@superblocksteam/vite-plugin-file-sync 1.99.99-next.3 → 2.0.0-SNAPSHOT.2143e2e95d0107ab

package/dist/ai-service/security/secret-scanner.js

@@ -0,0 +1,459 @@
+/**
+ * Secret scanning utilities using TruffleHog.
+ *
+ * Provides functions for scanning content for leaked credentials and secrets.
+ * Uses TruffleHog CLI under the hood for detection and verification.
+ */
+import { spawn, execSync, } from "node:child_process";
+import { getSystemErrorName } from "node:util";
+import { getErrorMeta, getPrefixedLogger } from "../../util/logger.js";
+/**
+ * Detects if trufflehog is running via a Nix wrapper that already adds --no-update.
+ * The Nix wrapper is a bash script that adds --no-update before forwarding args.
+ */
+function isNixWrappedTrufflehog() {
+    const logger = getPrefixedLogger("[secret-scan]");
+    try {
+        const trufflehogPath = execSync("which trufflehog", {
+            encoding: "utf-8",
+        }).trim();
+        return trufflehogPath.includes("/nix/store/");
+    }
+    catch (error) {
+        logger.debug("Nix detection failed, assuming non-Nix trufflehog", getErrorMeta(error));
+        return false;
+    }
+}
+// Cache the result since it won't change during runtime
+let _isNixWrapped;
+function shouldSkipNoUpdateFlag() {
+    if (_isNixWrapped === undefined) {
+        _isNixWrapped = isNixWrappedTrufflehog();
+    }
+    return _isNixWrapped;
+}
+export class TrufflehogError extends Error {
+    failure;
+    constructor(failure) {
+        super(`TruffleHog scan failed: ${failure.category}`);
+        this.failure = failure;
+        this.name = "TrufflehogError";
+    }
+}
+/**
+ * Redacts secrets in content by replacing raw values with redacted versions.
+ *
+ * Replaces each detected secret's raw value with its redacted form.
+ * Secrets are processed longest-first to handle overlapping matches correctly.
+ *
+ * @param content - The original content containing secrets
+ * @param findings - Array of secret findings from TruffleHog
+ * @returns Content with all detected secrets redacted
+ */
+export function redactSecrets(content, findings) {
+    if (findings.length === 0) {
+        return content;
+    }
+    let redacted = content;
+    // Sort findings by raw length (longest first) to handle overlapping secrets
+    const sortedFindings = [...findings].sort((a, b) => b.raw.length - a.raw.length);
+    for (const finding of sortedFindings) {
+        if (finding.raw && finding.redacted) {
+            // Use global replacement to catch all occurrences
+            redacted = redacted.split(finding.raw).join(finding.redacted);
+        }
+    }
+    return redacted;
+}
+/**
+ * Parses TruffleHog JSON output into SecretFinding objects.
+ *
+ * @param jsonLine - Single line of JSON output from TruffleHog
+ * @returns Parsed SecretFinding or null if parsing fails
+ */
+function parseTrufflehogResult(jsonLine) {
+    const logger = getPrefixedLogger("[secret-scan]");
+    try {
+        const result = JSON.parse(jsonLine);
+        const raw = result.Raw ?? "";
+        // Generate a sensible redacted value if TruffleHog doesn't provide one
+        // (custom regex detectors often return empty Redacted field)
+        const redacted = result.Redacted || generateRedactedValue(raw);
+        return {
+            detectorType: result.DetectorType?.toString() ?? "unknown",
+            detectorName: result.DetectorName ?? "unknown",
+            verified: result.Verified ?? false,
+            raw,
+            redacted,
+            line: result.SourceMetadata?.Data?.Filesystem?.line,
+            extraData: result.ExtraData,
+            sourceMetadata: {
+                file: result.SourceMetadata?.Data?.Filesystem?.file,
+                line: result.SourceMetadata?.Data?.Filesystem?.line,
+            },
+        };
+    }
+    catch {
+        logger.warn("Failed to parse TruffleHog result");
+        return null;
+    }
+}
+/**
+ * Generates a redacted version of a secret value.
+ *
+ * Preserves a prefix for recognizable patterns (like sk_live_, ghp_, AKIA)
+ * and replaces the rest with asterisks.
+ *
+ * @param raw - The raw secret value
+ * @returns A redacted version with preserved prefix and masked suffix
+ */
+function generateRedactedValue(raw) {
+    if (!raw || raw.length <= 4) {
+        return "[REDACTED]";
+    }
+    // For short secrets, just show first 2 chars
+    if (raw.length <= 8) {
+        return raw.slice(0, 2) + "****";
+    }
+    // For longer secrets, preserve recognizable prefixes
+    const prefixLength = Math.min(8, Math.floor(raw.length / 3));
+    return raw.slice(0, prefixLength) + "****";
+}
+/**
+ * Runs TruffleHog CLI using stdin and returns parsed findings.
+ *
+ * Uses TruffleHog's built-in detectors for common secret types (Stripe, GitHub,
+ * AWS, private keys, etc.) without custom configuration.
+ *
+ * @param content - Content to scan for secrets (piped to stdin)
+ * @param timeout - Timeout in milliseconds
+ * @param verifiedOnly - Whether to only return verified secrets
+ * @returns Promise resolving to array of SecretFinding objects
+ */
+export async function runTrufflehog(content, timeout, verifiedOnly) {
+    return new Promise((resolve, reject) => {
+        const args = ["stdin", "--json"];
+        if (!shouldSkipNoUpdateFlag()) {
+            args.push("--no-update");
+        }
+        if (verifiedOnly) {
+            args.push("--results=verified");
+        }
+        else {
+            args.push("--results=verified,unknown,unverified");
+        }
+        const started = performance.now();
+        let proc;
+        try {
+            proc = spawn("trufflehog", args, {
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+        }
+        catch (error) {
+            const errno = typeof error === "object" && error !== null && "errno" in error
+                ? error.errno
+                : undefined;
+            reject(new TrufflehogError({
+                category: "spawn_error",
+                ...(typeof errno === "number" && errno < 0
+                    ? { errno: getSystemErrorName(errno) }
+                    : {}),
+                exitCode: null,
+                deadlineExpired: false,
+                elapsedMs: performance.now() - started,
+            }));
+            return;
+        }
+        const findings = [];
+        let stdout = "";
+        let processError;
+        let inputError;
+        let deadlineExpired = false;
+        let cleanup;
+        let settlementFallback;
+        let settled = false;
+        const closePipes = () => {
+            proc.stdin.destroy();
+            proc.stdout.destroy();
+            proc.stderr.destroy();
+        };
+        const settle = (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(deadline);
+            clearTimeout(cleanup);
+            clearTimeout(settlementFallback);
+            // TruffleHog returns 0 for no secrets, 183 for secrets found
+            if (!processError &&
+                !inputError &&
+                !deadlineExpired &&
+                !signal &&
+                (code === 0 || code === 183)) {
+                // Parse each line of JSON output
+                const lines = stdout.split("\n").filter((line) => line.trim());
+                for (const line of lines) {
+                    const finding = parseTrufflehogResult(line);
+                    if (finding) {
+                        findings.push(finding);
+                    }
+                }
+                resolve(findings);
+            }
+            else {
+                const errno = processError?.errno ?? inputError?.errno;
+                reject(new TrufflehogError({
+                    category: deadlineExpired
+                        ? "deadline"
+                        : processError
+                            ? "spawn_error"
+                            : signal
+                                ? "signal"
+                                : code !== 0 && code !== 183
+                                    ? "nonzero_exit"
+                                    : "input_error",
+                    ...(typeof errno === "number" && errno < 0
+                        ? { errno: getSystemErrorName(errno) }
+                        : {}),
+                    exitCode: processError ? null : code,
+                    ...(signal ? { signal } : {}),
+                    deadlineExpired,
+                    elapsedMs: performance.now() - started,
+                }));
+            }
+        };
+        const scheduleSettlementFallback = () => {
+            if (settlementFallback)
+                return;
+            settlementFallback = setTimeout(() => {
+                closePipes();
+                proc.unref();
+                settle(proc.exitCode, proc.signalCode);
+            }, 250);
+        };
+        const deadline = timeout > 0
+            ? setTimeout(() => {
+                if (proc.exitCode !== null || proc.signalCode !== null) {
+                    closePipes();
+                    scheduleSettlementFallback();
+                    return;
+                }
+                deadlineExpired = true;
+                proc.kill("SIGTERM");
+                // Cleanup only, not additional scan time. A late exit 0 remains a failure.
+                cleanup = setTimeout(() => {
+                    proc.kill("SIGKILL");
+                    scheduleSettlementFallback();
+                }, 1000);
+            }, timeout)
+            : undefined;
+        proc.on("exit", (code, signal) => {
+            if (deadlineExpired || signal || (code !== 0 && code !== 183)) {
+                clearTimeout(deadline);
+                clearTimeout(cleanup);
+                // Failed output is unused. Descendants holding inherited pipes must not
+                // keep the scan pending after the direct scanner process has exited.
+                closePipes();
+                if (deadlineExpired)
+                    scheduleSettlementFallback();
+            }
+        });
+        proc.stdout.on("data", (data) => {
+            stdout += data.toString();
+        });
+        // Drain but never retain diagnostic output, which can contain scanned secrets.
+        proc.stderr.resume();
+        proc.on("close", settle);
+        proc.on("error", (error) => {
+            processError = error;
+        });
+        // Early child exits can close stdin before the write completes. The close
+        // event owns settlement so capacity is not released while a child is alive.
+        proc.stdin.on("error", (error) => {
+            inputError = error;
+        });
+        // Write content to stdin and close the stream
+        proc.stdin.write(content);
+        proc.stdin.end();
+    });
+}
+/** Five-second probe plus at most 250ms to collect termination evidence. */
+export async function probeTrufflehogAvailability(timeout = 5000) {
+    return new Promise((resolve) => {
+        const started = performance.now();
+        let deadline;
+        const onSpawnError = (error) => {
+            clearTimeout(deadline);
+            const errno = typeof error === "object" && error !== null && "errno" in error
+                ? error.errno
+                : undefined;
+            resolve({
+                available: false,
+                failure: {
+                    category: "spawn_error",
+                    ...(typeof errno === "number" && errno < 0
+                        ? { errno: getSystemErrorName(errno) }
+                        : {}),
+                    exitCode: null,
+                    deadlineExpired: false,
+                    elapsedMs: performance.now() - started,
+                },
+            });
+        };
+        let proc;
+        try {
+            // --version exits before TruffleHog's updater, including in Nix wrappers.
+            proc = spawn("trufflehog", ["--version"], { stdio: "ignore" });
+        }
+        catch (error) {
+            // Native spawn can throw synchronously for resource errors like ENOMEM.
+            onSpawnError(error);
+            return;
+        }
+        let deadlineExpired = false;
+        deadline = setTimeout(() => {
+            deadlineExpired = true;
+            // A probe has no cleanup work. SIGKILL also bounds an unresponsive wrapper.
+            proc.kill("SIGKILL");
+            // Normally close supplies the actual signal. Do not invent it if close
+            // never arrives (for example, an uninterruptible process).
+            deadline = setTimeout(() => {
+                proc.unref();
+                resolve({
+                    available: false,
+                    failure: {
+                        category: "deadline",
+                        exitCode: null,
+                        deadlineExpired: true,
+                        elapsedMs: performance.now() - started,
+                    },
+                });
+            }, 250);
+        }, timeout);
+        proc.once("close", (exitCode, signal) => {
+            clearTimeout(deadline);
+            resolve(exitCode === 0 && !deadlineExpired
+                ? { available: true }
+                : {
+                    available: false,
+                    failure: {
+                        category: deadlineExpired
+                            ? "deadline"
+                            : signal
+                                ? "signal"
+                                : "nonzero_exit",
+                        exitCode,
+                        ...(signal ? { signal } : {}),
+                        deadlineExpired,
+                        elapsedMs: performance.now() - started,
+                    },
+                });
+        });
+        proc.once("error", onSpawnError);
+    });
+}
+export async function isTrufflehogAvailable() {
+    return (await probeTrufflehogAvailability()).available;
+}
+/**
+ * A reusable secret redactor that can perform fast synchronous redaction.
+ *
+ * Use this when you need to redact secrets from multiple pieces of content
+ * using the same set of findings (e.g., redacting LLM responses based on
+ * secrets found in the input prompt).
+ *
+ * @example
+ * ```typescript
+ * // Scan input once
+ * const result = await scanContentForSecrets(userPrompt);
+ * const redactor = new SecretRedactor(result.findings);
+ *
+ * // Redact multiple outputs synchronously
+ * const safeResponse = redactor.redact(llmResponse);
+ * const safeToolOutput = redactor.redact(toolResult);
+ * ```
+ */
+export class SecretRedactor {
+    sortedFindings;
+    /**
+     * Creates a new SecretRedactor with the given findings.
+     *
+     * @param findings - Secret findings to use for redaction
+     */
+    constructor(findings) {
+        // Sort findings by raw length (longest first) to handle overlapping secrets
+        this.sortedFindings = [...findings].sort((a, b) => b.raw.length - a.raw.length);
+    }
+    /**
+     * Redacts secrets from the given content synchronously.
+     *
+     * @param content - The content to redact secrets from
+     * @returns Content with secrets replaced by redacted versions
+     */
+    redact(content) {
+        if (this.sortedFindings.length === 0 || !content) {
+            return content;
+        }
+        let redacted = content;
+        for (const finding of this.sortedFindings) {
+            if (finding.raw && finding.redacted) {
+                redacted = redacted.split(finding.raw).join(finding.redacted);
+            }
+        }
+        return redacted;
+    }
+    /**
+     * Redacts secrets from any value (string, object, or array).
+     *
+     * Recursively processes objects and arrays, redacting any string values.
+     *
+     * @param value - The value to redact secrets from
+     * @returns Value with secrets redacted from all string content
+     */
+    redactDeep(value) {
+        if (typeof value === "string") {
+            return this.redact(value);
+        }
+        if (Array.isArray(value)) {
+            return value.map((item) => this.redactDeep(item));
+        }
+        if (value !== null && typeof value === "object") {
+            const result = {};
+            for (const [key, val] of Object.entries(value)) {
+                result[key] = this.redactDeep(val);
+            }
+            return result;
+        }
+        return value;
+    }
+    /**
+     * Returns true if this redactor has any findings to redact.
+     */
+    hasFindings() {
+        return this.sortedFindings.length > 0;
+    }
+    /**
+     * Returns the number of findings this redactor has.
+     */
+    get findingCount() {
+        return this.sortedFindings.length;
+    }
+}
+export function formatSecretFindings(findings) {
+    if (findings.length === 0) {
+        return "No secrets detected.";
+    }
+    const lines = [`Found ${findings.length} potential secret(s):\n`];
+    for (const finding of findings) {
+        const status = finding.verified ? "✓ VERIFIED" : "? unverified";
+        lines.push(`  [${status}] ${finding.detectorName}`);
+        lines.push(`    Type: ${finding.detectorType}`);
+        lines.push(`    Value: ${finding.redacted}`);
+        if (finding.sourceMetadata?.line) {
+            lines.push(`    Line: ${finding.sourceMetadata.line}`);
+        }
+        lines.push("");
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=secret-scanner.js.map

package/dist/ai-service/security/secret-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scanner.js","sourceRoot":"","sources":["../../../src/ai-service/security/secret-scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,KAAK,EACL,QAAQ,GAET,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEvE;;;GAGG;AACH,SAAS,sBAAsB;IAC7B,MAAM,MAAM,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,QAAQ,CAAC,kBAAkB,EAAE;YAClD,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,mDAAmD,EACnD,YAAY,CAAC,KAAK,CAAC,CACpB,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,IAAI,aAAkC,CAAC;AACvC,SAAS,sBAAsB;IAC7B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAiED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAArB,YAAqB,OAA0B;QAC7C,KAAK,CAAC,2BAA2B,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QADlC,YAAO,GAAP,OAAO,CAAmB;QAE7C,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAqBD;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,QAAyB;IAEzB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,QAAQ,GAAG,OAAO,CAAC;IAEvB,4EAA4E;IAC5E,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CACtC,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACpC,kDAAkD;YAClD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,MAAM,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,GAAG,GAAW,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACrC,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,SAAS;YAC1D,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;YAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK;YAClC,GAAG;YACH,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI;YACnD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE;gBACd,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI;gBACnD,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI;aACpD;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,6CAA6C;IAC7C,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IAClC,CAAC;IAED,qDAAqD;IACrD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,OAAe,EACf,YAAqB;IAErB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEjC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,IAAoC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;gBAC/B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GACT,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK;gBAC7D,CAAC,CAAC,KAAK,CAAC,KAAK;gBACb,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,CACJ,IAAI,eAAe,CAAC;gBAClB,QAAQ,EAAE,aAAa;gBACvB,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC;oBACxC,CAAC,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE;oBACtC,CAAC,CAAC,EAAE,CAAC;gBACP,QAAQ,EAAE,IAAI;gBACd,eAAe,EAAE,KAAK;gBACtB,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO;aACvC,CAAC,CACH,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,YAA+C,CAAC;QACpD,IAAI,UAA6C,CAAC;QAClD,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,OAAkD,CAAC;QACvD,IAAI,kBAA6D,CAAC;QAClE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,UAAU,GAAG,GAAG,EAAE;YACtB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,MAA6B,EAAE,EAAE;YACpE,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,YAAY,CAAC,kBAAkB,CAAC,CAAC;YACjC,6DAA6D;YAC7D,IACE,CAAC,YAAY;gBACb,CAAC,UAAU;gBACX,CAAC,eAAe;gBAChB,CAAC,MAAM;gBACP,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAC5B,CAAC;gBACD,iCAAiC;gBACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;oBAC5C,IAAI,OAAO,EAAE,CAAC;wBACZ,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC;gBACD,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,YAAY,EAAE,KAAK,IAAI,UAAU,EAAE,KAAK,CAAC;gBACvD,MAAM,CACJ,IAAI,eAAe,CAAC;oBAClB,QAAQ,EAAE,eAAe;wBACvB,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,YAAY;4BACZ,CAAC,CAAC,aAAa;4BACf,CAAC,CAAC,MAAM;gCACN,CAAC,CAAC,QAAQ;gCACV,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG;oCAC1B,CAAC,CAAC,cAAc;oCAChB,CAAC,CAAC,aAAa;oBACvB,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC;wBACxC,CAAC,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE;wBACtC,CAAC,CAAC,EAAE,CAAC;oBACP,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBACpC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7B,eAAe;oBACf,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO;iBACvC,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QACF,MAAM,0BAA0B,GAAG,GAAG,EAAE;YACtC,IAAI,kBAAkB;gBAAE,OAAO;YAC/B,kBAAkB,GAAG,UAAU,CAAC,GAAG,EAAE;gBACnC,UAAU,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACzC,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC,CAAC;QACF,MAAM,QAAQ,GACZ,OAAO,GAAG,CAAC;YACT,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;oBACvD,UAAU,EAAE,CAAC;oBACb,0BAA0B,EAAE,CAAC;oBAC7B,OAAO;gBACT,CAAC;gBACD,eAAe,GAAG,IAAI,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrB,2EAA2E;gBAC3E,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;oBACxB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACrB,0BAA0B,EAAE,CAAC;gBAC/B,CAAC,EAAE,IAAI,CAAC,CAAC;YACX,CAAC,EAAE,OAAO,CAAC;YACb,CAAC,CAAC,SAAS,CAAC;QAEhB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAC/B,IAAI,eAAe,IAAI,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC9D,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACvB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,wEAAwE;gBACxE,qEAAqE;gBACrE,UAAU,EAAE,CAAC;gBACb,IAAI,eAAe;oBAAE,0BAA0B,EAAE,CAAC;YACpD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACtC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,+EAA+E;QAC/E,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAErB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEzB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YAChD,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,0EAA0E;QAC1E,4EAA4E;QAC5E,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACtD,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,8CAA8C;QAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAO,GAAG,IAAI;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,QAAmD,CAAC;QACxD,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,EAAE;YACtC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM,KAAK,GACT,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK;gBAC7D,CAAC,CAAC,KAAK,CAAC,KAAK;gBACb,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,CAAC;gBACN,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE;oBACP,QAAQ,EAAE,aAAa;oBACvB,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC;wBACxC,CAAC,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE;wBACtC,CAAC,CAAC,EAAE,CAAC;oBACP,QAAQ,EAAE,IAAI;oBACd,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO;iBACvC;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QACF,IAAI,IAA8B,CAAC;QACnC,IAAI,CAAC;YACH,0EAA0E;YAC1E,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YACzB,eAAe,GAAG,IAAI,CAAC;YACvB,4EAA4E;YAC5E,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,uEAAuE;YACvE,2DAA2D;YAC3D,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;gBACzB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO,CAAC;oBACN,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE;wBACP,QAAQ,EAAE,UAAU;wBACpB,QAAQ,EAAE,IAAI;wBACd,eAAe,EAAE,IAAI;wBACrB,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO;qBACvC;iBACF,CAAC,CAAC;YACL,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACtC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,CACL,QAAQ,KAAK,CAAC,IAAI,CAAC,eAAe;gBAChC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;gBACrB,CAAC,CAAC;oBACE,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE;wBACP,QAAQ,EAAE,eAAe;4BACvB,CAAC,CAAC,UAAU;4BACZ,CAAC,CAAC,MAAM;gCACN,CAAC,CAAC,QAAQ;gCACV,CAAC,CAAC,cAAc;wBACpB,QAAQ;wBACR,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7B,eAAe;wBACf,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO;qBACvC;iBACF,CACN,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,OAAO,CAAC,MAAM,2BAA2B,EAAE,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,cAAc;IACjB,cAAc,CAAkB;IAExC;;;;OAIG;IACH,YAAY,QAAyB;QACnC,4EAA4E;QAC5E,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CACtC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,OAAe;QACpB,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,QAAQ,GAAG,OAAO,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACpC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,KAAc;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IACpC,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAyB;IAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,sBAAsB,CAAC;IAChC,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,SAAS,QAAQ,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAE5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,MAAM,MAAM,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/ai-service/security/vulnerability-triage.d.ts

@@ -0,0 +1,90 @@
+import type { LanguageModelV3 } from "@ai-sdk/provider";
+import { z } from "zod";
+import type { TriageVerdict } from "@superblocksteam/shared";
+import type { LLMClientProviderConfig } from "../llm/client.js";
+declare const TriageClassificationSchema: z.ZodObject<{
+    confidence: z.ZodEnum<["high", "low", "medium"]>;
+    factors: z.ZodOptional<z.ZodObject<{
+        appExposure: z.ZodOptional<z.ZodString>;
+        intendedUse: z.ZodOptional<z.ZodString>;
+        vulnerableFunctionalityInPlay: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        appExposure?: string | undefined;
+        intendedUse?: string | undefined;
+        vulnerableFunctionalityInPlay?: boolean | undefined;
+    }, {
+        appExposure?: string | undefined;
+        intendedUse?: string | undefined;
+        vulnerableFunctionalityInPlay?: boolean | undefined;
+    }>>;
+    reasoning: z.ZodString;
+    verdict: z.ZodEnum<["exploitable", "not_exploitable", "uncertain"]>;
+}, "strip", z.ZodTypeAny, {
+    reasoning: string;
+    confidence: "medium" | "high" | "low";
+    verdict: "exploitable" | "not_exploitable" | "uncertain";
+    factors?: {
+        appExposure?: string | undefined;
+        intendedUse?: string | undefined;
+        vulnerableFunctionalityInPlay?: boolean | undefined;
+    } | undefined;
+}, {
+    reasoning: string;
+    confidence: "medium" | "high" | "low";
+    verdict: "exploitable" | "not_exploitable" | "uncertain";
+    factors?: {
+        appExposure?: string | undefined;
+        intendedUse?: string | undefined;
+        vulnerableFunctionalityInPlay?: boolean | undefined;
+    } | undefined;
+}>;
+type TriageClassification = z.infer<typeof TriageClassificationSchema>;
+type TriageFinding = {
+    advisoryId: string;
+    details?: string;
+    package: string;
+    severity?: string;
+    summary?: string;
+};
+type GenerateTriageObject = (args: {
+    abortSignal?: AbortSignal;
+    context: {
+        mode: "stateless";
+    };
+    model: LanguageModelV3;
+    providerConfig: LLMClientProviderConfig;
+    recordObsContent: false;
+    retry: {
+        maxAttempts: number;
+    };
+    safety: {
+        classification: {
+            enabled: false;
+        };
+        secretRedaction: {
+            level: "off";
+        };
+    };
+    schema: typeof TriageClassificationSchema;
+    system: string;
+    user: {
+        content: string;
+        role: "user";
+    };
+}) => Promise<TriageClassification>;
+/** Bound untrusted advisory text before any model reads it — the triage prompt
+ *  here, and the blocked-install tool result the build agent reads. */
+export declare const ADVISORY_DETAILS_MAX_LENGTH = 8000;
+export declare const ADVISORY_SUMMARY_MAX_LENGTH = 2000;
+export declare function triageVulnerability(args: {
+    abortSignal?: AbortSignal;
+    appContext: string;
+    finding: TriageFinding;
+    generateObject: GenerateTriageObject;
+    model: LanguageModelV3;
+    modelName: string;
+    now?: () => Date;
+    providerConfig: LLMClientProviderConfig;
+}): Promise<TriageVerdict>;
+export {};
+//# sourceMappingURL=vulnerability-triage.d.ts.map

package/dist/ai-service/security/vulnerability-triage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability-triage.d.ts","sourceRoot":"","sources":["../../../src/ai-service/security/vulnerability-triage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW9B,CAAC;AAEH,KAAK,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEvE,KAAK,aAAa,GAAG;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,KAAK,oBAAoB,GAAG,CAAC,IAAI,EAAE;IACjC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,EAAE;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC;IAC/B,KAAK,EAAE,eAAe,CAAC;IACvB,cAAc,EAAE,uBAAuB,CAAC;IACxC,gBAAgB,EAAE,KAAK,CAAC;IACxB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,MAAM,EAAE;QACN,cAAc,EAAE;YAAE,OAAO,EAAE,KAAK,CAAA;SAAE,CAAC;QACnC,eAAe,EAAE;YAAE,KAAK,EAAE,KAAK,CAAA;SAAE,CAAC;KACnC,CAAC;IACF,MAAM,EAAE,OAAO,0BAA0B,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAQpC;uEACuE;AACvE,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAiEjD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,cAAc,EAAE,oBAAoB,CAAC;IACrC,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,cAAc,EAAE,uBAAuB,CAAC;CACzC,GAAG,OAAO,CAAC,aAAa,CAAC,CA+CzB"}