modelrig 0.8.0 → 0.9.0

package/dist/screen/patterns.js

@@ -0,0 +1,151 @@
+"use strict";
+/**
+ * Screening — T0 deterministic injection patterns + the optional T1 classifier
+ * adapter (WIRED 2026-08-25, SC-1a). Spec §3 (Detector) + §4 (T0/T1).
+ *
+ * An OWASP-derived pattern pack that implements the shared `Detector` interface
+ * (packages/modelrig/src/detect/detector.ts) with `kind: "deterministic"`,
+ * confidence 1 on a match.
+ *
+ * DOCTRINE (research §2.2): detection is a SIGNAL, not a control. These patterns
+ * are trivially evaded by paraphrase/encoding; they exist to DRIVE the
+ * deterministic actions (flag/strip/quarantine) and to populate a MEASURED
+ * false-positive rate, NEVER to claim prevention (claim-lint, spec §7).
+ *
+ * LEAK INVARIANT (spec §1.4): a detector emits SPANS (offsets + type +
+ * confidence) — never the matched substring. Nothing in this file returns,
+ * logs, or persists a matched value.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScreenDetectorUnavailableError = exports.PATTERNS_ID = void 0;
+exports.createPatternDetector = createPatternDetector;
+exports.createClassifierDetector = createClassifierDetector;
+const node_fs_1 = require("node:fs");
+/** The registry id + version of the deterministic pack. Bumped when the pattern
+ * set changes so a receipt's `detectors[].version` pins what ran. */
+exports.PATTERNS_ID = "patterns@v1";
+/** The T0 pack. Deliberately narrow, US-English-shaped (A8), and biased toward
+ * classic injection SHAPES over broad keyword nets so the measured FP rate stays
+ * honest. Each entry is a signal, not a guarantee. */
+const INJECTION_PATTERNS = [
+    // "ignore the previous instructions" / "disregard all prior rules" family.
+    {
+        type: "injection:instruction_override",
+        re: /\b(?:ignore|disregard|forget|override)\b[^.?!\n]{0,40}\b(?:previous|prior|above|earlier|all|any)\b[^.?!\n]{0,20}\b(?:instruction|instructions|prompt|prompts|rule|rules|context|direction|directions)\b/gi,
+    },
+    // "you are now …", "new instructions:", "act as", "pretend to be" — role hijack.
+    {
+        type: "injection:role_override",
+        re: /\b(?:you\s+are\s+now|from\s+now\s+on|new\s+(?:instructions?|role|persona|system\s+prompt)|act\s+as(?:\s+if)?|pretend\s+to\s+be|roleplay\s+as|switch\s+to\s+developer\s+mode)\b/gi,
+    },
+    // An untrusted segment carrying its own "system:" / "assistant:" role label —
+    // the classic transcript-smuggling shape the raw lane's JSON-turn guard closes.
+    {
+        type: "injection:role_label",
+        re: /(?:^|\n)\s*(?:system|assistant|developer)\s*:/gi,
+    },
+    // Chat-template / instruction delimiters smuggled into data.
+    {
+        type: "injection:delimiter",
+        re: /<\/?(?:system|assistant|user|instructions?)>|\[\/?INST\]|<\|(?:im_start|im_end|system|user|assistant|endoftext)\|>/gi,
+    },
+    // "reveal your system prompt" / "print your instructions" — prompt-leak probe.
+    {
+        type: "injection:prompt_leak",
+        re: /\b(?:reveal|print|repeat|show|output|display|tell\s+me)\b[^.?!\n]{0,30}\b(?:system\s+prompt|your\s+instructions|initial\s+prompt|the\s+prompt\s+above|your\s+rules)\b/gi,
+    },
+    // "email/exfiltrate the api key/password/secret" — data-exfiltration steering.
+    {
+        type: "injection:exfiltration",
+        re: /\b(?:send|exfiltrate|post|email|upload|leak|forward|transmit)\b[^.?!\n]{0,40}\b(?:api[\s_-]?key|password|secret|secrets|token|credential|credentials|private\s+key)\b/gi,
+    },
+];
+/** Unicode tag plane (U+E0000–U+E007F) — invisible chars abused to smuggle
+ * instructions past a human reviewer. Detected as its own finding TYPE; the
+ * assembler strips them from delivered content, but their PRESENCE in untrusted
+ * input is itself a signal worth counting. */
+const UNICODE_TAG_RE = /[\u{E0000}-\u{E007F}]+/gu;
+/** Collect the spans one pattern matches in `text`. Offsets are into the exact
+ * string handed in; the matched substring is discarded immediately. */
+function spansFor(type, re, text) {
+    const spans = [];
+    for (const m of text.matchAll(re)) {
+        const start = m.index ?? 0;
+        spans.push({ start, end: start + m[0].length, type, confidence: 1 });
+    }
+    return spans;
+}
+/**
+ * The T0 pattern detector. Runs only on untrusted/semi tiers — the template's
+ * own trusted text is never scanned (it is the route author's, by construction).
+ * Deterministic: confidence 1 on every match, versioned as `patterns@v1`.
+ */
+function createPatternDetector() {
+    return {
+        id: exports.PATTERNS_ID,
+        kind: "deterministic",
+        detect(input) {
+            // Trusted content is the route's own framing — never an injection source.
+            if (input.tier === "trusted")
+                return Promise.resolve([]);
+            const spans = [];
+            for (const p of INJECTION_PATTERNS)
+                spans.push(...spansFor(p.type, p.re, input.text));
+            spans.push(...spansFor("injection:unicode_tag", UNICODE_TAG_RE, input.text));
+            // Reading order keeps the (offsets-only) span list stable and testable.
+            spans.sort((a, b) => a.start - b.start || a.end - b.end);
+            return Promise.resolve(spans);
+        },
+    };
+}
+/** Thrown by {@link createClassifierDetector} when the optional peer dep or the
+ * local model file is absent — a TYPED signal the engine catches to degrade to
+ * T0 with `degraded: true` (spec §4.3), never a run-failing surprise. */
+class ScreenDetectorUnavailableError extends Error {
+    constructor(detectorId, reason) {
+        super(`screen detector "${detectorId}" is unavailable: ${reason}`);
+        this.name = "ScreenDetectorUnavailableError";
+        this.detectorId = detectorId;
+    }
+}
+exports.ScreenDetectorUnavailableError = ScreenDetectorUnavailableError;
+/**
+ * The optional T1 in-process classifier adapter (A3: OPTIONAL peer dependency;
+ * NO weights bundled; NO default npm dep). Absent peer dep OR absent model file
+ * ⇒ throws {@link ScreenDetectorUnavailableError} so the engine degrades to T0
+ * with a once-per-process notice and `degraded: true` on the receipt.
+ *
+ * ModelRig NEVER bundles or re-hosts weights — the customer fetches them with
+ * `modelrig screen pull <detector>` to a local cache and points `modelPath` at
+ * the result. The runtime peer (`onnxruntime-node` or a WASM transformers
+ * backend) is likewise the customer's to install.
+ */
+function createClassifierDetector(opts) {
+    const peer = opts.runtime === "onnx" ? "onnxruntime-node" : "@xenova/transformers";
+    // A3: the peer is an OPTIONAL dependency resolved at RUNTIME. `require` is used
+    // (not a static import) precisely so a missing peer is a catchable throw, not a
+    // load-time crash / a bundled dependency.
+    let runtimeModule;
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires, global-require
+        runtimeModule = require(peer);
+    }
+    catch {
+        throw new ScreenDetectorUnavailableError(opts.id, `optional peer dependency "${peer}" is not installed (install it and run \`modelrig screen pull ${opts.id}\`)`);
+    }
+    if (!(0, node_fs_1.existsSync)(opts.modelPath)) {
+        throw new ScreenDetectorUnavailableError(opts.id, `model file not found at "${opts.modelPath}" — fetch it with \`modelrig screen pull ${opts.id}\` (weights are never bundled, A3)`);
+    }
+    // The concrete inference wiring (tokenize → run → score → span) is delegated to
+    // the loaded runtime; this SC-1a scaffold proves the OPTIONAL-load contract and
+    // the fail-closed degrade path. A configured-and-present classifier tier is a
+    // Matt-env run (live weights); the deterministic T0 path is what ships.
+    void runtimeModule;
+    return {
+        id: opts.id,
+        kind: "classifier",
+        detect(_input) {
+            return Promise.resolve([]);
+        },
+    };
+}

package/dist/screen/phi-gate.d.ts

@@ -0,0 +1,52 @@
+/**
+ * SC-2 — the gated `phi` route posture (spec-sc2 §4). Deterministic, fail-closed,
+ * dependency-free. Runs at ROUTE LOAD (the same place `require:` / `mask:` /
+ * `screen:` are validated), so a mis-postured PHI route REFUSES TO LOAD with a
+ * teaching error rather than silently serving PHI on an unmasked, un-screened,
+ * content-retaining route.
+ *
+ * A route classified `phi` (route-level `classification: phi`) MUST satisfy ALL:
+ *   1. mask effective mode ≥ redact — i.e. mask rewrites (mode `mask` or `block`,
+ *      CS-1); `off`/`detect` do NOT mask and fail the gate.
+ *   2. `require: zero_retention`  OR  a `sidecar` detector present in
+ *      `screen.detectors` (the managed-custody + sidecar path).
+ *
+ * This does NOT claim de-identification (that is a banned claim, §6). It enforces
+ * that PHI never rides an unmasked, un-screened, content-retaining route. The
+ * gate is code-visible and lane-independent: it checks the mask mode, the
+ * `require` list, and the presence of a sidecar detector — all resolved at load.
+ * `modelrig validate` prints {@link describePhiPosture}: the resolved posture and
+ * the specific unmet requirement.
+ */
+import type { DataClassification } from "../artifacts/classification";
+import type { ResolvedMaskPolicy } from "../mask/types";
+import type { Requirement } from "../types/route";
+import type { ResolvedScreenPolicy } from "./types";
+/** The load-time inputs the gate reads — all already resolved by the loader. */
+export interface PhiPostureInput {
+    /** The route-level `classification`, if any. The gate fires only for `phi`. */
+    readonly classification?: DataClassification;
+    readonly mask?: ResolvedMaskPolicy;
+    readonly screen?: ResolvedScreenPolicy;
+    readonly require: readonly Requirement[];
+}
+/** The resolved posture — what the gate saw and whether it passed. */
+export interface PhiPosture {
+    readonly isPhi: boolean;
+    readonly maskRedacts: boolean;
+    readonly zeroRetention: boolean;
+    readonly sidecarPresent: boolean;
+    readonly satisfied: boolean;
+}
+/** Resolve the posture for a route (whether or not it is `phi`). */
+export declare function resolvePhiPosture(input: PhiPostureInput): PhiPosture;
+/**
+ * Teaching-style problems for a mis-postured `phi` route (CE-2 fixHint pattern) —
+ * EMPTY when the route is not `phi` or the posture is satisfied. Each string
+ * names the SPECIFIC unmet requirement so the author knows exactly what to add.
+ */
+export declare function checkPhiPosture(input: PhiPostureInput): readonly string[];
+/** A one-line human posture summary for `modelrig validate` (spec-sc2 §4): the
+ * resolved posture and, when unsatisfied, the unmet requirement. */
+export declare function describePhiPosture(input: PhiPostureInput): string;
+//# sourceMappingURL=phi-gate.d.ts.map

package/dist/screen/phi-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phi-gate.d.ts","sourceRoot":"","sources":["../../src/screen/phi-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEpD,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAcD,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CAYpE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAkBzE;AAED;oEACoE;AACpE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAYjE"}

package/dist/screen/phi-gate.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * SC-2 — the gated `phi` route posture (spec-sc2 §4). Deterministic, fail-closed,
+ * dependency-free. Runs at ROUTE LOAD (the same place `require:` / `mask:` /
+ * `screen:` are validated), so a mis-postured PHI route REFUSES TO LOAD with a
+ * teaching error rather than silently serving PHI on an unmasked, un-screened,
+ * content-retaining route.
+ *
+ * A route classified `phi` (route-level `classification: phi`) MUST satisfy ALL:
+ *   1. mask effective mode ≥ redact — i.e. mask rewrites (mode `mask` or `block`,
+ *      CS-1); `off`/`detect` do NOT mask and fail the gate.
+ *   2. `require: zero_retention`  OR  a `sidecar` detector present in
+ *      `screen.detectors` (the managed-custody + sidecar path).
+ *
+ * This does NOT claim de-identification (that is a banned claim, §6). It enforces
+ * that PHI never rides an unmasked, un-screened, content-retaining route. The
+ * gate is code-visible and lane-independent: it checks the mask mode, the
+ * `require` list, and the presence of a sidecar detector — all resolved at load.
+ * `modelrig validate` prints {@link describePhiPosture}: the resolved posture and
+ * the specific unmet requirement.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePhiPosture = resolvePhiPosture;
+exports.checkPhiPosture = checkPhiPosture;
+exports.describePhiPosture = describePhiPosture;
+/** A mask policy "redacts" (rewrites content) iff its effective mode is `mask`
+ * or `block` — `off`/`detect` scan but do not rewrite (CS-1 §3). */
+function maskRedacts(mask) {
+    return mask !== undefined && (mask.policy.mode === "mask" || mask.policy.mode === "block");
+}
+/** A sidecar detector is present iff the resolved screen policy carries a
+ * `sidecar:*` detector identity (built from `screen.sidecar` at resolve time). */
+function hasSidecar(screen) {
+    return screen !== undefined && screen.detectorMeta.some((d) => d.id.startsWith("sidecar:"));
+}
+/** Resolve the posture for a route (whether or not it is `phi`). */
+function resolvePhiPosture(input) {
+    const isPhi = input.classification === "phi";
+    const maskR = maskRedacts(input.mask);
+    const zdr = input.require.includes("zero_retention");
+    const sidecar = hasSidecar(input.screen);
+    return {
+        isPhi,
+        maskRedacts: maskR,
+        zeroRetention: zdr,
+        sidecarPresent: sidecar,
+        satisfied: maskR && (zdr || sidecar),
+    };
+}
+/**
+ * Teaching-style problems for a mis-postured `phi` route (CE-2 fixHint pattern) —
+ * EMPTY when the route is not `phi` or the posture is satisfied. Each string
+ * names the SPECIFIC unmet requirement so the author knows exactly what to add.
+ */
+function checkPhiPosture(input) {
+    const posture = resolvePhiPosture(input);
+    if (!posture.isPhi || posture.satisfied)
+        return [];
+    const problems = [];
+    if (!posture.maskRedacts) {
+        problems.push("a `phi`-classified route must mask its content — set `mask.mode: mask` (or `block`); " +
+            "`off`/`detect` do not redact. PHI must never ride an unmasked route.");
+    }
+    if (!posture.zeroRetention && !posture.sidecarPresent) {
+        problems.push("a `phi`-classified route must either `require: [zero_retention]` OR configure a `screen.sidecar` " +
+            "(a customer-run de-id detector, present in the resolved `screen.detectors` as `sidecar:<digest>`). " +
+            "PHI must never ride a content-retaining route without the sidecar.");
+    }
+    return problems;
+}
+/** A one-line human posture summary for `modelrig validate` (spec-sc2 §4): the
+ * resolved posture and, when unsatisfied, the unmet requirement. */
+function describePhiPosture(input) {
+    const p = resolvePhiPosture(input);
+    if (!p.isPhi)
+        return "";
+    const parts = [
+        `mask≥redact=${p.maskRedacts ? "yes" : "NO"}`,
+        `zero_retention=${p.zeroRetention ? "yes" : "no"}`,
+        `sidecar=${p.sidecarPresent ? "yes" : "no"}`,
+    ];
+    const verdict = p.satisfied
+        ? "OK — PHI posture satisfied"
+        : `UNMET — ${checkPhiPosture(input).join(" ")}`;
+    return `phi posture [${parts.join(" · ")}] → ${verdict}`;
+}

package/dist/screen/policy.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Screening — policy loading & validation (WIRED 2026-08-25, SC-1a). Spec §4.1.
+ *
+ * Runs at ROUTE LOAD (same place `require:` / `mask:` are validated),
+ * synchronously — the route loader is sync, so the shape check, the detector
+ * build, and the hash are too. An unknown detector, an unknown action, or a
+ * `sources` key that LOOSENS a default tier is a LOAD error (teaching message,
+ * CE-2 fixHint style), never a runtime surprise (spec §4.1, §4.3 row 1).
+ *
+ * The single discipline shared with mask/policy.ts: validate the raw shape first
+ * (returns teaching strings, never throws), then parse, then resolve (builds
+ * detectors + the stable `policyHash`). A configured-but-unavailable optional
+ * classifier is NOT a load error — it degrades to T0 with `degraded: true`
+ * (spec §4.3); only a malformed policy fails the load.
+ */
+import { type ModelScreenCall, type DailyCapMeter } from "./model-screen";
+import type { ResolvedScreenPolicy, ScreenPolicy } from "./types";
+/**
+ * Validate the raw YAML `screen:` block shape (used by the route loader and by
+ * `modelrig validate`). Returns teaching-style problem strings (CE-2 fixHint
+ * pattern) — EMPTY means valid. Never throws.
+ */
+export declare function validateScreenPolicyShape(raw: unknown): readonly string[];
+/** Parse a validated raw block into a typed {@link ScreenPolicy}. Assumes
+ * {@link validateScreenPolicyShape} already passed (caller checks first). */
+export declare function parseScreenPolicy(raw: Record<string, unknown>): ScreenPolicy;
+/** Local cache dir for optional classifier weights (`modelrig screen pull`
+ * writes here; the resolver reads here). Weights are NEVER bundled or re-hosted
+ * (A3) — this is the customer's local store under the home dir. (A configurable
+ * location can ride RigConfig in SC-1b; env is read only in config.ts.) */
+export declare function screenCacheDir(): string;
+/** The on-disk model path a classifier id resolves to in the local cache. */
+export declare function classifierModelPath(id: string): string;
+/**
+ * Resolve a parsed policy into built detectors + a stable `policyHash`. The T0
+ * pattern detector is ALWAYS built; each `classifier:` id is built from the
+ * local cache and, if its optional peer dep or model file is absent, DROPPED
+ * with `degraded: true` (spec §4.3 — degrade to T0, never a load failure). A
+ * non-`ScreenDetectorUnavailableError` throw is rethrown (a real bug, not an
+ * absent optional). Pure but for the cache-existence check. */
+/**
+ * SC-3 model-screen wiring (spec-sc3 §2). The T3 tier needs a metered inference
+ * on the customer's CONFIGURED provider, which the pure route loader has no
+ * handle to — so the dispatch layer injects the screen call (and its daily cap)
+ * here. When a `model:screen@<model>` id is configured but NO wiring is supplied
+ * (pure `modelrig validate` / route load), the tier is UNAVAILABLE at load and
+ * the policy resolves `degraded: true` — exactly like a missing classifier
+ * (spec-sc3 §2: optional; absence degrades, never a load failure). When wiring is
+ * supplied, the detector is built and its throws (cap-exhausted / call failure)
+ * ride the shipped seam's §4.3 fail-closed matrix.
+ */
+export interface ModelScreenWiring {
+    /** The metered structured-boolean screen call (customer's provider). */
+    readonly call: ModelScreenCall;
+    /** Calls allowed per UTC day (mirrors run-judge). */
+    readonly dailyCap: number;
+    /** Confidence stamped on a flagged span (default 0.9). */
+    readonly flagConfidence?: number;
+    /** Shared per-process daily meter (defaults to one built per detector). */
+    readonly meter?: DailyCapMeter;
+    /** Injectable clock for the cap's UTC-day boundary. */
+    readonly now?: () => Date;
+}
+export interface ResolveScreenOptions {
+    /** Injected model-screen wiring; absent ⇒ a configured model tier degrades. */
+    readonly modelScreen?: ModelScreenWiring;
+}
+export declare function resolveScreenPolicy(policy: ScreenPolicy, opts?: ResolveScreenOptions): ResolvedScreenPolicy;
+/** sha256 over the canonical policy JSON — the `policy_hash` a receipt carries. */
+export declare function policyHashOf(policy: ScreenPolicy): string;
+//# sourceMappingURL=policy.d.ts.map

package/dist/screen/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/screen/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAeH,OAAO,EAAmD,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC3H,OAAO,KAAK,EAEV,oBAAoB,EAEpB,YAAY,EACb,MAAM,SAAS,CAAC;AA0CjB;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAgEzE;AAwCD;6EAC6E;AAC7E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,CAgB5E;AAaD;;;2EAG2E;AAC3E,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEtD;AAgCD;;;;;;+DAM+D;AAC/D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;CAC1C;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,oBAAyB,GAAG,oBAAoB,CAgF/G;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAEzD"}