palizade 0.1.2 → 0.2.2

package/dist/index.cjs

@@ -10829,6 +10829,16 @@ function makeErrorResponse(id, code, message, data) {
     }
   };
 }
+function makeToolErrorResultResponse(id, text) {
+  return {
+    jsonrpc: "2.0",
+    id,
+    result: {
+      content: [{ type: "text", text }],
+      isError: true
+    }
+  };
+}
 
 // ../core/dist/canonical.js
 var import_node_crypto = require("node:crypto");
@@ -25387,6 +25397,7 @@ var capabilitySchema = external_exports.enum([
   "reads_untrusted_content",
   "reads_sensitive_data",
   "network_egress",
+  "file_write",
   "writes_local",
   "writes_remote",
   "deletes_data",
@@ -25404,9 +25415,48 @@ var serverConfigSchema = external_exports.object({
   trust: trustSchema.default("untrusted"),
   toolClasses: external_exports.record(external_exports.string(), toolClassSchema).default({}),
   toolCapabilities: external_exports.record(external_exports.string(), external_exports.array(capabilitySchema)).default({}),
+  sensitive: external_exports.boolean().default(false),
+  sensitiveTools: external_exports.record(external_exports.string(), external_exports.boolean()).default({}),
+  sensitivePathPatterns: external_exports.array(external_exports.string()).default([]),
   shell: external_exports.boolean().default(false),
   allowShell: external_exports.boolean().default(false)
 }).strict();
+var secretDetectorConfigSchema = external_exports.object({
+  enabled: external_exports.boolean().default(false),
+  aws: external_exports.boolean().default(true),
+  generic: external_exports.boolean().default(true),
+  jwt: external_exports.boolean().default(true),
+  privateKey: external_exports.boolean().default(true),
+  googleApiKey: external_exports.boolean().default(true),
+  stripe: external_exports.boolean().default(true),
+  slack: external_exports.boolean().default(true),
+  github: external_exports.boolean().default(true),
+  openai: external_exports.boolean().default(true)
+}).default({
+  enabled: false,
+  aws: true,
+  generic: true,
+  jwt: true,
+  privateKey: true,
+  googleApiKey: true,
+  stripe: true,
+  slack: true,
+  github: true,
+  openai: true
+});
+var piiDetectorConfigSchema = external_exports.object({
+  enabled: external_exports.boolean().default(false),
+  email: external_exports.boolean().default(true),
+  ssn: external_exports.boolean().default(true),
+  creditCard: external_exports.boolean().default(true),
+  phone: external_exports.boolean().default(true)
+}).default({
+  enabled: false,
+  email: true,
+  ssn: true,
+  creditCard: true,
+  phone: true
+});
 var palizadeConfigSchema = external_exports.object({
   stateDir: external_exports.string().default(".palizade"),
   policy: external_exports.string().default("policies/default.yaml"),
@@ -25414,8 +25464,9 @@ var palizadeConfigSchema = external_exports.object({
   audit: external_exports.object({
     jsonl: external_exports.string().default(".palizade/audit.jsonl"),
     sqlite: external_exports.string().default(".palizade/audit.sqlite"),
-    captureRawPayloads: external_exports.boolean().default(false)
-  }).default({ jsonl: ".palizade/audit.jsonl", sqlite: ".palizade/audit.sqlite", captureRawPayloads: false }),
+    captureRawPayloads: external_exports.boolean().default(false),
+    errorVerbosity: external_exports.boolean().default(true)
+  }).default({ jsonl: ".palizade/audit.jsonl", sqlite: ".palizade/audit.sqlite", captureRawPayloads: false, errorVerbosity: true }),
   approvals: external_exports.object({
     mode: external_exports.enum(["terminal", "localhost", "static-allow", "static-deny"]).default("terminal"),
     timeoutMs: external_exports.number().int().positive().default(3e4),
@@ -25429,10 +25480,22 @@ var palizadeConfigSchema = external_exports.object({
       model: external_exports.string().default("sinatras/Llama-Prompt-Guard-2-86M-ONNX"),
       cacheDir: external_exports.string().optional(),
       device: external_exports.string().default("cpu")
-    }).default({ enabled: false, model: "sinatras/Llama-Prompt-Guard-2-86M-ONNX", device: "cpu" })
+    }).default({ enabled: false, model: "sinatras/Llama-Prompt-Guard-2-86M-ONNX", device: "cpu" }),
+    secrets: secretDetectorConfigSchema,
+    pii: piiDetectorConfigSchema
   }).default({
     heuristic: true,
-    promptGuard2: { enabled: false, model: "sinatras/Llama-Prompt-Guard-2-86M-ONNX", device: "cpu" }
+    promptGuard2: { enabled: false, model: "sinatras/Llama-Prompt-Guard-2-86M-ONNX", device: "cpu" },
+    secrets: { enabled: false, aws: true, generic: true, jwt: true, privateKey: true, googleApiKey: true, stripe: true, slack: true, github: true, openai: true },
+    pii: { enabled: false, email: true, ssn: true, creditCard: true, phone: true }
+  }),
+  egress: external_exports.object({
+    allowlist: external_exports.object({
+      hosts: external_exports.array(external_exports.string()).default([]),
+      emails: external_exports.array(external_exports.string()).default([])
+    }).default({ hosts: [], emails: [] })
+  }).default({
+    allowlist: { hosts: [], emails: [] }
   }),
   transport: external_exports.object({
     maxMessageBytes: external_exports.number().int().min(1024).default(64 * 1024 * 1024),
@@ -25520,7 +25583,7 @@ var SOURCE_RE = /\b(read|get|fetch|search|browse|list|download|crawl|open|load|q
 var CAPABILITY_RULES = [
   [/\b(fetch|http|post|put|patch|request|webhook|url|browser|crawl)\b/iu, ["network_egress", "reads_untrusted_content"]],
   [/\b(email|mail|send|sms|slack|discord|message|publish)\b/iu, ["sends_message", "writes_remote", "network_egress"]],
-  [/\b(write|save|edit|create|move|append)\b/iu, ["writes_local"]],
+  [/\b(write|save|edit|create|move|append)\b/iu, ["file_write", "writes_local"]],
   [/\b(delete|remove|rm|destroy)\b/iu, ["deletes_data"]],
   [/\b(exec|shell|run|spawn|command|script|terminal)\b/iu, ["executes_code"]],
   [/\b(secret|credential|token|key|env|password)\b/iu, ["accesses_credentials", "reads_sensitive_data"]],
@@ -25534,7 +25597,7 @@ function classifyToolDetailed(toolName, server, tool) {
   for (const capability of capabilitiesFromAnnotations(tool?.annotations)) {
     capabilities.add(capability);
   }
-  const searchable = `${toolName} ${tool?.title ?? ""} ${tool?.description ?? ""}`;
+  const searchable = `${toolName} ${tool?.title ?? ""} ${tool?.description ?? ""}`.replace(/[_-]+/gu, " ");
   for (const [regex, matched] of CAPABILITY_RULES) {
     if (regex.test(searchable)) {
       matched.forEach((capability) => capabilities.add(capability));
@@ -25564,6 +25627,7 @@ function capabilitiesFromAnnotations(annotations) {
   const capabilities = /* @__PURE__ */ new Set();
   if (annotations.destructiveHint === true) {
     capabilities.add("writes_remote");
+    capabilities.add("file_write");
     capabilities.add("writes_local");
   }
   if (annotations.openWorldHint === true) {
@@ -25578,6 +25642,7 @@ function capabilitiesFromAnnotations(annotations) {
 function deriveClass(toolName, capabilities) {
   if ([...capabilities].some((capability) => [
     "network_egress",
+    "file_write",
     "writes_local",
     "writes_remote",
     "deletes_data",
@@ -26480,8 +26545,176 @@ function promptGuardMaliciousScore(rows) {
   return rows[0]?.score ?? 0;
 }
 
+// ../detectors/dist/sensitive.js
+var SECRET_RULES = [
+  { label: "secret:aws-access-key-id", family: "aws", kind: "secret", score: 0.9, regex: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gu },
+  { label: "secret:aws-secret-key", family: "aws", kind: "secret", score: 0.95, regex: /\baws[_-]?secret[_-]?access[_-]?key\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})["']?/giu },
+  { label: "secret:openai", family: "openai", kind: "secret", score: 0.9, regex: /\bsk-[A-Za-z0-9]{20,}\b/gu },
+  { label: "secret:github", family: "github", kind: "secret", score: 0.9, regex: /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/gu },
+  { label: "secret:slack", family: "slack", kind: "secret", score: 0.9, regex: /\bxox[abprs]-[A-Za-z0-9-]{20,}\b/gu },
+  { label: "secret:jwt", family: "jwt", kind: "secret", score: 0.85, regex: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/gu },
+  { label: "secret:jwt", family: "jwt", kind: "secret", score: 0.85, regex: /\bBearer\s+(eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})\b/giu },
+  { label: "secret:private-key", family: "privateKey", kind: "secret", score: 1, regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]{24,}?-----END [A-Z ]*PRIVATE KEY-----/gu },
+  { label: "secret:google-api-key", family: "googleApiKey", kind: "secret", score: 0.9, regex: /\bAIza[0-9A-Za-z_-]{35}\b/gu },
+  { label: "secret:stripe", family: "stripe", kind: "secret", score: 0.9, regex: /\b[sp]k_live_[0-9A-Za-z]{16,}\b/gu },
+  {
+    label: "secret:assignment",
+    family: "generic",
+    kind: "secret",
+    score: 0.8,
+    regex: /\b(?:password|passwd|api[_-]?key|secret|token|access[_-]?token|client[_-]?secret)\s*[:=]\s*["']?([A-Za-z0-9_./+=-]{12,})["']?/giu,
+    validate: (match) => shannonEntropy(match[1] ?? "") >= 3.2
+  }
+];
+var PII_RULES = [
+  { label: "pii:email", family: "email", kind: "pii", score: 0.55, regex: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/giu },
+  { label: "pii:ssn", family: "ssn", kind: "pii", score: 0.75, regex: /\b(?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b/gu },
+  {
+    label: "pii:credit-card",
+    family: "creditCard",
+    kind: "pii",
+    score: 0.75,
+    regex: /\b(?:\d[ -]*?){13,19}\b/gu,
+    validate: (match) => luhn(match[0].replace(/\D/gu, ""))
+  },
+  { label: "pii:phone", family: "phone", kind: "pii", score: 0.45, regex: /\b(?:\+?1[\s.-]?)?(?:\(\d{3}\)|\d{3})[\s.-]\d{3}[\s.-]\d{4}\b/gu }
+];
+var SensitiveDataDetector = class {
+  name = "sensitive";
+  options;
+  constructor(options = {}) {
+    this.options = {
+      secrets: { enabled: false, ...options.secrets },
+      pii: { enabled: false, ...options.pii }
+    };
+  }
+  detect(text, _ctx = {}) {
+    if (!text.trim()) {
+      return { score: 0, labels: [], spans: [], detector: this.name };
+    }
+    const spans = [];
+    const labels = /* @__PURE__ */ new Set();
+    let score = 0;
+    if (this.options.secrets.enabled) {
+      score = Math.max(score, this.applyRules(text, SECRET_RULES, this.options.secrets, spans, labels));
+    }
+    if (this.options.pii.enabled) {
+      score = Math.max(score, this.applyRules(text, PII_RULES, this.options.pii, spans, labels));
+    }
+    return {
+      score: clampScore(score),
+      labels: [...labels],
+      spans: mergeSensitiveSpans(spans),
+      detector: this.name
+    };
+  }
+  applyRules(text, rules, options, spans, labels) {
+    let maxScore = 0;
+    for (const rule of rules) {
+      if (options[rule.family] === false) {
+        continue;
+      }
+      for (const match of text.matchAll(rule.regex)) {
+        if (rule.validate && !rule.validate(match)) {
+          continue;
+        }
+        const start = match.index ?? 0;
+        const end = start + match[0].length;
+        labels.add(rule.label);
+        spans.push({ start, end, label: rule.label });
+        maxScore = Math.max(maxScore, rule.score);
+      }
+    }
+    return maxScore;
+  }
+};
+function isSecretLabel(label) {
+  return label.startsWith("secret:");
+}
+function isPiiLabel(label) {
+  return label.startsWith("pii:");
+}
+function hasSecretLabel(labels) {
+  return labels.some(isSecretLabel);
+}
+function hasPiiLabel(labels) {
+  return labels.some(isPiiLabel);
+}
+function maskSensitiveText(text, spans = []) {
+  if (spans.length === 0) {
+    return text;
+  }
+  let output2 = text;
+  const sorted = [...spans].sort((left, right) => right.start - left.start || right.end - left.end);
+  for (const span of sorted) {
+    output2 = `${output2.slice(0, span.start)}[REDACTED:${span.label ?? "sensitive"}]${output2.slice(span.end)}`;
+  }
+  return output2;
+}
+function maskKnownSensitiveText(text) {
+  const detector = new SensitiveDataDetector({
+    secrets: { enabled: true },
+    pii: { enabled: true }
+  });
+  const result = detector.detect(text);
+  return maskSensitiveText(text, result.spans);
+}
+function mergeSensitiveSpans(spans) {
+  const sorted = [...spans].sort((a, b) => a.start - b.start || a.end - b.end);
+  const merged = [];
+  for (const span of sorted) {
+    const last = merged[merged.length - 1];
+    if (!last || span.start > last.end) {
+      merged.push({ ...span });
+      continue;
+    }
+    last.end = Math.max(last.end, span.end);
+    if (last.label !== span.label) {
+      last.label = `${last.label ?? "sensitive"},${span.label ?? "sensitive"}`;
+    }
+  }
+  return merged;
+}
+function shannonEntropy(input2) {
+  if (!input2) {
+    return 0;
+  }
+  const counts = /* @__PURE__ */ new Map();
+  for (const char of input2) {
+    counts.set(char, (counts.get(char) ?? 0) + 1);
+  }
+  let entropy = 0;
+  for (const count of counts.values()) {
+    const p = count / input2.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+function luhn(input2) {
+  if (input2.length < 13 || input2.length > 19) {
+    return false;
+  }
+  let sum = 0;
+  let doubleDigit = false;
+  for (let index = input2.length - 1; index >= 0; index -= 1) {
+    let digit = Number(input2[index]);
+    if (!Number.isInteger(digit)) {
+      return false;
+    }
+    if (doubleDigit) {
+      digit *= 2;
+      if (digit > 9) {
+        digit -= 9;
+      }
+    }
+    sum += digit;
+    doubleDigit = !doubleDigit;
+  }
+  return sum % 10 === 0;
+}
+
 // ../policy/dist/schema.js
-var actionSchema = external_exports.enum(["allow", "block", "sanitize", "redact_spans", "require_approval", "log_only"]);
+var actionSchema = external_exports.enum(["allow", "block", "sanitize", "redact_spans", "redact_secrets", "require_approval", "log_only"]);
 var directionSchema = external_exports.enum(["request", "response"]);
 var trustSchema2 = external_exports.enum(["trusted", "semi", "untrusted"]);
 var toolClassSchema2 = external_exports.enum(["source", "sink", "pure", "unknown"]);
@@ -26490,6 +26723,7 @@ var capabilitySchema2 = external_exports.enum([
   "reads_untrusted_content",
   "reads_sensitive_data",
   "network_egress",
+  "file_write",
   "writes_local",
   "writes_remote",
   "deletes_data",
@@ -26512,7 +26746,12 @@ var policyConditionSchema = external_exports.object({
   capabilities_all: external_exports.array(capabilitySchema2).optional(),
   trust: singleOrArray(trustSchema2).optional(),
   taint: external_exports.boolean().optional(),
+  sensitive_taint: external_exports.boolean().optional(),
   temporal_taint: external_exports.boolean().optional(),
+  secret_detected: external_exports.boolean().optional(),
+  pii_detected: external_exports.boolean().optional(),
+  destination_allowed: external_exports.boolean().optional(),
+  destination_allowlist_configured: external_exports.boolean().optional(),
   detector_score_gte: external_exports.number().min(0).max(1).optional(),
   detector_score_lt: external_exports.number().min(0).max(1).optional(),
   labels_any: external_exports.array(external_exports.string()).optional(),
@@ -26602,8 +26841,18 @@ function matchesCondition(condition, ctx) {
     return false;
   if (condition.taint !== void 0 && Boolean(ctx.taint) !== condition.taint)
     return false;
+  if (condition.sensitive_taint !== void 0 && Boolean(ctx.sensitive_taint) !== condition.sensitive_taint)
+    return false;
   if (condition.temporal_taint !== void 0 && Boolean(ctx.temporal_taint) !== condition.temporal_taint)
     return false;
+  if (condition.secret_detected !== void 0 && Boolean(ctx.secret_detected) !== condition.secret_detected)
+    return false;
+  if (condition.pii_detected !== void 0 && Boolean(ctx.pii_detected) !== condition.pii_detected)
+    return false;
+  if (condition.destination_allowed !== void 0 && Boolean(ctx.destination_allowed) !== condition.destination_allowed)
+    return false;
+  if (condition.destination_allowlist_configured !== void 0 && Boolean(ctx.destination_allowlist_configured) !== condition.destination_allowlist_configured)
+    return false;
   if (condition.session_quarantined !== void 0 && Boolean(ctx.session_quarantined) !== condition.session_quarantined)
     return false;
   if (condition.detector_score_gte !== void 0 && (ctx.detector_score ?? 0) < condition.detector_score_gte)
@@ -26703,14 +26952,44 @@ var InterceptionEngine = class {
     const toolClass = classification.toolClass;
     const argumentText = flattenArguments(params.arguments);
     const argumentFields = extractArgumentFields(params.arguments);
+    const argumentBlocks = extractTextBlocks(params.arguments);
+    const argumentDetections = await Promise.all(argumentBlocks.map(async (block) => ({
+      block,
+      detection: await this.options.detector.detect(block.text, {
+        server: this.options.serverName,
+        tool,
+        trust: this.options.server.trust,
+        surface: "argument"
+      })
+    })));
+    const argumentDetection = fuseDetections(argumentDetections.map((entry) => entry.detection));
+    const argumentDetectionsByPath = new Map(argumentDetections.map((entry) => [pathKey(entry.block), entry.detection]));
     const matches = this.options.taintStore.match(this.options.sessionId, argumentText, {
       fuzzyHammingMax: this.options.config.taint.fuzzyHammingMax
     });
     const fieldMatches = argumentFields.flatMap((field) => this.options.taintStore.match(this.options.sessionId, field.text, {
       fuzzyHammingMax: this.options.config.taint.fuzzyHammingMax
     }).map((match) => ({ field, match })));
+    const sensitiveMatches = this.options.taintStore.match(this.options.sessionId, argumentText, {
+      fuzzyHammingMax: this.options.config.taint.fuzzyHammingMax,
+      classes: ["sensitive"]
+    });
+    const sensitiveFieldMatches = argumentFields.flatMap((field) => this.options.taintStore.match(this.options.sessionId, field.text, {
+      fuzzyHammingMax: this.options.config.taint.fuzzyHammingMax,
+      classes: ["sensitive"]
+    }).map((match) => ({ field, match })));
     const taintedArgumentRoles = [...new Set(fieldMatches.map(({ field }) => field.role))];
     const temporal = matches.some((match) => match.reason === "temporal") || this.options.taintStore.hasTemporal(this.options.sessionId);
+    const secretDetected = hasSecretLabel(argumentDetection.labels);
+    const piiDetected = hasPiiLabel(argumentDetection.labels);
+    const sensitiveTaint = sensitiveMatches.length > 0 || sensitiveFieldMatches.length > 0;
+    const destination = summarizeDestinations(argumentFields, this.options.config.egress.allowlist);
+    const allTaintMatches = [
+      ...matches,
+      ...fieldMatches.map(({ match }) => match),
+      ...sensitiveMatches,
+      ...sensitiveFieldMatches.map(({ match }) => match)
+    ];
     const decision = evaluatePolicy(this.options.policy, {
       direction: "request",
       method: message.method,
@@ -26720,7 +26999,14 @@ var InterceptionEngine = class {
       capabilities: classification.capabilities,
       trust: this.options.server.trust,
       taint: matches.length > 0 || fieldMatches.length > 0,
+      sensitive_taint: sensitiveTaint,
       temporal_taint: temporal,
+      secret_detected: secretDetected,
+      pii_detected: piiDetected,
+      destination_allowed: destination.allowed,
+      destination_allowlist_configured: destination.allowlistConfigured,
+      detector_score: argumentDetection.score,
+      labels: argumentDetection.labels,
       argument_text: argumentText,
       argument_roles: argumentRolesSummary(argumentFields),
       tainted_argument_roles: taintedArgumentRoles
@@ -26730,29 +27016,48 @@ var InterceptionEngine = class {
       tool,
       toolClass,
       classification,
-      taintMatches: [...matches, ...fieldMatches.map(({ match }) => match)],
+      taintMatches: allTaintMatches,
       summary: `${tool} (${toolClass}; ${classification.capabilities.join(",") || "no capabilities"}) wants to run with ${matches.length + fieldMatches.length} taint match(es).`
     });
     await this.auditDecision(message, "request", approval.decision, startedAt, {
       tool,
       toolClass,
       classification,
-      taintMatches: [...matches, ...fieldMatches.map(({ match }) => match)],
-      approved: approval.approved
+      detector: argumentDetection,
+      taintMatches: allTaintMatches,
+      approved: approval.approved,
+      argumentRoles: argumentRolesSummary(argumentFields),
+      taintedArgumentRoles,
+      destination,
+      sensitiveTaint,
+      secretDetected,
+      piiDetected,
+      taintClasses: classesFromMatches(allTaintMatches),
+      redacted: decision.action === "redact_secrets"
     });
     this.options.taintStore.consumeTurn(this.options.sessionId);
     if (!approval.approved || decision.action === "block") {
       return {
         toClient: message.id === void 0 ? [] : [
-          makeErrorResponse(message.id, -32020, "Palizade blocked MCP tool call", {
-            decision,
-            taint: matches,
-            taintedArgumentRoles
-          })
+          makeToolErrorResultResponse(message.id, formatBlockedToolCallResultText(decision, tool, this.options.config.audit.errorVerbosity))
         ],
         toServer: []
       };
     }
+    if (decision.action === "redact_secrets") {
+      const redactedArguments = applyTextTransforms(params.arguments, (text, block) => maskSensitiveText(text, argumentDetectionsByPath.get(pathKey(block))?.spans));
+      this.recordPending(message, tool);
+      return {
+        toClient: [],
+        toServer: [{
+          ...message,
+          params: {
+            ...params,
+            arguments: redactedArguments
+          }
+        }]
+      };
+    }
     this.recordPending(message, tool);
     return { toClient: [], toServer: [message] };
   }
@@ -26855,6 +27160,9 @@ var InterceptionEngine = class {
       capabilities: classification.capabilities,
       trust: this.options.server.trust,
       taint: taintRecords.length > 0,
+      sensitive_taint: recordsHaveClass(taintRecords, "sensitive"),
+      secret_detected: hasSecretLabel(fused.labels),
+      pii_detected: hasPiiLabel(fused.labels),
       detector_score: fused.score,
       labels: fused.labels
     });
@@ -26873,6 +27181,10 @@ var InterceptionEngine = class {
       classification,
       detector: fused,
       taintIds: taintRecords.map((record2) => record2.id),
+      taintClasses: classesFromRecords(taintRecords),
+      sensitiveTaint: recordsHaveClass(taintRecords, "sensitive"),
+      secretDetected: hasSecretLabel(fused.labels),
+      piiDetected: hasPiiLabel(fused.labels),
       approved: approval.approved,
       payload: result
     });
@@ -26901,7 +27213,7 @@ var InterceptionEngine = class {
         toServer: []
       };
     }
-    if (decision.action === "redact_spans") {
+    if (decision.action === "redact_spans" || decision.action === "redact_secrets") {
       return {
         toClient: [{
           ...message,
@@ -26978,8 +27290,10 @@ var InterceptionEngine = class {
     return { toClient: [message], toServer: [] };
   }
   registerTaint(tool, toolClass, blocks, detection) {
-    const shouldTaint = this.options.server.trust !== "trusted" || toolClass === "source" || detection.score >= this.options.config.taint.suspiciousScore;
-    if (!shouldTaint) {
+    const untrusted = this.options.server.trust !== "trusted" || toolClass === "source" || detection.score >= this.options.config.taint.suspiciousScore;
+    const sensitive = this.isSensitiveOrigin(tool) || hasSecretLabel(detection.labels) || hasPiiLabel(detection.labels);
+    const classes = taintClasses({ untrusted, sensitive });
+    if (classes.length === 0) {
       return [];
     }
     return blocks.filter((block) => block.text.trim().length >= 8).map((block) => this.options.taintStore.add({
@@ -26989,24 +27303,30 @@ var InterceptionEngine = class {
       trust: this.options.server.trust,
       text: block.text,
       detectorScore: detection.score,
-      labels: detection.labels
+      labels: detection.labels,
+      classes
     }));
   }
   registerTaintFromContents(sourceName, classification, contents, detection) {
     const highRiskSource = this.options.server.trust === "untrusted" || classification.toolClass === "source" || classification.capabilities.includes("reads_untrusted_content");
-    const shouldTaint = highRiskSource || detection.score >= this.options.config.taint.suspiciousScore;
-    if (!shouldTaint) {
-      return [];
-    }
-    return contents.filter((content) => content.text && content.text.trim().length >= 8 && content.kind !== "binary").map((content) => this.options.taintStore.add({
-      sessionId: this.options.sessionId,
-      sourceServer: this.options.serverName,
-      sourceTool: content.sourceToolOrResource ?? sourceName,
-      trust: this.options.server.trust,
-      text: content.text ?? "",
-      detectorScore: detection.score,
-      labels: detection.labels
-    }));
+    return contents.filter((content) => content.text && content.text.trim().length >= 8 && content.kind !== "binary").flatMap((content) => {
+      const untrusted = highRiskSource || detection.score >= this.options.config.taint.suspiciousScore;
+      const sensitive = this.isSensitiveOrigin(sourceName, content) || hasSecretLabel(detection.labels) || hasPiiLabel(detection.labels);
+      const classes = taintClasses({ untrusted, sensitive });
+      if (classes.length === 0) {
+        return [];
+      }
+      return [this.options.taintStore.add({
+        sessionId: this.options.sessionId,
+        sourceServer: this.options.serverName,
+        sourceTool: content.sourceToolOrResource ?? sourceName,
+        trust: this.options.server.trust,
+        text: content.text ?? "",
+        detectorScore: detection.score,
+        labels: detection.labels,
+        classes
+      })];
+    });
   }
   async handleDescriptorListResponse(message, bucket, origin, resultKey, nameOf) {
     const startedAt = Date.now();
@@ -27077,6 +27397,9 @@ var InterceptionEngine = class {
       capabilities: classification.capabilities,
       trust: this.options.server.trust,
       taint: taintRecords.length > 0,
+      sensitive_taint: recordsHaveClass(taintRecords, "sensitive"),
+      secret_detected: hasSecretLabel(fused.labels),
+      pii_detected: hasPiiLabel(fused.labels),
       detector_score: fused.score,
       labels: fused.labels
     });
@@ -27093,6 +27416,10 @@ var InterceptionEngine = class {
       classification,
       detector: fused,
       taintIds: taintRecords.map((record2) => record2.id),
+      taintClasses: classesFromRecords(taintRecords),
+      sensitiveTaint: recordsHaveClass(taintRecords, "sensitive"),
+      secretDetected: hasSecretLabel(fused.labels),
+      piiDetected: hasPiiLabel(fused.labels),
       approved: approval.approved,
       payload: result
     });
@@ -27115,7 +27442,7 @@ var InterceptionEngine = class {
         toServer: []
       };
     }
-    if (decision.action === "redact_spans") {
+    if (decision.action === "redact_spans" || decision.action === "redact_secrets") {
       return {
         toClient: [{
           ...message,
@@ -27226,7 +27553,7 @@ var InterceptionEngine = class {
       tool: extra.tool,
       direction,
       method: extra.method ?? (isRequest(message) ? message.method : void 0),
-      taint_ids: extra.taintIds ?? extra.taintMatches?.map((match) => match.taintId) ?? [],
+      taint_ids: dedupePreservingOrder(extra.taintIds ?? extra.taintMatches?.map((match) => match.taintId) ?? []),
       detector: {
         score: extra.detector?.score ?? 0,
         labels: extra.detector?.labels ?? []
@@ -27238,13 +27565,46 @@ var InterceptionEngine = class {
       action: decision.action,
       reason: decision.reason,
       latency_ms: Date.now() - startedAt,
-      payload: extra.payload,
+      payload: scrubAuditPayload(extra.payload),
       metadata: {
         toolClass: extra.toolClass,
         capabilities: extra.classification?.capabilities,
         lockChecks: extra.lockChecks,
         lockStatus: extra.lockStatus,
-        approved: extra.approved
+        approved: extra.approved,
+        argumentRoles: extra.argumentRoles,
+        taintedArgumentRoles: extra.taintedArgumentRoles,
+        taintClasses: extra.taintClasses,
+        destination: extra.destination,
+        sensitiveTaint: extra.sensitiveTaint,
+        secretDetected: extra.secretDetected,
+        piiDetected: extra.piiDetected,
+        redacted: extra.redacted
+      }
+    });
+  }
+  isSensitiveOrigin(sourceName, content) {
+    if (this.options.server.sensitive) {
+      return true;
+    }
+    if (this.options.server.sensitiveTools[sourceName] === true) {
+      return true;
+    }
+    if (content?.sourceToolOrResource && this.options.server.sensitiveTools[content.sourceToolOrResource] === true) {
+      return true;
+    }
+    const searchable = [
+      sourceName,
+      content?.sourceToolOrResource,
+      content?.path,
+      typeof content?.rawValue === "string" ? content.rawValue : void 0
+    ].filter((value) => Boolean(value));
+    return this.options.server.sensitivePathPatterns.some((pattern) => {
+      try {
+        const regex = new RegExp(pattern, "iu");
+        return searchable.some((value) => regex.test(value));
+      } catch {
+        return false;
       }
     });
   }
@@ -27252,6 +27612,111 @@ var InterceptionEngine = class {
 function pathKey(block) {
   return block.path.join(".");
 }
+function taintClasses(input2) {
+  const classes = [];
+  if (input2.untrusted) {
+    classes.push("untrusted");
+  }
+  if (input2.sensitive) {
+    classes.push("sensitive");
+  }
+  return classes;
+}
+function recordsHaveClass(records, taintClass) {
+  return records.some((record2) => record2.classes.includes(taintClass));
+}
+function classesFromRecords(records) {
+  return dedupePreservingOrder(records.flatMap((record2) => record2.classes));
+}
+function classesFromMatches(matches) {
+  return dedupePreservingOrder(matches.flatMap((match) => match.classes ?? []));
+}
+function summarizeDestinations(argumentFields, allowlist) {
+  const hosts = dedupePreservingOrder(argumentFields.flatMap((field) => hostsFromField(field)));
+  const emails = dedupePreservingOrder(argumentFields.filter((field) => field.role === "email_recipient").map((field) => field.text.toLowerCase()));
+  const allowlistConfigured = allowlist.hosts.length > 0 || allowlist.emails.length > 0;
+  const hostsAllowed = hosts.every((host) => allowlist.hosts.some((entry) => matchesHost(entry, host)));
+  const emailsAllowed = emails.every((email3) => allowlist.emails.some((entry) => matchesEmail(entry, email3)));
+  const hasDestinations = hosts.length > 0 || emails.length > 0;
+  return {
+    allowed: !allowlistConfigured || !hasDestinations || hostsAllowed && emailsAllowed,
+    allowlistConfigured,
+    hosts,
+    emailRecipients: emails.map(maskSensitiveValueForMetadata),
+    destinationCount: hosts.length + emails.length
+  };
+}
+function hostsFromField(field) {
+  if (field.role === "hostname") {
+    return [normalizeHost(field.text)].filter(Boolean);
+  }
+  if (field.role !== "url") {
+    return [];
+  }
+  try {
+    return [normalizeHost(new URL(field.text).hostname)].filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function matchesHost(pattern, host) {
+  const normalizedPattern = normalizeHost(pattern);
+  const normalizedHost = normalizeHost(host);
+  if (!normalizedPattern || !normalizedHost) {
+    return false;
+  }
+  if (normalizedPattern === "*") {
+    return true;
+  }
+  if (normalizedPattern.startsWith("*.")) {
+    const suffix = normalizedPattern.slice(1);
+    return normalizedHost.endsWith(suffix);
+  }
+  return normalizedPattern === normalizedHost;
+}
+function matchesEmail(pattern, email3) {
+  const normalizedPattern = pattern.trim().toLowerCase();
+  const normalizedEmail = email3.trim().toLowerCase();
+  if (!normalizedPattern || !normalizedEmail) {
+    return false;
+  }
+  if (normalizedPattern === "*") {
+    return true;
+  }
+  if (normalizedPattern.startsWith("*@")) {
+    return normalizedEmail.endsWith(normalizedPattern.slice(1));
+  }
+  if (normalizedPattern.startsWith("@")) {
+    return normalizedEmail.endsWith(normalizedPattern);
+  }
+  return normalizedPattern === normalizedEmail;
+}
+function normalizeHost(value) {
+  return value.trim().toLowerCase().replace(/\.$/u, "");
+}
+function maskSensitiveValueForMetadata(value) {
+  const [local, domain2] = value.split("@");
+  if (!local || !domain2) {
+    return "[REDACTED:destination]";
+  }
+  return `${local.slice(0, 1) || "*"}***@${domain2}`;
+}
+function scrubAuditPayload(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value === "string") {
+    return maskKnownSensitiveText(value);
+  }
+  if (value === null || typeof value !== "object") {
+    return value;
+  }
+  try {
+    return applyTextTransforms(value, (text) => maskKnownSensitiveText(text));
+  } catch {
+    return "[payload omitted: audit masking failed]";
+  }
+}
 function worstLockStatus(checks) {
   if (checks.length === 0)
     return "unknown";
@@ -27274,6 +27739,23 @@ function descriptorName(item, fallback) {
   }
   return `${fallback}:${JSON.stringify(item).slice(0, 80)}`;
 }
+function formatBlockedToolCallResultText(decision, tool, verbose) {
+  if (!verbose) {
+    return "Palizade blocked this tool call. This action was prevented by your local Palizade security policy.";
+  }
+  const rule = decision.matchedRuleId ?? "policy-default";
+  const reason = scrubClientBlockText(trimTrailingPeriod(decision.reason));
+  return `Palizade blocked this tool call. Rule: ${rule}. Reason: ${reason}. Tool: ${tool}. This action was prevented by your local Palizade security policy.`;
+}
+function scrubClientBlockText(text) {
+  return text.replace(/\btaint_[A-Za-z0-9-]+\b/gu, "[taint-id]");
+}
+function trimTrailingPeriod(text) {
+  return text.endsWith(".") ? text.slice(0, -1) : text;
+}
+function dedupePreservingOrder(values) {
+  return [...new Set(values)];
+}
 function auditScopeId(scope, profileId, runId, sessionId) {
   if (scope === "process") {
     return `process:${sessionId}`;
@@ -27923,6 +28405,7 @@ var SqliteTaintStore = class {
         payload_hash text not null,
         detector_score real not null,
         labels_json text not null,
+        classes_json text,
         fingerprint_json text not null
       );
       create index if not exists idx_taint_session on taint_records(session_id);
@@ -27938,6 +28421,7 @@ var SqliteTaintStore = class {
     this.ensureColumn("taint_records", "scope_id", "text");
     this.ensureColumn("taint_records", "run_id", "text");
     this.ensureColumn("taint_records", "expires_at", "text");
+    this.ensureColumn("taint_records", "classes_json", "text");
     this.db.exec(`
       create index if not exists idx_taint_scope on taint_records(scope_id);
       create index if not exists idx_taint_expires on taint_records(expires_at);
@@ -27962,11 +28446,12 @@ var SqliteTaintStore = class {
       payloadHash: sha2563(input2.text),
       detectorScore: input2.detectorScore,
       labels: [...input2.labels],
+      classes: normalizeClasses(input2.classes),
       fingerprint: makeProtectedFingerprint(input2.text, this.hmacKey)
     };
     this.db.prepare(`insert into taint_records
-       (id, profile_id, scope_id, run_id, session_id, source_server, source_tool, trust, created_at, expires_at, payload_hash, detector_score, labels_json, fingerprint_json)
-       values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(record2.id, record2.profileId, record2.scopeId, record2.runId ?? null, record2.sessionId, record2.sourceServer, record2.sourceTool, record2.trust, record2.createdAt, record2.expiresAt, record2.payloadHash, record2.detectorScore, JSON.stringify(record2.labels), JSON.stringify(record2.fingerprint));
+       (id, profile_id, scope_id, run_id, session_id, source_server, source_tool, trust, created_at, expires_at, payload_hash, detector_score, labels_json, classes_json, fingerprint_json)
+       values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(record2.id, record2.profileId, record2.scopeId, record2.runId ?? null, record2.sessionId, record2.sourceServer, record2.sourceTool, record2.trust, record2.createdAt, record2.expiresAt, record2.payloadHash, record2.detectorScore, JSON.stringify(record2.labels), JSON.stringify(record2.classes), JSON.stringify(record2.fingerprint));
     return record2;
   }
   get(id) {
@@ -27984,27 +28469,34 @@ var SqliteTaintStore = class {
     const records = this.recordsForScope(sessionId);
     const matches = [];
     for (const record2 of records) {
+      if (!matchesClassFilter(record2.classes, options.classes)) {
+        continue;
+      }
       const incomingFragments = new Set(incoming.substrings);
       const substring = record2.fingerprint.substrings.find((candidate) => candidate.length >= minNormalizedLength && incomingFragments.has(candidate));
       if (substring) {
-        matches.push({ taintId: record2.id, reason: "substring", token: substring });
+        matches.push({ taintId: record2.id, reason: "substring", token: substring, classes: record2.classes });
         continue;
       }
       const token = record2.fingerprint.tokens.find((candidate) => candidate.length >= 8 && incoming.tokens.includes(candidate));
       if (token) {
-        matches.push({ taintId: record2.id, reason: "token", token });
+        matches.push({ taintId: record2.id, reason: "token", token, classes: record2.classes });
         continue;
       }
       if (record2.fingerprint.normalized.length >= 32 && incoming.normalized.length >= 32) {
         const distance = hammingDistanceHex(record2.fingerprint.simhash, incoming.simhash);
         if (distance <= fuzzyHammingMax) {
-          matches.push({ taintId: record2.id, reason: "fuzzy", score: 1 - distance / 64 });
+          matches.push({ taintId: record2.id, reason: "fuzzy", classes: record2.classes, score: 1 - distance / 64 });
         }
       }
     }
     for (const temporal of this.activeTemporalRows(sessionId)) {
       for (const taintId of JSON.parse(temporal.source_taint_ids_json)) {
-        matches.push({ taintId, reason: "temporal" });
+        const record2 = this.get(taintId);
+        const classes = record2?.classes ?? ["untrusted"];
+        if (matchesClassFilter(classes, options.classes)) {
+          matches.push({ taintId, reason: "temporal", classes });
+        }
       }
     }
     return dedupeMatches(matches);
@@ -28101,9 +28593,17 @@ function rowToRecord(row) {
     payloadHash: row.payload_hash,
     detectorScore: row.detector_score,
     labels: JSON.parse(row.labels_json),
+    classes: row.classes_json ? JSON.parse(row.classes_json) : ["untrusted"],
     fingerprint: JSON.parse(row.fingerprint_json)
   };
 }
+function normalizeClasses(classes) {
+  const normalized = classes && classes.length > 0 ? classes : ["untrusted"];
+  return [...new Set(normalized)];
+}
+function matchesClassFilter(classes, filter) {
+  return !filter || filter.some((taintClass) => classes.includes(taintClass));
+}
 function makeProtectedFingerprint(input2, key) {
   const normalized = normalizeText(input2);
   const fragments = makeSubstrings(normalized).map((fragment) => hmacSha256Hex(key, fragment));
@@ -28194,6 +28694,12 @@ function createDetector(config2) {
   if (config2.detectors.heuristic) {
     detectors2.push(new HeuristicDetector());
   }
+  if (config2.detectors.secrets.enabled || config2.detectors.pii.enabled) {
+    detectors2.push(new SensitiveDataDetector({
+      secrets: config2.detectors.secrets,
+      pii: config2.detectors.pii
+    }));
+  }
   if (config2.detectors.onnxModelPath) {
     detectors2.push(new OptionalOnnxDetector({ modelPath: config2.detectors.onnxModelPath }));
   }
@@ -28388,6 +28894,7 @@ audit:
   jsonl: .palizade/audit.jsonl
   sqlite: .palizade/audit.sqlite
   captureRawPayloads: false
+  errorVerbosity: true
 
 approvals:
   mode: localhost
@@ -28401,6 +28908,15 @@ detectors:
     model: sinatras/Llama-Prompt-Guard-2-86M-ONNX
     cacheDir: .palizade/models
     device: cpu
+  secrets:
+    enabled: false
+  pii:
+    enabled: false
+
+egress:
+  allowlist:
+    hosts: []
+    emails: []
 
 transport:
   maxMessageBytes: 67108864
@@ -28432,6 +28948,9 @@ servers:
       read_web: source
       send_email: sink
       echo: pure
+    sensitive: false
+    sensitiveTools: {}
+    sensitivePathPatterns: []
   filesystem:
     command: node
     args:
@@ -28453,6 +28972,9 @@ servers:
       edit_file: sink
       create_directory: sink
       move_file: sink
+    sensitive: false
+    sensitiveTools: {}
+    sensitivePathPatterns: []
 `;
 var DEFAULT_POLICY = `version: 1
 defaults:
@@ -28524,7 +29046,6 @@ rules:
     when:
       direction: response
       method: tools/call
-      trust: untrusted
       detector_score_gte: 0.35
     action: sanitize
     reason: Untrusted tool output contains injection-like signals.
@@ -28540,6 +29061,15 @@ rules:
     action: sanitize
     reason: Resource or prompt content contains injection-like signals.
 
+  - id: sanitize-strong-injection-any-trust
+    name: Spotlight strong injection signals regardless of trust
+    when:
+      direction: response
+      method: tools/call
+      detector_score_gte: 0.75
+    action: sanitize
+    reason: Strong injection signal in tool output.
+
   - id: block-tainted-sink
     name: Block tainted content entering sinks
     when:
@@ -28579,7 +29109,7 @@ rules:
 
 // src/index.ts
 var program2 = new Command();
-program2.name("palizade").description("MCP-native prompt-injection firewall and security proxy").version("0.1.0").option("-c, --config <path>", "Path to palizade.yaml", "palizade.yaml");
+program2.name("palizade").description("MCP-native prompt-injection firewall and security proxy").version("0.2.2").option("-c, --config <path>", "Path to palizade.yaml", "palizade.yaml");
 program2.command("init").description("Create a starter palizade.yaml, default policy, and state directory").option("--force", "Overwrite existing files", false).action(async (options) => {
   await writeIfMissing("palizade.yaml", DEFAULT_CONFIG, options.force);
   await writeIfMissing("policies/default.yaml", DEFAULT_POLICY, options.force);

package/dist/index.js

@@ -12,7 +12,7 @@ const program = new Command();
 program
     .name("palizade")
     .description("MCP-native prompt-injection firewall and security proxy")
-    .version("0.1.0")
+    .version(__PKG_VERSION__)
     .option("-c, --config <path>", "Path to palizade.yaml", "palizade.yaml");
 program.command("init")
     .description("Create a starter palizade.yaml, default policy, and state directory")

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,2BAA2B,EAC3B,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EAEd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,yDAAyD,CAAC;KACtE,OAAO,CAAC,OAAO,CAAC;KAChB,MAAM,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,eAAe,CAAC,CAAC;AAE3E,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,WAAW,CAAC,qEAAqE,CAAC;KAClF,MAAM,CAAC,SAAS,EAAE,0BAA0B,EAAE,KAAK,CAAC;KACpD,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,EAAE;IAC5C,6FAA6F;IAC7F,MAAM,cAAc,CAAC,eAAe,EAAE,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,cAAc,CAAC,uBAAuB,EAAE,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;AAC7F,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;KAC9B,WAAW,CAAC,4DAA4D,CAAC;KACzE,QAAQ,CAAC,cAAc,EAAE,gCAAgC,CAAC;KAC1D,MAAM,CAAC,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,CAAC;KAC5D,MAAM,CAAC,iBAAiB,EAAE,sCAAsC,CAAC;KACjE,MAAM,CAAC,wBAAwB,EAAE,0CAA0C,CAAC;KAC5E,MAAM,CAAC,oBAAoB,EAAE,+BAA+B,CAAC;KAC7D,MAAM,CAAC,WAAW,EAAE,sDAAsD,EAAE,KAAK,CAAC;KAClF,MAAM,CAAC,SAAS,EAAE,wCAAwC,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAOlC,EAAE,OAAgB,EAAE,EAAE;IACrB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,UAAU;QACV,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC;QACrD,gBAAgB,EAAE,OAAO,CAAC,YAAY;QACtC,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,iBAAiB,EAAE;KAC7B,CAAC,CAAC;IACH,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;AACrF,CAAC,CAAC,CAAC;AAEL,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;KAC3C,WAAW,CAAC,iCAAiC,CAAC,CAAC;AAElD,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;KACzB,WAAW,CAAC,qCAAqC,CAAC;KAClD,QAAQ,CAAC,QAAQ,EAAE,wCAAwC,CAAC;KAC5D,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,yBAAyB,CAAC;KAC7E,MAAM,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,kBAAkB,CAAC;KACxE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAA4C,EAAE,EAAE;IAC3E,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,KAAK,OAAO,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;IACtE,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;AACtG,CAAC,CAAC,CAAC;AAEL,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;KACxB,WAAW,CAAC,iDAAiD,CAAC;KAC9D,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;KAC/C,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;IAC7B,MAAM,MAAM,GAAG,sDAAsD,CAAC;IACtE,MAAM,SAAS,GAAG,wFAAwF,CAAC;IAC3G,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,eAAe;YAC1B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,EAAE,YAAY,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;SACjD,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,YAAY,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACxC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK;YAC1C,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM;SAC7C,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK;YAC1C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM;YAC5C,aAAa,EAAE,uCAAuC;YACtD,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,eAAe;YAC1B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,EAAE,YAAY,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;SACjD,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,YAAY,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,WAAW,CAAC,wCAAwC,CAAC;KACrD,QAAQ,CAAC,cAAc,EAAE,gCAAgC,CAAC;KAC1D,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,EAAE;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7G,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEL,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;KACjC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAE3D,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;KACpB,WAAW,CAAC,6DAA6D,CAAC;KAC1E,QAAQ,CAAC,cAAc,EAAE,gCAAgC,CAAC;KAC1D,MAAM,CAAC,sBAAsB,EAAE,0BAA0B,EAAE,IAAI,CAAC;KAChE,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAA4B,EAAE,EAAE;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAc,CAAC;IACrG,MAAM,MAAM,GAAG,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACxF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,eAAe,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEL,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;KACnC,WAAW,CAAC,mBAAmB,CAAC;KAChC,MAAM,CAAC,mBAAmB,EAAE,0CAA0C,EAAE,IAAI,CAAC;KAC7E,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;KAC/C,MAAM,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;KAClD,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;KAC/C,MAAM,CAAC,eAAe,EAAE,gBAAgB,CAAC;KACzC,MAAM,CAAC,aAAa,EAAE,gBAAgB,EAAE,IAAI,CAAC;KAC7C,MAAM,CAAC,KAAK,EAAE,OAA2G,EAAE,EAAE;IAC5H,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAOP;QACF,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;KAC7B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAClD,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAClD,IAAI,OAAO,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC;QAC9J,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;KACpB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,WAAW,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,qBAAqB,MAAM,CAAC,YAAY,cAAc,MAAM,IAAI,CAAC,CAAC;QACnI,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC;AAEL,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;KACnB,WAAW,CAAC,gDAAgD,CAAC;KAC7D,MAAM,CAAC,yBAAyB,EAAE,sBAAsB,EAAE,KAAK,CAAC;KAChE,MAAM,CAAC,KAAK,EAAE,OAA8B,EAAE,EAAE;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3H,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,kBAAkB,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEL,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;KACnC,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAErC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;KACnB,WAAW,CAAC,6BAA6B,CAAC;KAC1C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;QACtD,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QACzB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACjC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QACzB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,mBAAmB,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;KACtB,WAAW,CAAC,uCAAuC,CAAC;KACpD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IACpG,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC5C,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,OAAe,EAAE,KAAc;IACzE,IAAI,CAAC,KAAK,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,2BAA2B,EAC3B,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EAEd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIhE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,yDAAyD,CAAC;KACtE,OAAO,CAAC,eAAe,CAAC;KACxB,MAAM,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,eAAe,CAAC,CAAC;AAE3E,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,WAAW,CAAC,qEAAqE,CAAC;KAClF,MAAM,CAAC,SAAS,EAAE,0BAA0B,EAAE,KAAK,CAAC;KACpD,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,EAAE;IAC5C,6FAA6F;IAC7F,MAAM,cAAc,CAAC,eAAe,EAAE,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,cAAc,CAAC,uBAAuB,EAAE,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;AAC7F,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;KAC9B,WAAW,CAAC,4DAA4D,CAAC;KACzE,QAAQ,CAAC,cAAc,EAAE,gCAAgC,CAAC;KAC1D,MAAM,CAAC,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,CAAC;KAC5D,MAAM,CAAC,iBAAiB,EAAE,sCAAsC,CAAC;KACjE,MAAM,CAAC,wBAAwB,EAAE,0CAA0C,CAAC;KAC5E,MAAM,CAAC,oBAAoB,EAAE,+BAA+B,CAAC;KAC7D,MAAM,CAAC,WAAW,EAAE,sDAAsD,EAAE,KAAK,CAAC;KAClF,MAAM,CAAC,SAAS,EAAE,wCAAwC,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAOlC,EAAE,OAAgB,EAAE,EAAE;IACrB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,UAAU;QACV,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC;QACrD,gBAAgB,EAAE,OAAO,CAAC,YAAY;QACtC,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,iBAAiB,EAAE;KAC7B,CAAC,CAAC;IACH,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;AACrF,CAAC,CAAC,CAAC;AAEL,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;KAC3C,WAAW,CAAC,iCAAiC,CAAC,CAAC;AAElD,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;KACzB,WAAW,CAAC,qCAAqC,CAAC;KAClD,QAAQ,CAAC,QAAQ,EAAE,wCAAwC,CAAC;KAC5D,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,yBAAyB,CAAC;KAC7E,MAAM,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,kBAAkB,CAAC;KACxE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAA4C,EAAE,EAAE;IAC3E,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,KAAK,OAAO,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;IACtE,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;AACtG,CAAC,CAAC,CAAC;AAEL,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;KACxB,WAAW,CAAC,iDAAiD,CAAC;KAC9D,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;KAC/C,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;IAC7B,MAAM,MAAM,GAAG,sDAAsD,CAAC;IACtE,MAAM,SAAS,GAAG,wFAAwF,CAAC;IAC3G,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,eAAe;YAC1B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,EAAE,YAAY,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;SACjD,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,YAAY,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACxC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK;YAC1C,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM;SAC7C,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK;YAC1C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM;YAC5C,aAAa,EAAE,uCAAuC;YACtD,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,eAAe;YAC1B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,EAAE,YAAY,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK;SACjD,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,IAAI,YAAY,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,WAAW,CAAC,wCAAwC,CAAC;KACrD,QAAQ,CAAC,cAAc,EAAE,gCAAgC,CAAC;KAC1D,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,EAAE;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7G,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEL,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;KACjC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAE3D,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;KACpB,WAAW,CAAC,6DAA6D,CAAC;KAC1E,QAAQ,CAAC,cAAc,EAAE,gCAAgC,CAAC;KAC1D,MAAM,CAAC,sBAAsB,EAAE,0BAA0B,EAAE,IAAI,CAAC;KAChE,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAA4B,EAAE,EAAE;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAc,CAAC;IACrG,MAAM,MAAM,GAAG,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACxF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,eAAe,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEL,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;KACnC,WAAW,CAAC,mBAAmB,CAAC;KAChC,MAAM,CAAC,mBAAmB,EAAE,0CAA0C,EAAE,IAAI,CAAC;KAC7E,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;KAC/C,MAAM,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;KAClD,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;KAC/C,MAAM,CAAC,eAAe,EAAE,gBAAgB,CAAC;KACzC,MAAM,CAAC,aAAa,EAAE,gBAAgB,EAAE,IAAI,CAAC;KAC7C,MAAM,CAAC,KAAK,EAAE,OAA2G,EAAE,EAAE;IAC5H,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAOP;QACF,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;KAC7B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAClD,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAClD,IAAI,OAAO,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC;QAC9J,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;KACpB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,WAAW,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,qBAAqB,MAAM,CAAC,YAAY,cAAc,MAAM,IAAI,CAAC,CAAC;QACnI,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC;AAEL,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;KACnB,WAAW,CAAC,gDAAgD,CAAC;KAC7D,MAAM,CAAC,yBAAyB,EAAE,sBAAsB,EAAE,KAAK,CAAC;KAChE,MAAM,CAAC,KAAK,EAAE,OAA8B,EAAE,EAAE;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3H,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,kBAAkB,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEL,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;KACnC,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAErC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;KACnB,WAAW,CAAC,6BAA6B,CAAC;KAC1C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;QACtD,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QACzB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACjC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QACzB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,mBAAmB,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;KACtB,WAAW,CAAC,uCAAuC,CAAC;KACpD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAsB,CAAC,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IACpG,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC5C,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,OAAe,EAAE,KAAc;IACzE,IAAI,CAAC,KAAK,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/templates.d.ts

@@ -1,3 +1,3 @@
-export declare const DEFAULT_CONFIG = "stateDir: .palizade\npolicy: policies/default.yaml\nlockfile: palizade.lock\n\naudit:\n  jsonl: .palizade/audit.jsonl\n  sqlite: .palizade/audit.sqlite\n  captureRawPayloads: false\n\napprovals:\n  mode: localhost\n  timeoutMs: 30000\n  default: deny\n\ndetectors:\n  heuristic: true\n  promptGuard2:\n    enabled: false\n    model: sinatras/Llama-Prompt-Guard-2-86M-ONNX\n    cacheDir: .palizade/models\n    device: cpu\n\ntransport:\n  maxMessageBytes: 67108864\n  maxBufferedBytes: 67108864\n  allowBatches: false\n  allowContentLength: false\n\ntaint:\n  sqlite: .palizade/taint.sqlite\n  keyPath: .palizade/taint.key\n  scope: profile\n  profileId: default\n  ttlMs: 86400000\n  suspiciousScore: 0.35\n  fuzzyHammingMax: 7\n  temporal:\n    enabled: true\n    turns: 3\n    ttlMs: 300000\n    detectorScoreGte: 0.55\n\nservers:\n  toy:\n    command: node\n    args:\n      - examples/toy-mcp-server/server.mjs\n    trust: untrusted\n    toolClasses:\n      read_web: source\n      send_email: sink\n      echo: pure\n  filesystem:\n    command: node\n    args:\n      - node_modules/@modelcontextprotocol/server-filesystem/dist/index.js\n      - .\n    trust: semi\n    toolClasses:\n      read_file: source\n      read_text_file: source\n      read_media_file: source\n      read_multiple_files: source\n      list_directory: source\n      list_directory_with_sizes: source\n      directory_tree: source\n      search_files: source\n      get_file_info: source\n      list_allowed_directories: source\n      write_file: sink\n      edit_file: sink\n      create_directory: sink\n      move_file: sink\n";
-export declare const DEFAULT_POLICY = "version: 1\ndefaults:\n  action: allow\n  on_error: block\n\nrules:\n  - id: deny-server-sampling\n    name: Deny server-initiated model access\n    when:\n      direction: request\n      method: sampling/createMessage\n    action: block\n    reason: MCP server attempted to access the model through sampling.\n\n  - id: block-poisoned-tool-metadata\n    name: Block poisoned tool metadata\n    when:\n      direction: response\n      method: tools/list\n      detector_score_gte: 0.75\n    action: block\n    reason: Tool metadata looks like prompt injection or tool poisoning.\n\n  - id: block-untrusted-unknown-tool\n    name: Block unknown tools on untrusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: untrusted\n      tool_class: unknown\n    action: block\n    reason: Unknown tools on untrusted servers must be classified explicitly.\n\n  - id: approve-semi-unknown-tool\n    name: Require approval for unknown tools on semi-trusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: semi\n      tool_class: unknown\n    action: require_approval\n    reason: Unknown tools on semi-trusted servers require approval.\n\n  - id: log-trusted-unknown-tool\n    name: Audit unknown tools on trusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: trusted\n      tool_class: unknown\n    action: log_only\n    reason: Unknown tool on trusted server allowed with audit logging.\n\n  - id: log-unapproved-tool-metadata\n    name: Surface tool lock drift\n    when:\n      direction: response\n      method: tools/list\n      lock_status:\n        - missing\n        - new\n        - changed\n    action: log_only\n    reason: Tool metadata is not approved in palizade.lock.\n\n  - id: sanitize-suspicious-untrusted-output\n    name: Spotlight suspicious untrusted output\n    when:\n      direction: response\n      method: tools/call\n      trust: untrusted\n      detector_score_gte: 0.35\n    action: sanitize\n    reason: Untrusted tool output contains injection-like signals.\n\n  - id: sanitize-suspicious-resource-content\n    name: Spotlight suspicious resource content\n    when:\n      direction: response\n      method:\n        - resources/read\n        - prompts/get\n      detector_score_gte: 0.35\n    action: sanitize\n    reason: Resource or prompt content contains injection-like signals.\n\n  - id: block-tainted-sink\n    name: Block tainted content entering sinks\n    when:\n      direction: request\n      method: tools/call\n      tool_class: sink\n      taint: true\n    action: block\n    reason: Tainted content is flowing into a sink tool.\n\n  - id: block-tainted-egress-destination\n    name: Block tainted outbound destinations\n    when:\n      direction: request\n      method: tools/call\n      capabilities_any:\n        - network_egress\n        - sends_message\n      tainted_argument_role_any:\n        - url\n        - hostname\n        - email_recipient\n        - http_query\n    action: block\n    reason: Tainted content is being used as an outbound destination or query parameter.\n\n  - id: require-approval-temporal-taint-sink\n    name: Require approval during temporal taint\n    when:\n      direction: request\n      method: tools/call\n      tool_class: sink\n      temporal_taint: true\n    action: require_approval\n    reason: Recent suspicious untrusted content makes sink calls risky.\n";
+export declare const DEFAULT_CONFIG = "stateDir: .palizade\npolicy: policies/default.yaml\nlockfile: palizade.lock\n\naudit:\n  jsonl: .palizade/audit.jsonl\n  sqlite: .palizade/audit.sqlite\n  captureRawPayloads: false\n  errorVerbosity: true\n\napprovals:\n  mode: localhost\n  timeoutMs: 30000\n  default: deny\n\ndetectors:\n  heuristic: true\n  promptGuard2:\n    enabled: false\n    model: sinatras/Llama-Prompt-Guard-2-86M-ONNX\n    cacheDir: .palizade/models\n    device: cpu\n  secrets:\n    enabled: false\n  pii:\n    enabled: false\n\negress:\n  allowlist:\n    hosts: []\n    emails: []\n\ntransport:\n  maxMessageBytes: 67108864\n  maxBufferedBytes: 67108864\n  allowBatches: false\n  allowContentLength: false\n\ntaint:\n  sqlite: .palizade/taint.sqlite\n  keyPath: .palizade/taint.key\n  scope: profile\n  profileId: default\n  ttlMs: 86400000\n  suspiciousScore: 0.35\n  fuzzyHammingMax: 7\n  temporal:\n    enabled: true\n    turns: 3\n    ttlMs: 300000\n    detectorScoreGte: 0.55\n\nservers:\n  toy:\n    command: node\n    args:\n      - examples/toy-mcp-server/server.mjs\n    trust: untrusted\n    toolClasses:\n      read_web: source\n      send_email: sink\n      echo: pure\n    sensitive: false\n    sensitiveTools: {}\n    sensitivePathPatterns: []\n  filesystem:\n    command: node\n    args:\n      - node_modules/@modelcontextprotocol/server-filesystem/dist/index.js\n      - .\n    trust: semi\n    toolClasses:\n      read_file: source\n      read_text_file: source\n      read_media_file: source\n      read_multiple_files: source\n      list_directory: source\n      list_directory_with_sizes: source\n      directory_tree: source\n      search_files: source\n      get_file_info: source\n      list_allowed_directories: source\n      write_file: sink\n      edit_file: sink\n      create_directory: sink\n      move_file: sink\n    sensitive: false\n    sensitiveTools: {}\n    sensitivePathPatterns: []\n";
+export declare const DEFAULT_POLICY = "version: 1\ndefaults:\n  action: allow\n  on_error: block\n\nrules:\n  - id: deny-server-sampling\n    name: Deny server-initiated model access\n    when:\n      direction: request\n      method: sampling/createMessage\n    action: block\n    reason: MCP server attempted to access the model through sampling.\n\n  - id: block-poisoned-tool-metadata\n    name: Block poisoned tool metadata\n    when:\n      direction: response\n      method: tools/list\n      detector_score_gte: 0.75\n    action: block\n    reason: Tool metadata looks like prompt injection or tool poisoning.\n\n  - id: block-untrusted-unknown-tool\n    name: Block unknown tools on untrusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: untrusted\n      tool_class: unknown\n    action: block\n    reason: Unknown tools on untrusted servers must be classified explicitly.\n\n  - id: approve-semi-unknown-tool\n    name: Require approval for unknown tools on semi-trusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: semi\n      tool_class: unknown\n    action: require_approval\n    reason: Unknown tools on semi-trusted servers require approval.\n\n  - id: log-trusted-unknown-tool\n    name: Audit unknown tools on trusted servers\n    when:\n      direction: request\n      method: tools/call\n      trust: trusted\n      tool_class: unknown\n    action: log_only\n    reason: Unknown tool on trusted server allowed with audit logging.\n\n  - id: log-unapproved-tool-metadata\n    name: Surface tool lock drift\n    when:\n      direction: response\n      method: tools/list\n      lock_status:\n        - missing\n        - new\n        - changed\n    action: log_only\n    reason: Tool metadata is not approved in palizade.lock.\n\n  - id: sanitize-suspicious-untrusted-output\n    name: Spotlight suspicious untrusted output\n    when:\n      direction: response\n      method: tools/call\n      detector_score_gte: 0.35\n    action: sanitize\n    reason: Untrusted tool output contains injection-like signals.\n\n  - id: sanitize-suspicious-resource-content\n    name: Spotlight suspicious resource content\n    when:\n      direction: response\n      method:\n        - resources/read\n        - prompts/get\n      detector_score_gte: 0.35\n    action: sanitize\n    reason: Resource or prompt content contains injection-like signals.\n\n  - id: sanitize-strong-injection-any-trust\n    name: Spotlight strong injection signals regardless of trust\n    when:\n      direction: response\n      method: tools/call\n      detector_score_gte: 0.75\n    action: sanitize\n    reason: Strong injection signal in tool output.\n\n  - id: block-tainted-sink\n    name: Block tainted content entering sinks\n    when:\n      direction: request\n      method: tools/call\n      tool_class: sink\n      taint: true\n    action: block\n    reason: Tainted content is flowing into a sink tool.\n\n  - id: block-tainted-egress-destination\n    name: Block tainted outbound destinations\n    when:\n      direction: request\n      method: tools/call\n      capabilities_any:\n        - network_egress\n        - sends_message\n      tainted_argument_role_any:\n        - url\n        - hostname\n        - email_recipient\n        - http_query\n    action: block\n    reason: Tainted content is being used as an outbound destination or query parameter.\n\n  - id: require-approval-temporal-taint-sink\n    name: Require approval during temporal taint\n    when:\n      direction: request\n      method: tools/call\n      tool_class: sink\n      temporal_taint: true\n    action: require_approval\n    reason: Recent suspicious untrusted content makes sink calls risky.\n";
 //# sourceMappingURL=templates.d.ts.map

package/dist/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,6kDAyE1B,CAAC;AAEF,eAAO,MAAM,cAAc,k4GAyH1B,CAAC"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,m3DAyF1B,CAAC;AAEF,eAAO,MAAM,cAAc,soHAiI1B,CAAC"}

package/dist/templates.js

@@ -6,6 +6,7 @@ audit:
   jsonl: .palizade/audit.jsonl
   sqlite: .palizade/audit.sqlite
   captureRawPayloads: false
+  errorVerbosity: true
 
 approvals:
   mode: localhost
@@ -19,6 +20,15 @@ detectors:
     model: sinatras/Llama-Prompt-Guard-2-86M-ONNX
     cacheDir: .palizade/models
     device: cpu
+  secrets:
+    enabled: false
+  pii:
+    enabled: false
+
+egress:
+  allowlist:
+    hosts: []
+    emails: []
 
 transport:
   maxMessageBytes: 67108864
@@ -50,6 +60,9 @@ servers:
       read_web: source
       send_email: sink
       echo: pure
+    sensitive: false
+    sensitiveTools: {}
+    sensitivePathPatterns: []
   filesystem:
     command: node
     args:
@@ -71,6 +84,9 @@ servers:
       edit_file: sink
       create_directory: sink
       move_file: sink
+    sensitive: false
+    sensitiveTools: {}
+    sensitivePathPatterns: []
 `;
 export const DEFAULT_POLICY = `version: 1
 defaults:
@@ -142,7 +158,6 @@ rules:
     when:
       direction: response
       method: tools/call
-      trust: untrusted
       detector_score_gte: 0.35
     action: sanitize
     reason: Untrusted tool output contains injection-like signals.
@@ -158,6 +173,15 @@ rules:
     action: sanitize
     reason: Resource or prompt content contains injection-like signals.
 
+  - id: sanitize-strong-injection-any-trust
+    name: Spotlight strong injection signals regardless of trust
+    when:
+      direction: response
+      method: tools/call
+      detector_score_gte: 0.75
+    action: sanitize
+    reason: Strong injection signal in tool output.
+
   - id: block-tainted-sink
     name: Block tainted content entering sinks
     when:

package/dist/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyE7B,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyH7B,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyF7B,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiI7B,CAAC"}

package/package.json

@@ -1,56 +1,56 @@
-{
-  "name": "palizade",
-  "version": "0.1.2",
-  "description": "MCP-native prompt-injection firewall and security proxy.",
-  "license": "Apache-2.0",
-  "type": "module",
-  "bin": {
-    "palizade": "dist/index.cjs"
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "keywords": [
-    "mcp",
-    "security",
-    "prompt-injection",
-    "proxy",
-    "taint"
-  ],
-  "homepage": "https://github.com/hunar2006/palizade#readme",
-  "bugs": {
-    "url": "https://github.com/hunar2006/palizade/issues"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/hunar2006/palizade.git",
-    "directory": "packages/cli"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "main": "dist/index.cjs",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": "./dist/index.cjs"
-  },
-  "scripts": {
-    "build": "tsc -b && pnpm run bundle",
-    "bundle": "esbuild src/index.ts --bundle --platform=node --format=cjs --external:@huggingface/transformers --outfile=dist/index.cjs",
-    "test": "vitest run"
-  },
-  "dependencies": {
-    "@huggingface/transformers": "^4.2.0",
-    "commander": "^14.0.2",
-    "yaml": "^2.8.2"
-  },
-  "devDependencies": {
-    "@palizade/approvals": "workspace:*",
-    "@palizade/audit": "workspace:*",
-    "@palizade/core": "workspace:*",
-    "@palizade/detectors": "workspace:*",
-    "@palizade/policy": "workspace:*",
-    "@palizade/taint": "workspace:*"
-  }
-}
+{
+  "name": "palizade",
+  "version": "0.2.2",
+  "description": "MCP-native prompt-injection firewall and security proxy.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "bin": {
+    "palizade": "dist/index.cjs"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "keywords": [
+    "mcp",
+    "security",
+    "prompt-injection",
+    "proxy",
+    "taint"
+  ],
+  "homepage": "https://github.com/hunar2006/palizade#readme",
+  "bugs": {
+    "url": "https://github.com/hunar2006/palizade/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hunar2006/palizade.git",
+    "directory": "packages/cli"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "dist/index.cjs",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.cjs"
+  },
+  "scripts": {
+    "build": "tsc -b && pnpm run bundle",
+    "bundle": "node build.mjs",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@huggingface/transformers": "^4.2.0",
+    "commander": "^14.0.2",
+    "yaml": "^2.8.2"
+  },
+  "devDependencies": {
+    "@palizade/approvals": "workspace:*",
+    "@palizade/audit": "workspace:*",
+    "@palizade/core": "workspace:*",
+    "@palizade/detectors": "workspace:*",
+    "@palizade/policy": "workspace:*",
+    "@palizade/taint": "workspace:*"
+  }
+}