cli-jaw 2.2.9 → 2.2.11

package/dist/src/messaging/redact.js

@@ -0,0 +1,577 @@
+// ─── Channel Credential Redaction ────────────────────
+// One masker for every channel. Error strings cross channel boundaries — the
+// unified send path collects results from all three — so per-channel maskers
+// leak at the seams.
+//
+// Three sinks matter, in order of severity:
+//   1. the chat room itself (Telegram/Discord reply text)
+//   2. HTTP response bodies (`{ ok: false, error }` reaches /api callers)
+//   3. log files
+//
+// Telegram is the sharp edge: its Bot API puts the token in the URL PATH
+// (`https://api.telegram.org/bot<TOKEN>/method`), so the path is itself a
+// credential, exactly like Slack's `upload_url`.
+/** A language-tag-free guard: keep host, drop everything that identifies it. */
+import { canonicalize } from './fold.js';
+const REDACTED = '...redacted';
+/**
+ * Characters copied while assembling redacted output, since the last reset.
+ *
+ * Exists for the complexity regression tests. Those used to assert a wall-clock
+ * budget, which measures the runner rather than the algorithm: the same fixture
+ * took 155 ms on a developer laptop and 777 ms on a CI runner, and running the
+ * suite in parallel moved it again. A counter of the work actually performed is
+ * the same number on every machine, so the test can state the real invariant —
+ * copy work stays proportional to input length — instead of a machine-specific
+ * millisecond bound.
+ *
+ * Incrementing one integer per emitted piece costs nothing measurable and is
+ * never read in production.
+ */
+let charsCopied = 0;
+/** Read the copy-work counter; test-only introspection. */
+export function redactionCopyWork() {
+    return charsCopied;
+}
+/** Reset the copy-work counter; test-only introspection. */
+export function resetRedactionCopyWork() {
+    charsCopied = 0;
+}
+/**
+ * Mask a Telegram bot token embedded in a URL path, whatever the host.
+ *
+ * Host and credential are separate concerns. A lookalike host such as
+ * `evil.telegram.org.attacker.dev` is deliberately left readable — hiding it
+ * would conceal a suspicious destination — but a real token sitting in its
+ * path must still go. Anchoring on the literal `/bot` rather than a word
+ * boundary matters: in `.../bot123456:SECRET` the character before the digits
+ * is `t`, so `\b` never matches.
+ */
+function stripBotTokenFromPath(raw) {
+    // The separators may themselves be percent-encoded: a URL that travelled
+    // through a query parameter arrives as https%3A%2F%2F…%2Fbot<id>%3A<secret>.
+    return raw.replace(/(\/|%2F)(?:file(?:\/|%2F))?bots?(\d{6,12})(?::|%3A)[A-Za-z0-9_-]+/gi, (_m, slash, id) => `${slash}bot${id}:${REDACTED}`);
+}
+/**
+ * A `bot` prefix is proof of provenance: nothing but a Telegram credential is
+ * spelled `bot<digits>:<run>`. Because provenance is established, the secret's
+ * shape is not consulted — requiring a character mix would leak an
+ * all-uppercase token in full.
+ *
+ * The prefix has to stand alone. Excluding only a preceding letter was not
+ * enough — `my_bot123…` and `v2bot123…` are identifiers, not credentials — so
+ * the guard covers every identifier character.
+ */
+const PREFIXED_TOKEN = new RegExp(`(?<![A-Za-z0-9_])bot(\\d{6,12})(?::|\uFF1A)[A-Za-z0-9_-]{20,}`, 'gi');
+/**
+ * A Discord token's first segment is the bot's user id in base64url, so it
+ * decodes to a run of digits. An artifact id or checksum of the same dotted
+ * shape does not, which is what keeps ordinary diagnostics readable.
+ */
+function decodesToSnowflake(segment) {
+    // The regex has no way to know where the token starts, so ordinary text
+    // running into it ("logabcdefMTIz…") is captured as part of the first
+    // segment. Try the trailing windows: a real header is 24 characters for an
+    // 18-digit id, but ids vary in length, so scan a small range from the end.
+    //
+    // Padding needs no special handling here — Node's base64 decoder tolerates
+    // it, so a `…Njc4==` segment still yields the id. What DOES matter is that
+    // the pattern above accepts the `=` characters in the first place; without
+    // that the whole match never forms.
+    for (let width = 20; width <= Math.min(32, segment.length); width += 1) {
+        const candidate = segment.slice(segment.length - width);
+        try {
+            const decoded = Buffer.from(candidate.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8');
+            if (/^\d{15,}$/.test(decoded))
+                return true;
+        }
+        catch {
+            // Not valid base64 at this width; try the next.
+        }
+    }
+    return false;
+}
+/**
+ * Bot tokens anywhere in a string.
+ *
+ * Detection is anchored on the SECRET, not on what precedes it. Every earlier
+ * attempt anchored on the left — a word boundary, then a delimiter set, then a
+ * lookbehind — and each one was defeated by a spelling nobody had listed:
+ * `Bot`, `BOT`, a bare `/`, an ordinary letter, `%3A`. What actually identifies
+ * a Telegram credential is its shape: a bot id, a separator, and a long
+ * high-entropy run. Match that, and the left context stops mattering.
+ *
+ * Separators cover the literal colon, its percent-encoding at any nesting
+ * depth (`%3A`, `%253A`, …), the fullwidth colon that NFKC folds to `:`, and
+ * an intervening line break — a token wrapped across lines in a log is still a
+ * token once someone joins it back up.
+ */
+// `%3A` encoded once is `%253A`, twice is `%25253A`: each round replaces the
+// leading `%` with `%25`, so the nesting shows up as repeated `25` AFTER the
+// first percent, not as repeated `%25` before it.
+const TOKEN_SEPARATOR = '(?::|\uFF1A|%(?:25)*3A)';
+// Zero-width formatting characters can sit between the id and the separator.
+// They are invisible in a log yet vanish on paste, so a token split by one is
+// still a working token.
+const INVISIBLE = '[\\s\\u200B-\\u200D\\uFEFF]*';
+// The id runs to the END of a digit run: with a longer run, take its last 6-12
+// digits rather than refusing to match. A lookbehind that demands a non-digit
+// lets `9` + a 12-digit id slip past as a 13-digit run.
+const TOKEN_ANYWHERE = new RegExp(`(\\d{6,12})${INVISIBLE}${TOKEN_SEPARATOR}${INVISIBLE}([A-Za-z0-9_-]{30,})`, 'gi');
+/**
+ * Provenance, not shape, decides how aggressive masking may be.
+ *
+ * Telegram documents its token only as opaque, so a rule like "the secret
+ * mixes upper case, lower case and digits" is an unwritten assumption: an
+ * all-uppercase token would ship in full. Every path where the surrounding
+ * text PROVES a credential — a Bot API URL, a `bot` prefix, an Authorization
+ * header — therefore masks on structure alone, without consulting the shape.
+ *
+ * The character mix survives in exactly one place: a bare `<digits>:<run>`
+ * pair in arbitrary prose, where there is no provenance and a build id or a
+ * checksum would otherwise be blanked. A false negative there costs nothing,
+ * because the same token inside any real Telegram context is caught above.
+ */
+function mixesCharacterClasses(candidate) {
+    return /[A-Z]/.test(candidate) && /[a-z]/.test(candidate) && /\d/.test(candidate);
+}
+/**
+ * Find secrets in the CANONICAL form of the text, then remove those literal
+ * runs from the original.
+ *
+ * This is what stops the spelling arms race. A pattern matched against the raw
+ * string has to anticipate every encoding and every invisible character; a
+ * pattern matched against the folded string sees one shape. The secret run
+ * survives folding intact (its characters are base64url, which percent-decoding
+ * and control-stripping leave alone), so it can be located in the original by
+ * substring and blanked there.
+ */
+function stripSecretsFoundInCanonicalForm(input) {
+    // Scan the folded form ALWAYS, not only when folding changed something. A
+    // string that is already canonical still needs this pass: the raw matchers
+    // downstream stop at the first prefixed token, so a secret repeated later
+    // in the same error string survived.
+    const folded = canonicalize(input);
+    // The fold gave up with escapes still unresolved. Something is nested
+    // deeply enough to outrun the budget, which nothing legitimate does, so
+    // blank whatever could be hiding a credential rather than pass the text
+    // through unread.
+    //
+    // Blanking only the runs that CONTAIN an escape is not enough: the fold
+    // also removes control characters, so an encoded prefix and its secret can
+    // sit on either side of a newline. The bot id is public, so leaving the
+    // secret half behind still hands over the credential. Any long run that
+    // either carries an escape or could BE a secret goes.
+    if (folded.exhausted) {
+        // Scope it: the escaped run itself, and any credential-shaped run near
+        // enough to be its other half. Blanking every long alphanumeric run
+        // erased ordinary identifiers — `release-build-20260802-darwin-arm64`
+        // among them — which hands an attacker a way to strip diagnostics by
+        // burying one deeply encoded string in the same message.
+        return input.replace(/\S{20,}/g, (run, offset) => {
+            if (/%|\\u|&#/.test(run))
+                return REDACTED;
+            // A Telegram secret is an unbroken base64url run. An ordinary long
+            // identifier is punctuated — `release-build-20260802-darwin-arm64`
+            // has hyphens — so requiring no separator keeps diagnostics while
+            // still covering the shape a credential takes.
+            if (!/^[A-Za-z0-9]{20,}$/.test(run))
+                return run;
+            return hasEscapeWithin(input, offset, run.length) ? REDACTED : run;
+        });
+    }
+    // Collect the SOURCE ranges each match came from. Deleting the matched
+    // literal instead fails in both directions: an escape spliced inside the
+    // secret means the literal is not in the source at all, and a run that
+    // legitimately appears elsewhere gets destroyed with it.
+    const ranges = [];
+    // The folded coordinates of each hit, kept alongside. Recovering them
+    // afterwards meant scanning the whole map per range, which is the other
+    // half of the quadratic cost.
+    const foldedRanges = [];
+    const record = (start, stop) => {
+        if (start >= stop)
+            return;
+        const from = folded.origin[start];
+        const to = folded.end[stop - 1];
+        if (from === undefined || to === undefined)
+            return;
+        ranges.push({ from, to });
+        foldedRanges.push({ foldedFrom: start, foldedTo: stop });
+    };
+    for (const match of folded.text.matchAll(PREFIXED_TOKEN)) {
+        const at = match.index ?? 0;
+        const separator = match[0].search(/[:\uFF1A]/);
+        if (separator < 0)
+            continue;
+        record(at + separator + 1, at + match[0].length);
+    }
+    for (const match of folded.text.matchAll(CANONICAL_URL_TOKEN)) {
+        const at = match.index ?? 0;
+        const secret = match[2];
+        if (!secret)
+            continue;
+        record(at + match[0].length - secret.length, at + match[0].length);
+    }
+    if (ranges.length === 0)
+        return input;
+    // A credential proven once in a message is a credential everywhere in it.
+    // The repeat search runs over the FOLDED text, so a second mention wrapped
+    // in a different encoding is caught too, and each hit is carried back by
+    // the same offset map.
+    //
+    // Unlike the first pass this ignores whether the run is glued to
+    // surrounding characters. The earlier "standalone only" rule existed to
+    // protect unrelated values that happened to share the run, but once the
+    // very same run has been proven a credential in this message, treating a
+    // later copy as coincidence is the wrong way to be wrong.
+    //
+    // Bounded work: scanning the whole text once per distinct secret is
+    // quadratic, and an attacker controls how many distinct token-shaped runs
+    // an error string contains. Both the number of secrets and the total
+    // search effort are capped; the first pass has already masked each
+    // credential where it was proven, so the cap only trims the extra sweep
+    // for repeats.
+    // Every proven secret, not the first N. Capping this was the same mistake
+    // as capping decode rounds: the 33rd credential's repeat went out in the
+    // clear. Cost is controlled by making the sweep a single pass over the
+    // text rather than one pass per secret.
+    const known = new Set();
+    let shortest = Number.POSITIVE_INFINITY;
+    for (const { foldedFrom, foldedTo } of foldedRanges) {
+        const run = folded.text.slice(foldedFrom, foldedTo);
+        if (run.length < 20)
+            continue;
+        known.add(run);
+        shortest = Math.min(shortest, run.length);
+    }
+    if (known.size > 0) {
+        // Group by prefix AND length, so a position tests at most one string
+        // per length rather than every secret sharing that prefix.
+        //
+        // Bucketing on the prefix alone still lets an attacker pile hundreds of
+        // secrets into one bucket and follow it with near-miss tails: 400 of
+        // them took sixteen seconds. Any structure whose per-position work
+        // grows with attacker-chosen input is not a security boundary.
+        const byPrefixAndLength = new Map();
+        const lengthsByPrefix = new Map();
+        for (const secret of known) {
+            const prefix = secret.slice(0, PROBE_WIDTH);
+            byPrefixAndLength.set(`${prefix}\u0000${secret.length}`, secret);
+            const lengths = lengthsByPrefix.get(prefix);
+            if (lengths) {
+                if (!lengths.includes(secret.length))
+                    lengths.push(secret.length);
+            }
+            else {
+                lengthsByPrefix.set(prefix, [secret.length]);
+            }
+        }
+        for (let at = 0; at + shortest <= folded.text.length; at += 1) {
+            const prefix = folded.text.slice(at, at + PROBE_WIDTH);
+            const lengths = lengthsByPrefix.get(prefix);
+            if (!lengths)
+                continue;
+            for (const length of lengths) {
+                const candidate = byPrefixAndLength.get(`${prefix}\u0000${length}`);
+                if (candidate === undefined)
+                    continue;
+                if (folded.text.slice(at, at + length) !== candidate)
+                    continue;
+                record(at, at + length);
+                at += length - 1;
+                break;
+            }
+        }
+    }
+    // Build the output once, front to back.
+    //
+    // Splicing the string per range re-copied the whole text for every match,
+    // which is quadratic in the number of credentials — and an attacker picks
+    // that number. Measured on this fixture family: 4k credentials took 167 ms
+    // and 8k took 555 ms (3.3x for 2x input) while the scan itself stayed
+    // linear (43 ms → 79 ms). Collecting the pieces and joining once keeps the
+    // total copy work proportional to the text length.
+    //
+    // Overlapping ranges are MERGED rather than one being dropped. The old
+    // back-to-front loop kept the rightmost of two overlapping matches and
+    // discarded the other, which left the non-shared head of the discarded
+    // range in the clear — for a redactor, masking the union is the only
+    // direction that cannot leak. The union is bounded by the matches
+    // themselves, so ordinary text around them is untouched.
+    ranges.sort((a, b) => a.from - b.from || a.to - b.to);
+    const pieces = [];
+    let cursor = 0;
+    let openFrom = -1;
+    let openTo = -1;
+    const flush = () => {
+        if (openFrom < 0)
+            return;
+        pieces.push(input.slice(cursor, openFrom), REDACTED);
+        charsCopied += (openFrom - cursor) + REDACTED.length;
+        cursor = openTo;
+        openFrom = -1;
+    };
+    for (const { from, to } of ranges) {
+        if (openFrom >= 0 && from <= openTo) {
+            if (to > openTo)
+                openTo = to; // extend the merged run
+            continue;
+        }
+        flush();
+        openFrom = from;
+        openTo = to;
+    }
+    flush();
+    pieces.push(input.slice(cursor));
+    charsCopied += input.length - cursor;
+    return pieces.join('');
+}
+/** `/bot<id>:<secret>` inside a path, after folding. */
+const CANONICAL_URL_TOKEN = /\/(?:file\/)?bots?(\d{6,12}):([A-Za-z0-9_-]{20,})/gi;
+/**
+ * Mask query VALUES while keeping the keys, in one linear pass.
+ *
+ * A regex of the shape /([^&=]+)=([^&]*)/g backtracks quadratically when the
+ * query holds a long run with no `=` in it — a 100 KB URL took four seconds,
+ * which turns any logged string into a denial of service. Splitting on `&` and
+ * taking the first `=` per pair cannot backtrack at all.
+ */
+function maskQueryValues(query) {
+    return query
+        .split('&')
+        .map((pair) => {
+        const eq = pair.indexOf('=');
+        return eq < 0 ? pair : `${pair.slice(0, eq)}=${REDACTED}`;
+    })
+        .join('&');
+}
+/**
+ * Redact channel credentials from any string before it reaches a log sink, an
+ * API response, or a chat message.
+ */
+export function redactChannelSecrets(input) {
+    return stripSecretsFoundInCanonicalForm(input)
+        // Percent-encoded URLs never reach the URL parser below, so peel their
+        // credentials off first.
+        .replace(/https?%3A%2F%2F[^\s]+/gi, stripBotTokenFromPath)
+        // Slack bearer tokens: xoxb-, xoxp-, xoxa-, xoxs-, xapp-.
+        .replace(/x(?:ox[bpas]|app)-[A-Za-z0-9-]+/g, (m) => `${m.slice(0, 9)}${REDACTED}`)
+        // Discord bot tokens are three base64url segments separated by dots.
+        // No word boundary and no fixed first-segment length: `\b` fails when
+        // an ordinary letter abuts the token, and pinning the first segment to
+        // 23-28 characters misses a token that follows other text.
+        //
+        // The first segment is base64url of a snowflake id, so it decodes to
+        // digits — that is what separates a real token from an artifact id or
+        // a checksum of the same shape. Structure alone is not enough:
+        // `aaaa….bbbbb.cccc…` matches any three-run dotted string.
+        //
+        // KNOWN OVER-MASKING. A non-token whose first segment happens to be a
+        // base64url snowflake is redacted too. Nothing in the remaining
+        // segments distinguishes it: a real token's second segment is six
+        // base64url characters and its third is an opaque HMAC, both of which
+        // an artifact id can match exactly. Since a miss here publishes a bot
+        // token while a false hit costs one unreadable diagnostic, the tie goes
+        // to masking. The snowflake test already spares ordinary versions,
+        // checksums and build ids, which is where the real risk of over-masking
+        // was.
+        //
+        // Anchoring the whole match keeps it linear. Open-ended runs made the
+        // engine try every split of a long dotless string; 50 KB took two
+        // seconds, which the timing test caught.
+        .replace(
+    // The first segment may carry base64 padding when a log renders it
+    // that way; rejecting `=` would leave the token in the clear.
+    // `=` is padding, so it is meaningful only AFTER a segment. The
+    // leading guard must still allow it: `token=<token>` puts one
+    // immediately in front, and excluding it there dropped the match.
+    /(?<![A-Za-z0-9_.-])([A-Za-z0-9_-]{20,}={0,2})\.([A-Za-z0-9_-]{5,}={0,2})\.([A-Za-z0-9_-]{25,}={0,2})(?![A-Za-z0-9_.-])/g, (whole, header) => (decodesToSnowflake(header) ? REDACTED : whole))
+        // Prefixed tokens: provenance is certain, so shape does not matter.
+        .replace(PREFIXED_TOKEN, (_m, id) => `bot${id}:${REDACTED}`)
+        // Authorization header values, whichever scheme.
+        .replace(/\b(Bot|Bearer)\s+\S+/gi, (_m, scheme) => `${scheme} ${REDACTED}`)
+        // URLs. ONE pass: running two URL regexes would let the second parse a
+        // string the first already rewrote.
+        //
+        // Host matching goes through the URL parser rather than a regex on the
+        // raw text, so canonical-equivalent spellings cannot slip past:
+        // uppercase hosts, an explicit :443, a trailing dot, and userinfo
+        // (user:pass@) all normalize before the suffix check.
+        .replace(/https?:\/\/[^\s]+/gi, (raw) => {
+        let parsed;
+        try {
+            parsed = new URL(raw);
+        }
+        catch {
+            return stripBotTokenFromPath(raw);
+        }
+        const host = parsed.hostname.toLowerCase().replace(/\.$/, '');
+        const isSlack = host === 'slack.com' || host.endsWith('.slack.com');
+        const isTelegram = host === 'telegram.org' || host.endsWith('.telegram.org');
+        const isDiscord = host === 'discord.com' || host.endsWith('.discord.com')
+            || host === 'discordapp.com' || host.endsWith('.discordapp.com');
+        // For our own hosts the whole path is capability-bearing: Slack's
+        // upload_url is an opaque path, Telegram's carries the bot token,
+        // and Discord webhook URLs carry the webhook secret.
+        if (isSlack || isTelegram || isDiscord)
+            return `https://${parsed.host}/${REDACTED}`;
+        // Untrusted host: keep the URL readable, but never leave a
+        // credential in it.
+        //
+        // Being a URL is NOT provenance on its own — that reading blanked
+        // ordinary artifact paths like /build/<id>:<hash>/artifact. Only a
+        // `/bot<id>:<secret>` segment proves a Telegram credential here;
+        // anything else falls back to the shape heuristic, which spares a
+        // build id while still catching a real token.
+        const withoutToken = stripBotTokenFromPath(raw)
+            .replace(TOKEN_ANYWHERE, (whole, id, secret) => mixesCharacterClasses(secret) ? `${id}:${REDACTED}` : whole);
+        // Query VALUES go, keys stay: a diagnostic URL stays diagnosable
+        // while a signature does not survive.
+        const queryAt = withoutToken.indexOf('?');
+        if (queryAt < 0)
+            return withoutToken;
+        return withoutToken.slice(0, queryAt + 1) + maskQueryValues(withoutToken.slice(queryAt + 1));
+    })
+        // Bot tokens outside any URL, including percent-encoded separators and
+        // a Bot/BOT/bot prefix in any casing.
+        // Bare `<digits>:<run>` in arbitrary prose: no provenance, so the
+        // heuristic applies and an ordinary diagnostic stays readable.
+        .replace(TOKEN_ANYWHERE, (whole, id, secret) => mixesCharacterClasses(secret) ? `${id}:${REDACTED}` : whole);
+}
+/**
+ * Stringify anything that was thrown, without ever throwing.
+ *
+ * `JSON.stringify` rejects BigInt ("Do not know how to serialize a BigInt")
+ * and circular references; `String()` itself throws on a Symbol or an object
+ * whose `toString` throws. An error sink that can throw defeats the error
+ * handling it was added to protect.
+ */
+function stringifyThrown(err, withStack) {
+    if (err instanceof Error) {
+        return withStack ? (err.stack ?? err.message) : err.message;
+    }
+    if (typeof err === 'string')
+        return err;
+    try {
+        return JSON.stringify(err) ?? String(err);
+    }
+    catch {
+        try {
+            return String(err);
+        }
+        catch {
+            return '[unrepresentable error]';
+        }
+    }
+}
+/**
+ * For text a USER will see: message only, credentials masked.
+ *
+ * Never includes the stack. A stack frame carries absolute source paths, and
+ * publishing the operator's directory layout to a chat room is its own leak.
+ */
+export function userErrorText(err) {
+    return redactChannelSecrets(stringifyThrown(err, false));
+}
+/** For server logs: full stack, credentials masked. */
+export function logErrorText(err) {
+    return redactChannelSecrets(stringifyThrown(err, true));
+}
+/**
+ * Last mile: mask the BODY of an outbound message, whatever produced it.
+ *
+ * Error paths were hardened first, but a credential does not only travel in an
+ * error. An agent that reads a config file, a command that echoes a URL, a
+ * forwarder relaying tool output — each puts ordinary text on the wire, and
+ * that text goes to a chat room where anyone in the channel can read it.
+ *
+ * Every transport calls this immediately before handing text to the vendor
+ * SDK, so there is one place to audit rather than one per call site.
+ */
+export function redactOutboundText(text) {
+    return redactChannelSecrets(text);
+}
+/**
+ * Mask every string inside a structured outbound payload.
+ *
+ * Inline keyboards carry user-visible text in button labels and URLs, and
+ * those reach the room exactly like a message body. Walking the object beats
+ * enumerating fields, because the vendor's shape changes and a new field would
+ * silently go unmasked.
+ *
+ * Depth- and breadth-bounded: the input is attacker-influenced, and a
+ * recursive walk over it is a stack-overflow waiting to happen. Cycles are
+ * tracked so a self-referencing object cannot spin.
+ */
+export function redactOutboundPayload(value, depth = 0, seen = new WeakMap()) {
+    if (typeof value === 'string')
+        return redactChannelSecrets(value);
+    if (value === null || typeof value !== 'object')
+        return value;
+    // A cache, not a visited-set. Returning the ORIGINAL for an object seen
+    // before means the second alias of a shared button object ships its secret
+    // untouched — the first reference was sanitized and the second was not.
+    const cached = seen.get(value);
+    if (cached !== undefined)
+        return cached;
+    // Past the depth limit, drop the subtree instead of returning it. Handing
+    // back the raw object is a leak; anything this deep in an outbound payload
+    // is not something a channel renders.
+    if (depth >= MAX_PAYLOAD_DEPTH)
+        return (Array.isArray(value) ? [] : {});
+    // Register the container BEFORE walking it, so a cycle resolves to the
+    // same sanitized object rather than recursing forever.
+    const out = Array.isArray(value) ? [] : {};
+    seen.set(value, out);
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            out.push(redactOutboundPayload(item, depth + 1, seen));
+        }
+        return out;
+    }
+    for (const [key, item] of Object.entries(value)) {
+        out[key] = redactOutboundPayload(item, depth + 1, seen);
+    }
+    return out;
+}
+/** Deeper than any keyboard or media payload a channel actually renders. */
+const MAX_PAYLOAD_DEPTH = 12;
+/**
+ * True when an escaped run sits close enough to be the other half of a
+ * credential the fold could not finish resolving.
+ *
+ * Distance is measured to the escaped RUN, not to an escape character. A long
+ * `%2525…` chain is mostly digits, so a window around the neighbour can sit
+ * entirely inside it and still contain no `%` — which read as "no escape
+ * nearby" and let the secret through.
+ */
+function hasEscapeWithin(input, offset, length) {
+    for (const match of input.matchAll(/\S{20,}/g)) {
+        if (!/%|\\u|&#/.test(match[0]))
+            continue;
+        const start = match.index ?? 0;
+        const stop = start + match[0].length;
+        const gapBefore = offset - stop;
+        const gapAfter = start - (offset + length);
+        if (gapBefore >= 0 && gapBefore <= EXHAUSTED_NEIGHBOURHOOD)
+            return true;
+        if (gapAfter >= 0 && gapAfter <= EXHAUSTED_NEIGHBOURHOOD)
+            return true;
+    }
+    return false;
+}
+/**
+ * How far to look for the escaped half. The fold strips control characters and
+ * whitespace, so the two halves can be a line break and a little punctuation
+ * apart — but not paragraphs apart, which is what keeps this from swallowing
+ * an unrelated identifier elsewhere in the message.
+ */
+const EXHAUSTED_NEIGHBOURHOOD = 64;
+/**
+ * Width of the prefix used to index known secrets. Every tracked run is at
+ * least 20 characters, so this always exists, and collisions across distinct
+ * credentials are rare enough that each position tests roughly one candidate.
+ */
+const PROBE_WIDTH = 16;
+//# sourceMappingURL=redact.js.map

package/dist/src/messaging/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../../src/messaging/redact.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,6EAA6E;AAC7E,6EAA6E;AAC7E,qBAAqB;AACrB,EAAE;AACF,4CAA4C;AAC5C,0DAA0D;AAC1D,0EAA0E;AAC1E,iBAAiB;AACjB,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,iDAAiD;AAEjD,gFAAgF;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,QAAQ,GAAG,aAAa,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,2DAA2D;AAC3D,MAAM,UAAU,iBAAiB;IAC7B,OAAO,WAAW,CAAC;AACvB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,sBAAsB;IAClC,WAAW,GAAG,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACtC,yEAAyE;IACzE,6EAA6E;IAC7E,OAAO,GAAG,CAAC,OAAO,CACd,qEAAqE,EACrE,CAAC,EAAE,EAAE,KAAa,EAAE,EAAU,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CACpE,CAAC;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,IAAI,MAAM,CAC7B,+DAA+D,EAC/D,IAAI,CACP,CAAC;AAEF;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACvC,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,EAAE;IACF,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,oCAAoC;IACpC,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACvB,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAC/C,QAAQ,CACX,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnB,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACL,gDAAgD;QACpD,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,6EAA6E;AAC7E,6EAA6E;AAC7E,kDAAkD;AAClD,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAClD,6EAA6E;AAC7E,8EAA8E;AAC9E,yBAAyB;AACzB,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACjD,+EAA+E;AAC/E,8EAA8E;AAC9E,wDAAwD;AACxD,MAAM,cAAc,GAAG,IAAI,MAAM,CAC7B,cAAc,SAAS,GAAG,eAAe,GAAG,SAAS,sBAAsB,EAC3E,IAAI,CACP,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,SAAS,qBAAqB,CAAC,SAAiB;IAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gCAAgC,CAAC,KAAa;IACnD,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAEnC,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,kBAAkB;IAClB,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,sDAAsD;IACtD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,yDAAyD;QACzD,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,MAAc,EAAE,EAAE;YACrD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC1C,mEAAmE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,+CAA+C;YAC/C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;YAChD,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;QACvE,CAAC,CAAC,CAAC;IACP,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,sEAAsE;IACtE,wEAAwE;IACxE,8BAA8B;IAC9B,MAAM,YAAY,GAAoD,EAAE,CAAC;IACzE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE;QAC3C,IAAI,KAAK,IAAI,IAAI;YAAE,OAAO;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO;QACnD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,YAAY,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACvD,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,SAAS,GAAG,CAAC;YAAE,SAAS;QAC5B,MAAM,CAAC,EAAE,GAAG,SAAS,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC5D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uBAAuB;IACvB,EAAE;IACF,iEAAiE;IACjE,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,0DAA0D;IAC1D,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,qEAAqE;IACrE,mEAAmE;IACnE,wEAAwE;IACxE,eAAe;IACf,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,wCAAwC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxC,KAAK,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,YAAY,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;YAAE,SAAS;QAC9B,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACjB,qEAAqE;QACrE,2DAA2D;QAC3D,EAAE;QACF,wEAAwE;QACxE,qEAAqE;QACrE,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACpD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAoB,CAAC;QACpD,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAC5C,iBAAiB,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACJ,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,CAAC;QACL,CAAC;QACD,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,MAAM,EAAE,CAAC,CAAC;gBACpE,IAAI,SAAS,KAAK,SAAS;oBAAE,SAAS;gBACtC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,SAAS;oBAAE,SAAS;gBAC/D,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;gBACxB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC;gBACjB,MAAM;YACV,CAAC;QACL,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,mDAAmD;IACnD,EAAE;IACF,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,kEAAkE;IAClE,yDAAyD;IACzD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACtD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAClB,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,GAAG,EAAE;QACf,IAAI,QAAQ,GAAG,CAAC;YAAE,OAAO;QACzB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrD,WAAW,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;QACrD,MAAM,GAAG,MAAM,CAAC;QAChB,QAAQ,GAAG,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,MAAM,EAAE,CAAC;QAChC,IAAI,QAAQ,IAAI,CAAC,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAClC,IAAI,EAAE,GAAG,MAAM;gBAAE,MAAM,GAAG,EAAE,CAAC,CAAC,wBAAwB;YACtD,SAAS;QACb,CAAC;QACD,KAAK,EAAE,CAAC;QACR,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,KAAK,EAAE,CAAC;IACR,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,WAAW,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,wDAAwD;AACxD,MAAM,mBAAmB,GAAG,qDAAqD,CAAC;AAGlF;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAa;IAClC,OAAO,KAAK;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACV,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;IAC9D,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAC9C,OAAO,gCAAgC,CAAC,KAAK,CAAC;QAC1C,uEAAuE;QACvE,yBAAyB;SACxB,OAAO,CAAC,yBAAyB,EAAE,qBAAqB,CAAC;QAC1D,0DAA0D;SACzD,OAAO,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;QAClF,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,2DAA2D;QAC3D,EAAE;QACF,qEAAqE;QACrE,sEAAsE;QACtE,+DAA+D;QAC/D,2DAA2D;QAC3D,EAAE;QACF,sEAAsE;QACtE,gEAAgE;QAChE,kEAAkE;QAClE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,mEAAmE;QACnE,wEAAwE;QACxE,OAAO;QACP,EAAE;QACF,sEAAsE;QACtE,kEAAkE;QAClE,yCAAyC;SACxC,OAAO;IACJ,mEAAmE;IACnE,8DAA8D;IAC9D,gEAAgE;IAChE,8DAA8D;IAC9D,kEAAkE;IAClE,yHAAyH,EACzH,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CACrF;QACD,oEAAoE;SACnE,OAAO,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,EAAU,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QACpE,iDAAiD;SAChD,OAAO,CAAC,wBAAwB,EAAE,CAAC,EAAE,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;QACnF,uEAAuE;QACvE,oCAAoC;QACpC,EAAE;QACF,uEAAuE;QACvE,gEAAgE;QAChE,kEAAkE;QAClE,sDAAsD;SACrD,OAAO,CAAC,qBAAqB,EAAE,CAAC,GAAG,EAAE,EAAE;QACpC,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;eAClE,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACrE,kEAAkE;QAClE,kEAAkE;QAClE,qDAAqD;QACrD,IAAI,OAAO,IAAI,UAAU,IAAI,SAAS;YAAE,OAAO,WAAW,MAAM,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;QACpF,2DAA2D;QAC3D,oBAAoB;QACpB,EAAE;QACF,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,8CAA8C;QAC9C,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,CAAC;aAC1C,OAAO,CAAC,cAAc,EAAE,CAAC,KAAa,EAAE,EAAU,EAAE,MAAc,EAAE,EAAE,CACnE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACrE,iEAAiE;QACjE,sCAAsC;QACtC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,YAAY,CAAC;QACrC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC;QACF,uEAAuE;QACvE,sCAAsC;QACtC,kEAAkE;QAClE,+DAA+D;SAC9D,OAAO,CAAC,cAAc,EAAE,CAAC,KAAa,EAAE,EAAU,EAAE,MAAc,EAAE,EAAE,CACnE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAY,EAAE,SAAkB;IACrD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,CAAC;YACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,yBAAyB,CAAC;QACrC,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACtC,OAAO,oBAAoB,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,YAAY,CAAC,GAAY;IACrC,OAAO,oBAAoB,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC3C,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACjC,KAAQ,EACR,KAAK,GAAG,CAAC,EACT,OAAO,IAAI,OAAO,EAAmB;IAErC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,oBAAoB,CAAC,KAAK,CAAiB,CAAC;IAClF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE9D,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAW,CAAC;IAE7C,0EAA0E;IAC1E,2EAA2E;IAC3E,sCAAsC;IACtC,IAAI,KAAK,IAAI,iBAAiB;QAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAiB,CAAC;IAExF,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,GAAG,GAAwC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAErB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACtB,GAAiB,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,GAAmB,CAAC;IAC/B,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACxE,GAA+B,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAmB,CAAC;AAC/B,CAAC;AAED,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;IAClE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;QAC3C,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,IAAI,uBAAuB;YAAE,OAAO,IAAI,CAAC;QACxE,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,IAAI,uBAAuB;YAAE,OAAO,IAAI,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;GAIG;AACH,MAAM,WAAW,GAAG,EAAE,CAAC"}