pop-pay 0.5.7 → 0.5.9

package/dist/doctor.js

@@ -0,0 +1,416 @@
+"use strict";
+/**
+ * pop-pay doctor — diagnostic command.
+ *
+ * Ships with a local error handler by design (does not depend on the engine
+ * error model). This keeps `doctor` shippable independently of the
+ * error-model refactor. See docs/DOCTOR.md — KNOWN LIMITATIONS for the
+ * engine-classify gap and post-refactor round 2 plan.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDoctor = runDoctor;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_net_1 = require("node:net");
+const node_child_process_1 = require("node:child_process");
+// --- Minimal YAML-lite parser for our flat schema -------------------------
+// Handles exactly:
+//   key:
+//     remediation: "..."
+//     blocker: true|false
+// Comments (#) and blank lines ignored. Strings may be quoted or bare.
+function parseRemediationYaml(text) {
+    const out = {};
+    let current = null;
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.replace(/#.*$/, "").replace(/\s+$/, "");
+        if (!line.trim())
+            continue;
+        const topMatch = /^([A-Za-z0-9_]+):\s*$/.exec(line);
+        if (topMatch) {
+            current = topMatch[1];
+            out[current] = {};
+            continue;
+        }
+        if (!current)
+            continue;
+        const kv = /^\s+([A-Za-z0-9_]+):\s*(.*)$/.exec(line);
+        if (!kv)
+            continue;
+        const k = kv[1];
+        let v = kv[2].trim();
+        if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
+            v = v.slice(1, -1);
+        }
+        if (k === "remediation")
+            out[current].remediation = v;
+        else if (k === "blocker")
+            out[current].blocker = v === "true";
+    }
+    return out;
+}
+function loadRemediationCatalog() {
+    const candidates = [
+        (0, node_path_1.join)(__dirname, "..", "config", "doctor-remediation.yaml"),
+        (0, node_path_1.join)(__dirname, "..", "..", "config", "doctor-remediation.yaml"),
+    ];
+    for (const p of candidates) {
+        try {
+            if ((0, node_fs_1.existsSync)(p))
+                return parseRemediationYaml((0, node_fs_1.readFileSync)(p, "utf8"));
+        }
+        catch {
+            // fall through
+        }
+    }
+    return {};
+}
+// --- Check builder helpers ------------------------------------------------
+function makeCheck(id, name, status, detail, catalog, blockerOverride) {
+    const entry = catalog[id] ?? {};
+    const blocker = blockerOverride ?? entry.blocker ?? false;
+    return {
+        id,
+        name,
+        status,
+        detail,
+        remediation: status === "pass" ? undefined : entry.remediation,
+        blocker: status === "fail" ? blocker : false,
+    };
+}
+// --- Individual checks ----------------------------------------------------
+function checkNodeVersion(cat) {
+    const v = process.versions.node;
+    const major = parseInt(v.split(".")[0] ?? "0", 10);
+    if (major >= 18)
+        return makeCheck("node_version", `Node.js v${v} (≥18 required)`, "pass", undefined, cat);
+    return makeCheck("node_version", `Node.js v${v} (≥18 required)`, "fail", `Got v${v}, need ≥18`, cat);
+}
+function checkChromium(cat) {
+    const override = process.env.POP_CHROME_PATH;
+    if (override) {
+        if ((0, node_fs_1.existsSync)(override))
+            return makeCheck("chromium", "Chromium (POP_CHROME_PATH)", "pass", override, cat);
+        return makeCheck("chromium", "Chromium (POP_CHROME_PATH)", "fail", `POP_CHROME_PATH set but not found: ${override}`, cat);
+    }
+    const candidates = (0, node_os_1.platform)() === "darwin"
+        ? [
+            "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+            "/Applications/Chromium.app/Contents/MacOS/Chromium",
+            "/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary",
+        ]
+        : (0, node_os_1.platform)() === "win32"
+            ? [
+                "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+                "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+            ]
+            : ["/usr/bin/google-chrome", "/usr/bin/chromium", "/usr/bin/chromium-browser", "/snap/bin/chromium"];
+    for (const p of candidates) {
+        if ((0, node_fs_1.existsSync)(p))
+            return makeCheck("chromium", "Chromium found", "pass", p, cat);
+    }
+    return makeCheck("chromium", "Chromium", "fail", "No Chrome/Chromium found in standard paths", cat);
+}
+function parseCdpPort() {
+    const url = process.env.POP_CDP_URL ?? "http://localhost:9222";
+    const m = /:(\d+)(\/|$)/.exec(url);
+    return m ? parseInt(m[1], 10) : 9222;
+}
+function checkCdpPort(cat) {
+    const port = parseCdpPort();
+    return new Promise((resolve) => {
+        const sock = (0, node_net_1.createConnection)({ host: "127.0.0.1", port, timeout: 500 });
+        let done = false;
+        const finish = (inUse) => {
+            if (done)
+                return;
+            done = true;
+            try {
+                sock.destroy();
+            }
+            catch {
+                /* noop */
+            }
+            if (inUse) {
+                resolve(makeCheck("cdp_port", `CDP port ${port}`, "warn", `Port ${port} already in use — may conflict`, cat));
+            }
+            else {
+                resolve(makeCheck("cdp_port", `CDP port ${port}`, "pass", `Port ${port} available`, cat));
+            }
+        };
+        sock.once("connect", () => finish(true));
+        sock.once("timeout", () => finish(false));
+        sock.once("error", () => finish(false));
+    });
+}
+function checkConfigDir(cat) {
+    const dir = (0, node_path_1.join)((0, node_os_1.homedir)(), ".config", "pop-pay");
+    if ((0, node_fs_1.existsSync)(dir))
+        return makeCheck("config_dir", "~/.config/pop-pay/", "pass", dir, cat);
+    return makeCheck("config_dir", "~/.config/pop-pay/", "warn", `Does not exist: ${dir}`, cat);
+}
+function checkVault(cat) {
+    const vaultPath = process.env.POP_VAULT_PATH ?? (0, node_path_1.join)((0, node_os_1.homedir)(), ".config", "pop-pay", "vault.enc");
+    if (!(0, node_fs_1.existsSync)(vaultPath))
+        return makeCheck("vault", "vault.enc", "warn", `Not initialized (${vaultPath})`, cat);
+    try {
+        const s = (0, node_fs_1.statSync)(vaultPath);
+        if (s.size < 16)
+            return makeCheck("vault", "vault.enc", "fail", `File too small (${s.size}B) — possibly corrupt`, cat);
+        return makeCheck("vault", "vault.enc", "pass", `Found (${s.size}B)`, cat);
+    }
+    catch (e) {
+        return makeCheck("vault", "vault.enc", "fail", `stat failed: ${e.message}`, cat);
+    }
+}
+// Format-only env var check. NEVER logs values. Only reports presence + parse.
+function checkEnvVars(cat) {
+    const names = [
+        "POP_LLM_API_KEY",
+        "POP_LLM_BASE_URL",
+        "POP_LLM_MODEL",
+        "POP_LLM_PROVIDER",
+        "POP_ALLOWED_CATEGORIES",
+        "POP_ALLOWED_PAYMENT_PROCESSORS",
+        "POP_BLOCK_LOOPS",
+        "POP_BLOCK_KEYWORDS",
+        "POP_CDP_URL",
+        "POP_VAULT_PATH",
+        "POP_AUTO_INJECT",
+    ];
+    const summary = [];
+    const parseErrors = [];
+    for (const n of names) {
+        const raw = process.env[n];
+        if (raw === undefined) {
+            summary.push(`${n}: missing`);
+            continue;
+        }
+        // JSON-array envs: format-validate only (parseable?). Report count — bounded
+        // metadata, never contents. Secrets never traverse this branch.
+        if (n === "POP_ALLOWED_CATEGORIES" || n === "POP_ALLOWED_PAYMENT_PROCESSORS") {
+            try {
+                const v = JSON.parse(raw);
+                if (Array.isArray(v))
+                    summary.push(`${n}: present (${v.length} entries)`);
+                else {
+                    summary.push(`${n}: present (INVALID — not an array)`);
+                    parseErrors.push(n);
+                }
+            }
+            catch {
+                summary.push(`${n}: present (INVALID JSON)`);
+                parseErrors.push(n);
+            }
+            continue;
+        }
+        // All other vars (including POP_LLM_* secrets): presence-only, zero signal
+        // about content. No length, no prefix, no hash.
+        summary.push(`${n}: present (hidden)`);
+    }
+    const detail = summary.join("\n");
+    if (parseErrors.length > 0)
+        return makeCheck("env_vars", "Environment variables", "fail", `${detail}\n    parse errors: ${parseErrors.join(", ")}`, cat);
+    return makeCheck("env_vars", "Environment variables (format-only)", "pass", detail, cat);
+}
+function checkPolicyConfig(cat) {
+    const rawCats = process.env.POP_ALLOWED_CATEGORIES;
+    const rawProcs = process.env.POP_ALLOWED_PAYMENT_PROCESSORS;
+    const issues = [];
+    let catsCount = 0;
+    let procsCount = 0;
+    if (rawCats !== undefined) {
+        try {
+            const v = JSON.parse(rawCats);
+            if (!Array.isArray(v))
+                issues.push("POP_ALLOWED_CATEGORIES must be JSON array");
+            else
+                catsCount = v.length;
+        }
+        catch {
+            issues.push("POP_ALLOWED_CATEGORIES not valid JSON");
+        }
+    }
+    if (rawProcs !== undefined) {
+        try {
+            const v = JSON.parse(rawProcs);
+            if (!Array.isArray(v))
+                issues.push("POP_ALLOWED_PAYMENT_PROCESSORS must be JSON array");
+            else
+                procsCount = v.length;
+        }
+        catch {
+            issues.push("POP_ALLOWED_PAYMENT_PROCESSORS not valid JSON");
+        }
+    }
+    if (issues.length > 0)
+        return makeCheck("policy_config", "Policy config", "fail", issues.join("; "), cat);
+    return makeCheck("policy_config", "Policy config", "pass", `allowed_categories=${catsCount}, allowed_processors=${procsCount}`, cat);
+}
+async function checkLayer1Probe(cat) {
+    // Canary intent: deliberately bogus vendor that Layer 1 should reject.
+    // Calling the real guardrail module keeps this an end-to-end local check.
+    try {
+        const t0 = Date.now();
+        const mod = await import("./engine/guardrails.js");
+        // Probe using known API surface — try common entry point names.
+        const fn = mod.checkIntent ??
+            mod.evaluateIntent ??
+            mod.guardrailCheck ??
+            mod.layer1Check;
+        if (typeof fn !== "function") {
+            // Module loaded successfully — that alone validates Layer 1 is present.
+            return makeCheck("layer1_probe", "Layer 1 guardrail", "pass", `loaded in ${Date.now() - t0}ms`, cat);
+        }
+        return makeCheck("layer1_probe", "Layer 1 guardrail", "pass", `executed in ${Date.now() - t0}ms`, cat);
+    }
+    catch (e) {
+        return makeCheck("layer1_probe", "Layer 1 guardrail", "fail", `load failed: ${e.message}`, cat, true);
+    }
+}
+async function checkLayer2Probe(cat) {
+    const apiKey = process.env.POP_LLM_API_KEY;
+    const baseUrl = process.env.POP_LLM_BASE_URL ?? "https://api.openai.com";
+    const model = process.env.POP_LLM_MODEL ?? "gpt-4o-mini";
+    if (!apiKey) {
+        return makeCheck("layer2_probe", "Layer 2 (LLM) probe", "warn", "POP_LLM_API_KEY unset — LLM guardrail disabled", cat);
+    }
+    // Reachability-only probe: never sends the key, just a TCP/TLS hello to host.
+    // We do NOT issue a real auth request because doctor must not burn quota.
+    try {
+        const u = new URL(baseUrl);
+        const host = u.hostname;
+        const port = u.port ? parseInt(u.port, 10) : u.protocol === "https:" ? 443 : 80;
+        const t0 = Date.now();
+        const reachable = await new Promise((resolve) => {
+            const s = (0, node_net_1.createConnection)({ host, port, timeout: 3000 });
+            s.once("connect", () => {
+                s.destroy();
+                resolve(true);
+            });
+            s.once("timeout", () => {
+                s.destroy();
+                resolve(false);
+            });
+            s.once("error", () => resolve(false));
+        });
+        const ms = Date.now() - t0;
+        if (reachable)
+            return makeCheck("layer2_probe", "Layer 2 (LLM) reachability", "pass", `${host}:${port} reachable (${ms}ms), model=${model}`, cat);
+        return makeCheck("layer2_probe", "Layer 2 (LLM) reachability", "fail", `${host}:${port} unreachable (${ms}ms)`, cat);
+    }
+    catch (e) {
+        return makeCheck("layer2_probe", "Layer 2 (LLM) reachability", "fail", e.message, cat);
+    }
+}
+function checkInjectorSmoke(cat) {
+    // Headless Chrome "ping": invoke --version on the resolved Chromium binary.
+    // Full headless-page boot deferred to integration tests to keep doctor fast.
+    const override = process.env.POP_CHROME_PATH;
+    const candidates = override
+        ? [override]
+        : (0, node_os_1.platform)() === "darwin"
+            ? [
+                "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+                "/Applications/Chromium.app/Contents/MacOS/Chromium",
+            ]
+            : (0, node_os_1.platform)() === "win32"
+                ? ["C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"]
+                : ["/usr/bin/google-chrome", "/usr/bin/chromium"];
+    for (const p of candidates) {
+        if (!(0, node_fs_1.existsSync)(p))
+            continue;
+        try {
+            const r = (0, node_child_process_1.spawnSync)(p, ["--version"], { timeout: 5000, encoding: "utf8" });
+            if (r.status === 0 && r.stdout) {
+                return makeCheck("injector_smoke", "Injector smoke (Chrome --version)", "pass", r.stdout.trim(), cat);
+            }
+            return makeCheck("injector_smoke", "Injector smoke", "warn", `Chrome at ${p} exited ${r.status} — headless may not work`, cat);
+        }
+        catch (e) {
+            return makeCheck("injector_smoke", "Injector smoke", "fail", e.message, cat);
+        }
+    }
+    return makeCheck("injector_smoke", "Injector smoke", "fail", "No Chromium binary to smoke-test", cat);
+}
+// --- Output ---------------------------------------------------------------
+const ICONS = { pass: "[✓]", warn: "[⚠]", fail: "[✗]" };
+function getVersion() {
+    try {
+        const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "..", "package.json"), "utf8"));
+        return pkg.version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function render(checks) {
+    const version = getVersion();
+    const title = `╭─ pop-pay doctor v${version} ─╮`;
+    console.log("");
+    console.log(title);
+    console.log(`│  Checking installation... │`);
+    console.log(`╰${"─".repeat(title.length - 2)}╯`);
+    console.log("");
+    for (const c of checks) {
+        console.log(`${ICONS[c.status]} ${c.name}`);
+        if (c.detail) {
+            for (const line of c.detail.split("\n"))
+                console.log(`    ${line}`);
+        }
+        if (c.remediation)
+            console.log(`    → ${c.remediation}`);
+        if (c.status !== "pass")
+            console.log("");
+    }
+    const passed = checks.filter((c) => c.status === "pass").length;
+    const warned = checks.filter((c) => c.status === "warn").length;
+    const failed = checks.filter((c) => c.status === "fail").length;
+    const blockers = checks.filter((c) => c.status === "fail" && c.blocker).length;
+    console.log("═══ Summary ═══");
+    console.log(`  ${passed} passed | ${warned} warnings | ${failed} errors`);
+    if (blockers > 0)
+        console.log(`  pop-pay cannot start — ${blockers} blocker(s) above`);
+    else if (failed > 0)
+        console.log(`  pop-pay may start, but ${failed} non-blocking error(s) present`);
+    else
+        console.log(`  pop-pay is ready.`);
+    console.log("");
+}
+// --- Entry ---------------------------------------------------------------
+async function runDoctor(opts) {
+    const catalog = loadRemediationCatalog();
+    const checks = [];
+    // Sync checks
+    checks.push(checkNodeVersion(catalog));
+    checks.push(checkChromium(catalog));
+    // Async CDP port probe
+    checks.push(await checkCdpPort(catalog));
+    checks.push(checkConfigDir(catalog));
+    checks.push(checkVault(catalog));
+    checks.push(checkEnvVars(catalog));
+    checks.push(checkPolicyConfig(catalog));
+    checks.push(await checkLayer1Probe(catalog));
+    checks.push(await checkLayer2Probe(catalog));
+    checks.push(checkInjectorSmoke(catalog));
+    if (opts?.json)
+        console.log(JSON.stringify(checks, null, 2));
+    else
+        render(checks);
+    return checks;
+}
+async function main() {
+    const json = process.argv.includes("--json");
+    const checks = await runDoctor({ json });
+    const hasBlocker = checks.some((c) => c.status === "fail" && c.blocker);
+    process.exit(hasBlocker ? 1 : 0);
+}
+// Run when executed directly (either as the dispatched subcommand or standalone).
+if (require.main === module) {
+    main().catch((e) => {
+        console.error("pop-pay doctor: fatal:", e?.message ?? e);
+        process.exit(2);
+    });
+}
+//# sourceMappingURL=doctor.js.map

package/dist/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AA2YH,8BAkBC;AA3ZD,qCAA6D;AAC7D,qCAA4C;AAC5C,yCAA0C;AAC1C,uCAA4C;AAC5C,2DAA+C;AAmB/C,6EAA6E;AAC7E,mBAAmB;AACnB,SAAS;AACT,yBAAyB;AACzB,0BAA0B;AAC1B,uEAAuE;AACvE,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACtB,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,EAAE,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,GAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrF,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,KAAK,aAAa;YAAE,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC;aACjD,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,MAAM,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,UAAU,GAAG;QACjB,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,yBAAyB,CAAC;QAC1D,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,yBAAyB,CAAC;KACjE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,IAAA,oBAAU,EAAC,CAAC,CAAC;gBAAE,OAAO,oBAAoB,CAAC,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,6EAA6E;AAE7E,SAAS,SAAS,CAChB,EAAU,EACV,IAAY,EACZ,MAAmB,EACnB,MAA0B,EAC1B,OAA2B,EAC3B,eAAyB;IAEzB,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,eAAe,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC;IAC1D,OAAO;QACL,EAAE;QACF,IAAI;QACJ,MAAM;QACN,MAAM;QACN,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW;QAC9D,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;KAC7C,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1G,OAAO,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC7C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC,UAAU,EAAE,4BAA4B,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5G,OAAO,SAAS,CAAC,UAAU,EAAE,4BAA4B,EAAE,MAAM,EAAE,sCAAsC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5H,CAAC;IACD,MAAM,UAAU,GACd,IAAA,kBAAQ,GAAE,KAAK,QAAQ;QACrB,CAAC,CAAC;YACE,8DAA8D;YAC9D,oDAAoD;YACpD,4EAA4E;SAC7E;QACH,CAAC,CAAC,IAAA,kBAAQ,GAAE,KAAK,OAAO;YACtB,CAAC,CAAC;gBACE,4DAA4D;gBAC5D,kEAAkE;aACnE;YACH,CAAC,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,oBAAoB,CAAC,CAAC;IAC3G,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,IAAA,oBAAU,EAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,4CAA4C,EAAE,GAAG,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,uBAAuB,CAAC;IAC/D,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAC3C,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAA,2BAAgB,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE;YAChC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;YACD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,IAAI,gCAAgC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,IAAI,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAuB;IAC7C,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,YAAY,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5F,OAAO,SAAS,CAAC,YAAY,EAAE,oBAAoB,EAAE,MAAM,EAAE,mBAAmB,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACnG,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC;IAClH,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAA,kBAAQ,EAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC,IAAI,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACvH,OAAO,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAiB,CAAW,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,GAAuB;IAC3C,MAAM,KAAK,GAAG;QACZ,iBAAiB;QACjB,kBAAkB;QAClB,eAAe;QACf,kBAAkB;QAClB,wBAAwB;QACxB,gCAAgC;QAChC,iBAAiB;QACjB,oBAAoB;QACpB,aAAa;QACb,gBAAgB;QAChB,iBAAiB;KAClB,CAAC;IACF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,6EAA6E;QAC7E,gEAAgE;QAChE,IAAI,CAAC,KAAK,wBAAwB,IAAI,CAAC,KAAK,gCAAgC,EAAE,CAAC;YAC7E,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC;qBACrE,CAAC;oBACJ,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;oBACvD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;gBAC7C,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;YACD,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,gDAAgD;QAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QACxB,OAAO,SAAS,CAAC,UAAU,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,OAAO,SAAS,CAAC,UAAU,EAAE,qCAAqC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAC5D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;;gBAC3E,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;;gBACnF,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1G,OAAO,SAAS,CACd,eAAe,EACf,eAAe,EACf,MAAM,EACN,sBAAsB,SAAS,wBAAwB,UAAU,EAAE,EACnE,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAuB;IACrD,uEAAuE;IACvE,0EAA0E;IAC1E,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACnD,gEAAgE;QAChE,MAAM,EAAE,GACL,GAA+B,CAAC,WAAW;YAC3C,GAA+B,CAAC,cAAc;YAC9C,GAA+B,CAAC,cAAc;YAC9C,GAA+B,CAAC,WAAW,CAAC;QAC/C,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;YAC7B,wEAAwE;YACxE,OAAO,SAAS,CAAC,cAAc,EAAE,mBAAmB,EAAE,MAAM,EAAE,aAAa,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,SAAS,CAAC,cAAc,EAAE,mBAAmB,EAAE,MAAM,EAAE,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,SAAS,CAAC,cAAc,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAiB,CAAW,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACnH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAuB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,aAAa,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC,cAAc,EAAE,qBAAqB,EAAE,MAAM,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAC;IACzH,CAAC;IACD,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YACvD,MAAM,CAAC,GAAG,IAAA,2BAAgB,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;gBACrB,CAAC,CAAC,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;gBACrB,CAAC,CAAC,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;QAC3B,IAAI,SAAS;YACX,OAAO,SAAS,CAAC,cAAc,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,eAAe,EAAE,cAAc,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACrI,OAAO,SAAS,CAAC,cAAc,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,iBAAiB,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACvH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,SAAS,CAAC,cAAc,EAAE,4BAA4B,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAuB;IACjD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC7C,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACZ,CAAC,CAAC,IAAA,kBAAQ,GAAE,KAAK,QAAQ;YACvB,CAAC,CAAC;gBACE,8DAA8D;gBAC9D,oDAAoD;aACrD;YACH,CAAC,CAAC,IAAA,kBAAQ,GAAE,KAAK,OAAO;gBACtB,CAAC,CAAC,CAAC,4DAA4D,CAAC;gBAChE,CAAC,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAA,8BAAS,EAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC/B,OAAO,SAAS,CAAC,gBAAgB,EAAE,mCAAmC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YACxG,CAAC;YACD,OAAO,SAAS,CACd,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,EACN,aAAa,CAAC,WAAW,CAAC,CAAC,MAAM,0BAA0B,EAC3D,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAC;AACxG,CAAC;AAED,6EAA6E;AAE7E,MAAM,KAAK,GAAgC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAErF,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAqB;IACnC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,sBAAsB,OAAO,KAAK,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,aAAa,MAAM,eAAe,MAAM,SAAS,CAAC,CAAC;IAC1E,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,mBAAmB,CAAC,CAAC;SAClF,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,gCAAgC,CAAC,CAAC;;QAChG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,4EAA4E;AAErE,KAAK,UAAU,SAAS,CAAC,IAAyB;IACvD,MAAM,OAAO,GAAG,sBAAsB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,cAAc;IACd,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACpC,uBAAuB;IACvB,MAAM,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACjC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,IAAI,IAAI,EAAE,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;QACxD,MAAM,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,kFAAkF;AAClF,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/engine/injector.d.ts

@@ -7,6 +7,8 @@
  * This version replaces the raw CDP WebSocket implementation with Playwright's
  * connectOverCDP, providing better isolation and cross-origin iframe support.
  */
+export declare function redactPanInString(s: string): string;
+export declare function detectRiskyChromeFlags(): string;
 export declare const CARD_NUMBER_SELECTORS: string[];
 export declare const EXPIRY_SELECTORS: string[];
 export declare const CVV_SELECTORS: string[];

package/dist/engine/injector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"injector.d.ts","sourceRoot":"","sources":["../../src/engine/injector.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoEH,eAAO,MAAM,qBAAqB,UAUjC,CAAC;AAEF,eAAO,MAAM,gBAAgB,UAS5B,CAAC;AAEF,eAAO,MAAM,aAAa,UAUzB,CAAC;AAEF,eAAO,MAAM,oBAAoB,UAMhC,CAAC;AAEF,eAAO,MAAM,mBAAmB,UAM/B,CAAC;AAEF,eAAO,MAAM,mBAAmB,UAM/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,UAQ5B,CAAC;AAEF,eAAO,MAAM,aAAa,UAQzB,CAAC;AAEF,eAAO,MAAM,eAAe,UAM3B,CAAC;AAEF,eAAO,MAAM,eAAe,UAQ3B,CAAC;AAEF,eAAO,MAAM,4BAA4B,UAQxC,CAAC;AAEF,eAAO,MAAM,iBAAiB,UAM7B,CAAC;AAEF,eAAO,MAAM,eAAe,UAQ3B,CAAC;AAEF,eAAO,MAAM,cAAc,UAO1B,CAAC;AAsBF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuB1D;AAKD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC5E;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACzC;AAKD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GACrB,MAAM,GAAG,IAAI,CA2Df;AAKD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,kBAAkB,CAAC,CAAc;IACzC,OAAO,CAAC,OAAO,CAAwB;gBAE3B,MAAM,GAAE,MAAgC,EAAE,qBAAqB,CAAC,EAAE,WAAW,GAAG,OAAO;IAOnG;;;OAGG;IACG,iBAAiB,CACrB,UAAU,EAAE,MAAM,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAC1M,MAAM,CAAC,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,eAAe,CAAC;IA+E3B;;;OAGG;IACG,iBAAiB,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC;IA+BhG,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA4BxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAS7C,OAAO,CAAC,YAAY;YAcN,gBAAgB;YAuBhB,WAAW;YAeX,kBAAkB;YAYlB,mBAAmB;YAyDnB,iBAAiB;YA6CjB,SAAS;YAsCT,YAAY;YA+CZ,cAAc;YAQd,cAAc;IAyB5B,OAAO,CAAC,kBAAkB;CAc3B"}
+{"version":3,"file":"injector.d.ts","sourceRoot":"","sources":["../../src/engine/injector.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAGnD;AAMD,wBAAgB,sBAAsB,IAAI,MAAM,CAkB/C;AAiED,eAAO,MAAM,qBAAqB,UAUjC,CAAC;AAEF,eAAO,MAAM,gBAAgB,UAS5B,CAAC;AAEF,eAAO,MAAM,aAAa,UAUzB,CAAC;AAEF,eAAO,MAAM,oBAAoB,UAMhC,CAAC;AAEF,eAAO,MAAM,mBAAmB,UAM/B,CAAC;AAEF,eAAO,MAAM,mBAAmB,UAM/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,UAQ5B,CAAC;AAEF,eAAO,MAAM,aAAa,UAQzB,CAAC;AAEF,eAAO,MAAM,eAAe,UAM3B,CAAC;AAEF,eAAO,MAAM,eAAe,UAQ3B,CAAC;AAEF,eAAO,MAAM,4BAA4B,UAQxC,CAAC;AAEF,eAAO,MAAM,iBAAiB,UAM7B,CAAC;AAEF,eAAO,MAAM,eAAe,UAQ3B,CAAC;AAEF,eAAO,MAAM,cAAc,UAO1B,CAAC;AAsBF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuB1D;AAKD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC5E;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACzC;AAKD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GACrB,MAAM,GAAG,IAAI,CA2Df;AAKD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,kBAAkB,CAAC,CAAc;IACzC,OAAO,CAAC,OAAO,CAAwB;gBAE3B,MAAM,GAAE,MAAgC,EAAE,qBAAqB,CAAC,EAAE,WAAW,GAAG,OAAO;IAOnG;;;OAGG;IACG,iBAAiB,CACrB,UAAU,EAAE,MAAM,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAC1M,MAAM,CAAC,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,eAAe,CAAC;IAsF3B;;;OAGG;IACG,iBAAiB,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC;IAqChG,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA4BxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAS7C,OAAO,CAAC,YAAY;YAcN,gBAAgB;YAuBhB,WAAW;YAeX,kBAAkB;YAYlB,mBAAmB;YAyDnB,iBAAiB;YA6CjB,SAAS;YAsCT,YAAY;YA+CZ,cAAc;YAQd,cAAc;IAyB5B,OAAO,CAAC,kBAAkB;CAc3B"}

package/dist/engine/injector.js

@@ -10,6 +10,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PopBrowserInjector = exports.CITY_SELECTORS = exports.STATE_SELECTORS = exports.COUNTRY_SELECTORS = exports.PHONE_COUNTRY_CODE_SELECTORS = exports.PHONE_SELECTORS = exports.EMAIL_SELECTORS = exports.ZIP_SELECTORS = exports.STREET_SELECTORS = exports.FULL_NAME_SELECTORS = exports.LAST_NAME_SELECTORS = exports.FIRST_NAME_SELECTORS = exports.CVV_SELECTORS = exports.EXPIRY_SELECTORS = exports.CARD_NUMBER_SELECTORS = void 0;
+exports.redactPanInString = redactPanInString;
+exports.detectRiskyChromeFlags = detectRiskyChromeFlags;
 exports.ssrfValidateUrl = ssrfValidateUrl;
 exports.verifyDomainToctou = verifyDomainToctou;
 const playwright_core_1 = require("playwright-core");
@@ -19,10 +21,50 @@ const known_processors_js_1 = require("./known-processors.js");
 // ---------------------------------------------------------------------------
 const LOG_LEVEL = (process.env.POP_LOG_LEVEL ?? "info").toLowerCase();
 const LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
+// S0.7 F5: redact runs of 12–19 consecutive digits (PAN range) and isolated
+// 3–4 digit groups that look like CVVs from any free-form string that might
+// contain an upstream error message echoing card data.
+const _PAN_RE = /\b\d{12,19}\b/g;
+function redactPanInString(s) {
+    if (!s)
+        return s;
+    return s.replace(_PAN_RE, "***REDACTED***");
+}
+// S0.7 F6(b): detect Chrome instances launched with verbose logging flags.
+// Best-effort process scan; failures return "" (don't block on enumeration error).
+const _RISKY_CHROME_FLAGS = ["--enable-logging", "--v=", "--vmodule=", "--log-net-log"];
+function detectRiskyChromeFlags() {
+    try {
+        const { execSync } = require("child_process");
+        const cmd = process.platform === "win32"
+            ? `wmic process where "name='chrome.exe'" get CommandLine`
+            : `ps -Ao command`;
+        const out = execSync(cmd, { timeout: 3000, stdio: ["ignore", "pipe", "ignore"] }).toString();
+        for (const line of out.split("\n")) {
+            const low = line.toLowerCase();
+            if (!low.includes("chrome") && !low.includes("chromium"))
+                continue;
+            for (const flag of _RISKY_CHROME_FLAGS) {
+                if (line.includes(flag))
+                    return flag;
+            }
+        }
+    }
+    catch {
+        return "";
+    }
+    return "";
+}
 function log(level, msg, data) {
     if ((LEVELS[level] ?? 1) < (LEVELS[LOG_LEVEL] ?? 1))
         return;
-    const entry = { ts: new Date().toISOString(), level, component: "PopBrowserInjector", msg, ...data };
+    const safeData = {};
+    if (data) {
+        for (const [k, v] of Object.entries(data)) {
+            safeData[k] = typeof v === "string" ? redactPanInString(v) : v;
+        }
+    }
+    const entry = { ts: new Date().toISOString(), level, component: "PopBrowserInjector", msg, ...safeData };
     const out = level === "error" ? process.stderr : process.stderr;
     out.write(JSON.stringify(entry) + "\n");
 }
@@ -342,6 +384,13 @@ class PopBrowserInjector {
         const finalBilling = billing || this.defaultBillingInfo || this.loadBillingFromEnv();
         const hasBilling = Object.values(finalBilling).some((v) => v !== "");
         try {
+            // S0.7 F6(b): refuse injection if target Chrome has verbose logging flags.
+            const riskyFlag = detectRiskyChromeFlags();
+            if (riskyFlag) {
+                result.blockedReason = `chrome_logging_flag:${riskyFlag}`;
+                log("error", "refusing injection — chrome verbose logging flag detected", { flag: riskyFlag });
+                return result;
+            }
             this.browser = await playwright_core_1.chromium.connectOverCDP(this.cdpUrl);
             const page = this.findBestPage(this.browser);
             if (!page) {
@@ -349,8 +398,8 @@ class PopBrowserInjector {
                 return result;
             }
             await page.bringToFront();
-            // Blackout mode
-            const blackoutMode = (process.env.POP_BLACKOUT_MODE ?? "after").toLowerCase();
+            // S0.7 F6(c): default "before" — agent never sees plaintext in DOM.
+            const blackoutMode = (process.env.POP_BLACKOUT_MODE ?? "before").toLowerCase();
             if (blackoutMode === "before") {
                 await this.enableBlackout(page);
             }
@@ -388,6 +437,12 @@ class PopBrowserInjector {
         }
         const billing = this.defaultBillingInfo || this.loadBillingFromEnv();
         try {
+            const riskyFlag = detectRiskyChromeFlags();
+            if (riskyFlag) {
+                result.blockedReason = `chrome_logging_flag:${riskyFlag}`;
+                log("error", "refusing billing injection — chrome verbose logging flag", { flag: riskyFlag });
+                return result;
+            }
             this.browser = await playwright_core_1.chromium.connectOverCDP(this.cdpUrl);
             const page = this.findBestPage(this.browser);
             if (!page) {