shield360 1.0.1 → 1.2.0

package/dist/rasp/model-output.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setModelOutputRecording = setModelOutputRecording;
+exports.modelOutputRecording = modelOutputRecording;
+exports.recordModelOutput = recordModelOutput;
+exports.recordToolArguments = recordToolArguments;
+exports.recordModelResponse = recordModelResponse;
+/**
+ * The hook point the SDK's LLM instrumentation calls with what a model
+ * returned (README "Sources of untrusted input", `source: "model_output"`).
+ * No patching happens here: the instrumentation already sees the response
+ * and hands the text over. A no-op unless RASP is on with `modelOutput`.
+ *
+ * Inside a request the fragments join the request's inputs. Outside one,
+ * the SDK starts a context for the rest of the current async continuation;
+ * a worker that acts on a model's answer gets reliable scoping by wrapping
+ * the job in `runInRaspScope(fn)`.
+ */
+const context_1 = require("./context");
+const normalize_1 = require("./normalize");
+let enabled = false;
+/** Set by the engine: whether model output is recorded at all. */
+function setModelOutputRecording(on) {
+    enabled = on;
+}
+function modelOutputRecording() {
+    return enabled;
+}
+function scope() {
+    let ctx = context_1.storage.getStore();
+    if (!ctx) {
+        ctx = (0, context_1.newContext)();
+        context_1.storage.enterWith(ctx);
+    }
+    return ctx;
+}
+/** Registers completion text a model returned as untrusted input. Never throws. */
+function recordModelOutput(text, key = 'model.completion') {
+    if (!enabled)
+        return;
+    try {
+        if (typeof text !== 'string' || !text)
+            return;
+        (0, normalize_1.addModelOutput)(scope().inputs, text, key);
+    }
+    catch {
+        // fail open
+    }
+}
+/** Registers tool-call arguments (a JSON string or an object) as untrusted input. Never throws. */
+function recordToolArguments(args, toolName) {
+    if (!enabled)
+        return;
+    try {
+        if (args == null || args === '')
+            return;
+        const name = typeof toolName === 'string' ? toolName.replace(/[^A-Za-z0-9_-]/g, '_').slice(0, 64) : '';
+        (0, normalize_1.addToolArguments)(scope().inputs, args, name ? `model.tool.${name}` : 'model.tool');
+    }
+    catch {
+        // fail open
+    }
+}
+/**
+ * Records a provider response the instrumentation already holds: OpenAI chat
+ * completions (`choices[].message`), OpenAI Responses (`output[]`), Anthropic
+ * messages (`content[]`). Text becomes completion fragments; tool-call
+ * arguments become `model.tool.<name>` inputs. Never throws.
+ */
+function recordModelResponse(result) {
+    if (!enabled || !result || typeof result !== 'object')
+        return;
+    try {
+        const r = result;
+        if (Array.isArray(r.choices)) {
+            for (const c of r.choices.slice(0, 8)) {
+                const m = c?.message;
+                if (typeof m?.content === 'string')
+                    recordModelOutput(m.content);
+                for (const t of Array.isArray(m?.tool_calls) ? m.tool_calls.slice(0, 32) : [])
+                    recordToolArguments(t?.function?.arguments, t?.function?.name);
+            }
+        }
+        if (Array.isArray(r.output)) {
+            for (const item of r.output.slice(0, 64)) {
+                if (item?.type === 'function_call')
+                    recordToolArguments(item.arguments, item.name);
+                for (const part of Array.isArray(item?.content) ? item.content : []) {
+                    if (typeof part?.text === 'string')
+                        recordModelOutput(part.text);
+                }
+            }
+        }
+        if (Array.isArray(r.content)) {
+            for (const block of r.content.slice(0, 64)) {
+                if (block?.type === 'text' && typeof block.text === 'string')
+                    recordModelOutput(block.text);
+                else if (block?.type === 'tool_use')
+                    recordToolArguments(block.input, block.name);
+            }
+        }
+    }
+    catch {
+        // fail open
+    }
+}
+//# sourceMappingURL=model-output.js.map

package/dist/rasp/model-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-output.js","sourceRoot":"","sources":["../../src/rasp/model-output.ts"],"names":[],"mappings":";;AAiBA,0DAEC;AAED,oDAEC;AAYD,8CAQC;AAGD,kDASC;AAQD,kDA4BC;AA3FD;;;;;;;;;;GAUG;AACH,uCAAkE;AAClE,2CAA+D;AAE/D,IAAI,OAAO,GAAG,KAAK,CAAC;AAEpB,kEAAkE;AAClE,SAAgB,uBAAuB,CAAC,EAAW;IACjD,OAAO,GAAG,EAAE,CAAC;AACf,CAAC;AAED,SAAgB,oBAAoB;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,KAAK;IACZ,IAAI,GAAG,GAAG,iBAAO,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,IAAA,oBAAU,GAAE,CAAC;QACnB,iBAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAgB,iBAAiB,CAAC,IAAa,EAAE,GAAG,GAAG,kBAAkB;IACvE,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC;QACH,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;YAAE,OAAO;QAC9C,IAAA,0BAAc,EAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAgB,mBAAmB,CAAC,IAAa,EAAE,QAAiB;IAClE,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC;QACH,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO;QACxC,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,IAAA,4BAAgB,EAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,MAAe;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO;IAC9D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAA6B,CAAC;QACxC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;gBACrB,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ;oBAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACjE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;oBAAE,mBAAmB,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAChJ,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBACzC,IAAI,IAAI,EAAE,IAAI,KAAK,eAAe;oBAAE,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACpE,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;wBAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC3C,IAAI,KAAK,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;qBACvF,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU;oBAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC"}

package/dist/rasp/normalize.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Input normalisation: percent-decoded forms, JSON flattening and model-output
+ * fragments (README "Sources of untrusted input" and "Implementation notes").
+ */
+import type { RaspInput } from './types';
+export declare const MAX_INPUTS = 256;
+export declare const MAX_VALUE = 4096;
+export declare const MAX_FRAGMENTS = 32;
+export declare const MAX_RAW_BODY: number;
+/** Lenient percent decoding: %XX to bytes, other % kept, UTF-8 with U+FFFD. */
+export declare function percentDecode(s: string): string;
+/** Adds an input, its decoded and double-decoded forms; caps count and length. */
+export declare function addInput(list: RaspInput[], value: unknown, key: string, source?: RaspInput['source']): void;
+/** Flattens string leaves of a parsed body (`body.a.b`, arrays by index). */
+export declare function flatten(list: RaspInput[], value: unknown, key: string, depth?: number): void;
+/** Splits model text into fragments: fenced code blocks, then lines. */
+export declare function modelFragments(text: string): string[];
+/** Adds model text as model_output fragments. */
+export declare function addModelOutput(list: RaspInput[], text: string, key?: string): void;
+/** Adds tool-call argument string leaves as model_output (`model.tool.<path>`). */
+export declare function addToolArguments(list: RaspInput[], args: unknown, path?: string): void;
+/** Parses a Cookie header into name/value pairs. */
+export declare function parseCookies(header: string | undefined): [string, string][];

package/dist/rasp/normalize.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RAW_BODY = exports.MAX_FRAGMENTS = exports.MAX_VALUE = exports.MAX_INPUTS = void 0;
+exports.percentDecode = percentDecode;
+exports.addInput = addInput;
+exports.flatten = flatten;
+exports.modelFragments = modelFragments;
+exports.addModelOutput = addModelOutput;
+exports.addToolArguments = addToolArguments;
+exports.parseCookies = parseCookies;
+exports.MAX_INPUTS = 256;
+exports.MAX_VALUE = 4096;
+exports.MAX_FRAGMENTS = 32;
+exports.MAX_RAW_BODY = 8 * 1024;
+const HEX = /^[0-9a-fA-F]{2}$/;
+/** Lenient percent decoding: %XX to bytes, other % kept, UTF-8 with U+FFFD. */
+function percentDecode(s) {
+    if (!s.includes('%'))
+        return s;
+    const bytes = [];
+    const enc = Buffer.from(s, 'utf8');
+    for (let i = 0; i < enc.length; i++) {
+        if (enc[i] === 0x25 && i + 2 < enc.length) {
+            const h = String.fromCharCode(enc[i + 1], enc[i + 2]);
+            if (HEX.test(h)) {
+                bytes.push(parseInt(h, 16));
+                i += 2;
+                continue;
+            }
+        }
+        bytes.push(enc[i]);
+    }
+    return Buffer.from(bytes).toString('utf8');
+}
+/** Adds an input, its decoded and double-decoded forms; caps count and length. */
+function addInput(list, value, key, source = 'request') {
+    if (typeof value !== 'string' || value === '' || list.length >= exports.MAX_INPUTS)
+        return;
+    const v = value.length > exports.MAX_VALUE ? value.slice(0, exports.MAX_VALUE) : value;
+    list.push({ value: v, key, source });
+    if (source !== 'request' || !v.includes('%'))
+        return;
+    const once = percentDecode(v);
+    if (once !== v && list.length < exports.MAX_INPUTS) {
+        list.push({ value: once, key, source });
+        const twice = percentDecode(once);
+        if (twice !== once && list.length < exports.MAX_INPUTS)
+            list.push({ value: twice, key, source });
+    }
+}
+/** Flattens string leaves of a parsed body (`body.a.b`, arrays by index). */
+function flatten(list, value, key, depth = 0) {
+    if (list.length >= exports.MAX_INPUTS || depth > 16 || value == null)
+        return;
+    if (typeof value === 'string')
+        return addInput(list, value, key);
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return;
+    if (Array.isArray(value)) {
+        value.forEach((v, i) => flatten(list, v, `${key}.${i}`, depth + 1));
+        return;
+    }
+    if (typeof value === 'object') {
+        if (Buffer.isBuffer(value))
+            return;
+        for (const [k, v] of Object.entries(value))
+            flatten(list, v, `${key}.${k}`, depth + 1);
+    }
+}
+/** Splits model text into fragments: fenced code blocks, then lines. */
+function modelFragments(text) {
+    const out = [];
+    const seen = new Set();
+    const push = (f) => {
+        const t = f.trim();
+        if (!t || seen.has(t) || out.length >= exports.MAX_FRAGMENTS)
+            return;
+        seen.add(t);
+        out.push(t.length > exports.MAX_VALUE ? t.slice(0, exports.MAX_VALUE) : t);
+    };
+    const lines = text.split('\n');
+    let block = null;
+    for (const line of lines) {
+        if (line.trim().startsWith('```')) {
+            if (block) {
+                push(block.join('\n'));
+                block = null;
+            }
+            else
+                block = [];
+            continue;
+        }
+        if (block)
+            block.push(line);
+    }
+    if (block)
+        push(block.join('\n'));
+    for (const line of lines)
+        if (!line.trim().startsWith('```'))
+            push(line);
+    return out;
+}
+/** Adds model text as model_output fragments. */
+function addModelOutput(list, text, key = 'model.completion') {
+    for (const f of modelFragments(text)) {
+        if (list.length >= exports.MAX_INPUTS)
+            return;
+        list.push({ value: f, key, source: 'model_output' });
+    }
+}
+/** Adds tool-call argument string leaves as model_output (`model.tool.<path>`). */
+function addToolArguments(list, args, path = 'model.tool') {
+    if (typeof args === 'string') {
+        try {
+            args = JSON.parse(args);
+        }
+        catch {
+            return addModelOutput(list, args, path);
+        }
+    }
+    const tmp = [];
+    flatten(tmp, args, path);
+    for (const i of tmp)
+        if (list.length < exports.MAX_INPUTS)
+            list.push({ value: i.value, key: i.key, source: 'model_output' });
+}
+/** Parses a Cookie header into name/value pairs. */
+function parseCookies(header) {
+    if (!header)
+        return [];
+    const out = [];
+    for (const part of header.split(';')) {
+        const i = part.indexOf('=');
+        if (i <= 0)
+            continue;
+        out.push([part.slice(0, i).trim(), part.slice(i + 1).trim()]);
+    }
+    return out;
+}
+//# sourceMappingURL=normalize.js.map

package/dist/rasp/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/rasp/normalize.ts"],"names":[],"mappings":";;;AAcA,sCAgBC;AAGD,4BAWC;AAGD,0BAYC;AAGD,wCAwBC;AAGD,wCAKC;AAGD,4CAWC;AAGD,oCASC;AAlHY,QAAA,UAAU,GAAG,GAAG,CAAC;AACjB,QAAA,SAAS,GAAG,IAAI,CAAC;AACjB,QAAA,aAAa,GAAG,EAAE,CAAC;AACnB,QAAA,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC;AAErC,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,+EAA+E;AAC/E,SAAgB,aAAa,CAAC,CAAS;IACrC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5B,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,kFAAkF;AAClF,SAAgB,QAAQ,CAAC,IAAiB,EAAE,KAAc,EAAE,GAAW,EAAE,SAA8B,SAAS;IAC9G,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,kBAAU;QAAE,OAAO;IACnF,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,iBAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvE,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO;IACrD,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAU,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAU;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAgB,OAAO,CAAC,IAAiB,EAAE,KAAc,EAAE,GAAW,EAAE,KAAK,GAAG,CAAC;IAC/E,IAAI,IAAI,CAAC,MAAM,IAAI,kBAAU,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACpH,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAgB,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,qBAAa;YAAE,OAAO;QAC7D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,iBAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAoB,IAAI,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvB,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;;gBAAM,KAAK,GAAG,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iDAAiD;AACjD,SAAgB,cAAc,CAAC,IAAiB,EAAE,IAAY,EAAE,GAAG,GAAG,kBAAkB;IACtF,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,IAAI,kBAAU;YAAE,OAAO;QACtC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAgB,gBAAgB,CAAC,IAAiB,EAAE,IAAa,EAAE,IAAI,GAAG,YAAY;IACpF,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,cAAc,CAAC,IAAI,EAAE,IAAc,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAU;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AACvH,CAAC;AAED,oDAAoD;AACpD,SAAgB,YAAY,CAAC,MAA0B;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/rasp/reporter.d.ts

@@ -0,0 +1,60 @@
+export declare const RASP_EVENT = "shield360.rasp.event";
+export declare const RASP_COMPONENT = "shield360.rasp.component";
+export declare const PER_MINUTE = 100;
+export declare const FOLD_MS = 10000;
+export declare const MAX_COMPONENTS = 500;
+export type RaspEvent = {
+    name: string;
+    time: string;
+    attrs: Record<string, string>;
+};
+export type ReporterOptions = {
+    url: string;
+    apiKey: string;
+    applicationName: string;
+    environment?: string;
+    sdkVersion?: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    retryDelayMs?: number;
+};
+export declare class RaspReporter {
+    private readonly o;
+    private queue;
+    private folds;
+    private windowStart;
+    private sentInWindow;
+    private timer?;
+    private readonly endpoint;
+    readonly resource: Record<string, string>;
+    private readonly now;
+    private sending;
+    constructor(o: ReporterOptions);
+    start(): void;
+    /**
+     * Queues an event, folding repeats of the same key. Returns whether it was queued now.
+     * An empty `foldKey` never folds: the event is queued or refused and nothing is kept,
+     * for callers that count repeats themselves (passive IAST).
+     */
+    add(event: RaspEvent, foldKey: string): boolean;
+    private enqueue;
+    private closeFolds;
+    /** Queued events (tests). */
+    pending(): RaspEvent[];
+    /** Sends what is queued; `force` also closes every open fold. Never rejects. */
+    flush(force?: boolean): Promise<void>;
+    /** Queues the components report: names and versions only, at most 500. */
+    reportComponents(components: Component[]): void;
+    stop(): Promise<void>;
+}
+export type Component = {
+    ecosystem: string;
+    name: string;
+    version: string;
+};
+/**
+ * The runtime, the app's declared dependencies (resolved from
+ * `<cwd>/node_modules`), and every npm package loaded through `require` so
+ * far. Names and versions only; at most 500.
+ */
+export declare function collectComponents(cache?: Record<string, unknown>, cwd?: string): Component[];

package/dist/rasp/reporter.js

@@ -0,0 +1,230 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RaspReporter = exports.MAX_COMPONENTS = exports.FOLD_MS = exports.PER_MINUTE = exports.RASP_COMPONENT = exports.RASP_EVENT = void 0;
+exports.collectComponents = collectComponents;
+/**
+ * RASP event reporter (README "Events"). Batches `shield360.rasp.event` and
+ * `shield360.rasp.component` records to `POST /api/guard/events` through the
+ * guard reporter's transport (guard/report.ts `postGuardEvents`), off the
+ * call path. At most 100 events a minute per process; repeats of the same
+ * (attack, rule, sink, route, decision) within 10 s fold into one more
+ * event carrying `shield360.rasp.count`. Events name locations, never values.
+ */
+const fs = __importStar(require("fs"));
+const os_1 = require("os");
+const path_1 = require("path");
+const report_1 = require("../guard/report");
+exports.RASP_EVENT = 'shield360.rasp.event';
+exports.RASP_COMPONENT = 'shield360.rasp.component';
+exports.PER_MINUTE = 100;
+exports.FOLD_MS = 10000;
+const FLUSH_MS = 2000;
+const MAX_QUEUED = 1000;
+exports.MAX_COMPONENTS = 500;
+const BATCH = 100;
+// Captured at load, before any later file-system hook.
+const readFile = fs.readFileSync.bind(fs);
+class RaspReporter {
+    constructor(o) {
+        this.o = o;
+        this.queue = [];
+        this.folds = new Map();
+        this.windowStart = -Infinity;
+        this.sentInWindow = 0;
+        this.sending = Promise.resolve();
+        this.endpoint = `${o.url.replace(/\/+$/, '')}/api/guard/events`;
+        this.now = o.now ?? Date.now;
+        this.resource = { 'service.name': o.applicationName };
+        const host = safeHost();
+        if (host)
+            this.resource['host.name'] = host;
+        if (o.environment)
+            this.resource['deployment.environment'] = o.environment;
+        if (o.sdkVersion)
+            this.resource['service.version'] = o.sdkVersion;
+    }
+    start() {
+        if (this.timer)
+            return;
+        this.timer = setInterval(() => void this.flush(), FLUSH_MS);
+        this.timer.unref?.();
+    }
+    /**
+     * Queues an event, folding repeats of the same key. Returns whether it was queued now.
+     * An empty `foldKey` never folds: the event is queued or refused and nothing is kept,
+     * for callers that count repeats themselves (passive IAST).
+     */
+    add(event, foldKey) {
+        const now = this.now();
+        this.closeFolds(now);
+        if (!foldKey)
+            return this.enqueue(event, now);
+        const f = this.folds.get(foldKey);
+        if (f && now < f.until) {
+            f.extra++;
+            return false;
+        }
+        this.folds.set(foldKey, { event, extra: 0, until: now + exports.FOLD_MS });
+        return this.enqueue(event, now);
+    }
+    enqueue(event, now) {
+        if (now - this.windowStart >= 60000) {
+            this.windowStart = now;
+            this.sentInWindow = 0;
+        }
+        if (this.sentInWindow >= exports.PER_MINUTE || this.queue.length >= MAX_QUEUED)
+            return false;
+        this.sentInWindow++;
+        this.queue.push(event);
+        return true;
+    }
+    closeFolds(now) {
+        for (const [k, f] of this.folds) {
+            if (now < f.until)
+                continue;
+            this.folds.delete(k);
+            if (f.extra > 0) {
+                const time = new Date(Number.isFinite(now) ? now : this.now()).toISOString();
+                this.enqueue({ ...f.event, time, attrs: { ...f.event.attrs, 'shield360.rasp.count': String(f.extra) } }, Number.isFinite(now) ? now : this.now());
+            }
+        }
+    }
+    /** Queued events (tests). */
+    pending() {
+        return [...this.queue];
+    }
+    /** Sends what is queued; `force` also closes every open fold. Never rejects. */
+    flush(force = false) {
+        this.sending = this.sending
+            .then(async () => {
+            this.closeFolds(force ? Infinity : this.now());
+            while (this.queue.length) {
+                await (0, report_1.postGuardEvents)(this.endpoint, this.o.apiKey, { resource: this.resource, events: this.queue.splice(0, BATCH) }, { label: 'runtime protection event', fetchImpl: this.o.fetchImpl, retryDelayMs: this.o.retryDelayMs });
+            }
+        })
+            .catch(() => undefined);
+        return this.sending;
+    }
+    /** Queues the components report: names and versions only, at most 500. */
+    reportComponents(components) {
+        const time = new Date(this.now()).toISOString();
+        for (const c of components.slice(0, exports.MAX_COMPONENTS)) {
+            if (this.queue.length >= MAX_QUEUED)
+                break;
+            this.queue.push({
+                name: exports.RASP_COMPONENT,
+                time,
+                attrs: {
+                    'shield360.rasp.app': this.o.applicationName,
+                    'shield360.rasp.component.ecosystem': c.ecosystem,
+                    'shield360.rasp.component.name': c.name,
+                    'shield360.rasp.component.version': c.version,
+                },
+            });
+        }
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = undefined;
+        return this.flush(true);
+    }
+}
+exports.RaspReporter = RaspReporter;
+function safeHost() {
+    try {
+        return (0, os_1.hostname)();
+    }
+    catch {
+        return '';
+    }
+}
+const PACKAGE = /^[A-Za-z0-9@_][A-Za-z0-9@/._+~-]{0,213}$/;
+const VERSION = /^v?[0-9A-Za-z][0-9A-Za-z.+_~-]{0,63}$/;
+function readPackage(dir) {
+    try {
+        return JSON.parse(readFile((0, path_1.join)(dir, 'package.json'), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The runtime, the app's declared dependencies (resolved from
+ * `<cwd>/node_modules`), and every npm package loaded through `require` so
+ * far. Names and versions only; at most 500.
+ */
+function collectComponents(cache = require.cache, cwd = process.cwd()) {
+    const out = [{ ecosystem: 'runtime', name: 'node', version: process.versions.node }];
+    const seen = new Set();
+    const push = (name, version) => {
+        if (typeof name !== 'string' || typeof version !== 'string' || !PACKAGE.test(name) || !VERSION.test(version))
+            return;
+        const id = `${name}@${version}`;
+        if (seen.has(id) || out.length >= exports.MAX_COMPONENTS)
+            return;
+        seen.add(id);
+        out.push({ ecosystem: 'npm', name, version });
+    };
+    const app = readPackage(cwd);
+    for (const name of Object.keys({ ...(app?.dependencies || {}), ...(app?.optionalDependencies || {}) })) {
+        const pkg = readPackage((0, path_1.join)(cwd, 'node_modules', ...name.split('/')));
+        if (pkg)
+            push(pkg.name, pkg.version);
+    }
+    const roots = new Set();
+    const marker = `${path_1.sep}node_modules${path_1.sep}`;
+    for (const file of Object.keys(cache)) {
+        if (out.length >= exports.MAX_COMPONENTS)
+            break;
+        const at = file.lastIndexOf(marker);
+        if (at < 0)
+            continue;
+        const rest = file.slice(at + marker.length).split(path_1.sep);
+        if (!rest[0])
+            continue;
+        const name = rest[0].startsWith('@') && rest[1] ? `${rest[0]}/${rest[1]}` : rest[0];
+        const root = (0, path_1.join)(file.slice(0, at + marker.length), ...name.split('/'));
+        if (roots.has(root))
+            continue;
+        roots.add(root);
+        const pkg = readPackage(root);
+        if (pkg)
+            push(pkg.name, pkg.version);
+    }
+    return out;
+}
+//# sourceMappingURL=reporter.js.map

package/dist/rasp/reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../src/rasp/reporter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoLA,8CAkCC;AAtND;;;;;;;GAOG;AACH,uCAAyB;AACzB,2BAA8B;AAC9B,+BAAiC;AACjC,4CAAkD;AAErC,QAAA,UAAU,GAAG,sBAAsB,CAAC;AACpC,QAAA,cAAc,GAAG,0BAA0B,CAAC;AAC5C,QAAA,UAAU,GAAG,GAAG,CAAC;AACjB,QAAA,OAAO,GAAG,KAAM,CAAC;AAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,UAAU,GAAG,IAAI,CAAC;AACX,QAAA,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,KAAK,GAAG,GAAG,CAAC;AAElB,uDAAuD;AACvD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAgB1C,MAAa,YAAY;IAWvB,YAA6B,CAAkB;QAAlB,MAAC,GAAD,CAAC,CAAiB;QAVvC,UAAK,GAAgB,EAAE,CAAC;QACxB,UAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;QAChC,gBAAW,GAAG,CAAC,QAAQ,CAAC;QACxB,iBAAY,GAAG,CAAC,CAAC;QAKjB,YAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QAGjD,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC;QAChE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;QAC5C,IAAI,CAAC,CAAC,WAAW;YAAE,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC;QAC3E,IAAI,CAAC,CAAC,UAAU;YAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;IACpE,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,KAAgB,EAAE,OAAe;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC,CAAC,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,GAAG,eAAO,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;IAEO,OAAO,CAAC,KAAgB,EAAE,GAAW;QAC3C,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,KAAM,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,IAAI,kBAAU,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,UAAU;YAAE,OAAO,KAAK,CAAC;QACrF,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK;gBAAE,SAAS;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC7E,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACpJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,OAAO;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,KAAK,GAAG,KAAK;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO;aACxB,IAAI,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,IAAA,wBAAe,EACnB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,CAAC,CAAC,MAAM,EACb,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAChE,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CACtG,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,0EAA0E;IAC1E,gBAAgB,CAAC,UAAuB;QACtC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAc,CAAC,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,UAAU;gBAAE,MAAM;YAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,sBAAc;gBACpB,IAAI;gBACJ,KAAK,EAAE;oBACL,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe;oBAC5C,oCAAoC,EAAE,CAAC,CAAC,SAAS;oBACjD,+BAA+B,EAAE,CAAC,CAAC,IAAI;oBACvC,kCAAkC,EAAE,CAAC,CAAC,OAAO;iBAC9C;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF;AAjHD,oCAiHC;AAED,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,OAAO,IAAA,aAAQ,GAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAID,MAAM,OAAO,GAAG,0CAA0C,CAAC;AAC3D,MAAM,OAAO,GAAG,uCAAuC,CAAC;AAExD,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwC,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,QAAiC,OAAO,CAAC,KAAgC,EACzE,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,GAAG,GAAgB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,OAAgB,EAAE,EAAE;QAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO;QACrH,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,sBAAc;YAAE,OAAO;QACzD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAoG,CAAC;IAChI,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACvG,MAAM,GAAG,GAAG,WAAW,CAAC,IAAA,WAAI,EAAC,GAAG,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,GAAG;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,MAAM,GAAG,GAAG,UAAG,eAAe,UAAG,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,IAAI,sBAAc;YAAE,MAAM;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,UAAG,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC9B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,GAAG;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}