@senpi/runtime 1.1.0-dev.runtime-phase-2.20260525084519 → 1.1.0-dev.runtime-phase-2.20260528085140

package/dist/tracking/spans/plugin-span-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-span-tracker.d.ts","sourceRoot":"","sources":["../../../src/tracking/spans/plugin-span-tracker.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,WAAW,CAWb"}
+{"version":3,"file":"plugin-span-tracker.d.ts","sourceRoot":"","sources":["../../../src/tracking/spans/plugin-span-tracker.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAuChD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,WAAW,CAYb"}

package/dist/tracking/spans/plugin-span-tracker.js

@@ -10,8 +10,32 @@ import { createLogger } from "../../utils/logger.js";
 import { TRACKING_API_BASE_URL } from "../constants.js";
 import { BatchingSpanTransport, NoOpSpanTransport } from "./span-transport.js";
 import { SpanTracker } from "./span-tracker.js";
+import { createOpenRedactionAdapter, isPiiRedactionEnabled, setDefaultPiiRedactor, } from "./redact-pii.js";
 const logger = createLogger("[senpi-core][plugin-span-tracker]");
+/**
+ * Initialize the process-wide default PII redactor when the feature flag is on.
+ * Lazy — the OpenRedaction library is only imported when the flag is set, so
+ * builds and gateways that don't enable redaction don't pay the import cost.
+ *
+ * Fire-and-forget. Failures are logged; spans continue flowing unredacted
+ * rather than blocking startup.
+ */
+function initPiiRedactor() {
+    if (!isPiiRedactionEnabled()) {
+        logger.info("PII redaction disabled (set SENPI_PII_REDACTION_ENABLED=true to enable)");
+        return;
+    }
+    createOpenRedactionAdapter()
+        .then((redactor) => {
+        setDefaultPiiRedactor(redactor);
+        logger.info("PII redaction enabled — spans will be scrubbed for emails, international phones (US/IN/CN/KR/JP/UK/BR/+intl), vendor API keys, EVM private keys, and BIP39 mnemonics before transport");
+    })
+        .catch((err) => {
+        logger.warn("PII redaction init failed — spans will flow UNredacted; check openredaction install", { err: err instanceof Error ? err.message : String(err) });
+    });
+}
 export function createPluginSpanTracker(apiKey) {
+    initPiiRedactor();
     const trackingBaseUrl = process.env.SENPI_TRACKING_URL ?? TRACKING_API_BASE_URL;
     const transport = apiKey
         ? new BatchingSpanTransport({ baseUrl: trackingBaseUrl, apiKey })

package/dist/tracking/spans/plugin-span-tracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-span-tracker.js","sourceRoot":"","sources":["../../../src/tracking/spans/plugin-span-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,MAAM,GAAG,YAAY,CAAC,mCAAmC,CAAC,CAAC;AAEjE,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,qBAAqB,CAAC;IAChF,MAAM,SAAS,GAAG,MAAM;QACtB,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,CAAC,IAAI,CACT,iIAAiI,CAClI,CAAC;YACF,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACjC,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"plugin-span-tracker.js","sourceRoot":"","sources":["../../../src/tracking/spans/plugin-span-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,GAAG,YAAY,CAAC,mCAAmC,CAAC,CAAC;AAEjE;;;;;;;GAOG;AACH,SAAS,eAAe;IACtB,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CACT,yEAAyE,CAC1E,CAAC;QACF,OAAO;IACT,CAAC;IACD,0BAA0B,EAAE;SACzB,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjB,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CACT,uLAAuL,CACxL,CAAC;IACJ,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,CAAC,IAAI,CACT,qFAAqF,EACrF,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,eAAe,EAAE,CAAC;IAClB,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,qBAAqB,CAAC;IAChF,MAAM,SAAS,GAAG,MAAM;QACtB,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,CAAC,IAAI,CACT,iIAAiI,CAClI,CAAC;YACF,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACjC,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AACxC,CAAC"}

package/dist/tracking/spans/redact-pii.d.ts

@@ -0,0 +1,117 @@
+/**
+ * PII + secret redaction for span payloads.
+ *
+ * Walks the `data` field of each span and replaces matches in string values
+ * before the batch hits the wire. Runs at flush time (async) — the underlying
+ * redactor is async, and the producer is fire-and-forget, so we pay the
+ * latency on the network-bound path rather than on the caller's enqueue call.
+ *
+ * Scope (see createOpenRedactionAdapter): emails, phones (US, international,
+ * India, China, South Korea, Japan, UK mobile, Brazil), ~28 vendor API keys
+ * / tokens (AWS, GitHub, Stripe, OpenAI, etc.), EVM private keys, Anthropic
+ * `sk-ant-*` keys, generic `sk-*` keys, and BIP39 mnemonic phrases.
+ *
+ * Integration point: BatchingSpanTransport.flush() applies this to every
+ * span in the batch before JSON.stringify. Only `span.data` is walked;
+ * top-level columns (`address`, `correlationId`, etc.) are non-PII identifiers
+ * and stay as-is.
+ *
+ * Off by default. Enable with `SENPI_PII_REDACTION_ENABLED=true`.
+ */
+import type { TrackingSpan } from "./types.js";
+/** Minimal interface so tests can inject a synchronous stub. */
+export interface PiiRedactor {
+    redact(text: string): Promise<string>;
+}
+/**
+ * Walks a JSON-shaped value. Strings are run through the redactor; arrays
+ * and plain objects are recursed; everything else (number, boolean, null,
+ * non-plain objects) is returned unchanged. Preserves reference identity
+ * when nothing changes — useful for short-circuit downstream comparisons.
+ */
+export declare function redactStringsDeep(value: unknown, redactor: PiiRedactor): Promise<unknown>;
+/**
+ * Redact PII inside `span.data` only. Top-level structural fields (address,
+ * correlationId, runId, etc.) are non-PII identifiers and skipped.
+ *
+ * Returns the same span if nothing changed (avoids object allocation when no
+ * PII was found).
+ */
+export declare function redactSpanData(span: TrackingSpan, redactor: PiiRedactor): Promise<TrackingSpan>;
+export declare function setDefaultPiiRedactor(r: PiiRedactor | null): void;
+export declare function getDefaultPiiRedactor(): PiiRedactor | null;
+/** Reads SENPI_PII_REDACTION_ENABLED. Truthy only on exact "true". */
+export declare function isPiiRedactionEnabled(): boolean;
+/**
+ * Find BIP39-mnemonic spans in `text` using a true sliding window — not
+ * a greedy regex with a post-hoc validator.
+ *
+ * Why this and not a regex+validator:
+ *   - OpenRedaction calls the validator on whatever the regex captured. JS
+ *     regex matching is left-to-right with no backtracking across `lastIndex`
+ *     advances; once a (greedy) match is rejected, the engine moves past it
+ *     entirely. So a 17-word lowercase run like "my secret is <12 BIP39>
+ *     so keep safe" gets captured whole, fails validation on word count,
+ *     and the engine doesn't retry the 12-word window starting 3 tokens in.
+ *
+ * Algorithm:
+ *   1. Tokenize lowercase-only words and their offsets (skips capitalized
+ *      words and punctuation — real mnemonics from wallet exports are
+ *      always all-lowercase space-separated).
+ *   2. Walk left to right. At each token position, try valid mnemonic
+ *      counts largest-first (24, 21, 18, 15, 12) so a 24-word phrase
+ *      inside a longer prose run isn't missed by a premature 12-match.
+ *   3. A window is valid only when every word is BIP39 AND the gap between
+ *      consecutive tokens in the source is whitespace-only (rejects forms
+ *      with commas or other punctuation between words, which real wallet
+ *      exports don't use).
+ *   4. On match, record the source span and advance past it; otherwise step
+ *      forward one token.
+ */
+export declare function findMnemonicSpans(text: string, bip39: Set<string>): Array<{
+    start: number;
+    end: number;
+}>;
+/**
+ * Pre-redact BIP39 mnemonics in `text` before handing the result to
+ * OpenRedaction. Returns the original string when no mnemonics are present
+ * (cheap path — only the tokenizer runs and finds nothing).
+ */
+export declare function redactMnemonicsPreRedaction(text: string): Promise<string>;
+/**
+ * Build an OpenRedaction-backed PiiRedactor.
+ *
+ * Detects:
+ *   - Contact PII: emails.
+ *   - Phones (all custom — upstream phone patterns are unreliable, see
+ *     ALLOWLISTED_PATTERN_TYPES docstring): US, international (`+` prefix),
+ *     India, China, South Korea, Japan, UK mobile, Brazil. Each requires
+ *     either an explicit country code OR a country-specific mobile prefix
+ *     plus separators, so bare numeric IDs (timestamps, span IDs, UUIDs)
+ *     survive untouched.
+ *   - Credentials (upstream): cloud / vendor API keys + tokens (AWS, Azure,
+ *     GCP, GitHub, Slack, Stripe, OpenAI, Twilio, …), bearer + JWT tokens,
+ *     OAuth secrets, generic API keys, SSH/PEM private keys, URLs with
+ *     embedded auth.
+ *   - Crypto secrets (custom patterns): EVM private keys (0x + 64 hex),
+ *     Anthropic `sk-ant-*` keys, generic `sk-*` keys (OpenAI/OpenRouter).
+ *   - BIP39 mnemonic phrases (out-of-band sliding-window pre-pass — see
+ *     `redactMnemonicsPreRedaction`): 12/15/18/21/24 BIP39 words, found and
+ *     redacted before the OpenRedaction pass so embedded phrases like
+ *     "my key is <12 words> keep safe" are caught.
+ *
+ * Tuning:
+ *   - `enableFalsePositiveFilter: false` — explicit; the library defaults
+ *     this to truthy in practice and suppresses valid international-phone
+ *     matches in some contexts.
+ *   - `enableContextAnalysis: false` — saves CPU; context rules add
+ *     latency and aren't load-bearing for the patterns we keep.
+ *   - `enableCache: true` — chat history repeats; cache skips re-scan.
+ *   - `confidenceThreshold: 0.5` — kept conservative; custom patterns score
+ *     1.0 so this only affects built-ins.
+ *
+ * Lazy-imports `openredaction` and `bip39` — both deps stay cold for builds
+ * / tests that don't enable redaction.
+ */
+export declare function createOpenRedactionAdapter(): Promise<PiiRedactor>;
+//# sourceMappingURL=redact-pii.d.ts.map

package/dist/tracking/spans/redact-pii.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-pii.d.ts","sourceRoot":"","sources":["../../../src/tracking/spans/redact-pii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAK/C,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvC;AAQD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,OAAO,CAAC,CAgClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,YAAY,CAAC,CAKvB;AASD,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAEjE;AAED,wBAAgB,qBAAqB,IAAI,WAAW,GAAG,IAAI,CAE1D;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAqOD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GACjB,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA0CvC;AAsBD;;;;GAIG;AACH,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,WAAW,CAAC,CAkCvE"}

package/dist/tracking/spans/redact-pii.js

@@ -0,0 +1,468 @@
+/**
+ * PII + secret redaction for span payloads.
+ *
+ * Walks the `data` field of each span and replaces matches in string values
+ * before the batch hits the wire. Runs at flush time (async) — the underlying
+ * redactor is async, and the producer is fire-and-forget, so we pay the
+ * latency on the network-bound path rather than on the caller's enqueue call.
+ *
+ * Scope (see createOpenRedactionAdapter): emails, phones (US, international,
+ * India, China, South Korea, Japan, UK mobile, Brazil), ~28 vendor API keys
+ * / tokens (AWS, GitHub, Stripe, OpenAI, etc.), EVM private keys, Anthropic
+ * `sk-ant-*` keys, generic `sk-*` keys, and BIP39 mnemonic phrases.
+ *
+ * Integration point: BatchingSpanTransport.flush() applies this to every
+ * span in the batch before JSON.stringify. Only `span.data` is walked;
+ * top-level columns (`address`, `correlationId`, etc.) are non-PII identifiers
+ * and stay as-is.
+ *
+ * Off by default. Enable with `SENPI_PII_REDACTION_ENABLED=true`.
+ */
+import { createLogger } from "../../utils/logger.js";
+const logger = createLogger("[senpi-core][redact-pii]");
+function isPlainObject(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Walks a JSON-shaped value. Strings are run through the redactor; arrays
+ * and plain objects are recursed; everything else (number, boolean, null,
+ * non-plain objects) is returned unchanged. Preserves reference identity
+ * when nothing changes — useful for short-circuit downstream comparisons.
+ */
+export async function redactStringsDeep(value, redactor) {
+    if (typeof value === "string") {
+        if (value.length === 0)
+            return value;
+        try {
+            return await redactor.redact(value);
+        }
+        catch (err) {
+            logger.warn("redactor.redact threw; passing through original", {
+                err: err instanceof Error ? err.message : String(err),
+                preview: value.slice(0, 64),
+            });
+            return value;
+        }
+    }
+    if (Array.isArray(value)) {
+        const next = await Promise.all(value.map((item) => redactStringsDeep(item, redactor)));
+        return next.some((v, i) => v !== value[i]) ? next : value;
+    }
+    if (isPlainObject(value)) {
+        const entries = await Promise.all(Object.entries(value).map(async ([k, v]) => [k, await redactStringsDeep(v, redactor)]));
+        let changed = false;
+        const out = {};
+        for (const [k, v] of entries) {
+            out[k] = v;
+            if (v !== value[k])
+                changed = true;
+        }
+        return changed ? out : value;
+    }
+    return value;
+}
+/**
+ * Redact PII inside `span.data` only. Top-level structural fields (address,
+ * correlationId, runId, etc.) are non-PII identifiers and skipped.
+ *
+ * Returns the same span if nothing changed (avoids object allocation when no
+ * PII was found).
+ */
+export async function redactSpanData(span, redactor) {
+    if (!span.data || typeof span.data !== "object")
+        return span;
+    const next = await redactStringsDeep(span.data, redactor);
+    if (next === span.data)
+        return span;
+    return { ...span, data: next };
+}
+// ─── Default redactor lifecycle ────────────────────────────────────────────
+//
+// The runtime registers a default redactor at startup when the feature flag is
+// on; transports look it up via getDefaultPiiRedactor(). Tests can override.
+let defaultRedactor = null;
+export function setDefaultPiiRedactor(r) {
+    defaultRedactor = r;
+}
+export function getDefaultPiiRedactor() {
+    return defaultRedactor;
+}
+/** Reads SENPI_PII_REDACTION_ENABLED. Truthy only on exact "true". */
+export function isPiiRedactionEnabled() {
+    return process.env.SENPI_PII_REDACTION_ENABLED === "true";
+}
+/**
+ * Built-in OpenRedaction pattern types we allowlist for span redaction.
+ *
+ * Scoped via the `patterns` whitelist (not categories) because category
+ * activation sweeps in patterns that false-positive on our domain content:
+ *
+ *   - `categories: ['personal']` activates NAME patterns that redact
+ *     strategy/asset names ("Setup Bison strategy" → "[NAME_xxx] strategy",
+ *     "long position on ETH" → "long position on [NAME_xxx]").
+ *   - `categories: ['financial']` activates ETH_ADDR which redacts wallet
+ *     addresses inside `data.input.strategyWalletAddress`, breaking joins.
+ *
+ * Phone patterns from upstream are NOT used — we ship our own custom
+ * patterns instead. Specifically:
+ *   - `PHONE_UK` — over-permissive: regex matches any 11-12 digit run with
+ *     no separators, so the trailing 12-digit segment of a UUID (e.g.,
+ *     `...446655440000`) is misclassified as a UK phone.
+ *   - `PHONE_US` (upstream) — matches bare 10-digit numbers, which collides
+ *     with 10-digit Unix timestamps (`1716855600`).
+ *   - `PHONE_INTERNATIONAL` (upstream) — fine in isolation, but with
+ *     `enableContextAnalysis: false` the library still suppresses matches
+ *     in some contexts via undocumented filters; replacing it with our own
+ *     custom version gives us deterministic behavior.
+ *   - `TURKEY_ID` — personal national ID, not a credential.
+ */
+const ALLOWLISTED_PATTERN_TYPES = [
+    // Contact PII (phones come from custom patterns below)
+    "EMAIL",
+    // Cloud / vendor API keys + tokens
+    "AWS_ACCESS_KEY",
+    "AWS_SECRET_KEY",
+    "AZURE_STORAGE_KEY",
+    "BEARER_TOKEN",
+    "CARD_AUTH_CODE",
+    "DOCKER_AUTH",
+    "FIREBASE_API_KEY",
+    "GENERIC_API_KEY",
+    "GENERIC_SECRET",
+    "GITHUB_TOKEN",
+    "GOOGLE_API_KEY",
+    "HEROKU_API_KEY",
+    "JWT_TOKEN",
+    "KUBERNETES_SECRET",
+    "MAILGUN_API_KEY",
+    "NPM_TOKEN",
+    "OAUTH_CLIENT_SECRET",
+    "OAUTH_TOKEN",
+    "OPENAI_API_KEY",
+    "PRIVATE_KEY",
+    "PYPI_TOKEN",
+    "SENDGRID_API_KEY",
+    "SLACK_TOKEN",
+    "SSH_PRIVATE_KEY",
+    "STRIPE_API_KEY",
+    "TWILIO_API_KEY",
+    "URL_WITH_AUTH",
+];
+/**
+ * Phone patterns are entirely custom because upstream is unreliable: PHONE_UK
+ * matches bare 11–12 digit runs (UUID trailing segments), upstream PHONE_US
+ * matches bare 10-digit runs (Unix-seconds timestamps), and the library
+ * doesn't ship India / China / Korea / Japan / Brazil patterns at all.
+ *
+ * Design rule: every pattern requires either an explicit country code OR a
+ * country-specific mobile prefix AND/OR separators between groups. Pure
+ * numeric IDs (timestamps, span IDs, counters, UUID segments) don't satisfy
+ * any of those constraints, so they survive untouched.
+ */
+const PHONE_PATTERNS = [
+    {
+        type: "PHONE_INTL",
+        regex: /\+\d[\d\s.\-()]{8,20}\d/g,
+        priority: 90,
+        placeholder: "[PHONE_INTL_{n}]",
+        severity: "high",
+        description: "International phone with explicit + country-code prefix.",
+    },
+    {
+        type: "PHONE_US",
+        // `(?<!\d)` / `(?!\d)` instead of `\b` so `(415) 555-1234` matches at
+        // "space-paren" (where \b fails) and bare 10-digit timestamps don't.
+        regex: /(?<!\d)(?:\+1[\s.-])?(?:\(\d{3}\)[\s.-]?|\d{3}[\s.-])\d{3}[\s.-]\d{4}(?!\d)/g,
+        priority: 88,
+        placeholder: "[PHONE_US_{n}]",
+        severity: "high",
+        description: "US phone with at least one separator (rejects bare 10-digit timestamps).",
+    },
+    {
+        type: "PHONE_IN",
+        regex: /\b(?:\+?91[\s.-]?)?[6-9]\d{4}[\s.-]?\d{5}\b/g,
+        priority: 85,
+        placeholder: "[PHONE_IN_{n}]",
+        severity: "high",
+        description: "Indian mobile (10 digits starting 6-9; optional +91/91 prefix).",
+    },
+    {
+        type: "PHONE_CN",
+        regex: /\b(?:\+?86[\s.-]?)?1[3-9]\d[\s.-]?\d{4}[\s.-]?\d{4}\b/g,
+        priority: 85,
+        placeholder: "[PHONE_CN_{n}]",
+        severity: "high",
+        description: "Chinese mobile (11 digits starting 1[3-9]; optional +86/86 prefix).",
+    },
+    {
+        type: "PHONE_KR",
+        regex: /\b(?:\+?82[\s.-]?)?0?1[01679][\s.-]\d{3,4}[\s.-]\d{4}\b/g,
+        priority: 85,
+        placeholder: "[PHONE_KR_{n}]",
+        severity: "high",
+        description: "Korean mobile (010/011/016-019 + separators; optional +82 prefix).",
+    },
+    {
+        type: "PHONE_JP",
+        regex: /\b(?:\+?81[\s.-]?)?0?[789]0[\s.-]\d{4}[\s.-]\d{4}\b/g,
+        priority: 85,
+        placeholder: "[PHONE_JP_{n}]",
+        severity: "high",
+        description: "Japanese mobile (070/080/090 + separators; optional +81 prefix).",
+    },
+    {
+        type: "PHONE_UK_MOBILE",
+        regex: /\b(?:\+?44[\s.-]?|0)7\d{3}[\s.-]?\d{3}[\s.-]?\d{3}\b/g,
+        priority: 85,
+        placeholder: "[PHONE_UK_{n}]",
+        severity: "high",
+        description: "UK mobile (07xxx; optional +44 prefix).",
+    },
+    {
+        type: "PHONE_BR",
+        regex: /\b\+?55[\s.-]?\(?\d{2}\)?[\s.-]?9\d{4}[\s.-]?\d{4}\b/g,
+        priority: 85,
+        placeholder: "[PHONE_BR_{n}]",
+        severity: "high",
+        description: "Brazilian mobile (+55 required + DDD + 9-digit number).",
+    },
+];
+/**
+ * Lazy-load the BIP39 English wordlist into a Set for O(1) lookup during
+ * mnemonic validation. Cached after first call; the `bip39` package is only
+ * pulled in when PII redaction is enabled, keeping cold-start cost off the
+ * non-redacting build.
+ */
+let bip39WordSet = null;
+async function getBip39WordSet() {
+    if (bip39WordSet)
+        return bip39WordSet;
+    const mod = (await import("bip39"));
+    const wordlists = mod.wordlists ?? mod.default?.wordlists;
+    if (!wordlists?.english) {
+        throw new Error("bip39: english wordlist not available");
+    }
+    bip39WordSet = new Set(wordlists.english);
+    return bip39WordSet;
+}
+/**
+ * Build the custom-pattern set we layer on top of OpenRedaction's built-ins.
+ * These cover credentials common in our agent traffic that the upstream
+ * library either misses entirely or whose built-in pattern doesn't fire
+ * without context:
+ *
+ *   - CRYPTO_PRIVKEY_HEX: `0x` + 64 hex = EVM private key. Also matches
+ *     SHA-256 hashes; over-redaction is acceptable since hashes inside
+ *     `data` are rare and not load-bearing.
+ *   - ANTHROPIC_API_KEY: `sk-ant-(api|admin)NN-...`; upstream has no
+ *     specific Anthropic pattern.
+ *   - SK_API_KEY: catch-all for OpenAI / OpenRouter / similar `sk-` prefixed
+ *     keys; upstream OPENAI_API_KEY didn't fire on real `sk-proj-*` and
+ *     `sk-svcacct-*` formats in smoke tests.
+ *
+ * NOTE: Mnemonic detection is NOT in this list. The earlier regex-with-
+ * validator approach was greedy and silently missed mnemonics surrounded by
+ * other lowercase words (e.g. "my secret is <12 BIP39 words> so keep safe"
+ * → regex captures the full 17-word run, validator rejects on count/words,
+ * library moves on without retrying a shorter window). Mnemonics are now
+ * handled by `redactMnemonicsPreRedaction` ahead of the OpenRedaction pass.
+ */
+async function buildCustomPatterns() {
+    return [
+        ...PHONE_PATTERNS,
+        {
+            type: "CRYPTO_PRIVKEY_HEX",
+            regex: /\b0x[0-9a-fA-F]{64}\b/g,
+            priority: 110,
+            placeholder: "[CRYPTO_PRIVKEY_{n}]",
+            severity: "critical",
+            description: "EVM private key (0x + 32-byte hex). Matches SHA-256 hashes too — accepted as collateral.",
+        },
+        {
+            type: "ANTHROPIC_API_KEY",
+            regex: /\bsk-ant-(?:api|admin)\d+-[A-Za-z0-9_\-]{40,}\b/g,
+            priority: 110,
+            placeholder: "[ANTHROPIC_KEY_{n}]",
+            severity: "critical",
+        },
+        {
+            type: "SK_API_KEY",
+            regex: /\bsk-(?:proj|live|test|or|svcacct)?[-_]?[A-Za-z0-9_\-]{32,}\b/g,
+            priority: 100,
+            placeholder: "[SK_KEY_{n}]",
+            severity: "critical",
+            description: "Catch-all for sk-* API keys (OpenAI, OpenRouter, etc.).",
+        },
+    ];
+}
+/**
+ * Find BIP39-mnemonic spans in `text` using a true sliding window — not
+ * a greedy regex with a post-hoc validator.
+ *
+ * Why this and not a regex+validator:
+ *   - OpenRedaction calls the validator on whatever the regex captured. JS
+ *     regex matching is left-to-right with no backtracking across `lastIndex`
+ *     advances; once a (greedy) match is rejected, the engine moves past it
+ *     entirely. So a 17-word lowercase run like "my secret is <12 BIP39>
+ *     so keep safe" gets captured whole, fails validation on word count,
+ *     and the engine doesn't retry the 12-word window starting 3 tokens in.
+ *
+ * Algorithm:
+ *   1. Tokenize lowercase-only words and their offsets (skips capitalized
+ *      words and punctuation — real mnemonics from wallet exports are
+ *      always all-lowercase space-separated).
+ *   2. Walk left to right. At each token position, try valid mnemonic
+ *      counts largest-first (24, 21, 18, 15, 12) so a 24-word phrase
+ *      inside a longer prose run isn't missed by a premature 12-match.
+ *   3. A window is valid only when every word is BIP39 AND the gap between
+ *      consecutive tokens in the source is whitespace-only (rejects forms
+ *      with commas or other punctuation between words, which real wallet
+ *      exports don't use).
+ *   4. On match, record the source span and advance past it; otherwise step
+ *      forward one token.
+ */
+export function findMnemonicSpans(text, bip39) {
+    const tokens = [];
+    const wordRe = /[a-z]+/g;
+    let m;
+    while ((m = wordRe.exec(text)) !== null) {
+        tokens.push({ word: m[0], start: m.index, end: m.index + m[0].length });
+    }
+    const validCounts = [24, 21, 18, 15, 12];
+    const spans = [];
+    let i = 0;
+    while (i < tokens.length) {
+        let matched = false;
+        for (const count of validCounts) {
+            if (i + count > tokens.length)
+                continue;
+            let valid = true;
+            for (let j = 0; j < count; j++) {
+                if (!bip39.has(tokens[i + j].word)) {
+                    valid = false;
+                    break;
+                }
+                if (j > 0) {
+                    const gap = text.slice(tokens[i + j - 1].end, tokens[i + j].start);
+                    if (!/^\s+$/.test(gap)) {
+                        valid = false;
+                        break;
+                    }
+                }
+            }
+            if (valid) {
+                spans.push({
+                    start: tokens[i].start,
+                    end: tokens[i + count - 1].end,
+                });
+                i += count;
+                matched = true;
+                break;
+            }
+        }
+        if (!matched)
+            i++;
+    }
+    return spans;
+}
+let mnemonicCounter = 0;
+function redactMnemonicSpans(text, spans) {
+    if (spans.length === 0)
+        return text;
+    let out = "";
+    let cursor = 0;
+    for (const span of spans) {
+        out += text.slice(cursor, span.start);
+        // Bracketed uppercase placeholder ensures the result won't re-tokenize
+        // back into lowercase BIP39-shaped words on a second pass.
+        const suffix = String(mnemonicCounter++ % 10000).padStart(4, "0");
+        out += `[MNEMONIC_${suffix}]`;
+        cursor = span.end;
+    }
+    out += text.slice(cursor);
+    return out;
+}
+/**
+ * Pre-redact BIP39 mnemonics in `text` before handing the result to
+ * OpenRedaction. Returns the original string when no mnemonics are present
+ * (cheap path — only the tokenizer runs and finds nothing).
+ */
+export async function redactMnemonicsPreRedaction(text) {
+    const bip39 = await getBip39WordSet();
+    const spans = findMnemonicSpans(text, bip39);
+    return redactMnemonicSpans(text, spans);
+}
+/**
+ * Build an OpenRedaction-backed PiiRedactor.
+ *
+ * Detects:
+ *   - Contact PII: emails.
+ *   - Phones (all custom — upstream phone patterns are unreliable, see
+ *     ALLOWLISTED_PATTERN_TYPES docstring): US, international (`+` prefix),
+ *     India, China, South Korea, Japan, UK mobile, Brazil. Each requires
+ *     either an explicit country code OR a country-specific mobile prefix
+ *     plus separators, so bare numeric IDs (timestamps, span IDs, UUIDs)
+ *     survive untouched.
+ *   - Credentials (upstream): cloud / vendor API keys + tokens (AWS, Azure,
+ *     GCP, GitHub, Slack, Stripe, OpenAI, Twilio, …), bearer + JWT tokens,
+ *     OAuth secrets, generic API keys, SSH/PEM private keys, URLs with
+ *     embedded auth.
+ *   - Crypto secrets (custom patterns): EVM private keys (0x + 64 hex),
+ *     Anthropic `sk-ant-*` keys, generic `sk-*` keys (OpenAI/OpenRouter).
+ *   - BIP39 mnemonic phrases (out-of-band sliding-window pre-pass — see
+ *     `redactMnemonicsPreRedaction`): 12/15/18/21/24 BIP39 words, found and
+ *     redacted before the OpenRedaction pass so embedded phrases like
+ *     "my key is <12 words> keep safe" are caught.
+ *
+ * Tuning:
+ *   - `enableFalsePositiveFilter: false` — explicit; the library defaults
+ *     this to truthy in practice and suppresses valid international-phone
+ *     matches in some contexts.
+ *   - `enableContextAnalysis: false` — saves CPU; context rules add
+ *     latency and aren't load-bearing for the patterns we keep.
+ *   - `enableCache: true` — chat history repeats; cache skips re-scan.
+ *   - `confidenceThreshold: 0.5` — kept conservative; custom patterns score
+ *     1.0 so this only affects built-ins.
+ *
+ * Lazy-imports `openredaction` and `bip39` — both deps stay cold for builds
+ * / tests that don't enable redaction.
+ */
+export async function createOpenRedactionAdapter() {
+    const { OpenRedaction } = await import("openredaction");
+    const customPatterns = await buildCustomPatterns();
+    // Our local custom-pattern descriptor type is structurally compatible with
+    // the upstream PIIPattern. Cast at the options-object boundary so callers
+    // don't need a build-time dependency on the openredaction type.
+    const options = {
+        patterns: [...ALLOWLISTED_PATTERN_TYPES],
+        customPatterns,
+        enableContextAnalysis: false,
+        enableMultiPass: false,
+        enableCache: true,
+        cacheSize: 200,
+        // Despite the docs saying default is `false`, leaving this unset
+        // causes the library to suppress otherwise-valid phone matches in some
+        // contexts (e.g., `+44 20 7946 0958` after "ring me on"). Force off so
+        // our strict custom regex is the only thing deciding what gets redacted.
+        enableFalsePositiveFilter: false,
+        confidenceThreshold: 0.5,
+    };
+    const instance = new OpenRedaction(options);
+    // Warm the BIP39 word set so the first user-facing call doesn't pay the
+    // dynamic-import latency.
+    await getBip39WordSet();
+    return {
+        async redact(text) {
+            // Mnemonic pre-pass runs FIRST — its sliding-window detector can find
+            // mnemonics that OpenRedaction's regex-with-validator misses when the
+            // phrase is embedded in surrounding lowercase prose.
+            const preRedacted = await redactMnemonicsPreRedaction(text);
+            const result = await instance.detect(preRedacted);
+            return result.redacted;
+        },
+    };
+}
+//# sourceMappingURL=redact-pii.js.map

package/dist/tracking/spans/redact-pii.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-pii.js","sourceRoot":"","sources":["../../../src/tracking/spans/redact-pii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,MAAM,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAC;AAOxD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,QAAqB;IAErB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;gBAC7D,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACrD,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aAC5B,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CACvD,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAU,CAAC,CAChG,CAAC;QACF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;YAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACX,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAkB,EAClB,QAAqB;IAErB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAA+B,EAAE,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAE7E,IAAI,eAAe,GAAuB,IAAI,CAAC;AAE/C,MAAM,UAAU,qBAAqB,CAAC,CAAqB;IACzD,eAAe,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,yBAAyB,GAAG;IAChC,uDAAuD;IACvD,OAAO;IACP,mCAAmC;IACnC,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,WAAW;IACX,mBAAmB;IACnB,iBAAiB;IACjB,WAAW;IACX,qBAAqB;IACrB,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,kBAAkB;IAClB,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;CACP,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAOf;IACH;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,kBAAkB;QAC/B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,0DAA0D;KACxE;IACD;QACE,IAAI,EAAE,UAAU;QAChB,sEAAsE;QACtE,qEAAqE;QACrE,KAAK,EAAE,8EAA8E;QACrF,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,0EAA0E;KACxF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,8CAA8C;QACrD,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,iEAAiE;KAC/E;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,wDAAwD;QAC/D,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,qEAAqE;KACnF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,0DAA0D;QACjE,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oEAAoE;KAClF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,sDAAsD;QAC7D,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,kEAAkE;KAChF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,uDAAuD;QAC9D,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,yCAAyC;KACvD;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,uDAAuD;QAC9D,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,gBAAgB;QAC7B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,yDAAyD;KACvE;CACF,CAAC;AAEF;;;;;GAKG;AACH,IAAI,YAAY,GAAuB,IAAI,CAAC;AAC5C,KAAK,UAAU,eAAe;IAC5B,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAGjC,CAAC;IACF,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;IAC1D,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,KAAK,UAAU,mBAAmB;IAWhC,OAAO;QACL,GAAG,cAAc;QACjB;YACE,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,wBAAwB;YAC/B,QAAQ,EAAE,GAAG;YACb,WAAW,EAAE,sBAAsB;YACnC,QAAQ,EAAE,UAAU;YACpB,WAAW,EAAE,0FAA0F;SACxG;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,kDAAkD;YACzD,QAAQ,EAAE,GAAG;YACb,WAAW,EAAE,qBAAqB;YAClC,QAAQ,EAAE,UAAU;SACrB;QACD;YACE,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,gEAAgE;YACvE,QAAQ,EAAE,GAAG;YACb,WAAW,EAAE,cAAc;YAC3B,QAAQ,EAAE,UAAU;YACpB,WAAW,EAAE,yDAAyD;SACvE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,KAAkB;IAElB,MAAM,MAAM,GAAwD,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAA0C,EAAE,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM;gBAAE,SAAS;YACxC,IAAI,KAAK,GAAG,IAAI,CAAC;YACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,KAAK,GAAG,KAAK,CAAC;oBACd,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACV,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBACnE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvB,KAAK,GAAG,KAAK,CAAC;wBACd,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK;oBACtB,GAAG,EAAE,MAAM,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG;iBAC/B,CAAC,CAAC;gBACH,CAAC,IAAI,KAAK,CAAC;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,CAAC,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,IAAI,eAAe,GAAG,CAAC,CAAC;AACxB,SAAS,mBAAmB,CAC1B,IAAY,EACZ,KAA4C;IAE5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,GAAG,IAAI,aAAa,MAAM,GAAG,CAAC;QAC9B,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;IACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAY;IAC5D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACnD,2EAA2E;IAC3E,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,OAAO,GAAG;QACd,QAAQ,EAAE,CAAC,GAAG,yBAAyB,CAAC;QACxC,cAAc;QACd,qBAAqB,EAAE,KAAK;QAC5B,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,GAAG;QACd,iEAAiE;QACjE,uEAAuE;QACvE,uEAAuE;QACvE,yEAAyE;QACzE,yBAAyB,EAAE,KAAK;QAChC,mBAAmB,EAAE,GAAG;KACoC,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;IAC5C,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,eAAe,EAAE,CAAC;IACxB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,IAAY;YACvB,sEAAsE;YACtE,sEAAsE;YACtE,qDAAqD;YACrD,MAAM,WAAW,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}