shield360 1.1.0 → 1.2.1

package/dist/rasp/iast.js

@@ -0,0 +1,272 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.iastRouteOf = exports.IAST_DEFAULT_RATE_PRODUCTION = exports.IAST_DEFAULT_RATE = exports.IAST_MAX_FINGERPRINTS = exports.IAST_REPORT_EVERY_MS = exports.RASP_VULNERABILITY = void 0;
+exports.configureIast = configureIast;
+exports.setIastRemote = setIastRemote;
+exports.setIastSink = setIastSink;
+exports.iastEnabled = iastEnabled;
+exports.iastSampleRate = iastSampleRate;
+exports.beginIast = beginIast;
+exports.endIast = endIast;
+exports.vulnFingerprint = vulnFingerprint;
+exports.isAppFrame = isAppFrame;
+exports.codeLocation = codeLocation;
+exports.resetIast = resetIast;
+/**
+ * Passive IAST (README "Passive IAST"): while RASP checks its sinks during
+ * normal traffic, report the places where a request input reaches a sink
+ * verbatim and unparameterized, even when the value is harmless and no
+ * attack happened, so developers can fix "route X builds SQL from query.id"
+ * before anyone attacks it.
+ *
+ * Off by default; turned on by the signed config (`iast: "on"`), the local
+ * option (`rasp: { iast: true }`) or `SHIELD360_IAST=on`. Never blocks and
+ * does not depend on the attack modes. It adds work only to sink checks that
+ * already run with request input in scope, and only for sampled checks.
+ *
+ * Each vulnerability has a fingerprint (route, sink, input key, rule) and is
+ * reported at most once per process per hour, with how many times it was
+ * seen since the last report. Events name locations, never values, and carry
+ * no snippet: the code location (the app's own stack frame, captured once
+ * per fingerprint) replaces it.
+ */
+const crypto_1 = require("crypto");
+const path_1 = require("path");
+const context_1 = require("./context");
+const iast_scope_1 = require("./iast-scope");
+exports.RASP_VULNERABILITY = 'shield360.rasp.vulnerability';
+/** A fingerprint is reported at most once per this period per process. */
+exports.IAST_REPORT_EVERY_MS = 60 * 60 * 1000;
+/** Fingerprints remembered per process; the oldest is forgotten past this. */
+exports.IAST_MAX_FINGERPRINTS = 10000;
+exports.IAST_DEFAULT_RATE = 1;
+exports.IAST_DEFAULT_RATE_PRODUCTION = 0.1;
+const fresh = () => ({
+    env: undefined,
+    envRate: undefined,
+    local: undefined,
+    localRate: undefined,
+    remote: undefined,
+    remoteRate: undefined,
+    configVersion: 'local',
+    production: false,
+    app: 'default',
+    seen: new Map(),
+    now: Date.now,
+    random: Math.random,
+});
+let state = fresh();
+const PRODUCTION = /^prod(uction)?$/i;
+const asSetting = (v) => {
+    const s = typeof v === 'string' ? v.trim().toLowerCase() : typeof v === 'boolean' ? (v ? 'on' : 'off') : '';
+    return s === 'on' || s === 'off' ? s : undefined;
+};
+const asRate = (v) => {
+    const n = typeof v === 'string' && v.trim() !== '' ? Number(v) : v;
+    return typeof n === 'number' && Number.isFinite(n) && n >= 0 && n <= 1 ? n : undefined;
+};
+/** Reads the local option and the environment (`SHIELD360_IAST`, `SHIELD360_IAST_SAMPLE_RATE`). Forgets what was seen. */
+function configureIast(s) {
+    const env = s.env ?? process.env;
+    const o = s.option;
+    state = {
+        ...fresh(),
+        env: asSetting(env.SHIELD360_IAST),
+        envRate: asRate(env.SHIELD360_IAST_SAMPLE_RATE),
+        local: typeof o === 'boolean' ? o : o && typeof o === 'object' ? o.enabled !== false : undefined,
+        localRate: o && typeof o === 'object' ? asRate(o.sampleRate) : undefined,
+        production: [env.NODE_ENV, env.ENVIRONMENT, s.environment].some((v) => PRODUCTION.test((v || '').trim())),
+        app: s.applicationName || 'default',
+        now: s.now ?? Date.now,
+        random: s.random ?? Math.random,
+    };
+}
+/** The verified signed config's switch and rate (undefined drops them). */
+function setIastRemote(c) {
+    state.remote = asSetting(c?.iast);
+    state.remoteRate = asRate(c?.iastSampleRate);
+    state.configVersion = c?.version || 'local';
+}
+function setIastSink(sink) {
+    state.sink = sink;
+}
+/**
+ * Whether passive IAST is on. Order: `SHIELD360_IAST=off` wins; then the
+ * signed config's `iast`; then the local option or `SHIELD360_IAST=on`.
+ */
+function iastEnabled() {
+    if (state.env === 'off')
+        return false;
+    if (state.remote)
+        return state.remote === 'on';
+    return state.local === true || state.env === 'on';
+}
+/** The share of checks that run the IAST rules: env, then the signed config, then the option, then 1.0 (0.1 in production). */
+function iastSampleRate() {
+    return state.envRate ?? state.remoteRate ?? state.localRate ?? (state.production ? exports.IAST_DEFAULT_RATE_PRODUCTION : exports.IAST_DEFAULT_RATE);
+}
+/**
+ * Arms the IAST slot for one check, or returns null: off, not sampled, or
+ * no request input in scope. engine.check calls it only while RASP is active.
+ */
+function beginIast() {
+    try {
+        if (!iastEnabled())
+            return null;
+        const ctx = (0, context_1.currentContext)();
+        if (!ctx || (!ctx.inputs.length && !ctx.late))
+            return null;
+        const rate = iastSampleRate();
+        if (rate <= 0 || (rate < 1 && state.random() >= rate))
+            return null;
+        return (0, iast_scope_1.armIastSlot)();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Disarms the slot. With a sink (the check found no attack), reports the
+ * vulnerability its detectors noted, if any. Never throws.
+ */
+function endIast(slot, report) {
+    const vuln = (0, iast_scope_1.closeIastSlot)(slot);
+    if (!vuln || !report)
+        return;
+    try {
+        reportVulnerability(vuln, report.sink, report.extra ?? {});
+    }
+    catch {
+        // reporting never breaks the call
+    }
+}
+// Event attributes must pass the platform's shape checks (lib/security/rasp/vulnerabilities.ts); same shapes as engine.ts.
+const safeKey = (k) => k.replace(/[^A-Za-z0-9_.\-[\]]/g, '_').replace(/^[^A-Za-z0-9_]/, '_').slice(0, 128);
+const safeRoute = (r) => {
+    const s = r.replace(/[^\x21\x23-\x26\x28-\x3b\x3d\x3f-\x5b\x5d-\x7e]/g, '_').slice(0, 256);
+    return s.startsWith('/') ? s : '';
+};
+const safeMethod = (m) => (m && /^[A-Za-z]{3,10}$/.test(m) ? m.toUpperCase() : '');
+const SINK = /^[A-Za-z_][A-Za-z0-9_]*(?:[.:/][A-Za-z0-9_]+)*$/;
+/** The fingerprint: SHA-256 of route, sink, input key and rule (NUL-separated), first 32 hex. */
+function vulnFingerprint(route, sink, inputKey, rule) {
+    return (0, crypto_1.createHash)('sha256').update([route, sink, inputKey, rule].join('\u0000')).digest('hex').slice(0, 32);
+}
+function reportVulnerability(v, sink, extra) {
+    if (!SINK.test(sink) || sink.length > 64)
+        return;
+    const ctx = (0, context_1.currentContext)();
+    const path = extra.path ?? ctx?.path;
+    const template = extra.route ?? ctx?.route;
+    const route = safeRoute(template ?? (path ? (0, context_1.eventRouteOf)(path) : ''));
+    const inputKey = safeKey(v.input.key);
+    if (!inputKey)
+        return;
+    const fp = vulnFingerprint(route, sink, inputKey, v.rule);
+    const now = state.now();
+    let seen = state.seen.get(fp);
+    if (seen && now - seen.lastSent < exports.IAST_REPORT_EVERY_MS) {
+        seen.pending++;
+        return;
+    }
+    if (!seen) {
+        // First sight in this process: the one time the stack is read.
+        seen = { lastSent: -Infinity, pending: 0, location: codeLocation() };
+        if (state.seen.size >= exports.IAST_MAX_FINGERPRINTS) {
+            const oldest = state.seen.keys().next().value;
+            if (oldest !== undefined)
+                state.seen.delete(oldest);
+        }
+        state.seen.set(fp, seen);
+    }
+    const attrs = {
+        'shield360.rasp.kind': 'vulnerability',
+        'shield360.rasp.event_id': (0, crypto_1.randomBytes)(16).toString('hex'),
+        'shield360.rasp.app': state.app,
+        'shield360.rasp.rule': v.rule,
+        'shield360.rasp.sink': sink,
+        'shield360.rasp.source': 'request',
+        'shield360.rasp.input_key': inputKey,
+        'shield360.rasp.config_version': state.configVersion,
+        'shield360.rasp.language': 'node',
+        'shield360.rasp.vuln.fingerprint': fp,
+        'shield360.rasp.vuln.position': v.position,
+        'shield360.rasp.count': String(seen.pending + 1),
+    };
+    const opt = (k, value) => {
+        if (value)
+            attrs[k] = value;
+    };
+    opt('shield360.rasp.route', route);
+    opt('shield360.rasp.method', safeMethod(extra.method ?? ctx?.method));
+    opt('shield360.rasp.framework', extra.framework ?? ctx?.framework);
+    opt('shield360.rasp.vuln.location', seen.location);
+    const sinkTo = state.sink;
+    // Refused (rate limit, full queue) or nowhere to send: count it, and try again at the next sighting.
+    // No fold key: IAST dedupes and counts its own sightings, so a refused report must leave nothing
+    // in the reporter that could be sent later behind its back.
+    if (!sinkTo || sinkTo.add({ name: exports.RASP_VULNERABILITY, time: new Date(now).toISOString(), attrs }, '') === false) {
+        seen.pending++;
+        return;
+    }
+    seen.lastSent = now;
+    seen.pending = 0;
+}
+/** The route of a finding whose framework gave no template: the event route (README "Event route"). */
+exports.iastRouteOf = context_1.eventRouteOf;
+// The SDK's own files (src/ or dist/): frames there are not the app's. Its tests are.
+const SDK_ROOT = (0, path_1.resolve)(__dirname, '..');
+const FRAME_TAIL = /:(\d{1,7}):\d{1,7}$/;
+const LOCATION_CHARS = /[^A-Za-z0-9_./@+~-]/g;
+/** Whether a stack frame's file is the app's own code. */
+function isAppFrame(file) {
+    const f = file.replace(/\\/g, '/');
+    if (!f || f.startsWith('node:') || f.startsWith('internal/') || f.includes('/node_modules/'))
+        return false;
+    const root = SDK_ROOT.replace(/\\/g, '/');
+    if ((f === root || f.startsWith(root + '/')) && !f.includes('/__tests__/'))
+        return false;
+    return f.startsWith('/') || /^[A-Za-z]:\//.test(f);
+}
+/**
+ * The top stack frame in the app's own code (outside node_modules, Node's
+ * internals and the SDK), as `path:line` relative to the working directory
+ * (only the last three segments when outside it), or '' when there is none.
+ */
+function codeLocation(stack) {
+    let text = stack;
+    if (text === undefined) {
+        const limit = Error.stackTraceLimit;
+        try {
+            Error.stackTraceLimit = 64;
+            text = new Error().stack || '';
+        }
+        finally {
+            Error.stackTraceLimit = limit;
+        }
+    }
+    for (const raw of text.split('\n').slice(1)) {
+        let line = raw.trim();
+        if (!line.startsWith('at '))
+            continue;
+        line = line.slice(3);
+        const open = line.lastIndexOf('(');
+        if (open >= 0 && line.endsWith(')'))
+            line = line.slice(open + 1, -1);
+        const m = FRAME_TAIL.exec(line);
+        if (!m)
+            continue;
+        const file = line.slice(0, m.index).replace(/^file:\/\//, '');
+        if (!isAppFrame(file))
+            continue;
+        const rel = (0, path_1.relative)(process.cwd(), file);
+        const shown = rel && !rel.startsWith('..') && !rel.startsWith(path_1.sep) && !/^[A-Za-z]:/.test(rel) ? rel : file.split(/[\\/]/).slice(-3).join('/');
+        return `${shown.replace(/\\/g, '/').replace(LOCATION_CHARS, '_').slice(0, 240)}:${m[1]}`;
+    }
+    return '';
+}
+/** Forgets every fingerprint seen and the configuration (tests, re-init). */
+function resetIast() {
+    state = fresh();
+}
+//# sourceMappingURL=iast.js.map

package/dist/rasp/iast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iast.js","sourceRoot":"","sources":["../../src/rasp/iast.ts"],"names":[],"mappings":";;;AA+FA,sCAcC;AAGD,sCAIC;AAED,kCAEC;AAMD,kCAIC;AAGD,wCAEC;AAMD,8BAWC;AAQD,0BAQC;AAYD,0CAEC;AAoED,gCAMC;AAOD,oCA0BC;AAGD,8BAEC;AAtSD;;;;;;;;;;;;;;;;;GAiBG;AACH,mCAAiD;AACjD,+BAA8C;AAC9C,uCAAyD;AAIzD,6CAAyE;AAG5D,QAAA,kBAAkB,GAAG,8BAA8B,CAAC;AACjE,0EAA0E;AAC7D,QAAA,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnD,8EAA8E;AACjE,QAAA,qBAAqB,GAAG,KAAM,CAAC;AAC/B,QAAA,iBAAiB,GAAG,CAAC,CAAC;AACtB,QAAA,4BAA4B,GAAG,GAAG,CAAC;AAwBhD,MAAM,KAAK,GAAG,GAAU,EAAE,CAAC,CAAC;IAC1B,GAAG,EAAE,SAAS;IACd,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,SAAS;IAChB,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,SAAS;IACjB,UAAU,EAAE,SAAS;IACrB,aAAa,EAAE,OAAO;IACtB,UAAU,EAAE,KAAK;IACjB,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,IAAI,GAAG,EAAE;IACf,GAAG,EAAE,IAAI,CAAC,GAAG;IACb,MAAM,EAAE,IAAI,CAAC,MAAM;CACpB,CAAC,CAAC;AAEH,IAAI,KAAK,GAAU,KAAK,EAAE,CAAC;AAE3B,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,MAAM,SAAS,GAAG,CAAC,CAAU,EAA2B,EAAE;IACxD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5G,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC,CAAC;AACF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAsB,EAAE;IAChD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC,CAAC;AAYF,0HAA0H;AAC1H,SAAgB,aAAa,CAAC,CAAe;IAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACjC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,KAAK,GAAG;QACN,GAAG,KAAK,EAAE;QACV,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC;QAClC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAC/C,KAAK,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS;QAChG,SAAS,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACxE,UAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzG,GAAG,EAAE,CAAC,CAAC,eAAe,IAAI,SAAS;QACnC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;KAChC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,aAAa,CAAC,CAA6E;IACzG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAClC,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7C,KAAK,CAAC,aAAa,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,CAAC;AAC9C,CAAC;AAED,SAAgB,WAAW,CAAC,IAA+B;IACzD,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW;IACzB,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC;AACpD,CAAC;AAED,+HAA+H;AAC/H,SAAgB,cAAc;IAC5B,OAAO,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,oCAA4B,CAAC,CAAC,CAAC,yBAAiB,CAAC,CAAC;AACvI,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,IAAA,wBAAW,GAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAID;;;GAGG;AACH,SAAgB,OAAO,CAAC,IAAc,EAAE,MAA4C;IAClF,MAAM,IAAI,GAAG,IAAA,0BAAa,EAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO;IAC7B,IAAI,CAAC;QACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;AACH,CAAC;AAED,2HAA2H;AAC3H,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnH,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE;IAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3F,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpC,CAAC,CAAC;AACF,MAAM,UAAU,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvG,MAAM,IAAI,GAAG,iDAAiD,CAAC;AAE/D,iGAAiG;AACjG,SAAgB,eAAe,CAAC,KAAa,EAAE,IAAY,EAAE,QAAgB,EAAE,IAAY;IACzF,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAO,EAAE,IAAY,EAAE,KAAgB;IAClE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO;IACjD,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,EAAE,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,4BAAoB,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,+DAA+D;QAC/D,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC;QACrE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,6BAAqB,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAA2B;QACpC,qBAAqB,EAAE,eAAe;QACtC,yBAAyB,EAAE,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1D,oBAAoB,EAAE,KAAK,CAAC,GAAG;QAC/B,qBAAqB,EAAE,CAAC,CAAC,IAAI;QAC7B,qBAAqB,EAAE,IAAI;QAC3B,uBAAuB,EAAE,SAAS;QAClC,0BAA0B,EAAE,QAAQ;QACpC,+BAA+B,EAAE,KAAK,CAAC,aAAa;QACpD,yBAAyB,EAAE,MAAM;QACjC,iCAAiC,EAAE,EAAE;QACrC,8BAA8B,EAAE,CAAC,CAAC,QAAQ;QAC1C,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;KACjD,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,KAAyB,EAAE,EAAE;QACnD,IAAI,KAAK;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IAC9B,CAAC,CAAC;IACF,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACnC,GAAG,CAAC,uBAAuB,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC;IACnE,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;IAC1B,qGAAqG;IACrG,iGAAiG;IACjG,4DAA4D;IAC5D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,0BAAkB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;QAChH,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;IACpB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,uGAAuG;AAC1F,QAAA,WAAW,GAAG,sBAAY,CAAC;AAExC,sFAAsF;AACtF,MAAM,QAAQ,GAAG,IAAA,cAAO,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC1C,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,0DAA0D;AAC1D,SAAgB,UAAU,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3G,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,KAAc;IACzC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,CAAC,eAAe,GAAG,EAAE,CAAC;YAC3B,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC;QAChC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QACtC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,GAAG,GAAG,IAAA,eAAQ,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9I,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,SAAgB,SAAS;IACvB,KAAK,GAAG,KAAK,EAAE,CAAC;AAClB,CAAC"}

package/dist/rasp/index.d.ts

@@ -0,0 +1,52 @@
+import { type RaspClaims } from './config-client';
+import { applicationName, setMonitorOnly, type RemoteConfig } from './engine';
+import type { RaspOptions } from './types';
+export type RaspInitContext = {
+    applicationName: string;
+    environment?: string;
+    url?: string;
+    apiKey?: string;
+    sdkVersion?: string;
+    /** The OTLP endpoint the SDK exports to: always allowed outbound, like `url`. */
+    otlpEndpoint?: string;
+    env?: NodeJS.ProcessEnv;
+    fetchImpl?: typeof fetch;
+};
+/** The hosts of the Shield360 URL and the OTLP endpoint (README "SSRF": always allowed). */
+export declare function alwaysAllowedHosts(urls: (string | undefined)[]): string[];
+/**
+ * Whether trust on first use is allowed: the explicit opt-in
+ * (`allowUnpinnedConfig` or `SHIELD360_CONFIG_TOFU=dev`), never when
+ * `NODE_ENV` or `ENVIRONMENT` says production.
+ */
+export declare function tofuAllowed(option: boolean | undefined, env?: NodeJS.ProcessEnv): boolean;
+/** Tests only: lets the once-per-process warning fire again. */
+export declare function resetRaspWarnings(): void;
+export declare function toRemote(c: RaspClaims): RemoteConfig;
+/** Normalises `init({ rasp })`: true, false, or options (an object means on unless `enabled: false`). */
+export declare function resolveRaspOptions(option: boolean | RaspOptions | undefined, env?: NodeJS.ProcessEnv): RaspOptions & {
+    enabled: boolean;
+};
+/** Stops polling, reporting and the components timer, and removes the sink hooks (tests, re-init). */
+export declare function shutdownRasp(): Promise<void>;
+/**
+ * Turns RASP on (or leaves it off) for this process. Returns whether it is
+ * on. Never throws.
+ */
+export declare function initRasp(option: boolean | RaspOptions | undefined, ctx: RaspInitContext): boolean;
+/** The runtime kill switch: checks return immediately until `enableRasp()`. */
+export declare function disableRasp(): void;
+/** Undoes `disableRasp()`. The env switch and the signed config's kill switch still win. */
+export declare function enableRasp(): void;
+/** Whether RASP checks run right now (on, and no kill switch). */
+export declare function raspActive(): boolean;
+export { applicationName as raspApplicationName, setMonitorOnly };
+export { RaspBlockedError, RaspBlockedError as Shield360RaspBlocked, blockBody, BLOCK_MESSAGE, ATTACK_TYPES } from './types';
+export type { RaspOptions, RaspMode, AttackType, RaspInput, Finding, ConfigPublicKey } from './types';
+export type { RaspExpressOptions } from './middleware';
+export { raspExpress, raspExpressErrorHandler, raspFastify, raspKoa, raspHttp, withRasp, recordRequestBody, isRaspBlocked, sendBlocked, blockedResponse } from './middleware';
+export { recordModelOutput, recordToolArguments } from './model-output';
+export { runInRaspScope, currentContext as currentRaspContext, inputsOf } from './context';
+export { check as raspCheck } from './engine';
+export { compileRuleExpr, evaluateRuleExpr, RULE_EXPR_LIMITS, RULE_FIELDS } from './rule-expr';
+export type { RuleSubject, RuleExprErrorCode } from './rule-expr';

package/dist/rasp/index.js

@@ -0,0 +1,280 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RULE_FIELDS = exports.RULE_EXPR_LIMITS = exports.evaluateRuleExpr = exports.compileRuleExpr = exports.raspCheck = exports.inputsOf = exports.currentRaspContext = exports.runInRaspScope = exports.recordToolArguments = exports.recordModelOutput = exports.blockedResponse = exports.sendBlocked = exports.isRaspBlocked = exports.recordRequestBody = exports.withRasp = exports.raspHttp = exports.raspKoa = exports.raspFastify = exports.raspExpressErrorHandler = exports.raspExpress = exports.ATTACK_TYPES = exports.BLOCK_MESSAGE = exports.blockBody = exports.Shield360RaspBlocked = exports.RaspBlockedError = exports.setMonitorOnly = exports.raspApplicationName = void 0;
+exports.alwaysAllowedHosts = alwaysAllowedHosts;
+exports.tofuAllowed = tofuAllowed;
+exports.resetRaspWarnings = resetRaspWarnings;
+exports.toRemote = toRemote;
+exports.resolveRaspOptions = resolveRaspOptions;
+exports.shutdownRasp = shutdownRasp;
+exports.initRasp = initRasp;
+exports.disableRasp = disableRasp;
+exports.enableRasp = enableRasp;
+exports.raspActive = raspActive;
+/**
+ * Shield360 runtime application self-protection (RASP), opt-in.
+ *
+ *   Shield360.init({ rasp: { enabled: true, configPublicKey: process.env.SHIELD360_CONFIG_PUBLIC_KEY } });
+ *   app.use(raspExpress());
+ *
+ * or `SHIELD360_RASP=monitor|block`. `SHIELD360_RASP=off` always wins.
+ * sdk/rasp/README.md is the contract. Fail open everywhere: the only error
+ * RASP raises on purpose is `RaspBlockedError`, which the middleware turns
+ * into a 403.
+ *
+ * This part covers request capture, model output as input, the detection
+ * engine, virtual patches, the signed config, events, and the sink hooks:
+ * child_process, fs, outbound HTTP, database drivers, and code,
+ * deserialization, XML and HTML responses; and sink rules, which point those
+ * checks at further library functions from data (built in, or the signed
+ * config).
+ */
+const os_1 = require("os");
+const path_1 = require("path");
+const baseline_1 = require("./baseline");
+const deception_1 = require("./deception");
+const config_client_1 = require("./config-client");
+const engine_1 = require("./engine");
+Object.defineProperty(exports, "raspApplicationName", { enumerable: true, get: function () { return engine_1.applicationName; } });
+Object.defineProperty(exports, "setMonitorOnly", { enumerable: true, get: function () { return engine_1.setMonitorOnly; } });
+const code_1 = require("./hooks/code");
+const db_1 = require("./hooks/db");
+const fs_1 = require("./hooks/fs");
+const http_1 = require("./hooks/http");
+const include_1 = require("./hooks/include");
+const process_1 = require("./hooks/process");
+const sinks_1 = require("./hooks/sinks");
+const iast_1 = require("./iast");
+const reporter_1 = require("./reporter");
+const COMPONENTS_EVERY_MS = 24 * 60 * 60 * 1000;
+/** The hosts of the Shield360 URL and the OTLP endpoint (README "SSRF": always allowed). */
+function alwaysAllowedHosts(urls) {
+    const hosts = new Set();
+    for (const u of urls) {
+        try {
+            if (u)
+                hosts.add(new URL(u).hostname.toLowerCase().replace(/^\[|\]$/g, ''));
+        }
+        catch {
+            // not a URL: nothing to allow
+        }
+    }
+    return [...hosts];
+}
+const PRODUCTION = /^prod(uction)?$/i;
+/**
+ * Whether trust on first use is allowed: the explicit opt-in
+ * (`allowUnpinnedConfig` or `SHIELD360_CONFIG_TOFU=dev`), never when
+ * `NODE_ENV` or `ENVIRONMENT` says production.
+ */
+function tofuAllowed(option, env = process.env) {
+    const asked = option === true || (env.SHIELD360_CONFIG_TOFU || '').trim().toLowerCase() === 'dev';
+    if (!asked)
+        return false;
+    return ![env.NODE_ENV, env.ENVIRONMENT].some((v) => PRODUCTION.test((v || '').trim()));
+}
+let warnedUnpinned = false;
+/** One log line per process when the config key is not pinned (not a reported event). */
+function warnUnpinnedOnce() {
+    if (warnedUnpinned)
+        return;
+    warnedUnpinned = true;
+    console.warn("Shield360 RASP: the signed config key is not pinned, so the signed config is not used and RASP runs its built-in defaults in monitor mode. Set configPublicKey (or SHIELD360_CONFIG_PUBLIC_KEY) to the environment's public key from the app's Runtime protection settings in Shield360.");
+}
+/** Tests only: lets the once-per-process warning fire again. */
+function resetRaspWarnings() {
+    warnedUnpinned = false;
+}
+let runtime = {};
+function toRemote(c) {
+    return {
+        version: c.version,
+        exp: c.exp,
+        killSwitch: c.killSwitch === true,
+        snippets: c.snippets === true,
+        reportTargets: c.reportTargets === true,
+        mode: c.mode,
+        attacks: c.attacks && typeof c.attacks === 'object' ? c.attacks : {},
+        allow: c.allow && typeof c.allow === 'object' ? c.allow : undefined,
+        rules: Array.isArray(c.rules) ? c.rules : null,
+        sinks: Array.isArray(c.sinks) ? c.sinks : null,
+        customRules: Array.isArray(c.customRules) ? c.customRules : null,
+        deception: (0, deception_1.parseDeception)(c.deception),
+    };
+}
+/** Normalises `init({ rasp })`: true, false, or options (an object means on unless `enabled: false`). */
+function resolveRaspOptions(option, env = process.env) {
+    const e = (0, engine_1.envSetting)(env);
+    const o = typeof option === 'object' && option !== null ? option : {};
+    let enabled = option === true || (typeof option === 'object' && option !== null && option.enabled !== false);
+    if (option === undefined && (e === 'monitor' || e === 'block'))
+        enabled = true;
+    if (e === 'off')
+        enabled = false;
+    return { ...o, enabled };
+}
+/** Stops polling, reporting and the components timer, and removes the sink hooks (tests, re-init). */
+async function shutdownRasp() {
+    const r = runtime;
+    runtime = {};
+    (0, process_1.uninstallProcessHooks)();
+    (0, fs_1.uninstallFsHooks)();
+    (0, http_1.uninstallHttpHooks)();
+    (0, db_1.uninstallDbHooks)();
+    (0, code_1.uninstallCodeHooks)();
+    (0, sinks_1.uninstallSinkHooks)();
+    (0, include_1.uninstallIncludeHooks)();
+    r.client?.stop();
+    if (r.componentsTimer)
+        clearInterval(r.componentsTimer);
+    (0, engine_1.setEventSink)(undefined);
+    (0, iast_1.setIastSink)(undefined);
+    await r.reporter?.stop();
+}
+/**
+ * Turns RASP on (or leaves it off) for this process. Returns whether it is
+ * on. Never throws.
+ */
+function initRasp(option, ctx) {
+    try {
+        void shutdownRasp();
+        const env = ctx.env ?? process.env;
+        const o = resolveRaspOptions(option, env);
+        const remoteWanted = o.enabled && o.remote !== false && Boolean(ctx.url && ctx.apiKey);
+        const pinned = (0, config_client_1.parsePublicKeys)(o.configPublicKey ?? env.SHIELD360_CONFIG_PUBLIC_KEY);
+        const tofu = !pinned.length && tofuAllowed(o.allowUnpinnedConfig, env);
+        const unpinned = remoteWanted && !pinned.length && !tofu;
+        (0, engine_1.configureEngine)({
+            enabled: o.enabled,
+            applicationName: ctx.applicationName,
+            mode: o.mode,
+            attacks: o.attacks,
+            allow: o.allow,
+            modelOutput: o.modelOutput,
+            // No pinned key while a remote config was expected: built-in defaults, monitor only.
+            monitorOnly: unpinned,
+            env,
+        });
+        (0, iast_1.configureIast)({ option: o.iast, applicationName: ctx.applicationName, environment: ctx.environment, env });
+        if (!o.enabled)
+            return false;
+        (0, process_1.installProcessHooks)();
+        (0, fs_1.installFsHooks)();
+        (0, http_1.installHttpHooks)({ alwaysAllowedHosts: alwaysAllowedHosts([ctx.url, ctx.otlpEndpoint]) });
+        (0, db_1.installDbHooks)();
+        (0, code_1.installCodeHooks)();
+        (0, sinks_1.installSinkHooks)();
+        (0, include_1.installIncludeHooks)();
+        let reporter;
+        if (ctx.url && ctx.apiKey) {
+            reporter = new reporter_1.RaspReporter({
+                url: ctx.url,
+                apiKey: ctx.apiKey,
+                applicationName: ctx.applicationName,
+                environment: ctx.environment,
+                sdkVersion: ctx.sdkVersion,
+                fetchImpl: ctx.fetchImpl,
+            });
+            reporter.start();
+            (0, engine_1.setEventSink)(reporter);
+            (0, iast_1.setIastSink)(reporter);
+            runtime.reporter = reporter;
+            if (o.components !== false) {
+                const report = () => {
+                    try {
+                        reporter?.reportComponents((0, reporter_1.collectComponents)());
+                    }
+                    catch {
+                        // never
+                    }
+                };
+                setImmediate(report).unref?.();
+                runtime.componentsTimer = setInterval(report, COMPONENTS_EVERY_MS);
+                runtime.componentsTimer.unref?.();
+            }
+        }
+        // Logged, once per reason (the client dedupes); trust on first use was already announced at start.
+        const warn = (reason) => {
+            if (reason === 'trust_on_first_use')
+                return;
+            console.warn(`Shield360 RASP: a signed config was refused (${reason}); the last verified config or the local options stay in force.`);
+        };
+        if (unpinned) {
+            warnUnpinnedOnce();
+        }
+        else if (remoteWanted) {
+            if (tofu)
+                console.warn('Shield360 RASP: trust on first use is on for the signed config (development only); set configPublicKey before production.');
+            const client = new config_client_1.RaspConfigClient({
+                url: ctx.url,
+                apiKey: ctx.apiKey,
+                app: ctx.applicationName,
+                pinned,
+                allowUnpinned: tofu,
+                cacheDir: o.cacheDir || (0, path_1.join)((0, os_1.tmpdir)(), 'shield360-rasp'),
+                onConfig: (claims) => {
+                    const remote = claims ? toRemote(claims) : undefined;
+                    (0, engine_1.setRemoteConfig)(remote);
+                    (0, iast_1.setIastRemote)(claims ? { iast: claims.iast, iastSampleRate: claims.iastSampleRate, version: claims.version } : undefined);
+                    // The platform's sink rules replace the built-in list when present.
+                    (0, sinks_1.setSinkRules)(remote?.sinks ? (0, sinks_1.parseSinkRules)(remote.sinks) : sinks_1.BUILT_IN_SINKS);
+                },
+                onWarning: warn,
+                fetchImpl: ctx.fetchImpl,
+            });
+            runtime.client = client;
+            client.start();
+        }
+        // Off the start-up path, once the reporter is in place.
+        setImmediate(() => (0, baseline_1.runBaseline)({ environment: ctx.environment, remoteWanted, pinned: pinned.length > 0, env })).unref?.();
+        return true;
+    }
+    catch (e) {
+        console.warn(`Shield360 RASP could not start: ${e instanceof Error ? e.name : 'error'}`);
+        return false;
+    }
+}
+/** The runtime kill switch: checks return immediately until `enableRasp()`. */
+function disableRasp() {
+    (0, engine_1.setRuntimeDisabled)(true);
+}
+/** Undoes `disableRasp()`. The env switch and the signed config's kill switch still win. */
+function enableRasp() {
+    (0, engine_1.setRuntimeDisabled)(false);
+}
+/** Whether RASP checks run right now (on, and no kill switch). */
+function raspActive() {
+    return (0, engine_1.isActive)();
+}
+var types_1 = require("./types");
+Object.defineProperty(exports, "RaspBlockedError", { enumerable: true, get: function () { return types_1.RaspBlockedError; } });
+Object.defineProperty(exports, "Shield360RaspBlocked", { enumerable: true, get: function () { return types_1.RaspBlockedError; } });
+Object.defineProperty(exports, "blockBody", { enumerable: true, get: function () { return types_1.blockBody; } });
+Object.defineProperty(exports, "BLOCK_MESSAGE", { enumerable: true, get: function () { return types_1.BLOCK_MESSAGE; } });
+Object.defineProperty(exports, "ATTACK_TYPES", { enumerable: true, get: function () { return types_1.ATTACK_TYPES; } });
+var middleware_1 = require("./middleware");
+Object.defineProperty(exports, "raspExpress", { enumerable: true, get: function () { return middleware_1.raspExpress; } });
+Object.defineProperty(exports, "raspExpressErrorHandler", { enumerable: true, get: function () { return middleware_1.raspExpressErrorHandler; } });
+Object.defineProperty(exports, "raspFastify", { enumerable: true, get: function () { return middleware_1.raspFastify; } });
+Object.defineProperty(exports, "raspKoa", { enumerable: true, get: function () { return middleware_1.raspKoa; } });
+Object.defineProperty(exports, "raspHttp", { enumerable: true, get: function () { return middleware_1.raspHttp; } });
+Object.defineProperty(exports, "withRasp", { enumerable: true, get: function () { return middleware_1.withRasp; } });
+Object.defineProperty(exports, "recordRequestBody", { enumerable: true, get: function () { return middleware_1.recordRequestBody; } });
+Object.defineProperty(exports, "isRaspBlocked", { enumerable: true, get: function () { return middleware_1.isRaspBlocked; } });
+Object.defineProperty(exports, "sendBlocked", { enumerable: true, get: function () { return middleware_1.sendBlocked; } });
+Object.defineProperty(exports, "blockedResponse", { enumerable: true, get: function () { return middleware_1.blockedResponse; } });
+var model_output_1 = require("./model-output");
+Object.defineProperty(exports, "recordModelOutput", { enumerable: true, get: function () { return model_output_1.recordModelOutput; } });
+Object.defineProperty(exports, "recordToolArguments", { enumerable: true, get: function () { return model_output_1.recordToolArguments; } });
+var context_1 = require("./context");
+Object.defineProperty(exports, "runInRaspScope", { enumerable: true, get: function () { return context_1.runInRaspScope; } });
+Object.defineProperty(exports, "currentRaspContext", { enumerable: true, get: function () { return context_1.currentContext; } });
+Object.defineProperty(exports, "inputsOf", { enumerable: true, get: function () { return context_1.inputsOf; } });
+var engine_2 = require("./engine");
+Object.defineProperty(exports, "raspCheck", { enumerable: true, get: function () { return engine_2.check; } });
+var rule_expr_1 = require("./rule-expr");
+Object.defineProperty(exports, "compileRuleExpr", { enumerable: true, get: function () { return rule_expr_1.compileRuleExpr; } });
+Object.defineProperty(exports, "evaluateRuleExpr", { enumerable: true, get: function () { return rule_expr_1.evaluateRuleExpr; } });
+Object.defineProperty(exports, "RULE_EXPR_LIMITS", { enumerable: true, get: function () { return rule_expr_1.RULE_EXPR_LIMITS; } });
+Object.defineProperty(exports, "RULE_FIELDS", { enumerable: true, get: function () { return rule_expr_1.RULE_FIELDS; } });
+//# sourceMappingURL=index.js.map

package/dist/rasp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rasp/index.ts"],"names":[],"mappings":";;;AA4DA,gDAUC;AASD,kCAIC;AAcD,8CAEC;AAKD,4BAeC;AAGD,gDAOC;AAGD,oCAeC;AAMD,4BA+FC;AAGD,kCAEC;AAGD,gCAEC;AAGD,gCAEC;AAvQD;;;;;;;;;;;;;;;;;GAiBG;AACH,2BAA4B;AAC5B,+BAA4B;AAC5B,yCAAyC;AACzC,2CAA6C;AAC7C,mDAAqF;AACrF,qCAUkB;AAwOU,oGAjP1B,wBAAe,OAiP8B;AAAE,+FA5O/C,uBAAc,OA4O+C;AAvO/D,uCAAoE;AACpE,mCAA8D;AAC9D,mCAA8D;AAC9D,uCAAoE;AACpE,6CAA6E;AAC7E,6CAA6E;AAC7E,yCAAmH;AACnH,iCAAmE;AACnE,yCAA6D;AAG7D,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAchD,4FAA4F;AAC5F,SAAgB,kBAAkB,CAAC,IAA4B;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;;;GAIG;AACH,SAAgB,WAAW,CAAC,MAA2B,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC3F,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;IAClG,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,yFAAyF;AACzF,SAAS,gBAAgB;IACvB,IAAI,cAAc;QAAE,OAAO;IAC3B,cAAc,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,IAAI,CACV,0RAA0R,CAC3R,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAgB,iBAAiB;IAC/B,cAAc,GAAG,KAAK,CAAC;AACzB,CAAC;AAGD,IAAI,OAAO,GAAY,EAAE,CAAC;AAE1B,SAAgB,QAAQ,CAAC,CAAa;IACpC,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,UAAU,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI;QACjC,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI;QAC7B,aAAa,EAAE,CAAC,CAAC,aAAa,KAAK,IAAI;QACvC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACpE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC9C,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC9C,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QAChE,SAAS,EAAE,IAAA,0BAAc,EAAC,CAAC,CAAC,SAAS,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,SAAgB,kBAAkB,CAAC,MAAyC,EAAE,MAAyB,OAAO,CAAC,GAAG;IAChH,MAAM,CAAC,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAgB,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,IAAI,OAAO,GAAG,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC7G,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,OAAO,CAAC;QAAE,OAAO,GAAG,IAAI,CAAC;IAC/E,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,GAAG,KAAK,CAAC;IACjC,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,sGAAsG;AAC/F,KAAK,UAAU,YAAY;IAChC,MAAM,CAAC,GAAG,OAAO,CAAC;IAClB,OAAO,GAAG,EAAE,CAAC;IACb,IAAA,+BAAqB,GAAE,CAAC;IACxB,IAAA,qBAAgB,GAAE,CAAC;IACnB,IAAA,yBAAkB,GAAE,CAAC;IACrB,IAAA,qBAAgB,GAAE,CAAC;IACnB,IAAA,yBAAkB,GAAE,CAAC;IACrB,IAAA,0BAAkB,GAAE,CAAC;IACrB,IAAA,+BAAqB,GAAE,CAAC;IACxB,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACjB,IAAI,CAAC,CAAC,eAAe;QAAE,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACxD,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;IACxB,IAAA,kBAAW,EAAC,SAAS,CAAC,CAAC;IACvB,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,MAAyC,EAAE,GAAoB;IACtF,IAAI,CAAC;QACH,KAAK,YAAY,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACnC,MAAM,CAAC,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,IAAA,+BAAe,EAAC,CAAC,CAAC,eAAe,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,YAAY,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC;QACzD,IAAA,wBAAe,EAAC;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,qFAAqF;YACrF,WAAW,EAAE,QAAQ;YACrB,GAAG;SACJ,CAAC,CAAC;QACH,IAAA,oBAAa,EAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAA,6BAAmB,GAAE,CAAC;QACtB,IAAA,mBAAc,GAAE,CAAC;QACjB,IAAA,uBAAgB,EAAC,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAA,mBAAc,GAAE,CAAC;QACjB,IAAA,uBAAgB,GAAE,CAAC;QACnB,IAAA,wBAAgB,GAAE,CAAC;QACnB,IAAA,6BAAmB,GAAE,CAAC;QAEtB,IAAI,QAAkC,CAAC;QACvC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,uBAAY,CAAC;gBAC1B,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,CAAC;YACH,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,IAAA,qBAAY,EAAC,QAAQ,CAAC,CAAC;YACvB,IAAA,kBAAW,EAAC,QAAQ,CAAC,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC5B,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,GAAG,EAAE;oBAClB,IAAI,CAAC;wBACH,QAAQ,EAAE,gBAAgB,CAAC,IAAA,4BAAiB,GAAE,CAAC,CAAC;oBAClD,CAAC;oBAAC,MAAM,CAAC;wBACP,QAAQ;oBACV,CAAC;gBACH,CAAC,CAAC;gBACF,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC/B,OAAO,CAAC,eAAe,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;gBACnE,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QAED,mGAAmG;QACnG,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE;YAC9B,IAAI,MAAM,KAAK,oBAAoB;gBAAE,OAAO;YAC5C,OAAO,CAAC,IAAI,CAAC,gDAAgD,MAAM,iEAAiE,CAAC,CAAC;QACxI,CAAC,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,gBAAgB,EAAE,CAAC;QACrB,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,2HAA2H,CAAC,CAAC;YACpJ,MAAM,MAAM,GAAG,IAAI,gCAAgB,CAAC;gBAClC,GAAG,EAAE,GAAG,CAAC,GAAa;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,GAAG,EAAE,GAAG,CAAC,eAAe;gBACxB,MAAM;gBACN,aAAa,EAAE,IAAI;gBACnB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,gBAAgB,CAAC;gBACxD,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;oBACnB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACrD,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC;oBACxB,IAAA,oBAAa,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;oBAC1H,oEAAoE;oBACpE,IAAA,oBAAY,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAA,sBAAc,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,sBAAc,CAAC,CAAC;gBAC9E,CAAC;gBACD,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACxB,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QACD,wDAAwD;QACxD,YAAY,CAAC,GAAG,EAAE,CAAC,IAAA,sBAAW,EAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1H,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,mCAAmC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAgB,WAAW;IACzB,IAAA,2BAAkB,EAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,4FAA4F;AAC5F,SAAgB,UAAU;IACxB,IAAA,2BAAkB,EAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,kEAAkE;AAClE,SAAgB,UAAU;IACxB,OAAO,IAAA,iBAAQ,GAAE,CAAC;AACpB,CAAC;AAGD,iCAA6H;AAApH,yGAAA,gBAAgB,OAAA;AAAE,6GAAA,gBAAgB,OAAwB;AAAE,kGAAA,SAAS,OAAA;AAAE,sGAAA,aAAa,OAAA;AAAE,qGAAA,YAAY,OAAA;AAG3G,2CAA8K;AAArK,yGAAA,WAAW,OAAA;AAAE,qHAAA,uBAAuB,OAAA;AAAE,yGAAA,WAAW,OAAA;AAAE,qGAAA,OAAO,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,+GAAA,iBAAiB,OAAA;AAAE,2GAAA,aAAa,OAAA;AAAE,yGAAA,WAAW,OAAA;AAAE,6GAAA,eAAe,OAAA;AACvJ,+CAAwE;AAA/D,iHAAA,iBAAiB,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAC/C,qCAA2F;AAAlF,yGAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAsB;AAAE,mGAAA,QAAQ,OAAA;AACvE,mCAA8C;AAArC,mGAAA,KAAK,OAAa;AAC3B,yCAA+F;AAAtF,4GAAA,eAAe,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,wGAAA,WAAW,OAAA"}