nexus-agents 2.90.0 → 2.92.0

package/dist/chunk-NR4NSTJH.js

@@ -0,0 +1,547 @@
+import {
+  CACHE_TIMEOUTS,
+  getTimeProvider
+} from "./chunk-W5I6L4UT.js";
+
+// src/security/trust-types.ts
+import { z } from "zod";
+var TrustTierSchema = z.enum(["1", "2", "3", "4"]);
+var TRUST_TIER_NUMERIC = {
+  "1": 1,
+  "2": 2,
+  "3": 3,
+  "4": 4
+};
+var GitHubUserRoleSchema = z.enum([
+  "owner",
+  "maintainer",
+  "collaborator",
+  "contributor",
+  "member",
+  "unknown"
+]);
+var ROLE_DEFAULT_TRUST = {
+  owner: "1",
+  maintainer: "1",
+  collaborator: "2",
+  contributor: "2",
+  member: "3",
+  unknown: "3"
+};
+var InjectionFlagSchema = z.enum([
+  "authority_claim",
+  "instruction_pattern",
+  "system_prompt_manipulation",
+  "hidden_content",
+  "urgency_manipulation",
+  "fake_conversation",
+  "base64_encoded",
+  "external_link_instruction"
+]);
+var StrippedElementSchema = z.object({
+  /** Type of element stripped. */
+  tag: z.string().min(1),
+  /** Reason for stripping. */
+  reason: z.string().min(1),
+  /** Start index in original content. */
+  startIndex: z.number().int().nonnegative(),
+  /** Length of stripped content. */
+  length: z.number().int().positive()
+});
+var SanitizedInputSchema = z.object({
+  /** Sanitized content with dangerous elements removed. */
+  content: z.string(),
+  /** Original content before sanitization (for audit). */
+  originalLength: z.number().int().nonnegative(),
+  /** Assigned trust tier based on user role and content analysis. */
+  trustTier: TrustTierSchema,
+  /** GitHub user role of the input source. */
+  userRole: GitHubUserRoleSchema,
+  /** Injection patterns detected in content. */
+  injectionFlags: z.array(InjectionFlagSchema),
+  /** Elements stripped during sanitization (audit trail). */
+  strippedElements: z.array(StrippedElementSchema),
+  /** Whether any dangerous content was detected and stripped. */
+  wasModified: z.boolean(),
+  /** Timestamp of sanitization (ISO 8601). */
+  sanitizedAt: z.iso.datetime()
+});
+var SanitizerConfigSchema = z.object({
+  /** GitHub usernames that are always Tier 1 (allowlisted maintainers). */
+  allowlistedMaintainers: z.array(z.string().min(1)).default([]),
+  /** Whether to fail open (log only) or fail closed (block). Phase 1 = open. */
+  failOpen: z.boolean().default(true),
+  /** Maximum input length before truncation. */
+  maxInputLength: z.number().int().positive().default(5e4)
+});
+
+// src/security/input-sanitizer.ts
+var DANGEROUS_HTML_PATTERN = /<(picture|source|img)\b[^>]*>[\s\S]*?<\/\1>|<(picture|source|img)\b[^>]*\/?>/gi;
+var XML_INJECTION_PATTERN = /<\/?(system|human|assistant|instructions|user|prompt|context|tool_use|tool_result)\b[^>]*>/gi;
+var HTML_COMMENT_PATTERN = /<!--[\s\S]*?-->/g;
+var INJECTION_PATTERNS = [
+  {
+    flag: "authority_claim",
+    pattern: /\b(as (?:a|the) (?:maintainer|admin|owner|security lead|repo owner|developer))\b/i
+  },
+  {
+    flag: "authority_claim",
+    pattern: /\b(i(?:'m| am) the (?:repo |project )?(?:owner|maintainer|admin))\b/i
+  },
+  {
+    flag: "instruction_pattern",
+    pattern: /\b(please (?:close|merge|label|mark|apply|delete|remove|approve|reject))\b/i
+  },
+  {
+    flag: "instruction_pattern",
+    pattern: /\b(you (?:should|must|need to) (?:close|merge|label|apply|delete))\b/i
+  },
+  {
+    flag: "system_prompt_manipulation",
+    pattern: /\b(ignore (?:all )?previous (?:instructions|rules|prompts))\b/i
+  },
+  {
+    flag: "system_prompt_manipulation",
+    pattern: /\b(forget (?:your |all )?(?:instructions|rules|safety))\b/i
+  },
+  {
+    flag: "system_prompt_manipulation",
+    pattern: /\b(new (?:instructions|rules|system prompt|directives))\b/i
+  },
+  {
+    flag: "urgency_manipulation",
+    pattern: /\b(critical|emergency|urgent|must act now|immediately|time[- ]?sensitive)\b/i
+  },
+  {
+    flag: "fake_conversation",
+    pattern: /<(?:assistant|human|user|system)>/i
+  },
+  // base64_encoded is detected separately by `looksLikeBase64Payload` below.
+  // The lookahead-based regex it replaced exhibited catastrophic backtracking
+  // on long hex-only inputs (#2191) — see `looksLikeBase64Payload` for the
+  // two-phase rewrite that preserves the #1811 SHA-hash false-positive guard.
+  {
+    flag: "external_link_instruction",
+    pattern: /(?:apply|run|execute|install)\s+(?:this\s+)?(?:from\s+)?https?:\/\//i
+  }
+];
+var BASE64_RUN_GLOBAL = /[A-Za-z0-9+/]{40,}={0,2}/g;
+var BASE64_DISCRIMINATOR = /[g-zG-Z+/=]/;
+function looksLikeBase64Payload(content) {
+  for (const match of content.matchAll(BASE64_RUN_GLOBAL)) {
+    if (BASE64_DISCRIMINATOR.test(match[0])) return true;
+  }
+  return false;
+}
+var DANGEROUS_TAG_NAMES = "picture|source|img|system|human|assistant|instructions|user|prompt|context|tool_use|tool_result";
+var ENCODED_DANGEROUS_TAG_PATTERN = new RegExp(
+  `&(?:lt|#0*60|#x0*3c);\\s*\\/?\\s*(?:${DANGEROUS_TAG_NAMES})\\b`,
+  "i"
+);
+function decodeEntities(content) {
+  return content.replace(/&#(\d+);/g, (_match, dec) => {
+    const code = Number.parseInt(dec, 10);
+    return Number.isFinite(code) ? String.fromCodePoint(code) : _match;
+  }).replace(/&#x([0-9a-f]+);/gi, (_match, hex) => {
+    const code = Number.parseInt(hex, 16);
+    return Number.isFinite(code) ? String.fromCodePoint(code) : _match;
+  }).replace(/&lt;/gi, "<").replace(/&gt;/gi, ">").replace(/&quot;/gi, '"').replace(/&apos;/gi, "'").replace(/&amp;/gi, "&");
+}
+function applyEntityEvasionDefense(content) {
+  if (!ENCODED_DANGEROUS_TAG_PATTERN.test(content)) {
+    return { cleaned: content, stripped: [] };
+  }
+  const decoded = decodeEntities(content);
+  return {
+    cleaned: decoded,
+    stripped: [
+      {
+        tag: "&\u2026;",
+        reason: "HTML entity-encoded dangerous tag decoded for stripping (CWE-79)",
+        startIndex: 0,
+        length: content.length
+      }
+    ]
+  };
+}
+function stripDangerousHtml(content) {
+  const stripped = [];
+  let cleaned = content;
+  const MAX_PASSES = 5;
+  for (let pass = 0; pass < MAX_PASSES; pass++) {
+    DANGEROUS_HTML_PATTERN.lastIndex = 0;
+    if (!DANGEROUS_HTML_PATTERN.test(cleaned)) break;
+    cleaned = cleaned.replace(DANGEROUS_HTML_PATTERN, (match, _g1, _g2, offset) => {
+      stripped.push({
+        tag: match.slice(0, 30) + (match.length > 30 ? "..." : ""),
+        reason: "Dangerous HTML tag (Trail of Bits injection vector)",
+        startIndex: offset,
+        length: match.length
+      });
+      return "";
+    });
+  }
+  return { cleaned, stripped };
+}
+function stripXmlTags(content) {
+  const stripped = [];
+  let cleaned = content;
+  const MAX_PASSES = 5;
+  for (let pass = 0; pass < MAX_PASSES; pass++) {
+    XML_INJECTION_PATTERN.lastIndex = 0;
+    if (!XML_INJECTION_PATTERN.test(cleaned)) break;
+    cleaned = cleaned.replace(XML_INJECTION_PATTERN, (match, _g1, offset) => {
+      stripped.push({
+        tag: match,
+        reason: "XML-like conversation injection tag",
+        startIndex: offset,
+        length: match.length
+      });
+      return "";
+    });
+  }
+  return { cleaned, stripped };
+}
+function stripHtmlComments(content) {
+  const stripped = [];
+  let cleaned = content;
+  const MAX_PASSES = 5;
+  for (let pass = 0; pass < MAX_PASSES; pass++) {
+    HTML_COMMENT_PATTERN.lastIndex = 0;
+    const prevLength = cleaned.length;
+    cleaned = cleaned.replace(HTML_COMMENT_PATTERN, (match, offset) => {
+      const hasInstruction = /\b(ignore|execute|close|merge|delete|apply)\b/i.test(match);
+      if (!hasInstruction) return match;
+      stripped.push({
+        tag: "<!-- ... -->",
+        reason: "HTML comment with instruction-like content",
+        startIndex: offset,
+        length: match.length
+      });
+      return "";
+    });
+    if (cleaned.length === prevLength) break;
+  }
+  let searchFrom = 0;
+  while (searchFrom < cleaned.length) {
+    const openIdx = cleaned.indexOf("<!--", searchFrom);
+    if (openIdx === -1) break;
+    const closeIdx = cleaned.indexOf("-->", openIdx + 4);
+    if (closeIdx === -1) {
+      stripped.push({
+        tag: "<!--",
+        reason: "Unclosed HTML comment (potential injection vector)",
+        startIndex: openIdx,
+        length: cleaned.length - openIdx
+      });
+      cleaned = cleaned.slice(0, openIdx);
+      break;
+    }
+    searchFrom = closeIdx + 3;
+  }
+  return { cleaned, stripped };
+}
+function detectInjectionPatterns(content) {
+  const flags = /* @__PURE__ */ new Set();
+  for (const { flag, pattern } of INJECTION_PATTERNS) {
+    pattern.lastIndex = 0;
+    if (pattern.test(content)) {
+      flags.add(flag);
+    }
+  }
+  if (looksLikeBase64Payload(content)) {
+    flags.add("base64_encoded");
+  }
+  return Array.from(flags);
+}
+function normalizeRole(userRole) {
+  const lower = userRole.toLowerCase();
+  if (lower in ROLE_DEFAULT_TRUST) return lower;
+  return "unknown";
+}
+function assignTrustTier(userRole, injectionFlags, allowlisted) {
+  if (allowlisted) return "1";
+  const normalizedRole = normalizeRole(userRole);
+  const baseTier = ROLE_DEFAULT_TRUST[normalizedRole];
+  const hostileFlags = ["system_prompt_manipulation", "fake_conversation"];
+  if (injectionFlags.some((f) => hostileFlags.includes(f))) return "4";
+  if (injectionFlags.includes("authority_claim") && normalizedRole !== "owner" && normalizedRole !== "maintainer") {
+    return "4";
+  }
+  return baseTier;
+}
+function sanitizeInput(content, userRole, username, config) {
+  const cfg = SanitizerConfigSchema.parse(config ?? {});
+  const truncated = content.slice(0, cfg.maxInputLength);
+  const allowlisted = cfg.allowlistedMaintainers.includes(username);
+  try {
+    const entityDecoded = applyEntityEvasionDefense(truncated);
+    const html = stripDangerousHtml(entityDecoded.cleaned);
+    const xml = stripXmlTags(html.cleaned);
+    const comments = stripHtmlComments(xml.cleaned);
+    const allStripped = [
+      ...entityDecoded.stripped,
+      ...html.stripped,
+      ...xml.stripped,
+      ...comments.stripped
+    ];
+    const injectionFlags = detectInjectionPatterns(truncated);
+    const trustTier = assignTrustTier(userRole, injectionFlags, allowlisted);
+    return {
+      content: comments.cleaned,
+      originalLength: content.length,
+      trustTier,
+      userRole,
+      injectionFlags,
+      strippedElements: allStripped,
+      wasModified: allStripped.length > 0,
+      sanitizedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  } catch (err) {
+    return buildFailClosedResult(err, content, truncated, userRole, allowlisted);
+  }
+}
+function buildFailClosedResult(err, originalContent, truncated, userRole, allowlisted) {
+  const message = err instanceof Error ? err.message : String(err);
+  return {
+    content: "",
+    originalLength: originalContent.length,
+    trustTier: allowlisted ? "1" : "4",
+    userRole,
+    injectionFlags: [],
+    strippedElements: [
+      {
+        tag: "(pipeline-failure)",
+        reason: `Sanitizer pipeline threw; input discarded as fail-closed: ${message}`,
+        startIndex: 0,
+        length: truncated.length
+      }
+    ],
+    wasModified: true,
+    sanitizedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// src/security/reputation-model.ts
+import { z as z2 } from "zod";
+var SuspiciousSignalSchema = z2.enum([
+  "new_account",
+  "no_prior_contributions",
+  "injection_patterns_detected",
+  "rapid_comments",
+  "mismatched_authority_claim"
+]);
+var DAYS_PER_YEAR_APPROX = 36.5;
+var SUSPICIOUS_THRESHOLDS = {
+  /** Account younger than this (days) is flagged. */
+  newAccountDays: 30,
+  /** Fewer contributions than this is flagged. */
+  minContributions: 1,
+  /** More comments than this in the window triggers rapid-comment flag. */
+  rapidCommentThreshold: 5,
+  /** Time window (minutes) for rapid comment detection. */
+  rapidCommentWindowMinutes: 10
+};
+var DEFAULT_TTL_MS = CACHE_TIMEOUTS.reputationTtlMs;
+var DEFAULT_MAX_SIZE = 1e3;
+var ReputationCache = class {
+  cache = /* @__PURE__ */ new Map();
+  ttlMs;
+  maxSize;
+  constructor(ttlMs = DEFAULT_TTL_MS, maxSize = DEFAULT_MAX_SIZE) {
+    this.ttlMs = ttlMs;
+    this.maxSize = maxSize;
+  }
+  get(username) {
+    const entry = this.cache.get(username);
+    if (entry === void 0) return void 0;
+    if (getTimeProvider().now() > entry.expiresAt) {
+      this.cache.delete(username);
+      return void 0;
+    }
+    return entry.assessment;
+  }
+  set(username, assessment) {
+    if (this.cache.size >= this.maxSize && !this.cache.has(username)) {
+      this.evictOldest();
+    }
+    this.cache.set(username, {
+      assessment,
+      expiresAt: getTimeProvider().now() + this.ttlMs
+    });
+  }
+  /** Evict a batch of oldest entries (10% of maxSize, minimum 1). */
+  evictOldest() {
+    const batchSize = Math.max(1, Math.floor(this.maxSize * 0.1));
+    const keys = this.cache.keys();
+    for (let i = 0; i < batchSize; i++) {
+      const next = keys.next();
+      if (next.done === true) break;
+      this.cache.delete(next.value);
+    }
+  }
+  clear() {
+    this.cache.clear();
+  }
+  get size() {
+    return this.cache.size;
+  }
+};
+var HOSTILE_INJECTION_FLAGS = [
+  "system_prompt_manipulation",
+  "fake_conversation",
+  "authority_claim",
+  "hidden_content"
+];
+function hasHostileInjection(flags) {
+  return flags.some((f) => HOSTILE_INJECTION_FLAGS.includes(f));
+}
+function isRapidCommenting(m) {
+  return m.recentCommentCount !== void 0 && m.recentCommentWindowMinutes !== void 0 && m.recentCommentCount > SUSPICIOUS_THRESHOLDS.rapidCommentThreshold && m.recentCommentWindowMinutes <= SUSPICIOUS_THRESHOLDS.rapidCommentWindowMinutes;
+}
+function isMismatchedAuthority(m) {
+  if (!m.injectionFlags.includes("authority_claim")) return false;
+  const association = m.authorAssociation.toUpperCase();
+  return association !== "OWNER" && association !== "MEMBER";
+}
+function detectSuspiciousSignals(metadata) {
+  const signals = [];
+  const { accountAgeDays, priorContributions } = metadata;
+  if (accountAgeDays !== void 0 && accountAgeDays < SUSPICIOUS_THRESHOLDS.newAccountDays) {
+    signals.push("new_account");
+  }
+  if (priorContributions !== void 0 && priorContributions < SUSPICIOUS_THRESHOLDS.minContributions) {
+    signals.push("no_prior_contributions");
+  }
+  if (hasHostileInjection(metadata.injectionFlags)) signals.push("injection_patterns_detected");
+  if (isRapidCommenting(metadata)) signals.push("rapid_comments");
+  if (isMismatchedAuthority(metadata)) signals.push("mismatched_authority_claim");
+  return signals;
+}
+function calculateReputationScore(metadata, signals, userRole) {
+  let score = 50;
+  const roleBonus = {
+    owner: 40,
+    maintainer: 35,
+    collaborator: 25,
+    contributor: 15,
+    member: 5,
+    unknown: 0
+  };
+  score += roleBonus[userRole];
+  if (metadata.accountAgeDays !== void 0) {
+    score += Math.min(metadata.accountAgeDays / DAYS_PER_YEAR_APPROX, 10);
+  }
+  if (metadata.priorContributions !== void 0) {
+    score += Math.min(metadata.priorContributions, 10);
+  }
+  const signalPenalty = {
+    new_account: -15,
+    no_prior_contributions: -10,
+    injection_patterns_detected: -25,
+    rapid_comments: -20,
+    mismatched_authority_claim: -30
+  };
+  for (const signal of signals) {
+    score += signalPenalty[signal];
+  }
+  return Math.max(0, Math.min(100, Math.round(score)));
+}
+function mapRole(association) {
+  switch (association.toUpperCase()) {
+    case "OWNER":
+      return "owner";
+    case "MEMBER":
+      return "member";
+    case "COLLABORATOR":
+      return "collaborator";
+    case "CONTRIBUTOR":
+      return "contributor";
+    default:
+      return "unknown";
+  }
+}
+function determineEffectiveTier(userRole, signals) {
+  const baseTier = ROLE_DEFAULT_TRUST[userRole];
+  const hostileSignals = [
+    "injection_patterns_detected",
+    "mismatched_authority_claim"
+  ];
+  if (signals.some((s) => hostileSignals.includes(s))) return "4";
+  if (signals.length >= 2) {
+    const baseNumeric = TRUST_TIER_NUMERIC[baseTier];
+    const downgraded = Math.min(baseNumeric + 1, 4);
+    return String(downgraded);
+  }
+  return baseTier;
+}
+function assessReputation(metadata, cache) {
+  const cached = cache?.get(metadata.username);
+  if (cached !== void 0) return cached;
+  const userRole = mapRole(metadata.authorAssociation);
+  const signals = detectSuspiciousSignals(metadata);
+  const score = calculateReputationScore(metadata, signals, userRole);
+  const effectiveTier = determineEffectiveTier(userRole, signals);
+  const assessment = {
+    username: metadata.username,
+    userRole,
+    suspiciousSignals: signals,
+    isSuspicious: signals.length > 0,
+    effectiveTrustTier: effectiveTier,
+    reputationScore: score,
+    reason: buildReason(userRole, signals, effectiveTier),
+    assessedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  cache?.set(metadata.username, assessment);
+  return assessment;
+}
+function reconcileTrustTier(classifierTier, reputation) {
+  if (classifierTier === "1") return "1";
+  const repTier = reputation?.effectiveTrustTier;
+  if (repTier === void 0) return classifierTier;
+  return TRUST_TIER_NUMERIC[repTier] > TRUST_TIER_NUMERIC[classifierTier] ? repTier : classifierTier;
+}
+var ReputationGatingModeSchema = z2.enum(["off", "audit", "enforce"]);
+var DEFAULT_REPUTATION_GATING_MODE = "audit";
+function resolveReputationGatingMode(env = process.env) {
+  const raw = env["NEXUS_REPUTATION_GATING"];
+  if (typeof raw !== "string" || raw.length === 0) return DEFAULT_REPUTATION_GATING_MODE;
+  const parsed = ReputationGatingModeSchema.safeParse(raw.toLowerCase());
+  return parsed.success ? parsed.data : DEFAULT_REPUTATION_GATING_MODE;
+}
+function gateWithReputation(classifierTier, reputation, mode) {
+  const reconciledTier = mode === "off" ? classifierTier : reconcileTrustTier(classifierTier, reputation);
+  const enforcedTier = mode === "enforce" ? reconciledTier : classifierTier;
+  return {
+    enforcedTier,
+    reconciledTier,
+    demotionSuppressed: mode !== "enforce" && reconciledTier !== classifierTier,
+    mode
+  };
+}
+function buildReason(role, signals, tier) {
+  if (signals.length === 0) {
+    return `Role ${role} \u2192 Tier ${tier} (no suspicious signals)`;
+  }
+  const signalList = signals.join(", ");
+  return `Role ${role} \u2192 Tier ${tier} (signals: ${signalList})`;
+}
+
+export {
+  TrustTierSchema,
+  TRUST_TIER_NUMERIC,
+  GitHubUserRoleSchema,
+  ROLE_DEFAULT_TRUST,
+  InjectionFlagSchema,
+  StrippedElementSchema,
+  SanitizedInputSchema,
+  SanitizerConfigSchema,
+  sanitizeInput,
+  SuspiciousSignalSchema,
+  ReputationCache,
+  assessReputation,
+  reconcileTrustTier,
+  resolveReputationGatingMode,
+  gateWithReputation
+};
+//# sourceMappingURL=chunk-NR4NSTJH.js.map

package/dist/chunk-NR4NSTJH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/trust-types.ts","../src/security/input-sanitizer.ts","../src/security/reputation-model.ts"],"sourcesContent":["/**\n * nexus-agents/security - Trust Types\n *\n * Zod schemas and TypeScript types for the untrusted input hardening\n * framework. Defines trust tiers, sanitized input, user roles, and\n * injection detection flags.\n *\n * @module security/trust-types\n * (Source: Issue #818, #819 — Phase 1: Input Sanitization)\n */\n\nimport { z } from 'zod';\n\n// ============================================================================\n// Trust Tiers\n// ============================================================================\n\n/**\n * Trust tier classification for input sources.\n * Lower number = higher trust.\n *\n * 1 = Authoritative (repo files, CI, CLAUDE.md, allowlisted maintainers)\n * 2 = Semi-trusted (collaborator issue body, contributor PR metadata)\n * 3 = Untrusted (unknown user comments, non-collaborator issue body)\n * 4 = Hostile (injection patterns, hidden HTML, instruction-like content)\n */\nexport const TrustTierSchema = z.enum(['1', '2', '3', '4']);\nexport type TrustTier = z.infer<typeof TrustTierSchema>;\n\n/** Numeric trust tier for comparisons. Higher number = lower trust. */\nexport const TRUST_TIER_NUMERIC: Record<TrustTier, number> = {\n  '1': 1,\n  '2': 2,\n  '3': 3,\n  '4': 4,\n};\n\n// ============================================================================\n// GitHub User Roles\n// ============================================================================\n\n/**\n * GitHub user relationship to the repository.\n */\nexport const GitHubUserRoleSchema = z.enum([\n  'owner',\n  'maintainer',\n  'collaborator',\n  'contributor',\n  'member',\n  'unknown',\n]);\nexport type GitHubUserRole = z.infer<typeof GitHubUserRoleSchema>;\n\n/**\n * Default trust tier mapping for each GitHub role.\n * Can be overridden by injection pattern detection (downgrade only).\n */\nexport const ROLE_DEFAULT_TRUST: Record<GitHubUserRole, TrustTier> = {\n  owner: '1',\n  maintainer: '1',\n  collaborator: '2',\n  contributor: '2',\n  member: '3',\n  unknown: '3',\n};\n\n// ============================================================================\n// Injection Detection\n// ============================================================================\n\n/**\n * Categories of injection patterns detected in content.\n */\nexport const InjectionFlagSchema = z.enum([\n  'authority_claim',\n  'instruction_pattern',\n  'system_prompt_manipulation',\n  'hidden_content',\n  'urgency_manipulation',\n  'fake_conversation',\n  'base64_encoded',\n  'external_link_instruction',\n]);\nexport type InjectionFlag = z.infer<typeof InjectionFlagSchema>;\n\n/**\n * An element stripped during sanitization, preserved for audit trail.\n */\nexport const StrippedElementSchema = z.object({\n  /** Type of element stripped. */\n  tag: z.string().min(1),\n  /** Reason for stripping. */\n  reason: z.string().min(1),\n  /** Start index in original content. */\n  startIndex: z.number().int().nonnegative(),\n  /** Length of stripped content. */\n  length: z.number().int().positive(),\n});\nexport type StrippedElement = z.infer<typeof StrippedElementSchema>;\n\n// ============================================================================\n// Sanitized Input\n// ============================================================================\n\n/**\n * The result of sanitizing untrusted input.\n * Contains cleaned content, trust classification, and audit data.\n */\nexport const SanitizedInputSchema = z.object({\n  /** Sanitized content with dangerous elements removed. */\n  content: z.string(),\n  /** Original content before sanitization (for audit). */\n  originalLength: z.number().int().nonnegative(),\n  /** Assigned trust tier based on user role and content analysis. */\n  trustTier: TrustTierSchema,\n  /** GitHub user role of the input source. */\n  userRole: GitHubUserRoleSchema,\n  /** Injection patterns detected in content. */\n  injectionFlags: z.array(InjectionFlagSchema),\n  /** Elements stripped during sanitization (audit trail). */\n  strippedElements: z.array(StrippedElementSchema),\n  /** Whether any dangerous content was detected and stripped. */\n  wasModified: z.boolean(),\n  /** Timestamp of sanitization (ISO 8601). */\n  sanitizedAt: z.iso.datetime(),\n});\nexport type SanitizedInput = z.infer<typeof SanitizedInputSchema>;\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/**\n * Configuration for the input sanitizer.\n */\nexport const SanitizerConfigSchema = z.object({\n  /** GitHub usernames that are always Tier 1 (allowlisted maintainers). */\n  allowlistedMaintainers: z.array(z.string().min(1)).default([]),\n  /** Whether to fail open (log only) or fail closed (block). Phase 1 = open. */\n  failOpen: z.boolean().default(true),\n  /** Maximum input length before truncation. */\n  maxInputLength: z.number().int().positive().default(50_000),\n});\nexport type SanitizerConfig = z.infer<typeof SanitizerConfigSchema>;\n","/**\n * nexus-agents/security - Input Sanitizer\n *\n * Sanitizes untrusted GitHub input by stripping dangerous HTML/XML tags,\n * detecting injection patterns, and producing a SanitizedInput result\n * with full audit trail.\n *\n * Defense layer 1 of the three-layer hardening architecture.\n * See: docs/architecture/UNTRUSTED_INPUT_HARDENING.md\n *\n * @module security/input-sanitizer\n * (Source: Issue #818, #819 — Phase 1: Input Sanitization)\n */\n\nimport type {\n  InjectionFlag,\n  SanitizedInput,\n  SanitizerConfig,\n  StrippedElement,\n  TrustTier,\n  GitHubUserRole,\n} from './trust-types.js';\nimport { ROLE_DEFAULT_TRUST, SanitizerConfigSchema } from './trust-types.js';\n\n// ============================================================================\n// Dangerous HTML Patterns (Trail of Bits / GitHub Copilot vectors)\n// ============================================================================\n\n/**\n * HTML tags to strip. These are known injection vectors:\n * - `<picture>` / `<source>`: Trail of Bits GitHub Copilot injection\n * - `<img>`: Can carry injection via alt text or onerror\n */\nconst DANGEROUS_HTML_PATTERN =\n  /<(picture|source|img)\\b[^>]*>[\\s\\S]*?<\\/\\1>|<(picture|source|img)\\b[^>]*\\/?>/gi;\n\n// ============================================================================\n// XML-like Tags (Conversation History Injection)\n// ============================================================================\n\n/**\n * XML-like tags that mimic conversation structure or system prompts.\n */\nconst XML_INJECTION_PATTERN =\n  /<\\/?(system|human|assistant|instructions|user|prompt|context|tool_use|tool_result)\\b[^>]*>/gi;\n\n// ============================================================================\n// HTML Comments with Instructions\n// ============================================================================\n\nconst HTML_COMMENT_PATTERN = /<!--[\\s\\S]*?-->/g;\n\n// ============================================================================\n// Injection Pattern Detectors\n// ============================================================================\n\ninterface PatternMatch {\n  flag: InjectionFlag;\n  pattern: RegExp;\n}\n\nconst INJECTION_PATTERNS: readonly PatternMatch[] = [\n  {\n    flag: 'authority_claim',\n    pattern: /\\b(as (?:a|the) (?:maintainer|admin|owner|security lead|repo owner|developer))\\b/i,\n  },\n  {\n    flag: 'authority_claim',\n    pattern: /\\b(i(?:'m| am) the (?:repo |project )?(?:owner|maintainer|admin))\\b/i,\n  },\n  {\n    flag: 'instruction_pattern',\n    pattern: /\\b(please (?:close|merge|label|mark|apply|delete|remove|approve|reject))\\b/i,\n  },\n  {\n    flag: 'instruction_pattern',\n    pattern: /\\b(you (?:should|must|need to) (?:close|merge|label|apply|delete))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(ignore (?:all )?previous (?:instructions|rules|prompts))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(forget (?:your |all )?(?:instructions|rules|safety))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(new (?:instructions|rules|system prompt|directives))\\b/i,\n  },\n  {\n    flag: 'urgency_manipulation',\n    pattern: /\\b(critical|emergency|urgent|must act now|immediately|time[- ]?sensitive)\\b/i,\n  },\n  {\n    flag: 'fake_conversation',\n    pattern: /<(?:assistant|human|user|system)>/i,\n  },\n  // base64_encoded is detected separately by `looksLikeBase64Payload` below.\n  // The lookahead-based regex it replaced exhibited catastrophic backtracking\n  // on long hex-only inputs (#2191) — see `looksLikeBase64Payload` for the\n  // two-phase rewrite that preserves the #1811 SHA-hash false-positive guard.\n  {\n    flag: 'external_link_instruction',\n    pattern: /(?:apply|run|execute|install)\\s+(?:this\\s+)?(?:from\\s+)?https?:\\/\\//i,\n  },\n];\n\n/**\n * Two-phase base64-payload detection (#2191).\n *\n * The original `(?=[A-Za-z0-9+/]*[g-zG-Z+/=])[A-Za-z0-9+/]{40,}={0,2}` regex\n * was vulnerable to catastrophic backtracking — V8 took ~1.8s on a 50K\n * hex-only adversarial input. Splitting the check into two non-overlapping\n * phases removes the lookahead and makes the worst case linear.\n *\n *   Phase 1: find a 40+ run of base64-alphabet chars (no lookahead).\n *   Phase 2: confirm the matched substring contains a base64-discriminating\n *            char (g-z, G-Z, +, /, =) so SHA-1 / SHA-256 hex hashes don't\n *            false-positive (preserves #1811 behavior).\n *\n * Same detection coverage as the original; same false-positive resistance.\n */\nconst BASE64_RUN_GLOBAL = /[A-Za-z0-9+/]{40,}={0,2}/g;\nconst BASE64_DISCRIMINATOR = /[g-zG-Z+/=]/;\n\nfunction looksLikeBase64Payload(content: string): boolean {\n  // Iterate every 40+ base64-alphabet run rather than just the first one,\n  // so a long hex-only prefix doesn't mask a real base64 payload that\n  // appears later in the content.\n  for (const match of content.matchAll(BASE64_RUN_GLOBAL)) {\n    if (BASE64_DISCRIMINATOR.test(match[0])) return true;\n  }\n  return false;\n}\n\n// ============================================================================\n// HTML Entity Decoding (evasion defense)\n// ============================================================================\n\n/**\n * Dangerous-tag names we will still match after entity decoding.\n * Kept in sync with DANGEROUS_HTML_PATTERN and XML_INJECTION_PATTERN above.\n */\nconst DANGEROUS_TAG_NAMES =\n  'picture|source|img|system|human|assistant|instructions|user|prompt|context|tool_use|tool_result';\n\n/**\n * Detects whether the input contains entity-encoded forms of any dangerous\n * tag (&lt;picture, &#60;system, &#x3c;img …). Used as a cheap pre-check so\n * that benign content with legitimate entities (e.g. \"AT&amp;T\") is passed\n * through untouched and wasModified stays false.\n */\nconst ENCODED_DANGEROUS_TAG_PATTERN = new RegExp(\n  `&(?:lt|#0*60|#x0*3c);\\\\s*\\\\/?\\\\s*(?:${DANGEROUS_TAG_NAMES})\\\\b`,\n  'i'\n);\n\n/** Decodes the subset of HTML entities that can reconstruct tag syntax. */\nfunction decodeEntities(content: string): string {\n  return (\n    content\n      // Numeric (decimal) references\n      .replace(/&#(\\d+);/g, (_match, dec: string) => {\n        const code = Number.parseInt(dec, 10);\n        return Number.isFinite(code) ? String.fromCodePoint(code) : _match;\n      })\n      // Numeric (hex) references\n      .replace(/&#x([0-9a-f]+);/gi, (_match, hex: string) => {\n        const code = Number.parseInt(hex, 16);\n        return Number.isFinite(code) ? String.fromCodePoint(code) : _match;\n      })\n      // Named entities most relevant to tag reconstruction\n      .replace(/&lt;/gi, '<')\n      .replace(/&gt;/gi, '>')\n      .replace(/&quot;/gi, '\"')\n      .replace(/&apos;/gi, \"'\")\n      // &amp; must be decoded last so that &amp;lt; does not resurface as <\n      .replace(/&amp;/gi, '&')\n  );\n}\n\n/**\n * Runs decodeEntities only if the input contains an entity-encoded dangerous\n * tag. This keeps benign content with legitimate entities untouched.\n */\nfunction applyEntityEvasionDefense(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  if (!ENCODED_DANGEROUS_TAG_PATTERN.test(content)) {\n    return { cleaned: content, stripped: [] };\n  }\n  const decoded = decodeEntities(content);\n  return {\n    cleaned: decoded,\n    stripped: [\n      {\n        tag: '&…;',\n        reason: 'HTML entity-encoded dangerous tag decoded for stripping (CWE-79)',\n        startIndex: 0,\n        length: content.length,\n      },\n    ],\n  };\n}\n\n// ============================================================================\n// Core Sanitization Functions\n// ============================================================================\n\n/** Strips dangerous HTML tags and records what was removed.\n * Loops until stable to prevent reconstructed patterns after removal (#1496). */\nfunction stripDangerousHtml(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    DANGEROUS_HTML_PATTERN.lastIndex = 0;\n    if (!DANGEROUS_HTML_PATTERN.test(cleaned)) break;\n    cleaned = cleaned.replace(DANGEROUS_HTML_PATTERN, (match, _g1, _g2, offset: number) => {\n      stripped.push({\n        tag: match.slice(0, 30) + (match.length > 30 ? '...' : ''),\n        reason: 'Dangerous HTML tag (Trail of Bits injection vector)',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n  }\n  return { cleaned, stripped };\n}\n\n/** Strips XML-like tags that mimic conversation structure.\n * Loops until stable to prevent reconstructed patterns after removal (#1496). */\nfunction stripXmlTags(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    XML_INJECTION_PATTERN.lastIndex = 0;\n    if (!XML_INJECTION_PATTERN.test(cleaned)) break;\n    cleaned = cleaned.replace(XML_INJECTION_PATTERN, (match, _g1, offset: number) => {\n      stripped.push({\n        tag: match,\n        reason: 'XML-like conversation injection tag',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n  }\n  return { cleaned, stripped };\n}\n\n/** Strips HTML comments that may contain hidden instructions.\n * Loops until stable to prevent reconstructed comment patterns (#1496). */\nfunction stripHtmlComments(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  // Loop until stable: stripping may reveal new instruction-bearing comments\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    HTML_COMMENT_PATTERN.lastIndex = 0;\n    const prevLength = cleaned.length;\n    cleaned = cleaned.replace(HTML_COMMENT_PATTERN, (match, offset: number) => {\n      const hasInstruction = /\\b(ignore|execute|close|merge|delete|apply)\\b/i.test(match);\n      if (!hasInstruction) return match;\n\n      stripped.push({\n        tag: '<!-- ... -->',\n        reason: 'HTML comment with instruction-like content',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n    if (cleaned.length === prevLength) break;\n  }\n  // Second pass: strip unclosed <!-- tags (incomplete comment injection)\n  let searchFrom = 0;\n  while (searchFrom < cleaned.length) {\n    const openIdx = cleaned.indexOf('<!--', searchFrom);\n    if (openIdx === -1) break;\n    const closeIdx = cleaned.indexOf('-->', openIdx + 4);\n    if (closeIdx === -1) {\n      stripped.push({\n        tag: '<!--',\n        reason: 'Unclosed HTML comment (potential injection vector)',\n        startIndex: openIdx,\n        length: cleaned.length - openIdx,\n      });\n      cleaned = cleaned.slice(0, openIdx);\n      break;\n    }\n    searchFrom = closeIdx + 3;\n  }\n  return { cleaned, stripped };\n}\n\n/** Detects injection patterns in content without modifying it. */\nfunction detectInjectionPatterns(content: string): InjectionFlag[] {\n  const flags = new Set<InjectionFlag>();\n  for (const { flag, pattern } of INJECTION_PATTERNS) {\n    // Reset lastIndex for global patterns\n    pattern.lastIndex = 0;\n    if (pattern.test(content)) {\n      flags.add(flag);\n    }\n  }\n  if (looksLikeBase64Payload(content)) {\n    flags.add('base64_encoded');\n  }\n  return Array.from(flags);\n}\n\n/** Lower-cases an arbitrary role literal and maps it to a known role. */\nfunction normalizeRole(userRole: string): GitHubUserRole {\n  const lower = userRole.toLowerCase();\n  if (lower in ROLE_DEFAULT_TRUST) return lower as GitHubUserRole;\n  return 'unknown';\n}\n\n/**\n * Assigns trust tier based on user role and injection analysis.\n * Injection patterns can only DOWNGRADE trust, never upgrade.\n */\nfunction assignTrustTier(\n  userRole: GitHubUserRole,\n  injectionFlags: readonly InjectionFlag[],\n  allowlisted: boolean\n): TrustTier {\n  if (allowlisted) return '1';\n\n  // Defensive lowercase — the type says GitHubUserRole, but callers\n  // sometimes cast an unnormalized GitHub author_association literal\n  // (e.g. 'OWNER', 'MEMBER') directly. Normalize here so the maintainer\n  // exemption below matches regardless of case (CWE-178).\n  const normalizedRole = normalizeRole(userRole);\n  const baseTier = ROLE_DEFAULT_TRUST[normalizedRole];\n\n  // Content with injection patterns is downgraded to Tier 4 (hostile)\n  const hostileFlags: InjectionFlag[] = ['system_prompt_manipulation', 'fake_conversation'];\n  if (injectionFlags.some((f) => hostileFlags.includes(f))) return '4';\n\n  // Content with authority claims from non-maintainers is suspicious\n  if (\n    injectionFlags.includes('authority_claim') &&\n    normalizedRole !== 'owner' &&\n    normalizedRole !== 'maintainer'\n  ) {\n    return '4';\n  }\n\n  return baseTier;\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Sanitizes untrusted GitHub input through the full Layer 1 pipeline:\n * 1. HTML stripping (picture/source/img tags)\n * 2. XML tag stripping (system/human/assistant)\n * 3. HTML comment stripping (instruction-bearing comments only)\n * 4. Injection pattern detection\n * 5. Trust tier assignment\n *\n * ⚠ **Use HostileInputFirewall.process() in agent code paths.** Calling\n * sanitizeInput() directly only runs Layer 1 — it does not evaluate the\n * Rule of Two (enforced in policy-gate.ts via evaluatePolicy) and does\n * not emit audit-trail events. An agent that processes untrusted input\n * while holding both write access and secrets violates the Rule of Two;\n * the policy gate is what catches this, and it only runs inside the\n * firewall pipeline. Direct use of this function is appropriate for\n * unit tests and pure content analysis, not for agent decision paths.\n *\n * @see packages/nexus-agents/src/security/firewall/firewall-pipeline.ts\n * @see packages/nexus-agents/src/security/policy-gate.ts\n * @param content - Raw untrusted content from GitHub\n * @param userRole - GitHub user's relationship to the repository\n * @param username - GitHub username (for allowlist check)\n * @param config - Optional sanitizer configuration\n * @returns SanitizedInput with cleaned content and audit data\n */\nexport function sanitizeInput(\n  content: string,\n  userRole: GitHubUserRole,\n  username: string,\n  config?: Partial<SanitizerConfig>\n): SanitizedInput {\n  const cfg = SanitizerConfigSchema.parse(config ?? {});\n  const truncated = content.slice(0, cfg.maxInputLength);\n  const allowlisted = cfg.allowlistedMaintainers.includes(username);\n\n  try {\n    // Pipeline: decode entity-encoded dangerous tags, then strip dangerous content\n    const entityDecoded = applyEntityEvasionDefense(truncated);\n    const html = stripDangerousHtml(entityDecoded.cleaned);\n    const xml = stripXmlTags(html.cleaned);\n    const comments = stripHtmlComments(xml.cleaned);\n    const allStripped = [\n      ...entityDecoded.stripped,\n      ...html.stripped,\n      ...xml.stripped,\n      ...comments.stripped,\n    ];\n\n    // Detect injection patterns on ORIGINAL content (before stripping)\n    const injectionFlags = detectInjectionPatterns(truncated);\n\n    // Assign trust tier\n    const trustTier = assignTrustTier(userRole, injectionFlags, allowlisted);\n\n    return {\n      content: comments.cleaned,\n      originalLength: content.length,\n      trustTier,\n      userRole,\n      injectionFlags,\n      strippedElements: allStripped,\n      wasModified: allStripped.length > 0,\n      sanitizedAt: new Date().toISOString(),\n    };\n  } catch (err: unknown) {\n    return buildFailClosedResult(err, content, truncated, userRole, allowlisted);\n  }\n}\n\n/**\n * Fail-closed result returned when the sanitizer pipeline throws.\n * Returns empty content at Tier-4 (or Tier-1 for allowlisted maintainers,\n * since their bypass is not regex-dependent) so downstream consumers\n * cannot act on untrusted content we could not validate.\n * CLAUDE.md: \"Fail closed on ambiguity.\"\n */\nfunction buildFailClosedResult(\n  err: unknown,\n  originalContent: string,\n  truncated: string,\n  userRole: GitHubUserRole,\n  allowlisted: boolean\n): SanitizedInput {\n  const message = err instanceof Error ? err.message : String(err);\n  return {\n    content: '',\n    originalLength: originalContent.length,\n    trustTier: allowlisted ? '1' : '4',\n    userRole,\n    injectionFlags: [],\n    strippedElements: [\n      {\n        tag: '(pipeline-failure)',\n        reason: `Sanitizer pipeline threw; input discarded as fail-closed: ${message}`,\n        startIndex: 0,\n        length: truncated.length,\n      },\n    ],\n    wasModified: true,\n    sanitizedAt: new Date().toISOString(),\n  };\n}\n","/**\n * nexus-agents/security - Reputation Model\n *\n * Lightweight trust model for GitHub users that assesses reputation\n * based on account age, contribution history, and behavioral signals.\n * Integrates with the trust classifier for comprehensive trust assessment.\n *\n * @module security/reputation-model\n * (Source: Issue #818, #824 — Phase 3: Reputation Model)\n */\n\nimport { z } from 'zod';\n\nimport { getTimeProvider } from '../core/index.js';\nimport type { TrustTier, GitHubUserRole, InjectionFlag } from './trust-types.js';\nimport { TRUST_TIER_NUMERIC, ROLE_DEFAULT_TRUST } from './trust-types.js';\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Signals that indicate a suspicious actor.\n */\nexport const SuspiciousSignalSchema = z.enum([\n  'new_account',\n  'no_prior_contributions',\n  'injection_patterns_detected',\n  'rapid_comments',\n  'mismatched_authority_claim',\n]);\nexport type SuspiciousSignal = z.infer<typeof SuspiciousSignalSchema>;\n\n/**\n * GitHub user metadata for reputation assessment.\n */\nexport interface GitHubUserMetadata {\n  readonly username: string;\n  /**\n   * Account/activity fields are OPTIONAL (#3106). When a field is absent (the\n   * caller couldn't fetch it — e.g. the firewall before Phase 3 wiring), its\n   * signal is SKIPPED rather than fabricated: an unknown value must never be\n   * treated as benign (the old hardcoded `365`/`0`) nor as hostile. Only the\n   * `authorAssociation` + `injectionFlags` signals fire on absent activity data.\n   */\n  readonly accountAgeDays?: number;\n  readonly priorContributions?: number;\n  readonly recentCommentCount?: number;\n  readonly recentCommentWindowMinutes?: number;\n  readonly authorAssociation: string;\n  readonly injectionFlags: readonly InjectionFlag[];\n}\n\n/**\n * Result of a reputation assessment.\n */\nexport interface ReputationAssessment {\n  readonly username: string;\n  readonly userRole: GitHubUserRole;\n  readonly suspiciousSignals: readonly SuspiciousSignal[];\n  readonly isSuspicious: boolean;\n  readonly effectiveTrustTier: TrustTier;\n  readonly reputationScore: number;\n  readonly reason: string;\n  readonly assessedAt: string;\n}\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/** Thresholds for suspicious behavior detection. */\n/** Approximate days per year, used to normalize account age to a 0–10 scale. */\nconst DAYS_PER_YEAR_APPROX = 36.5;\n\nconst SUSPICIOUS_THRESHOLDS = {\n  /** Account younger than this (days) is flagged. */\n  newAccountDays: 30,\n  /** Fewer contributions than this is flagged. */\n  minContributions: 1,\n  /** More comments than this in the window triggers rapid-comment flag. */\n  rapidCommentThreshold: 5,\n  /** Time window (minutes) for rapid comment detection. */\n  rapidCommentWindowMinutes: 10,\n} as const;\n\n// ============================================================================\n// Reputation Cache\n// ============================================================================\n\ninterface CacheEntry {\n  assessment: ReputationAssessment;\n  expiresAt: number;\n}\n\n// Canonical source: config/timeouts.ts (Issue #1046)\nimport { CACHE_TIMEOUTS } from '../config/timeouts.js';\n\nconst DEFAULT_TTL_MS: number = CACHE_TIMEOUTS.reputationTtlMs;\nconst DEFAULT_MAX_SIZE = 1000;\n\n/**\n * In-memory reputation cache with TTL and max size.\n * Reduces redundant assessments for the same user within a short window.\n * Evicts oldest entries when max size is exceeded.\n */\nexport class ReputationCache {\n  private readonly cache = new Map<string, CacheEntry>();\n  private readonly ttlMs: number;\n  private readonly maxSize: number;\n\n  constructor(ttlMs = DEFAULT_TTL_MS, maxSize = DEFAULT_MAX_SIZE) {\n    this.ttlMs = ttlMs;\n    this.maxSize = maxSize;\n  }\n\n  get(username: string): ReputationAssessment | undefined {\n    const entry = this.cache.get(username);\n    if (entry === undefined) return undefined;\n    if (getTimeProvider().now() > entry.expiresAt) {\n      this.cache.delete(username);\n      return undefined;\n    }\n    return entry.assessment;\n  }\n\n  set(username: string, assessment: ReputationAssessment): void {\n    if (this.cache.size >= this.maxSize && !this.cache.has(username)) {\n      this.evictOldest();\n    }\n    this.cache.set(username, {\n      assessment,\n      expiresAt: getTimeProvider().now() + this.ttlMs,\n    });\n  }\n\n  /** Evict a batch of oldest entries (10% of maxSize, minimum 1). */\n  private evictOldest(): void {\n    const batchSize = Math.max(1, Math.floor(this.maxSize * 0.1));\n    const keys = this.cache.keys();\n    for (let i = 0; i < batchSize; i++) {\n      const next = keys.next();\n      if (next.done === true) break;\n      this.cache.delete(next.value);\n    }\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  get size(): number {\n    return this.cache.size;\n  }\n}\n\n// ============================================================================\n// Suspicious Signal Detection\n// ============================================================================\n\n/** Only hostile-tier injection flags count — benign flags like\n * instruction_pattern (\"please remove\") must not trip the injection signal. */\nconst HOSTILE_INJECTION_FLAGS: readonly InjectionFlag[] = [\n  'system_prompt_manipulation',\n  'fake_conversation',\n  'authority_claim',\n  'hidden_content',\n];\n\nfunction hasHostileInjection(flags: readonly InjectionFlag[]): boolean {\n  return flags.some((f) => HOSTILE_INJECTION_FLAGS.includes(f));\n}\n\n/** Rapid-comment burst — only when both count and window are known (#3106). */\nfunction isRapidCommenting(m: GitHubUserMetadata): boolean {\n  return (\n    m.recentCommentCount !== undefined &&\n    m.recentCommentWindowMinutes !== undefined &&\n    m.recentCommentCount > SUSPICIOUS_THRESHOLDS.rapidCommentThreshold &&\n    m.recentCommentWindowMinutes <= SUSPICIOUS_THRESHOLDS.rapidCommentWindowMinutes\n  );\n}\n\n/** Authority claim from a non-maintainer role. */\nfunction isMismatchedAuthority(m: GitHubUserMetadata): boolean {\n  if (!m.injectionFlags.includes('authority_claim')) return false;\n  const association = m.authorAssociation.toUpperCase();\n  return association !== 'OWNER' && association !== 'MEMBER';\n}\n\n/** Detect all suspicious signals from user metadata. #3106: account/activity\n * signals are skipped when their data is absent — never fabricated. */\nfunction detectSuspiciousSignals(metadata: GitHubUserMetadata): SuspiciousSignal[] {\n  const signals: SuspiciousSignal[] = [];\n  const { accountAgeDays, priorContributions } = metadata;\n\n  if (accountAgeDays !== undefined && accountAgeDays < SUSPICIOUS_THRESHOLDS.newAccountDays) {\n    signals.push('new_account');\n  }\n  if (\n    priorContributions !== undefined &&\n    priorContributions < SUSPICIOUS_THRESHOLDS.minContributions\n  ) {\n    signals.push('no_prior_contributions');\n  }\n  if (hasHostileInjection(metadata.injectionFlags)) signals.push('injection_patterns_detected');\n  if (isRapidCommenting(metadata)) signals.push('rapid_comments');\n  if (isMismatchedAuthority(metadata)) signals.push('mismatched_authority_claim');\n\n  return signals;\n}\n\n/** Calculate a 0-100 reputation score. */\nfunction calculateReputationScore(\n  metadata: GitHubUserMetadata,\n  signals: readonly SuspiciousSignal[],\n  userRole: GitHubUserRole\n): number {\n  let score = 50; // baseline\n\n  // Role bonus\n  const roleBonus: Record<GitHubUserRole, number> = {\n    owner: 40,\n    maintainer: 35,\n    collaborator: 25,\n    contributor: 15,\n    member: 5,\n    unknown: 0,\n  };\n  score += roleBonus[userRole];\n\n  // Account age bonus (max +10). #3106: absent → no bonus (avoid NaN; an\n  // unknown account neither earns nor loses the age bonus).\n  if (metadata.accountAgeDays !== undefined) {\n    score += Math.min(metadata.accountAgeDays / DAYS_PER_YEAR_APPROX, 10);\n  }\n\n  // Contribution bonus (max +10). #3106: absent → no bonus.\n  if (metadata.priorContributions !== undefined) {\n    score += Math.min(metadata.priorContributions, 10);\n  }\n\n  // Suspicious signal penalties\n  const signalPenalty: Record<SuspiciousSignal, number> = {\n    new_account: -15,\n    no_prior_contributions: -10,\n    injection_patterns_detected: -25,\n    rapid_comments: -20,\n    mismatched_authority_claim: -30,\n  };\n  for (const signal of signals) {\n    score += signalPenalty[signal];\n  }\n\n  return Math.max(0, Math.min(100, Math.round(score)));\n}\n\n/** Map role string to GitHubUserRole. */\nfunction mapRole(association: string): GitHubUserRole {\n  switch (association.toUpperCase()) {\n    case 'OWNER':\n      return 'owner';\n    case 'MEMBER':\n      return 'member';\n    case 'COLLABORATOR':\n      return 'collaborator';\n    case 'CONTRIBUTOR':\n      return 'contributor';\n    default:\n      return 'unknown';\n  }\n}\n\n/** Determine effective trust tier from signals and role. */\nfunction determineEffectiveTier(\n  userRole: GitHubUserRole,\n  signals: readonly SuspiciousSignal[]\n): TrustTier {\n  const baseTier = ROLE_DEFAULT_TRUST[userRole];\n\n  // Hostile signals → Tier 4\n  const hostileSignals: SuspiciousSignal[] = [\n    'injection_patterns_detected',\n    'mismatched_authority_claim',\n  ];\n  if (signals.some((s) => hostileSignals.includes(s))) return '4';\n\n  // Multiple suspicious signals → downgrade by 1\n  if (signals.length >= 2) {\n    const baseNumeric = TRUST_TIER_NUMERIC[baseTier];\n    const downgraded = Math.min(baseNumeric + 1, 4);\n    return String(downgraded) as TrustTier;\n  }\n\n  return baseTier;\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Assess a GitHub user's reputation for trust classification.\n *\n * @param metadata - User metadata from GitHub API or local context.\n * @param cache - Optional cache instance for TTL-based deduplication.\n * @returns ReputationAssessment with trust tier and suspicious signals.\n */\nexport function assessReputation(\n  metadata: GitHubUserMetadata,\n  cache?: ReputationCache\n): ReputationAssessment {\n  // Check cache first\n  const cached = cache?.get(metadata.username);\n  if (cached !== undefined) return cached;\n\n  const userRole = mapRole(metadata.authorAssociation);\n  const signals = detectSuspiciousSignals(metadata);\n  const score = calculateReputationScore(metadata, signals, userRole);\n  const effectiveTier = determineEffectiveTier(userRole, signals);\n\n  const assessment: ReputationAssessment = {\n    username: metadata.username,\n    userRole,\n    suspiciousSignals: signals,\n    isSuspicious: signals.length > 0,\n    effectiveTrustTier: effectiveTier,\n    reputationScore: score,\n    reason: buildReason(userRole, signals, effectiveTier),\n    assessedAt: new Date().toISOString(),\n  };\n\n  cache?.set(metadata.username, assessment);\n  return assessment;\n}\n\n/**\n * Reconcile a trust-classifier tier with a reputation assessment into the\n * effective tier to enforce (#3119 / epic #3118). Demotion-only — reputation\n * can only RAISE the tier number (more restrictive), never lower it.\n *\n * Invariants:\n * - **Allowlist/Tier-1 wins**: a classifier Tier 1 (owner/allowlisted maintainer)\n *   is authoritative — reputation never demotes it.\n * - **Absent reputation → classifier tier**: no assessment (stage off / not\n *   fetched) keeps the classifier/role-default tier — never fabricate a benign\n *   tier, never escalate on mere absence (fetch-failure ≠ hostile signal).\n * - **Score is advisory**: only `effectiveTrustTier` participates; the 0–100\n *   `reputationScore` never moves the gate.\n */\nexport function reconcileTrustTier(\n  classifierTier: TrustTier,\n  reputation: ReputationAssessment | undefined\n): TrustTier {\n  if (classifierTier === '1') return '1';\n  const repTier = reputation?.effectiveTrustTier;\n  if (repTier === undefined) return classifierTier;\n  return TRUST_TIER_NUMERIC[repTier] > TRUST_TIER_NUMERIC[classifierTier]\n    ? repTier\n    : classifierTier;\n}\n\n// ============================================================================\n// Reputation gating rollout (#3122 / epic #3118 Phase 4)\n// ============================================================================\n\n/**\n * Rollout mode for reputation-based tier gating, mirroring\n * `NEXUS_ACCESS_POLICY_MODE` (#1977): `off` (no reputation effect), `audit`\n * (compute + report the would-be demotion but enforce the classifier tier), or\n * `enforce` (apply the demotion). Default `audit` — surface telemetry without\n * blocking until the false-positive rate is known, then flip to `enforce`.\n */\nexport const ReputationGatingModeSchema = z.enum(['off', 'audit', 'enforce']);\nexport type ReputationGatingMode = z.infer<typeof ReputationGatingModeSchema>;\n\n/** Default when `NEXUS_REPUTATION_GATING` is unset/invalid — audit (telemetry, no block). */\nexport const DEFAULT_REPUTATION_GATING_MODE: ReputationGatingMode = 'audit';\n\n/** Resolve the gating mode from the environment (invalid → default, never throws). */\nexport function resolveReputationGatingMode(\n  env: NodeJS.ProcessEnv = process.env\n): ReputationGatingMode {\n  const raw = env['NEXUS_REPUTATION_GATING'];\n  if (typeof raw !== 'string' || raw.length === 0) return DEFAULT_REPUTATION_GATING_MODE;\n  const parsed = ReputationGatingModeSchema.safeParse(raw.toLowerCase());\n  return parsed.success ? parsed.data : DEFAULT_REPUTATION_GATING_MODE;\n}\n\n/** Outcome of applying the gating mode to a reputation assessment. */\nexport interface ReputationGateDecision {\n  /** Tier to actually enforce at the policy gate. */\n  readonly enforcedTier: TrustTier;\n  /** Tier reputation reconciliation computed (what `enforce` mode WOULD use). */\n  readonly reconciledTier: TrustTier;\n  /** True when reputation would demote but the mode (off/audit) did not enforce it. */\n  readonly demotionSuppressed: boolean;\n  readonly mode: ReputationGatingMode;\n}\n\n/**\n * Apply the rollout mode to a reputation assessment (#3122). `enforce` gates on\n * the reconciled (possibly demoted) tier; `audit`/`off` gate on the classifier\n * tier but report whether a demotion was suppressed (for telemetry). The\n * Tier-1/allowlist-wins and demotion-only invariants live in `reconcileTrustTier`,\n * so the allowlist remains the escape hatch in every mode.\n */\nexport function gateWithReputation(\n  classifierTier: TrustTier,\n  reputation: ReputationAssessment | undefined,\n  mode: ReputationGatingMode\n): ReputationGateDecision {\n  const reconciledTier =\n    mode === 'off' ? classifierTier : reconcileTrustTier(classifierTier, reputation);\n  const enforcedTier = mode === 'enforce' ? reconciledTier : classifierTier;\n  return {\n    enforcedTier,\n    reconciledTier,\n    demotionSuppressed: mode !== 'enforce' && reconciledTier !== classifierTier,\n    mode,\n  };\n}\n\n/** Build a human-readable reason string. */\nfunction buildReason(\n  role: GitHubUserRole,\n  signals: readonly SuspiciousSignal[],\n  tier: TrustTier\n): string {\n  if (signals.length === 0) {\n    return `Role ${role} → Tier ${tier} (no suspicious signals)`;\n  }\n  const signalList = signals.join(', ');\n  return `Role ${role} → Tier ${tier} (signals: ${signalList})`;\n}\n"],"mappings":";;;;;;AAWA,SAAS,SAAS;AAeX,IAAM,kBAAkB,EAAE,KAAK,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;AAInD,IAAM,qBAAgD;AAAA,EAC3D,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AASO,IAAM,uBAAuB,EAAE,KAAK;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,IAAM,qBAAwD;AAAA,EACnE,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AACX;AASO,IAAM,sBAAsB,EAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAErB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAExB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAEzC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACpC,CAAC;AAWM,IAAM,uBAAuB,EAAE,OAAO;AAAA;AAAA,EAE3C,SAAS,EAAE,OAAO;AAAA;AAAA,EAElB,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAE7C,WAAW;AAAA;AAAA,EAEX,UAAU;AAAA;AAAA,EAEV,gBAAgB,EAAE,MAAM,mBAAmB;AAAA;AAAA,EAE3C,kBAAkB,EAAE,MAAM,qBAAqB;AAAA;AAAA,EAE/C,aAAa,EAAE,QAAQ;AAAA;AAAA,EAEvB,aAAa,EAAE,IAAI,SAAS;AAC9B,CAAC;AAUM,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,wBAAwB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAE7D,UAAU,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAElC,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAC5D,CAAC;;;AC9GD,IAAM,yBACJ;AASF,IAAM,wBACJ;AAMF,IAAM,uBAAuB;AAW7B,IAAM,qBAA8C;AAAA,EAClD;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AAiBA,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAE7B,SAAS,uBAAuB,SAA0B;AAIxD,aAAW,SAAS,QAAQ,SAAS,iBAAiB,GAAG;AACvD,QAAI,qBAAqB,KAAK,MAAM,CAAC,CAAC,EAAG,QAAO;AAAA,EAClD;AACA,SAAO;AACT;AAUA,IAAM,sBACJ;AAQF,IAAM,gCAAgC,IAAI;AAAA,EACxC,uCAAuC,mBAAmB;AAAA,EAC1D;AACF;AAGA,SAAS,eAAe,SAAyB;AAC/C,SACE,QAEG,QAAQ,aAAa,CAAC,QAAQ,QAAgB;AAC7C,UAAM,OAAO,OAAO,SAAS,KAAK,EAAE;AACpC,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO,cAAc,IAAI,IAAI;AAAA,EAC9D,CAAC,EAEA,QAAQ,qBAAqB,CAAC,QAAQ,QAAgB;AACrD,UAAM,OAAO,OAAO,SAAS,KAAK,EAAE;AACpC,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO,cAAc,IAAI,IAAI;AAAA,EAC9D,CAAC,EAEA,QAAQ,UAAU,GAAG,EACrB,QAAQ,UAAU,GAAG,EACrB,QAAQ,YAAY,GAAG,EACvB,QAAQ,YAAY,GAAG,EAEvB,QAAQ,WAAW,GAAG;AAE7B;AAMA,SAAS,0BAA0B,SAGjC;AACA,MAAI,CAAC,8BAA8B,KAAK,OAAO,GAAG;AAChD,WAAO,EAAE,SAAS,SAAS,UAAU,CAAC,EAAE;AAAA,EAC1C;AACA,QAAM,UAAU,eAAe,OAAO;AACtC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,UAAU;AAAA,MACR;AAAA,QACE,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,QAAQ;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACF;AAQA,SAAS,mBAAmB,SAG1B;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AACd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,2BAAuB,YAAY;AACnC,QAAI,CAAC,uBAAuB,KAAK,OAAO,EAAG;AAC3C,cAAU,QAAQ,QAAQ,wBAAwB,CAAC,OAAO,KAAK,KAAK,WAAmB;AACrF,eAAS,KAAK;AAAA,QACZ,KAAK,MAAM,MAAM,GAAG,EAAE,KAAK,MAAM,SAAS,KAAK,QAAQ;AAAA,QACvD,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAIA,SAAS,aAAa,SAGpB;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AACd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,0BAAsB,YAAY;AAClC,QAAI,CAAC,sBAAsB,KAAK,OAAO,EAAG;AAC1C,cAAU,QAAQ,QAAQ,uBAAuB,CAAC,OAAO,KAAK,WAAmB;AAC/E,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAIA,SAAS,kBAAkB,SAGzB;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AAEd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,yBAAqB,YAAY;AACjC,UAAM,aAAa,QAAQ;AAC3B,cAAU,QAAQ,QAAQ,sBAAsB,CAAC,OAAO,WAAmB;AACzE,YAAM,iBAAiB,iDAAiD,KAAK,KAAK;AAClF,UAAI,CAAC,eAAgB,QAAO;AAE5B,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AACD,QAAI,QAAQ,WAAW,WAAY;AAAA,EACrC;AAEA,MAAI,aAAa;AACjB,SAAO,aAAa,QAAQ,QAAQ;AAClC,UAAM,UAAU,QAAQ,QAAQ,QAAQ,UAAU;AAClD,QAAI,YAAY,GAAI;AACpB,UAAM,WAAW,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACnD,QAAI,aAAa,IAAI;AACnB,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,QAAQ,SAAS;AAAA,MAC3B,CAAC;AACD,gBAAU,QAAQ,MAAM,GAAG,OAAO;AAClC;AAAA,IACF;AACA,iBAAa,WAAW;AAAA,EAC1B;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAGA,SAAS,wBAAwB,SAAkC;AACjE,QAAM,QAAQ,oBAAI,IAAmB;AACrC,aAAW,EAAE,MAAM,QAAQ,KAAK,oBAAoB;AAElD,YAAQ,YAAY;AACpB,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,YAAM,IAAI,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,uBAAuB,OAAO,GAAG;AACnC,UAAM,IAAI,gBAAgB;AAAA,EAC5B;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAGA,SAAS,cAAc,UAAkC;AACvD,QAAM,QAAQ,SAAS,YAAY;AACnC,MAAI,SAAS,mBAAoB,QAAO;AACxC,SAAO;AACT;AAMA,SAAS,gBACP,UACA,gBACA,aACW;AACX,MAAI,YAAa,QAAO;AAMxB,QAAM,iBAAiB,cAAc,QAAQ;AAC7C,QAAM,WAAW,mBAAmB,cAAc;AAGlD,QAAM,eAAgC,CAAC,8BAA8B,mBAAmB;AACxF,MAAI,eAAe,KAAK,CAAC,MAAM,aAAa,SAAS,CAAC,CAAC,EAAG,QAAO;AAGjE,MACE,eAAe,SAAS,iBAAiB,KACzC,mBAAmB,WACnB,mBAAmB,cACnB;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AA+BO,SAAS,cACd,SACA,UACA,UACA,QACgB;AAChB,QAAM,MAAM,sBAAsB,MAAM,UAAU,CAAC,CAAC;AACpD,QAAM,YAAY,QAAQ,MAAM,GAAG,IAAI,cAAc;AACrD,QAAM,cAAc,IAAI,uBAAuB,SAAS,QAAQ;AAEhE,MAAI;AAEF,UAAM,gBAAgB,0BAA0B,SAAS;AACzD,UAAM,OAAO,mBAAmB,cAAc,OAAO;AACrD,UAAM,MAAM,aAAa,KAAK,OAAO;AACrC,UAAM,WAAW,kBAAkB,IAAI,OAAO;AAC9C,UAAM,cAAc;AAAA,MAClB,GAAG,cAAc;AAAA,MACjB,GAAG,KAAK;AAAA,MACR,GAAG,IAAI;AAAA,MACP,GAAG,SAAS;AAAA,IACd;AAGA,UAAM,iBAAiB,wBAAwB,SAAS;AAGxD,UAAM,YAAY,gBAAgB,UAAU,gBAAgB,WAAW;AAEvE,WAAO;AAAA,MACL,SAAS,SAAS;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,MACA,kBAAkB;AAAA,MAClB,aAAa,YAAY,SAAS;AAAA,MAClC,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACtC;AAAA,EACF,SAAS,KAAc;AACrB,WAAO,sBAAsB,KAAK,SAAS,WAAW,UAAU,WAAW;AAAA,EAC7E;AACF;AASA,SAAS,sBACP,KACA,iBACA,WACA,UACA,aACgB;AAChB,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,SAAO;AAAA,IACL,SAAS;AAAA,IACT,gBAAgB,gBAAgB;AAAA,IAChC,WAAW,cAAc,MAAM;AAAA,IAC/B;AAAA,IACA,gBAAgB,CAAC;AAAA,IACjB,kBAAkB;AAAA,MAChB;AAAA,QACE,KAAK;AAAA,QACL,QAAQ,6DAA6D,OAAO;AAAA,QAC5E,YAAY;AAAA,QACZ,QAAQ,UAAU;AAAA,MACpB;AAAA,IACF;AAAA,IACA,aAAa;AAAA,IACb,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;;;AC5cA,SAAS,KAAAA,UAAS;AAaX,IAAM,yBAAyBC,GAAE,KAAK;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA2CD,IAAM,uBAAuB;AAE7B,IAAM,wBAAwB;AAAA;AAAA,EAE5B,gBAAgB;AAAA;AAAA,EAEhB,kBAAkB;AAAA;AAAA,EAElB,uBAAuB;AAAA;AAAA,EAEvB,2BAA2B;AAC7B;AAcA,IAAM,iBAAyB,eAAe;AAC9C,IAAM,mBAAmB;AAOlB,IAAM,kBAAN,MAAsB;AAAA,EACV,QAAQ,oBAAI,IAAwB;AAAA,EACpC;AAAA,EACA;AAAA,EAEjB,YAAY,QAAQ,gBAAgB,UAAU,kBAAkB;AAC9D,SAAK,QAAQ;AACb,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,IAAI,UAAoD;AACtD,UAAM,QAAQ,KAAK,MAAM,IAAI,QAAQ;AACrC,QAAI,UAAU,OAAW,QAAO;AAChC,QAAI,gBAAgB,EAAE,IAAI,IAAI,MAAM,WAAW;AAC7C,WAAK,MAAM,OAAO,QAAQ;AAC1B,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,UAAkB,YAAwC;AAC5D,QAAI,KAAK,MAAM,QAAQ,KAAK,WAAW,CAAC,KAAK,MAAM,IAAI,QAAQ,GAAG;AAChE,WAAK,YAAY;AAAA,IACnB;AACA,SAAK,MAAM,IAAI,UAAU;AAAA,MACvB;AAAA,MACA,WAAW,gBAAgB,EAAE,IAAI,IAAI,KAAK;AAAA,IAC5C,CAAC;AAAA,EACH;AAAA;AAAA,EAGQ,cAAoB;AAC1B,UAAM,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAC5D,UAAM,OAAO,KAAK,MAAM,KAAK;AAC7B,aAAS,IAAI,GAAG,IAAI,WAAW,KAAK;AAClC,YAAM,OAAO,KAAK,KAAK;AACvB,UAAI,KAAK,SAAS,KAAM;AACxB,WAAK,MAAM,OAAO,KAAK,KAAK;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,IAAI,OAAe;AACjB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;AAQA,IAAM,0BAAoD;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,oBAAoB,OAA0C;AACrE,SAAO,MAAM,KAAK,CAAC,MAAM,wBAAwB,SAAS,CAAC,CAAC;AAC9D;AAGA,SAAS,kBAAkB,GAAgC;AACzD,SACE,EAAE,uBAAuB,UACzB,EAAE,+BAA+B,UACjC,EAAE,qBAAqB,sBAAsB,yBAC7C,EAAE,8BAA8B,sBAAsB;AAE1D;AAGA,SAAS,sBAAsB,GAAgC;AAC7D,MAAI,CAAC,EAAE,eAAe,SAAS,iBAAiB,EAAG,QAAO;AAC1D,QAAM,cAAc,EAAE,kBAAkB,YAAY;AACpD,SAAO,gBAAgB,WAAW,gBAAgB;AACpD;AAIA,SAAS,wBAAwB,UAAkD;AACjF,QAAM,UAA8B,CAAC;AACrC,QAAM,EAAE,gBAAgB,mBAAmB,IAAI;AAE/C,MAAI,mBAAmB,UAAa,iBAAiB,sBAAsB,gBAAgB;AACzF,YAAQ,KAAK,aAAa;AAAA,EAC5B;AACA,MACE,uBAAuB,UACvB,qBAAqB,sBAAsB,kBAC3C;AACA,YAAQ,KAAK,wBAAwB;AAAA,EACvC;AACA,MAAI,oBAAoB,SAAS,cAAc,EAAG,SAAQ,KAAK,6BAA6B;AAC5F,MAAI,kBAAkB,QAAQ,EAAG,SAAQ,KAAK,gBAAgB;AAC9D,MAAI,sBAAsB,QAAQ,EAAG,SAAQ,KAAK,4BAA4B;AAE9E,SAAO;AACT;AAGA,SAAS,yBACP,UACA,SACA,UACQ;AACR,MAAI,QAAQ;AAGZ,QAAM,YAA4C;AAAA,IAChD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACA,WAAS,UAAU,QAAQ;AAI3B,MAAI,SAAS,mBAAmB,QAAW;AACzC,aAAS,KAAK,IAAI,SAAS,iBAAiB,sBAAsB,EAAE;AAAA,EACtE;AAGA,MAAI,SAAS,uBAAuB,QAAW;AAC7C,aAAS,KAAK,IAAI,SAAS,oBAAoB,EAAE;AAAA,EACnD;AAGA,QAAM,gBAAkD;AAAA,IACtD,aAAa;AAAA,IACb,wBAAwB;AAAA,IACxB,6BAA6B;AAAA,IAC7B,gBAAgB;AAAA,IAChB,4BAA4B;AAAA,EAC9B;AACA,aAAW,UAAU,SAAS;AAC5B,aAAS,cAAc,MAAM;AAAA,EAC/B;AAEA,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;AACrD;AAGA,SAAS,QAAQ,aAAqC;AACpD,UAAQ,YAAY,YAAY,GAAG;AAAA,IACjC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAGA,SAAS,uBACP,UACA,SACW;AACX,QAAM,WAAW,mBAAmB,QAAQ;AAG5C,QAAM,iBAAqC;AAAA,IACzC;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,KAAK,CAAC,MAAM,eAAe,SAAS,CAAC,CAAC,EAAG,QAAO;AAG5D,MAAI,QAAQ,UAAU,GAAG;AACvB,UAAM,cAAc,mBAAmB,QAAQ;AAC/C,UAAM,aAAa,KAAK,IAAI,cAAc,GAAG,CAAC;AAC9C,WAAO,OAAO,UAAU;AAAA,EAC1B;AAEA,SAAO;AACT;AAaO,SAAS,iBACd,UACA,OACsB;AAEtB,QAAM,SAAS,OAAO,IAAI,SAAS,QAAQ;AAC3C,MAAI,WAAW,OAAW,QAAO;AAEjC,QAAM,WAAW,QAAQ,SAAS,iBAAiB;AACnD,QAAM,UAAU,wBAAwB,QAAQ;AAChD,QAAM,QAAQ,yBAAyB,UAAU,SAAS,QAAQ;AAClE,QAAM,gBAAgB,uBAAuB,UAAU,OAAO;AAE9D,QAAM,aAAmC;AAAA,IACvC,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,mBAAmB;AAAA,IACnB,cAAc,QAAQ,SAAS;AAAA,IAC/B,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,IACjB,QAAQ,YAAY,UAAU,SAAS,aAAa;AAAA,IACpD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AAEA,SAAO,IAAI,SAAS,UAAU,UAAU;AACxC,SAAO;AACT;AAgBO,SAAS,mBACd,gBACA,YACW;AACX,MAAI,mBAAmB,IAAK,QAAO;AACnC,QAAM,UAAU,YAAY;AAC5B,MAAI,YAAY,OAAW,QAAO;AAClC,SAAO,mBAAmB,OAAO,IAAI,mBAAmB,cAAc,IAClE,UACA;AACN;AAaO,IAAM,6BAA6BA,GAAE,KAAK,CAAC,OAAO,SAAS,SAAS,CAAC;AAIrE,IAAM,iCAAuD;AAG7D,SAAS,4BACd,MAAyB,QAAQ,KACX;AACtB,QAAM,MAAM,IAAI,yBAAyB;AACzC,MAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAG,QAAO;AACxD,QAAM,SAAS,2BAA2B,UAAU,IAAI,YAAY,CAAC;AACrE,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAoBO,SAAS,mBACd,gBACA,YACA,MACwB;AACxB,QAAM,iBACJ,SAAS,QAAQ,iBAAiB,mBAAmB,gBAAgB,UAAU;AACjF,QAAM,eAAe,SAAS,YAAY,iBAAiB;AAC3D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,oBAAoB,SAAS,aAAa,mBAAmB;AAAA,IAC7D;AAAA,EACF;AACF;AAGA,SAAS,YACP,MACA,SACA,MACQ;AACR,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,QAAQ,IAAI,gBAAW,IAAI;AAAA,EACpC;AACA,QAAM,aAAa,QAAQ,KAAK,IAAI;AACpC,SAAO,QAAQ,IAAI,gBAAW,IAAI,cAAc,UAAU;AAC5D;","names":["z","z"]}