bla-agents 0.0.0-stage → 1.5.3

package/dist/core/debug-posture.js

@@ -0,0 +1,197 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+/**
+ * Read-only production debug exposure inspector (Issue #19).
+ *
+ * Inspects authorized local build/deployment configuration files to identify
+ * unnecessary debug/inspector entry points (`--inspect`, `--remote-debugging-port`,
+ * `com.apple.security.get-task-allow`, `android:debuggable="true"`).
+ *
+ * Never probes network ports, never attaches to processes, and never claims that
+ * client-side JS markers can block Frida/GDB/CDP when the observer holds OS privileges.
+ */
+export function inspectProductionDebugPosture(options) {
+    const rootDir = resolve(options.targetDir);
+    const pkgPath = options.packageJsonPath
+        ? resolve(options.packageJsonPath)
+        : join(rootDir, "package.json");
+    const envPath = options.envFilePath
+        ? resolve(options.envFilePath)
+        : join(rootDir, ".env.production");
+    const entitlementsPath = options.macosEntitlementsPath
+        ? resolve(options.macosEntitlementsPath)
+        : join(rootDir, "entitlements.plist");
+    const androidManifestPath = options.androidManifestPath
+        ? resolve(options.androidManifestPath)
+        : join(rootDir, "AndroidManifest.xml");
+    const checks = [];
+    // 1. Node CLI inspector & NODE_OPTIONS check
+    {
+        const sources = [];
+        const exposedFlags = [];
+        if (existsSync(pkgPath) && statSync(pkgPath).isFile()) {
+            try {
+                const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+                if (pkg.scripts && typeof pkg.scripts === "object") {
+                    for (const [name, cmd] of Object.entries(pkg.scripts)) {
+                        if (typeof cmd !== "string")
+                            continue;
+                        // Focus on production/start/serve/pack scripts or all scripts
+                        if (/(^|[\s"'])(--inspect(?:-brk|-port)?|ELECTRON_RUN_AS_NODE=1)\b/.test(cmd)) {
+                            exposedFlags.push(`package.json#scripts.${name}: "${cmd}"`);
+                        }
+                    }
+                    sources.push("package.json#scripts");
+                }
+            }
+            catch {
+                // Ignore malformed package.json here; status falls back if no valid sources
+            }
+        }
+        if (existsSync(envPath) && statSync(envPath).isFile()) {
+            const envText = readFileSync(envPath, "utf8");
+            sources.push(".env.production");
+            if (/(--inspect(?:-brk|-port)?|ELECTRON_RUN_AS_NODE\s*=\s*1)/.test(envText)) {
+                exposedFlags.push(`.env.production contains inspector/run-as-node directive`);
+            }
+        }
+        const status = exposedFlags.length > 0
+            ? "exposed"
+            : sources.length > 0
+                ? "not-observed"
+                : "unknown";
+        checks.push({
+            id: "node-cli-inspector-exposure",
+            platform: "cross-platform",
+            status,
+            observedConfig: exposedFlags.length > 0
+                ? exposedFlags.join("; ")
+                : sources.length > 0
+                    ? `Inspected ${sources.join(", ")}; no --inspect or ELECTRON_RUN_AS_NODE flags found.`
+                    : "No package.json or .env.production found to verify Node launch flags.",
+            restrictedChannel: "Node.js V8 Inspector WebSocket (--inspect / NODE_OPTIONS)",
+            remediation: "Remove --inspect, --inspect-brk, and ELECTRON_RUN_AS_NODE=1 from production start scripts and environment files, and disable RunAsNode / EnableNodeCliInspectArguments in Electron fuses.",
+        });
+    }
+    // 2. Chromium / WebView remote debugging port exposure
+    {
+        const sources = [];
+        const exposedFlags = [];
+        if (existsSync(pkgPath) && statSync(pkgPath).isFile()) {
+            try {
+                const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+                if (pkg.scripts && typeof pkg.scripts === "object") {
+                    for (const [name, cmd] of Object.entries(pkg.scripts)) {
+                        if (typeof cmd !== "string")
+                            continue;
+                        if (/--remote-debugging-(?:port|pipe|address)|--remote-allow-origins/.test(cmd)) {
+                            exposedFlags.push(`package.json#scripts.${name}: "${cmd}"`);
+                        }
+                    }
+                    sources.push("package.json#scripts");
+                }
+            }
+            catch {
+                // Ignore
+            }
+        }
+        const status = exposedFlags.length > 0
+            ? "exposed"
+            : sources.length > 0
+                ? "not-observed"
+                : "unknown";
+        checks.push({
+            id: "chromium-remote-debugging-exposure",
+            platform: "cross-platform",
+            status,
+            observedConfig: exposedFlags.length > 0
+                ? exposedFlags.join("; ")
+                : sources.length > 0
+                    ? `Inspected ${sources.join(", ")}; no --remote-debugging-port flags found.`
+                    : "No launch configuration found to verify Chromium remote debugging flags.",
+            restrictedChannel: "Chrome DevTools Protocol (CDP) HTTP/WebSocket endpoint",
+            remediation: "Remove --remote-debugging-port and --remote-allow-origins from production launch scripts and BrowserWindow startup switches.",
+        });
+    }
+    // 3. macOS Entitlements / Hardened Runtime debug posture
+    {
+        if (existsSync(entitlementsPath) && statSync(entitlementsPath).isFile()) {
+            const xml = readFileSync(entitlementsPath, "utf8");
+            const riskyKeys = [
+                "com.apple.security.get-task-allow",
+                "com.apple.security.cs.allow-dyld-environment-variables",
+                "com.apple.security.cs.disable-library-validation",
+                "com.apple.security.cs.allow-unsigned-executable-memory",
+            ];
+            const enabledKeys = riskyKeys.filter((key) => {
+                const regex = new RegExp(`<key>\\s*${key.replace(/\./g, "\\.")}\\s*</key>\\s*<true\\s*/>`, "i");
+                return regex.test(xml);
+            });
+            checks.push({
+                id: "macos-entitlements-debug-posture",
+                platform: "macos",
+                status: enabledKeys.length > 0 ? "exposed" : "not-observed",
+                observedConfig: enabledKeys.length > 0
+                    ? `Enabled debug/injection entitlements in ${entitlementsPath}: ${enabledKeys.join(", ")}`
+                    : `Inspected ${entitlementsPath}; get-task-allow and dyld injection entitlements are not enabled.`,
+                restrictedChannel: "macOS task_for_pid / LLDB / Frida attach & DYLD_INSERT_LIBRARIES",
+                remediation: "Set com.apple.security.get-task-allow, allow-dyld-environment-variables, and disable-library-validation to false (or remove them) in production release entitlements with Hardened Runtime enabled.",
+            });
+        }
+        else {
+            checks.push({
+                id: "macos-entitlements-debug-posture",
+                platform: "macos",
+                status: "unknown",
+                observedConfig: "No macOS entitlements.plist provided or discovered in target directory.",
+                restrictedChannel: "macOS task_for_pid / LLDB / Frida attach & DYLD_INSERT_LIBRARIES",
+                remediation: "Provide macosEntitlementsPath to verify that com.apple.security.get-task-allow is omitted in release builds.",
+            });
+        }
+    }
+    // 4. Android Manifest debuggable posture
+    {
+        if (existsSync(androidManifestPath) && statSync(androidManifestPath).isFile()) {
+            const xml = readFileSync(androidManifestPath, "utf8");
+            const isDebuggable = /android:debuggable\s*=\s*["']true["']/i.test(xml);
+            checks.push({
+                id: "android-manifest-debuggable-posture",
+                platform: "android",
+                status: isDebuggable ? "exposed" : "not-observed",
+                observedConfig: isDebuggable
+                    ? `android:debuggable="true" observed in ${androidManifestPath}`
+                    : `Inspected ${androidManifestPath}; android:debuggable="true" is not set.`,
+                restrictedChannel: "Android JDWP / run-as / Frida gadget attach on non-rooted devices",
+                remediation: "Ensure android:debuggable=\"false\" in release buildTypes in build.gradle / AndroidManifest.xml.",
+            });
+        }
+        else {
+            checks.push({
+                id: "android-manifest-debuggable-posture",
+                platform: "android",
+                status: "unknown",
+                observedConfig: "No AndroidManifest.xml provided or discovered in target directory.",
+                restrictedChannel: "Android JDWP / run-as / Frida gadget attach on non-rooted devices",
+                remediation: "Provide androidManifestPath to verify that android:debuggable is false in release builds.",
+            });
+        }
+    }
+    const overallPosture = checks.some((c) => c.status === "exposed")
+        ? "exposed"
+        : checks.some((c) => c.status === "not-observed")
+            ? "not-observed"
+            : "unknown";
+    return {
+        targetPath: rootDir,
+        overallPosture,
+        checks,
+        runtimeBoundaryContract: {
+            shadowObjectsClassification: "decorative-deception-signal",
+            absenceOfRuntimeMarkersImpliesNoDebugger: false,
+            blocksFridaOrGdbWithLocalPrivileges: false,
+            blocksRuntimeStateRecovery: false,
+            secretStorageGuidance: "BLA JavaScript runtime shields cannot guarantee confidentiality of plaintext or decryption keys held by a client process when the observer has OS-level debugging/instrumentation permissions (e.g., Frida, GDB, LLDB, or root/admin access). Keep authoritative access control and long-lived secrets in trusted server or hardware boundaries.",
+        },
+    };
+}
+//# sourceMappingURL=debug-posture.js.map

package/dist/core/debug-posture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-posture.js","sourceRoot":"","sources":["../../src/core/debug-posture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsC1C;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAmC;IAEnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe;QACrC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW;QACjC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACrC,MAAM,gBAAgB,GAAG,OAAO,CAAC,qBAAqB;QACpD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACxC,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB;QACrD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAEzC,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,6CAA6C;IAC7C,CAAC;QACC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAEnD,CAAC;gBACF,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACnD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;wBACtD,IAAI,OAAO,GAAG,KAAK,QAAQ;4BAAE,SAAS;wBACtC,8DAA8D;wBAC9D,IAAI,+DAA+D,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC9E,YAAY,CAAC,IAAI,CAAC,wBAAwB,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC;wBAC9D,CAAC;oBACH,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4EAA4E;YAC9E,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAChC,IAAI,yDAAyD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5E,YAAY,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAClB,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,SAAS,CAAC;QAElB,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,6BAA6B;YACjC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM;YACN,cAAc,EACZ,YAAY,CAAC,MAAM,GAAG,CAAC;gBACrB,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzB,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;oBAClB,CAAC,CAAC,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qDAAqD;oBACtF,CAAC,CAAC,uEAAuE;YAC/E,iBAAiB,EAAE,2DAA2D;YAC9E,WAAW,EACT,2LAA2L;SAC9L,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,CAAC;QACC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAEnD,CAAC;gBACF,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACnD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;wBACtD,IAAI,OAAO,GAAG,KAAK,QAAQ;4BAAE,SAAS;wBACtC,IAAI,iEAAiE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;4BAChF,YAAY,CAAC,IAAI,CAAC,wBAAwB,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC;wBAC9D,CAAC;oBACH,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAClB,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,SAAS,CAAC;QAElB,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,oCAAoC;YACxC,QAAQ,EAAE,gBAAgB;YAC1B,MAAM;YACN,cAAc,EACZ,YAAY,CAAC,MAAM,GAAG,CAAC;gBACrB,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzB,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;oBAClB,CAAC,CAAC,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C;oBAC5E,CAAC,CAAC,0EAA0E;YAClF,iBAAiB,EAAE,wDAAwD;YAC3E,WAAW,EACT,8HAA8H;SACjI,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,CAAC;QACC,IAAI,UAAU,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG;gBAChB,mCAAmC;gBACnC,wDAAwD;gBACxD,kDAAkD;gBAClD,wDAAwD;aACzD,CAAC;YACF,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3C,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,YAAY,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,2BAA2B,EAChE,GAAG,CACJ,CAAC;gBACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,kCAAkC;gBACtC,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;gBAC3D,cAAc,EACZ,WAAW,CAAC,MAAM,GAAG,CAAC;oBACpB,CAAC,CAAC,2CAA2C,gBAAgB,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC1F,CAAC,CAAC,aAAa,gBAAgB,mEAAmE;gBACtG,iBAAiB,EAAE,kEAAkE;gBACrF,WAAW,EACT,qMAAqM;aACxM,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,kCAAkC;gBACtC,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,SAAS;gBACjB,cAAc,EAAE,yEAAyE;gBACzF,iBAAiB,EAAE,kEAAkE;gBACrF,WAAW,EACT,8GAA8G;aACjH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,CAAC;QACC,IAAI,UAAU,CAAC,mBAAmB,CAAC,IAAI,QAAQ,CAAC,mBAAmB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9E,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,YAAY,GAAG,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,qCAAqC;gBACzC,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;gBACjD,cAAc,EAAE,YAAY;oBAC1B,CAAC,CAAC,yCAAyC,mBAAmB,EAAE;oBAChE,CAAC,CAAC,aAAa,mBAAmB,yCAAyC;gBAC7E,iBAAiB,EAAE,mEAAmE;gBACtF,WAAW,EACT,kGAAkG;aACrG,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,qCAAqC;gBACzC,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,SAAS;gBACjB,cAAc,EAAE,oEAAoE;gBACpF,iBAAiB,EAAE,mEAAmE;gBACtF,WAAW,EACT,2FAA2F;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAuB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;QACnF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC;YAC/C,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,UAAU,EAAE,OAAO;QACnB,cAAc;QACd,MAAM;QACN,uBAAuB,EAAE;YACvB,2BAA2B,EAAE,6BAA6B;YAC1D,wCAAwC,EAAE,KAAK;YAC/C,mCAAmC,EAAE,KAAK;YAC1C,0BAA0B,EAAE,KAAK;YACjC,qBAAqB,EACnB,kVAAkV;SACrV;KACF,CAAC;AACJ,CAAC"}

package/dist/core/detector.d.ts

@@ -0,0 +1,7 @@
+import type { ArtifactFormat } from "./types.js";
+/**
+ * Format-aware detector that inspects both magic bytes and file extensions
+ * to route targets accurately across all 19 REA-supported artifact formats.
+ */
+export declare function detectArtifactFormat(targetPath: string): ArtifactFormat;
+//# sourceMappingURL=detector.d.ts.map

package/dist/core/detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/core/detector.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,CAmNvE"}

package/dist/core/detector.js

@@ -0,0 +1,190 @@
+import { statSync, openSync, readSync, closeSync } from "node:fs";
+import { extname } from "node:path";
+/**
+ * Format-aware detector that inspects both magic bytes and file extensions
+ * to route targets accurately across all 19 REA-supported artifact formats.
+ */
+export function detectArtifactFormat(targetPath) {
+    let stats;
+    try {
+        stats = statSync(targetPath);
+    }
+    catch {
+        return "unknown";
+    }
+    if (stats.isDirectory()) {
+        return "directory";
+    }
+    const ext = extname(targetPath).toLowerCase();
+    // Read up to 4096 header bytes for binary magic & CLR metadata inspection
+    const header = Buffer.alloc(Math.min(4096, stats.size));
+    if (header.length > 0) {
+        const fd = openSync(targetPath, "r");
+        try {
+            readSync(fd, header, 0, header.length, 0);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    // 0. Apple Binary PropertyList (`bplist00` / `bplist01`)
+    if (header.length >= 8 &&
+        header.subarray(0, 6).toString("latin1") === "bplist") {
+        return "apple-plist";
+    }
+    // 1. SQLite 3 database: `SQLite format 3\0`
+    if (header.length >= 16 &&
+        header.subarray(0, 16).toString("latin1") === "SQLite format 3\0") {
+        return "sqlite";
+    }
+    // 2. GGUF model artifact: `GGUF` (0x47 0x47 0x55 0x46)
+    if (header.length >= 4 &&
+        header[0] === 0x47 &&
+        header[1] === 0x47 &&
+        header[2] === 0x55 &&
+        header[3] === 0x46) {
+        return "model-gguf";
+    }
+    // 3. Android Dalvik Executable (`.dex`): `dex\n` (0x64 0x65 0x78 0x0a)
+    if (header.length >= 4 &&
+        header[0] === 0x64 &&
+        header[1] === 0x65 &&
+        header[2] === 0x78 &&
+        header[3] === 0x0a) {
+        return "android-dex";
+    }
+    // 4. Unity IL2CPP `global-metadata.dat`: magic 0xFAB11BAF (little-endian: AF 1B B1 FA)
+    if (header.length >= 4 && header.readUInt32LE(0) === 0xfab11baf) {
+        return "il2cpp-metadata";
+    }
+    // 5. WebAssembly binary: `\0asm` (0x00 0x61 0x73 0x6d)
+    if (header.length >= 4 &&
+        header[0] === 0x00 &&
+        header[1] === 0x61 &&
+        header[2] === 0x73 &&
+        header[3] === 0x6d) {
+        return "wasm";
+    }
+    // 6. ELF binary: `\x7fELF`
+    if (header.length >= 4 &&
+        header[0] === 0x7f &&
+        header[1] === 0x45 &&
+        header[2] === 0x4c &&
+        header[3] === 0x46) {
+        return "native-elf";
+    }
+    // 7. JVM `.class` vs Mach-O binary (thin 32/64 BE/LE or fat universal)
+    if (header.length >= 4) {
+        const magicBE = header.readUInt32BE(0);
+        if (magicBE === 0xcafebabe) {
+            if (ext === ".class")
+                return "jvm-class";
+            // In Mach-O universal fat binaries, uint32BE(4) is nfat_arch (1..20).
+            // In JVM .class files, uint16BE(4) is minor_version and uint16BE(6) is major_version (>= 45).
+            if (header.length >= 8) {
+                const nfatOrVersion = header.readUInt32BE(4);
+                const majorVersion = header.readUInt16BE(6);
+                if (nfatOrVersion > 30 && majorVersion >= 45 && majorVersion <= 90) {
+                    return "jvm-class";
+                }
+            }
+            return "native-macho";
+        }
+        if (magicBE === 0xfeedface ||
+            magicBE === 0xcefaedfe ||
+            magicBE === 0xfeedfacf ||
+            magicBE === 0xcffaedfe ||
+            magicBE === 0xbebafeca) {
+            return "native-macho";
+        }
+    }
+    // 8. PE binary (`MZ`) or .NET Managed CLR assembly (contains `BSJB` metadata root)
+    if (header.length >= 2 && header[0] === 0x4d && header[1] === 0x5a) {
+        if (header.includes(Buffer.from("BSJB", "ascii"))) {
+            return "dotnet-managed";
+        }
+        return "native-pe";
+    }
+    // 9. Electron ASAR archive: Pickles header (uint32LE(0) === 4, uint32LE(12) === jsonLen)
+    if (ext === ".asar" ||
+        (header.length >= 16 &&
+            header.readUInt32LE(0) === 4 &&
+            header.subarray(16).toString("utf8").trimStart().startsWith('{"files"'))) {
+        return "electron-asar";
+    }
+    // 10. Safetensors model artifact: `.safetensors` or 8-byte uint64 LE header size followed by `{"`
+    if (ext === ".safetensors" ||
+        (header.length >= 10 &&
+            header[8] === 0x7b &&
+            header[9] === 0x22 &&
+            header.readUInt32LE(4) === 0 &&
+            header.readUInt32LE(0) > 2 &&
+            header.readUInt32LE(0) < 100_000_000)) {
+        return "model-safetensors";
+    }
+    // 11. ZIP / APK archive: `PK\x03\x04`
+    if (header.length >= 4 &&
+        header[0] === 0x50 &&
+        header[1] === 0x4b &&
+        header[2] === 0x03 &&
+        header[3] === 0x04) {
+        return ext === ".apk" ? "android-apk" : "archive-zip";
+    }
+    // 12. CPython `.pyc` bytecode (magic bytes 0x0d 0x0a at offset 2..3)
+    if (ext === ".pyc" ||
+        (header.length >= 16 && header[2] === 0x0d && header[3] === 0x0a)) {
+        return "python-pyc";
+    }
+    // 13. Erlang BEAM IFF: `FOR1....BEAM`
+    if (header.length >= 12 &&
+        header.subarray(0, 4).toString("latin1") === "FOR1" &&
+        header.subarray(8, 12).toString("latin1") === "BEAM") {
+        return "erlang-beam";
+    }
+    // 14. Classic libpcap / pcapng magic
+    if (header.length >= 4) {
+        const magicLE = header.readUInt32LE(0);
+        if (magicLE === 0xa1b2c3d4 ||
+            magicLE === 0xa1b23c4d ||
+            magicLE === 0xd4c3b2a1) {
+            return "pcap-capture";
+        }
+        // pcapng section header block
+        if (magicLE === 0x0a0d0d0a) {
+            return "pcap-capture";
+        }
+    }
+    // 15. Extension-based formats
+    if ([".js", ".mjs", ".cjs", ".jsx"].includes(ext))
+        return "javascript";
+    if ([".ts", ".mts", ".cts", ".tsx"].includes(ext))
+        return "typescript";
+    if (ext === ".map")
+        return "sourcemap";
+    if ([".html", ".htm"].includes(ext))
+        return "html-bundle";
+    if ([".py", ".pyw"].includes(ext))
+        return "python-source";
+    if (ext === ".wasm")
+        return "wasm";
+    if ([".sqlite", ".sqlite3", ".db"].includes(ext))
+        return "sqlite";
+    if (ext === ".gguf")
+        return "model-gguf";
+    if (ext === ".dex")
+        return "android-dex";
+    if ([".plist", ".entitlements", ".mobileprovision"].includes(ext))
+        return "apple-plist";
+    if (ext === ".class")
+        return "jvm-class";
+    if (ext === ".beam")
+        return "erlang-beam";
+    if ([".evm", ".bin-evm", ".solidity-bin"].includes(ext))
+        return "evm-bytecode";
+    if ([".pcap", ".pcapng", ".cap"].includes(ext))
+        return "pcap-capture";
+    if (ext === ".ptx")
+        return "gpu-ptx";
+    return "unknown";
+}
+//# sourceMappingURL=detector.js.map

package/dist/core/detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/core/detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAE9C,0EAA0E;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,IACE,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,EACrD,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,4CAA4C;IAC5C,IACE,MAAM,CAAC,MAAM,IAAI,EAAE;QACnB,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,mBAAmB,EACjE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,uDAAuD;IACvD,IACE,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,uEAAuE;IACvE,IACE,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,uFAAuF;IACvF,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAChE,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,IACE,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2BAA2B;IAC3B,IACE,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,uEAAuE;IACvE,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,IAAI,GAAG,KAAK,QAAQ;gBAAE,OAAO,WAAW,CAAC;YACzC,sEAAsE;YACtE,8FAA8F;YAC9F,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC5C,IAAI,aAAa,GAAG,EAAE,IAAI,YAAY,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;oBACnE,OAAO,WAAW,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,IACE,OAAO,KAAK,UAAU;YACtB,OAAO,KAAK,UAAU;YACtB,OAAO,KAAK,UAAU;YACtB,OAAO,KAAK,UAAU;YACtB,OAAO,KAAK,UAAU,EACtB,CAAC;YACD,OAAO,cAAc,CAAC;QACxB,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,yFAAyF;IACzF,IACE,GAAG,KAAK,OAAO;QACf,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE;YAClB,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAC1E,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,kGAAkG;IAClG,IACE,GAAG,KAAK,cAAc;QACtB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE;YAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;YAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;YAClB,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;YAC5B,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;YAC1B,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,EACvC,CAAC;QACD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,sCAAsC;IACtC,IACE,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;IACxD,CAAC;IAED,qEAAqE;IACrE,IACE,GAAG,KAAK,MAAM;QACd,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EACjE,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,sCAAsC;IACtC,IACE,MAAM,CAAC,MAAM,IAAI,EAAE;QACnB,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM;QACnD,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,EACpD,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,qCAAqC;IACrC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,IACE,OAAO,KAAK,UAAU;YACtB,OAAO,KAAK,UAAU;YACtB,OAAO,KAAK,UAAU,EACtB,CAAC;YACD,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,8BAA8B;QAC9B,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC;QACxB,CAAC;IACH,CAAC;IAED,8BAA8B;IAE9B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACvE,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,eAAe,CAAC;IAC1D,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClE,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,YAAY,CAAC;IACzC,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC;IACzC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IACxF,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IACzC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,aAAa,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC;IAC/E,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC;IACtE,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAErC,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/core/identifiers.d.ts

@@ -0,0 +1,32 @@
+import type { SeededPrng } from "./prng.js";
+export type IdentifierStyle = "camel" | "pascal" | "snake" | "privateCamel" | "earlySort";
+export interface RealisticIdentifierOptions {
+    readonly style?: IdentifierStyle;
+    /** Extra suffix entropy hex length (default 3). */
+    readonly entropy?: number;
+    /** Optional semantic stem forced into the name (still mixed with vocabulary). */
+    readonly hint?: string;
+}
+/**
+ * Draw a realistic identifier from a seeded distribution.
+ * Guarantees: no `_bla`, `__bla`, `$00_AAA` substring; valid JS/TS/Python ident.
+ */
+export declare function realisticIdentifier(prng: SeededPrng, options?: RealisticIdentifierOptions): string;
+/**
+ * Draw N unique realistic identifiers (retry on collision within the batch).
+ */
+export declare function realisticIdentifierBatch(prng: SeededPrng, count: number, options?: RealisticIdentifierOptions): string[];
+/** Shared honey-table names for SQLite (no `_bla_` prefix; probe looks these up by name). */
+export declare const SQLITE_HONEY_TABLES: Readonly<{
+    readonly keyHierarchy: "enclave_key_hierarchy";
+    readonly attestationLedger: "tpm2_attestation_ledger";
+    readonly sessionLeases: "zero_trust_session_leases";
+    readonly canaryTransport: "canary_transport_redaction";
+    readonly systemDiagnostic: "system_diagnostic_log";
+    readonly activeTopologyView: "v_enclave_active_topology";
+}>;
+export declare const SQLITE_HONEY_TABLE_NAME_SET: ReadonlySet<string>;
+/** Forbidden greppable marker substrings that must NEVER appear in emitted artifacts. */
+export declare const FORBIDDEN_EMITTED_MARKERS: readonly RegExp[];
+export declare function assertNoForbiddenMarkers(emitted: string, context?: string): void;
+//# sourceMappingURL=identifiers.d.ts.map

package/dist/core/identifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifiers.d.ts","sourceRoot":"","sources":["../../src/core/identifiers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAiL5C,MAAM,MAAM,eAAe,GACvB,OAAO,GACP,QAAQ,GACR,OAAO,GACP,cAAc,GACd,WAAW,CAAC;AAEhB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,0BAA+B,GACvC,MAAM,CAiDR;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,0BAA+B,GACvC,MAAM,EAAE,CAeV;AAED,6FAA6F;AAC7F,eAAO,MAAM,mBAAmB;;;;;;;EAOrB,CAAC;AAEZ,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAE3D,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAIrD,CAAC;AAEH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,SAAqB,GAC3B,IAAI,CAQN"}