tweek 0.1.0__py3-none-any.whl

tweek/plugins/compliance/pci.py

@@ -0,0 +1,361 @@
+#!/usr/bin/env python3
+"""
+Tweek PCI-DSS Compliance Plugin
+
+Detects payment card industry data:
+- Credit/debit card numbers (with Luhn validation)
+- CVV/CVC codes
+- Bank account and routing numbers
+- Payment tokens and references
+- Cardholder data markers
+
+Based on PCI-DSS requirements for protecting cardholder data.
+"""
+
+from typing import Optional, List, Dict, Any
+from tweek.plugins.base import (
+    CompliancePlugin,
+    ScanDirection,
+    ActionType,
+    Severity,
+    PatternDefinition,
+    Finding,
+)
+
+
+def luhn_checksum(card_number: str) -> bool:
+    """
+    Validate a card number using the Luhn algorithm.
+
+    Args:
+        card_number: Card number string (digits only)
+
+    Returns:
+        True if valid according to Luhn algorithm
+    """
+    # Remove non-digits
+    digits = ''.join(c for c in card_number if c.isdigit())
+
+    if len(digits) < 13 or len(digits) > 19:
+        return False
+
+    # Luhn algorithm
+    total = 0
+    reverse_digits = digits[::-1]
+
+    for i, digit in enumerate(reverse_digits):
+        n = int(digit)
+        if i % 2 == 1:
+            n *= 2
+            if n > 9:
+                n -= 9
+        total += n
+
+    return total % 10 == 0
+
+
+class PCICompliancePlugin(CompliancePlugin):
+    """
+    PCI-DSS compliance plugin.
+
+    Detects payment card data and related financial information
+    that must be protected under PCI-DSS requirements.
+    """
+
+    VERSION = "1.0.0"
+    DESCRIPTION = "Detect PCI-DSS payment card and financial data"
+    AUTHOR = "Tweek"
+    REQUIRES_LICENSE = "enterprise"
+    TAGS = ["compliance", "pci", "financial", "payment"]
+
+    def __init__(self, config: Optional[Dict[str, Any]] = None):
+        super().__init__(config)
+        self._patterns: Optional[List[PatternDefinition]] = None
+        self._validate_luhn = config.get("validate_luhn", True) if config else True
+
+    @property
+    def name(self) -> str:
+        return "pci"
+
+    @property
+    def scan_direction(self) -> ScanDirection:
+        direction = self._config.get("scan_direction", "both")
+        return ScanDirection(direction)
+
+    def get_patterns(self) -> List[PatternDefinition]:
+        """Return PCI-DSS patterns."""
+        if self._patterns is not None:
+            return self._patterns
+
+        self._patterns = [
+            # =================================================================
+            # Credit Card Numbers
+            # =================================================================
+            PatternDefinition(
+                name="visa",
+                regex=r"\b4[0-9]{3}[\s-]?[0-9]{4}[\s-]?[0-9]{4}[\s-]?[0-9]{4}\b",
+                severity=Severity.CRITICAL,
+                description="Visa card number",
+                default_action=ActionType.REDACT,
+                tags=["pci", "card", "visa"],
+            ),
+            PatternDefinition(
+                name="mastercard",
+                regex=r"\b5[1-5][0-9]{2}[\s-]?[0-9]{4}[\s-]?[0-9]{4}[\s-]?[0-9]{4}\b",
+                severity=Severity.CRITICAL,
+                description="Mastercard number",
+                default_action=ActionType.REDACT,
+                tags=["pci", "card", "mastercard"],
+            ),
+            PatternDefinition(
+                name="mastercard_2_series",
+                regex=r"\b2[2-7][0-9]{2}[\s-]?[0-9]{4}[\s-]?[0-9]{4}[\s-]?[0-9]{4}\b",
+                severity=Severity.CRITICAL,
+                description="Mastercard 2-series number",
+                default_action=ActionType.REDACT,
+                tags=["pci", "card", "mastercard"],
+            ),
+            PatternDefinition(
+                name="amex",
+                regex=r"\b3[47][0-9]{2}[\s-]?[0-9]{6}[\s-]?[0-9]{5}\b",
+                severity=Severity.CRITICAL,
+                description="American Express card number",
+                default_action=ActionType.REDACT,
+                tags=["pci", "card", "amex"],
+            ),
+            PatternDefinition(
+                name="discover",
+                regex=r"\b6(?:011|5[0-9]{2})[\s-]?[0-9]{4}[\s-]?[0-9]{4}[\s-]?[0-9]{4}\b",
+                severity=Severity.CRITICAL,
+                description="Discover card number",
+                default_action=ActionType.REDACT,
+                tags=["pci", "card", "discover"],
+            ),
+            PatternDefinition(
+                name="diners",
+                regex=r"\b3(?:0[0-5]|[68][0-9])[0-9][\s-]?[0-9]{6}[\s-]?[0-9]{4}\b",
+                severity=Severity.CRITICAL,
+                description="Diners Club card number",
+                default_action=ActionType.REDACT,
+                tags=["pci", "card", "diners"],
+            ),
+            PatternDefinition(
+                name="jcb",
+                regex=r"\b(?:2131|1800|35[0-9]{2})[\s-]?[0-9]{4}[\s-]?[0-9]{4}[\s-]?[0-9]{4}\b",
+                severity=Severity.CRITICAL,
+                description="JCB card number",
+                default_action=ActionType.REDACT,
+                tags=["pci", "card", "jcb"],
+            ),
+            PatternDefinition(
+                name="generic_card",
+                regex=r"\b(?:[0-9]{4}[\s-]?){3}[0-9]{4}\b",
+                severity=Severity.HIGH,
+                description="Potential card number (16 digits)",
+                default_action=ActionType.WARN,
+                tags=["pci", "card", "generic"],
+            ),
+
+            # =================================================================
+            # CVV/CVC/Security Codes
+            # =================================================================
+            PatternDefinition(
+                name="cvv_labeled",
+                regex=r"(?i)(?:CVV|CVC|CVV2|CVC2|CSC|CID)[:\s#]*[0-9]{3,4}",
+                severity=Severity.CRITICAL,
+                description="Card security code (CVV/CVC)",
+                default_action=ActionType.REDACT,
+                tags=["pci", "cvv"],
+            ),
+            PatternDefinition(
+                name="security_code",
+                regex=r"(?i)(?:SECURITY\s*CODE|CARD\s*CODE|VERIFICATION\s*(?:CODE|VALUE))[:\s#]*[0-9]{3,4}",
+                severity=Severity.CRITICAL,
+                description="Card security/verification code",
+                default_action=ActionType.REDACT,
+                tags=["pci", "cvv"],
+            ),
+
+            # =================================================================
+            # Expiration Dates
+            # =================================================================
+            PatternDefinition(
+                name="expiry_labeled",
+                regex=r"(?i)(?:EXP(?:IRY|IRATION)?|VALID\s*(?:THRU|UNTIL))[:\s]*(?:0[1-9]|1[0-2])[\s/\-]?(?:[0-9]{2}|20[2-9][0-9])",
+                severity=Severity.HIGH,
+                description="Card expiration date",
+                default_action=ActionType.WARN,
+                tags=["pci", "expiry"],
+            ),
+
+            # =================================================================
+            # Bank Account Information
+            # =================================================================
+            PatternDefinition(
+                name="bank_account",
+                regex=r"(?i)(?:BANK\s*)?(?:ACCOUNT|ACCT)[\s#:]*[0-9]{8,17}",
+                severity=Severity.HIGH,
+                description="Bank account number",
+                default_action=ActionType.WARN,
+                tags=["pci", "bank", "account"],
+            ),
+            PatternDefinition(
+                name="routing_number",
+                regex=r"(?i)(?:ROUTING|ABA|RTN)[\s#:]*[0-9]{9}",
+                severity=Severity.HIGH,
+                description="Bank routing number",
+                default_action=ActionType.WARN,
+                tags=["pci", "bank", "routing"],
+            ),
+            PatternDefinition(
+                name="iban",
+                regex=r"\b[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}(?:[A-Z0-9]?){0,16}\b",
+                severity=Severity.HIGH,
+                description="International Bank Account Number (IBAN)",
+                default_action=ActionType.WARN,
+                tags=["pci", "bank", "iban"],
+            ),
+            PatternDefinition(
+                name="swift_bic",
+                regex=r"(?i)(?:SWIFT|BIC)[:\s]*[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?",
+                severity=Severity.MEDIUM,
+                description="SWIFT/BIC code",
+                default_action=ActionType.WARN,
+                tags=["pci", "bank", "swift"],
+            ),
+
+            # =================================================================
+            # Payment Tokens and References
+            # =================================================================
+            PatternDefinition(
+                name="stripe_token",
+                regex=r"(?i)(?:tok|pm|pi|ch|cus|sub|inv|in)_[a-zA-Z0-9]{14,}",
+                severity=Severity.MEDIUM,
+                description="Stripe payment token/ID",
+                default_action=ActionType.WARN,
+                tags=["pci", "token", "stripe"],
+            ),
+            PatternDefinition(
+                name="paypal_transaction",
+                regex=r"(?i)(?:PAYPAL|PP)\s*(?:TRANSACTION|TXN|ID)[:\s#]*[A-Z0-9]{17}",
+                severity=Severity.MEDIUM,
+                description="PayPal transaction ID",
+                default_action=ActionType.WARN,
+                tags=["pci", "token", "paypal"],
+            ),
+
+            # =================================================================
+            # Cardholder Data
+            # =================================================================
+            PatternDefinition(
+                name="cardholder_name",
+                regex=r"(?i)(?:CARDHOLDER|CARD\s*HOLDER|NAME\s*ON\s*CARD)[:\s]+[A-Z][a-z]+(?:\s+[A-Z][a-z]+)+",
+                severity=Severity.MEDIUM,
+                description="Cardholder name",
+                default_action=ActionType.WARN,
+                tags=["pci", "cardholder"],
+            ),
+            PatternDefinition(
+                name="billing_address",
+                regex=r"(?i)(?:BILLING\s*ADDRESS|CARD\s*ADDRESS)[:\s]+[\w\s,.-]+",
+                severity=Severity.LOW,
+                description="Billing address",
+                default_action=ActionType.WARN,
+                tags=["pci", "cardholder", "address"],
+            ),
+
+            # =================================================================
+            # PCI Context Markers
+            # =================================================================
+            PatternDefinition(
+                name="pan_marker",
+                regex=r"(?i)\bPAN\b[:\s]+|PRIMARY\s*ACCOUNT\s*NUMBER",
+                severity=Severity.HIGH,
+                description="Primary Account Number reference",
+                default_action=ActionType.WARN,
+                tags=["pci", "marker"],
+            ),
+            PatternDefinition(
+                name="magnetic_stripe",
+                regex=r"(?i)(?:TRACK\s*[12]|MAGNETIC\s*STRIPE|MAG\s*STRIPE)\s*DATA",
+                severity=Severity.CRITICAL,
+                description="Magnetic stripe data reference",
+                default_action=ActionType.BLOCK,
+                tags=["pci", "magnetic", "sensitive"],
+            ),
+            PatternDefinition(
+                name="pin_block",
+                regex=r"(?i)PIN\s*BLOCK|ENCRYPTED\s*PIN",
+                severity=Severity.CRITICAL,
+                description="PIN block reference",
+                default_action=ActionType.BLOCK,
+                tags=["pci", "pin", "sensitive"],
+            ),
+        ]
+
+        return self._patterns
+
+    def scan(self, content: str, direction: ScanDirection) -> "ScanResult":
+        """
+        Scan content for PCI data with Luhn validation for card numbers.
+
+        Overrides base scan to add Luhn validation for card numbers.
+        """
+        from tweek.plugins.base import ScanResult
+
+        result = super().scan(content, direction)
+
+        if not self._validate_luhn:
+            return result
+
+        # Filter card findings through Luhn validation
+        validated_findings = []
+        for finding in result.findings:
+            if finding.pattern_name in (
+                "visa", "mastercard", "mastercard_2_series", "amex",
+                "discover", "diners", "jcb", "generic_card"
+            ):
+                # Validate with Luhn
+                if luhn_checksum(finding.matched_text):
+                    validated_findings.append(finding)
+                # else: skip false positive
+            else:
+                # Non-card patterns pass through
+                validated_findings.append(finding)
+
+        return ScanResult(
+            passed=len(validated_findings) == 0,
+            findings=validated_findings,
+            action=self._determine_action(validated_findings),
+            message=self._format_message(validated_findings, direction),
+            scan_direction=direction,
+            plugin_name=self.name
+        )
+
+    def _format_message(
+        self,
+        findings: List,
+        direction: ScanDirection
+    ) -> Optional[str]:
+        """Format a PCI-specific message."""
+        if not findings:
+            return None
+
+        card_findings = [f for f in findings if "card" in f.metadata.get("pattern_tags", [])]
+        cvv_findings = [f for f in findings if "cvv" in f.metadata.get("pattern_tags", [])]
+
+        msg_parts = []
+
+        if direction == ScanDirection.OUTPUT:
+            msg_parts.append(f"WARNING: LLM output contains {len(findings)} potential PCI data element(s).")
+        else:
+            msg_parts.append(f"ALERT: Input contains {len(findings)} potential PCI data element(s).")
+
+        if card_findings:
+            msg_parts.append(f"  {len(card_findings)} card number(s) detected (Luhn validated)")
+        if cvv_findings:
+            msg_parts.append(f"  {len(cvv_findings)} CVV/security code(s) detected")
+
+        msg_parts.append("This data must be protected per PCI-DSS requirements.")
+
+        return "\n".join(msg_parts)

tweek/plugins/compliance/soc2.py

@@ -0,0 +1,275 @@
+#!/usr/bin/env python3
+"""
+Tweek SOC2 Compliance Plugin
+
+Detects patterns indicating SOC2-relevant security and compliance concerns:
+- Access control indicators (passwords, API keys in logs)
+- Audit log patterns (security events, access logs)
+- Change management markers
+- Incident response indicators
+- Risk assessment markers
+- Security policy references
+
+SOC2 Trust Services Criteria:
+- Security
+- Availability
+- Processing Integrity
+- Confidentiality
+- Privacy
+
+Supports bidirectional scanning:
+- OUTPUT: Detect LLM generating content that could violate SOC2 controls
+- INPUT: Detect sensitive SOC2-relevant data in incoming content
+"""
+
+from typing import Optional, List, Dict, Any
+from tweek.plugins.base import (
+    CompliancePlugin,
+    ScanDirection,
+    ActionType,
+    Severity,
+    PatternDefinition,
+)
+
+
+class SOC2CompliancePlugin(CompliancePlugin):
+    """
+    SOC2 compliance plugin.
+
+    Detects patterns relevant to SOC2 Trust Services Criteria,
+    helping prevent exposure of security-sensitive information.
+    """
+
+    VERSION = "1.0.0"
+    DESCRIPTION = "Detect SOC2-relevant security and compliance patterns"
+    AUTHOR = "Tweek"
+    REQUIRES_LICENSE = "enterprise"
+    TAGS = ["compliance", "soc2", "security", "audit"]
+
+    def __init__(self, config: Optional[Dict[str, Any]] = None):
+        super().__init__(config)
+        self._patterns: Optional[List[PatternDefinition]] = None
+
+    @property
+    def name(self) -> str:
+        return "soc2"
+
+    @property
+    def scan_direction(self) -> ScanDirection:
+        direction = self._config.get("scan_direction", "both")
+        return ScanDirection(direction)
+
+    def get_patterns(self) -> List[PatternDefinition]:
+        """Return SOC2 compliance patterns."""
+        if self._patterns is not None:
+            return self._patterns
+
+        self._patterns = [
+            # =================================================================
+            # Access Control (Security Criteria)
+            # =================================================================
+            PatternDefinition(
+                name="access_credentials",
+                regex=r"(?i)(?:admin|root|service)\s*(?:password|pwd|pass|credential)[:\s=]+\S+",
+                severity=Severity.CRITICAL,
+                description="Administrative credentials exposure",
+                default_action=ActionType.BLOCK,
+                tags=["soc2", "security", "access-control"],
+            ),
+            PatternDefinition(
+                name="api_key_exposure",
+                regex=r"(?i)(?:api[_-]?key|auth[_-]?token|bearer[_-]?token|access[_-]?token)[:\s=]+['\"]?[\w-]{20,}['\"]?",
+                severity=Severity.CRITICAL,
+                description="API key or token exposure",
+                default_action=ActionType.REDACT,
+                tags=["soc2", "security", "access-control"],
+            ),
+            PatternDefinition(
+                name="connection_string",
+                regex=r"(?i)(?:connection[_-]?string|conn[_-]?str)[:\s=]+['\"]?[^'\"]{20,}['\"]?",
+                severity=Severity.HIGH,
+                description="Database connection string exposure",
+                default_action=ActionType.REDACT,
+                tags=["soc2", "security", "access-control"],
+            ),
+            PatternDefinition(
+                name="private_key_header",
+                regex=r"-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----",
+                severity=Severity.CRITICAL,
+                description="Private key header detected",
+                default_action=ActionType.BLOCK,
+                tags=["soc2", "security", "cryptography"],
+            ),
+
+            # =================================================================
+            # Audit Logging (Security/Processing Integrity)
+            # =================================================================
+            PatternDefinition(
+                name="audit_log_tampering",
+                regex=r"(?i)(?:delete|truncate|drop)\s+(?:from\s+)?(?:audit|security|access)[_-]?logs?",
+                severity=Severity.CRITICAL,
+                description="Audit log tampering attempt",
+                default_action=ActionType.BLOCK,
+                tags=["soc2", "audit", "integrity"],
+            ),
+            PatternDefinition(
+                name="log_manipulation",
+                regex=r"(?i)(?:modify|alter|update)\s+(?:audit|security)[_-]?(?:log|trail|record)",
+                severity=Severity.HIGH,
+                description="Security log manipulation",
+                default_action=ActionType.WARN,
+                tags=["soc2", "audit", "integrity"],
+            ),
+            PatternDefinition(
+                name="disable_logging",
+                regex=r"(?i)(?:disable|stop|pause|turn\s*off)\s+(?:audit|security|access)[_-]?log",
+                severity=Severity.HIGH,
+                description="Attempt to disable security logging",
+                default_action=ActionType.WARN,
+                tags=["soc2", "audit"],
+            ),
+
+            # =================================================================
+            # Change Management (Processing Integrity)
+            # =================================================================
+            PatternDefinition(
+                name="unauthorized_change",
+                regex=r"(?i)(?:bypass|skip|disable)\s+(?:change[_-]?management|approval|review)",
+                severity=Severity.HIGH,
+                description="Change management bypass attempt",
+                default_action=ActionType.WARN,
+                tags=["soc2", "change-management"],
+            ),
+            PatternDefinition(
+                name="production_direct_access",
+                regex=r"(?i)direct\s+(?:production|prod)\s+(?:access|modification|change)",
+                severity=Severity.MEDIUM,
+                description="Direct production access indication",
+                default_action=ActionType.WARN,
+                tags=["soc2", "change-management"],
+            ),
+
+            # =================================================================
+            # Incident Response (Security/Availability)
+            # =================================================================
+            PatternDefinition(
+                name="security_incident",
+                regex=r"(?i)(?:security\s+)?(?:incident|breach|compromise|intrusion)\s+(?:report|detected|confirmed)",
+                severity=Severity.HIGH,
+                description="Security incident indicator",
+                default_action=ActionType.WARN,
+                tags=["soc2", "incident-response"],
+            ),
+            PatternDefinition(
+                name="data_breach",
+                regex=r"(?i)data\s+(?:breach|leak|exposure|exfiltration)",
+                severity=Severity.CRITICAL,
+                description="Data breach indicator",
+                default_action=ActionType.WARN,
+                tags=["soc2", "incident-response", "confidentiality"],
+            ),
+            PatternDefinition(
+                name="unauthorized_access",
+                regex=r"(?i)unauthorized\s+(?:access|login|entry|attempt)",
+                severity=Severity.HIGH,
+                description="Unauthorized access indicator",
+                default_action=ActionType.WARN,
+                tags=["soc2", "incident-response", "security"],
+            ),
+
+            # =================================================================
+            # Confidentiality Controls
+            # =================================================================
+            PatternDefinition(
+                name="confidential_marker",
+                regex=r"(?i)\[?\s*(?:CONFIDENTIAL|INTERNAL\s+ONLY|RESTRICTED)\s*\]?",
+                severity=Severity.MEDIUM,
+                description="Confidentiality marking",
+                default_action=ActionType.WARN,
+                tags=["soc2", "confidentiality"],
+            ),
+            PatternDefinition(
+                name="customer_data_exposure",
+                regex=r"(?i)(?:customer|client|user)\s+(?:pii|personal\s+data|sensitive\s+data)",
+                severity=Severity.HIGH,
+                description="Customer sensitive data reference",
+                default_action=ActionType.WARN,
+                tags=["soc2", "confidentiality", "privacy"],
+            ),
+
+            # =================================================================
+            # Risk Assessment
+            # =================================================================
+            PatternDefinition(
+                name="vulnerability_disclosure",
+                regex=r"(?i)(?:vulnerability|cve-\d{4}-\d+|security\s+flaw)\s+(?:in|affecting|found)",
+                severity=Severity.MEDIUM,
+                description="Vulnerability disclosure",
+                default_action=ActionType.WARN,
+                tags=["soc2", "risk", "security"],
+            ),
+            PatternDefinition(
+                name="risk_assessment",
+                regex=r"(?i)(?:high|critical)\s+risk\s+(?:identified|assessment|finding)",
+                severity=Severity.MEDIUM,
+                description="High risk assessment finding",
+                default_action=ActionType.WARN,
+                tags=["soc2", "risk"],
+            ),
+
+            # =================================================================
+            # Security Policy
+            # =================================================================
+            PatternDefinition(
+                name="policy_exception",
+                regex=r"(?i)(?:security\s+)?policy\s+exception\s+(?:granted|approved|requested)",
+                severity=Severity.MEDIUM,
+                description="Security policy exception",
+                default_action=ActionType.WARN,
+                tags=["soc2", "policy"],
+            ),
+            PatternDefinition(
+                name="compliance_violation",
+                regex=r"(?i)(?:compliance|regulatory|policy)\s+violation",
+                severity=Severity.HIGH,
+                description="Compliance violation indicator",
+                default_action=ActionType.WARN,
+                tags=["soc2", "compliance"],
+            ),
+        ]
+
+        return self._patterns
+
+    def _format_message(
+        self,
+        findings: List,
+        direction: ScanDirection
+    ) -> Optional[str]:
+        """Format a SOC2-specific message."""
+        if not findings:
+            return None
+
+        # Group findings by SOC2 criteria
+        security = [f for f in findings if "security" in f.metadata.get("pattern_tags", [])]
+        confidentiality = [f for f in findings if "confidentiality" in f.metadata.get("pattern_tags", [])]
+        audit = [f for f in findings if "audit" in f.metadata.get("pattern_tags", [])]
+
+        if direction == ScanDirection.OUTPUT:
+            lines = [
+                f"WARNING: LLM output contains {len(findings)} SOC2-relevant finding(s).",
+                "Review for potential security/compliance concerns:"
+            ]
+        else:
+            lines = [
+                f"ALERT: Input contains {len(findings)} SOC2-relevant finding(s).",
+                "Verify proper handling according to security policies:"
+            ]
+
+        if security:
+            lines.append(f"  Security: {len(security)} finding(s)")
+        if confidentiality:
+            lines.append(f"  Confidentiality: {len(confidentiality)} finding(s)")
+        if audit:
+            lines.append(f"  Audit: {len(audit)} finding(s)")
+
+        return "\n".join(lines)

tweek/plugins/detectors/__init__.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+"""
+Tweek Tool Detector Plugins
+
+Detector plugins identify installed LLM tools and IDEs:
+- Moltbot: AI coding assistant
+- Cursor: AI-powered IDE
+- Continue.dev: VS Code AI extension
+- Copilot: GitHub Copilot
+- Windsurf: Codeium AI IDE
+
+Detection helps:
+- Identify proxy conflicts
+- Configure appropriate protection
+- Suggest integration options
+"""
+
+from tweek.plugins.detectors.moltbot import MoltbotDetector
+from tweek.plugins.detectors.cursor import CursorDetector
+from tweek.plugins.detectors.continue_dev import ContinueDetector
+from tweek.plugins.detectors.copilot import CopilotDetector
+from tweek.plugins.detectors.windsurf import WindsurfDetector
+
+__all__ = [
+    "MoltbotDetector",
+    "CursorDetector",
+    "ContinueDetector",
+    "CopilotDetector",
+    "WindsurfDetector",
+]