usertrust 1.3.0 → 1.5.0

package/dist/policy/gate.js

@@ -38,18 +38,90 @@ function resolveFieldPath(path, context) {
 // ---------------------------------------------------------------------------
 /** Maximum allowed length for regex patterns in policy rules. */
 const MAX_REGEX_LENGTH = 200;
+/** Maximum input length the regex engine is allowed to scan (defense-in-depth). */
+const MAX_REGEX_INPUT = 4096;
 /**
- * Detects nested quantifiers that can cause catastrophic backtracking (ReDoS).
- * Matches patterns like `a+*`, `a*+`, `a{2,}*`, `a+{2,}`, etc.
+ * Adjacent nested quantifiers, e.g. `a+*`, `a*+`, `a{2,}*`, `a+{2,}`.
  */
-const NESTED_QUANTIFIER_RE = /[+*?]\{?\d*,?\d*\}?[+*?]/;
+const ADJACENT_QUANTIFIER_RE = /[+*?]\{?\d*,?\d*\}?[+*?]/;
+/**
+ * Structural catastrophic-backtracking guard.
+ *
+ * Rejects a group `( ... )` that is immediately followed by an unbounded
+ * quantifier (`*`, `+`, or `{n,}`) when the group body itself contains a
+ * quantifier (`*` `+` `?` `{`) or an alternation (`|`). This is the canonical
+ * shape of exponential backtracking: `(a+)+`, `(.*)*`, `(\d+)+`, `(a|a)*`,
+ * `(a|ab)*`, etc. Escaped parens (`\(`) and character classes (`[...]`) are
+ * handled by tracking escape/class state so real group boundaries are matched.
+ *
+ * Conservative by design: it may reject some benign patterns, but policy
+ * regexes are operator-authored config, so over-rejection is acceptable and
+ * fails safe (safeRegExp returns null → condition is non-matching).
+ */
+function hasNestedQuantifiedGroup(pattern) {
+    // Per open group, whether its body so far contains a quantifier/alternation.
+    const bodyHasAmbiguity = [];
+    let escaped = false;
+    let inClass = false; // inside a [...] character class
+    for (let i = 0; i < pattern.length; i++) {
+        const c = pattern[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (c === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (inClass) {
+            if (c === "]")
+                inClass = false;
+            continue;
+        }
+        if (c === "[") {
+            inClass = true;
+            continue;
+        }
+        if (c === "(") {
+            bodyHasAmbiguity.push(false);
+            continue;
+        }
+        if (c === "|" || c === "*" || c === "+" || c === "?" || c === "{") {
+            // Mark the innermost open group's body as ambiguous.
+            if (bodyHasAmbiguity.length > 0) {
+                bodyHasAmbiguity[bodyHasAmbiguity.length - 1] = true;
+            }
+        }
+        if (c === ")") {
+            const ambiguous = bodyHasAmbiguity.pop() ?? false;
+            // Look at the quantifier applied to this group.
+            const next = pattern[i + 1];
+            const unboundedQuantifier = next === "*" ||
+                next === "+" ||
+                (next === "{" &&
+                    /^\{\d*,\d*\}/.test(pattern.slice(i + 1)) &&
+                    !/^\{\d+\}/.test(pattern.slice(i + 1))); // {n,} or {n,m}/{,m}, not {n}
+            if (ambiguous && unboundedQuantifier)
+                return true;
+            // Propagate ambiguity outward: a quantified group is itself ambiguous
+            // content for any enclosing group.
+            if (bodyHasAmbiguity.length > 0 &&
+                (next === "*" || next === "+" || next === "?" || next === "{")) {
+                bodyHasAmbiguity[bodyHasAmbiguity.length - 1] = true;
+            }
+        }
+    }
+    return false;
+}
 /**
  * Validate that a regex pattern is safe to compile and execute.
  *
- * **Security**: Regex policies must contain trusted input. User-supplied patterns
- * are constrained to prevent ReDoS (Regular Expression Denial of Service):
+ * **Security** (AUD-463): prevents ReDoS (Regular Expression Denial of Service).
  * - Patterns longer than 200 characters are rejected.
- * - Patterns containing nested quantifiers (e.g. `a+*`, `x{2,}+`) are rejected.
+ * - Adjacent nested quantifiers (`a+*`, `x{2,}+`) are rejected.
+ * - A quantified group whose body contains a quantifier/alternation
+ *   (`(a+)+`, `(.*)*`, `(\d+)+`, `(a|a)*`) is rejected structurally at compile
+ *   time — this eliminates the exponential-backtracking class deterministically.
  * - Invalid regex syntax is caught and treated as non-matching.
  *
  * @returns The compiled RegExp, or null if the pattern is unsafe or invalid.
@@ -57,7 +129,9 @@ const NESTED_QUANTIFIER_RE = /[+*?]\{?\d*,?\d*\}?[+*?]/;
 function safeRegExp(pattern) {
     if (pattern.length > MAX_REGEX_LENGTH)
         return null;
-    if (NESTED_QUANTIFIER_RE.test(pattern))
+    if (ADJACENT_QUANTIFIER_RE.test(pattern))
+        return null;
+    if (hasNestedQuantifiedGroup(pattern))
         return null;
     try {
         return new RegExp(pattern);
@@ -66,12 +140,14 @@ function safeRegExp(pattern) {
         return null;
     }
 }
-// ---------------------------------------------------------------------------
-// Field condition evaluation (12 operators)
-// ---------------------------------------------------------------------------
 /**
  * Evaluate a single field condition against the evaluation context.
  * Supports all 12 operators from the FieldOperator union.
+ *
+ * Numeric operators (`gt`/`gte`/`lt`/`lte`) return `"indeterminate"` when the
+ * field is absent or non-numeric — the distinction between "present but does not
+ * satisfy" (`false`) and "cannot be evaluated" (`"indeterminate"`) is what lets
+ * hard rules fail closed instead of silently allowing an unbounded operation.
  */
 function evaluateFieldCondition(fc, context) {
     const resolved = resolveFieldPath(fc.field, context);
@@ -85,13 +161,21 @@ function evaluateFieldCondition(fc, context) {
         case "neq":
             return resolved !== fc.value;
         case "gt":
-            return typeof resolved === "number" && typeof fc.value === "number" && resolved > fc.value;
+            if (typeof resolved !== "number" || typeof fc.value !== "number")
+                return "indeterminate";
+            return resolved > fc.value;
         case "gte":
-            return typeof resolved === "number" && typeof fc.value === "number" && resolved >= fc.value;
+            if (typeof resolved !== "number" || typeof fc.value !== "number")
+                return "indeterminate";
+            return resolved >= fc.value;
         case "lt":
-            return typeof resolved === "number" && typeof fc.value === "number" && resolved < fc.value;
+            if (typeof resolved !== "number" || typeof fc.value !== "number")
+                return "indeterminate";
+            return resolved < fc.value;
         case "lte":
-            return typeof resolved === "number" && typeof fc.value === "number" && resolved <= fc.value;
+            if (typeof resolved !== "number" || typeof fc.value !== "number")
+                return "indeterminate";
+            return resolved <= fc.value;
         case "in":
             return Array.isArray(fc.value) && fc.value.includes(resolved);
         case "not_in":
@@ -104,7 +188,10 @@ function evaluateFieldCondition(fc, context) {
             const re = safeRegExp(fc.value);
             if (re === null)
                 return false;
-            return re.test(resolved);
+            // Layer B (defense-in-depth): bound the scanned input so even a
+            // structural miss cannot be fed an unbounded string.
+            const input = resolved.length > MAX_REGEX_INPUT ? resolved.slice(0, MAX_REGEX_INPUT) : resolved;
+            return re.test(input);
         }
         default:
             return false;
@@ -147,9 +234,20 @@ function ruleMatches(rule, context) {
     const enabled = rule.enabled ?? true;
     if (!enabled)
         return false;
+    // Hard rules fail CLOSED: a condition that cannot be evaluated (a missing or
+    // mistyped guarded field) is treated as satisfied so the guard still fires,
+    // rather than silently allowing an unbounded/ungoverned operation. Soft rules
+    // stay lenient (indeterminate → unmet) to preserve warning-only behavior.
+    const failClosed = rule.enforcement === "hard";
     // All field conditions must match
     for (const fc of rule.conditions) {
-        if (!evaluateFieldCondition(fc, context))
+        const res = evaluateFieldCondition(fc, context);
+        if (res === "indeterminate") {
+            if (failClosed)
+                continue;
+            return false;
+        }
+        if (!res)
             return false;
     }
     // Scope matching (if rule has scope patterns)

package/dist/policy/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/policy/gate.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AA0C1C,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAgC;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,OAAO,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrE,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;GAGG;AACH,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAExD;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,OAAe;IAClC,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC;QACJ,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,sBAAsB,CAAC,EAAkB,EAAE,OAAgC;IACnF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAErD,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,QAAQ;YACZ,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC;QAEpD,KAAK,YAAY;YAChB,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC;QAEpD,KAAK,IAAI;YACR,OAAO,QAAQ,KAAK,EAAE,CAAC,KAAK,CAAC;QAE9B,KAAK,KAAK;YACT,OAAO,QAAQ,KAAK,EAAE,CAAC,KAAK,CAAC;QAE9B,KAAK,IAAI;YACR,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC;QAE5F,KAAK,KAAK;YACT,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC;QAE7F,KAAK,IAAI;YACR,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC;QAE5F,KAAK,KAAK;YACT,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC;QAE7F,KAAK,IAAI;YACR,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE/D,KAAK,QAAQ;YACZ,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEhE,KAAK,UAAU;YACd,OAAO,CACN,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAC3F,CAAC;QAEH,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC/E,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC9B,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAED;YACC,OAAO,KAAK,CAAC;IACf,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,MAAgB;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAeD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CACjC,WAAqC,EACrC,SAAiB;IAEjB,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAE7B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC9B,IAAI,EAAE,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,GAAG,EAAE,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QACjE,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;AACJ,CAAC;AAwCD;;GAEG;AACH,SAAS,WAAW,CAAC,IAAc,EAAE,OAAsB;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,kCAAkC;IAClC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IACxD,CAAC;IAED,8CAA8C;IAC9C,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IAED,uBAAuB;IACvB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,SAAS,GAAI,OAAO,CAAC,SAAgC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB,EAAE,OAAsB;IACvE,MAAM,SAAS,GAAI,OAAO,CAAC,SAAgC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAExF,gEAAgE;IAChE,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC;IAEzF,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,MAAM,cAAc,GAAgB,EAAE,CAAC;IACvC,MAAM,cAAc,GAAgB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,SAAS;QAE1C,MAAM,KAAK,GAAc;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEpB,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;QACrE,IAAI,WAAW,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC;YAChD,MAAM,MAAM,GACX,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,SAAS,EAAE,CAAC;YAExF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;gBACjC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACP,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO;QACN,QAAQ,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACtD,WAAW,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC;QACtC,OAAO;QACP,cAAc;QACd,cAAc;QACd,OAAO;QACP,WAAW,EAAE,SAAS;KACtB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACxC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAExC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAY,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAElE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAAoB,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,KAAmB,CAAC;QAC9D,CAAC;QAED,OAAO,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/policy/gate.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AA0C1C,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAgC;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,OAAO,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrE,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,mFAAmF;AACnF,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;GAEG;AACH,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAChD,6EAA6E;IAC7E,MAAM,gBAAgB,GAAc,EAAE,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,iCAAiC;IAEtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAErB,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAChB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,GAAG,KAAK,CAAC;YAC/B,SAAS;QACV,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACf,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,SAAS;QACV,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACnE,qDAAqD;YACrD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;YACtD,CAAC;QACF,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;YAClD,gDAAgD;YAChD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,MAAM,mBAAmB,GACxB,IAAI,KAAK,GAAG;gBACZ,IAAI,KAAK,GAAG;gBACZ,CAAC,IAAI,KAAK,GAAG;oBACZ,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,8BAA8B;YACzE,IAAI,SAAS,IAAI,mBAAmB;gBAAE,OAAO,IAAI,CAAC;YAClD,sEAAsE;YACtE,mCAAmC;YACnC,IACC,gBAAgB,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAC7D,CAAC;gBACF,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;YACtD,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,UAAU,CAAC,OAAe;IAClC,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,wBAAwB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC;QACJ,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAiBD;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,EAAkB,EAAE,OAAgC;IACnF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAErD,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,QAAQ;YACZ,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC;QAEpD,KAAK,YAAY;YAChB,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC;QAEpD,KAAK,IAAI;YACR,OAAO,QAAQ,KAAK,EAAE,CAAC,KAAK,CAAC;QAE9B,KAAK,KAAK;YACT,OAAO,QAAQ,KAAK,EAAE,CAAC,KAAK,CAAC;QAE9B,KAAK,IAAI;YACR,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,eAAe,CAAC;YACzF,OAAO,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC;QAE5B,KAAK,KAAK;YACT,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,eAAe,CAAC;YACzF,OAAO,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC;QAE7B,KAAK,IAAI;YACR,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,eAAe,CAAC;YACzF,OAAO,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC;QAE5B,KAAK,KAAK;YACT,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,eAAe,CAAC;YACzF,OAAO,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC;QAE7B,KAAK,IAAI;YACR,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE/D,KAAK,QAAQ;YACZ,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEhE,KAAK,UAAU;YACd,OAAO,CACN,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAC3F,CAAC;QAEH,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC/E,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC9B,gEAAgE;YAChE,qDAAqD;YACrD,MAAM,KAAK,GACV,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YACnF,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAED;YACC,OAAO,KAAK,CAAC;IACf,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,MAAgB;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAeD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CACjC,WAAqC,EACrC,SAAiB;IAEjB,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAE7B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC9B,IAAI,EAAE,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,GAAG,EAAE,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QACjE,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;AACJ,CAAC;AAwCD;;GAEG;AACH,SAAS,WAAW,CAAC,IAAc,EAAE,OAAsB;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC;IAE/C,kCAAkC;IAClC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,sBAAsB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YAC7B,IAAI,UAAU;gBAAE,SAAS;YACzB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;IACxB,CAAC;IAED,8CAA8C;IAC9C,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IAED,uBAAuB;IACvB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,SAAS,GAAI,OAAO,CAAC,SAAgC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB,EAAE,OAAsB;IACvE,MAAM,SAAS,GAAI,OAAO,CAAC,SAAgC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAExF,gEAAgE;IAChE,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC;IAEzF,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,MAAM,cAAc,GAAgB,EAAE,CAAC;IACvC,MAAM,cAAc,GAAgB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,SAAS;QAE1C,MAAM,KAAK,GAAc;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEpB,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;QACrE,IAAI,WAAW,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC;YAChD,MAAM,MAAM,GACX,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,SAAS,EAAE,CAAC;YAExF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;gBACjC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACP,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO;QACN,QAAQ,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACtD,WAAW,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC;QACtC,OAAO;QACP,cAAc;QACd,cAAc;QACd,OAAO;QACP,WAAW,EAAE,SAAS;KACtB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACxC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAExC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAY,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAElE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAAoB,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,KAAmB,CAAC;QAC9D,CAAC;QAED,OAAO,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC"}

package/dist/policy/injection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"injection.d.ts","sourceRoot":"","sources":["../../src/policy/injection.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAyL7D;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAejE"}
+{"version":3,"file":"injection.d.ts","sourceRoot":"","sources":["../../src/policy/injection.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAuM7D;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAejE"}

package/dist/policy/injection.js

@@ -14,29 +14,38 @@ const VERBS = [
     "stop following",
     "forget about",
 ];
-const OBJECTS = [
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Injection intent regex: a directive verb, then up to a few OPTIONAL filler
+ * words (all/any/the/your/those/these/prior/previous/preceding/earlier/above/
+ * following/original/system/of/to), then a target noun. The filler window lets
+ * "ignore ALL previous instructions" and "disregard all prior instructions"
+ * match where the old literal "verb object" substrings did not.
+ *
+ * Filler is bounded to `{0,4}` and every alternative is a literal, so the
+ * pattern is linear-time and cannot itself become a ReDoS vector. Homoglyph and
+ * heavy-obfuscation evasions remain explicitly out of scope.
+ */
+const VERB_ALT = VERBS.map(escapeRegExp).join("|");
+const OBJECT_ALT = [
     "instructions",
+    "instruction",
     "rules",
     "guidelines",
+    "directives",
     "system prompt",
-    "previous instructions",
-    "above instructions",
+    "system message",
+    "prompt",
     "context",
     "constraints",
-];
-/** Pre-computed lowercased injection phrases (verb + " " + object). */
-const KEYWORD_COMBOS = [];
-for (const verb of VERBS) {
-    for (const obj of OBJECTS) {
-        KEYWORD_COMBOS.push(`${verb} ${obj}`);
-    }
-}
+    "restrictions",
+].join("|");
+const FILLER = "(?:all|any|the|your|those|these|prior|previous|preceding|earlier|above|following|original|system|of|to)";
+const INJECTION_INTENT_RE = new RegExp(`(?:${VERB_ALT})\\s+(?:${FILLER}\\s+){0,4}(?:${OBJECT_ALT})`, "i");
 function checkKeywordCombo(lower) {
-    for (const combo of KEYWORD_COMBOS) {
-        if (lower.includes(combo))
-            return true;
-    }
-    return false;
+    return INJECTION_INTENT_RE.test(lower);
 }
 // ---------------------------------------------------------------------------
 // Layer 2: Role boundary detection

package/dist/policy/injection.js.map

@@ -1 +1 @@
-{"version":3,"file":"injection.js","sourceRoot":"","sources":["../../src/policy/injection.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAoBjC,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,KAAK,GAAG;IACb,QAAQ;IACR,WAAW;IACX,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,eAAe;IACf,gBAAgB;IAChB,cAAc;CACd,CAAC;AAEF,MAAM,OAAO,GAAG;IACf,cAAc;IACd,OAAO;IACP,YAAY;IACZ,eAAe;IACf,uBAAuB;IACvB,oBAAoB;IACpB,SAAS;IACT,aAAa;CACb,CAAC;AAEF,uEAAuE;AACvE,MAAM,cAAc,GAAa,EAAE,CAAC;AACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC3B,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACvC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,MAAM,aAAa,GAAa;IAC/B,oBAAoB;IACpB,aAAa;IACb,WAAW;IACX,iBAAiB;IACjB,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,WAAW;IACX,2BAA2B;IAC3B,0BAA0B;IAC1B,0BAA0B;IAC1B,4BAA4B;IAC5B,qBAAqB;IACrB,oBAAoB;CACpB,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAa;IACvC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,SAAS,GAAG,6DAA6D,CAAC;AAEhF,SAAS,kBAAkB,CAAC,KAAa;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnE,mDAAmD;YACnD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACR,wBAAwB;QACzB,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,8DAA8D;AAC9D,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AAEzE,iDAAiD;AACjD,MAAM,gBAAgB,GAAG,yCAAyC,CAAC;AAEnE,2CAA2C;AAC3C,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAE3E,SAAS,uBAAuB,CAAC,KAAa;IAC7C,OAAO,CACN,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5B,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAChC,CAAC;AACH,CAAC;AAYD,SAAS,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,KAAgB;IACvE,MAAM,UAAU,GAAG,KAAK;SACtB,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,mDAAmD,EAAE,EAAE,CAAC;SAChE,WAAW,EAAE,CAAC;IAEhB,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpF,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC;IAC1C,CAAC;IAED,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpF,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IAC5C,CAAC;IAED,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACrC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACtF,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IAC5C,CAAC;IAED,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC1C,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,uBAAuB,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAChG,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC;IAC1C,CAAC;AACF,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,WAAmB,EAAE,KAAgB;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO;IACR,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACjE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO;IACR,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9D,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAa;IAC5C,MAAM,KAAK,GAAc;QACxB,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,IAAI,GAAG,EAAU;QAC3B,KAAK,EAAE,EAAE;KACT,CAAC;IAEF,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAE3B,OAAO;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;KAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"injection.js","sourceRoot":"","sources":["../../src/policy/injection.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAoBjC,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,KAAK,GAAG;IACb,QAAQ;IACR,WAAW;IACX,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,eAAe;IACf,gBAAgB;IAChB,cAAc;CACd,CAAC;AAEF,SAAS,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,MAAM,UAAU,GAAG;IAClB,cAAc;IACd,aAAa;IACb,OAAO;IACP,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,QAAQ;IACR,SAAS;IACT,aAAa;IACb,cAAc;CACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACZ,MAAM,MAAM,GACX,yGAAyG,CAAC;AAC3G,MAAM,mBAAmB,GAAG,IAAI,MAAM,CACrC,MAAM,QAAQ,WAAW,MAAM,gBAAgB,UAAU,GAAG,EAC5D,GAAG,CACH,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAa;IACvC,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,MAAM,aAAa,GAAa;IAC/B,oBAAoB;IACpB,aAAa;IACb,WAAW;IACX,iBAAiB;IACjB,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,WAAW;IACX,2BAA2B;IAC3B,0BAA0B;IAC1B,0BAA0B;IAC1B,4BAA4B;IAC5B,qBAAqB;IACrB,oBAAoB;CACpB,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAa;IACvC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,SAAS,GAAG,6DAA6D,CAAC;AAEhF,SAAS,kBAAkB,CAAC,KAAa;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnE,mDAAmD;YACnD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACR,wBAAwB;QACzB,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,8DAA8D;AAC9D,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AAEzE,iDAAiD;AACjD,MAAM,gBAAgB,GAAG,yCAAyC,CAAC;AAEnE,2CAA2C;AAC3C,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAE3E,SAAS,uBAAuB,CAAC,KAAa;IAC7C,OAAO,CACN,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5B,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAChC,CAAC;AACH,CAAC;AAYD,SAAS,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,KAAgB;IACvE,MAAM,UAAU,GAAG,KAAK;SACtB,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,mDAAmD,EAAE,EAAE,CAAC;SAChE,WAAW,EAAE,CAAC;IAEhB,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpF,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC;IAC1C,CAAC;IAED,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpF,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IAC5C,CAAC;IAED,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACrC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACtF,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IAC5C,CAAC;IAED,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC1C,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,uBAAuB,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAChG,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC;IAC1C,CAAC;AACF,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,WAAmB,EAAE,KAAgB;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO;IACR,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACjE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO;IACR,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9D,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAa;IAC5C,MAAM,KAAK,GAAc;QACxB,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,IAAI,GAAG,EAAU;QAC3B,KAAK,EAAE,EAAE;KACT,CAAC;IAEF,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAE3B,OAAO;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;KAClB,CAAC;AACH,CAAC"}

package/dist/policy/pii.d.ts

@@ -35,4 +35,24 @@ export interface RedactedData {
  * Returns both the redacted data and the detection metadata.
  */
 export declare function redactPII(data: unknown): RedactedData;
+/**
+ * Redact PII from an LLM request's message array for OUTBOUND transmission.
+ *
+ * Contract:
+ * - **Pure**: does not mutate `messages`; deep-clones and returns a new value.
+ * - Redacts only string values that match a PII pattern, replacing them with
+ *   `[REDACTED:<types>]` (same placeholder as {@link redactPII}).
+ * - Non-string / non-PII values are returned structurally unchanged.
+ * - Never touches sibling request fields — callers apply this to the message
+ *   array ONLY, then rebuild `params` with the redacted messages.
+ * - Returns the detection metadata so the caller can audit what was redacted.
+ *
+ * Intended caller (GOVERN), when `config.pii === "redact"`:
+ *   const { data: safeMessages } = redactMessages(messages);
+ *   const safeArgs = [{ ...params, messages: safeMessages }, ...args.slice(1)];
+ *   await originalFn.apply(thisArg, safeArgs);
+ *
+ * @returns `{ data: <redacted messages>, detection }`
+ */
+export declare function redactMessages(messages: unknown): RedactedData;
 //# sourceMappingURL=pii.d.ts.map

package/dist/policy/pii.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pii.d.ts","sourceRoot":"","sources":["../../src/policy/pii.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,YAAY;IAC5B,gCAAgC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qFAAqF;IACrF,KAAK,EAAE,MAAM,EAAE,CAAC;CAChB;AAuID;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAWrD;AAsCD,MAAM,WAAW,YAAY;IAC5B,wDAAwD;IACxD,IAAI,EAAE,OAAO,CAAC;IACd,+CAA+C;IAC/C,SAAS,EAAE,YAAY,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAOrD"}
+{"version":3,"file":"pii.d.ts","sourceRoot":"","sources":["../../src/policy/pii.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,YAAY;IAC5B,gCAAgC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qFAAqF;IACrF,KAAK,EAAE,MAAM,EAAE,CAAC;CAChB;AA2JD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAWrD;AAsCD,MAAM,WAAW,YAAY;IAC5B,wDAAwD;IACxD,IAAI,EAAE,OAAO,CAAC;IACd,+CAA+C;IAC/C,SAAS,EAAE,YAAY,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAOrD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,YAAY,CAE9D"}

package/dist/policy/pii.js

@@ -9,9 +9,30 @@ function isPhoneNumber(value) {
     const stripped = value.replace(/\s+/g, "");
     return /(?:\+?\d{1,3}[-.\s()]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}/.test(stripped);
 }
-/** US SSN: XXX-XX-XXXX (with dashes required to avoid false positives) */
+/**
+ * US SSN. High-confidence dashed form `XXX-XX-XXXX`, OR a bare/space-separated
+ * 9-digit sequence that passes SSA structural validation (area 001-899 except
+ * 666, group 01-99, serial 0001-9999). Structural validation keeps the bare
+ * form from matching arbitrary 9-digit identifiers, and the word boundaries stop
+ * it firing inside longer digit runs (phone/credit-card numbers).
+ */
 function isSSN(value) {
-    return /\b\d{3}-\d{2}-\d{4}\b/.test(value);
+    if (/\b\d{3}-\d{2}-\d{4}\b/.test(value))
+        return true;
+    // Bare or single-space-separated: 123456789 or 123 45 6789. Require standalone.
+    const bare = value.match(/\b(\d{3})[ ]?(\d{2})[ ]?(\d{4})\b/g);
+    if (!bare)
+        return false;
+    for (const candidate of bare) {
+        const digits = candidate.replace(/ /g, "");
+        const area = Number(digits.slice(0, 3));
+        const group = Number(digits.slice(3, 5));
+        const serial = Number(digits.slice(5, 9));
+        if (area >= 1 && area <= 899 && area !== 666 && group >= 1 && group <= 99 && serial >= 1) {
+            return true;
+        }
+    }
+    return false;
 }
 /** IPv4 address: 0-255.0-255.0-255.0-255 */
 function isIPv4(value) {
@@ -166,6 +187,28 @@ export function redactPII(data) {
     const redacted = redactValue(data);
     return { data: redacted, detection };
 }
+/**
+ * Redact PII from an LLM request's message array for OUTBOUND transmission.
+ *
+ * Contract:
+ * - **Pure**: does not mutate `messages`; deep-clones and returns a new value.
+ * - Redacts only string values that match a PII pattern, replacing them with
+ *   `[REDACTED:<types>]` (same placeholder as {@link redactPII}).
+ * - Non-string / non-PII values are returned structurally unchanged.
+ * - Never touches sibling request fields — callers apply this to the message
+ *   array ONLY, then rebuild `params` with the redacted messages.
+ * - Returns the detection metadata so the caller can audit what was redacted.
+ *
+ * Intended caller (GOVERN), when `config.pii === "redact"`:
+ *   const { data: safeMessages } = redactMessages(messages);
+ *   const safeArgs = [{ ...params, messages: safeMessages }, ...args.slice(1)];
+ *   await originalFn.apply(thisArg, safeArgs);
+ *
+ * @returns `{ data: <redacted messages>, detection }`
+ */
+export function redactMessages(messages) {
+    return redactPII(messages);
+}
 /** Return matched PII type names for a string value. */
 function matchedTypes(value) {
     const matched = [];

package/dist/policy/pii.js.map

@@ -1 +1 @@
-{"version":3,"file":"pii.js","sourceRoot":"","sources":["../../src/policy/pii.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAqCjC,6CAA6C;AAC7C,SAAS,OAAO,CAAC,KAAa;IAC7B,OAAO,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CAAC,KAAa;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,6DAA6D,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED,0EAA0E;AAC1E,SAAS,KAAK,CAAC,KAAa;IAC3B,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,4CAA4C;AAC5C,SAAS,MAAM,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IAC3B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,SAAS,SAAS,CAAC,MAAc;IAChC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,SAAS,EAAE,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,SAAS,GAAG,CAAC,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,KAAa;IAC9B,OAAO,iDAAiD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,KAAa;IAC9B,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,2FAA2F;AAC3F,SAAS,aAAa,CAAC,KAAa;IACnC,OAAO,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,6DAA6D;AAC7D,SAAS,aAAa,CAAC,KAAa;IACnC,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,iDAAiD;AACjD,SAAS,KAAK,CAAC,KAAa;IAC3B,OAAO,mEAAmE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,8BAA8B;AAC9B,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,8FAA8F;AAC9F,SAAS,eAAe,CAAC,KAAa;IACrC,uEAAuE;IACvE,IACC,uGAAuG,CAAC,IAAI,CAC3G,KAAK,CACL,EACA,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,wFAAwF;IACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,YAAY,GAAiB;IAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;IAChC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE;IACtC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;IAC5B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;IAC3C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;IAC9B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAC7C,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAC7C,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;IAC5B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;IAC3C,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE;CACjD,CAAC;AAEF,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAElC,OAAO;QACN,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;QACrB,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;QACjB,KAAK;KACL,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,WAAmB,EAAE,KAAkB,EAAE,KAAe;IAC1F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO;IACR,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACjE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO;IACR,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9D,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,KAAkB,EAAE,KAAe;IAC1F,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;AACF,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa;IACtC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,wDAAwD;AACxD,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,aAAa,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC"}
+{"version":3,"file":"pii.js","sourceRoot":"","sources":["../../src/policy/pii.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAqCjC,6CAA6C;AAC7C,SAAS,OAAO,CAAC,KAAa;IAC7B,OAAO,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CAAC,KAAa;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,6DAA6D,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,KAAa;IAC3B,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,gFAAgF;IAChF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YAC1F,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,4CAA4C;AAC5C,SAAS,MAAM,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IAC3B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,SAAS,SAAS,CAAC,MAAc;IAChC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,SAAS,EAAE,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,SAAS,GAAG,CAAC,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,KAAa;IAC9B,OAAO,iDAAiD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,KAAa;IAC9B,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,2FAA2F;AAC3F,SAAS,aAAa,CAAC,KAAa;IACnC,OAAO,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,6DAA6D;AAC7D,SAAS,aAAa,CAAC,KAAa;IACnC,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,iDAAiD;AACjD,SAAS,KAAK,CAAC,KAAa;IAC3B,OAAO,mEAAmE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,8BAA8B;AAC9B,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,8FAA8F;AAC9F,SAAS,eAAe,CAAC,KAAa;IACrC,uEAAuE;IACvE,IACC,uGAAuG,CAAC,IAAI,CAC3G,KAAK,CACL,EACA,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,wFAAwF;IACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,YAAY,GAAiB;IAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;IAChC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE;IACtC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;IAC5B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;IAC3C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;IAC9B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAC7C,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAC7C,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;IAC5B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;IAC3C,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE;CACjD,CAAC;AAEF,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAElC,OAAO;QACN,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;QACrB,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;QACjB,KAAK;KACL,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,WAAmB,EAAE,KAAkB,EAAE,KAAe;IAC1F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO;IACR,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACjE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO;IACR,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9D,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,KAAkB,EAAE,KAAe;IAC1F,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;AACF,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa;IACtC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAAC,QAAiB;IAC/C,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,wDAAwD;AACxD,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,aAAa,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC"}