@skillsmith/core 0.5.5 → 0.5.6

package/dist/security/scanner/patterns.js

@@ -0,0 +1,295 @@
+/**
+ * Security Scanner Patterns - SMI-587, SMI-685, SMI-1189
+ *
+ * Pattern definitions for security scanning.
+ */
+// Default allowed domains
+export const DEFAULT_ALLOWED_DOMAINS = [
+    'github.com',
+    'githubusercontent.com',
+    'raw.githubusercontent.com',
+    'npmjs.com',
+    'npmjs.org',
+    'docs.anthropic.com',
+    'anthropic.com',
+    'claude.ai',
+    'docs.github.com',
+    'developer.mozilla.org',
+    'nodejs.org',
+    'typescriptlang.org',
+];
+// Sensitive file path patterns
+// SMI-4396 Wave 2: bare-keyword variants (credentials, secrets?, password) tightened
+// to require assignment/path/file-extension context. Without this tuning,
+// documentation keywords in SKILL.md frontmatter and prose (1Password integration
+// guides, security-research skill domain vocabulary) tripped HIGH severity.
+export const SENSITIVE_PATH_PATTERNS = [
+    /\.env/i,
+    // Contextual credentials: filename or assignment, not bare prose
+    /credentials\.(?:json|ya?ml|env|toml|txt)/i,
+    /credentials\s*[:=]/i,
+    // Contextual secrets: assignment or path, not bare word
+    /\bsecrets?\s*[:=]/i,
+    /\bsecrets?\/[a-z0-9_.-]+/i,
+    /\.pem$/i,
+    /\.key$/i,
+    /\.crt$/i,
+    // Contextual password: assignment or URL (postgres://user:pass@host) only
+    /password\s*[:=]/i,
+    /api[_-]?key/i,
+    /auth[_-]?token/i,
+    /~\/\.ssh/i,
+    /~\/\.aws/i,
+    /~\/\.config/i,
+    // SMI-4396 Wave 2: explicit system-file paths. Added so that tightening
+    // bare /credentials/i and /password/i into assignment-context variants
+    // doesn't drop coverage of obvious sensitive references like /etc/passwd.
+    /\/etc\/(?:passwd|shadow|sudoers|hosts)\b/i,
+];
+// Jailbreak attempt patterns
+export const JAILBREAK_PATTERNS = [
+    /ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|prompts?|rules?)/i,
+    /disregard\s+(all\s+)?(previous|prior|your)\s+(instructions?|programming)/i,
+    /developer\s+mode/i,
+    /\bDAN\b/,
+    /do\s+anything\s+now/i,
+    /jailbreak/i,
+    /bypass\s+(all\s+)?(restrictions?|filters?|safety)/i,
+    /pretend\s+(you\s+)?(are|have)\s+no\s+(restrictions?|limits?)/i,
+    /act\s+as\s+(if\s+)?you\s+(have\s+)?no\s+ethics/i,
+    /you\s+are\s+now\s+(free|unrestricted|unfiltered)/i,
+    /ignore\s+your\s+(safety|ethical)\s+(guidelines?|rules?)/i,
+    /hypothetical\s+scenario\s+where\s+you\s+can/i,
+    // Multi-line split-word obfuscation patterns (tested against full content)
+    /ig\s*\n\s*nore\s+(?:all\s+)?(?:previous|prior|above)\s+(?:instructions?|prompts?|rules?)/i,
+    /dis\s*\n\s*regard\s+(?:all\s+)?(?:previous|prior|your)\s+(?:instructions?|programming)/i,
+    /by\s*\n\s*pass\s+(?:all\s+)?(?:restrictions?|filters?|safety)/i,
+];
+// Suspicious patterns that might indicate malicious intent
+export const SUSPICIOUS_PATTERNS = [
+    /eval\s*\(/i,
+    /exec\s*\(/i,
+    /child_process/i,
+    /\$\(\s*[`'"]/i, // Command substitution
+    /base64\s*\.\s*decode/i,
+    /from\s+base64\s+import/i,
+    /subprocess\s*\.\s*(run|call|Popen)/i,
+    /os\s*\.\s*(system|popen|exec)/i,
+    /\brm\s+-rf\b/i,
+    /curl\s+.*\|\s*(bash|sh)/i, // Curl pipe to shell
+    /wget\s+.*\|\s*(bash|sh)/i,
+];
+// SMI-685: Social engineering attempt patterns
+export const SOCIAL_ENGINEERING_PATTERNS = [
+    /pretend\s+(to\s+be|you\s+are|that\s+you)/i,
+    /roleplay\s+as/i,
+    /you\s+are\s+now\s+(?!free|unrestricted)/i, // Exclude jailbreak patterns
+    /act\s+as\s+(if\s+you\s+were|though\s+you\s+are)/i,
+    /imagine\s+you\s+are/i,
+    /for\s+the\s+purposes?\s+of\s+this/i,
+    /let'?s?\s+say\s+you\s+are/i,
+    /assume\s+the\s+role\s+of/i,
+    /from\s+now\s+on\s+you\s+are/i,
+    /i\s+want\s+you\s+to\s+act\s+as/i,
+    /please\s+behave\s+as\s+if/i,
+    /can\s+you\s+pretend/i,
+];
+// SMI-685: Prompt leaking attempt patterns
+export const PROMPT_LEAKING_PATTERNS = [
+    /show\s+(me\s+)?your\s+(system\s+)?(instructions?|prompt)/i,
+    /what\s+are\s+your\s+(\w+\s+)?rules/i,
+    /reveal\s+your\s+(system\s+)?prompt/i,
+    /display\s+your\s+(initial\s+)?instructions?/i,
+    /output\s+your\s+(system\s+)?prompt/i,
+    /print\s+your\s+(hidden\s+)?instructions?/i,
+    /tell\s+me\s+your\s+(secret\s+)?instructions?/i,
+    /what\s+(were|are)\s+you\s+(told|instructed)\s+to\s+do/i,
+    /repeat\s+(back\s+)?your\s+(\w+\s+)?prompt/i,
+    /what\s+is\s+your\s+(original\s+)?programming/i,
+    /dump\s+(your\s+)?system\s+(prompt|instructions?)/i,
+    /list\s+your\s+(hidden\s+)?directives?/i,
+    /what\s+(constraints?|limitations?)\s+do\s+you\s+have/i,
+    /echo\s+(back\s+)?your\s+(initial\s+)?prompt/i,
+];
+// SMI-685: Data exfiltration patterns
+export const DATA_EXFILTRATION_PATTERNS = [
+    /btoa\s*\(/i, // Base64 encode in JS
+    /atob\s*\(/i, // Base64 decode in JS
+    /Buffer\.from\s*\([^)]*,\s*['"]base64['"]/i,
+    /\.toString\s*\(\s*['"]base64['"]\s*\)/i,
+    /encodeURIComponent\s*\(/i,
+    /fetch\s*\(\s*['"`][^'"`]*\?.*=/i, // Fetch with query params
+    /XMLHttpRequest/i,
+    /navigator\.sendBeacon/i,
+    /\.upload\s*\(/i,
+    /formData\.append/i,
+    /new\s+FormData/i,
+    /multipart\/form-data/i,
+    /webhook\s*[=:]/i,
+    /exfil/i,
+    /data\s*:\s*['"]/i, // Data URLs
+    /\.writeFile.*https?:\/\//i,
+    /send\s+.*(to|the)\s+(external|remote)/i,
+    // SMI-4396 Wave 2: word-boundary \bcloud\b + bounded wildcard.
+    // Previous /upload\s+.*(to|the)\s+(server|cloud|remote)/i matched
+    // "upload to Cloudinary" (the Cloud prefix substring-matches) —
+    // triggered skill-image-pipeline as data_exfiltration FP. The
+    // bounded [\w\s]{0,30}? prevents ReDoS; \bcloud\b excludes
+    // Cloudinary/cloudfront/cloudflare/iCloud/cloudstorage.
+    /upload\s+[\w\s]{0,30}?\s*(?:to|the)\s+(?:server|\bcloud\b|remote)/i,
+    // SMI-4396 Wave 2: explicit key/secret/credential/token upload detector.
+    // Ensures "upload private keys to our cdn bucket" still triggers even
+    // though \bcloud\b word-boundary now excludes "cdn bucket" prose.
+    /upload\s+[\w\s]{0,50}?\s*(?:private\s+)?(?:key|secret|credential|token)s?\b/i,
+    /post\s+data\s+to/i,
+    /to\s+external\s+(api|server|endpoint)/i,
+    // SMI-4396 Wave 2: restore prose coverage dropped by tightening bare /password/i
+    // and /credentials/i to assignment-context only. These unambiguous exfiltration
+    // verbs (send/transmit/leak/dump/steal/extract) + credential noun preserve detection
+    // of "send the user's passwords to attacker.com" and similar imperative instructions
+    // without re-introducing FPs on "This skill handles passwords" or
+    // "Never expose the password to Claude Code" (expose excluded: weak intent signal
+    // + negation-context FP in 1Password-style SKILL.md fixtures).
+    /(?:send|transmit|leak|dump|steal|extract)\s+[\w\s']{0,40}(?:passwords?|credentials?|secrets?)\b/i,
+];
+// SMI-685: Privilege escalation patterns
+export const PRIVILEGE_ESCALATION_PATTERNS = [
+    /sudo\s+.*(-S|--stdin)/i, // sudo with password from stdin
+    /echo\s+.*\|\s*sudo/i, // Echo password to sudo
+    /sudo\s+-S/i,
+    /\bchmod\s+[0-7]*[4-7][0-7][0-7]\b/i, // chmod with setuid/setgid
+    /\bchmod\s+\+s\b/i, // chmod setuid
+    /\bchmod\s+777\b/i, // World writable
+    /\bchmod\s+666\b/i, // World readable/writable
+    /\bchown\s+root/i,
+    /\bchgrp\s+root/i,
+    /visudo/i,
+    /\/etc\/sudoers/i,
+    /NOPASSWD/i,
+    /setuid/i,
+    /setgid/i,
+    /capability\s+cap_/i,
+    // SMI-4396 Wave 2: contextual privilege_escalation patterns.
+    // Previous bare /escalat(e|ion)/i matched documentation prose in
+    // security-research and prompt-injection-scanner skills that legitimately
+    // enumerate "privilege escalation" as an adversarial technique they
+    // detect — triggered 3/5 CRITICAL FPs. Bare pattern removed; these three
+    // contextual variants preserve real coverage (exploit-escalate calls,
+    // attack/vector noun phrases, to-root/to-admin targets).
+    /privilege[_\s-]+escalat(?:e|ion)/i,
+    /escalat(?:e|ion)\s+(?:attack|vector|(?:to|as)\s+(?:root|admin|superuser))/i,
+    /exploit\s+[\w\s]{0,30}?\s*escalat(?:e|ion)/i,
+    /privilege[ds]?\s+(elevat|escal)/i,
+    /run\s+.*as\s+root/i,
+    /(run|execute)\s+as\s+(root|admin)/i,
+    /admin(istrator)?\s+access/i,
+    /root\s+(access|user)/i,
+    /as\s+root\s+user/i,
+    /su\s+-\s+root/i,
+    /become\s+root/i,
+];
+/**
+ * SMI-3509: SSRF instruction patterns
+ * Detects content instructing fetches to internal/dangerous endpoints.
+ * These are text-oriented patterns for skill content scanning (not URL validators).
+ */
+export const SSRF_INSTRUCTION_PATTERNS = [
+    // Dangerous protocol schemes in skill instructions
+    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?file:\/\//i,
+    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?gopher:\/\//i,
+    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?dict:\/\//i,
+    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?ldap:\/\//i,
+    // Instructions targeting localhost/internal IPs
+    /(?:fetch|request|curl|wget|get|connect|send)\s+(?:to\s+)?(?:https?:\/\/)?localhost/i,
+    /(?:fetch|request|curl|wget|get|connect|send)\s+(?:to\s+)?(?:https?:\/\/)?127\.0\.0\.\d+/i,
+    /(?:fetch|request|curl|wget|get|connect|send)\s+(?:to\s+)?(?:https?:\/\/)?0\.0\.0\.0/i,
+    // Cloud metadata service endpoints
+    /169\.254\.169\.254/,
+    // Bare dangerous protocol references in content (without action verb)
+    /file:\/\/\/etc\/(?:passwd|shadow|hosts)/i,
+    /gopher:\/\/localhost/i,
+    // SMI-3522: Multi-line SSRF patterns (split across lines)
+    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?(?:the\s+)?(?:url\s+)?\n\s*file:\/\//i,
+    /(?:fetch|request|curl|wget|get|connect|send)\s+(?:to\s+)?(?:the\s*)?\n\s*(?:https?:\/\/)?(?:localhost|127\.0\.0\.\d+|0\.0\.0\.0)/i,
+    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?(?:the\s+)?(?:url\s+)?\n\s*gopher:\/\//i,
+];
+/**
+ * SMI-1532: AIDefence CVE-hardened injection patterns
+ * Optimized for sub-10ms scan time with compiled regex and no backtracking
+ *
+ * These patterns detect sophisticated prompt injection attacks based on
+ * known CVEs and security research findings.
+ *
+ * References:
+ * - OWASP LLM Top 10: LLM01 Prompt Injection
+ * - Anthropic Responsible Disclosure Program findings
+ * - Academic research on prompt injection attacks
+ */
+/**
+ * SMI-3864: PII detection patterns
+ * Detects personally identifiable information and credentials in skill content.
+ * Complements AIDefence's aidefence_has_pii() for offline/local scanning.
+ */
+export const PII_PATTERNS = [
+    // API keys and tokens (generic patterns)
+    /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[A-Za-z0-9_-]{20,}['"]?/i,
+    /(?:secret[_-]?key|secretkey)\s*[:=]\s*['"]?[A-Za-z0-9_-]{20,}['"]?/i,
+    /(?:access[_-]?token|accesstoken)\s*[:=]\s*['"]?[A-Za-z0-9_-]{20,}['"]?/i,
+    // Provider-specific key formats
+    /sk[_-](?:live|test)[_-][A-Za-z0-9]{20,}/, // Stripe
+    /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}/, // GitHub PAT
+    /xoxb-[0-9]+-[0-9]+-[A-Za-z0-9]+/, // Slack bot token
+    /AKIA[0-9A-Z]{16}/, // AWS Access Key
+    // Email addresses — severity `info` in YAML frontmatter context (Review #8)
+    // Downgraded because SKILL.md files legitimately contain author contact emails
+    /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/,
+    // US Social Security Numbers
+    /\b\d{3}-\d{2}-\d{4}\b/,
+    // Private keys
+    /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/,
+    // Generic password assignments
+    /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/i,
+];
+export const AI_DEFENCE_PATTERNS = [
+    // Role injection patterns - attempts to inject system/assistant/user roles
+    // Pattern detects role markers that could manipulate conversation boundaries
+    // Covers: start of line, after whitespace, with various delimiters
+    /(?:^|\s)(?:system|assistant|user)\s*:\s*(?:\n|$)/i,
+    // Hidden instruction brackets - obfuscated commands
+    /\[\[\s*[^\]]{1,200}\s*\]\]/,
+    // HTML/XML comment injection - hiding malicious instructions
+    /<!--[\s\S]{0,100}?(?:ignore|override|bypass|system|instruction)[\s\S]{0,100}?-->/i,
+    // Unicode homograph attacks - visually similar characters
+    // Detects Cyrillic, Greek, or other homoglyphs mixed with Latin
+    /[\u0400-\u04FF\u0370-\u03FF]{2,}[\w\s]+(?:ignore|bypass|instruction)/i,
+    // Mixed-script detection: Latin + Cyrillic/Greek in same word (homoglyph attack)
+    // Note: \b word boundaries don't work with Unicode; use space/start/end anchors
+    /(?:^|[\s,."'(])(?:[a-zA-Z]+[\u0400-\u04FF\u0370-\u03FF]|[\u0400-\u04FF\u0370-\u03FF]+[a-zA-Z])[a-zA-Z\u0400-\u04FF\u0370-\u03FF]*/,
+    // Prompt structure manipulation - XML/markdown injection
+    /<\/?(?:system|prompt|instruction|context|message)(?:\s[^>]*)?>/i,
+    // Base64 encoded instructions (common evasion technique)
+    /(?:base64|b64)\s*[:=]\s*["']?[A-Za-z0-9+/]{20,}={0,2}["']?/i,
+    // Delimiter injection - breaking out of prompt boundaries
+    /(?:^|\n)(?:---|\*{3}|#{3,})\s*(?:system|prompt|instruction|override)/i,
+    // JSON structure injection in prompts
+    // SMI-1532: Refined to require suspicious values, not just field names
+    // Matches: "role": "system" or "instruction": "ignore" but not "content": "Hello"
+    /["']\s*(?:role|system|instruction)\s*["']\s*:\s*["'](?:system|assistant|user|ignore|override|bypass)/i,
+    // Nested instruction blocks
+    /<instruction[^>]*>[\s\S]{0,500}?<\/instruction>/i,
+    // CRLF injection for prompt manipulation
+    /(?:\r\n|\r|\n){2,}\s*(?:ignore|forget|override|bypass)\s+(?:all|previous|above)/i,
+    // Template literal injection
+    /\$\{\s*(?:system|prompt|instruction|config)/i,
+    // Zero-width character obfuscation detection
+    // SMI-1532: Enhanced to detect single zero-width chars near sensitive keywords
+    /[\u200B-\u200F\u2028-\u202F\uFEFF](?:[\s\S]{0,20}(?:ignore|bypass|system|instruction)|[\u200B-\u200F\u2028-\u202F\uFEFF])/i,
+    // Markdown link injection with suspicious targets
+    /\[(?:click|here|link|url)[^\]]*\]\([^)]*(?:javascript|data|vbscript):/i,
+    // Escape sequence abuse
+    /\\x[0-9a-fA-F]{2}(?:\\x[0-9a-fA-F]{2}){3,}/,
+    // Unicode normalization attacks - combining characters that render differently
+    // Detects combining diacritical marks used to obfuscate text
+    /[\u0300-\u036F]{2,}/,
+];
+//# sourceMappingURL=patterns.js.map

package/dist/security/scanner/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/security/scanner/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0BAA0B;AAC1B,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,YAAY;IACZ,uBAAuB;IACvB,2BAA2B;IAC3B,WAAW;IACX,WAAW;IACX,oBAAoB;IACpB,eAAe;IACf,WAAW;IACX,iBAAiB;IACjB,uBAAuB;IACvB,YAAY;IACZ,oBAAoB;CACrB,CAAA;AAED,+BAA+B;AAC/B,qFAAqF;AACrF,0EAA0E;AAC1E,kFAAkF;AAClF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ;IACR,iEAAiE;IACjE,2CAA2C;IAC3C,qBAAqB;IACrB,wDAAwD;IACxD,oBAAoB;IACpB,2BAA2B;IAC3B,SAAS;IACT,SAAS;IACT,SAAS;IACT,0EAA0E;IAC1E,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,WAAW;IACX,WAAW;IACX,cAAc;IACd,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,2CAA2C;CAC5C,CAAA;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,6EAA6E;IAC7E,2EAA2E;IAC3E,mBAAmB;IACnB,SAAS;IACT,sBAAsB;IACtB,YAAY;IACZ,oDAAoD;IACpD,+DAA+D;IAC/D,iDAAiD;IACjD,mDAAmD;IACnD,0DAA0D;IAC1D,8CAA8C;IAE9C,2EAA2E;IAC3E,2FAA2F;IAC3F,yFAAyF;IACzF,gEAAgE;CACjE,CAAA;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,YAAY;IACZ,YAAY;IACZ,gBAAgB;IAChB,eAAe,EAAE,uBAAuB;IACxC,uBAAuB;IACvB,yBAAyB;IACzB,qCAAqC;IACrC,gCAAgC;IAChC,eAAe;IACf,0BAA0B,EAAE,qBAAqB;IACjD,0BAA0B;CAC3B,CAAA;AAED,+CAA+C;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,2CAA2C;IAC3C,gBAAgB;IAChB,0CAA0C,EAAE,6BAA6B;IACzE,kDAAkD;IAClD,sBAAsB;IACtB,oCAAoC;IACpC,4BAA4B;IAC5B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,4BAA4B;IAC5B,sBAAsB;CACvB,CAAA;AAED,2CAA2C;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,2DAA2D;IAC3D,qCAAqC;IACrC,qCAAqC;IACrC,8CAA8C;IAC9C,qCAAqC;IACrC,2CAA2C;IAC3C,+CAA+C;IAC/C,wDAAwD;IACxD,4CAA4C;IAC5C,+CAA+C;IAC/C,mDAAmD;IACnD,wCAAwC;IACxC,uDAAuD;IACvD,8CAA8C;CAC/C,CAAA;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,YAAY,EAAE,sBAAsB;IACpC,YAAY,EAAE,sBAAsB;IACpC,2CAA2C;IAC3C,wCAAwC;IACxC,0BAA0B;IAC1B,iCAAiC,EAAE,0BAA0B;IAC7D,iBAAiB;IACjB,wBAAwB;IACxB,gBAAgB;IAChB,mBAAmB;IACnB,iBAAiB;IACjB,uBAAuB;IACvB,iBAAiB;IACjB,QAAQ;IACR,kBAAkB,EAAE,YAAY;IAChC,2BAA2B;IAC3B,wCAAwC;IACxC,+DAA+D;IAC/D,kEAAkE;IAClE,gEAAgE;IAChE,8DAA8D;IAC9D,2DAA2D;IAC3D,wDAAwD;IACxD,oEAAoE;IACpE,yEAAyE;IACzE,sEAAsE;IACtE,kEAAkE;IAClE,8EAA8E;IAC9E,mBAAmB;IACnB,wCAAwC;IACxC,iFAAiF;IACjF,gFAAgF;IAChF,qFAAqF;IACrF,qFAAqF;IACrF,kEAAkE;IAClE,kFAAkF;IAClF,+DAA+D;IAC/D,kGAAkG;CACnG,CAAA;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,wBAAwB,EAAE,gCAAgC;IAC1D,qBAAqB,EAAE,wBAAwB;IAC/C,YAAY;IACZ,oCAAoC,EAAE,2BAA2B;IACjE,kBAAkB,EAAE,eAAe;IACnC,kBAAkB,EAAE,iBAAiB;IACrC,kBAAkB,EAAE,0BAA0B;IAC9C,iBAAiB;IACjB,iBAAiB;IACjB,SAAS;IACT,iBAAiB;IACjB,WAAW;IACX,SAAS;IACT,SAAS;IACT,oBAAoB;IACpB,6DAA6D;IAC7D,iEAAiE;IACjE,0EAA0E;IAC1E,oEAAoE;IACpE,yEAAyE;IACzE,sEAAsE;IACtE,yDAAyD;IACzD,mCAAmC;IACnC,4EAA4E;IAC5E,6CAA6C;IAC7C,kCAAkC;IAClC,oBAAoB;IACpB,oCAAoC;IACpC,4BAA4B;IAC5B,uBAAuB;IACvB,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;CACjB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,mDAAmD;IACnD,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IAEzE,gDAAgD;IAChD,qFAAqF;IACrF,0FAA0F;IAC1F,sFAAsF;IAEtF,mCAAmC;IACnC,oBAAoB;IAEpB,sEAAsE;IACtE,0CAA0C;IAC1C,uBAAuB;IAEvB,0DAA0D;IAC1D,oGAAoG;IACpG,mIAAmI;IACnI,sGAAsG;CACvG,CAAA;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,yCAAyC;IACzC,+DAA+D;IAC/D,qEAAqE;IACrE,yEAAyE;IAEzE,gCAAgC;IAChC,yCAAyC,EAAE,SAAS;IACpD,0CAA0C,EAAE,aAAa;IACzD,iCAAiC,EAAE,kBAAkB;IACrD,kBAAkB,EAAE,iBAAiB;IAErC,4EAA4E;IAC5E,+EAA+E;IAC/E,gDAAgD;IAEhD,6BAA6B;IAC7B,uBAAuB;IAEvB,eAAe;IACf,4CAA4C;IAE5C,+BAA+B;IAC/B,qDAAqD;CACtD,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,2EAA2E;IAC3E,6EAA6E;IAC7E,mEAAmE;IACnE,mDAAmD;IAEnD,oDAAoD;IACpD,4BAA4B;IAE5B,6DAA6D;IAC7D,mFAAmF;IAEnF,0DAA0D;IAC1D,gEAAgE;IAChE,uEAAuE;IAEvE,iFAAiF;IACjF,gFAAgF;IAChF,mIAAmI;IAEnI,yDAAyD;IACzD,iEAAiE;IAEjE,yDAAyD;IACzD,6DAA6D;IAE7D,0DAA0D;IAC1D,uEAAuE;IAEvE,sCAAsC;IACtC,uEAAuE;IACvE,kFAAkF;IAClF,uGAAuG;IAEvG,4BAA4B;IAC5B,kDAAkD;IAElD,yCAAyC;IACzC,kFAAkF;IAElF,6BAA6B;IAC7B,8CAA8C;IAE9C,6CAA6C;IAC7C,+EAA+E;IAC/E,4HAA4H;IAE5H,kDAAkD;IAClD,wEAAwE;IAExE,wBAAwB;IACxB,4CAA4C;IAE5C,+EAA+E;IAC/E,6DAA6D;IAC7D,qBAAqB;CACtB,CAAA"}

package/dist/security/scanner/regex-utils.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Security Scanner Regex Utilities - SMI-882, SMI-1189
+ *
+ * ReDoS protection utilities for safe regex matching.
+ */
+/**
+ * SMI-882: ReDoS Protection Constants
+ * Maximum line length to process with regex patterns.
+ * Lines exceeding this limit are truncated before regex matching
+ * to prevent catastrophic backtracking attacks.
+ */
+export declare const MAX_LINE_LENGTH_FOR_REGEX = 10000;
+/**
+ * SMI-882: Safe regex test with length limit
+ * Applies input length limit before regex matching to prevent ReDoS attacks.
+ *
+ * @param pattern - Regex pattern to test
+ * @param input - Input string to test against
+ * @param maxLength - Maximum input length (default: MAX_LINE_LENGTH_FOR_REGEX)
+ * @returns Match result or null if input is too long/no match
+ */
+export declare function safeRegexTest(pattern: RegExp, input: string, maxLength?: number): RegExpMatchArray | null;
+/**
+ * SMI-882: Check if pattern matches safely
+ * Returns boolean instead of match array for simple tests.
+ *
+ * @param pattern - Regex pattern to test
+ * @param input - Input string to test against
+ * @param maxLength - Maximum input length (default: MAX_LINE_LENGTH_FOR_REGEX)
+ * @returns True if pattern matches (within safe input limits)
+ */
+export declare function safeRegexCheck(pattern: RegExp, input: string, maxLength?: number): boolean;
+//# sourceMappingURL=regex-utils.d.ts.map

package/dist/security/scanner/regex-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex-utils.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAQ,CAAA;AAE9C;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,gBAAgB,GAAG,IAAI,CAIzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,OAAO,CAIT"}

package/dist/security/scanner/regex-utils.js

@@ -0,0 +1,41 @@
+/**
+ * Security Scanner Regex Utilities - SMI-882, SMI-1189
+ *
+ * ReDoS protection utilities for safe regex matching.
+ */
+/**
+ * SMI-882: ReDoS Protection Constants
+ * Maximum line length to process with regex patterns.
+ * Lines exceeding this limit are truncated before regex matching
+ * to prevent catastrophic backtracking attacks.
+ */
+export const MAX_LINE_LENGTH_FOR_REGEX = 10000;
+/**
+ * SMI-882: Safe regex test with length limit
+ * Applies input length limit before regex matching to prevent ReDoS attacks.
+ *
+ * @param pattern - Regex pattern to test
+ * @param input - Input string to test against
+ * @param maxLength - Maximum input length (default: MAX_LINE_LENGTH_FOR_REGEX)
+ * @returns Match result or null if input is too long/no match
+ */
+export function safeRegexTest(pattern, input, maxLength = MAX_LINE_LENGTH_FOR_REGEX) {
+    // Truncate input if it exceeds max length to prevent ReDoS
+    const safeInput = input.length > maxLength ? input.slice(0, maxLength) : input;
+    return safeInput.match(pattern);
+}
+/**
+ * SMI-882: Check if pattern matches safely
+ * Returns boolean instead of match array for simple tests.
+ *
+ * @param pattern - Regex pattern to test
+ * @param input - Input string to test against
+ * @param maxLength - Maximum input length (default: MAX_LINE_LENGTH_FOR_REGEX)
+ * @returns True if pattern matches (within safe input limits)
+ */
+export function safeRegexCheck(pattern, input, maxLength = MAX_LINE_LENGTH_FOR_REGEX) {
+    // Truncate input if it exceeds max length to prevent ReDoS
+    const safeInput = input.length > maxLength ? input.slice(0, maxLength) : input;
+    return pattern.test(safeInput);
+}
+//# sourceMappingURL=regex-utils.js.map

package/dist/security/scanner/regex-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex-utils.js","sourceRoot":"","sources":["../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAE9C;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC"}

package/dist/security/scanner/types.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Security Scanner Types - SMI-587, SMI-685, SMI-1189
+ *
+ * Type definitions for security scanning functionality.
+ */
+/**
+ * Types of security findings that can be detected
+ */
+export type SecurityFindingType = 'url' | 'sensitive_path' | 'jailbreak' | 'suspicious_pattern' | 'social_engineering' | 'prompt_leaking' | 'data_exfiltration' | 'privilege_escalation' | 'ai_defence' | 'ssrf' | 'pii';
+/**
+ * Severity levels for security findings
+ */
+export type SecuritySeverity = 'low' | 'medium' | 'high' | 'critical';
+/**
+ * Confidence level for a finding
+ * - high: Strong indicator of malicious intent
+ * - medium: Possible issue, context suggests caution
+ * - low: Likely false positive (e.g., in documentation/examples)
+ */
+export type FindingConfidence = 'high' | 'medium' | 'low';
+/**
+ * Individual security finding from a scan
+ */
+export interface SecurityFinding {
+    type: SecurityFindingType;
+    severity: SecuritySeverity;
+    message: string;
+    location?: string;
+    lineNumber?: number;
+    /** Category for grouping related findings */
+    category?: string;
+    /** Whether finding is in a documentation context (code block, table, example) */
+    inDocumentationContext?: boolean;
+    /** Confidence level - lower for findings in documentation context */
+    confidence?: FindingConfidence;
+}
+/**
+ * Risk score breakdown by category
+ */
+export interface RiskScoreBreakdown {
+    jailbreak: number;
+    socialEngineering: number;
+    promptLeaking: number;
+    dataExfiltration: number;
+    privilegeEscalation: number;
+    suspiciousCode: number;
+    sensitivePaths: number;
+    externalUrls: number;
+    aiDefence: number;
+    ssrf: number;
+    pii: number;
+}
+/**
+ * Comprehensive scan report with risk scoring
+ */
+export interface ScanReport {
+    skillId: string;
+    passed: boolean;
+    findings: SecurityFinding[];
+    scannedAt: Date;
+    scanDurationMs: number;
+    /** Overall risk score from 0-100 (0 = safe, 100 = extremely dangerous) */
+    riskScore: number;
+    /** Breakdown of risk score by category */
+    riskBreakdown: RiskScoreBreakdown;
+}
+/**
+ * Configuration options for the security scanner
+ */
+export interface ScannerOptions {
+    allowedDomains?: string[];
+    blockedPatterns?: RegExp[];
+    maxContentLength?: number;
+    /** Risk score threshold for failing a scan (default: 40) */
+    riskThreshold?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/scanner/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL,gBAAgB,GAChB,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,MAAM,GACN,KAAK,CAAA;AAET;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAErE;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,qEAAqE;IACrE,UAAU,CAAC,EAAE,iBAAiB,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,SAAS,EAAE,IAAI,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,aAAa,EAAE,kBAAkB,CAAA;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB"}

package/dist/security/scanner/types.js

@@ -0,0 +1,7 @@
+/**
+ * Security Scanner Types - SMI-587, SMI-685, SMI-1189
+ *
+ * Type definitions for security scanning functionality.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/security/scanner/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/security/scanner/weights.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Security Scanner Weights - SMI-685, SMI-1189
+ *
+ * Weight constants for risk score calculation.
+ */
+import type { SecuritySeverity } from './types.js';
+/**
+ * Severity weights for risk score calculation
+ */
+export declare const SEVERITY_WEIGHTS: Record<SecuritySeverity, number>;
+/**
+ * Category weights for risk score calculation
+ */
+export declare const CATEGORY_WEIGHTS: Record<string, number>;
+//# sourceMappingURL=weights.d.ts.map

package/dist/security/scanner/weights.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"weights.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/weights.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAK7D,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAYnD,CAAA"}

package/dist/security/scanner/weights.js

@@ -0,0 +1,31 @@
+/**
+ * Security Scanner Weights - SMI-685, SMI-1189
+ *
+ * Weight constants for risk score calculation.
+ */
+/**
+ * Severity weights for risk score calculation
+ */
+export const SEVERITY_WEIGHTS = {
+    low: 5,
+    medium: 15,
+    high: 30,
+    critical: 50,
+};
+/**
+ * Category weights for risk score calculation
+ */
+export const CATEGORY_WEIGHTS = {
+    jailbreak: 2.0,
+    social_engineering: 1.5,
+    prompt_leaking: 1.8,
+    data_exfiltration: 1.7,
+    privilege_escalation: 1.9,
+    suspicious_pattern: 1.3,
+    sensitive_path: 1.2,
+    url: 0.8,
+    ai_defence: 1.9, // SMI-1532: High weight for AI injection attacks
+    ssrf: 1.6, // SMI-3509: SSRF instruction detection
+    pii: 1.8, // SMI-3864: PII in skill content is high-risk
+};
+//# sourceMappingURL=weights.js.map

package/dist/security/scanner/weights.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"weights.js","sourceRoot":"","sources":["../../../src/security/scanner/weights.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC;IAChE,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,EAAE;CACb,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,SAAS,EAAE,GAAG;IACd,kBAAkB,EAAE,GAAG;IACvB,cAAc,EAAE,GAAG;IACnB,iBAAiB,EAAE,GAAG;IACtB,oBAAoB,EAAE,GAAG;IACzB,kBAAkB,EAAE,GAAG;IACvB,cAAc,EAAE,GAAG;IACnB,GAAG,EAAE,GAAG;IACR,UAAU,EAAE,GAAG,EAAE,iDAAiD;IAClE,IAAI,EAAE,GAAG,EAAE,uCAAuC;IAClD,GAAG,EAAE,GAAG,EAAE,8CAA8C;CACzD,CAAA"}

package/dist/security/stripe-validators.d.ts

@@ -0,0 +1,92 @@
+/**
+ * SMI-1062: Stripe ID Validators
+ *
+ * Validation and sanitization functions for Stripe IDs.
+ * Extracted from sanitization.ts for file size compliance.
+ */
+/**
+ * Stripe ID prefixes for validation
+ */
+declare const STRIPE_ID_PREFIXES: {
+    readonly customer: "cus_";
+    readonly subscription: "sub_";
+    readonly price: "price_";
+    readonly invoice: "in_";
+    readonly paymentIntent: "pi_";
+    readonly paymentMethod: "pm_";
+    readonly product: "prod_";
+    readonly checkout: "cs_";
+    readonly event: "evt_";
+};
+type StripeIdType = keyof typeof STRIPE_ID_PREFIXES;
+/**
+ * Validate a Stripe ID format
+ *
+ * Stripe IDs follow the pattern: prefix_alphanumeric
+ * - Prefix identifies the object type (cus_, sub_, price_, etc.)
+ * - Suffix is alphanumeric, typically 14-24 characters
+ *
+ * @param id - The Stripe ID to validate
+ * @param type - The expected ID type (customer, subscription, price, etc.)
+ * @param maxLength - Maximum allowed input length (default: 100)
+ * @returns true if valid, false otherwise
+ *
+ * @example
+ * ```typescript
+ * isValidStripeId('cus_OtLqEJvHu1Mvxm', 'customer')  // true
+ * isValidStripeId('sub_1234567890abcd', 'subscription')  // true
+ * isValidStripeId('invalid_id', 'customer')  // false
+ * ```
+ */
+export declare function isValidStripeId(id: string, type: StripeIdType, maxLength?: number): boolean;
+/**
+ * Sanitize a Stripe customer ID
+ *
+ * @param customerId - Raw customer ID
+ * @param maxLength - Maximum allowed input length (default: 100)
+ * @returns Sanitized customer ID or empty string if invalid
+ *
+ * @example
+ * ```typescript
+ * sanitizeStripeCustomerId('cus_OtLqEJvHu1Mvxm')
+ * // Returns: 'cus_OtLqEJvHu1Mvxm'
+ *
+ * sanitizeStripeCustomerId('cus_<script>')
+ * // Returns: ''
+ * ```
+ */
+export declare function sanitizeStripeCustomerId(customerId: string, maxLength?: number): string;
+/**
+ * Sanitize a Stripe subscription ID
+ *
+ * @param subscriptionId - Raw subscription ID
+ * @param maxLength - Maximum allowed input length (default: 100)
+ * @returns Sanitized subscription ID or empty string if invalid
+ */
+export declare function sanitizeStripeSubscriptionId(subscriptionId: string, maxLength?: number): string;
+/**
+ * Sanitize a Stripe price ID
+ *
+ * @param priceId - Raw price ID
+ * @param maxLength - Maximum allowed input length (default: 100)
+ * @returns Sanitized price ID or empty string if invalid
+ */
+export declare function sanitizeStripePriceId(priceId: string, maxLength?: number): string;
+/**
+ * Sanitize a Stripe invoice ID
+ *
+ * @param invoiceId - Raw invoice ID
+ * @param maxLength - Maximum allowed input length (default: 100)
+ * @returns Sanitized invoice ID or empty string if invalid
+ */
+export declare function sanitizeStripeInvoiceId(invoiceId: string, maxLength?: number): string;
+/**
+ * Sanitize a Stripe event ID (for webhooks)
+ *
+ * @param eventId - Raw event ID
+ * @param maxLength - Maximum allowed input length (default: 100)
+ * @returns Sanitized event ID or empty string if invalid
+ */
+export declare function sanitizeStripeEventId(eventId: string, maxLength?: number): string;
+export {};
+//# sourceMappingURL=stripe-validators.d.ts.map

package/dist/security/stripe-validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe-validators.d.ts","sourceRoot":"","sources":["../../src/security/stripe-validators.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;GAEG;AACH,QAAA,MAAM,kBAAkB;;;;;;;;;;CAUd,CAAA;AAEV,KAAK,YAAY,GAAG,MAAM,OAAO,kBAAkB,CAAA;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,SAAM,GAAG,OAAO,CAqBxF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,MAAM,CAMpF;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,MAAM,CAM5F;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,MAAM,CAM9E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,MAAM,CAMlF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,MAAM,CAM9E"}