@skillsmith/core 0.11.7 → 0.12.1

package/dist/src/security/scanner/SecurityScanner.decoy.js

@@ -0,0 +1,265 @@
+/**
+ * Security Scanner — decoy/misdirection URL-target heuristic
+ * @module @skillsmith/core/security/scanner/SecurityScanner.decoy
+ *
+ * SMI-6033 Wave 4 (Gap 6): reuses the typosquat detector's brand data —
+ * `BRAND_ALIASES` (typosquat.ts) and `AUTHORITY_CLAIMING_AFFIXES`
+ * (typosquat.ts, exported for exactly this reuse as part of Wave 1's Gap 6
+ * prerequisite) — to catch a fetch/exec instruction whose surrounding prose
+ * claims a specific vendor (a brand token, optionally reinforced by an
+ * authority-claiming affix like "official"/"verified") while the fetch
+ * target's actual domain does not belong to that vendor and is not in the
+ * general `DEFAULT_ALLOWED_DOMAINS` allowlist.
+ *
+ * Per the plan's §9 reconciliation table: `decoy_misdirection` is "N/A —
+ * never standalone... Approximate NL heuristic by construction; co-signal
+ * required (medium tier), unchanged." This detector therefore NEVER emits
+ * `high`/`critical` — only `medium`, or nothing (see the doc-context
+ * downgrade below, which uses `low`, not a third severity choice for the
+ * non-doc case). The co-signal mechanism that would let this medium finding
+ * contribute toward escalating a separate weak `code_execution` finding is a
+ * SEPARATE dispatch's job — `SecurityScanner.exec.ts`'s
+ * `CO_SIGNAL_MIN_SEVERITY` replacement — and is NOT implemented in this file.
+ *
+ * Design note, NOT explicit in the plan text and flagged here for review:
+ * the plan says to compare "the claimed vendor's canonical domain" against
+ * the fetch target's domain, but `BRAND_ALIASES`'s values are GitHub OWNER
+ * SLUGS (`anthropics`, `google-gemini`, ...) — they answer "whose GitHub org
+ * publishes this," not "what is this vendor's real website." A small
+ * curated `BRAND_CANONICAL_DOMAINS` map below, scoped to the exact same six
+ * brand tokens `BRAND_ALIASES` already curates, fills that gap; a brand
+ * token with no entry here is not currently possible (the two maps share the
+ * same key set by construction) but the lookup fails safe (empty domain
+ * list -> never matches -> never suppresses) if that ever drifts.
+ *
+ * Second design note: the plan text reads "a brand token OR an
+ * authority-claiming phrase implying a specific vendor." An authority-
+ * claiming affix ALONE ("the official installer") never names a specific
+ * vendor and so cannot resolve a canonical domain to compare against — this
+ * detector therefore requires a brand-token match to identify "the claimed
+ * vendor" at all (necessary for the domain comparison to mean anything), and
+ * treats a co-occurring authority-claiming affix as a confidence booster
+ * (medium -> high), not an alternate, independently-sufficient trigger. This
+ * mirrors typosquat.ts's own rule 3 (`hasBrandToken && hasAuthorityAffix`),
+ * which also requires both signals together.
+ *
+ * Two fixes from adversarial review (2026-08-16 — see
+ * docs/internal/code_review/2026-08-15-smi6033-wave4-escalation-model.md
+ * for the full account):
+ *
+ *  1. Fetch-target correlation. The original version treated ANY URL on a
+ *     line that ALSO matched the generic FETCH_COMMAND_PATTERN as the fetch
+ *     target — including a URL that was merely mentioned in prose alongside
+ *     an unrelated fetch-verb usage on the same line (e.g.
+ *     "curl --version; see mirror documentation at <url>", where curl is
+ *     checking its own version, not fetching that URL). Replaced with
+ *     `isActualFetchTarget`, which requires the fetch verb to be
+ *     IMMEDIATELY followed (only flag-like tokens and whitespace, no
+ *     command separator, no prose) by the URL — i.e. the URL must actually
+ *     be the verb's argument.
+ *
+ *  2. Authority-affix proximity. `hasAuthorityAffix` used to scan the ENTIRE
+ *     ±5-line window independently of where the brand token itself was
+ *     found, so an unrelated authority phrase elsewhere in the window (e.g.
+ *     "for official documentation on Python packaging, see PEP 517") could
+ *     wrongly boost confidence to 'high' for a brand claim it has nothing to
+ *     do with. Now scoped to a tight window around the brand token's OWN
+ *     line (`DECOY_AUTHORITY_AFFIX_PROXIMITY_LINES`).
+ */
+import { analyzeMarkdownContext, isDocumentationContext } from './SecurityScanner.helpers.js';
+import { extractUrls } from './SecurityScanner.urls.js';
+import { DEFAULT_ALLOWED_DOMAINS } from './patterns.js';
+import { BRAND_ALIASES, AUTHORITY_CLAIMING_AFFIXES } from './typosquat.js';
+/** Bounded prose window (±N lines) around a fetch/exec instruction, per the plan's Gap 6 text. */
+const DECOY_WINDOW_LINES = 5;
+/**
+ * How close an authority-claiming affix ("official", "verified", ...) must
+ * be to the brand token's OWN line for it to count as a confidence booster.
+ * Same-line-only (adversarial-review fix, 2026-08-16) — the affix and the
+ * brand claim must plausibly be part of the SAME sentence/claim, not merely
+ * co-located somewhere in the wider fetch-correlation window OR on an
+ * adjacent line carrying an unrelated sentence (a real adversarial-review
+ * example: "For official documentation on Python packaging, see PEP 517."
+ * on the line right after a genuine, affix-free "Claude API" brand mention —
+ * a ±1-line window still wrongly pairs the two).
+ */
+const DECOY_AUTHORITY_AFFIX_PROXIMITY_LINES = 0;
+const FETCH_VERBS = new Set(['curl', 'wget', 'npx']);
+/** A bare flag token, e.g. `-o`, `-fsSL`, `--output`, `--data=x`. */
+const FLAG_TOKEN = /^-{1,2}[A-Za-z][\w-]*$/;
+/**
+ * Common curl/wget/npx flags that take a SEPARATE value token (e.g.
+ * `-o setup.sh`, `-X POST`) — that value token must be consumed as part of
+ * the flag, not mistaken for prose.
+ */
+const VALUE_TAKING_FLAGS = new Set([
+    '-o',
+    '-x',
+    '-h',
+    '-d',
+    '-a',
+    '-e',
+    '-u',
+    '-b',
+    '--output',
+    '--request',
+    '--header',
+    '--data',
+    '--data-raw',
+    '--data-binary',
+    '--data-urlencode',
+    '--user-agent',
+    '--referer',
+    '--proxy',
+    '--cookie',
+]);
+/**
+ * True when `url` (verbatim substring of `lineContent`) is actually the
+ * argument to a fetch verb (curl/wget/npx, or `git clone`) on that line —
+ * not merely co-located with one. Tokenizes the prefix before the URL:
+ * rejects outright on any command separator (`;`, `|`, `&`), requires the
+ * prefix to start with the fetch verb, and requires every remaining token to
+ * be either a flag or the value argument of a value-taking flag (e.g.
+ * `curl -o setup.sh <url>`) — any other token (prose) fails the match.
+ * Rejects "curl --version; see mirror documentation at <url>" (the URL is
+ * not curl's argument, and the `;` alone already disqualifies it); accepts
+ * "curl -fsSL <url>", "curl -o setup.sh <url>", "wget <url>",
+ * "git clone <url>", "npx --yes <url>".
+ */
+function isActualFetchTarget(lineContent, url) {
+    const urlIndex = lineContent.indexOf(url);
+    if (urlIndex < 0)
+        return false;
+    const prefix = lineContent.slice(0, urlIndex);
+    if (/[;|&]/.test(prefix))
+        return false;
+    const tokens = prefix
+        .trim()
+        .split(/\s+/)
+        .filter((t) => t.length > 0);
+    if (tokens.length === 0)
+        return false;
+    let i;
+    if (tokens[0]?.toLowerCase() === 'git' && tokens[1]?.toLowerCase() === 'clone') {
+        i = 2;
+    }
+    else if (FETCH_VERBS.has(tokens[0]?.toLowerCase() ?? '')) {
+        i = 1;
+    }
+    else {
+        return false;
+    }
+    for (; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (!FLAG_TOKEN.test(token))
+            return false;
+        if (VALUE_TAKING_FLAGS.has(token.toLowerCase()) && i + 1 < tokens.length) {
+            i++; // consume the flag's own value token too
+        }
+    }
+    return true;
+}
+/**
+ * Curated canonical domain(s) per `BRAND_ALIASES` brand token — see this
+ * file's own header for why this cannot simply reuse `BRAND_ALIASES`'
+ * values directly (those are GitHub owner slugs, not DNS domains).
+ */
+const BRAND_CANONICAL_DOMAINS = {
+    anthropic: ['anthropic.com', 'claude.ai'],
+    claude: ['anthropic.com', 'claude.ai'],
+    gemini: ['google.com', 'ai.google.dev', 'deepmind.google'],
+    copilot: ['github.com', 'microsoft.com'],
+    vercel: ['vercel.com'],
+    salesforce: ['salesforce.com'],
+};
+/** Split a line into lowercase alphanumeric tokens on any separator (mirrors typosquat.ts's own `tokenize`). */
+function tokenize(raw) {
+    return raw
+        .toLowerCase()
+        .split(/[^a-z0-9]+/i)
+        .filter((t) => t.length > 0);
+}
+/** Exact-or-subdomain match against a domain set (mirrors `isAllowedDomain`'s own logic in SecurityScanner.ts). */
+function matchesDomainSet(hostname, domains) {
+    return domains.some((d) => hostname === d || hostname.endsWith('.' + d));
+}
+/**
+ * Scan a bounded ±`DECOY_WINDOW_LINES` window around `lineIndex` for a brand
+ * token (required). Returns `null` when no brand token is present — nothing
+ * to compare a fetch target's domain against. `hasAuthorityAffix` is then
+ * resolved separately, scoped tightly to the brand token's OWN line (see
+ * `DECOY_AUTHORITY_AFFIX_PROXIMITY_LINES` and this file's header note on the
+ * adversarial-review fix) — NOT the wider fetch-correlation window, so an
+ * authority phrase unrelated to this specific brand claim can't wrongly
+ * boost confidence.
+ */
+function findVendorClaimInWindow(lines, lineIndex) {
+    const start = Math.max(0, lineIndex - DECOY_WINDOW_LINES);
+    const end = Math.min(lines.length - 1, lineIndex + DECOY_WINDOW_LINES);
+    let brandToken = null;
+    let brandLineIndex = -1;
+    for (let i = start; i <= end && !brandToken; i++) {
+        for (const token of tokenize(lines[i] ?? '')) {
+            if (Object.prototype.hasOwnProperty.call(BRAND_ALIASES, token)) {
+                brandToken = token;
+                brandLineIndex = i;
+                break;
+            }
+        }
+    }
+    if (!brandToken)
+        return null;
+    const affixStart = Math.max(0, brandLineIndex - DECOY_AUTHORITY_AFFIX_PROXIMITY_LINES);
+    const affixEnd = Math.min(lines.length - 1, brandLineIndex + DECOY_AUTHORITY_AFFIX_PROXIMITY_LINES);
+    const hasAuthorityAffix = tokenize(lines.slice(affixStart, affixEnd + 1).join(' ')).some((t) => AUTHORITY_CLAIMING_AFFIXES.has(t));
+    return { brandToken, hasAuthorityAffix };
+}
+export function scanDecoyMisdirection(content, lineContexts) {
+    const findings = [];
+    const lines = content.split('\n');
+    const contexts = lineContexts ?? analyzeMarkdownContext(content);
+    const urls = extractUrls(content);
+    for (const { url, line } of urls) {
+        const lineIndex = line - 1;
+        const lineContent = lines[lineIndex] ?? '';
+        // Only a URL that is ACTUALLY the argument to a fetch verb is in scope —
+        // a bare linked URL ("see https://docs.example.com") is not, and neither
+        // is a URL merely co-located on a line with an unrelated fetch-verb
+        // usage (adversarial-review fix, 2026-08-16 — see isActualFetchTarget's
+        // own doc comment).
+        if (!isActualFetchTarget(lineContent, url))
+            continue;
+        let hostname;
+        try {
+            hostname = new URL(url).hostname.toLowerCase();
+        }
+        catch {
+            continue;
+        }
+        const claim = findVendorClaimInWindow(lines, lineIndex);
+        if (!claim)
+            continue; // no vendor claim nearby -> nothing to compare against; not a general brand-mention detector
+        const canonicalDomains = BRAND_CANONICAL_DOMAINS[claim.brandToken] ?? [];
+        if (matchesDomainSet(hostname, canonicalDomains))
+            continue; // fetch target IS the claimed vendor's own domain
+        if (matchesDomainSet(hostname, DEFAULT_ALLOWED_DOMAINS))
+            continue; // generally-trusted host, excluded per the plan text
+        const ctx = contexts[lineIndex];
+        const inDocContext = ctx ? isDocumentationContext(ctx) : false;
+        findings.push({
+            type: 'decoy_misdirection',
+            // Never high/critical — an approximate NL heuristic by construction
+            // (plan §9 reconciliation table); the escalation-into-code_execution
+            // co-signal mechanism lives in a separate dispatch.
+            severity: inDocContext ? 'low' : 'medium',
+            message: `Fetch target domain ("${hostname}") does not match the "${claim.brandToken}" vendor claimed nearby in the skill's own prose: ${url}`,
+            location: lineContent.trim().slice(0, 100),
+            lineNumber: line,
+            category: 'decoy_misdirection',
+            inDocumentationContext: inDocContext,
+            confidence: inDocContext ? 'low' : claim.hasAuthorityAffix ? 'high' : 'medium',
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=SecurityScanner.decoy.js.map

package/dist/src/security/scanner/SecurityScanner.decoy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.decoy.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.decoy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAIH,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAA;AAE1E,kGAAkG;AAClG,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAE5B;;;;;;;;;;GAUG;AACH,MAAM,qCAAqC,GAAG,CAAC,CAAA;AAE/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AACpD,qEAAqE;AACrE,MAAM,UAAU,GAAG,wBAAwB,CAAA;AAC3C;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,UAAU;IACV,WAAW;IACX,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,eAAe;IACf,kBAAkB;IAClB,cAAc;IACd,WAAW;IACX,SAAS;IACT,UAAU;CACX,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,SAAS,mBAAmB,CAAC,WAAmB,EAAE,GAAW;IAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAEtC,MAAM,MAAM,GAAG,MAAM;SAClB,IAAI,EAAE;SACN,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,CAAS,CAAA;IACb,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QAC/E,CAAC,GAAG,CAAC,CAAA;IACP,CAAC;SAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,CAAC,GAAG,CAAC,CAAA;IACP,CAAC;SAAM,CAAC;QACN,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACzE,CAAC,EAAE,CAAA,CAAC,yCAAyC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAgD;IAC3E,SAAS,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;IACzC,MAAM,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;IACtC,MAAM,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,iBAAiB,CAAC;IAC1D,OAAO,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC;IACxC,MAAM,EAAE,CAAC,YAAY,CAAC;IACtB,UAAU,EAAE,CAAC,gBAAgB,CAAC;CAC/B,CAAA;AAED,gHAAgH;AAChH,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,GAAG;SACP,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,mHAAmH;AACnH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,OAA0B;IACpE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;AAC1E,CAAC;AAOD;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,KAAe,EAAE,SAAiB;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,kBAAkB,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,GAAG,kBAAkB,CAAC,CAAA;IAEtE,IAAI,UAAU,GAAkB,IAAI,CAAA;IACpC,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IACvB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/D,UAAU,GAAG,KAAK,CAAA;gBAClB,cAAc,GAAG,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,qCAAqC,CAAC,CAAA;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,KAAK,CAAC,MAAM,GAAG,CAAC,EAChB,cAAc,GAAG,qCAAqC,CACvD,CAAA;IACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7F,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAClC,CAAA;IAED,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IAEjC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAA;QAC1B,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QAC1C,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,wEAAwE;QACxE,oBAAoB;QACpB,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,GAAG,CAAC;YAAE,SAAQ;QAEpD,IAAI,QAAgB,CAAA;QACpB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACvD,IAAI,CAAC,KAAK;YAAE,SAAQ,CAAC,6FAA6F;QAElH,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QACxE,IAAI,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YAAE,SAAQ,CAAC,kDAAkD;QAC7G,IAAI,gBAAgB,CAAC,QAAQ,EAAE,uBAAuB,CAAC;YAAE,SAAQ,CAAC,qDAAqD;QAEvH,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC/B,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAE9D,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,oEAAoE;YACpE,qEAAqE;YACrE,oDAAoD;YACpD,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;YACzC,OAAO,EAAE,yBAAyB,QAAQ,0BAA0B,KAAK,CAAC,UAAU,qDAAqD,GAAG,EAAE;YAC9I,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC1C,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,oBAAoB;YAC9B,sBAAsB,EAAE,YAAY;YACpC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;SAC/E,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/src/security/scanner/SecurityScanner.encoding.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Security Scanner — encoded (base64) payload detect-decode-recursively-rescan
+ * @module @skillsmith/core/security/scanner/SecurityScanner.encoding
+ *
+ * SMI-6033 Wave 2 (Gap 2): before this file, `base64 -d | sh` (the DECODE
+ * INVOCATION syntax) was already caught by CODE_EXECUTION_PATTERNS, but an
+ * inert base64 blob the agent is merely instructed to decode and run itself
+ * scored zero.
+ *
+ * Rather than a parallel "this looks suspicious" heuristic (high FP risk —
+ * base64 blobs are extremely common in legitimate skills: image data URIs,
+ * git hashes, JWTs), this detector DECODES the candidate and recursively runs
+ * the caller's full detector suite against the decoded text, reusing the
+ * whole pattern arsenal instead of duplicating it. The escalation this gap
+ * achieves is free: a decoded `curl|bash` natively trips `code_execution` at
+ * ITS OWN severity, exactly as if the attacker had shipped it undecoded.
+ *
+ * Depth-1-only, STRUCTURALLY (not by convention). This module never scans
+ * itself — `rescan`, the callback the caller supplies, is expected to be the
+ * caller's OWN "run every detector" entry point with the encoded-payload
+ * detector specifically disabled for that inner call (see
+ * `SecurityScanner.ts`'s `runDetectors(content, lineContexts,
+ * skipEncodedPayload)`, where the recursive callback always passes `true`).
+ * The inner call therefore cannot reach this detector again no matter what
+ * the decoded content contains — a base64 blob discovered INSIDE decoded
+ * content is never itself decoded.
+ *
+ * Candidate detection: a contiguous base64-alphabet run,
+ * `[A-Za-z0-9+/]{120,}={0,2}`. Deliberately EXCLUDES `-`/`_` (base64url), so
+ * a JWT never becomes a candidate at all — that is the intentional mechanism
+ * keeping JWTs out, not a separate check. Bounded/ReDoS-safe: a single
+ * character-class quantifier has no catastrophic-backtracking surface, so
+ * this intentionally does NOT route through `safeRegexTest`'s 10,000-char
+ * truncation — a legitimate base64 blob routinely runs past that on one long
+ * line, and truncating it would silently defeat detection.
+ *
+ * The wrapper finding (`encoded_payload`) is advisory-tier ONLY (weight 1.2 /
+ * coefficient 0.04 — the sensitive_path/typosquat tier, NOT the 2.0/0.40 tier
+ * the other three Wave 2 detectors use, see weights.ts): this detector is
+ * pure observability/provenance-marking, not itself a strong signal. Every
+ * finding folded in from the decoded content carries a NEW `decodedFrom`
+ * field (types.ts) set to the OUTER document line the blob was found on —
+ * the same provenance-marker role `filePath` already plays for a
+ * sibling-file finding, just for a decoded-blob origin instead of a
+ * different file.
+ */
+import type { SecurityFinding } from './types.js';
+import type { LineContext } from './SecurityScanner.helpers.js';
+/**
+ * Callback the caller (`SecurityScanner`) supplies to run its OWN full
+ * detector suite against decoded text, with the encoded-payload detector
+ * itself disabled — the structural depth-1 guarantee (see module header).
+ */
+export type EncodedPayloadRescanner = (decodedContent: string) => SecurityFinding[];
+export declare function scanEncodedPayload(content: string, lineContexts: LineContext[] | undefined, rescan: EncodedPayloadRescanner): SecurityFinding[];
+//# sourceMappingURL=SecurityScanner.encoding.d.ts.map

package/dist/src/security/scanner/SecurityScanner.encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.encoding.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.encoding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AA2I/D;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,cAAc,EAAE,MAAM,KAAK,eAAe,EAAE,CAAA;AAEnF,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,WAAW,EAAE,GAAG,SAAS,EACvC,MAAM,EAAE,uBAAuB,GAC9B,eAAe,EAAE,CAsGnB"}

package/dist/src/security/scanner/SecurityScanner.encoding.js

@@ -0,0 +1,270 @@
+/**
+ * Security Scanner — encoded (base64) payload detect-decode-recursively-rescan
+ * @module @skillsmith/core/security/scanner/SecurityScanner.encoding
+ *
+ * SMI-6033 Wave 2 (Gap 2): before this file, `base64 -d | sh` (the DECODE
+ * INVOCATION syntax) was already caught by CODE_EXECUTION_PATTERNS, but an
+ * inert base64 blob the agent is merely instructed to decode and run itself
+ * scored zero.
+ *
+ * Rather than a parallel "this looks suspicious" heuristic (high FP risk —
+ * base64 blobs are extremely common in legitimate skills: image data URIs,
+ * git hashes, JWTs), this detector DECODES the candidate and recursively runs
+ * the caller's full detector suite against the decoded text, reusing the
+ * whole pattern arsenal instead of duplicating it. The escalation this gap
+ * achieves is free: a decoded `curl|bash` natively trips `code_execution` at
+ * ITS OWN severity, exactly as if the attacker had shipped it undecoded.
+ *
+ * Depth-1-only, STRUCTURALLY (not by convention). This module never scans
+ * itself — `rescan`, the callback the caller supplies, is expected to be the
+ * caller's OWN "run every detector" entry point with the encoded-payload
+ * detector specifically disabled for that inner call (see
+ * `SecurityScanner.ts`'s `runDetectors(content, lineContexts,
+ * skipEncodedPayload)`, where the recursive callback always passes `true`).
+ * The inner call therefore cannot reach this detector again no matter what
+ * the decoded content contains — a base64 blob discovered INSIDE decoded
+ * content is never itself decoded.
+ *
+ * Candidate detection: a contiguous base64-alphabet run,
+ * `[A-Za-z0-9+/]{120,}={0,2}`. Deliberately EXCLUDES `-`/`_` (base64url), so
+ * a JWT never becomes a candidate at all — that is the intentional mechanism
+ * keeping JWTs out, not a separate check. Bounded/ReDoS-safe: a single
+ * character-class quantifier has no catastrophic-backtracking surface, so
+ * this intentionally does NOT route through `safeRegexTest`'s 10,000-char
+ * truncation — a legitimate base64 blob routinely runs past that on one long
+ * line, and truncating it would silently defeat detection.
+ *
+ * The wrapper finding (`encoded_payload`) is advisory-tier ONLY (weight 1.2 /
+ * coefficient 0.04 — the sensitive_path/typosquat tier, NOT the 2.0/0.40 tier
+ * the other three Wave 2 detectors use, see weights.ts): this detector is
+ * pure observability/provenance-marking, not itself a strong signal. Every
+ * finding folded in from the decoded content carries a NEW `decodedFrom`
+ * field (types.ts) set to the OUTER document line the blob was found on —
+ * the same provenance-marker role `filePath` already plays for a
+ * sibling-file finding, just for a decoded-blob origin instead of a
+ * different file.
+ */
+import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, } from './SecurityScanner.helpers.js';
+/**
+ * Per-candidate size cap. Mirrors `MAX_SIBLING_CONTENT_BYTES`'s rationale
+ * (`scripts/indexer/skill-processor.security.ts`, 256_000) — bound the work a
+ * single decode-and-recursively-rescan pass can do so an attacker can't
+ * weaponize an oversized base64 blob into a decode/rescan cost blowup. Same
+ * order of magnitude; not required to match exactly.
+ *
+ * SMI-6033 Wave 3 (adversarial-review fix): exceeding this cap used to
+ * `continue` with ZERO trace — no decode, no finding, nothing — which handed
+ * an attacker a one-line bypass of the entire detector: pad the malicious
+ * blob past 200 KB with base64-valid filler and it becomes invisible. The cap
+ * itself is a deliberate, correct resource bound and is UNCHANGED (an
+ * oversized candidate is still never decoded or rescanned — decoding it is
+ * exactly what the cap exists to prevent); what changed is that its
+ * existence is now SURFACED as a low/low advisory finding instead of being
+ * silently dropped. Same "caps surfaced, not silent" principle as Gap 8's
+ * `scan_coverage_incomplete` flag.
+ */
+const MAX_ENCODED_CANDIDATE_BYTES = 200_000;
+/**
+ * Ceiling on how many oversized-candidate advisories one document can emit
+ * (SMI-6033 Wave 3). Deliberately a SEPARATE counter from
+ * `MAX_BASE64_CANDIDATES` below, not a share of that budget: an oversized
+ * candidate costs no decode work, so charging it to the decode budget would
+ * let an attacker spend the real budget on cheap oversized filler and
+ * suppress decoding of the genuine candidates that follow. Beyond this
+ * ceiling further oversized candidates are dropped, but — unlike before the
+ * fix — the pattern is no longer invisible: the first `MAX_OVERSIZED_ADVISORIES`
+ * already surface it. Reset fresh on every `scanEncodedPayload` call.
+ */
+const MAX_OVERSIZED_ADVISORIES = 8;
+/**
+ * Document-wide candidate-COUNT cap (SMI-6033 Gap 2 resource-bound
+ * follow-up). Without a ceiling here, an attacker could pad a skill with
+ * dozens/hundreds of individually-qualifying base64 blobs to force many
+ * expensive decode-and-recursively-rescan passes — a cost/availability
+ * concern, not a false-positive concern (each candidate under
+ * `MAX_ENCODED_CANDIDATE_BYTES` is still legitimate-shaped on its own).
+ * Checked in REGEX-MATCH order, before the decode attempt itself, so the
+ * bound applies even to attempts that end up failing (invalid base64,
+ * binary noise) — not just to successful decode-and-rescan passes. Once 8
+ * candidates in one document have been attempted, every further candidate is
+ * silently skipped: no decode attempt, no finding — the same "not processed
+ * is silent" convention `tryDecodeBase64ToPlausibleText`'s own failure path
+ * already follows. Reset fresh on every `scanEncodedPayload` call; never
+ * persisted across calls or across a scan session.
+ */
+const MAX_BASE64_CANDIDATES = 8;
+/**
+ * Aggregate DECODED-byte cap across ALL candidates in one document (SMI-6033
+ * Gap 2 resource-bound follow-up). Mirrors `MAX_SIBLING_CONTENT_BYTES`'s
+ * 256_000 convention (`scripts/indexer/skill-processor.security.ts`) — this
+ * detector's document-wide analogue of that per-fetch byte budget. IN
+ * ADDITION TO the per-candidate `MAX_ENCODED_CANDIDATE_BYTES` cap above: that
+ * one bounds a single blob's ENCODED size; this one bounds the running total
+ * of DECODED bytes across every candidate successfully decoded so far in the
+ * same document scan, so a run of many just-under-the-per-candidate-cap
+ * blobs can't sum to an unbounded decode/rescan cost. Once exceeded, every
+ * remaining candidate in the document is skipped — including the one whose
+ * own decode pushed the running total over the limit — same silent-skip
+ * convention as `MAX_BASE64_CANDIDATES` above. Reset fresh on every
+ * `scanEncodedPayload` call; never persisted across calls or across a scan
+ * session.
+ */
+const MAX_DECODED_TOTAL_BYTES = 256_000;
+/** Contiguous base64-alphabet run, >=120 chars, optional 0-2 padding chars. */
+const BASE64_CANDIDATE = /[A-Za-z0-9+/]{120,}={0,2}/g;
+/**
+ * How far back (chars) to look, from a candidate's start, for a
+ * `data:image/`, `data:font/`, or `data:audio/` prefix. A real data URI's
+ * MIME type + `;base64,` separator is well within this window
+ * (`data:image/svg+xml;base64,` is 28 chars).
+ */
+const DATA_URI_LOOKBACK = 60;
+const DATA_URI_PREFIX = /data:(?:image|font|audio)\//i;
+/** Non-printable / control characters (excluding \t\r\n) — the printable-ratio gate. */
+// eslint-disable-next-line no-control-regex -- Intentional: detecting binary/control-byte noise in decoded content.
+const CONTROL_CHAR = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/;
+/** Minimum fraction of non-control characters required to treat decoded bytes as plausible text. */
+const MIN_PRINTABLE_RATIO = 0.9;
+/**
+ * Attempt exactly one base64 decode of `candidate`. Returns the decoded text
+ * when it is valid UTF-8 with a plausible-text printable-character ratio;
+ * `null` on ANY failure (invalid base64 syntax, decoded bytes that are not
+ * valid UTF-8, or valid UTF-8 that is mostly control/binary noise) — decode
+ * failure is deliberately not itself a finding.
+ */
+function tryDecodeBase64ToPlausibleText(candidate) {
+    let binary;
+    try {
+        // atob (Web/Deno/Node-global — no Buffer dependency, keeps this logic
+        // parallel to the edge/Deno twin) throws on invalid base64 syntax.
+        binary = atob(candidate);
+    }
+    catch {
+        return null;
+    }
+    if (binary.length === 0)
+        return null;
+    // Round-trip check: atob is lenient about some malformed/non-canonical
+    // input (e.g. missing padding) — re-encoding and comparing (modulo
+    // padding) rejects a decode atob accepted but that doesn't reproduce the
+    // original candidate, rather than silently scanning a garbled subset.
+    if (btoa(binary).replace(/=+$/, '') !== candidate.replace(/=+$/, ''))
+        return null;
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        return null; // not valid UTF-8 -> binary blob, not a text payload
+    }
+    if (text.length === 0)
+        return null;
+    let controlCount = 0;
+    for (const ch of text) {
+        if (CONTROL_CHAR.test(ch))
+            controlCount++;
+    }
+    const printableRatio = (text.length - controlCount) / text.length;
+    if (printableRatio < MIN_PRINTABLE_RATIO)
+        return null;
+    return text;
+}
+export function scanEncodedPayload(content, lineContexts, rescan) {
+    const findings = [];
+    const lines = content.split('\n');
+    const contexts = lineContexts ?? analyzeMarkdownContext(content);
+    // Per-document resource bounds (see MAX_BASE64_CANDIDATES /
+    // MAX_DECODED_TOTAL_BYTES doc comments above) — fresh per call, never
+    // shared across calls or across a scan session.
+    let candidatesProcessed = 0;
+    let decodedTotalBytes = 0;
+    let aggregateBudgetExhausted = false;
+    let oversizedAdvisories = 0;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        for (const match of line.matchAll(BASE64_CANDIDATE)) {
+            const candidate = match[0];
+            const start = match.index ?? 0;
+            // Data-URI exclusion runs FIRST (SMI-6033 Wave 3 — it used to run after
+            // the size check). An embedded image/font/audio data URI routinely runs
+            // past MAX_ENCODED_CANDIDATE_BYTES, and it is a known-benign shape, so
+            // it must be excluded BEFORE the oversized advisory below can fire on
+            // it. Behaviorally identical for every candidate under the cap.
+            const before = line.slice(Math.max(0, start - DATA_URI_LOOKBACK), start);
+            if (DATA_URI_PREFIX.test(before))
+                continue;
+            // Oversized candidate: never decoded/rescanned (that is precisely what
+            // the cap buys), but no longer silently dropped either — see
+            // MAX_ENCODED_CANDIDATE_BYTES's doc comment for the evasion this
+            // closes. Emitted at low/low: it is a coverage caveat, not evidence.
+            if (candidate.length > MAX_ENCODED_CANDIDATE_BYTES) {
+                if (oversizedAdvisories >= MAX_OVERSIZED_ADVISORIES)
+                    continue;
+                oversizedAdvisories++;
+                const oversizeCtx = contexts[index];
+                const oversizeInInlineCode = oversizeCtx?.isInlineCode && isWithinInlineCode(line, start);
+                const oversizeInDocContext = oversizeCtx
+                    ? isDocumentationContext(oversizeCtx) || oversizeInInlineCode
+                    : false;
+                findings.push({
+                    type: 'encoded_payload',
+                    severity: 'low',
+                    message: `Base64-encoded payload exceeds the ${MAX_ENCODED_CANDIDATE_BYTES}-byte per-candidate cap — oversized candidate, not decoded/rescanned (${candidate.length} chars)`,
+                    location: line.trim().slice(0, 100),
+                    lineNumber,
+                    category: 'encoded_payload',
+                    inDocumentationContext: oversizeInDocContext,
+                    confidence: 'low',
+                });
+                continue;
+            }
+            // Document-wide candidate-count cap — checked before the decode
+            // attempt itself so the bound applies even to attempts that end up
+            // failing, not just successful ones. Once the aggregate decoded-byte
+            // budget below is exhausted, every remaining candidate is skipped too.
+            if (candidatesProcessed >= MAX_BASE64_CANDIDATES || aggregateBudgetExhausted)
+                continue;
+            candidatesProcessed++;
+            const decoded = tryDecodeBase64ToPlausibleText(candidate);
+            if (decoded === null)
+                continue; // decode failure / binary noise -> not itself a finding
+            // Aggregate decoded-byte cap: if THIS candidate would push the
+            // document-wide running total over MAX_DECODED_TOTAL_BYTES, skip it
+            // (and, via aggregateBudgetExhausted, every candidate after it) rather
+            // than folding in its finding/rescan results.
+            const decodedByteLength = new TextEncoder().encode(decoded).length;
+            if (decodedTotalBytes + decodedByteLength > MAX_DECODED_TOTAL_BYTES) {
+                aggregateBudgetExhausted = true;
+                continue;
+            }
+            decodedTotalBytes += decodedByteLength;
+            const ctx = contexts[index];
+            const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, start);
+            const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+            findings.push({
+                type: 'encoded_payload',
+                // Advisory-tier only (weights.ts: 1.2 / 0.04, the sensitive_path/
+                // typosquat tier) — see module header for why this is deliberately
+                // NOT the 2.0/0.40 tier the other three Wave 2 detectors use.
+                severity: inDocContext ? 'low' : 'medium',
+                message: `Base64-encoded payload decoded and rescanned (${candidate.length} chars)`,
+                location: line.trim().slice(0, 100),
+                lineNumber,
+                category: 'encoded_payload',
+                inDocumentationContext: inDocContext,
+                confidence: inDocContext ? 'low' : 'high',
+            });
+            // Fold in the decoded content's OWN findings, each tagged with
+            // decodedFrom so it stays traceable back to the outer blob that
+            // produced it (see module header — the filePath-provenance analogue).
+            for (const inner of rescan(decoded)) {
+                findings.push({ ...inner, decodedFrom: lineNumber });
+            }
+        }
+    });
+    return findings;
+}
+//# sourceMappingURL=SecurityScanner.encoding.js.map

package/dist/src/security/scanner/SecurityScanner.encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.encoding.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.encoding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAIH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,2BAA2B,GAAG,OAAO,CAAA;AAE3C;;;;;;;;;;GAUG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAElC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAA;AAE/B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,uBAAuB,GAAG,OAAO,CAAA;AAEvC,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AAErD;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAC5B,MAAM,eAAe,GAAG,8BAA8B,CAAA;AAEtD,wFAAwF;AACxF,oHAAoH;AACpH,MAAM,YAAY,GAAG,kCAAkC,CAAA;AAEvD,oGAAoG;AACpG,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAE/B;;;;;;GAMG;AACH,SAAS,8BAA8B,CAAC,SAAiB;IACvD,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACH,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,uEAAuE;IACvE,mEAAmE;IACnE,yEAAyE;IACzE,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAEvE,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA,CAAC,qDAAqD;IACnE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,YAAY,EAAE,CAAA;IAC3C,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,MAAM,CAAA;IACjE,IAAI,cAAc,GAAG,mBAAmB;QAAE,OAAO,IAAI,CAAA;IAErD,OAAO,IAAI,CAAA;AACb,CAAC;AASD,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAAuC,EACvC,MAA+B;IAE/B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,4DAA4D;IAC5D,sEAAsE;IACtE,gDAAgD;IAChD,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAC3B,IAAI,iBAAiB,GAAG,CAAC,CAAA;IACzB,IAAI,wBAAwB,GAAG,KAAK,CAAA;IACpC,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAE3B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAA;QAE5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;YAE9B,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAA;YACxE,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAQ;YAE1C,uEAAuE;YACvE,6DAA6D;YAC7D,iEAAiE;YACjE,qEAAqE;YACrE,IAAI,SAAS,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;gBACnD,IAAI,mBAAmB,IAAI,wBAAwB;oBAAE,SAAQ;gBAC7D,mBAAmB,EAAE,CAAA;gBACrB,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;gBACnC,MAAM,oBAAoB,GAAG,WAAW,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACzF,MAAM,oBAAoB,GAAG,WAAW;oBACtC,CAAC,CAAC,sBAAsB,CAAC,WAAW,CAAC,IAAI,oBAAoB;oBAC7D,CAAC,CAAC,KAAK,CAAA;gBACT,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,sCAAsC,2BAA2B,yEAAyE,SAAS,CAAC,MAAM,SAAS;oBAC5K,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU;oBACV,QAAQ,EAAE,iBAAiB;oBAC3B,sBAAsB,EAAE,oBAAoB;oBAC5C,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YAED,gEAAgE;YAChE,mEAAmE;YACnE,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,mBAAmB,IAAI,qBAAqB,IAAI,wBAAwB;gBAAE,SAAQ;YACtF,mBAAmB,EAAE,CAAA;YAErB,MAAM,OAAO,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAA;YACzD,IAAI,OAAO,KAAK,IAAI;gBAAE,SAAQ,CAAC,wDAAwD;YAEvF,+DAA+D;YAC/D,oEAAoE;YACpE,uEAAuE;YACvE,8CAA8C;YAC9C,MAAM,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;YAClE,IAAI,iBAAiB,GAAG,iBAAiB,GAAG,uBAAuB,EAAE,CAAC;gBACpE,wBAAwB,GAAG,IAAI,CAAA;gBAC/B,SAAQ;YACV,CAAC;YACD,iBAAiB,IAAI,iBAAiB,CAAA;YAEtC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC3B,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACzE,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;YAE9E,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,kEAAkE;gBAClE,mEAAmE;gBACnE,8DAA8D;gBAC9D,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBACzC,OAAO,EAAE,iDAAiD,SAAS,CAAC,MAAM,SAAS;gBACnF,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACnC,UAAU;gBACV,QAAQ,EAAE,iBAAiB;gBAC3B,sBAAsB,EAAE,YAAY;gBACpC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;aAC1C,CAAC,CAAA;YAEF,+DAA+D;YAC/D,gEAAgE;YAChE,sEAAsE;YACtE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAA;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC"}