@skillsmith/core 0.5.6 → 0.5.8

package/dist/security/scanner/patterns.js

@@ -1,295 +0,0 @@
-/**
- * Security Scanner Patterns - SMI-587, SMI-685, SMI-1189
- *
- * Pattern definitions for security scanning.
- */
-// Default allowed domains
-export const DEFAULT_ALLOWED_DOMAINS = [
-    'github.com',
-    'githubusercontent.com',
-    'raw.githubusercontent.com',
-    'npmjs.com',
-    'npmjs.org',
-    'docs.anthropic.com',
-    'anthropic.com',
-    'claude.ai',
-    'docs.github.com',
-    'developer.mozilla.org',
-    'nodejs.org',
-    'typescriptlang.org',
-];
-// Sensitive file path patterns
-// SMI-4396 Wave 2: bare-keyword variants (credentials, secrets?, password) tightened
-// to require assignment/path/file-extension context. Without this tuning,
-// documentation keywords in SKILL.md frontmatter and prose (1Password integration
-// guides, security-research skill domain vocabulary) tripped HIGH severity.
-export const SENSITIVE_PATH_PATTERNS = [
-    /\.env/i,
-    // Contextual credentials: filename or assignment, not bare prose
-    /credentials\.(?:json|ya?ml|env|toml|txt)/i,
-    /credentials\s*[:=]/i,
-    // Contextual secrets: assignment or path, not bare word
-    /\bsecrets?\s*[:=]/i,
-    /\bsecrets?\/[a-z0-9_.-]+/i,
-    /\.pem$/i,
-    /\.key$/i,
-    /\.crt$/i,
-    // Contextual password: assignment or URL (postgres://user:pass@host) only
-    /password\s*[:=]/i,
-    /api[_-]?key/i,
-    /auth[_-]?token/i,
-    /~\/\.ssh/i,
-    /~\/\.aws/i,
-    /~\/\.config/i,
-    // SMI-4396 Wave 2: explicit system-file paths. Added so that tightening
-    // bare /credentials/i and /password/i into assignment-context variants
-    // doesn't drop coverage of obvious sensitive references like /etc/passwd.
-    /\/etc\/(?:passwd|shadow|sudoers|hosts)\b/i,
-];
-// Jailbreak attempt patterns
-export const JAILBREAK_PATTERNS = [
-    /ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|prompts?|rules?)/i,
-    /disregard\s+(all\s+)?(previous|prior|your)\s+(instructions?|programming)/i,
-    /developer\s+mode/i,
-    /\bDAN\b/,
-    /do\s+anything\s+now/i,
-    /jailbreak/i,
-    /bypass\s+(all\s+)?(restrictions?|filters?|safety)/i,
-    /pretend\s+(you\s+)?(are|have)\s+no\s+(restrictions?|limits?)/i,
-    /act\s+as\s+(if\s+)?you\s+(have\s+)?no\s+ethics/i,
-    /you\s+are\s+now\s+(free|unrestricted|unfiltered)/i,
-    /ignore\s+your\s+(safety|ethical)\s+(guidelines?|rules?)/i,
-    /hypothetical\s+scenario\s+where\s+you\s+can/i,
-    // Multi-line split-word obfuscation patterns (tested against full content)
-    /ig\s*\n\s*nore\s+(?:all\s+)?(?:previous|prior|above)\s+(?:instructions?|prompts?|rules?)/i,
-    /dis\s*\n\s*regard\s+(?:all\s+)?(?:previous|prior|your)\s+(?:instructions?|programming)/i,
-    /by\s*\n\s*pass\s+(?:all\s+)?(?:restrictions?|filters?|safety)/i,
-];
-// Suspicious patterns that might indicate malicious intent
-export const SUSPICIOUS_PATTERNS = [
-    /eval\s*\(/i,
-    /exec\s*\(/i,
-    /child_process/i,
-    /\$\(\s*[`'"]/i, // Command substitution
-    /base64\s*\.\s*decode/i,
-    /from\s+base64\s+import/i,
-    /subprocess\s*\.\s*(run|call|Popen)/i,
-    /os\s*\.\s*(system|popen|exec)/i,
-    /\brm\s+-rf\b/i,
-    /curl\s+.*\|\s*(bash|sh)/i, // Curl pipe to shell
-    /wget\s+.*\|\s*(bash|sh)/i,
-];
-// SMI-685: Social engineering attempt patterns
-export const SOCIAL_ENGINEERING_PATTERNS = [
-    /pretend\s+(to\s+be|you\s+are|that\s+you)/i,
-    /roleplay\s+as/i,
-    /you\s+are\s+now\s+(?!free|unrestricted)/i, // Exclude jailbreak patterns
-    /act\s+as\s+(if\s+you\s+were|though\s+you\s+are)/i,
-    /imagine\s+you\s+are/i,
-    /for\s+the\s+purposes?\s+of\s+this/i,
-    /let'?s?\s+say\s+you\s+are/i,
-    /assume\s+the\s+role\s+of/i,
-    /from\s+now\s+on\s+you\s+are/i,
-    /i\s+want\s+you\s+to\s+act\s+as/i,
-    /please\s+behave\s+as\s+if/i,
-    /can\s+you\s+pretend/i,
-];
-// SMI-685: Prompt leaking attempt patterns
-export const PROMPT_LEAKING_PATTERNS = [
-    /show\s+(me\s+)?your\s+(system\s+)?(instructions?|prompt)/i,
-    /what\s+are\s+your\s+(\w+\s+)?rules/i,
-    /reveal\s+your\s+(system\s+)?prompt/i,
-    /display\s+your\s+(initial\s+)?instructions?/i,
-    /output\s+your\s+(system\s+)?prompt/i,
-    /print\s+your\s+(hidden\s+)?instructions?/i,
-    /tell\s+me\s+your\s+(secret\s+)?instructions?/i,
-    /what\s+(were|are)\s+you\s+(told|instructed)\s+to\s+do/i,
-    /repeat\s+(back\s+)?your\s+(\w+\s+)?prompt/i,
-    /what\s+is\s+your\s+(original\s+)?programming/i,
-    /dump\s+(your\s+)?system\s+(prompt|instructions?)/i,
-    /list\s+your\s+(hidden\s+)?directives?/i,
-    /what\s+(constraints?|limitations?)\s+do\s+you\s+have/i,
-    /echo\s+(back\s+)?your\s+(initial\s+)?prompt/i,
-];
-// SMI-685: Data exfiltration patterns
-export const DATA_EXFILTRATION_PATTERNS = [
-    /btoa\s*\(/i, // Base64 encode in JS
-    /atob\s*\(/i, // Base64 decode in JS
-    /Buffer\.from\s*\([^)]*,\s*['"]base64['"]/i,
-    /\.toString\s*\(\s*['"]base64['"]\s*\)/i,
-    /encodeURIComponent\s*\(/i,
-    /fetch\s*\(\s*['"`][^'"`]*\?.*=/i, // Fetch with query params
-    /XMLHttpRequest/i,
-    /navigator\.sendBeacon/i,
-    /\.upload\s*\(/i,
-    /formData\.append/i,
-    /new\s+FormData/i,
-    /multipart\/form-data/i,
-    /webhook\s*[=:]/i,
-    /exfil/i,
-    /data\s*:\s*['"]/i, // Data URLs
-    /\.writeFile.*https?:\/\//i,
-    /send\s+.*(to|the)\s+(external|remote)/i,
-    // SMI-4396 Wave 2: word-boundary \bcloud\b + bounded wildcard.
-    // Previous /upload\s+.*(to|the)\s+(server|cloud|remote)/i matched
-    // "upload to Cloudinary" (the Cloud prefix substring-matches) —
-    // triggered skill-image-pipeline as data_exfiltration FP. The
-    // bounded [\w\s]{0,30}? prevents ReDoS; \bcloud\b excludes
-    // Cloudinary/cloudfront/cloudflare/iCloud/cloudstorage.
-    /upload\s+[\w\s]{0,30}?\s*(?:to|the)\s+(?:server|\bcloud\b|remote)/i,
-    // SMI-4396 Wave 2: explicit key/secret/credential/token upload detector.
-    // Ensures "upload private keys to our cdn bucket" still triggers even
-    // though \bcloud\b word-boundary now excludes "cdn bucket" prose.
-    /upload\s+[\w\s]{0,50}?\s*(?:private\s+)?(?:key|secret|credential|token)s?\b/i,
-    /post\s+data\s+to/i,
-    /to\s+external\s+(api|server|endpoint)/i,
-    // SMI-4396 Wave 2: restore prose coverage dropped by tightening bare /password/i
-    // and /credentials/i to assignment-context only. These unambiguous exfiltration
-    // verbs (send/transmit/leak/dump/steal/extract) + credential noun preserve detection
-    // of "send the user's passwords to attacker.com" and similar imperative instructions
-    // without re-introducing FPs on "This skill handles passwords" or
-    // "Never expose the password to Claude Code" (expose excluded: weak intent signal
-    // + negation-context FP in 1Password-style SKILL.md fixtures).
-    /(?:send|transmit|leak|dump|steal|extract)\s+[\w\s']{0,40}(?:passwords?|credentials?|secrets?)\b/i,
-];
-// SMI-685: Privilege escalation patterns
-export const PRIVILEGE_ESCALATION_PATTERNS = [
-    /sudo\s+.*(-S|--stdin)/i, // sudo with password from stdin
-    /echo\s+.*\|\s*sudo/i, // Echo password to sudo
-    /sudo\s+-S/i,
-    /\bchmod\s+[0-7]*[4-7][0-7][0-7]\b/i, // chmod with setuid/setgid
-    /\bchmod\s+\+s\b/i, // chmod setuid
-    /\bchmod\s+777\b/i, // World writable
-    /\bchmod\s+666\b/i, // World readable/writable
-    /\bchown\s+root/i,
-    /\bchgrp\s+root/i,
-    /visudo/i,
-    /\/etc\/sudoers/i,
-    /NOPASSWD/i,
-    /setuid/i,
-    /setgid/i,
-    /capability\s+cap_/i,
-    // SMI-4396 Wave 2: contextual privilege_escalation patterns.
-    // Previous bare /escalat(e|ion)/i matched documentation prose in
-    // security-research and prompt-injection-scanner skills that legitimately
-    // enumerate "privilege escalation" as an adversarial technique they
-    // detect — triggered 3/5 CRITICAL FPs. Bare pattern removed; these three
-    // contextual variants preserve real coverage (exploit-escalate calls,
-    // attack/vector noun phrases, to-root/to-admin targets).
-    /privilege[_\s-]+escalat(?:e|ion)/i,
-    /escalat(?:e|ion)\s+(?:attack|vector|(?:to|as)\s+(?:root|admin|superuser))/i,
-    /exploit\s+[\w\s]{0,30}?\s*escalat(?:e|ion)/i,
-    /privilege[ds]?\s+(elevat|escal)/i,
-    /run\s+.*as\s+root/i,
-    /(run|execute)\s+as\s+(root|admin)/i,
-    /admin(istrator)?\s+access/i,
-    /root\s+(access|user)/i,
-    /as\s+root\s+user/i,
-    /su\s+-\s+root/i,
-    /become\s+root/i,
-];
-/**
- * SMI-3509: SSRF instruction patterns
- * Detects content instructing fetches to internal/dangerous endpoints.
- * These are text-oriented patterns for skill content scanning (not URL validators).
- */
-export const SSRF_INSTRUCTION_PATTERNS = [
-    // Dangerous protocol schemes in skill instructions
-    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?file:\/\//i,
-    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?gopher:\/\//i,
-    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?dict:\/\//i,
-    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?ldap:\/\//i,
-    // Instructions targeting localhost/internal IPs
-    /(?:fetch|request|curl|wget|get|connect|send)\s+(?:to\s+)?(?:https?:\/\/)?localhost/i,
-    /(?:fetch|request|curl|wget|get|connect|send)\s+(?:to\s+)?(?:https?:\/\/)?127\.0\.0\.\d+/i,
-    /(?:fetch|request|curl|wget|get|connect|send)\s+(?:to\s+)?(?:https?:\/\/)?0\.0\.0\.0/i,
-    // Cloud metadata service endpoints
-    /169\.254\.169\.254/,
-    // Bare dangerous protocol references in content (without action verb)
-    /file:\/\/\/etc\/(?:passwd|shadow|hosts)/i,
-    /gopher:\/\/localhost/i,
-    // SMI-3522: Multi-line SSRF patterns (split across lines)
-    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?(?:the\s+)?(?:url\s+)?\n\s*file:\/\//i,
-    /(?:fetch|request|curl|wget|get|connect|send)\s+(?:to\s+)?(?:the\s*)?\n\s*(?:https?:\/\/)?(?:localhost|127\.0\.0\.\d+|0\.0\.0\.0)/i,
-    /(?:fetch|request|curl|wget|get|open|load|read)\s+(?:from\s+)?(?:the\s+)?(?:url\s+)?\n\s*gopher:\/\//i,
-];
-/**
- * SMI-1532: AIDefence CVE-hardened injection patterns
- * Optimized for sub-10ms scan time with compiled regex and no backtracking
- *
- * These patterns detect sophisticated prompt injection attacks based on
- * known CVEs and security research findings.
- *
- * References:
- * - OWASP LLM Top 10: LLM01 Prompt Injection
- * - Anthropic Responsible Disclosure Program findings
- * - Academic research on prompt injection attacks
- */
-/**
- * SMI-3864: PII detection patterns
- * Detects personally identifiable information and credentials in skill content.
- * Complements AIDefence's aidefence_has_pii() for offline/local scanning.
- */
-export const PII_PATTERNS = [
-    // API keys and tokens (generic patterns)
-    /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[A-Za-z0-9_-]{20,}['"]?/i,
-    /(?:secret[_-]?key|secretkey)\s*[:=]\s*['"]?[A-Za-z0-9_-]{20,}['"]?/i,
-    /(?:access[_-]?token|accesstoken)\s*[:=]\s*['"]?[A-Za-z0-9_-]{20,}['"]?/i,
-    // Provider-specific key formats
-    /sk[_-](?:live|test)[_-][A-Za-z0-9]{20,}/, // Stripe
-    /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}/, // GitHub PAT
-    /xoxb-[0-9]+-[0-9]+-[A-Za-z0-9]+/, // Slack bot token
-    /AKIA[0-9A-Z]{16}/, // AWS Access Key
-    // Email addresses — severity `info` in YAML frontmatter context (Review #8)
-    // Downgraded because SKILL.md files legitimately contain author contact emails
-    /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/,
-    // US Social Security Numbers
-    /\b\d{3}-\d{2}-\d{4}\b/,
-    // Private keys
-    /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/,
-    // Generic password assignments
-    /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/i,
-];
-export const AI_DEFENCE_PATTERNS = [
-    // Role injection patterns - attempts to inject system/assistant/user roles
-    // Pattern detects role markers that could manipulate conversation boundaries
-    // Covers: start of line, after whitespace, with various delimiters
-    /(?:^|\s)(?:system|assistant|user)\s*:\s*(?:\n|$)/i,
-    // Hidden instruction brackets - obfuscated commands
-    /\[\[\s*[^\]]{1,200}\s*\]\]/,
-    // HTML/XML comment injection - hiding malicious instructions
-    /<!--[\s\S]{0,100}?(?:ignore|override|bypass|system|instruction)[\s\S]{0,100}?-->/i,
-    // Unicode homograph attacks - visually similar characters
-    // Detects Cyrillic, Greek, or other homoglyphs mixed with Latin
-    /[\u0400-\u04FF\u0370-\u03FF]{2,}[\w\s]+(?:ignore|bypass|instruction)/i,
-    // Mixed-script detection: Latin + Cyrillic/Greek in same word (homoglyph attack)
-    // Note: \b word boundaries don't work with Unicode; use space/start/end anchors
-    /(?:^|[\s,."'(])(?:[a-zA-Z]+[\u0400-\u04FF\u0370-\u03FF]|[\u0400-\u04FF\u0370-\u03FF]+[a-zA-Z])[a-zA-Z\u0400-\u04FF\u0370-\u03FF]*/,
-    // Prompt structure manipulation - XML/markdown injection
-    /<\/?(?:system|prompt|instruction|context|message)(?:\s[^>]*)?>/i,
-    // Base64 encoded instructions (common evasion technique)
-    /(?:base64|b64)\s*[:=]\s*["']?[A-Za-z0-9+/]{20,}={0,2}["']?/i,
-    // Delimiter injection - breaking out of prompt boundaries
-    /(?:^|\n)(?:---|\*{3}|#{3,})\s*(?:system|prompt|instruction|override)/i,
-    // JSON structure injection in prompts
-    // SMI-1532: Refined to require suspicious values, not just field names
-    // Matches: "role": "system" or "instruction": "ignore" but not "content": "Hello"
-    /["']\s*(?:role|system|instruction)\s*["']\s*:\s*["'](?:system|assistant|user|ignore|override|bypass)/i,
-    // Nested instruction blocks
-    /<instruction[^>]*>[\s\S]{0,500}?<\/instruction>/i,
-    // CRLF injection for prompt manipulation
-    /(?:\r\n|\r|\n){2,}\s*(?:ignore|forget|override|bypass)\s+(?:all|previous|above)/i,
-    // Template literal injection
-    /\$\{\s*(?:system|prompt|instruction|config)/i,
-    // Zero-width character obfuscation detection
-    // SMI-1532: Enhanced to detect single zero-width chars near sensitive keywords
-    /[\u200B-\u200F\u2028-\u202F\uFEFF](?:[\s\S]{0,20}(?:ignore|bypass|system|instruction)|[\u200B-\u200F\u2028-\u202F\uFEFF])/i,
-    // Markdown link injection with suspicious targets
-    /\[(?:click|here|link|url)[^\]]*\]\([^)]*(?:javascript|data|vbscript):/i,
-    // Escape sequence abuse
-    /\\x[0-9a-fA-F]{2}(?:\\x[0-9a-fA-F]{2}){3,}/,
-    // Unicode normalization attacks - combining characters that render differently
-    // Detects combining diacritical marks used to obfuscate text
-    /[\u0300-\u036F]{2,}/,
-];
-//# sourceMappingURL=patterns.js.map

package/dist/security/scanner/patterns.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/security/scanner/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0BAA0B;AAC1B,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,YAAY;IACZ,uBAAuB;IACvB,2BAA2B;IAC3B,WAAW;IACX,WAAW;IACX,oBAAoB;IACpB,eAAe;IACf,WAAW;IACX,iBAAiB;IACjB,uBAAuB;IACvB,YAAY;IACZ,oBAAoB;CACrB,CAAA;AAED,+BAA+B;AAC/B,qFAAqF;AACrF,0EAA0E;AAC1E,kFAAkF;AAClF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ;IACR,iEAAiE;IACjE,2CAA2C;IAC3C,qBAAqB;IACrB,wDAAwD;IACxD,oBAAoB;IACpB,2BAA2B;IAC3B,SAAS;IACT,SAAS;IACT,SAAS;IACT,0EAA0E;IAC1E,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,WAAW;IACX,WAAW;IACX,cAAc;IACd,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,2CAA2C;CAC5C,CAAA;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,6EAA6E;IAC7E,2EAA2E;IAC3E,mBAAmB;IACnB,SAAS;IACT,sBAAsB;IACtB,YAAY;IACZ,oDAAoD;IACpD,+DAA+D;IAC/D,iDAAiD;IACjD,mDAAmD;IACnD,0DAA0D;IAC1D,8CAA8C;IAE9C,2EAA2E;IAC3E,2FAA2F;IAC3F,yFAAyF;IACzF,gEAAgE;CACjE,CAAA;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,YAAY;IACZ,YAAY;IACZ,gBAAgB;IAChB,eAAe,EAAE,uBAAuB;IACxC,uBAAuB;IACvB,yBAAyB;IACzB,qCAAqC;IACrC,gCAAgC;IAChC,eAAe;IACf,0BAA0B,EAAE,qBAAqB;IACjD,0BAA0B;CAC3B,CAAA;AAED,+CAA+C;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,2CAA2C;IAC3C,gBAAgB;IAChB,0CAA0C,EAAE,6BAA6B;IACzE,kDAAkD;IAClD,sBAAsB;IACtB,oCAAoC;IACpC,4BAA4B;IAC5B,2BAA2B;IAC3B,8BAA8B;IAC9B,iCAAiC;IACjC,4BAA4B;IAC5B,sBAAsB;CACvB,CAAA;AAED,2CAA2C;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,2DAA2D;IAC3D,qCAAqC;IACrC,qCAAqC;IACrC,8CAA8C;IAC9C,qCAAqC;IACrC,2CAA2C;IAC3C,+CAA+C;IAC/C,wDAAwD;IACxD,4CAA4C;IAC5C,+CAA+C;IAC/C,mDAAmD;IACnD,wCAAwC;IACxC,uDAAuD;IACvD,8CAA8C;CAC/C,CAAA;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,YAAY,EAAE,sBAAsB;IACpC,YAAY,EAAE,sBAAsB;IACpC,2CAA2C;IAC3C,wCAAwC;IACxC,0BAA0B;IAC1B,iCAAiC,EAAE,0BAA0B;IAC7D,iBAAiB;IACjB,wBAAwB;IACxB,gBAAgB;IAChB,mBAAmB;IACnB,iBAAiB;IACjB,uBAAuB;IACvB,iBAAiB;IACjB,QAAQ;IACR,kBAAkB,EAAE,YAAY;IAChC,2BAA2B;IAC3B,wCAAwC;IACxC,+DAA+D;IAC/D,kEAAkE;IAClE,gEAAgE;IAChE,8DAA8D;IAC9D,2DAA2D;IAC3D,wDAAwD;IACxD,oEAAoE;IACpE,yEAAyE;IACzE,sEAAsE;IACtE,kEAAkE;IAClE,8EAA8E;IAC9E,mBAAmB;IACnB,wCAAwC;IACxC,iFAAiF;IACjF,gFAAgF;IAChF,qFAAqF;IACrF,qFAAqF;IACrF,kEAAkE;IAClE,kFAAkF;IAClF,+DAA+D;IAC/D,kGAAkG;CACnG,CAAA;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,wBAAwB,EAAE,gCAAgC;IAC1D,qBAAqB,EAAE,wBAAwB;IAC/C,YAAY;IACZ,oCAAoC,EAAE,2BAA2B;IACjE,kBAAkB,EAAE,eAAe;IACnC,kBAAkB,EAAE,iBAAiB;IACrC,kBAAkB,EAAE,0BAA0B;IAC9C,iBAAiB;IACjB,iBAAiB;IACjB,SAAS;IACT,iBAAiB;IACjB,WAAW;IACX,SAAS;IACT,SAAS;IACT,oBAAoB;IACpB,6DAA6D;IAC7D,iEAAiE;IACjE,0EAA0E;IAC1E,oEAAoE;IACpE,yEAAyE;IACzE,sEAAsE;IACtE,yDAAyD;IACzD,mCAAmC;IACnC,4EAA4E;IAC5E,6CAA6C;IAC7C,kCAAkC;IAClC,oBAAoB;IACpB,oCAAoC;IACpC,4BAA4B;IAC5B,uBAAuB;IACvB,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;CACjB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,mDAAmD;IACnD,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IAEzE,gDAAgD;IAChD,qFAAqF;IACrF,0FAA0F;IAC1F,sFAAsF;IAEtF,mCAAmC;IACnC,oBAAoB;IAEpB,sEAAsE;IACtE,0CAA0C;IAC1C,uBAAuB;IAEvB,0DAA0D;IAC1D,oGAAoG;IACpG,mIAAmI;IACnI,sGAAsG;CACvG,CAAA;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,yCAAyC;IACzC,+DAA+D;IAC/D,qEAAqE;IACrE,yEAAyE;IAEzE,gCAAgC;IAChC,yCAAyC,EAAE,SAAS;IACpD,0CAA0C,EAAE,aAAa;IACzD,iCAAiC,EAAE,kBAAkB;IACrD,kBAAkB,EAAE,iBAAiB;IAErC,4EAA4E;IAC5E,+EAA+E;IAC/E,gDAAgD;IAEhD,6BAA6B;IAC7B,uBAAuB;IAEvB,eAAe;IACf,4CAA4C;IAE5C,+BAA+B;IAC/B,qDAAqD;CACtD,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,2EAA2E;IAC3E,6EAA6E;IAC7E,mEAAmE;IACnE,mDAAmD;IAEnD,oDAAoD;IACpD,4BAA4B;IAE5B,6DAA6D;IAC7D,mFAAmF;IAEnF,0DAA0D;IAC1D,gEAAgE;IAChE,uEAAuE;IAEvE,iFAAiF;IACjF,gFAAgF;IAChF,mIAAmI;IAEnI,yDAAyD;IACzD,iEAAiE;IAEjE,yDAAyD;IACzD,6DAA6D;IAE7D,0DAA0D;IAC1D,uEAAuE;IAEvE,sCAAsC;IACtC,uEAAuE;IACvE,kFAAkF;IAClF,uGAAuG;IAEvG,4BAA4B;IAC5B,kDAAkD;IAElD,yCAAyC;IACzC,kFAAkF;IAElF,6BAA6B;IAC7B,8CAA8C;IAE9C,6CAA6C;IAC7C,+EAA+E;IAC/E,4HAA4H;IAE5H,kDAAkD;IAClD,wEAAwE;IAExE,wBAAwB;IACxB,4CAA4C;IAE5C,+EAA+E;IAC/E,6DAA6D;IAC7D,qBAAqB;CACtB,CAAA"}

package/dist/security/scanner/regex-utils.d.ts

@@ -1,33 +0,0 @@
-/**
- * Security Scanner Regex Utilities - SMI-882, SMI-1189
- *
- * ReDoS protection utilities for safe regex matching.
- */
-/**
- * SMI-882: ReDoS Protection Constants
- * Maximum line length to process with regex patterns.
- * Lines exceeding this limit are truncated before regex matching
- * to prevent catastrophic backtracking attacks.
- */
-export declare const MAX_LINE_LENGTH_FOR_REGEX = 10000;
-/**
- * SMI-882: Safe regex test with length limit
- * Applies input length limit before regex matching to prevent ReDoS attacks.
- *
- * @param pattern - Regex pattern to test
- * @param input - Input string to test against
- * @param maxLength - Maximum input length (default: MAX_LINE_LENGTH_FOR_REGEX)
- * @returns Match result or null if input is too long/no match
- */
-export declare function safeRegexTest(pattern: RegExp, input: string, maxLength?: number): RegExpMatchArray | null;
-/**
- * SMI-882: Check if pattern matches safely
- * Returns boolean instead of match array for simple tests.
- *
- * @param pattern - Regex pattern to test
- * @param input - Input string to test against
- * @param maxLength - Maximum input length (default: MAX_LINE_LENGTH_FOR_REGEX)
- * @returns True if pattern matches (within safe input limits)
- */
-export declare function safeRegexCheck(pattern: RegExp, input: string, maxLength?: number): boolean;
-//# sourceMappingURL=regex-utils.d.ts.map

package/dist/security/scanner/regex-utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"regex-utils.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAQ,CAAA;AAE9C;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,gBAAgB,GAAG,IAAI,CAIzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,OAAO,CAIT"}

package/dist/security/scanner/regex-utils.js

@@ -1,41 +0,0 @@
-/**
- * Security Scanner Regex Utilities - SMI-882, SMI-1189
- *
- * ReDoS protection utilities for safe regex matching.
- */
-/**
- * SMI-882: ReDoS Protection Constants
- * Maximum line length to process with regex patterns.
- * Lines exceeding this limit are truncated before regex matching
- * to prevent catastrophic backtracking attacks.
- */
-export const MAX_LINE_LENGTH_FOR_REGEX = 10000;
-/**
- * SMI-882: Safe regex test with length limit
- * Applies input length limit before regex matching to prevent ReDoS attacks.
- *
- * @param pattern - Regex pattern to test
- * @param input - Input string to test against
- * @param maxLength - Maximum input length (default: MAX_LINE_LENGTH_FOR_REGEX)
- * @returns Match result or null if input is too long/no match
- */
-export function safeRegexTest(pattern, input, maxLength = MAX_LINE_LENGTH_FOR_REGEX) {
-    // Truncate input if it exceeds max length to prevent ReDoS
-    const safeInput = input.length > maxLength ? input.slice(0, maxLength) : input;
-    return safeInput.match(pattern);
-}
-/**
- * SMI-882: Check if pattern matches safely
- * Returns boolean instead of match array for simple tests.
- *
- * @param pattern - Regex pattern to test
- * @param input - Input string to test against
- * @param maxLength - Maximum input length (default: MAX_LINE_LENGTH_FOR_REGEX)
- * @returns True if pattern matches (within safe input limits)
- */
-export function safeRegexCheck(pattern, input, maxLength = MAX_LINE_LENGTH_FOR_REGEX) {
-    // Truncate input if it exceeds max length to prevent ReDoS
-    const safeInput = input.length > maxLength ? input.slice(0, maxLength) : input;
-    return pattern.test(safeInput);
-}
-//# sourceMappingURL=regex-utils.js.map

package/dist/security/scanner/regex-utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"regex-utils.js","sourceRoot":"","sources":["../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAE9C;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC"}

package/dist/security/scanner/types.d.ts

@@ -1,77 +0,0 @@
-/**
- * Security Scanner Types - SMI-587, SMI-685, SMI-1189
- *
- * Type definitions for security scanning functionality.
- */
-/**
- * Types of security findings that can be detected
- */
-export type SecurityFindingType = 'url' | 'sensitive_path' | 'jailbreak' | 'suspicious_pattern' | 'social_engineering' | 'prompt_leaking' | 'data_exfiltration' | 'privilege_escalation' | 'ai_defence' | 'ssrf' | 'pii';
-/**
- * Severity levels for security findings
- */
-export type SecuritySeverity = 'low' | 'medium' | 'high' | 'critical';
-/**
- * Confidence level for a finding
- * - high: Strong indicator of malicious intent
- * - medium: Possible issue, context suggests caution
- * - low: Likely false positive (e.g., in documentation/examples)
- */
-export type FindingConfidence = 'high' | 'medium' | 'low';
-/**
- * Individual security finding from a scan
- */
-export interface SecurityFinding {
-    type: SecurityFindingType;
-    severity: SecuritySeverity;
-    message: string;
-    location?: string;
-    lineNumber?: number;
-    /** Category for grouping related findings */
-    category?: string;
-    /** Whether finding is in a documentation context (code block, table, example) */
-    inDocumentationContext?: boolean;
-    /** Confidence level - lower for findings in documentation context */
-    confidence?: FindingConfidence;
-}
-/**
- * Risk score breakdown by category
- */
-export interface RiskScoreBreakdown {
-    jailbreak: number;
-    socialEngineering: number;
-    promptLeaking: number;
-    dataExfiltration: number;
-    privilegeEscalation: number;
-    suspiciousCode: number;
-    sensitivePaths: number;
-    externalUrls: number;
-    aiDefence: number;
-    ssrf: number;
-    pii: number;
-}
-/**
- * Comprehensive scan report with risk scoring
- */
-export interface ScanReport {
-    skillId: string;
-    passed: boolean;
-    findings: SecurityFinding[];
-    scannedAt: Date;
-    scanDurationMs: number;
-    /** Overall risk score from 0-100 (0 = safe, 100 = extremely dangerous) */
-    riskScore: number;
-    /** Breakdown of risk score by category */
-    riskBreakdown: RiskScoreBreakdown;
-}
-/**
- * Configuration options for the security scanner
- */
-export interface ScannerOptions {
-    allowedDomains?: string[];
-    blockedPatterns?: RegExp[];
-    maxContentLength?: number;
-    /** Risk score threshold for failing a scan (default: 40) */
-    riskThreshold?: number;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/security/scanner/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL,gBAAgB,GAChB,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,MAAM,GACN,KAAK,CAAA;AAET;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAErE;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,qEAAqE;IACrE,UAAU,CAAC,EAAE,iBAAiB,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,SAAS,EAAE,IAAI,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,aAAa,EAAE,kBAAkB,CAAA;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB"}

package/dist/security/scanner/types.js

@@ -1,7 +0,0 @@
-/**
- * Security Scanner Types - SMI-587, SMI-685, SMI-1189
- *
- * Type definitions for security scanning functionality.
- */
-export {};
-//# sourceMappingURL=types.js.map

package/dist/security/scanner/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/security/scanner/weights.d.ts

@@ -1,15 +0,0 @@
-/**
- * Security Scanner Weights - SMI-685, SMI-1189
- *
- * Weight constants for risk score calculation.
- */
-import type { SecuritySeverity } from './types.js';
-/**
- * Severity weights for risk score calculation
- */
-export declare const SEVERITY_WEIGHTS: Record<SecuritySeverity, number>;
-/**
- * Category weights for risk score calculation
- */
-export declare const CATEGORY_WEIGHTS: Record<string, number>;
-//# sourceMappingURL=weights.d.ts.map

package/dist/security/scanner/weights.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"weights.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/weights.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAK7D,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAYnD,CAAA"}

package/dist/security/scanner/weights.js

@@ -1,31 +0,0 @@
-/**
- * Security Scanner Weights - SMI-685, SMI-1189
- *
- * Weight constants for risk score calculation.
- */
-/**
- * Severity weights for risk score calculation
- */
-export const SEVERITY_WEIGHTS = {
-    low: 5,
-    medium: 15,
-    high: 30,
-    critical: 50,
-};
-/**
- * Category weights for risk score calculation
- */
-export const CATEGORY_WEIGHTS = {
-    jailbreak: 2.0,
-    social_engineering: 1.5,
-    prompt_leaking: 1.8,
-    data_exfiltration: 1.7,
-    privilege_escalation: 1.9,
-    suspicious_pattern: 1.3,
-    sensitive_path: 1.2,
-    url: 0.8,
-    ai_defence: 1.9, // SMI-1532: High weight for AI injection attacks
-    ssrf: 1.6, // SMI-3509: SSRF instruction detection
-    pii: 1.8, // SMI-3864: PII in skill content is high-risk
-};
-//# sourceMappingURL=weights.js.map

package/dist/security/scanner/weights.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"weights.js","sourceRoot":"","sources":["../../../src/security/scanner/weights.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC;IAChE,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,EAAE;CACb,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,SAAS,EAAE,GAAG;IACd,kBAAkB,EAAE,GAAG;IACvB,cAAc,EAAE,GAAG;IACnB,iBAAiB,EAAE,GAAG;IACtB,oBAAoB,EAAE,GAAG;IACzB,kBAAkB,EAAE,GAAG;IACvB,cAAc,EAAE,GAAG;IACnB,GAAG,EAAE,GAAG;IACR,UAAU,EAAE,GAAG,EAAE,iDAAiD;IAClE,IAAI,EAAE,GAAG,EAAE,uCAAuC;IAClD,GAAG,EAAE,GAAG,EAAE,8CAA8C;CACzD,CAAA"}

package/dist/security/stripe-validators.d.ts

@@ -1,92 +0,0 @@
-/**
- * SMI-1062: Stripe ID Validators
- *
- * Validation and sanitization functions for Stripe IDs.
- * Extracted from sanitization.ts for file size compliance.
- */
-/**
- * Stripe ID prefixes for validation
- */
-declare const STRIPE_ID_PREFIXES: {
-    readonly customer: "cus_";
-    readonly subscription: "sub_";
-    readonly price: "price_";
-    readonly invoice: "in_";
-    readonly paymentIntent: "pi_";
-    readonly paymentMethod: "pm_";
-    readonly product: "prod_";
-    readonly checkout: "cs_";
-    readonly event: "evt_";
-};
-type StripeIdType = keyof typeof STRIPE_ID_PREFIXES;
-/**
- * Validate a Stripe ID format
- *
- * Stripe IDs follow the pattern: prefix_alphanumeric
- * - Prefix identifies the object type (cus_, sub_, price_, etc.)
- * - Suffix is alphanumeric, typically 14-24 characters
- *
- * @param id - The Stripe ID to validate
- * @param type - The expected ID type (customer, subscription, price, etc.)
- * @param maxLength - Maximum allowed input length (default: 100)
- * @returns true if valid, false otherwise
- *
- * @example
- * ```typescript
- * isValidStripeId('cus_OtLqEJvHu1Mvxm', 'customer')  // true
- * isValidStripeId('sub_1234567890abcd', 'subscription')  // true
- * isValidStripeId('invalid_id', 'customer')  // false
- * ```
- */
-export declare function isValidStripeId(id: string, type: StripeIdType, maxLength?: number): boolean;
-/**
- * Sanitize a Stripe customer ID
- *
- * @param customerId - Raw customer ID
- * @param maxLength - Maximum allowed input length (default: 100)
- * @returns Sanitized customer ID or empty string if invalid
- *
- * @example
- * ```typescript
- * sanitizeStripeCustomerId('cus_OtLqEJvHu1Mvxm')
- * // Returns: 'cus_OtLqEJvHu1Mvxm'
- *
- * sanitizeStripeCustomerId('cus_<script>')
- * // Returns: ''
- * ```
- */
-export declare function sanitizeStripeCustomerId(customerId: string, maxLength?: number): string;
-/**
- * Sanitize a Stripe subscription ID
- *
- * @param subscriptionId - Raw subscription ID
- * @param maxLength - Maximum allowed input length (default: 100)
- * @returns Sanitized subscription ID or empty string if invalid
- */
-export declare function sanitizeStripeSubscriptionId(subscriptionId: string, maxLength?: number): string;
-/**
- * Sanitize a Stripe price ID
- *
- * @param priceId - Raw price ID
- * @param maxLength - Maximum allowed input length (default: 100)
- * @returns Sanitized price ID or empty string if invalid
- */
-export declare function sanitizeStripePriceId(priceId: string, maxLength?: number): string;
-/**
- * Sanitize a Stripe invoice ID
- *
- * @param invoiceId - Raw invoice ID
- * @param maxLength - Maximum allowed input length (default: 100)
- * @returns Sanitized invoice ID or empty string if invalid
- */
-export declare function sanitizeStripeInvoiceId(invoiceId: string, maxLength?: number): string;
-/**
- * Sanitize a Stripe event ID (for webhooks)
- *
- * @param eventId - Raw event ID
- * @param maxLength - Maximum allowed input length (default: 100)
- * @returns Sanitized event ID or empty string if invalid
- */
-export declare function sanitizeStripeEventId(eventId: string, maxLength?: number): string;
-export {};
-//# sourceMappingURL=stripe-validators.d.ts.map

package/dist/security/stripe-validators.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"stripe-validators.d.ts","sourceRoot":"","sources":["../../src/security/stripe-validators.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;GAEG;AACH,QAAA,MAAM,kBAAkB;;;;;;;;;;CAUd,CAAA;AAEV,KAAK,YAAY,GAAG,MAAM,OAAO,kBAAkB,CAAA;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,SAAM,GAAG,OAAO,CAqBxF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,MAAM,CAMpF;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,MAAM,CAM5F;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,MAAM,CAM9E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,MAAM,CAMlF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,SAAM,GAAG,MAAM,CAM9E"}