@openauditmodel/cli 0.1.0

package/dist/conformance/src/privacy/safe-formats.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Recognizers for values that must not be reported by the entropy heuristic.
+ *
+ * Audit events are full of long, random-looking strings that are supposed to be
+ * there: event identifiers, trace context, integrity digests. Reporting them
+ * would bury the findings that matter.
+ *
+ * These exclusions apply **only** to the generic entropy rule. A value under a
+ * property named `password` is reported whatever it looks like, and a value
+ * matching a known token format is reported even if it also looks like an
+ * identifier.
+ *
+ * Every pattern here is anchored with a bounded quantifier, so none can
+ * backtrack catastrophically.
+ */
+export declare function isUuid(value: string): boolean;
+export declare function isUlid(value: string): boolean;
+export declare function isTraceId(value: string): boolean;
+export declare function isSpanId(value: string): boolean;
+export declare function isHexDigest(value: string): boolean;
+export declare function isRfc3339Timestamp(value: string): boolean;
+export declare function isNumericIdentifier(value: string): boolean;
+export declare function isPlainIdentifier(value: string): boolean;
+/** True when a value stands in for a secret that was removed. */
+export declare function isRedactionPlaceholder(value: string): boolean;
+/** True when a value looks like a URL or a scheme-qualified locator. */
+export declare function looksLikeLocator(value: string): boolean;
+/**
+ * True when a value has a recognised, non-secret shape. Consulted only by the
+ * entropy heuristic.
+ */
+export declare function isKnownSafeFormat(value: string): boolean;

package/dist/conformance/src/privacy/safe-formats.js

@@ -0,0 +1,118 @@
+/**
+ * Recognizers for values that must not be reported by the entropy heuristic.
+ *
+ * Audit events are full of long, random-looking strings that are supposed to be
+ * there: event identifiers, trace context, integrity digests. Reporting them
+ * would bury the findings that matter.
+ *
+ * These exclusions apply **only** to the generic entropy rule. A value under a
+ * property named `password` is reported whatever it looks like, and a value
+ * matching a known token format is reported even if it also looks like an
+ * identifier.
+ *
+ * Every pattern here is anchored with a bounded quantifier, so none can
+ * backtrack catastrophically.
+ */
+const UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+/** Crockford base32, excluding I, L, O and U. */
+const ULID = /^[0-9ABCDEFGHJKMNPQRSTVWXYZ]{26}$/;
+const TRACE_ID = /^[0-9a-f]{32}$/;
+const SPAN_ID = /^[0-9a-f]{16}$/;
+/** Lower-case hexadecimal digests of the lengths the integrity verifier supports. */
+const HEX_DIGEST = /^(?:[0-9a-f]{64}|[0-9a-f]{96}|[0-9a-f]{128})$/;
+const RFC3339 = /^\d{4}-\d{2}-\d{2}[Tt ]\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:[Zz]|[+-]\d{2}:\d{2})$/;
+const NUMERIC_ID = /^\d{1,32}$/;
+/**
+ * A lower-case separated identifier or reference path, such as
+ * `payments.settlement.completed`, `chain-platform-control-service` or
+ * `records/root-cause-analysis/rca-2026-0418`.
+ *
+ * Two constraints keep this from swallowing real tokens. At least one separator
+ * is required, so an unbroken run is never excluded. And upper case is not
+ * accepted: a mixed-case alphanumeric run is exactly what a token looks like, so
+ * matching one here would blind the entropy rule to the values it exists to
+ * find. The cost is that an all-lower-case token containing a separator goes
+ * unreported, which is an accepted false negative.
+ */
+const PLAIN_IDENTIFIER = /^[a-z][a-z0-9]*(?:[./_-][a-z0-9]+){1,32}$/;
+/**
+ * Values that stand in for a removed secret. Reporting these punishes the
+ * behaviour the specification asks for, so they are not treated as exposures.
+ * The list is deliberately short and matched exactly: a broad "looks masked"
+ * rule would hide real values.
+ */
+const REDACTION_PLACEHOLDERS = new Set([
+    "[redacted]",
+    "<redacted>",
+    "redacted",
+    "[masked]",
+    "<masked>",
+    "masked",
+    "[removed]",
+    "<removed>",
+    "removed",
+    "[omitted]",
+    "<omitted>",
+    "omitted",
+    "[hidden]",
+    "n/a",
+    "null",
+    "none",
+    "-",
+    "--",
+]);
+/** Any run of asterisks or bullet characters, such as `********`. */
+const MASK_CHARACTERS = /^[*•·]{1,64}$/;
+export function isUuid(value) {
+    return UUID.test(value);
+}
+export function isUlid(value) {
+    return ULID.test(value);
+}
+export function isTraceId(value) {
+    return TRACE_ID.test(value);
+}
+export function isSpanId(value) {
+    return SPAN_ID.test(value);
+}
+export function isHexDigest(value) {
+    return HEX_DIGEST.test(value);
+}
+export function isRfc3339Timestamp(value) {
+    return RFC3339.test(value);
+}
+export function isNumericIdentifier(value) {
+    return NUMERIC_ID.test(value);
+}
+export function isPlainIdentifier(value) {
+    return PLAIN_IDENTIFIER.test(value);
+}
+/** True when a value stands in for a secret that was removed. */
+export function isRedactionPlaceholder(value) {
+    const trimmed = value.trim();
+    if (trimmed === "") {
+        return true;
+    }
+    return REDACTION_PLACEHOLDERS.has(trimmed.toLowerCase()) || MASK_CHARACTERS.test(trimmed);
+}
+/** True when a value looks like a URL or a scheme-qualified locator. */
+export function looksLikeLocator(value) {
+    return value.includes("://");
+}
+/**
+ * True when a value has a recognised, non-secret shape. Consulted only by the
+ * entropy heuristic.
+ */
+export function isKnownSafeFormat(value) {
+    return (isUuid(value) ||
+        isUlid(value) ||
+        isTraceId(value) ||
+        isSpanId(value) ||
+        isHexDigest(value) ||
+        isRfc3339Timestamp(value) ||
+        isNumericIdentifier(value) ||
+        isPlainIdentifier(value) ||
+        looksLikeLocator(value) ||
+        isRedactionPlaceholder(value));
+}
+//# sourceMappingURL=safe-formats.js.map

package/dist/conformance/src/privacy/safe-formats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-formats.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/safe-formats.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,IAAI,GAAG,+EAA+E,CAAC;AAE7F,iDAAiD;AACjD,MAAM,IAAI,GAAG,mCAAmC,CAAC;AAEjD,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC,qFAAqF;AACrF,MAAM,UAAU,GAAG,+CAA+C,CAAC;AAEnE,MAAM,OAAO,GAAG,iFAAiF,CAAC;AAElG,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAG,2CAA2C,CAAC;AAErE;;;;;GAKG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,QAAQ;IACR,WAAW;IACX,WAAW;IACX,SAAS;IACT,WAAW;IACX,WAAW;IACX,SAAS;IACT,UAAU;IACV,KAAK;IACL,MAAM;IACN,MAAM;IACN,GAAG;IACH,IAAI;CACL,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,eAAe,GAAG,eAAe,CAAC;AAExC,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC5F,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,CACL,MAAM,CAAC,KAAK,CAAC;QACb,MAAM,CAAC,KAAK,CAAC;QACb,SAAS,CAAC,KAAK,CAAC;QAChB,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,CAAC;QAClB,kBAAkB,CAAC,KAAK,CAAC;QACzB,mBAAmB,CAAC,KAAK,CAAC;QAC1B,iBAAiB,CAAC,KAAK,CAAC;QACxB,gBAAgB,CAAC,KAAK,CAAC;QACvB,sBAAsB,CAAC,KAAK,CAAC,CAC9B,CAAC;AACJ,CAAC"}

package/dist/conformance/src/privacy/size-analysis.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Size analysis for the containers that are captured wholesale most often.
+ *
+ * This rule cannot tell a carefully chosen large object from a serialized
+ * database row. It reports that a value is large enough to suggest the second,
+ * and says so in those terms: the finding is about **minimization**, not about
+ * personal data, and it never claims to know what the value contains.
+ *
+ * Thresholds are fixed in v0.1 and documented in specification/privacy.md §6.
+ * They are deliberately generous; the aim is to catch dumping, not to police
+ * legitimately detailed metadata.
+ */
+export interface SizeThresholds {
+    readonly serializedBytes: number;
+    readonly totalProperties: number;
+    readonly maxDepth: number;
+    readonly maxArrayLength: number;
+    readonly longestString: number;
+}
+export declare const SIZE_THRESHOLDS: SizeThresholds;
+/** Depth at which profiling stops descending, so that a hostile document cannot exhaust the stack. */
+export declare const MAX_PROFILE_DEPTH = 64;
+export interface SizeProfile {
+    readonly serializedBytes: number;
+    readonly totalProperties: number;
+    readonly maxDepth: number;
+    readonly maxArrayLength: number;
+    readonly longestString: number;
+}
+/** Measures a value without inspecting what it means. */
+export declare function profileValue(value: unknown): SizeProfile;
+/**
+ * Returns the human-readable signals a profile exceeded. The strings describe
+ * measurements only; they never contain any part of the value.
+ */
+export declare function exceededSignals(profile: SizeProfile, thresholds?: SizeThresholds): string[];

package/dist/conformance/src/privacy/size-analysis.js

@@ -0,0 +1,87 @@
+/**
+ * Size analysis for the containers that are captured wholesale most often.
+ *
+ * This rule cannot tell a carefully chosen large object from a serialized
+ * database row. It reports that a value is large enough to suggest the second,
+ * and says so in those terms: the finding is about **minimization**, not about
+ * personal data, and it never claims to know what the value contains.
+ *
+ * Thresholds are fixed in v0.1 and documented in specification/privacy.md §6.
+ * They are deliberately generous; the aim is to catch dumping, not to police
+ * legitimately detailed metadata.
+ */
+export const SIZE_THRESHOLDS = {
+    serializedBytes: 4096,
+    totalProperties: 50,
+    maxDepth: 6,
+    maxArrayLength: 100,
+    longestString: 2048,
+};
+/** Depth at which profiling stops descending, so that a hostile document cannot exhaust the stack. */
+export const MAX_PROFILE_DEPTH = 64;
+/** Measures a value without inspecting what it means. */
+export function profileValue(value) {
+    let totalProperties = 0;
+    let maxDepth = 0;
+    let maxArrayLength = 0;
+    let longestString = 0;
+    const walk = (node, depth) => {
+        if (depth > maxDepth) {
+            maxDepth = depth;
+        }
+        if (depth >= MAX_PROFILE_DEPTH) {
+            return;
+        }
+        if (typeof node === "string") {
+            longestString = Math.max(longestString, node.length);
+            return;
+        }
+        if (Array.isArray(node)) {
+            maxArrayLength = Math.max(maxArrayLength, node.length);
+            for (const item of node) {
+                walk(item, depth + 1);
+            }
+            return;
+        }
+        if (node !== null && typeof node === "object") {
+            for (const [, member] of Object.entries(node)) {
+                totalProperties += 1;
+                walk(member, depth + 1);
+            }
+        }
+    };
+    walk(value, 0);
+    let serializedBytes;
+    try {
+        serializedBytes = Buffer.byteLength(JSON.stringify(value) ?? "", "utf8");
+    }
+    catch {
+        // A value that cannot be serialized cannot be measured; it is not reported.
+        serializedBytes = 0;
+    }
+    return { serializedBytes, totalProperties, maxDepth, maxArrayLength, longestString };
+}
+/**
+ * Returns the human-readable signals a profile exceeded. The strings describe
+ * measurements only; they never contain any part of the value.
+ */
+export function exceededSignals(profile, thresholds = SIZE_THRESHOLDS) {
+    const signals = [];
+    if (profile.serializedBytes > thresholds.serializedBytes) {
+        signals.push(`serialized size ${profile.serializedBytes} bytes exceeds ${thresholds.serializedBytes}`);
+    }
+    if (profile.totalProperties > thresholds.totalProperties) {
+        signals.push(`${profile.totalProperties} properties exceeds ${thresholds.totalProperties}`);
+    }
+    if (profile.maxDepth > thresholds.maxDepth) {
+        signals.push(`nesting depth ${profile.maxDepth} exceeds ${thresholds.maxDepth}`);
+    }
+    if (profile.maxArrayLength > thresholds.maxArrayLength) {
+        signals.push(`array of ${profile.maxArrayLength} items exceeds ${thresholds.maxArrayLength}`);
+    }
+    if (profile.longestString > thresholds.longestString) {
+        signals.push(`string of ${profile.longestString} characters exceeds ${thresholds.longestString}`);
+    }
+    return signals;
+}
+//# sourceMappingURL=size-analysis.js.map

package/dist/conformance/src/privacy/size-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"size-analysis.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/size-analysis.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,MAAM,CAAC,MAAM,eAAe,GAAmB;IAC7C,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,EAAE;IACnB,QAAQ,EAAE,CAAC;IACX,cAAc,EAAE,GAAG;IACnB,aAAa,EAAE,IAAI;CACpB,CAAC;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAUpC,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,KAAa,EAAQ,EAAE;QAClD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACvD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;gBACzE,eAAe,IAAI,CAAC,CAAC;gBACrB,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEf,IAAI,eAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,eAAe,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAoB,EACpB,aAA6B,eAAe;IAE5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,OAAO,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CACV,mBAAmB,OAAO,CAAC,eAAe,kBAAkB,UAAU,CAAC,eAAe,EAAE,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,eAAe,uBAAuB,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,QAAQ,YAAY,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,cAAc,kBAAkB,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CACV,aAAa,OAAO,CAAC,aAAa,uBAAuB,UAAU,CAAC,aAAa,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/conformance/src/privacy/token-patterns.d.ts

@@ -0,0 +1,24 @@
+/** True when a value is shaped like an authorization header credential. */
+export declare function matchesAuthorizationHeader(value: string): boolean;
+/**
+ * True when a value contains a private key marker. Matching is a plain substring
+ * search, so there is no pattern to backtrack, and public certificates and
+ * public keys never match because their markers do not contain `PRIVATE KEY`.
+ */
+export declare function containsPrivateKeyMaterial(value: string): boolean;
+/**
+ * True when a value is structured as a JSON Web Token.
+ *
+ * Three dot-separated segments alone are not enough: arbitrary data splits that
+ * way too. The header and payload must decode from base64url to JSON **objects**
+ * and the header must declare an algorithm, which is what JWS requires.
+ *
+ * The signature is never checked, the decoded values are never returned, and no
+ * claim ever reaches a report.
+ */
+export declare function isJwtStructured(value: string): boolean;
+/**
+ * Returns the rule identifier for a published credential format, or
+ * `undefined`. The matched value is never returned.
+ */
+export declare function matchKnownTokenFormat(value: string): string | undefined;

package/dist/conformance/src/privacy/token-patterns.js

@@ -0,0 +1,126 @@
+/**
+ * Recognizers for credential-shaped values.
+ *
+ * Every pattern is anchored, uses bounded quantifiers and contains no nested
+ * quantifier or back-reference, so none can backtrack catastrophically. No
+ * pattern uses look-behind, which keeps them portable across engines.
+ *
+ * A match identifies a value **shaped like** a credential. Nothing here checks
+ * whether a credential is real, current or usable, and no matched value is ever
+ * returned to a caller: the functions answer yes or no, so that a value cannot
+ * leak into a report by accident.
+ *
+ * The prefixes below are published by the systems that issue them. Recognising
+ * them is a property of this linter, not of the OpenAuditModel data model: the
+ * specification and the canonical schema remain vendor-neutral, and no rule here
+ * introduces a field, vocabulary or concept into the model.
+ */
+import { RULES } from "./rules.js";
+/**
+ * `Scheme <credential>`, as an HTTP authorization header value.
+ *
+ * The credential must be at least 16 characters of credential alphabet and the
+ * whole string must be exactly two whitespace-separated parts, so that ordinary
+ * prose beginning with one of these words is not matched.
+ */
+const AUTHORIZATION_HEADER = /^(?:Bearer|Basic|Digest|ApiKey|Token)\s+[A-Za-z0-9._~+/=-]{16,4096}$/i;
+/** PEM markers that introduce private key material. Public material is excluded. */
+const PRIVATE_KEY_MARKERS = [
+    "BEGIN PRIVATE KEY",
+    "BEGIN RSA PRIVATE KEY",
+    "BEGIN DSA PRIVATE KEY",
+    "BEGIN EC PRIVATE KEY",
+    "BEGIN OPENSSH PRIVATE KEY",
+    "BEGIN PGP PRIVATE KEY BLOCK",
+    "BEGIN ENCRYPTED PRIVATE KEY",
+];
+const BASE64URL_SEGMENT = /^[A-Za-z0-9_-]{4,8192}$/;
+/** Published credential prefixes, each with the rule that reports it. */
+const PREFIXED_TOKEN_PATTERNS = [
+    // Access key identifiers: a 4-character prefix and 16 upper-case characters.
+    { pattern: /^(?:AKIA|ASIA)[A-Z0-9]{16}$/, ruleId: RULES.AWS_ACCESS_KEY_ID.id },
+    // Personal, OAuth, user, server and refresh tokens, and fine-grained tokens.
+    { pattern: /^gh[pousr]_[A-Za-z0-9]{36,255}$/, ruleId: RULES.GITHUB_TOKEN.id },
+    { pattern: /^github_pat_[A-Za-z0-9_]{22,255}$/, ruleId: RULES.GITHUB_TOKEN.id },
+    { pattern: /^glpat-[A-Za-z0-9_-]{20,255}$/, ruleId: RULES.GITLAB_TOKEN.id },
+    { pattern: /^xox[abprs]-[A-Za-z0-9-]{10,255}$/, ruleId: RULES.SLACK_TOKEN.id },
+    { pattern: /^(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,255}$/, ruleId: RULES.PAYMENT_SECRET_KEY.id },
+    { pattern: /^AIza[A-Za-z0-9_-]{35}$/, ruleId: RULES.CLOUD_API_KEY.id },
+];
+/** True when a value is shaped like an authorization header credential. */
+export function matchesAuthorizationHeader(value) {
+    return AUTHORIZATION_HEADER.test(value.trim());
+}
+/**
+ * True when a value contains a private key marker. Matching is a plain substring
+ * search, so there is no pattern to backtrack, and public certificates and
+ * public keys never match because their markers do not contain `PRIVATE KEY`.
+ */
+export function containsPrivateKeyMaterial(value) {
+    return PRIVATE_KEY_MARKERS.some((marker) => value.includes(marker));
+}
+/**
+ * True when a value is structured as a JSON Web Token.
+ *
+ * Three dot-separated segments alone are not enough: arbitrary data splits that
+ * way too. The header and payload must decode from base64url to JSON **objects**
+ * and the header must declare an algorithm, which is what JWS requires.
+ *
+ * The signature is never checked, the decoded values are never returned, and no
+ * claim ever reaches a report.
+ */
+export function isJwtStructured(value) {
+    const segments = value.split(".");
+    if (segments.length !== 3) {
+        return false;
+    }
+    const [header, payload] = segments;
+    if (header === undefined || payload === undefined) {
+        return false;
+    }
+    if (!BASE64URL_SEGMENT.test(header) || !BASE64URL_SEGMENT.test(payload)) {
+        return false;
+    }
+    const decodedHeader = decodeJsonObject(header);
+    if (decodedHeader === undefined || typeof decodedHeader["alg"] !== "string") {
+        return false;
+    }
+    return decodeJsonObject(payload) !== undefined;
+}
+/** Decodes a base64url segment to a JSON object, or `undefined`. Never returns content to a report. */
+function decodeJsonObject(segment) {
+    let text;
+    try {
+        text = Buffer.from(segment, "base64url").toString("utf8");
+    }
+    catch {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return undefined;
+    }
+    return parsed;
+}
+/**
+ * Returns the rule identifier for a published credential format, or
+ * `undefined`. The matched value is never returned.
+ */
+export function matchKnownTokenFormat(value) {
+    if (isJwtStructured(value)) {
+        return RULES.JWT_TOKEN.id;
+    }
+    for (const { pattern, ruleId } of PREFIXED_TOKEN_PATTERNS) {
+        if (pattern.test(value)) {
+            return ruleId;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=token-patterns.js.map

package/dist/conformance/src/privacy/token-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-patterns.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/token-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,oBAAoB,GACxB,uEAAuE,CAAC;AAE1E,oFAAoF;AACpF,MAAM,mBAAmB,GAAsB;IAC7C,mBAAmB;IACnB,uBAAuB;IACvB,uBAAuB;IACvB,sBAAsB;IACtB,2BAA2B;IAC3B,6BAA6B;IAC7B,6BAA6B;CAC9B,CAAC;AAEF,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAEpD,yEAAyE;AACzE,MAAM,uBAAuB,GAGxB;IACH,6EAA6E;IAC7E,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE;IAC9E,6EAA6E;IAC7E,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE;IAC7E,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE;IAC/E,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE;IAC3E,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE;IAC9E,EAAE,OAAO,EAAE,+CAA+C,EAAE,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE;IACjG,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE;CACvE,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;AACjD,CAAC;AAED,uGAAuG;AACvG,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAC5B,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/conformance/src/privacy/traverse.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Deterministic JSON walker.
+ *
+ * Traversal uses own enumerable properties only, never reads a prototype and
+ * never invokes an accessor: input always comes from `JSON.parse`, but a caller
+ * could pass anything, and a linter that runs code contained in the thing it is
+ * inspecting is a vulnerability rather than a tool.
+ */
+/** Depth at which traversal stops descending. */
+export declare const MAX_LINT_DEPTH = 64;
+/** One value encountered during traversal. */
+export interface VisitedValue {
+    /** JSON Pointer to this value. */
+    readonly path: string;
+    /** Property name this value was found under, absent for array items and roots. */
+    readonly key?: string;
+    readonly value: unknown;
+    readonly depth: number;
+}
+/** Escapes a property name as a JSON Pointer reference token: `~` to `~0`, `/` to `~1`. */
+export declare function pointerSegment(property: string): string;
+/** Appends a property name or array index to a JSON Pointer. */
+export declare function joinPointer(base: string, segment: string | number): string;
+/**
+ * Visits a value and every value beneath it, in a stable order.
+ *
+ * The root is visited first, then each member in own-property order. Traversal
+ * stops at `MAX_LINT_DEPTH`; a document deep enough to reach it is reported by
+ * the size rule rather than silently truncated in the caller's mind.
+ */
+export declare function traverse(root: unknown, basePath: string, visit: (visited: VisitedValue) => void): void;
+/** Reads a nested value by property path, without traversing prototypes. */
+export declare function readPath(root: unknown, properties: readonly string[]): unknown;

package/dist/conformance/src/privacy/traverse.js

@@ -0,0 +1,61 @@
+/**
+ * Deterministic JSON walker.
+ *
+ * Traversal uses own enumerable properties only, never reads a prototype and
+ * never invokes an accessor: input always comes from `JSON.parse`, but a caller
+ * could pass anything, and a linter that runs code contained in the thing it is
+ * inspecting is a vulnerability rather than a tool.
+ */
+/** Depth at which traversal stops descending. */
+export const MAX_LINT_DEPTH = 64;
+/** Escapes a property name as a JSON Pointer reference token: `~` to `~0`, `/` to `~1`. */
+export function pointerSegment(property) {
+    return property.replaceAll("~", "~0").replaceAll("/", "~1");
+}
+/** Appends a property name or array index to a JSON Pointer. */
+export function joinPointer(base, segment) {
+    const encoded = typeof segment === "number" ? String(segment) : pointerSegment(segment);
+    return `${base}/${encoded}`;
+}
+/**
+ * Visits a value and every value beneath it, in a stable order.
+ *
+ * The root is visited first, then each member in own-property order. Traversal
+ * stops at `MAX_LINT_DEPTH`; a document deep enough to reach it is reported by
+ * the size rule rather than silently truncated in the caller's mind.
+ */
+export function traverse(root, basePath, visit) {
+    const walk = (value, path, key, depth) => {
+        visit({ path, ...(key === undefined ? {} : { key }), value, depth });
+        if (depth >= MAX_LINT_DEPTH) {
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const [index, item] of value.entries()) {
+                walk(item, joinPointer(path, index), undefined, depth + 1);
+            }
+            return;
+        }
+        if (value !== null && typeof value === "object") {
+            for (const [property, member] of Object.entries(value)) {
+                walk(member, joinPointer(path, property), property, depth + 1);
+            }
+        }
+    };
+    walk(root, basePath, undefined, 0);
+}
+/** Reads a nested value by property path, without traversing prototypes. */
+export function readPath(root, properties) {
+    let current = root;
+    for (const property of properties) {
+        if (current === null || typeof current !== "object" || Array.isArray(current)) {
+            return undefined;
+        }
+        if (!Object.hasOwn(current, property)) {
+            return undefined;
+        }
+        current = current[property];
+    }
+    return current;
+}
+//# sourceMappingURL=traverse.js.map

package/dist/conformance/src/privacy/traverse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"traverse.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/traverse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iDAAiD;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAYjC,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAwB;IAChE,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACxF,OAAO,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAa,EACb,QAAgB,EAChB,KAAsC;IAEtC,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,IAAY,EAAE,GAAuB,EAAE,KAAa,EAAQ,EAAE;QAC1F,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAErE,IAAI,KAAK,IAAI,cAAc,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC5C,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;gBAClF,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,UAA6B;IACnE,IAAI,OAAO,GAAY,IAAI,CAAC;IAE5B,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/conformance/src/privacy/types.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Shared types for privacy linting.
+ *
+ * A **privacy finding** is a suspicion raised by deterministic static analysis.
+ * It is not proof of a data breach, a regulatory violation, a confirmed
+ * credential or confirmed personal data, and the absence of findings is not
+ * proof that an event is safe or compliant. See specification/privacy.md §6.
+ */
+export type Severity = "info" | "low" | "medium" | "high" | "critical";
+export type Confidence = "low" | "medium" | "high";
+export declare const SEVERITY_ORDER: readonly Severity[];
+/** One suspected privacy or secret-exposure risk. Never carries the offending value. */
+export interface PrivacyFinding {
+    /** Stable rule identifier, such as `OAM-PRIV-001`. */
+    readonly ruleId: string;
+    /** How serious the risk would be if the suspicion is correct. */
+    readonly severity: Severity;
+    /** How confident the rule is that the suspicion is correct. */
+    readonly confidence: Confidence;
+    /** JSON Pointer to the offending location inside the event. */
+    readonly path: string;
+    /** One line describing what was observed. Never contains the observed value. */
+    readonly message: string;
+    /** Coarse grouping of the rule. */
+    readonly category?: string;
+    /** What to do about it. */
+    readonly recommendation?: string;
+    /** File the event was read from. Added by the command layer. */
+    readonly sourceFile?: string;
+    /** `id` of the event the finding belongs to. */
+    readonly eventId?: string;
+}
+export type LintStatus = "clean" | "findings" | "schema-invalid";
+/** Outcome of linting one event. */
+export interface EventLintResult {
+    readonly label: string;
+    readonly eventId?: string;
+    readonly status: LintStatus;
+    readonly findings: readonly PrivacyFinding[];
+    /**
+     * Rendered schema issues, present only when the event failed validation.
+     * Deep linting is not attempted for a malformed event, because traversing an
+     * arbitrary structure produces findings whose paths mean nothing.
+     */
+    readonly schemaIssues: readonly string[];
+}
+/** Counts for a run, for the summary line and the JSON report. */
+export interface LintSummary {
+    readonly events: number;
+    readonly clean: number;
+    readonly withFindings: number;
+    readonly schemaInvalid: number;
+    readonly findings: number;
+    readonly bySeverity: Readonly<Record<Severity, number>>;
+}
+export declare function emptySeverityCounts(): Record<Severity, number>;
+/** Summarises a set of results. */
+export declare function summarise(results: readonly EventLintResult[]): LintSummary;

package/dist/conformance/src/privacy/types.js

@@ -0,0 +1,32 @@
+/**
+ * Shared types for privacy linting.
+ *
+ * A **privacy finding** is a suspicion raised by deterministic static analysis.
+ * It is not proof of a data breach, a regulatory violation, a confirmed
+ * credential or confirmed personal data, and the absence of findings is not
+ * proof that an event is safe or compliant. See specification/privacy.md §6.
+ */
+export const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"];
+export function emptySeverityCounts() {
+    return { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+}
+/** Summarises a set of results. */
+export function summarise(results) {
+    const bySeverity = emptySeverityCounts();
+    let findings = 0;
+    for (const result of results) {
+        for (const finding of result.findings) {
+            bySeverity[finding.severity] += 1;
+            findings += 1;
+        }
+    }
+    return {
+        events: results.length,
+        clean: results.filter((result) => result.status === "clean").length,
+        withFindings: results.filter((result) => result.status === "findings").length,
+        schemaInvalid: results.filter((result) => result.status === "schema-invalid").length,
+        findings,
+        bySeverity,
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/conformance/src/privacy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,CAAC,MAAM,cAAc,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAkDjG,MAAM,UAAU,mBAAmB;IACjC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,SAAS,CAAC,OAAmC;IAC3D,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClC,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM;QACnE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;QAC7E,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,MAAM;QACpF,QAAQ;QACR,UAAU;KACX,CAAC;AACJ,CAAC"}