@aarmos/bridge 0.1.0

package/dist/commands/run.js

@@ -0,0 +1,279 @@
+import path from "node:path";
+import fs from "node:fs/promises";
+import fssync from "node:fs";
+import crypto from "node:crypto";
+import { createSession } from "../session.js";
+import { handleRpc } from "../rpc/router.js";
+import { loadPlaybook, verifyPlaybookSignature } from "../lib/playbook.js";
+import { classifyStep, resolveEffectiveApproval } from "../lib/scope-templates.js";
+import { listInstalledPacks } from "../lib/pack.js";
+import { runSimulate } from "./simulate.js";
+export async function startRun(opts) {
+    const workspace = path.resolve(opts.workspace ?? process.cwd());
+    const playbook = await loadPlaybook(opts.playbook);
+    // COMPILE-TIME LAYER: signature enforcement (opt-in).
+    if (opts.enforceSignatures) {
+        if (!playbook.signature) {
+            throw new Error("--enforce-signatures: playbook is unsigned. Run `aarmos playbook sign` first.");
+        }
+        const v = verifyPlaybookSignature(playbook);
+        if (!v.ok)
+            throw new Error(`--enforce-signatures: ${v.reason}`);
+        if (opts.trustedPubKeys && opts.trustedPubKeys.length > 0) {
+            if (!opts.trustedPubKeys.includes(playbook.signature.pubKey)) {
+                throw new Error(`--enforce-signatures: signer ${playbook.signature.pubKey} not in --trusted-pubkey set`);
+            }
+        }
+    }
+    // COMPILE-TIME LAYER: --dry short-circuits to the simulator. No side effects.
+    if (opts.dry) {
+        await runSimulate({
+            playbook: opts.playbook,
+            workspace: opts.workspace,
+            extraShellAllow: opts.extraShellAllow,
+            httpAllow: opts.httpAllow,
+            mcpAllow: opts.mcpAllow,
+            strict: true,
+        });
+        return;
+    }
+    // Auto-widen allowlists from any installed packs so operators don't
+    // have to re-pass --allow-http/--allow-mcp for pack-shipped playbooks.
+    const packAllow = await collectPackAllow(workspace);
+    const session = createSession({
+        workspace,
+        extraShellAllow: [...opts.extraShellAllow, ...packAllow.shell],
+        httpAllow: [...(opts.httpAllow ?? []), ...packAllow.http],
+        mcpAllow: [...(opts.mcpAllow ?? []), ...packAllow.mcp],
+    });
+    const receiptsPath = path.resolve(opts.receipts);
+    await fs.mkdir(path.dirname(receiptsPath), { recursive: true });
+    log("");
+    log("  aarmos run (headless)");
+    log(`    workspace   : ${workspace}`);
+    log(`    playbook    : ${opts.playbook}  (${playbook.name}, ${playbook.steps.length} step[s])`);
+    log(`    receipts    : ${receiptsPath}`);
+    log(`    kill-switch : ${opts.killSwitch ?? "(none)"}`);
+    log(`    ceiling     : ${opts.maxPerHour}/hour`);
+    log(`    heartbeat   : ${opts.heartbeatUrl ?? "(none)"}`);
+    log(`    mode        : ${opts.once ? "single pass" : "loop"}`);
+    log("");
+    // Per-step schedule state.
+    const nextRunAt = new Map();
+    const now = Date.now();
+    for (const step of playbook.steps) {
+        nextRunAt.set(step.id, now);
+    }
+    const applyTimestamps = []; // rolling 1h window of applied runs
+    let stopped = false;
+    const stop = (why) => {
+        if (stopped)
+            return;
+        stopped = true;
+        log(`\n  [stop] ${why}`);
+    };
+    process.on("SIGINT", () => stop("SIGINT"));
+    process.on("SIGTERM", () => stop("SIGTERM"));
+    const heartbeatTimer = opts.heartbeatUrl
+        ? setInterval(() => {
+            void postHeartbeat(opts, {
+                playbook: playbook.name,
+                runsLastHour: applyTimestamps.length,
+                killed: killSwitchTripped(opts.killSwitch),
+            });
+        }, 30_000)
+        : null;
+    try {
+        do {
+            if (killSwitchTripped(opts.killSwitch)) {
+                for (const step of playbook.steps) {
+                    const r = makeReceipt(playbook, step, { mode: "skipped-killed" });
+                    await appendReceipt(receiptsPath, r);
+                    await postReceipt(opts, r);
+                }
+                stop(`kill-switch present at ${opts.killSwitch}`);
+                break;
+            }
+            const tickAt = Date.now();
+            pruneWindow(applyTimestamps, tickAt);
+            for (const step of playbook.steps) {
+                if (stopped)
+                    break;
+                const due = (nextRunAt.get(step.id) ?? 0) <= tickAt;
+                if (!due)
+                    continue;
+                let receipt;
+                try {
+                    // Governance primitive: classify + resolve effective approval per tick.
+                    const cls = classifyStep(step);
+                    const approval = resolveEffectiveApproval(step, cls, {
+                        playbookSigned: Boolean(playbook.signature),
+                    });
+                    const preview = await callRpc(session, step.kind, step.params);
+                    const isPrev = isPreviewEnvelope(preview);
+                    if (approval.forcedApproval || !approval.autoApply) {
+                        receipt = makeReceipt(playbook, step, {
+                            mode: "needs-approval",
+                            preview: isPrev ? preview.action.preview : preview,
+                            risk: cls.rank,
+                            riskReason: cls.reason,
+                            approvalReason: approval.reason,
+                        });
+                    }
+                    else if (applyTimestamps.length >= opts.maxPerHour) {
+                        receipt = makeReceipt(playbook, step, { mode: "skipped-ceiling", risk: cls.rank });
+                    }
+                    else if (!isPrev) {
+                        receipt = makeReceipt(playbook, step, {
+                            mode: "dry-run",
+                            preview,
+                            risk: cls.rank,
+                        });
+                    }
+                    else {
+                        const applyRes = (await callRpc(session, "apply.batch", {
+                            actions: [{ kind: step.kind, params: step.params }],
+                        }));
+                        const first = applyRes.results[0];
+                        if (first?.ok) {
+                            applyTimestamps.push(Date.now());
+                            receipt = makeReceipt(playbook, step, {
+                                mode: "applied",
+                                preview: preview.action.preview,
+                                result: first.result,
+                                risk: cls.rank,
+                            });
+                        }
+                        else {
+                            receipt = makeReceipt(playbook, step, {
+                                mode: "error",
+                                preview: preview.action.preview,
+                                error: first?.error ?? "apply.batch returned no result",
+                                risk: cls.rank,
+                            });
+                        }
+                    }
+                }
+                catch (err) {
+                    receipt = makeReceipt(playbook, step, {
+                        mode: "error",
+                        error: err.message,
+                    });
+                }
+                await appendReceipt(receiptsPath, receipt);
+                await postReceipt(opts, receipt);
+                log(`  [${receipt.mode}] ${step.label}`);
+                if (!opts.once && step.intervalSec && step.intervalSec > 0) {
+                    nextRunAt.set(step.id, Date.now() + step.intervalSec * 1000);
+                }
+            }
+            if (opts.once)
+                break;
+            // Sleep until the next step is due, but wake at least every 5s so
+            // kill-switch / SIGINT are responsive.
+            const soonest = Math.min(...playbook.steps.map((s) => nextRunAt.get(s.id) ?? Infinity));
+            const waitMs = Math.max(1_000, Math.min(5_000, soonest - Date.now()));
+            await sleep(waitMs);
+        } while (!stopped);
+    }
+    finally {
+        if (heartbeatTimer)
+            clearInterval(heartbeatTimer);
+    }
+}
+// ---------- receipts --------------------------------------------------------
+function makeReceipt(pb, step, extra) {
+    const base = {
+        ts: new Date().toISOString(),
+        playbook: pb.name,
+        stepId: step.id,
+        label: step.label,
+        kind: step.kind,
+        mode: extra.mode,
+        preview: extra.preview,
+        result: extra.result,
+        error: extra.error,
+        risk: extra.risk,
+        riskReason: extra.riskReason,
+        approvalReason: extra.approvalReason,
+    };
+    const hash = crypto.createHash("sha256").update(JSON.stringify(base)).digest("hex");
+    return { ...base, hash };
+}
+async function appendReceipt(file, r) {
+    await fs.appendFile(file, JSON.stringify(r) + "\n", "utf8");
+}
+/** Union of all `allow` entries from installed packs at `<workspace>/.aarmos/packs`. */
+async function collectPackAllow(workspace) {
+    const packs = await listInstalledPacks(path.join(workspace, ".aarmos/packs"));
+    const shell = new Set();
+    const http = new Set();
+    const mcp = new Set();
+    for (const p of packs) {
+        for (const b of p.allow?.shell ?? [])
+            shell.add(b);
+        for (const h of p.allow?.http ?? [])
+            http.add(h);
+        for (const m of p.allow?.mcp ?? [])
+            mcp.add(m);
+    }
+    return { shell: [...shell], http: [...http], mcp: [...mcp] };
+}
+// ---------- kill switch + rate window ---------------------------------------
+function killSwitchTripped(file) {
+    if (!file)
+        return false;
+    try {
+        fssync.accessSync(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function pruneWindow(ts, now) {
+    const cutoff = now - 60 * 60 * 1000;
+    while (ts.length > 0 && ts[0] < cutoff)
+        ts.shift();
+}
+// ---------- heartbeat / receipt forwarding ----------------------------------
+async function postReceipt(opts, r) {
+    if (!opts.heartbeatUrl)
+        return;
+    await safePost(opts.heartbeatUrl.replace(/\/$/, "") + "/receipts", opts.heartbeatToken, r);
+}
+async function postHeartbeat(opts, body) {
+    await safePost(opts.heartbeatUrl.replace(/\/$/, "") + "/heartbeat", opts.heartbeatToken, { ...body, ts: new Date().toISOString() });
+}
+async function safePost(url, token, body) {
+    try {
+        await fetch(url, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                ...(token ? { authorization: `Bearer ${token}` } : {}),
+            },
+            body: JSON.stringify(body),
+        });
+    }
+    catch {
+        // Heartbeat is best-effort; a dead sink must not crash the loop.
+    }
+}
+function isPreviewEnvelope(x) {
+    return !!x && typeof x === "object" && x.preview === true;
+}
+async function callRpc(session, method, params) {
+    const res = await handleRpc(session, { id: 1, type: "rpc", method, params });
+    if ("type" in res && res.type === "error")
+        throw new Error(res.error);
+    if ("type" in res && res.type === "result")
+        return res.result;
+    throw new Error("unexpected rpc envelope");
+}
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+// eslint-disable-next-line no-console
+function log(s) { console.log(s); }
+//# sourceMappingURL=run.js.map

package/dist/commands/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAoC,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA0D5C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAgB;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEnD,sDAAsD;IACtD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,CAAC,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,gCAAgC,QAAQ,CAAC,SAAS,CAAC,MAAM,8BAA8B,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,CAAC;YAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,CAAC;QAC5B,SAAS;QACT,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;QAC9D,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC;QACzD,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC;KACvD,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAIhE,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC/B,GAAG,CAAC,qBAAqB,SAAS,EAAE,CAAC,CAAC;IACtC,GAAG,CAAC,qBAAqB,IAAI,CAAC,QAAQ,MAAM,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,CAAC;IAChG,GAAG,CAAC,qBAAqB,YAAY,EAAE,CAAC,CAAC;IACzC,GAAG,CAAC,qBAAqB,IAAI,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IACxD,GAAG,CAAC,qBAAqB,IAAI,CAAC,UAAU,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,qBAAqB,IAAI,CAAC,YAAY,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC1D,GAAG,CAAC,qBAAqB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,GAAG,CAAC,EAAE,CAAC,CAAC;IAER,2BAA2B;IAC3B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,eAAe,GAAa,EAAE,CAAC,CAAC,oCAAoC;IAE1E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE;QAC3B,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,GAAG,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAE7C,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY;QACtC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;YACf,KAAK,aAAa,CAAC,IAAI,EAAE;gBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,YAAY,EAAE,eAAe,CAAC,MAAM;gBACpC,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC,EAAE,MAAM,CAAC;QACZ,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,CAAC;QACH,GAAG,CAAC;YACF,IAAI,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBAClC,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;oBAClE,MAAM,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;oBACrC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC7B,CAAC;gBACD,IAAI,CAAC,0BAA0B,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;gBAClD,MAAM;YACR,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,WAAW,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAErC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAClC,IAAI,OAAO;oBAAE,MAAM;gBACnB,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC;gBACpD,IAAI,CAAC,GAAG;oBAAE,SAAS;gBAEnB,IAAI,OAAgB,CAAC;gBACrB,IAAI,CAAC;oBACH,wEAAwE;oBACxE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;oBAC/B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,EAAE,GAAG,EAAE;wBACnD,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;qBAC5C,CAAC,CAAC;oBAEH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;oBAE1C,IAAI,QAAQ,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;wBACnD,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE;4BACpC,IAAI,EAAE,gBAAgB;4BACtB,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;4BAClD,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,UAAU,EAAE,GAAG,CAAC,MAAM;4BACtB,cAAc,EAAE,QAAQ,CAAC,MAAM;yBAChC,CAAC,CAAC;oBACL,CAAC;yBAAM,IAAI,eAAe,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;wBACrD,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;oBACrF,CAAC;yBAAM,IAAI,CAAC,MAAM,EAAE,CAAC;wBACnB,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE;4BACpC,IAAI,EAAE,SAAS;4BACf,OAAO;4BACP,IAAI,EAAE,GAAG,CAAC,IAAI;yBACf,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE;4BACtD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;yBACpD,CAAC,CAGD,CAAC;wBACF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;wBAClC,IAAI,KAAK,EAAE,EAAE,EAAE,CAAC;4BACd,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;4BACjC,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE;gCACpC,IAAI,EAAE,SAAS;gCACf,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;gCAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;gCACpB,IAAI,EAAE,GAAG,CAAC,IAAI;6BACf,CAAC,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE;gCACpC,IAAI,EAAE,OAAO;gCACb,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;gCAC/B,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,gCAAgC;gCACvD,IAAI,EAAE,GAAG,CAAC,IAAI;6BACf,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE;wBACpC,IAAI,EAAE,OAAO;wBACb,KAAK,EAAG,GAAa,CAAC,OAAO;qBAC9B,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACjC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAEzC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;oBAC3D,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YAED,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YAErB,kEAAkE;YAClE,uCAAuC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC;YACxF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC,QAAQ,CAAC,OAAO,EAAE;IACrB,CAAC;YAAS,CAAC;QACT,IAAI,cAAc;YAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,+EAA+E;AAI/E,SAAS,WAAW,CAClB,EAAY,EACZ,IAAkB,EAClB,KAA+C;IAE/C,MAAM,IAAI,GAA0B;QAClC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,QAAQ,EAAE,EAAE,CAAC,IAAI;QACjB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpF,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,CAAU;IACnD,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IAC/C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,EAAY,EAAE,GAAW;IAC5C,MAAM,MAAM,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM;QAAE,EAAE,CAAC,KAAK,EAAE,CAAC;AACrD,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,CAAU;IACrD,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO;IAC/B,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAgB,EAChB,IAAiE;IAEjE,MAAM,QAAQ,CACZ,IAAI,CAAC,YAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,YAAY,EACpD,IAAI,CAAC,cAAc,EACnB,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,KAAyB,EAAE,IAAa;IAC3E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AASD,SAAS,iBAAiB,CAAC,CAAU;IACnC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAA2B,CAAC,OAAO,KAAK,IAAI,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,OAAwC,EACxC,MAAc,EACd,MAAe;IAEf,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAQ,GAA2B,CAAC,MAAM,CAAC;IACvF,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,sCAAsC;AACtC,SAAS,GAAG,CAAC,CAAS,IAAU,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/commands/simulate.js

@@ -0,0 +1,181 @@
+// `aarmos simulate` (and `aarmos run --dry`) — compile-time governance.
+//
+// Loads a playbook, runs the same dry-run pipeline the interactive bridge
+// uses, and prints a per-step verdict WITHOUT applying anything. This is
+// the velocity feature: it lets a developer see which steps would be
+// rejected by policy, blocked by autoApply, or throttled — before letting
+// the unattended loop run for real.
+//
+// Runtime enforcement is unchanged. This is additive.
+import path from "node:path";
+import { createSession } from "../session.js";
+import { handleRpc } from "../rpc/router.js";
+import { lintPlaybook, loadPlaybook, verifyPlaybookSignature, } from "../lib/playbook.js";
+import { classifyStep, resolveEffectiveApproval } from "../lib/scope-templates.js";
+import { listInstalledPacks } from "../lib/pack.js";
+export async function runSimulate(opts) {
+    const workspace = path.resolve(opts.workspace ?? process.cwd());
+    const pb = await loadPlaybook(opts.playbook);
+    // Auto-widen from installed packs, same rule as `aarmos run`.
+    const packAllow = await collectPackAllow(workspace);
+    const session = createSession({
+        workspace,
+        extraShellAllow: [...opts.extraShellAllow, ...packAllow.shell],
+        httpAllow: [...(opts.httpAllow ?? []), ...packAllow.http],
+        mcpAllow: [...(opts.mcpAllow ?? []), ...packAllow.mcp],
+    });
+    const sigCheck = pb.signature ? verifyPlaybookSignature(pb) : { ok: false, reason: "unsigned" };
+    const lint = lintPlaybook(pb);
+    const steps = [];
+    for (const step of pb.steps) {
+        steps.push(await simulateStep(session, pb, step));
+    }
+    const summary = {
+        total: steps.length,
+        wouldApply: steps.filter((s) => s.verdict === "would-apply").length,
+        needsApproval: steps.filter((s) => s.verdict === "needs-approval").length,
+        wouldFail: steps.filter((s) => s.verdict === "would-fail" || s.verdict === "unsupported").length,
+        destructive: steps.filter((s) => s.risk === "destructive").length,
+    };
+    const report = {
+        playbook: opts.playbook,
+        signature: {
+            present: Boolean(pb.signature),
+            ok: pb.signature ? sigCheck.ok : undefined,
+            reason: pb.signature ? sigCheck.reason : undefined,
+            pubKey: pb.signature?.pubKey,
+        },
+        lint,
+        steps,
+        summary,
+    };
+    if (opts.json) {
+        // eslint-disable-next-line no-console
+        console.log(JSON.stringify(report, null, 2));
+    }
+    else {
+        printHuman(report);
+    }
+    if (opts.strict && summary.wouldFail > 0) {
+        process.exitCode = 2;
+    }
+    return report;
+}
+async function simulateStep(session, pb, step) {
+    const autoApply = Boolean(step.autoApply);
+    const cls = classifyStep(step);
+    const approval = resolveEffectiveApproval(step, cls, {
+        playbookSigned: Boolean(pb.signature),
+    });
+    try {
+        const preview = await callRpc(session, step.kind, step.params);
+        const summary = summarizePreview(preview);
+        if (approval.forcedApproval || !approval.autoApply) {
+            return {
+                id: step.id,
+                label: step.label,
+                kind: step.kind,
+                autoApply,
+                risk: cls.rank,
+                riskReason: cls.reason,
+                verdict: "needs-approval",
+                reason: approval.reason ??
+                    (autoApply
+                        ? "risk-gated"
+                        : "autoApply not set — human approval required in the PWA"),
+                previewSummary: summary,
+            };
+        }
+        return {
+            id: step.id,
+            label: step.label,
+            kind: step.kind,
+            autoApply,
+            risk: cls.rank,
+            riskReason: cls.reason,
+            verdict: "would-apply",
+            previewSummary: summary,
+        };
+    }
+    catch (err) {
+        const msg = err.message;
+        return {
+            id: step.id,
+            label: step.label,
+            kind: step.kind,
+            autoApply,
+            risk: cls.rank,
+            riskReason: cls.reason,
+            verdict: "would-fail",
+            reason: msg,
+        };
+    }
+}
+async function collectPackAllow(workspace) {
+    const packs = await listInstalledPacks(path.join(workspace, ".aarmos/packs"));
+    const shell = new Set();
+    const http = new Set();
+    const mcp = new Set();
+    for (const p of packs) {
+        for (const b of p.allow?.shell ?? [])
+            shell.add(b);
+        for (const h of p.allow?.http ?? [])
+            http.add(h);
+        for (const m of p.allow?.mcp ?? [])
+            mcp.add(m);
+    }
+    return { shell: [...shell], http: [...http], mcp: [...mcp] };
+}
+function summarizePreview(preview) {
+    if (!preview || typeof preview !== "object")
+        return String(preview);
+    const p = preview;
+    const body = p.action?.preview ?? p.preview ?? preview;
+    const s = JSON.stringify(body);
+    return s.length > 200 ? s.slice(0, 200) + "…" : s;
+}
+async function callRpc(session, method, params) {
+    const res = await handleRpc(session, { id: 1, type: "rpc", method, params });
+    if ("type" in res && res.type === "error")
+        throw new Error(res.error);
+    if ("type" in res && res.type === "result")
+        return res.result;
+    throw new Error("unexpected rpc envelope");
+}
+function printHuman(r) {
+    const log = (s) => console.log(s); // eslint-disable-line no-console
+    log("");
+    log(`  aarmos simulate — ${r.playbook}`);
+    log("");
+    if (r.signature.present) {
+        log(`  signature   : ${r.signature.ok ? "OK" : "INVALID"} (${r.signature.pubKey?.slice(0, 16)}…)${r.signature.reason ? "  " + r.signature.reason : ""}`);
+    }
+    else {
+        log("  signature   : (unsigned — allowed in dev; blocked under --enforce-signatures)");
+    }
+    if (r.lint.length > 0) {
+        log("");
+        log("  lint:");
+        for (const f of r.lint) {
+            log(`    [${f.level}] ${f.stepId ? `${f.stepId}: ` : ""}${f.message}`);
+        }
+    }
+    log("");
+    log("  steps:");
+    for (const s of r.steps) {
+        const tag = s.verdict === "would-apply"
+            ? "would-apply    "
+            : s.verdict === "needs-approval"
+                ? "needs-approval "
+                : "would-fail     ";
+        log(`    [${tag}] ${s.id}  ${s.label}  (risk: ${s.risk} — ${s.riskReason})`);
+        if (s.reason)
+            log(`        reason: ${s.reason}`);
+        if (s.previewSummary)
+            log(`        preview: ${s.previewSummary}`);
+    }
+    log("");
+    log(`  summary     : ${r.summary.wouldApply} would-apply · ${r.summary.needsApproval} needs-approval · ${r.summary.wouldFail} would-fail · ${r.summary.destructive} destructive`);
+    log("");
+}
+//# sourceMappingURL=simulate.js.map

package/dist/commands/simulate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"simulate.js","sourceRoot":"","sources":["../../src/commands/simulate.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,qEAAqE;AACrE,0EAA0E;AAC1E,oCAAoC;AACpC,EAAE;AACF,sDAAsD;AACtD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,uBAAuB,GAGxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAwCpD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7C,8DAA8D;IAC9D,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,CAAC;QAC5B,SAAS;QACT,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;QAC9D,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC;QACzD,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC;KACvD,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChG,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,MAAM;QACnE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC,CAAC,MAAM;QACzE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,MAAM;QAChG,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,MAAM;KAClE,CAAC;IAEF,MAAM,MAAM,GAAmB;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE;YACT,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC;YAC9B,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAClD,MAAM,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM;SAC7B;QACD,IAAI;QACJ,KAAK;QACL,OAAO;KACR,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAwC,EACxC,EAAY,EACZ,IAAkB;IAElB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,EAAE,GAAG,EAAE;QACnD,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACnD,OAAO;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS;gBACT,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,UAAU,EAAE,GAAG,CAAC,MAAM;gBACtB,OAAO,EAAE,gBAAgB;gBACzB,MAAM,EACJ,QAAQ,CAAC,MAAM;oBACf,CAAC,SAAS;wBACR,CAAC,CAAC,YAAY;wBACd,CAAC,CAAC,wDAAwD,CAAC;gBAC/D,cAAc,EAAE,OAAO;aACxB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS;YACT,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,OAAO,EAAE,aAAa;YACtB,cAAc,EAAE,OAAO;SACxB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS;YACT,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IAC/C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,OAAgE,CAAC;IAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC;IACvD,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,OAAwC,EACxC,MAAc,EACd,MAAe;IAEf,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAQ,GAA2B,CAAC,MAAM,CAAC;IACvF,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,CAAiB;IACnC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iCAAiC;IAC5E,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CACD,mBAAmB,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KACvF,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EACnD,EAAE,CACH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,iFAAiF,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,SAAS,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,UAAU,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,GAAG,GACP,CAAC,CAAC,OAAO,KAAK,aAAa;YACzB,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB;gBAC9B,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,iBAAiB,CAAC;QAC1B,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;QAC7E,IAAI,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,CAAC,cAAc;YAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CACD,mBAAmB,CAAC,CAAC,OAAO,CAAC,UAAU,kBAAkB,CAAC,CAAC,OAAO,CAAC,aAAa,qBAAqB,CAAC,CAAC,OAAO,CAAC,SAAS,iBAAiB,CAAC,CAAC,OAAO,CAAC,WAAW,cAAc,CAC7K,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC"}

package/dist/commands/verify.js

@@ -0,0 +1,81 @@
+// aarmos verify — offline AVAR bundle verifier.
+//
+// Reads a .avar.zip, calls the same @avar/core.verifyBundle() the browser
+// drop-zone at /trust/verify uses. Exit codes match the plan:
+//   0 valid | 1 invalid | 2 warnings-with-strict | 3 malformed input.
+import { readFile } from "node:fs/promises";
+import { unzipSync, strFromU8 } from "fflate";
+import { verifyBundle, } from "@aarmos/avar-core";
+export async function runVerify(opts) {
+    let bundle;
+    try {
+        const buf = await readFile(opts.file);
+        bundle = await parseBundle(new Uint8Array(buf));
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ ok: false, error: "malformed", detail: msg }) + "\n");
+        }
+        else if (!opts.quiet) {
+            process.stderr.write(`✖ malformed bundle: ${msg}\n`);
+        }
+        return 3;
+    }
+    const report = await verifyBundle(bundle);
+    if (opts.json) {
+        process.stdout.write(JSON.stringify(report) + "\n");
+    }
+    else if (!opts.quiet) {
+        printHumanReport(opts.file, report);
+    }
+    if (report.verdict === "invalid")
+        return 1;
+    if (opts.strict && report.verdict === "valid-with-warnings")
+        return 2;
+    return 0;
+}
+async function parseBundle(bytes) {
+    const files = unzipSync(bytes);
+    const required = ["SPEC-VERSION", "manifest.json", "entries.ndjson", "pubkeys.json"];
+    const missing = required.filter((n) => !files[n]);
+    if (missing.length > 0) {
+        throw new Error(`missing required file(s): ${missing.join(", ")}`);
+    }
+    const specVersion = strFromU8(files["SPEC-VERSION"]).trim();
+    const manifest = JSON.parse(strFromU8(files["manifest.json"]));
+    const pubkeys = JSON.parse(strFromU8(files["pubkeys.json"]));
+    const entriesBytes = files["entries.ndjson"];
+    const entries = strFromU8(entriesBytes)
+        .split("\n")
+        .filter((l) => l.length > 0)
+        .map((l) => JSON.parse(l));
+    return { specVersion, manifest, entriesNdjsonBytes: entriesBytes, entries, pubkeys };
+}
+function printHumanReport(file, r) {
+    const verdictSym = r.verdict === "valid" ? "✔" : r.verdict === "valid-with-warnings" ? "!" : "✖";
+    const line = (ok, label) => `  ${ok ? "✔" : "✖"} ${label}`;
+    process.stdout.write(`${verdictSym} ${r.verdict.toUpperCase()}  ${file}\n` +
+        `  entries: ${r.entryCount}  signed: ${r.signedCount}  unsigned: ${r.unsignedCount}  unchained: ${r.unchainedCount}\n` +
+        line(r.formatOk, "format (SPEC-VERSION + manifest.format = avar/1)") + "\n" +
+        line(r.entriesSha256Ok, "envelope integrity (sha256 of entries.ndjson)") + "\n" +
+        line(r.signaturesOk, "Ed25519 signatures") + "\n" +
+        line(r.fingerprintsOk, "device fingerprints match public keys") + "\n" +
+        line(r.chainOk, "entry-level hash chain") + "\n" +
+        line(r.perStepChainOk, "per-step hash chain") + "\n");
+    if (r.chainHead.entryHash) {
+        process.stdout.write(`  chain head (#${r.chainHead.index}): ${r.chainHead.entryHash}\n`);
+    }
+    if (r.issues.length > 0) {
+        process.stdout.write(`  issues:\n`);
+        for (const iss of r.issues.slice(0, 20)) {
+            const idx = iss.index >= 0 ? `entry ${iss.index}: ` : "";
+            const detail = iss.detail ? ` — ${iss.detail}` : "";
+            process.stdout.write(`    - ${idx}${iss.kind}${detail}\n`);
+        }
+        if (r.issues.length > 20) {
+            process.stdout.write(`    (…and ${r.issues.length - 20} more)\n`);
+        }
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/commands/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,0EAA0E;AAC1E,8DAA8D;AAC9D,sEAAsE;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,YAAY,GAMb,MAAM,mBAAmB,CAAC;AAS3B,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9F,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IAE1C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB;QAAE,OAAO,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAiB;IAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAmB,CAAC;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAkB,CAAC;IAC9E,MAAM,YAAY,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAgB,SAAS,CAAC,YAAY,CAAC;SACjD,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC,CAAC;IAE1C,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,CAAqB;IAC3D,MAAM,UAAU,GACd,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAChF,MAAM,IAAI,GAAG,CAAC,EAAW,EAAE,KAAa,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC;IAC5E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,IAAI;QACnD,cAAc,CAAC,CAAC,UAAU,aAAa,CAAC,CAAC,WAAW,eAAe,CAAC,CAAC,aAAa,gBAAgB,CAAC,CAAC,cAAc,IAAI;QACtH,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,kDAAkD,CAAC,GAAG,IAAI;QAC3E,IAAI,CAAC,CAAC,CAAC,eAAe,EAAE,+CAA+C,CAAC,GAAG,IAAI;QAC/E,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,oBAAoB,CAAC,GAAG,IAAI;QACjD,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,uCAAuC,CAAC,GAAG,IAAI;QACtE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,wBAAwB,CAAC,GAAG,IAAI;QAChD,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,qBAAqB,CAAC,GAAG,IAAI,CACvD,CAAC;IACF,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACpC,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,GAAG,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,UAAU,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC"}