@mossbear/eval-core 0.1.0-alpha.100

package/dist/redact-prose.test.js

@@ -0,0 +1,429 @@
+import { describe, expect, it } from 'vitest';
+import { MAX_PROSE_CHARS, redactProse } from './redact-prose.js';
+import { sanitizeCommand } from './sanitize-command.js';
+/**
+ * The corpus this redactor is judged against. Each entry is a plausible line of
+ * assistant or user prose from a real session: what must be removed, and — just
+ * as load-bearing — what must survive intact.
+ */
+describe('redactProse', () => {
+    describe('secrets that must not survive', () => {
+        it('removes a PEM private key block', () => {
+            const result = redactProse('Here is the key I generated:\n-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAx7Vn9kQm\nQm5kZXJ0aGVzdHJpbmc=\n-----END RSA PRIVATE KEY-----\nUse it for the deploy.' // oss-boundary-ignore — synthetic fixture, not a real key
+            );
+            expect(result.text).not.toContain('MIIEowIBAAKCAQEAx7Vn9kQm');
+            expect(result.text).not.toContain('BEGIN RSA PRIVATE KEY');
+            expect(result.text).toContain('Here is the key I generated:');
+            expect(result.text).toContain('Use it for the deploy.');
+            expect(result.counts.private_key).toBe(1);
+        });
+        // A truncated key is still a key.
+        it('removes an unterminated private key block', () => {
+            const result = redactProse('-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAA' // oss-boundary-ignore — synthetic fixture, not a real key
+            );
+            expect(result.text).not.toContain('b3BlbnNzaC1rZXktdjEAAAAA');
+            expect(result.counts.private_key).toBe(1);
+        });
+        it('removes credentials from a URL but keeps the host', () => {
+            const result = redactProse('I connected with postgres://admin:hunter2@db.example.com:5432/app and it worked.');
+            expect(result.text).not.toContain('hunter2');
+            expect(result.text).toContain('db.example.com');
+            expect(result.counts.url_credentials).toBe(1);
+        });
+        // `sanitizeCommand` anchors this at a shell-token boundary, which is
+        // exactly what misses it mid-sentence. This is the gap that made a
+        // separate prose redactor the load-bearing deliverable.
+        it('removes KEY=value embedded in a sentence', () => {
+            const result = redactProse('I set OPENAI_API_KEY=sk-proj-abcdefghijklmnop1234 and reran the script.');
+            expect(result.text).not.toContain('sk-proj-abcdefghijklmnop1234');
+            expect(result.text).toContain('I set OPENAI_API_KEY');
+            expect(result.text).toContain('and reran the script.');
+        });
+        it('removes a quoted value with spaces', () => {
+            const result = redactProse('The config had DB_PASSWORD = "correct horse battery"');
+            expect(result.text).not.toContain('correct horse battery');
+            expect(result.counts.assignment).toBe(1);
+        });
+        it('removes a colon-separated secret', () => {
+            const result = redactProse('auth token: aVeryLongOpaqueValue99');
+            expect(result.text).not.toContain('aVeryLongOpaqueValue99');
+        });
+        it.each([
+            ['Mossbear CLI', 'mossbear_aB3dEfGhIjKlMnOp'],
+            ['legacy auden CLI', 'auden_aB3dEfGhIjKlMnOp'],
+            ['OpenAI-style', 'sk-proj-QQQQwwwweeee1234RRRR'],
+            ['GitHub PAT', 'ghp_abcdefghijklmnopqrstuvwxyz0123'],
+            ['GitHub fine-grained', 'github_pat_11ABCDEFG0abcdefghij_KLMNOP'], // oss-boundary-ignore — fake token shape
+            ['Slack', 'xoxb-1234567890-abcdefghijkl'], // oss-boundary-ignore — fake token shape
+            ['AWS access key', 'AKIAIOSFODNN7EXAMPLE'], // oss-boundary-ignore — fake token shape
+            ['Google API key', 'AIzaSyA1234567890abcdefghijklmnopqrs'],
+        ])('removes a bare %s token', (_name, token) => {
+            const result = redactProse(`The failing call used ${token} as its credential.`);
+            expect(result.text).not.toContain(token);
+            expect(result.text).toContain('The failing call used');
+            expect(result.redactedCount).toBeGreaterThan(0);
+        });
+        // The product's own token, in the shapes prose actually puts it in. The
+        // `assignment` rule already covered `token: mossbear_…`; these three are
+        // the forms that had nothing to anchor on, and they are why the prefix arm
+        // exists. `mossbear_` keys are under `long_random_string`'s 40-character
+        // floor, so no other rule reaches them.
+        it.each([
+            ['a bare mention', 'use mossbear_aB3dEfGhIjKlMnOp'],
+            ['a sentence', 'I set my token to mossbear_aB3dEfGhIjKlMnOp and it worked'],
+            ['a space-separated flag', 'ran mossbear sync --token mossbear_aB3dEfGhIjKlMnOp'],
+        ])('removes our own CLI token in %s', (_name, prose) => {
+            const result = redactProse(prose);
+            expect(result.text).not.toContain('mossbear_aB3dEfGhIjKlMnOp');
+            expect(result.counts.token).toBe(1);
+        });
+        // The two redactors guard the same credential against the same upload, so
+        // a token one removes and the other keeps is a gap, not a difference in
+        // scope. This asserts they agree on the case that opened it.
+        it('redacts our own CLI token wherever sanitizeCommand does', () => {
+            const prose = 'use mossbear_aB3dEfGhIjKlMnOp';
+            expect(redactProse(prose).text).toBe(sanitizeCommand(prose));
+        });
+        // A pasted request header: `Authorization` is not a sensitive assignment
+        // key, and these values are routinely too short for the prefix and
+        // long-run rules, so without a rule of their own they upload verbatim.
+        it.each([
+            ['Bearer', 'Authorization: Bearer short-live-token-123', 'short-live-token-123'],
+            ['Basic', 'Authorization: Basic dXNlcjpwYXNz', 'dXNlcjpwYXNz'],
+        ])('removes an %s Authorization header credential', (_name, prose, secret) => {
+            const result = redactProse(prose);
+            expect(result.text).not.toContain(secret);
+            expect(result.text).toContain('Authorization');
+        });
+        // A colon-requiring pattern misses the token-as-sole-userinfo form, and
+        // nothing else here catches it when the token is short.
+        it('removes token-only URL userinfo', () => {
+            const result = redactProse('Connected with postgres://short-live-token@127.0.0.1/db');
+            expect(result.text).not.toContain('short-live-token');
+            expect(result.text).toContain('127.0.0.1');
+        });
+        // Stopping at the first inner quote leaves the tail of the password in
+        // place, which is worse than not matching at all — it looks redacted.
+        it('consumes escaped quotes inside a quoted value', () => {
+            const result = redactProse('DB_PASSWORD="correct horse \\"battery staple"');
+            expect(result.text).not.toContain('battery staple');
+            expect(result.text).toBe('DB_PASSWORD=[redacted]');
+        });
+        // `+` and `/` are base64 characters but not word characters, so a leading
+        // one leaves `\b` nothing to match and the run one short of the floor.
+        it('removes a base64 run beginning with a non-word character', () => {
+            const secret = '/123456789012345678901234567890123456789';
+            const result = redactProse(`The blob was ${secret} in the header.`);
+            expect(result.text).not.toContain(secret);
+            expect(result.counts.long_random_string).toBe(1);
+        });
+        it('removes email addresses', () => {
+            const result = redactProse('Ping alex.doe+work@example.co.uk about the migration.');
+            expect(result.text).not.toContain('alex.doe+work@example.co.uk');
+            expect(result.text).toContain('about the migration.');
+            expect(result.counts.email).toBe(1);
+        });
+        it('removes a long opaque base64/hex run', () => {
+            const digest = 'a3f5c9e17b2d4869fa0c5e3d7b91240affe6c8d251b7093e';
+            const result = redactProse(`The session id was ${digest} in the logs.`);
+            expect(result.text).not.toContain(digest);
+            expect(result.counts.long_random_string).toBe(1);
+        });
+        it('removes every secret when a message carries several', () => {
+            const result = redactProse('Mailed ops@example.com the key ghp_abcdefghijklmnopqrstuvwxyz0123 and set API_KEY=topsecret123');
+            expect(result.text).not.toContain('ops@example.com');
+            expect(result.text).not.toContain('ghp_abcdefghijklmnopqrstuvwxyz0123');
+            expect(result.text).not.toContain('topsecret123');
+            expect(result.redactedCount).toBeGreaterThanOrEqual(3);
+        });
+    });
+    /**
+     * The other half of the contract. Prose scrubbed into nonsense is useless to
+     * a grader and alarming to a reader, so over-redaction is a defect too.
+     */
+    describe('ordinary text that must not be mangled', () => {
+        it.each([
+            "I'm going to refactor the sync queue because the retry logic double-counts.",
+            'The test failed at src/lib/runs/format.ts:42 with a TypeError.',
+            'Renaming getUserById to fetchUserById across 14 call sites; the answer: 42.',
+            'Run `bun run test` first — it takes about 18 seconds on this machine.',
+            'The verdict vocabulary is aligned | unguided | misaligned, never anything else.',
+            'See https://example.com/docs/getting-started for the setup steps.',
+            // The prefix arm must not turn the product's own name into a secret:
+            // `mossbear` is a word this corpus is full of, and only `mossbear_`
+            // followed by a key-length run is a credential.
+            'Run mossbear sync after the hook writes, then check the feed.',
+            'The mossbear_ prefix is what API_KEY_PREFIX expands to.',
+        ])('leaves %s untouched', (prose) => {
+            const result = redactProse(prose);
+            expect(result.text).toBe(prose);
+            expect(result.redactedCount).toBe(0);
+        });
+        // The floor on the loosest pattern is what protects ordinary language:
+        // English words, paths and identifiers do not reach 40 unbroken characters.
+        it('does not redact a long ordinary sentence as a random string', () => {
+            const prose = 'The implementation of the deterministic detector counts distinct runs rather than rows.';
+            const result = redactProse(prose);
+            expect(result.text).toBe(prose);
+        });
+        // As an arbitrary substring, SECRET matches `secretary` and TOKEN matches
+        // `tokenization`. These are ordinary prose, not credential assignments.
+        it.each([
+            ['secretary: Alice', 'Alice'],
+            ['tokenization: complete', 'complete'],
+            ['The password reset flow: works now', 'works now'],
+        ])('keeps %s, whose key only contains a sensitive word', (prose, value) => {
+            expect(redactProse(prose).text).toContain(value);
+        });
+        // Length alone is not a random-string signal. Redacting a long identifier
+        // removes the exact implementation detail a grader needs.
+        it.each([
+            'createAuthenticatedDashboardRequestContext',
+            'useRunGuideVerdictLabelsWithFallbackResolution',
+        ])('keeps the long ordinary identifier %s', (identifier) => {
+            const prose = `The call to ${identifier} failed.`;
+            expect(redactProse(prose).text).toBe(prose);
+        });
+        it('keeps a non-sensitive assignment', () => {
+            const prose = 'I set NODE_ENV=production and the build shrank by 40%.';
+            const result = redactProse(prose);
+            expect(result.text).toBe(prose);
+        });
+    });
+    describe('length capping', () => {
+        it('caps and marks a message past the limit', () => {
+            const long = 'word '.repeat(MAX_PROSE_CHARS);
+            const result = redactProse(long);
+            expect(result.wasTruncated).toBe(true);
+            expect(result.text).toContain('[truncated]');
+            expect(result.text.length).toBeLessThan(MAX_PROSE_CHARS + 30);
+        });
+        it('leaves a message inside the limit alone', () => {
+            const result = redactProse('A short explanation of the change.');
+            expect(result.wasTruncated).toBe(false);
+            expect(result.text).not.toContain('[truncated]');
+        });
+        // The output cap is not a bound on the work: without a scan bound every
+        // pattern scans the whole untrusted message first, and the assignment
+        // matcher backtracks badly on adversarial input.
+        it('bounds the work on a hostile input rather than only the output', () => {
+            const hostile = `${'SECRET'.repeat(200_000)} tail`;
+            const started = performance.now();
+            const result = redactProse(hostile);
+            const elapsedMs = performance.now() - started;
+            expect(elapsedMs).toBeLessThan(2000);
+            expect(result.wasTruncated).toBe(true);
+            expect(result.text.length).toBeLessThan(MAX_PROSE_CHARS + 30);
+        });
+        // The cap is the backstop for whatever the patterns miss, so it has to
+        // apply after redaction rather than instead of it.
+        it('still redacts before truncating', () => {
+            const result = redactProse(`ghp_abcdefghijklmnopqrstuvwxyz0123 ${'padding '.repeat(MAX_PROSE_CHARS)}`);
+            expect(result.text).not.toContain('ghp_abcdefghijklmnopqrstuvwxyz0123');
+            expect(result.wasTruncated).toBe(true);
+        });
+    });
+    describe('the report', () => {
+        it('counts each class separately', () => {
+            const result = redactProse('Contact a@example.com and b@example.com; the token is ghp_abcdefghijklmnopqrstuvwxyz0123');
+            expect(result.counts.email).toBe(2);
+            expect(result.counts.token).toBe(1);
+            expect(result.redactedCount).toBe(3);
+        });
+        it('omits classes that redacted nothing', () => {
+            const result = redactProse('Ping ops@example.com when the deploy lands.');
+            expect(result.counts.email).toBe(1);
+            expect(result.counts.private_key).toBeUndefined();
+            expect(result.counts.token).toBeUndefined();
+        });
+        it('reports nothing redacted for clean prose', () => {
+            const result = redactProse('Nothing sensitive here at all.');
+            expect(result.counts).toEqual({});
+            expect(result.redactedCount).toBe(0);
+        });
+        it('treats empty, null, and undefined as empty prose', () => {
+            for (const input of ['', null, undefined]) {
+                const result = redactProse(input);
+                expect(result.text).toBe('');
+                expect(result.redactedCount).toBe(0);
+                expect(result.wasTruncated).toBe(false);
+            }
+        });
+    });
+    // A stateful `g` regex silently skipping the first match of the next message
+    // is exactly the failure a redactor must not have.
+    it('redacts identically on repeated calls', () => {
+        const prose = 'The key ghp_abcdefghijklmnopqrstuvwxyz0123 leaked into the log.';
+        const first = redactProse(prose);
+        const second = redactProse(prose);
+        const third = redactProse(prose);
+        expect(second.text).toBe(first.text);
+        expect(third.text).toBe(first.text);
+        expect(second.counts).toEqual(first.counts);
+    });
+});
+describe('credential disclosure regressions', () => {
+    it.each([
+        'You can pass --token to the sync command.',
+        'It takes --password or prompts you.',
+        'I recommend --client-secret for the CI job.',
+    ])('preserves prose explaining credential options: %s', (input) => {
+        expect(redactProse(input).text).toBe(input);
+    });
+    it.each(['password', '"password"', "'password'"])('counts one YAML block credential under %s once', (key) => {
+        const result = redactProse(`${key}: |\n  fixture-secret\n  fixture-tail\nname: reader`);
+        expect(result.text).not.toContain('fixture');
+        expect(result.text).toContain('name: reader');
+        expect(result.counts.assignment).toBe(1);
+        expect(result.redactedCount).toBe(1);
+    });
+    it('counts a bounded nested JSON replacement', () => {
+        const nested = Array.from({ length: 25 }).reduce((value) => ({ child: value }), 'fixture-secret');
+        const result = redactProse(JSON.stringify({ payload: JSON.stringify(nested) }));
+        expect(result.text).not.toContain('fixture-secret');
+        expect(result.counts.assignment).toBe(1);
+        expect(result.redactedCount).toBe(1);
+    });
+    it('redacts quoted JSON keys in transcript prose, including escaped keys', () => {
+        for (const input of [
+            'The response was {"password":"fixture-json-secret","ok":true}.',
+            'The response was {"clientSecret":"fixture-json-secret"}.',
+            String.raw `{"\u0070assword":"fixture-json-secret"}`,
+        ]) {
+            expect(redactProse(input).text).not.toContain('fixture-json-secret');
+        }
+    });
+    it('redacts multiline and concatenated quoted credential values completely', () => {
+        for (const input of [
+            'password="fixture-first\nfixture-tail" after',
+            "SECRET='first'fixture-tail after",
+            'password="fixture-first\nfixture-tail',
+        ]) {
+            const output = redactProse(input).text;
+            expect(output).not.toContain('fixture-first');
+            expect(output).not.toContain('fixture-tail');
+        }
+    });
+    it('redacts session cookies pasted into prose', () => {
+        for (const name of ['Cookie', 'Set-Cookie'])
+            expect(redactProse(`${name}: session=fixture-cookie; Path=/`).text).not.toContain('fixture-cookie');
+    });
+});
+describe('review evidence-preservation regressions', () => {
+    it('preserves prose following an ordinary apostrophe', () => {
+        const input = "I reset the password: it's stored in the vault now, so the deploy can retry safely.";
+        expect(redactProse(input).text).toContain('stored in the vault now, so the deploy can retry safely.');
+    });
+    it('does not treat discussion of a cookie header as a credential', () => {
+        const input = 'The API expects a Cookie: header with the session token. Retry after rotating it.';
+        expect(redactProse(input).text).toBe(input);
+    });
+    it('preserves prose after a cookie value while removing every cookie pair', () => {
+        const text = redactProse('Cookie: session=fixture-cookie; csrf=fixture-csrf Retry after rotating it.').text;
+        expect(text).not.toContain('fixture-cookie');
+        expect(text).not.toContain('fixture-csrf');
+        expect(text).toContain('Retry after rotating it.');
+    });
+    it.each(['clientSecret', 'client_secret', 'PRIVATE_KEY', 'authorization'])('redacts unquoted %s keys', (key) => {
+        expect(redactProse(`${key}: fixture-secret here`).text).not.toContain('fixture-secret');
+    });
+});
+describe('credential syntax in uploaded narration', () => {
+    it.each(['--auth.token', '--spring.datasource.password'])('retains redaction for dotted credential options: %s', (flag) => {
+        const report = redactProse(`I ran deploy ${flag} "fixture-secret" --verbose.`);
+        expect(report.text).not.toContain('fixture-secret');
+        expect(report.text).toContain('--verbose.');
+    });
+    it.each([
+        "I ran deploy --password=$'fixture secret' retried.",
+        String.raw `I ran deploy --password=$'fixture\' secret' retried.`,
+        "I ran deploy --password=$'fixture'credential retried.",
+        String.raw `I set password=$'fixture\nsecret' retried.`,
+    ])('redacts complete attached ANSI-C credential values: %s', (input) => {
+        const report = redactProse(input);
+        expect(report.text).not.toContain('fixture');
+        expect(report.text).not.toContain(' secret');
+        expect(report.text).not.toContain('credential');
+        expect(report.text).toContain('retried.');
+    });
+    it.each(['|', '>-', '|2+'])('redacts YAML sequence credentials with %s while preserving siblings', (marker) => {
+        const report = redactProse(`accounts:\n  - password: ${marker}\n      fixture-secret\n      fixture-tail\n    name: reader\n  - name: second`);
+        expect(report.text).not.toContain('fixture');
+        expect(report.text).toContain('    name: reader\n  - name: second');
+        expect(report.redactedCount).toBe(1);
+    });
+    it.each([
+        "{'password': 'first' 'fixture-tail', 'action': 'retry'}",
+        '{"password": "first" "fixture-tail", "action": "retry"}',
+        "{'password': 'first'\n'fixture-tail', 'action': 'retry'}",
+    ])('redacts adjacent Python credential strings in %s', (input) => {
+        const report = redactProse(input);
+        expect(report.text).not.toContain('first');
+        expect(report.text).not.toContain('fixture-tail');
+        expect(report.text).toContain('retry');
+    });
+    it('preserves a quoted YAML sibling after a quoted credential', () => {
+        expect(redactProse("'password': 'fixture-secret'\n'action': 'retry'").text).toContain("'action': 'retry'");
+    });
+    it.each(['--tokenizer', '--secretary'])('preserves the unrelated quoted option %s', (flag) => {
+        const input = `I ran encode ${flag} "cl100k base" and compared the output.`;
+        expect(redactProse(input).text).toBe(input);
+    });
+    it.each([
+        "I ran deploy --password $'fixture credential' --verbose.",
+        String.raw `I ran deploy --password $'fixture\' credential' --verbose.`,
+        String.raw `I ran deploy --password $'fixture\ncredential' --verbose.`,
+        "I ran deploy --password $'fixture'credential --verbose.",
+    ])('redacts ANSI-C quoted command credentials: %s', (input) => {
+        const report = redactProse(input);
+        expect(report.text).not.toContain('fixture');
+        expect(report.text).not.toContain('credential');
+        expect(report.text).toContain('--verbose.');
+    });
+    it.each(['--password', '--api-key', '--token', '--client-secret'])('redacts prose mentioning the %s command option', (flag) => {
+        const report = redactProse(`I ran deploy ${flag} "fixture secret with spaces" --verbose yesterday.`);
+        expect(report.text).not.toContain('fixture');
+        expect(report.text).not.toContain('with spaces');
+        expect(report.text).toContain('--verbose yesterday.');
+        expect(report.counts.assignment).toBeGreaterThan(0);
+    });
+    it.each(['|', '|-', '|+', '>', '>2-'])('redacts complete YAML credentials in %s block scalars', (marker) => {
+        const report = redactProse(`config:\n  password: ${marker}\n    fixture secret\n    second secret line\n  retries: 3\nNext step`);
+        expect(report.text).not.toContain('fixture');
+        expect(report.text).not.toContain('second secret line');
+        expect(report.text).toContain('  retries: 3\nNext step');
+        expect(report.counts.assignment).toBeGreaterThan(0);
+    });
+    it('redacts recursively serialized JSON inside prose while retaining benign fields', () => {
+        let value = JSON.stringify({
+            password: 'fixture private credential',
+            action: 'retry',
+        });
+        for (let depth = 0; depth < 4; depth += 1) {
+            value = JSON.stringify({ payload: value, count: 2 });
+            const report = redactProse(`I sent ${value} then retried.`);
+            expect(report.text).not.toContain('fixture');
+            expect(report.text).not.toContain('private credential');
+            expect(report.text).toContain('retry');
+            expect(report.text).toContain('then retried.');
+        }
+    });
+    it.each([
+        "{'password': 'fixture secret', 'action': 'retry'}",
+        '{\'api_key\': "fixture secret"}',
+    ])('redacts single-quoted mapping keys in %s', (input) => {
+        const report = redactProse(input);
+        expect(report.text).not.toContain('fixture');
+        expect(report.text).not.toContain(' secret');
+        expect(report.counts.assignment).toBeGreaterThan(0);
+    });
+    it('preserves ordinary quoted narration and non-secret YAML blocks', () => {
+        for (const text of [
+            'I said "retry the migration".',
+            'notes: |\n  keep this explanation\nretries: 3',
+        ]) {
+            expect(redactProse(text).text).toBe(text);
+        }
+    });
+});
+//# sourceMappingURL=redact-prose.test.js.map

package/dist/redact-prose.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-prose.test.js","sourceRoot":"","sources":["../src/redact-prose.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD;;;;GAIG;AACH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;QAC7C,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,WAAW,CACxB,sKAAsK,CAAC,0DAA0D;aAClO,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAA;YAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YAC1D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;YAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAA;YACvD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;QAEF,kCAAkC;QAClC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,MAAM,GAAG,WAAW,CACxB,+DAA+D,CAAC,0DAA0D;aAC3H,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAA;YAC7D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,MAAM,GAAG,WAAW,CACxB,kFAAkF,CACnF,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;YAC/C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;QAEF,qEAAqE;QACrE,mEAAmE;QACnE,wDAAwD;QACxD,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,MAAM,GAAG,WAAW,CACxB,yEAAyE,CAC1E,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;YACjE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAA;YACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,sDAAsD,CAAC,CAAA;YAElF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,oCAAoC,CAAC,CAAA;YAEhE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAA;QAC7D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,IAAI,CAAC;YACN,CAAC,cAAc,EAAE,2BAA2B,CAAC;YAC7C,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;YAC9C,CAAC,cAAc,EAAE,8BAA8B,CAAC;YAChD,CAAC,YAAY,EAAE,oCAAoC,CAAC;YACpD,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,EAAE,yCAAyC;YAC5G,CAAC,OAAO,EAAE,8BAA8B,CAAC,EAAE,yCAAyC;YACpF,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,EAAE,yCAAyC;YACrF,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;SAC3D,CAAC,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,WAAW,CAAC,yBAAyB,KAAK,qBAAqB,CAAC,CAAA;YAE/E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;YACtD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,wCAAwC;QACxC,EAAE,CAAC,IAAI,CAAC;YACN,CAAC,gBAAgB,EAAE,+BAA+B,CAAC;YACnD,CAAC,YAAY,EAAE,2DAA2D,CAAC;YAC3E,CAAC,wBAAwB,EAAE,qDAAqD,CAAC;SAClF,CAAC,CAAC,iCAAiC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACrD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAA;YAC9D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,0EAA0E;QAC1E,wEAAwE;QACxE,6DAA6D;QAC7D,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;YACjE,MAAM,KAAK,GAAG,+BAA+B,CAAA;YAE7C,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;QAC9D,CAAC,CAAC,CAAA;QAEF,yEAAyE;QACzE,mEAAmE;QACnE,uEAAuE;QACvE,EAAE,CAAC,IAAI,CAAC;YACN,CAAC,QAAQ,EAAE,4CAA4C,EAAE,sBAAsB,CAAC;YAChF,CAAC,OAAO,EAAE,mCAAmC,EAAE,cAAc,CAAC;SAC/D,CAAC,CAAC,+CAA+C,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACzC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,wDAAwD;QACxD,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,WAAW,CACxB,yDAAyD,CAC1D,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;YACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;QAEF,uEAAuE;QACvE,sEAAsE;QACtE,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,MAAM,GAAG,WAAW,CAAC,+CAA+C,CAAC,CAAA;YAE3E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;YACnD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACpD,CAAC,CAAC,CAAA;QAEF,0EAA0E;QAC1E,uEAAuE;QACvE,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,MAAM,GAAG,0CAA0C,CAAA;YACzD,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,MAAM,iBAAiB,CAAC,CAAA;YAEnE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,WAAW,CAAC,uDAAuD,CAAC,CAAA;YAEnF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAA;YAChE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAA;YACrD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,MAAM,GAAG,kDAAkD,CAAA;YACjE,MAAM,MAAM,GAAG,WAAW,CAAC,sBAAsB,MAAM,eAAe,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC7D,MAAM,MAAM,GAAG,WAAW,CACxB,gGAAgG,CACjG,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACpD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAA;YACvE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;YACjD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF;;;OAGG;IACH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACtD,EAAE,CAAC,IAAI,CAAC;YACN,6EAA6E;YAC7E,gEAAgE;YAChE,6EAA6E;YAC7E,uEAAuE;YACvE,iFAAiF;YACjF,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,gDAAgD;YAChD,+DAA+D;YAC/D,yDAAyD;SAC1D,CAAC,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE;YAClC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC/B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,uEAAuE;QACvE,4EAA4E;QAC5E,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACrE,MAAM,KAAK,GACT,yFAAyF,CAAA;YAC3F,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;QAEF,0EAA0E;QAC1E,wEAAwE;QACxE,EAAE,CAAC,IAAI,CAAC;YACN,CAAC,kBAAkB,EAAE,OAAO,CAAC;YAC7B,CAAC,wBAAwB,EAAE,UAAU,CAAC;YACtC,CAAC,oCAAoC,EAAE,WAAW,CAAC;SACpD,CAAC,CAAC,oDAAoD,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QAEF,0EAA0E;QAC1E,0DAA0D;QAC1D,EAAE,CAAC,IAAI,CAAC;YACN,4CAA4C;YAC5C,gDAAgD;SACjD,CAAC,CAAC,uCAAuC,EAAE,CAAC,UAAU,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,eAAe,UAAU,UAAU,CAAA;YAEjD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,KAAK,GAAG,wDAAwD,CAAA;YACtE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YAEhC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;YAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,eAAe,GAAG,EAAE,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,MAAM,GAAG,WAAW,CAAC,oCAAoC,CAAC,CAAA;YAEhE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACvC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,sEAAsE;QACtE,iDAAiD;QACjD,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;YACxE,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAA;YAClD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;YACjC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;YACnC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;YAE7C,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;YACpC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,eAAe,GAAG,EAAE,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;QAEF,uEAAuE;QACvE,mDAAmD;QACnD,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,WAAW,CACxB,sCAAsC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAC3E,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAA;YACvE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,MAAM,GAAG,WAAW,CACxB,0FAA0F,CAC3F,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,MAAM,GAAG,WAAW,CAAC,6CAA6C,CAAC,CAAA;YAEzE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAA;YACjD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,MAAM,GAAG,WAAW,CAAC,gCAAgC,CAAC,CAAA;YAE5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACjC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,KAAK,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAEjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAC5B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACpC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACzC,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,mDAAmD;IACnD,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,KAAK,GAAG,iEAAiE,CAAA;QAE/E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAEhC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,IAAI,CAAC;QACN,2CAA2C;QAC3C,qCAAqC;QACrC,6CAA6C;KAC9C,CAAC,CAAC,mDAAmD,EAAE,CAAC,KAAK,EAAE,EAAE;QAChE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAC/C,gDAAgD,EAChD,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,MAAM,GAAG,WAAW,CACxB,GAAG,GAAG,qDAAqD,CAC5D,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QAC7C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC,CACF,CAAA;IACD,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAC7B,gBAAgB,CACjB,CAAA;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,KAAK,MAAM,KAAK,IAAI;YAClB,gEAAgE;YAChE,0DAA0D;YAC1D,MAAM,CAAC,GAAG,CAAA,yCAAyC;SACpD,EAAE,CAAC;YACF,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAA;QACtE,CAAC;IACH,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,KAAK,MAAM,KAAK,IAAI;YAClB,8CAA8C;YAC9C,kCAAkC;YAClC,uCAAuC;SACxC,EAAE,CAAC;YACF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAA;YACtC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;YAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC;YACzC,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAC/E,gBAAgB,CACjB,CAAA;IACL,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,KAAK,GACT,qFAAqF,CAAA;QACvF,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CACvC,0DAA0D,CAC3D,CAAA;IACH,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,KAAK,GACT,mFAAmF,CAAA;QACrF,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,IAAI,GAAG,WAAW,CACtB,4EAA4E,CAC7E,CAAC,IAAI,CAAA;QACN,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,CACxE,0BAA0B,EAC1B,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,CAAC,WAAW,CAAC,GAAG,GAAG,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CACnE,gBAAgB,CACjB,CAAA;IACH,CAAC,CACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,EAAE,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC,CACvD,qDAAqD,EACrD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,IAAI,8BAA8B,CAAC,CAAA;QAC9E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAC7C,CAAC,CACF,CAAA;IACD,EAAE,CAAC,IAAI,CAAC;QACN,oDAAoD;QACpD,MAAM,CAAC,GAAG,CAAA,sDAAsD;QAChE,uDAAuD;QACvD,MAAM,CAAC,GAAG,CAAA,4CAA4C;KACvD,CAAC,CAAC,wDAAwD,EAAE,CAAC,KAAK,EAAE,EAAE;QACrE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CACzB,qEAAqE,EACrE,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,MAAM,GAAG,WAAW,CACxB,4BAA4B,MAAM,gFAAgF,CACnH,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAA;QACnE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC,CACF,CAAA;IACD,EAAE,CAAC,IAAI,CAAC;QACN,yDAAyD;QACzD,yDAAyD;QACzD,0DAA0D;KAC3D,CAAC,CAAC,kDAAkD,EAAE,CAAC,KAAK,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QACjD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,WAAW,CAAC,iDAAiD,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CACnF,mBAAmB,CACpB,CAAA;IACH,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CACrC,0CAA0C,EAC1C,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,KAAK,GAAG,gBAAgB,IAAI,yCAAyC,CAAA;QAC3E,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC,CACF,CAAA;IACD,EAAE,CAAC,IAAI,CAAC;QACN,0DAA0D;QAC1D,MAAM,CAAC,GAAG,CAAA,4DAA4D;QACtE,MAAM,CAAC,GAAG,CAAA,2DAA2D;QACrE,yDAAyD;KAC1D,CAAC,CAAC,+CAA+C,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAChE,gDAAgD,EAChD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,MAAM,GAAG,WAAW,CACxB,gBAAgB,IAAI,oDAAoD,CACzE,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAA;QACrD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACrD,CAAC,CACF,CAAA;IACD,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CACpC,uDAAuD,EACvD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,MAAM,GAAG,WAAW,CACxB,wBAAwB,MAAM,uEAAuE,CACtG,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;QACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;QACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACrD,CAAC,CACF,CAAA;IACD,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,IAAI,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;YACzB,QAAQ,EAAE,4BAA4B;YACtC,MAAM,EAAE,OAAO;SAChB,CAAC,CAAA;QACF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YACpD,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAA;YAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC;IACH,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,IAAI,CAAC;QACN,mDAAmD;QACnD,iCAAiC;KAClC,CAAC,CAAC,0CAA0C,EAAE,CAAC,KAAK,EAAE,EAAE;QACvD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,KAAK,MAAM,IAAI,IAAI;YACjB,+BAA+B;YAC/B,+CAA+C;SAChD,EAAE,CAAC;YACF,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/redaction.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Facts shared by this package's two redactors.
+ *
+ * `sanitizeCommand` (shell command text) and `redactProse` (transcript prose)
+ * are deliberately separate scanners — see the header of `./redact-prose.ts`
+ * for why one cannot be built out of the other. But a few of the things they
+ * match are the *same fact* stated twice, and a hardening applied to one copy
+ * while the other is forgotten is a credential on the wire. Those live here.
+ */
+/** Marker substituted for every redacted span, in both redactors. */
+export declare const REDACTED = "[redacted]";
+/**
+ * Matches a whole private-key block, including an unterminated one — a
+ * truncated key is still a key.
+ *
+ * Exported as a **source string** rather than a shared `RegExp`: a `g`-flagged
+ * regex object carries `lastIndex` between calls, and a single instance shared
+ * across modules is exactly the stateful-regex hazard `redactProse` guards
+ * against when it counts matches. Each call site builds its own instance from
+ * this source, so no state can leak between them.
+ */
+export declare const PRIVATE_KEY_BLOCK_SOURCE: string;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qEAAqE;AACrE,eAAO,MAAM,QAAQ,eAAe,CAAA;AAEpC;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,QAA6F,CAAA"}

package/dist/redaction.js

@@ -0,0 +1,23 @@
+/**
+ * Facts shared by this package's two redactors.
+ *
+ * `sanitizeCommand` (shell command text) and `redactProse` (transcript prose)
+ * are deliberately separate scanners — see the header of `./redact-prose.ts`
+ * for why one cannot be built out of the other. But a few of the things they
+ * match are the *same fact* stated twice, and a hardening applied to one copy
+ * while the other is forgotten is a credential on the wire. Those live here.
+ */
+/** Marker substituted for every redacted span, in both redactors. */
+export const REDACTED = '[redacted]';
+/**
+ * Matches a whole private-key block, including an unterminated one — a
+ * truncated key is still a key.
+ *
+ * Exported as a **source string** rather than a shared `RegExp`: a `g`-flagged
+ * regex object carries `lastIndex` between calls, and a single instance shared
+ * across modules is exactly the stateful-regex hazard `redactProse` guards
+ * against when it counts matches. Each call site builds its own instance from
+ * this source, so no state can leak between them.
+ */
+export const PRIVATE_KEY_BLOCK_SOURCE = String.raw `-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END[A-Z ]*PRIVATE KEY-----|$)`;
+//# sourceMappingURL=redaction.js.map

package/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAA;AAEpC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAA,gFAAgF,CAAA"}

package/dist/sanitize-command.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Secret redaction and length-capping for shell command text.
+ *
+ * Command text can embed secrets or whole file bodies (heredocs, inline env
+ * vars). The CLI runs logged commands through this before creating an action
+ * summary. Recognized credential syntax is removed; arbitrary shell/tool
+ * programs remain an open language, so pattern scanning cannot prove that
+ * every surviving argument is credential-free.
+ *
+ * Lives in eval-core rather than the CLI because grading is what consumes the
+ * result: this is the boundary that decides what a grader may ever see of a
+ * command.
+ */
+/**
+ * Redact common secret shapes from a shell command and cap its length so
+ * command text never carries credentials or bulk file content off-box.
+ *
+ * Pure function — no I/O.
+ */
+export declare function sanitizeCommand(command: string): string;
+//# sourceMappingURL=sanitize-command.d.ts.map

package/dist/sanitize-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-command.d.ts","sourceRoot":"","sources":["../src/sanitize-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAq7BH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQvD"}