+        if (!hasLetterOrDigit(inner) || (quote === '"' && inner.startsWith('$')))
+            return null;
+        if (inner !== inner.trim())
+            return null;
+        return isPlaceholderPassword(inner) ? null : inner;
+    }
+    if (word.startsWith('$'))
+        return null;
+    const core = word.replace(TRAILING_PUNCTUATION, '');
+    if (!hasLetterOrDigit(core) || isPlaceholderPassword(core))
+        return null;
+    if (REGEX_DELIMITER.test(core))
+        return null;
+    return PROSE_WORDS.has(core.toLowerCase()) ? null : core;
+}
+/** Replace the password word of a command, keeping the command around it. */
+function redactShellWord(match, head = '', word = '', tail = '') {
+    return shellWordSecret(word) === null ? match : `${head}${REDACTED}${tail}`;
+}
+/**
+ * As redactShellWord, for a rule that may start inside a string: when the
+ * assignment or option is itself quoted and its value position holds the same
+ * quote (`"PGPASSWORD=" pw`, `'--password=' + pw`), that quote closes the
+ * string; the program supplies the value from a variable.
+ */
+function redactQuotedShellWord(match, head = '', openingQuote = '', word = '', tail = '') {
+    if (openingQuote !== '' && word.startsWith(openingQuote))
+        return match;
+    return redactShellWord(match, head, word, tail);
+}
+// The programs sshpass is run in front of. A bare lower-case word after -p is
+// taken for a password only when one of these follows it.
+const SSHPASS_COMMAND = String.raw `ssh|scp|sftp|rsync|ssh-copy-id|ansible[\w-]*`;
+/**
+ * As redactShellWord, for `sshpass -p`, whose flag agents also write about
+ * ("the sshpass -p form, ...", "rules for sshpass -p passwords"): a bare
+ * all-lower-case word counts as a password only when the command sshpass runs
+ * follows it. Every sshpass password in production on 2026-10-12 (63 copies)
+ * was followed by ssh or scp; the one prose mention was a lower-case word
+ * followed by more prose. A lower-case password at the end of a line is the
+ * miss this accepts.
+ */
+function redactSshpassWord(match, head = '', openingQuote = '', word = '', tail = '', command = '') {
+    if (openingQuote !== '' && word.startsWith(openingQuote))
+        return match;
+    const secret = shellWordSecret(word);
+    if (secret === null)
+        return match;
+    const bare = word[0] !== "'" && word[0] !== '"';
+    if (bare && /^[a-z]+$/.test(secret) && command === '')
+        return match;
+    return `${head}${REDACTED}${tail}`;
+}
+const PATTERNS = [
+    {
+        kind: 'bearer',
+        pattern: /(\bBearer\s+)([^\s]{40,})/gi,
+        replacement: redactContextValue,
+        secretGroup: 2,
+    },
+    {
+        // Before openai, whose sk- shape would otherwise claim these keys.
+        kind: 'anthropic',
+        pattern: /(?<![A-Za-z0-9_-])sk-ant-(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'openai',
+        pattern: /(?<![A-Za-z0-9_-])sk-(?:proj-)?(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'shopify',
+        pattern: /(?<![A-Za-z0-9_])shp(?:at|ss|ca)_[A-Za-z0-9]{16,}(?![A-Za-z0-9])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'aws_access_key',
+        pattern: /(?<![A-Z0-9])AKIA[A-Z0-9]{16}(?![A-Z0-9])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'github',
+        pattern: /(?<![A-Za-z0-9_])gh[opu]_[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'slack',
+        pattern: /(?<![A-Za-z0-9-])xox[abp]-(?=-*[A-Za-z0-9])[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'sentry',
+        pattern: /(?<![A-Za-z0-9_])sntry[us]_(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'fly',
+        pattern: /(?<![A-Za-z0-9_])(?:FlyV1\s+)?fm2_(?=[_-]*[A-Za-z0-9])[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'google_api_key',
+        pattern: /(?<![A-Za-z0-9_-])AIza(?=[_-]*[A-Za-z0-9])[0-9A-Za-z_-]{35}(?![A-Za-z0-9_-])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'jwt',
+        // header.payload.signature, both JSON segments starting eyJ. The length
+        // floors keep `eyJ...` prose and signature-less examples out.
+        pattern: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'mnemonik_component_token',
+        // mnc_ / mncr_ + 43 base64url (oauth/components.ts); 32+ also catches a
+        // partial token. The body must contain an upper-case letter or digit, so a
+        // snake_case identifier is not mistaken for one; the 8-character
+        // display prefix (mnc_ + 8) is too short.
+        pattern: /(?<![A-Za-z0-9_])mncr?_(?=[A-Za-z0-9_-]*[A-Z0-9])[A-Za-z0-9_-]{32,}/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'stripe',
+        // Secret and restricted keys (sk_/rk_ live|test) and webhook signing secrets.
+        pattern: /(?<![A-Za-z0-9_])(?:(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}|whsec_[A-Za-z0-9]{20,})(?![A-Za-z0-9])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'mnemonik_proxy_token',
+        // pxt_ + 32 hex (the format server.ts validates). A bare prefix in prose is left.
+        pattern: /(?<![A-Za-z0-9_])pxt_[0-9a-f]{32,}/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'mnemonik_api_key',
+        // mnk_ + 64 hex (AuthManager.generateApiKey); 32+ also catches a half key.
+        // The stored 12-character key_prefix (mnk_ + 8 hex) is not a credential.
+        pattern: /(?<![A-Za-z0-9_])mnk_[0-9a-f]{32,}/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'mnemonik_api_key_legacy',
+        // mnk_ + 43 base64url: keys minted by hand before AuthManager's hex form
+        // (production's only key in 2026-10 has this shape, and one stored memory
+        // held a development key in it). Authentication accepts any mnk_ bearer.
+        // The body needs upper and lower case and a digit, so a snake_case
+        // identifier that starts mnk_ is not taken for one.
+        pattern: /(?<![A-Za-z0-9_])mnk_(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*[a-z])(?=[A-Za-z0-9_-]*[0-9])[A-Za-z0-9_-]{40,}(?![A-Za-z0-9_-])/g,
+        replacement: REDACTED,
+    },
+    {
+        kind: 'named_value',
+        pattern: /(\b[A-Za-z_][A-Za-z0-9_]*(?:_TOKEN|_KEY|_SECRET|_PASSWORD|_PASS|APIKEY|API_KEY)\s*(?:=|:)\s*)([^\s]{16,})/gi,
+        replacement: redactContextValue,
+        secretGroup: 2,
+    },
+    {
+        kind: 'connection_string',
+        // scheme://user:password@host: only the password is replaced; scheme,
+        // user, host and database stay readable. The user may be empty
+        // (redis://:password@host). The password runs to the last `@` before a
+        // path, query, fragment, quote or whitespace, so an unencoded `@` inside
+        // it is still covered. Runs after named_value, which already replaces a
+        // whole URL assigned to a secret-named variable.
+        pattern: /\b((?:postgres(?:ql)?|mysql|mariadb|mongodb|rediss?|amqps?|mssql|sqlserver)(?:\+[a-z0-9]+)?:\/\/[^\s:/?#@'"`<>]{0,256}:)([^\s/?#'"`]{1,512})@/gi,
+        replacement: redactUrlPassword,
+        secretGroup: 2,
+    },
+    {
+        kind: 'url_basic_auth',
+        // https://user:password@host: same shape and placeholder rules as a
+        // connection string; only the password is replaced.
+        pattern: /\b(https?:\/\/[^\s:/?#@'"`<>]{0,256}:)([^\s/?#'"`]{1,512})@/gi,
+        replacement: redactUrlPassword,
+        secretGroup: 2,
+    },
+    // Command-line passwords. Each keeps the command and replaces only the
+    // password word; an expansion or placeholder in that position is left.
+    {
+        // sshpass -p <password> (also -p'<password>' and -p"<password>"), after
+        // any other sshpass flags. 13 memories, 11 scanner chunks, 15 versions and
+        // 6 dated facts in production held one on 2026-10-12.
+        kind: 'sshpass_password',
+        pattern: new RegExp(String.raw `(${OPENING_QUOTE}\bsshpass(?:[ \t]+-[a-oq-zA-Z]\S*)*[ \t]+-p[ \t]*)(${SHELL_WORD})()(?=((?:[ \t]+(?:${SSHPASS_COMMAND})(?![\w-]))?))`, 'g'),
+        replacement: redactSshpassWord,
+        secretGroup: 3,
+        commandLine: true,
+    },
+    {
+        // Environment variables whose only purpose is a password, in shell
+        // assignment form (no space around `=`): libpq's PGPASSWORD (one memory,
+        // version and fact in production), MySQL's MYSQL_PWD, sshpass -e's
+        // SSHPASS. named_value needs an `_PASSWORD`-style suffix and 16
+        // characters, so it misses all three. Not an awk program that matches or
+        // prints the assignment: `/^PGPASSWORD=/ { print "PGPASSWORD=" pw }`.
+        kind: 'password_env_var',
+        pattern: new RegExp(String.raw `(${OPENING_QUOTE}\b(?:PGPASSWORD|MYSQL_PWD|SSHPASS)=)(${SHELL_WORD})()`, 'g'),
+        replacement: redactQuotedShellWord,
+        secretGroup: 3,
+        commandLine: true,
+    },
+    {
+        // --password=<value>, the long option every CLI that takes one spells
+        // this way. The `=` keeps prose about the option ("--password is
+        // required") out; the spaced form is not matched for that reason.
+        kind: 'password_option',
+        pattern: new RegExp(String.raw `(${OPENING_QUOTE}(?<![\w-])--password=)(${SHELL_WORD})()`, 'g'),
+        replacement: redactQuotedShellWord,
+        secretGroup: 3,
+        commandLine: true,
+    },
+    {
+        // echo <password> | sudo -S: sudo reads the password from stdin. One
+        // memory, two versions and two facts in production.
+        kind: 'sudo_password',
+        pattern: new RegExp(String.raw `(\becho[ \t]+(?:-[neE]+[ \t]+)?)(${SHELL_WORD})([ \t]*\|[ \t]*sudo\b[^|\n]*?[ \t](?:-[A-Za-z]*S[A-Za-z]*|--stdin)\b)`, 'g'),
+        replacement: redactShellWord,
+        secretGroup: 2,
+        commandLine: true,
+    },
+];
+function isPrivateKeyLabel(label) {
+    if (label === 'PRIVATE KEY')
+        return true;
+    if (!label.endsWith(' PRIVATE KEY'))
+        return false;
+    const prefix = label.slice(0, -' PRIVATE KEY'.length);
+    return prefix.split(' ').every((word) => word.length > 0 &&
+        [...word].every((char) => {
+            const code = char.charCodeAt(0);
+            return (code >= 48 && code <= 57) || (code >= 65 && code <= 90);
+        }));
+}
+/** Linear, bounded PEM scanner. Unterminated or oversized blocks are preserved. */
+function redactPemPrivateKeys(text) {
+    const pieces = [];
+    let copiedThrough = 0;
+    let cursor = 0;
+    let redactions = 0;
+    while (cursor < text.length) {
+        const begin = text.indexOf(PEM_BEGIN, cursor);
+        if (begin === -1)
+            break;
+        const labelStart = begin + PEM_BEGIN.length;
+        const headerEnd = text.indexOf('-----', labelStart);
+        if (headerEnd === -1 || headerEnd - labelStart > MAX_PEM_LABEL_LENGTH) {
+            cursor = labelStart;
+            continue;
+        }
+        const label = text.slice(labelStart, headerEnd);
+        if (!isPrivateKeyLabel(label)) {
+            cursor = headerEnd + 5;
+            continue;
+        }
+        const bodyStart = headerEnd + 5;
+        const endMarker = `-----END ${label}-----`;
+        const nextBegin = text.indexOf(PEM_BEGIN, bodyStart);
+        const boundedEnd = Math.min(text.length, bodyStart + MAX_PEM_BODY_LENGTH + endMarker.length);
+        const scanEnd = nextBegin === -1 ? boundedEnd : Math.min(nextBegin, boundedEnd);
+        const endOffset = text.slice(bodyStart, scanEnd).indexOf(endMarker);
+        if (endOffset >= 0 && endOffset <= MAX_PEM_BODY_LENGTH) {
+            const end = bodyStart + endOffset + endMarker.length;
+            pieces.push(text.slice(copiedThrough, begin), REDACTED);
+            copiedThrough = end;
+            cursor = end;
+            redactions++;
+            continue;
+        }
+        cursor = scanEnd > begin ? scanEnd : labelStart;
+    }
+    if (redactions === 0)
+        return { text, redactions };
+    pieces.push(text.slice(copiedThrough));
+    return { text: pieces.join(''), redactions };
+}
+/**
+ * The value a rule redacted, in the form worth chasing elsewhere in the text,
+ * or null when it is too short or too plain (isDistinctiveValue), a
+ * placeholder, or part of this module's own marker.
+ */
+function chaseableValue(raw, commandLine) {
+    let value = raw;
+    if (commandLine)
+        value = shellWordSecret(raw);
+    else if (/^(["'`]).+\1$/.test(raw))
+        value = raw.slice(1, -1);
+    if (value === null || !isDistinctiveValue(value))
+        return null;
+    if (isPlaceholderPassword(value) || REDACTED.includes(value))
+        return null;
+    return value;
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Redact every recurrence of `values` that stands as a whole word (not inside
+ * a longer run of letters, digits or underscores), outside the markers already
+ * in the text.
+ */
+function redactRecurrences(text, values) {
+    const present = [...values].filter((value) => text.includes(value));
+    if (present.length === 0)
+        return { text, redactions: 0 };
+    // Longest first, so a value that contains another is replaced whole.
+    present.sort((a, b) => b.length - a.length);
+    const pattern = new RegExp(`(?<![A-Za-z0-9_])(?:${present.map(escapeRegExp).join('|')})(?![A-Za-z0-9_])`, 'g');
+    let redactions = 0;
+    const pieces = text.split(REDACTED).map((piece) => piece.replace(pattern, () => {
+        redactions++;
+        return REDACTED;
+    }));
+    return { text: pieces.join(REDACTED), redactions };
+}
+function redact(text, options, values) {
+    const commandLineOnly = options.commandLineOnly === true;
+    const pem = commandLineOnly ? { text, redactions: 0 } : redactPemPrivateKeys(text);
+    let redactedText = pem.text;
+    let redactions = pem.redactions;
+    const kinds = pem.redactions > 0 ? ['pem_private_key'] : [];
+    for (const { kind, pattern, replacement, secretGroup, commandLine } of PATTERNS) {
+        if (commandLineOnly && !commandLine)
+            continue;
+        let matches = 0;
+        if (typeof replacement === 'string') {
+            matches = redactedText.match(pattern)?.length ?? 0;
+            redactedText = redactedText.replace(pattern, replacement);
+        }
+        else {
+            redactedText = redactedText.replace(pattern, (match, ...args) => {
+                // args = [...captureGroups, offset, input]; a non-participating group is undefined.
+                const offsetIndex = args.findIndex((arg) => typeof arg === 'number');
+                const groups = args
+                    .slice(0, offsetIndex)
+                    .map((group) => (typeof group === 'string' ? group : ''));
+                const next = replacement(match, ...groups);
+                if (next !== match) {
+                    matches++;
+                    const secret = secretGroup ? groups[secretGroup - 1] : undefined;
+                    const value = secret ? chaseableValue(secret, commandLine === true) : null;
+                    if (value !== null)
+                        values.add(value);
+                }
+                return next;
+            });
+        }
+        if (matches > 0) {
+            redactions += matches;
+            kinds.push(kind);
+        }
+    }
+    const chase = new Set(values);
+    for (const known of options.knownValues ?? []) {
+        if (isDistinctiveValue(known) && !isPlaceholderPassword(known) && !REDACTED.includes(known)) {
+            chase.add(known);
+        }
+    }
+    const repeated = redactRecurrences(redactedText, chase);
+    if (repeated.redactions > 0) {
+        redactedText = repeated.text;
+        redactions += repeated.redactions;
+        kinds.push('repeated_credential');
+    }
+    return { text: redactedText, redactions, kinds };
+}
+export function redactCredentials(text, options = {}) {
+    return redact(text, options, new Set());
+}
+/**
+ * The credential values the context rules (command-line passwords, URL
+ * passwords, named values, Bearer tokens) would redact from `text`, for a
+ * caller that redacts them across many texts (`knownValues`). The values are
+ * secrets: never log, print, store or return them.
+ */
+export function credentialValues(text, options = {}) {
+    const values = new Set();
+    redact(text, options, values);
+    return values;
+}
+//# sourceMappingURL=redactCredentials.js.map

package/dist/redactCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactCredentials.js","sourceRoot":"","sources":["../src/redactCredentials.ts"],"names":[],"mappings":"AAAA,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AACzC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,CAAC;AACrC;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC,MAAM,IAAI,yBAAyB,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;AAC1E,CAAC;AAuCD;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,aAAa,CAAC;AAEtC,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,kGAAkG;AAClG,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE;IAC9D,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAChE,CAAC;AAED,0EAA0E;AAC1E,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,oBAAoB,GACxB,qRAAqR,CAAC;AACxR,yEAAyE;AACzE,6DAA6D;AAC7D,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAEnD,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnF,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAa,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE;IAChE,OAAO,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QACnE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,IAAI,GAAG,QAAQ,GAAG,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,uEAAuE;AACvE,qCAAqC;AACrC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAA,0BAA0B,QAAQ,uCAAuC,CAAC;AACvG,wEAAwE;AACxE,6DAA6D;AAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAA,WAAW,CAAC;AAC5C,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAC9C,6EAA6E;AAC7E,iEAAiE;AACjE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,GAAG;IACH,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,MAAM;IACN,MAAM;IACN,QAAQ;IACR,UAAU;IACV,SAAS;IACT,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAEH,wEAAwE;AACxE,+EAA+E;AAC/E,uDAAuD;AACvD,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,KAAa,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE;IACrE,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,KAAa,EACb,IAAI,GAAG,EAAE,EACT,YAAY,GAAG,EAAE,EACjB,IAAI,GAAG,EAAE,EACT,IAAI,GAAG,EAAE;IAET,IAAI,YAAY,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAA,8CAA8C,CAAC;AAEjF;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CACxB,KAAa,EACb,IAAI,GAAG,EAAE,EACT,YAAY,GAAG,EAAE,EACjB,IAAI,GAAG,EAAE,EACT,IAAI,GAAG,EAAE,EACT,OAAO,GAAG,EAAE;IAEZ,IAAI,YAAY,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;IAChD,IAAI,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,QAAQ,GAAwB;IACpC;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EAAE,CAAC;KACf;IACD;QACE,mEAAmE;QACnE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,mFAAmF;QAC5F,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EACL,yFAAyF;QAC3F,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,mEAAmE;QAC5E,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,4CAA4C;QACrD,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,2DAA2D;QACpE,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,+EAA+E;QACxF,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,qFAAqF;QAC9F,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,KAAK;QACX,OAAO,EACL,4FAA4F;QAC9F,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,+EAA+E;QACxF,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,KAAK;QACX,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EACL,oGAAoG;QACtG,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,wEAAwE;QACxE,2EAA2E;QAC3E,iEAAiE;QACjE,0CAA0C;QAC1C,OAAO,EAAE,sEAAsE;QAC/E,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,8EAA8E;QAC9E,OAAO,EACL,sGAAsG;QACxG,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,kFAAkF;QAClF,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,2EAA2E;QAC3E,yEAAyE;QACzE,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,oDAAoD;QACpD,OAAO,EACL,gIAAgI;QAClI,WAAW,EAAE,QAAQ;KACtB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EACL,6GAA6G;QAC/G,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EAAE,CAAC;KACf;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,sEAAsE;QACtE,+DAA+D;QAC/D,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,iDAAiD;QACjD,OAAO,EACL,iJAAiJ;QACnJ,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE,CAAC;KACf;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,oEAAoE;QACpE,oDAAoD;QACpD,OAAO,EAAE,+DAA+D;QACxE,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE,CAAC;KACf;IACD,uEAAuE;IACvE,uEAAuE;IACvE;QACE,wEAAwE;QACxE,2EAA2E;QAC3E,sDAAsD;QACtD,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,IAAI,MAAM,CACjB,MAAM,CAAC,GAAG,CAAA,IAAI,aAAa,sDAAsD,UAAU,sBAAsB,eAAe,gBAAgB,EAChJ,GAAG,CACJ;QACD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE,CAAC;QACd,WAAW,EAAE,IAAI;KAClB;IACD;QACE,mEAAmE;QACnE,yEAAyE;QACzE,mEAAmE;QACnE,gEAAgE;QAChE,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,IAAI,MAAM,CACjB,MAAM,CAAC,GAAG,CAAA,IAAI,aAAa,wCAAwC,UAAU,KAAK,EAClF,GAAG,CACJ;QACD,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE,CAAC;QACd,WAAW,EAAE,IAAI;KAClB;IACD;QACE,sEAAsE;QACtE,iEAAiE;QACjE,kEAAkE;QAClE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,IAAI,aAAa,0BAA0B,UAAU,KAAK,EAAE,GAAG,CAAC;QAC9F,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE,CAAC;QACd,WAAW,EAAE,IAAI;KAClB;IACD;QACE,qEAAqE;QACrE,oDAAoD;QACpD,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,IAAI,MAAM,CACjB,MAAM,CAAC,GAAG,CAAA,oCAAoC,UAAU,wEAAwE,EAChI,GAAG,CACJ;QACD,WAAW,EAAE,eAAe;QAC5B,WAAW,EAAE,CAAC;QACd,WAAW,EAAE,IAAI;KAClB;CACF,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAC5B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM;QAExB,MAAM,UAAU,GAAG,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACpD,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,UAAU,GAAG,oBAAoB,EAAE,CAAC;YACtE,MAAM,GAAG,UAAU,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,YAAY,KAAK,OAAO,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAChF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEpE,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,IAAI,mBAAmB,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;YACxD,aAAa,GAAG,GAAG,CAAC;YACpB,MAAM,GAAG,GAAG,CAAC;YACb,UAAU,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QAED,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;IAClD,CAAC;IAED,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,WAAoB;IACvD,IAAI,KAAK,GAAkB,GAAG,CAAC;IAC/B,IAAI,WAAW;QAAE,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;SACzC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,qBAAqB,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,IAAY,EACZ,MAA2B;IAE3B,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACzD,qEAAqE;IACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,MAAM,CACxB,uBAAuB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAC7E,GAAG,CACJ,CAAC;IACF,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;QAC1B,UAAU,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CACH,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CACb,IAAY,EACZ,OAAiC,EACjC,MAAmB;IAEnB,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnF,IAAI,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC;IAC5B,IAAI,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAChC,MAAM,KAAK,GAAa,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtE,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,QAAQ,EAAE,CAAC;QAChF,IAAI,eAAe,IAAI,CAAC,WAAW;YAAE,SAAS;QAC9C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;YACnD,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAa,EAAE,GAAG,IAAe,EAAE,EAAE;gBACjF,oFAAoF;gBACpF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC;gBACrE,MAAM,MAAM,GAAG,IAAI;qBAChB,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC;qBACrB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC;gBAC3C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;oBACnB,OAAO,EAAE,CAAC;oBACV,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACjE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC3E,IAAI,KAAK,KAAK,IAAI;wBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACxC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,UAAU,IAAI,OAAO,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5F,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QAC5B,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC7B,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,OAAO,GAA6B,EAAE;IAMtC,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,OAAO,GAAsD,EAAE;IAE/D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/secretPatterns.d.ts

@@ -40,6 +40,9 @@
  * guarded against hashes, UUIDs, paths, slugs and identifiers.
  */
 export declare const SECRET_REDACTION_PLACEHOLDER = "[REDACTED]";
+export declare const SECRET_LABEL_RE: RegExp;
+/** Keep physical and escaped newline sequences, including JS line continuations. */
+export declare function redactSecretValue(value: string): string;
 export declare const SECRET_PATTERNS: ReadonlyArray<RegExp>;
 /**
  * Redact standalone high-entropy tokens that no provider pattern claimed.

package/dist/secretPatterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secretPatterns.d.ts","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,eAAO,MAAM,4BAA4B,eAAe,CAAC;AASzD,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,MAAM,CAoDjD,CAAC;AA4HF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAc5D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWjD"}
+{"version":3,"file":"secretPatterns.d.ts","sourceRoot":"","sources":["../src/secretPatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,eAAO,MAAM,4BAA4B,eAAe,CAAC;AAGzD,eAAO,MAAM,eAAe,QAA6D,CAAC;AAM1F,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKvD;AA0ED,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,MAAM,CAiDjD,CAAC;AA4HF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAc5D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAejD"}

package/dist/secretPatterns.js

@@ -40,6 +40,83 @@
  * guarded against hashes, UUIDs, paths, slugs and identifiers.
  */
 export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED]';
+const SECRET_LABEL = String.raw `[\w$-]*(?:api[_-]?key|secret|token|password|credential|auth)|aws_secret_access_key`;
+export const SECRET_LABEL_RE = new RegExp(`^(?:${SECRET_LABEL}|MYSQL_PWD|SSHPASS)$`, 'i');
+const LABELED_VALUE_RE = new RegExp(String.raw `(?<![\w$-])((["']?)(?:${SECRET_LABEL})\2\s*[:=]\s*)(?=\S)`, 'gi');
+/** Keep physical and escaped newline sequences, including JS line continuations. */
+export function redactSecretValue(value) {
+    return (SECRET_REDACTION_PLACEHOLDER +
+        (value.match(/\\(?:\r\n|[\r\n])|\r\n|[\r\n]|\\[rn]/g)?.join('') ?? ''));
+}
+function redactLabeledValues(text) {
+    let result = '';
+    let offset = 0;
+    LABELED_VALUE_RE.lastIndex = 0;
+    for (const match of text.matchAll(LABELED_VALUE_RE)) {
+        if (match.index < offset)
+            continue;
+        const start = match.index + match[0].length;
+        const escaped = text[start] === '\\' && /^["']/.test(text.charAt(start + 1));
+        const quote = escaped
+            ? text.charAt(start + 1)
+            : /^["'`]/.test(text.charAt(start))
+                ? text.charAt(start)
+                : '';
+        const delimiter = (escaped ? '\\' : '') + quote;
+        let end = start;
+        let closed = false;
+        if (quote) {
+            end += delimiter.length;
+            while (end < text.length) {
+                if (text[end] === '\\') {
+                    if (escaped) {
+                        const begin = end;
+                        while (text[end] === '\\')
+                            end++;
+                        // A quoted value embedded in a string: \" closes, \\\" escapes its quote.
+                        if (text[end] === quote && (end - begin) % 4 === 1) {
+                            end++;
+                            closed = true;
+                            break;
+                        }
+                        end = Math.min(end + 1, text.length);
+                    }
+                    else {
+                        end = Math.min(end + 2, text.length);
+                    }
+                }
+                else if (text[end++] === quote && !escaped) {
+                    closed = true;
+                    break;
+                }
+            }
+        }
+        else {
+            // Never split an escape pair and leave its quote as executable syntax.
+            end += /^(?:\\[^\r\n]|[^\s"'`,;()[\]{}\\])+/.exec(text.slice(start))?.[0].length ?? 0;
+        }
+        const value = text.slice(start, end);
+        if (!/[A-Za-z0-9]/.test(value) || ENV_READ_VALUE_RE.test(match[0] + value))
+            continue;
+        // The quote closes a command string or anchored label search, such as '^API_KEY='.
+        if (quote &&
+            !escaped &&
+            (text[match.index - 1] === quote ||
+                (text[match.index - 1] === '^' &&
+                    text[match.index - 2] === quote &&
+                    (start + 1 === text.length || /\s/.test(text.charAt(start + 1))))))
+            continue;
+        if (/aws_secret_access_key/i.test(match[0]) && /^<[^>]*>$/.test(value))
+            continue;
+        const body = quote
+            ? value.slice(delimiter.length, closed ? -delimiter.length : undefined)
+            : value.replace(/(?:\*\/|[.!?]+)$/, '');
+        const tail = quote ? (closed ? delimiter : '') : value.slice(body.length);
+        result += text.slice(offset, start) + delimiter + redactSecretValue(body) + tail;
+        offset = end;
+    }
+    return result + text.slice(offset);
+}
 // Shared by the scanner daemon and server-side scrub paths.
 //
 // A value must hold a letter or a digit, in every pattern whose value is free
@@ -48,7 +125,7 @@ export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED]';
 // flag: "--password=; repeated copies" in a stored checkpoint became
 // "--[REDACTED] repeated copies" (2026-10-13), and so did "password: ***".
 export const SECRET_PATTERNS = [
-    /(?:api[_-]?key|secret|token|password|credential|auth)\s*[:=]\s*(?=\S*[A-Za-z0-9])\S+/gi,
+    LABELED_VALUE_RE, // Select the label; the linear reader consumes its complete value.
     // Stripe-shape: (sk|pk)_(live|test)_<24+ alphanumerics>. Catches modern
     // Stripe keys whose body is split by an environment separator that
     // breaks the contiguous-alphanum pattern below. Required `live|test`
@@ -69,10 +146,7 @@ export const SECRET_PATTERNS = [
     // \b-delimited, so prose ("AKIAMIA is a place name") cannot match.
     /\bAKIA[0-9A-Z]{16}\b/g,
     /\bASIA[0-9A-Z]{16}\b/g,
-    // AWS secret access key, labeled. The generic key=value pattern above does
-    // NOT cover this: its `secret` alternative must be followed immediately by
-    // `[:=]`, and here it is followed by `_access_key`.
-    /\baws_secret_access_key\s*[:=]\s*[A-Za-z0-9/+=]{40}\b/gi,
+    // Labeled AWS secret access keys are covered by LABELED_VALUE_RE, including quotes.
     // JWT: three base64url segments. Length minimums keep dotted identifiers
     // (`payload.header.signature`) out.
     /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}\b/g,
@@ -252,7 +326,12 @@ export function scrubSecrets(text) {
         return text;
     let result = text;
     for (const pattern of SECRET_PATTERNS) {
-        result = result.replace(pattern, (match) => ENV_READ_VALUE_RE.test(match) ? match : SECRET_REDACTION_PLACEHOLDER);
+        if (pattern === LABELED_VALUE_RE) {
+            result = redactLabeledValues(result);
+        }
+        else {
+            result = result.replace(pattern, (match) => ENV_READ_VALUE_RE.test(match) ? match : redactSecretValue(match));
+        }
     }
     // Backstop for credentials with no recognizable prefix. Runs last so the
     // precise provider patterns get first claim on their own shapes.