@trenchwork/erosolar 1.1.30 → 1.1.32

package/dist/capabilities/_binaryRequirements.js

@@ -0,0 +1,288 @@
+/**
+ * Single source of truth for every external binary the offsec
+ * capability surface invokes.
+ *
+ * Each entry maps `bin` → install commands (one per bootstrap channel)
+ * + the capability that needs it. Two things consume this manifest:
+ *
+ *   1. `ensureBinary(bin)` (in _processRunner.ts) — the runtime
+ *      preflight every offsec tool handler runs before spawn. Missing
+ *      binary → clean error with the install hint instead of cryptic
+ *      ENOENT.
+ *
+ *   2. `erosolar offsec install` — the operator-facing self-bootstrap.
+ *      Reads the manifest, filters to the active profile's
+ *      capabilities, runs the install command for every missing
+ *      binary after HITL confirmation. Idempotent — already-installed
+ *      bins are skipped.
+ *
+ * `system-unification.test.ts` (Site ↔ Lambda contract test) is
+ * extended to also assert that every binary spawned from
+ * `src/capabilities/*.ts` has an entry here. That catches the "I
+ * added a tool but forgot the install hint" drift that would
+ * otherwise surface as a confused operator running into ENOENT.
+ *
+ * Kali is the assumed default, but the manifest carries cross-platform
+ * commands so a Linux-non-Kali / macOS / Windows operator can also
+ * bootstrap if their OS package manager has the tool.
+ */
+/**
+ * Canonical channel preference order per platform. The first channel
+ * the binary's manifest entry lists in this order is what the
+ * installer will run. `pipx`/`pip`/`npm`/`cargo`/`go`/`gem` are the
+ * cross-platform escape hatches — any binary published to one of
+ * those channels works on every operator OS without needing a Kali
+ * box. `apt` is Debian/Kali/Ubuntu only; `brew` is macOS-first;
+ * `winget` is Windows.
+ */
+export const CHANNEL_PREFERENCE = {
+    linux: ['apt', 'pipx', 'pip', 'npm', 'gem', 'cargo', 'go', 'docker'],
+    darwin: ['brew', 'pipx', 'pip', 'npm', 'gem', 'cargo', 'go', 'docker'],
+    win32: ['winget', 'pipx', 'pip', 'npm', 'gem', 'cargo', 'go', 'docker'],
+    default: ['pipx', 'pip', 'npm', 'apt', 'brew', 'winget', 'gem', 'cargo', 'go', 'docker'],
+};
+// ── Manifest ──────────────────────────────────────────────────────
+//
+// Keep alphabetical within each capability block so the test
+// (system-unification — every spawn has an entry) gives readable
+// diffs when something drifts.
+// Cross-platform availability matrix:
+//   pipx / pip / npm / cargo / go / gem  → all 3 platforms (Linux / macOS / Windows native)
+//   apt                                  → Debian / Ubuntu / Kali only
+//   brew                                 → macOS first-class; works on Linux but unusual
+//   winget                               → Windows-native package manager
+//   docker                               → universal escape hatch
+//
+// Every binary below either:
+//   (a) has a cross-platform channel (pipx / npm / cargo / go / gem) that
+//       works on macOS / Windows / non-Kali Linux without sudo, OR
+//   (b) carries a `notes` entry explaining the platform's recommended
+//       path (typically: WSL2 on Windows, Homebrew on macOS).
+// Operators on macOS / Windows / Ubuntu never need to install Kali to
+// run the offsec capabilities — they install only what their platform
+// supports, and the runtime gracefully degrades for the rest.
+export const BINARY_REQUIREMENTS = [
+    // ─── kali (general offsec) ────────────────────────────────────
+    { bin: 'amass', capability: 'kali', description: 'OWASP Amass — DNS/cert-graph subdomain enumeration.',
+        install: { apt: 'sudo apt-get update && sudo apt-get install -y amass',
+            go: 'go install -v github.com/owasp-amass/amass/v4/...@master',
+            brew: 'brew install amass',
+            docker: 'docker pull caffix/amass' } },
+    { bin: 'feroxbuster', capability: 'kali', description: 'Recursive content / virtual-host fuzzer.',
+        install: { apt: 'sudo apt-get install -y feroxbuster',
+            cargo: 'cargo install feroxbuster',
+            brew: 'brew install feroxbuster',
+            winget: 'winget install epi052.feroxbuster' } },
+    { bin: 'ffuf', capability: 'kali', description: 'Fast web fuzzer (paths / params / vhosts).',
+        install: { apt: 'sudo apt-get install -y ffuf',
+            go: 'go install github.com/ffuf/ffuf/v2@latest',
+            brew: 'brew install ffuf',
+            docker: 'docker pull ffuf/ffuf' } },
+    { bin: 'gobuster', capability: 'kali', description: 'Directory / DNS / vhost bruteforcer.',
+        install: { apt: 'sudo apt-get install -y gobuster',
+            go: 'go install github.com/OJ/gobuster/v3@latest',
+            brew: 'brew install gobuster' } },
+    { bin: 'hashcat', capability: 'kali', description: 'GPU-accelerated password cracker.',
+        install: { apt: 'sudo apt-get install -y hashcat',
+            brew: 'brew install hashcat',
+            winget: 'winget install hashcat.hashcat' },
+        notes: { win32: 'GPU acceleration on Windows requires NVIDIA / AMD drivers + correct hashcat build for your GPU.' } },
+    { bin: 'hydra', capability: 'kali', description: 'Online password brute-forcer (ssh, ftp, http-post-form, …).',
+        install: { apt: 'sudo apt-get install -y hydra',
+            brew: 'brew install hydra',
+            docker: 'docker pull vanhauser/hydra' },
+        notes: { win32: 'No native Windows build — run via WSL2 (`wsl sudo apt install hydra`) or Docker.' } },
+    { bin: 'john', capability: 'kali', description: 'John the Ripper — offline password cracker.',
+        install: { apt: 'sudo apt-get install -y john',
+            brew: 'brew install john',
+            docker: 'docker pull openwall/john' },
+        notes: { win32: 'Use the Jumbo build from openwall.com or run inside WSL2.' } },
+    { bin: 'masscan', capability: 'kali', description: 'Async port scanner — internet-scale speed.',
+        install: { apt: 'sudo apt-get install -y masscan',
+            brew: 'brew install masscan',
+            docker: 'docker pull ilyaglow/masscan' },
+        notes: { win32: 'Raw-socket scanning needs npcap on Windows; WSL2 typically simpler.' } },
+    { bin: 'nikto', capability: 'kali', description: 'Legacy web-server vulnerability scanner.',
+        install: { apt: 'sudo apt-get install -y nikto',
+            brew: 'brew install nikto',
+            docker: 'docker pull frapsoft/nikto' } },
+    { bin: 'sqlmap', capability: 'kali', description: 'Automated SQL-injection exploitation.',
+        install: { apt: 'sudo apt-get install -y sqlmap',
+            pipx: 'pipx install sqlmap',
+            brew: 'brew install sqlmap' } },
+    { bin: 'subfinder', capability: 'kali', description: 'Passive subdomain enumeration (ProjectDiscovery).',
+        install: { apt: 'sudo apt-get install -y subfinder',
+            go: 'go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest',
+            brew: 'brew install subfinder',
+            docker: 'docker pull projectdiscovery/subfinder' } },
+    { bin: 'wpscan', capability: 'kali', description: 'WordPress vulnerability scanner.',
+        install: { apt: 'sudo apt-get install -y wpscan',
+            gem: 'gem install wpscan',
+            brew: 'brew install wpscan',
+            docker: 'docker pull wpscanteam/wpscan' } },
+    // ─── aflpp (coverage-guided fuzzing) ──────────────────────────
+    { bin: 'afl-fuzz', capability: 'aflpp', description: 'AFL++ coverage-guided fuzzer.',
+        install: { apt: 'sudo apt-get install -y afl++',
+            brew: 'brew install afl++',
+            docker: 'docker pull aflplusplus/aflplusplus' },
+        notes: { win32: 'AFL++ does not support Windows directly. Run inside WSL2 or use the aflplusplus/aflplusplus Docker image.' } },
+    { bin: 'afl-showmap', capability: 'aflpp', description: 'AFL++ coverage-map dumper.',
+        install: { apt: 'sudo apt-get install -y afl++',
+            brew: 'brew install afl++',
+            docker: 'docker pull aflplusplus/aflplusplus' } },
+    { bin: 'afl-cmin', capability: 'aflpp', description: 'AFL++ corpus minimizer.',
+        install: { apt: 'sudo apt-get install -y afl++',
+            brew: 'brew install afl++' } },
+    { bin: 'afl-tmin', capability: 'aflpp', description: 'AFL++ test-case minimizer.',
+        install: { apt: 'sudo apt-get install -y afl++',
+            brew: 'brew install afl++' } },
+    { bin: 'afl-clang-fast', capability: 'aflpp', description: 'AFL++ instrumented LLVM compiler.', optional: true,
+        install: { apt: 'sudo apt-get install -y afl++-clang',
+            brew: 'brew install afl++' } },
+    { bin: 'afl-clang-lto', capability: 'aflpp', description: 'AFL++ LTO-instrumented compiler.', optional: true,
+        install: { apt: 'sudo apt-get install -y afl++-clang',
+            brew: 'brew install afl++' } },
+    // ─── gdb (binary triage) ──────────────────────────────────────
+    { bin: 'gdb', capability: 'gdb', description: 'GNU debugger (use with pwndbg or GEF for offsec workflow).',
+        install: { apt: 'sudo apt-get install -y gdb',
+            brew: 'brew install gdb' },
+        notes: {
+            darwin: 'macOS requires code-signing the gdb binary; lldb is the supported alternative on Apple Silicon.',
+            win32: 'No native Windows build — use MinGW gdb or WSL2.',
+        } },
+    // pwndbg / GEF are gdb extensions — installed via their .gdbinit.
+    // Tracked optional so the audit doesn't fail when only gdb is present.
+    { bin: 'pwndbg', capability: 'gdb', description: 'Augmented gdb plugin (heap / rop / vmmap commands).', optional: true,
+        install: { apt: 'sudo apt-get install -y pwndbg',
+            pip: 'pip install --user pwndbg' } },
+    // ─── pwntools (exploit dev) ───────────────────────────────────
+    { bin: 'python3', capability: 'pwntools', description: 'Python 3 — runs pwntools scripts.',
+        install: { apt: 'sudo apt-get install -y python3 python3-pip python3-venv',
+            brew: 'brew install python@3.12',
+            winget: 'winget install Python.Python.3.12' } },
+    { bin: 'pwn', capability: 'pwntools', description: 'pwntools CLI — gadget / shellcode helpers.',
+        install: { pipx: 'pipx install pwntools',
+            pip: 'pip install --user pwntools',
+            apt: 'sudo apt-get install -y python3-pwntools' } },
+    // ─── binaryAnalysis ───────────────────────────────────────────
+    { bin: 'objdump', capability: 'binaryAnalysis', description: 'GNU objdump — section / disasm dumps.',
+        install: { apt: 'sudo apt-get install -y binutils',
+            brew: 'brew install binutils',
+            winget: 'winget install GnuWin32.Binutils' } },
+    { bin: 'readelf', capability: 'binaryAnalysis', description: 'GNU readelf — ELF header / section walker.',
+        install: { apt: 'sudo apt-get install -y binutils',
+            brew: 'brew install binutils' } },
+    { bin: 'r2', capability: 'binaryAnalysis', description: 'radare2 — interactive RE framework (CLI).',
+        install: { apt: 'sudo apt-get install -y radare2',
+            brew: 'brew install radare2',
+            winget: 'winget install radare.radare2' } },
+    { bin: 'checksec', capability: 'binaryAnalysis', description: 'ELF security-feature audit (RELRO, NX, PIE, …).',
+        install: { apt: 'sudo apt-get install -y checksec',
+            pipx: 'pipx install checksec.py',
+            brew: 'brew install checksec' } },
+    { bin: 'file', capability: 'binaryAnalysis', description: 'libmagic-based file-type identification.',
+        install: { apt: 'sudo apt-get install -y file',
+            brew: 'brew install file-formula' },
+        notes: { win32: 'Bundled inside Git-for-Windows or available via MSYS2 — no winget package.' } },
+    { bin: 'strings', capability: 'binaryAnalysis', description: 'Print printable strings from object / executable files (binutils).',
+        install: { apt: 'sudo apt-get install -y binutils',
+            brew: 'brew install binutils',
+            winget: 'winget install GnuWin32.Binutils' } },
+    { bin: 'nm', capability: 'binaryAnalysis', description: 'List symbols from object files (binutils).',
+        install: { apt: 'sudo apt-get install -y binutils',
+            brew: 'brew install binutils',
+            winget: 'winget install GnuWin32.Binutils' } },
+    { bin: 'ROPgadget', capability: 'binaryAnalysis', description: 'ROP-gadget search across ELF / PE / Mach-O.',
+        install: { pipx: 'pipx install ROPGadget',
+            pip: 'pip install --user ROPGadget',
+            apt: 'sudo apt-get install -y python3-ropgadget' } },
+    // ─── ghidra ───────────────────────────────────────────────────
+    { bin: 'analyzeHeadless', capability: 'ghidra', description: 'NSA Ghidra headless analyser.',
+        install: { apt: 'sudo apt-get install -y ghidra',
+            brew: 'brew install --cask ghidra',
+            winget: 'winget install nsa.ghidra',
+            docker: 'docker pull blacktop/ghidra' } },
+    // ─── llmRedteam (cross-platform pure-Python / pure-Node) ──────
+    { bin: 'garak', capability: 'llmRedteam', description: 'LLM vulnerability scanner — prompt-injection / jailbreak / leakage probes.',
+        install: {
+            pipx: 'pipx install garak',
+            pip: 'pip install --user garak',
+            docker: 'docker pull leondz/garak',
+        } },
+    { bin: 'promptfoo', capability: 'llmRedteam', description: 'LLM eval framework — `redteam` subcommand auto-generates jailbreak / harmful / PII probes.',
+        install: {
+            npm: 'npm install -g promptfoo',
+            brew: 'brew install promptfoo',
+        } },
+];
+// ── Lookup helpers ───────────────────────────────────────────────
+const REQ_BY_BIN = new Map(BINARY_REQUIREMENTS.map((r) => [r.bin, r]));
+export function findRequirement(bin) {
+    return REQ_BY_BIN.get(bin) ?? null;
+}
+export function requirementsForCapability(capability) {
+    return BINARY_REQUIREMENTS.filter((r) => r.capability === capability);
+}
+/**
+ * Choose the install command for a given platform. Walks the
+ * platform's preferred channel order; returns the first channel the
+ * requirement has a command for. Returns null when no channel matches
+ * (extremely rare — every entry should have at least one command).
+ */
+export function pickInstallCommand(req, platform = process.platform) {
+    const order = CHANNEL_PREFERENCE[platform] || CHANNEL_PREFERENCE.default;
+    for (const ch of order) {
+        const cmd = req.install[ch];
+        if (cmd)
+            return { channel: ch, cmd };
+    }
+    // Fall through to ANY channel if the platform-preferred order has none.
+    for (const ch of Object.keys(req.install)) {
+        const cmd = req.install[ch];
+        if (cmd)
+            return { channel: ch, cmd };
+    }
+    return null;
+}
+/** Returns true when at least one platform install command exists. */
+export function hasInstallCommand(req) {
+    for (const ch of Object.keys(req.install)) {
+        if (req.install[ch])
+            return true;
+    }
+    return false;
+}
+/**
+ * Platform-availability heuristic. Returns true when the requirement
+ * has a channel that's actually usable on the given platform — i.e.
+ * the operator can plausibly install it without WSL/Docker.
+ *
+ *   linux  → any of: apt, pipx, pip, npm, cargo, go, gem
+ *   darwin → any of: brew, pipx, pip, npm, cargo, go, gem
+ *   win32  → any of: winget, pipx, pip, npm, cargo, go, gem
+ *
+ * Tools that are Linux-only at the source level (afl-fuzz, gdb without
+ * code-signing on macOS, hydra) carry a `notes` entry pointing at the
+ * WSL2 / Docker path. The installer surfaces those notes so the
+ * operator knows they need to take a manual route.
+ */
+export function isNativelyAvailable(req, platform = process.platform) {
+    const exclusiveChannels = {
+        linux: new Set(['apt', 'pipx', 'pip', 'npm', 'cargo', 'go', 'gem']),
+        darwin: new Set(['brew', 'pipx', 'pip', 'npm', 'cargo', 'go', 'gem']),
+        win32: new Set(['winget', 'pipx', 'pip', 'npm', 'cargo', 'go', 'gem']),
+    };
+    const allowed = exclusiveChannels[platform];
+    if (!allowed)
+        return hasInstallCommand(req);
+    for (const ch of Object.keys(req.install)) {
+        if (req.install[ch] && allowed.has(ch))
+            return true;
+    }
+    return false;
+}
+/** Note for the operator's platform, if any. */
+export function platformNote(req, platform = process.platform) {
+    return req.notes?.[platform] ?? null;
+}
+//# sourceMappingURL=_binaryRequirements.js.map

package/dist/capabilities/_binaryRequirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_binaryRequirements.js","sourceRoot":"","sources":["../../src/capabilities/_binaryRequirements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAmCH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0D;IACvF,KAAK,EAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC;IACtE,MAAM,EAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC;IACvE,KAAK,EAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC;IACzE,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC;CAChC,CAAC;AAE3D,qEAAqE;AACrE,EAAE;AACF,6DAA6D;AAC7D,iEAAiE;AACjE,+BAA+B;AAE/B,sCAAsC;AACtC,4FAA4F;AAC5F,uEAAuE;AACvE,yFAAyF;AACzF,0EAA0E;AAC1E,kEAAkE;AAClE,EAAE;AACF,6BAA6B;AAC7B,0EAA0E;AAC1E,mEAAmE;AACnE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAE9D,MAAM,CAAC,MAAM,mBAAmB,GAAqC;IACnE,iEAAiE;IACjE,EAAE,GAAG,EAAE,OAAO,EAAS,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,qDAAqD;QAC3G,OAAO,EAAE,EAAE,GAAG,EAAE,sDAAsD;YAC3D,EAAE,EAAE,0DAA0D;YAC9D,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,0BAA0B,EAAE,EAAE;IACnD,EAAE,GAAG,EAAE,aAAa,EAAG,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,0CAA0C;QAChG,OAAO,EAAE,EAAE,GAAG,EAAE,qCAAqC;YAC1C,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,mCAAmC,EAAE,EAAE;IAC5D,EAAE,GAAG,EAAE,MAAM,EAAU,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,4CAA4C;QAClG,OAAO,EAAE,EAAE,GAAG,EAAE,8BAA8B;YACnC,EAAE,EAAE,2CAA2C;YAC/C,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,uBAAuB,EAAE,EAAE;IAChD,EAAE,GAAG,EAAE,UAAU,EAAM,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,sCAAsC;QAC5F,OAAO,EAAE,EAAE,GAAG,EAAE,kCAAkC;YACvC,EAAE,EAAE,6CAA6C;YACjD,IAAI,EAAE,uBAAuB,EAAE,EAAE;IAC9C,EAAE,GAAG,EAAE,SAAS,EAAO,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,mCAAmC;QACzF,OAAO,EAAE,EAAE,GAAG,EAAE,iCAAiC;YACtC,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,gCAAgC,EAAE;QACrD,KAAK,EAAE,EAAE,KAAK,EAAE,iGAAiG,EAAE,EAAE;IACvH,EAAE,GAAG,EAAE,OAAO,EAAS,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,6DAA6D;QACnH,OAAO,EAAE,EAAE,GAAG,EAAE,+BAA+B;YACpC,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,6BAA6B,EAAE;QAClD,KAAK,EAAE,EAAE,KAAK,EAAE,kFAAkF,EAAE,EAAE;IACxG,EAAE,GAAG,EAAE,MAAM,EAAU,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,6CAA6C;QACnG,OAAO,EAAE,EAAE,GAAG,EAAE,8BAA8B;YACnC,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,2BAA2B,EAAE;QAChD,KAAK,EAAE,EAAE,KAAK,EAAE,2DAA2D,EAAE,EAAE;IACjF,EAAE,GAAG,EAAE,SAAS,EAAO,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,4CAA4C;QAClG,OAAO,EAAE,EAAE,GAAG,EAAE,iCAAiC;YACtC,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,8BAA8B,EAAE;QACnD,KAAK,EAAE,EAAE,KAAK,EAAE,qEAAqE,EAAE,EAAE;IAC3F,EAAE,GAAG,EAAE,OAAO,EAAS,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,0CAA0C;QAChG,OAAO,EAAE,EAAE,GAAG,EAAE,+BAA+B;YACpC,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,4BAA4B,EAAE,EAAE;IACrD,EAAE,GAAG,EAAE,QAAQ,EAAQ,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,uCAAuC;QAC7F,OAAO,EAAE,EAAE,GAAG,EAAE,gCAAgC;YACrC,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,qBAAqB,EAAE,EAAE;IAC5C,EAAE,GAAG,EAAE,WAAW,EAAK,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,mDAAmD;QACzG,OAAO,EAAE,EAAE,GAAG,EAAE,mCAAmC;YACxC,EAAE,EAAE,6EAA6E;YACjF,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,wCAAwC,EAAE,EAAE;IACjE,EAAE,GAAG,EAAE,QAAQ,EAAQ,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,kCAAkC;QACxF,OAAO,EAAE,EAAE,GAAG,EAAE,gCAAgC;YACrC,GAAG,EAAE,oBAAoB;YACzB,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,+BAA+B,EAAE,EAAE;IAExD,iEAAiE;IACjE,EAAE,GAAG,EAAE,UAAU,EAAM,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,+BAA+B;QACtF,OAAO,EAAE,EAAE,GAAG,EAAE,+BAA+B;YACpC,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,qCAAqC,EAAE;QAC1D,KAAK,EAAE,EAAE,KAAK,EAAE,2GAA2G,EAAE,EAAE;IACjI,EAAE,GAAG,EAAE,aAAa,EAAG,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,4BAA4B;QACnF,OAAO,EAAE,EAAE,GAAG,EAAE,+BAA+B;YACpC,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,qCAAqC,EAAE,EAAE;IAC9D,EAAE,GAAG,EAAE,UAAU,EAAM,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,yBAAyB;QAChF,OAAO,EAAE,EAAE,GAAG,EAAE,+BAA+B;YACpC,IAAI,EAAE,oBAAoB,EAAE,EAAE;IAC3C,EAAE,GAAG,EAAE,UAAU,EAAM,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,4BAA4B;QACnF,OAAO,EAAE,EAAE,GAAG,EAAE,+BAA+B;YACpC,IAAI,EAAE,oBAAoB,EAAE,EAAE;IAC3C,EAAE,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI;QAC5G,OAAO,EAAE,EAAE,GAAG,EAAE,qCAAqC;YAC1C,IAAI,EAAE,oBAAoB,EAAE,EAAE;IAC3C,EAAE,GAAG,EAAE,eAAe,EAAG,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,kCAAkC,EAAE,QAAQ,EAAE,IAAI;QAC3G,OAAO,EAAE,EAAE,GAAG,EAAE,qCAAqC;YAC1C,IAAI,EAAE,oBAAoB,EAAE,EAAE;IAE3C,iEAAiE;IACjE,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,4DAA4D;QACxG,OAAO,EAAE,EAAE,GAAG,EAAE,6BAA6B;YAClC,IAAI,EAAE,kBAAkB,EAAE;QACrC,KAAK,EAAE;YACL,MAAM,EAAE,iGAAiG;YACzG,KAAK,EAAE,kDAAkD;SAC1D,EAAE;IACL,kEAAkE;IAClE,uEAAuE;IACvE,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,qDAAqD,EAAE,QAAQ,EAAE,IAAI;QACpH,OAAO,EAAE,EAAE,GAAG,EAAE,gCAAgC;YACrC,GAAG,EAAE,2BAA2B,EAAE,EAAE;IAEjD,iEAAiE;IACjE,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,mCAAmC;QACxF,OAAO,EAAE,EAAE,GAAG,EAAE,0DAA0D;YAC/D,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,mCAAmC,EAAE,EAAE;IAC5D,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,4CAA4C;QAC7F,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB;YAC7B,GAAG,EAAE,6BAA6B;YAClC,GAAG,EAAE,0CAA0C,EAAE,EAAE;IAEhE,iEAAiE;IACjE,EAAE,GAAG,EAAE,SAAS,EAAG,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,uCAAuC;QACnG,OAAO,EAAE,EAAE,GAAG,EAAE,kCAAkC;YACvC,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,kCAAkC,EAAE,EAAE;IAC3D,EAAE,GAAG,EAAE,SAAS,EAAG,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,4CAA4C;QACxG,OAAO,EAAE,EAAE,GAAG,EAAE,kCAAkC;YACvC,IAAI,EAAE,uBAAuB,EAAE,EAAE;IAC9C,EAAE,GAAG,EAAE,IAAI,EAAQ,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,2CAA2C;QACvG,OAAO,EAAE,EAAE,GAAG,EAAE,iCAAiC;YACtC,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,+BAA+B,EAAE,EAAE;IACxD,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,iDAAiD;QAC7G,OAAO,EAAE,EAAE,GAAG,EAAE,kCAAkC;YACvC,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE,uBAAuB,EAAE,EAAE;IAC9C,EAAE,GAAG,EAAE,MAAM,EAAM,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,0CAA0C;QACtG,OAAO,EAAE,EAAE,GAAG,EAAE,8BAA8B;YACnC,IAAI,EAAE,2BAA2B,EAAE;QAC9C,KAAK,EAAE,EAAE,KAAK,EAAE,4EAA4E,EAAE,EAAE;IAClG,EAAE,GAAG,EAAE,SAAS,EAAG,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,oEAAoE;QAChI,OAAO,EAAE,EAAE,GAAG,EAAE,kCAAkC;YACvC,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,kCAAkC,EAAE,EAAE;IAC3D,EAAE,GAAG,EAAE,IAAI,EAAQ,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,4CAA4C;QACxG,OAAO,EAAE,EAAE,GAAG,EAAE,kCAAkC;YACvC,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,kCAAkC,EAAE,EAAE;IAC3D,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,6CAA6C;QAC1G,OAAO,EAAE,EAAE,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,8BAA8B;YACnC,GAAG,EAAE,2CAA2C,EAAE,EAAE;IAEjE,iEAAiE;IACjE,EAAE,GAAG,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B;QAC1F,OAAO,EAAE,EAAE,GAAG,EAAE,gCAAgC;YACrC,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,2BAA2B;YACnC,MAAM,EAAE,6BAA6B,EAAE,EAAE;IAEtD,iEAAiE;IACjE,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,4EAA4E;QACjI,OAAO,EAAE;YACP,IAAI,EAAE,oBAAoB;YAC1B,GAAG,EAAE,0BAA0B;YAC/B,MAAM,EAAE,0BAA0B;SACnC,EAAE;IACL,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,4FAA4F;QACrJ,OAAO,EAAE;YACP,GAAG,EAAE,0BAA0B;YAC/B,IAAI,EAAE,wBAAwB;SAC/B,EAAE;CACN,CAAC;AAEF,oEAAoE;AAEpE,MAAM,UAAU,GACd,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAEtD,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAsB,EACtB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC;IACzE,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IACvC,CAAC;IACD,wEAAwE;IACxE,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAqB,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,GAAsB;IACtD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAqB,EAAE,CAAC;QAC9D,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAsB,EACtB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,iBAAiB,GAAkE;QACvF,KAAK,EAAE,IAAI,GAAG,CAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACnF,MAAM,EAAE,IAAI,GAAG,CAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACrF,KAAK,EAAE,IAAI,GAAG,CAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KACvF,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO;QAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAqB,EAAE,CAAC;QAC9D,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAC1B,GAAsB,EACtB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;AACvC,CAAC"}

package/dist/capabilities/_opsContext.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Operations-Center wiring for offsec capabilities.
+ *
+ * Every offsec tool wrapper (recon / web / llmRedteam / network / mobile)
+ * shares this single helper. It abstracts:
+ *
+ *   • Engagement-scope enforcement (defence-in-depth — the Lambda
+ *     re-checks server-side, but a CLI-side gate trips faster + emits
+ *     a clearer error before any process spawns).
+ *   • Long-running job lifecycle (start → append-log → progress →
+ *     complete) routed through the existing cliJob* Lambda surface,
+ *     which the portal's #jobsList rail listens to via Firestore.
+ *   • HITL approval prompts (cliQuestionCreate / cliQuestionPoll) for
+ *     destructive ops, so the operator can veto from the portal.
+ *   • Findings emission with a unified schema — every tool's output
+ *     normalised so the portal's #findingsList rail renders without
+ *     per-tool special-casing.
+ *
+ * Tools that own a long-running scan should:
+ *
+ *   const job = await opsCtx.startJob({ tool: 'garak', kind: 'llmRedteam',
+ *                                       targetId, cmd: ['garak', ...] });
+ *   for await (const line of job.lines()) {
+ *     await job.appendLog(line);
+ *     const finding = parse(line);
+ *     if (finding) await opsCtx.emitFinding(finding);
+ *   }
+ *   await job.complete('done', { probesRun: N, findingsEmitted: M });
+ *
+ * The `lines()` iterator is backed by the existing Monitor capability
+ * (background spawn + streaming reader). Multiple jobs run concurrently
+ * without blocking the agent loop.
+ */
+export type FindingSeverity = 'info' | 'low' | 'medium' | 'high' | 'critical';
+export type FindingSource = 'recon' | 'web' | 'llmRedteam' | 'network' | 'mobile' | 'manual';
+export type FindingStatus = 'new' | 'validated' | 'duplicate' | 'invalid' | 'reported' | 'closed';
+export interface FindingDraft {
+    engagementId?: string | null;
+    targetId?: string | null;
+    source: FindingSource;
+    tool: string;
+    severity: FindingSeverity;
+    title: string;
+    description: string;
+    /** Exact reproducer (curl line, garak invocation, nmap line). */
+    replication: string;
+    evidence?: {
+        request?: string;
+        response?: string;
+        transcript?: string;
+        screenshot?: string;
+        pcap?: string;
+        paths?: string[];
+        raw?: unknown;
+    };
+    cwe?: string;
+    cvss?: {
+        vector: string;
+        score: number;
+    };
+    jobId?: string;
+}
+export interface ScopeTarget {
+    host?: string;
+    cidr?: string;
+    url?: string;
+    /** LLM endpoint (e.g. an https URL pointing at /v1/chat/completions). */
+    endpoint?: string;
+}
+export interface JobSpec {
+    tool: string;
+    kind: string;
+    cmd: string[];
+    targetId?: string | null;
+    engagementId?: string | null;
+    /** Optional cwd for the spawn. */
+    cwd?: string;
+    /** Optional env overlay. */
+    env?: Record<string, string>;
+    /** Hard timeout in ms (default 30 min). */
+    timeoutMs?: number;
+}
+export interface JobHandle {
+    readonly id: string;
+    /** Async iterator over stdout+stderr lines. */
+    lines(): AsyncIterableIterator<string>;
+    appendLog(line: string): Promise<void>;
+    setProgress(pct: number, lastLine?: string): Promise<void>;
+    complete(status: 'done' | 'failed' | 'cancelled', summary?: object): Promise<void>;
+    /** Force-kill the underlying process. */
+    cancel(): void;
+}
+export interface ApprovalRequest {
+    severity: 'risky' | 'destructive';
+    question: string;
+    /** Single-select; 2..9 options. The first option is the safe default. */
+    options: Array<{
+        label: string;
+        description?: string;
+    }>;
+    /** How long to wait for an answer before falling back. Default 300s. */
+    timeoutSec?: number;
+    /** Action to take if the operator does not answer in time. */
+    defaultOnTimeout?: 'proceed' | 'abort';
+}
+export interface OpsContext {
+    /** Current engagement (set when the operator selects one in the portal). */
+    readonly engagementId: string | null;
+    readonly uid: string | null;
+    /** Throw if `target` is outside the engagement's allowed scope. */
+    assertInScope(target: ScopeTarget): Promise<void>;
+    /** Spawn a long-running tool, register a Job doc, return a streaming handle. */
+    startJob(spec: JobSpec): Promise<JobHandle>;
+    /** Block on operator HITL approval; resolves to the chosen option label. */
+    requestApproval(req: ApprovalRequest): Promise<string>;
+    /** Persist a finding under the user's findings collection. */
+    emitFinding(draft: FindingDraft): Promise<string>;
+}
+export interface NodeOpsContextOptions {
+    engagementId?: string | null;
+    uid?: string | null;
+}
+/**
+ * Build an OpsContext for a CLI agent session. The engagementId can be
+ * threaded in from the active engagement (set via the portal or
+ * EngagementCapability tool calls).
+ */
+export declare function createOpsContext(opts?: NodeOpsContextOptions): OpsContext;
+//# sourceMappingURL=_opsContext.d.ts.map

package/dist/capabilities/_opsContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_opsContext.d.ts","sourceRoot":"","sources":["../../src/capabilities/_opsContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AASH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAC9E,MAAM,MAAM,aAAa,GACrB,OAAO,GAAG,KAAK,GAAG,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AACrE,MAAM,MAAM,aAAa,GACrB,KAAK,GAAG,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE1E,MAAM,WAAW,YAAY;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,EAAE,OAAO,CAAC;KACf,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACvC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,yCAAyC;IACzC,MAAM,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,GAAG,aAAa,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,UAAU;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mEAAmE;IACnE,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,4EAA4E;IAC5E,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,8DAA8D;IAC9D,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAyED,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AA4ID;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,qBAA0B,GAAG,UAAU,CAE7E"}