palaryn 0.1.0

package/dist/src/dlp/regex-backend.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RegexDLPBackend = void 0;
+const patterns_1 = require("./patterns");
+/**
+ * Zero-width and invisible Unicode characters that can be used to evade
+ * regex-based secret detection (e.g. embedding \u200b inside "AKIA...").
+ */
+const ZERO_WIDTH_RE = /[\u200B\u200C\u200D\u200E\u200F\uFEFF\u00AD\u034F\u061C\u180E\u2060\u2061\u2062\u2063\u2064\u2066\u2067\u2068\u2069\u206A\u206B\u206C\u206D\u206E\u206F]/g;
+/**
+ * Common Unicode homoglyphs that look like ASCII characters but would bypass
+ * regex patterns designed for ASCII. Maps Cyrillic/Greek/other lookalikes to
+ * their ASCII equivalents.
+ */
+const HOMOGLYPH_MAP = {
+    '\u0410': 'A', '\u0412': 'B', '\u0421': 'C', '\u0415': 'E', '\u041D': 'H',
+    '\u041A': 'K', '\u041C': 'M', '\u041E': 'O', '\u0420': 'P', '\u0422': 'T',
+    '\u0425': 'X', '\u0430': 'a', '\u0435': 'e', '\u043E': 'o', '\u0440': 'p',
+    '\u0441': 'c', '\u0443': 'y', '\u0445': 'x', '\u04BB': 'h',
+    '\u0391': 'A', '\u0392': 'B', '\u0395': 'E', '\u0397': 'H', '\u0399': 'I',
+    '\u039A': 'K', '\u039C': 'M', '\u039D': 'N', '\u039F': 'O', '\u03A1': 'P',
+    '\u03A4': 'T', '\u03A7': 'X', '\u03B1': 'a', '\u03BF': 'o',
+    '\u2010': '-', '\u2011': '-', '\u2012': '-', '\u2013': '-', '\u2014': '-',
+    '\uFF21': 'A', '\uFF22': 'B', '\uFF23': 'C', '\uFF24': 'D', '\uFF25': 'E',
+};
+const HOMOGLYPH_RE = new RegExp('[' + Object.keys(HOMOGLYPH_MAP).join('') + ']', 'g');
+/**
+ * Regex to detect potential Base64-encoded strings.
+ * Matches strings of at least 20 characters using the Base64 alphabet,
+ * optionally followed by 1-2 padding '=' characters.
+ */
+const BASE64_RE = /[A-Za-z0-9+/]{20,}={0,2}/g;
+/**
+ * Extract and decode potential Base64-encoded strings from the input.
+ * Returns the decoded strings concatenated with newlines, or empty string
+ * if no valid Base64 content was found.
+ */
+function decodeBase64Content(value) {
+    BASE64_RE.lastIndex = 0;
+    const decoded = [];
+    let m;
+    while ((m = BASE64_RE.exec(value)) !== null) {
+        try {
+            const candidate = m[0];
+            const buf = Buffer.from(candidate, 'base64');
+            const text = buf.toString('utf-8');
+            // Only include decoded content that looks like printable text
+            // (at least 80% printable ASCII characters) to avoid noise
+            const printable = text.replace(/[^\x20-\x7E]/g, '');
+            if (printable.length >= text.length * 0.8 && text.length >= 8) {
+                decoded.push(text);
+            }
+        }
+        catch {
+            // Not valid Base64, skip
+        }
+    }
+    BASE64_RE.lastIndex = 0;
+    return decoded.join('\n');
+}
+/**
+ * Normalize input to defeat common DLP evasion techniques:
+ * 1. NFC Unicode normalization (canonical decomposition + composition)
+ * 2. Strip zero-width / invisible characters
+ * 3. Replace common Unicode homoglyphs with ASCII equivalents
+ */
+function normalizeForDLP(value) {
+    // Step 1: NFC normalization
+    let normalized = value.normalize('NFC');
+    // Step 2: Strip zero-width characters
+    normalized = normalized.replace(ZERO_WIDTH_RE, '');
+    // Step 3: Replace homoglyphs with ASCII equivalents
+    normalized = normalized.replace(HOMOGLYPH_RE, (ch) => HOMOGLYPH_MAP[ch] || ch);
+    return normalized;
+}
+/**
+ * Regex-based DLP backend that uses the same patterns as the built-in DLPScanner.
+ *
+ * This backend is extracted as a standalone DLPBackend implementation so it can
+ * be composed with other backends (e.g. TruffleHog) via the CompositeDLPScanner.
+ * The original DLPScanner remains unchanged and fully functional on its own.
+ */
+class RegexDLPBackend {
+    constructor(config) {
+        this.name = 'regex';
+        this.secretsEnabled = config?.secrets_detection ?? true;
+        this.piiEnabled = config?.pii_detection ?? true;
+    }
+    /**
+     * Scan a string for secrets and PII using regex patterns.
+     *
+     * Input is normalized before scanning to defeat evasion techniques
+     * (zero-width chars, Unicode homoglyphs, NFC normalization).
+     *
+     * Every regex with the /g flag has its lastIndex reset before and after
+     * testing to avoid state leaking between calls.
+     */
+    scanString(value) {
+        const normalized = normalizeForDLP(value);
+        const detections = [];
+        if (this.secretsEnabled) {
+            this.scanPatterns(normalized, patterns_1.SECRET_PATTERNS, detections);
+        }
+        if (this.piiEnabled) {
+            this.scanPatterns(normalized, patterns_1.PII_PATTERNS, detections);
+        }
+        // Decode and scan Base64-encoded content to catch encoded secrets
+        const decodedBase64 = decodeBase64Content(normalized);
+        if (decodedBase64) {
+            const base64Detections = [];
+            if (this.secretsEnabled) {
+                this.scanPatterns(decodedBase64, patterns_1.SECRET_PATTERNS, base64Detections);
+            }
+            if (this.piiEnabled) {
+                this.scanPatterns(decodedBase64, patterns_1.PII_PATTERNS, base64Detections);
+            }
+            // Add Base64 detections with a prefix to indicate they were found in encoded content
+            for (const det of base64Detections) {
+                // Avoid duplicate detections already found in the raw content
+                const isDuplicate = detections.some((d) => d.pattern_name === det.pattern_name && d.match === det.match);
+                if (!isDuplicate) {
+                    detections.push({
+                        ...det,
+                        pattern_name: `base64:${det.pattern_name}`,
+                    });
+                }
+            }
+        }
+        return detections;
+    }
+    scanPatterns(value, patterns, detections) {
+        for (const pat of patterns) {
+            pat.pattern.lastIndex = 0;
+            let m;
+            while ((m = pat.pattern.exec(value)) !== null) {
+                detections.push({
+                    pattern_name: pat.name,
+                    severity: pat.severity,
+                    match: m[0],
+                    start: m.index,
+                    end: m.index + m[0].length,
+                });
+                // Prevent infinite loops on zero-length matches
+                if (m[0].length === 0) {
+                    pat.pattern.lastIndex++;
+                }
+            }
+            pat.pattern.lastIndex = 0;
+        }
+    }
+}
+exports.RegexDLPBackend = RegexDLPBackend;
+//# sourceMappingURL=regex-backend.js.map

package/dist/src/dlp/regex-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex-backend.js","sourceRoot":"","sources":["../../../src/dlp/regex-backend.ts"],"names":[],"mappings":";;;AACA,yCAAuE;AASvE;;;GAGG;AACH,MAAM,aAAa,GAAG,2JAA2J,CAAC;AAElL;;;;GAIG;AACH,MAAM,aAAa,GAA2B;IAC5C,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG;IACzE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG;IACzE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG;IACzE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG;IAC1D,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG;IACzE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG;IACzE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG;IAC1D,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG;IACzE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG;CAC1E,CAAC;AAEF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;AAEtF;;;;GAIG;AACH,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAE9C;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;IACxB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnC,8DAA8D;YAC9D,2DAA2D;YAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC9D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IACD,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,4BAA4B;IAC5B,IAAI,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAExC,sCAAsC;IACtC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAEnD,oDAAoD;IACpD,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAE/E,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAa,eAAe;IAM1B,YAAY,MAA2B;QAL9B,SAAI,GAAG,OAAO,CAAC;QAMtB,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,iBAAiB,IAAI,IAAI,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,aAAa,IAAI,IAAI,CAAC;IAClD,CAAC;IAED;;;;;;;;OAQG;IACH,UAAU,CAAC,KAAa;QACtB,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAmB,EAAE,CAAC;QAEtC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,0BAAe,EAAE,UAAU,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,uBAAY,EAAE,UAAU,CAAC,CAAC;QAC1D,CAAC;QAED,kEAAkE;QAClE,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,gBAAgB,GAAmB,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,0BAAe,EAAE,gBAAgB,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,uBAAY,EAAE,gBAAgB,CAAC,CAAC;YACnE,CAAC;YACD,qFAAqF;YACrF,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;gBACnC,8DAA8D;gBAC9D,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,CACpE,CAAC;gBACF,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,UAAU,CAAC,IAAI,CAAC;wBACd,GAAG,GAAG;wBACN,YAAY,EAAE,UAAU,GAAG,CAAC,YAAY,EAAE;qBAC3C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,YAAY,CAClB,KAAa,EACb,QAAsB,EACtB,UAA0B;QAE1B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,UAAU,CAAC,IAAI,CAAC;oBACd,YAAY,EAAE,GAAG,CAAC,IAAI;oBACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;oBACX,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBAC3B,CAAC,CAAC;gBACH,gDAAgD;gBAChD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1B,CAAC;YACH,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF;AApFD,0CAoFC"}

package/dist/src/dlp/scanner.d.ts

@@ -0,0 +1,122 @@
+import { DLPReport, DLPRedaction, RedactionMethod } from '../types/tool-result';
+import { DLPConfig } from '../types/config';
+/**
+ * DLPScanner detects secrets and PII in tool call arguments and outputs,
+ * and applies configurable redaction strategies (mask, hash, drop, tokenize).
+ */
+export declare class DLPScanner {
+    private config;
+    constructor(config: DLPConfig);
+    /**
+     * Main scan function -- recursively scans an object for secrets and PII.
+     *
+     * @param data - The data to scan (object, array, string, or primitive).
+     * @param basePath - Dot-notation prefix for paths within the data structure.
+     * @returns A DLPReport describing all detections, suggested redactions, and overall severity.
+     */
+    scan(data: unknown, basePath?: string): DLPReport;
+    /**
+     * Scan a single string value for secrets and PII patterns.
+     *
+     * Every regex with the /g flag has its lastIndex reset before and after
+     * testing to avoid state leaking between calls.
+     */
+    private scanString;
+    /** Mask a matched value, keeping first 3 and last 3 chars visible. */
+    static maskValue(value: string): string;
+    /**
+     * Recursively walk an unknown value, scanning every string leaf.
+     *
+     * A depth limit prevents stack overflow on circular or extremely deep structures.
+     */
+    private scanObject;
+    /**
+     * Apply a single redaction method to a string value.
+     *
+     * - `mask`     -- Keep the first 4 characters, replace the rest with 'x' (capped at 20 x's).
+     * - `hash`     -- SHA-256 hash prefix (16 hex chars) with a HASH: prefix.
+     * - `drop`     -- Replace entirely with `[REDACTED]`.
+     * - `tokenize` -- Replace with a deterministic placeholder token derived from MD5.
+     */
+    static redact(value: string, method: RedactionMethod): string;
+    /**
+     * Apply a list of redactions to a data structure.
+     *
+     * Returns a deep clone of `data` with every path referenced in `redactions`
+     * replaced by the redacted version of the string found at that path.
+     *
+     * Paths use lodash-style dot/bracket notation:
+     *   - `"args.headers.Authorization"` -> obj.args.headers.Authorization
+     *   - `"items[0].value"`             -> obj.items[0].value
+     *
+     * If a path cannot be resolved (e.g. the structure was mutated), the
+     * redaction is silently skipped.
+     */
+    applyRedactions(data: unknown, redactions: DLPRedaction[]): unknown;
+    /**
+     * Navigate to `path` inside `root` and replace the leaf string value
+     * with its redacted form.
+     */
+    private applyRedactionAtPath;
+    /**
+     * Redact all pattern matches within a string, replacing each match occurrence
+     * with the appropriate redacted form. Non-matching portions of the string are
+     * preserved. If no matches are found, the entire string is redacted as a
+     * fallback (e.g. when the string itself is the sensitive value).
+     */
+    private redactMatchesInString;
+    /**
+     * Parse a lodash-style path string into an array of segments.
+     *
+     * Examples:
+     *   `"args.headers.Authorization"` -> `["args", "headers", "Authorization"]`
+     *   `"items[0].value"`             -> `["items", "0", "value"]`
+     *   `"[0]"`                        -> `["0"]`
+     */
+    static parsePath(path: string): string[];
+    /**
+     * Get a child value from an object or array given a single path segment.
+     */
+    private static getChild;
+    /**
+     * Set a child value on an object or array given a single path segment.
+     */
+    private static setChild;
+    /**
+     * Deep clone a value using structured clone semantics.
+     *
+     * Falls back to JSON round-trip for environments where structuredClone is
+     * unavailable. Handles primitives, plain objects, arrays, and null/undefined.
+     */
+    static deepClone<T>(data: T): T;
+    /**
+     * Determine the highest severity among all detected pattern names.
+     *
+     * Checks both SECRET_PATTERNS and PII_PATTERNS for each detection name
+     * and returns the highest severity found. Defaults to 'low' when no
+     * detections are present or none match a known pattern.
+     */
+    private calculateSeverity;
+    /**
+     * Calculate the Shannon entropy of a string.
+     *
+     * High-entropy strings (random-looking) are more likely to be secrets,
+     * API keys, or tokens even if they don't match a known pattern.
+     *
+     * @returns Entropy in bits per character (0 to ~log2(charset_size)).
+     */
+    static calculateEntropy(str: string): number;
+    /**
+     * Check if a string looks like a high-entropy secret.
+     *
+     * Requires both a minimum length (to ignore short random-ish strings like
+     * UUIDs in non-secret contexts) and an entropy above the threshold.
+     *
+     * @param str - The string to check.
+     * @param threshold - Minimum entropy in bits per character. Default 4.5
+     *   (base64-encoded random bytes typically have entropy ~5.2).
+     * @returns True if the string exceeds both the length and entropy thresholds.
+     */
+    static isHighEntropy(str: string, threshold?: number): boolean;
+}
+//# sourceMappingURL=scanner.d.ts.map

package/dist/src/dlp/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../src/dlp/scanner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAe,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAM5C;;;GAGG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAY;gBAEd,MAAM,EAAE,SAAS;IAI7B;;;;;;OAMG;IACH,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAE,MAAW,GAAG,SAAS;IA2BrD;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IA8ClB,sEAAsE;IACtE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAKvC;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAwClB;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM;IAgB7D;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,OAAO;IAenE;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAgE7B;;;;;;;OAOG;IACH,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAuCxC;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;IAgBvB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;IAgBvB;;;;;OAKG;IACH,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC;IAsB/B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IA+BzB;;;;;;;OAOG;IACH,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAkB5C;;;;;;;;;;OAUG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,GAAE,MAAY,GAAG,OAAO;CAIpE"}