@aarmos/bridge 0.1.0

package/dist/index.js

@@ -0,0 +1,231 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { startDev } from "./commands/dev.js";
+import { runDemo } from "./commands/demo.js";
+import { startRun } from "./commands/run.js";
+import { runSimulate } from "./commands/simulate.js";
+import { playbookKeygen, playbookSign, playbookVerify } from "./commands/playbook.js";
+import { packInstall, packList, packVerify } from "./commands/pack.js";
+import { runAttest, runAttestVerify } from "./commands/attest.js";
+const program = new Command();
+program
+    .name("aarmos")
+    .description("Aarmos CLI bridge — native host for the Aarmos PWA")
+    .version("0.0.0-dev");
+// Repeatable-option collector. Commander calls the coerce function once per
+// occurrence with the previous accumulator as the second arg.
+function collect(value, prev) {
+    return [...prev, value];
+}
+program
+    .command("dev")
+    .description("Start the local bridge and pair with the PWA")
+    .option("-p, --port <port>", "WebSocket port to bind on 127.0.0.1", "7423")
+    .option("--pwa <url>", "PWA base URL to open for pairing", process.env.AARMOS_PWA_URL ?? "https://www.aarmatix.com")
+    .option("--no-open", "Do not auto-open the PWA in the browser")
+    .option("--allow-shell <bins>", "Comma-separated additional shell binaries to allow (in addition to defaults)", "")
+    .option("--allow-sql <alias=dsn>", "Register a read-only Postgres target. Repeatable. Example: --allow-sql prod=postgres://readonly@…/db", collect, [])
+    .option("--allow-read <path>", "Allow fs.scopedRead / fs.scopedList inside this absolute path (outside the workspace). Repeatable.", collect, [])
+    .action(async (opts) => {
+    const sqlAllow = opts.allowSql.map((raw) => {
+        const eq = raw.indexOf("=");
+        if (eq < 0) {
+            throw new Error(`--allow-sql expects <alias>=<dsn>, got: ${raw}`);
+        }
+        const alias = raw.slice(0, eq).trim();
+        const dsn = raw.slice(eq + 1).trim();
+        if (!alias || !dsn) {
+            throw new Error(`--allow-sql alias and dsn must be non-empty: ${raw}`);
+        }
+        if (!/^[a-zA-Z0-9._-]+$/.test(alias)) {
+            throw new Error(`--allow-sql alias must be [a-zA-Z0-9._-]+: ${alias}`);
+        }
+        return { alias, dsn };
+    });
+    await startDev({
+        port: Number(opts.port),
+        pwaUrl: opts.pwa,
+        autoOpen: opts.open !== false,
+        extraShellAllow: opts.allowShell
+            ? String(opts.allowShell).split(",").map((s) => s.trim()).filter(Boolean)
+            : [],
+        sqlAllow,
+        readAllow: opts.allowRead,
+    });
+});
+program
+    .command("demo")
+    .description("Scripted end-to-end walkthrough of the dry-run pipeline (no PWA required)")
+    .option("--apply", "Commit the proposed batch after previewing (default: preview only)", false)
+    .option("--workspace <path>", "Workspace to run against (default: cwd)")
+    .action(async (opts) => {
+    await runDemo({ apply: Boolean(opts.apply), workspace: opts.workspace });
+});
+program
+    .command("run")
+    .description("Headless unattended loop — executes a playbook against the local dry-run pipeline")
+    .requiredOption("--playbook <path>", "Path to a JSON playbook file")
+    .option("--once", "Run one pass and exit (default: loop)", false)
+    .option("--dry", "Simulate only — no side effects. Prints per-step verdicts and exits.", false)
+    .option("--enforce-signatures", "Refuse to run unless the playbook is signed (Ed25519)", false)
+    .option("--trusted-pubkey <key>", "Only accept playbooks signed by this pubkey. Repeatable. Requires --enforce-signatures.", collect, [])
+    .option("--kill-switch <file>", "Halt gracefully when this file exists")
+    .option("--receipts <file>", "Append signed receipts here (JSONL)", ".aarmos/receipts.jsonl")
+    .option("--max-per-hour <n>", "Ceiling on applied actions per rolling hour", "60")
+    .option("--heartbeat-url <url>", "POST receipts + heartbeats to this base URL")
+    .option("--heartbeat-token <token>", "Bearer token attached to heartbeat POSTs")
+    .option("--workspace <path>", "Workspace to run against (default: cwd)")
+    .option("--allow-shell <bins>", "Comma-separated additional shell binaries to allow (in addition to defaults)", "")
+    .option("--allow-http <host>", "Allow governed http.call steps to reach this host. Repeatable.", collect, [])
+    .option("--allow-mcp <url>", "Allow governed mcp.tool steps to invoke this MCP endpoint. Repeatable.", collect, [])
+    .action(async (opts) => {
+    await startRun({
+        playbook: opts.playbook,
+        once: Boolean(opts.once),
+        dry: Boolean(opts.dry),
+        enforceSignatures: Boolean(opts.enforceSignatures),
+        trustedPubKeys: opts.trustedPubkey,
+        killSwitch: opts.killSwitch,
+        receipts: opts.receipts,
+        maxPerHour: Number(opts.maxPerHour),
+        heartbeatUrl: opts.heartbeatUrl,
+        heartbeatToken: opts.heartbeatToken,
+        workspace: opts.workspace,
+        extraShellAllow: opts.allowShell
+            ? String(opts.allowShell).split(",").map((s) => s.trim()).filter(Boolean)
+            : [],
+        httpAllow: opts.allowHttp,
+        mcpAllow: opts.allowMcp,
+    });
+});
+program
+    .command("simulate")
+    .description("Compile-time governance: replay a playbook through the dry-run pipeline without applying anything")
+    .requiredOption("--playbook <path>", "Path to a JSON playbook file")
+    .option("--workspace <path>", "Workspace to simulate against (default: cwd)")
+    .option("--json", "Emit machine-readable JSON (for CI)", false)
+    .option("--strict", "Exit non-zero if any step would fail", false)
+    .option("--allow-shell <bins>", "Comma-separated additional shell binaries to allow", "")
+    .option("--allow-http <host>", "Allow http.call to this host. Repeatable.", collect, [])
+    .option("--allow-mcp <url>", "Allow mcp.tool against this MCP endpoint. Repeatable.", collect, [])
+    .action(async (opts) => {
+    await runSimulate({
+        playbook: opts.playbook,
+        workspace: opts.workspace,
+        json: Boolean(opts.json),
+        strict: Boolean(opts.strict),
+        extraShellAllow: opts.allowShell
+            ? String(opts.allowShell).split(",").map((s) => s.trim()).filter(Boolean)
+            : [],
+        httpAllow: opts.allowHttp,
+        mcpAllow: opts.allowMcp,
+    });
+});
+const playbook = program
+    .command("playbook")
+    .description("Sign, verify, and manage Ed25519 keys for playbooks (optional; only enforced under --enforce-signatures)");
+playbook
+    .command("keygen")
+    .description("Generate an Ed25519 signing keypair")
+    .option("--out <dir>", "Directory to write keys into", ".aarmos/keys")
+    .option("--name <name>", "Basename for the key files", "playbook")
+    .action(async (opts) => {
+    await playbookKeygen({ out: opts.out, name: opts.name });
+});
+playbook
+    .command("sign")
+    .description("Sign a playbook in place (or to --out)")
+    .requiredOption("--playbook <path>", "Playbook to sign")
+    .requiredOption("--key <pem>", "Ed25519 private key PEM file")
+    .option("--out <path>", "Write signed playbook here (default: overwrite in place)")
+    .action(async (opts) => {
+    await playbookSign({ playbook: opts.playbook, key: opts.key, out: opts.out });
+});
+playbook
+    .command("verify")
+    .description("Verify a signed playbook")
+    .requiredOption("--playbook <path>", "Playbook to verify")
+    .option("--trusted-pubkey <key>", "Reject if signer is not this pubkey")
+    .action(async (opts) => {
+    await playbookVerify({ playbook: opts.playbook, trustedPubkey: opts.trustedPubkey });
+});
+const pack = program
+    .command("pack")
+    .description("Install / list / verify certified playbook packs (signed bundles of playbooks + scope allowlists)");
+pack
+    .command("install")
+    .description("Install a pack from a local path (or URL — future).")
+    .requiredOption("--source <path>", "Path to a pack JSON file")
+    .option("--workspace <path>", "Workspace to install into (default: cwd)")
+    .action(async (opts) => {
+    await packInstall({ source: opts.source, workspace: opts.workspace });
+});
+pack
+    .command("list")
+    .description("List installed packs")
+    .option("--workspace <path>", "Workspace to inspect (default: cwd)")
+    .action(async (opts) => {
+    await packList({ workspace: opts.workspace });
+});
+pack
+    .command("verify")
+    .description("Verify a pack's Ed25519 signature")
+    .requiredOption("--source <path>", "Path to a pack JSON file")
+    .option("--trusted-pubkey <key>", "Reject if signer is not this pubkey")
+    .action(async (opts) => {
+    await packVerify({ source: opts.source, trustedPubkey: opts.trustedPubkey });
+});
+const attest = program
+    .command("attest")
+    .description("Export a signed audit bundle (receipts + policy hash + pack hashes + rootHash) — verifiable offline")
+    .option("--since <window>", "Only include receipts from this window (e.g. 24h, 7d, or ISO date)", "24h")
+    .option("--out <file>", "Where to write the attestation JSON", "audit.attest.json")
+    .option("--workspace <path>", "Workspace to attest against (default: cwd)")
+    .option("--receipts <file>", "Receipts JSONL to fold in", ".aarmos/receipts.jsonl")
+    .option("--playbook <path>", "Include this playbook's hash + signature")
+    .option("--policy <path>", "Path to aarmos.json (default: <workspace>/aarmos.json)")
+    .option("--sign-key <pem>", "Ed25519 private key PEM — signs the bundle so auditors can verify offline")
+    .action(async (opts) => {
+    await runAttest({
+        out: opts.out,
+        since: opts.since,
+        workspace: opts.workspace,
+        receipts: opts.receipts,
+        playbook: opts.playbook,
+        policy: opts.policy,
+        signKey: opts.signKey,
+    });
+});
+attest
+    .command("verify")
+    .description("Verify an attestation bundle offline — recomputes rootHash and checks signature")
+    .requiredOption("--file <path>", "Attestation JSON to verify")
+    .option("--trusted-pubkey <key>", "Reject if signer is not this pubkey")
+    .action(async (opts) => {
+    await runAttestVerify({ file: opts.file, trustedPubkey: opts.trustedPubkey });
+});
+// aarmos verify — offline AVAR bundle verifier (AVAR spec §6).
+// Uses the same @aarmos/avar-core module the browser drop-zone at
+// /trust/verify uses, so results are bit-identical across runtimes.
+program
+    .command("verify")
+    .description("Verify an AVAR bundle offline (.avar.zip)")
+    .argument("<bundle>", "Path to a .avar.zip bundle")
+    .option("--json", "Emit the VerificationReport as JSON on stdout")
+    .option("--quiet", "Suppress all human-readable output")
+    .option("--strict", "Exit non-zero on 'valid-with-warnings'")
+    .action(async (bundle, opts) => {
+    const { runVerify } = await import("./commands/verify.js");
+    const code = await runVerify({
+        file: bundle,
+        json: !!opts.json,
+        quiet: !!opts.quiet,
+        strict: !!opts.strict,
+    });
+    process.exit(code);
+});
+program.parseAsync(process.argv).catch((err) => {
+    console.error("[aarmos] fatal:", err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAIlE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,oDAAoD,CAAC;KACjE,OAAO,CAAC,WAAW,CAAC,CAAC;AAExB,4EAA4E;AAC5E,8DAA8D;AAC9D,SAAS,OAAO,CAAC,KAAa,EAAE,IAAc;IAC5C,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,8CAA8C,CAAC;KAC3D,MAAM,CAAC,mBAAmB,EAAE,qCAAqC,EAAE,MAAM,CAAC;KAC1E,MAAM,CACL,aAAa,EACb,kCAAkC,EAClC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,0BAA0B,CACzD;KACA,MAAM,CAAC,WAAW,EAAE,yCAAyC,CAAC;KAC9D,MAAM,CACL,sBAAsB,EACtB,8EAA8E,EAC9E,EAAE,CACH;KACA,MAAM,CACL,yBAAyB,EACzB,sGAAsG,EACtG,OAAO,EACP,EAAc,CACf;KACA,MAAM,CACL,qBAAqB,EACrB,oGAAoG,EACpG,OAAO,EACP,EAAc,CACf;KACA,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,QAAQ,GAAgB,IAAI,CAAC,QAAqB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACnE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,2CAA2C,GAAG,EAAE,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,gDAAgD,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,EAAE,IAAI,CAAC,GAAG;QAChB,QAAQ,EAAE,IAAI,CAAC,IAAI,KAAK,KAAK;QAC7B,eAAe,EAAE,IAAI,CAAC,UAAU;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACjF,CAAC,CAAC,EAAE;QACN,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,SAAqB;KACtC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,2EAA2E,CAAC;KACxF,MAAM,CAAC,SAAS,EAAE,oEAAoE,EAAE,KAAK,CAAC;KAC9F,MAAM,CAAC,oBAAoB,EAAE,yCAAyC,CAAC;KACvE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,mFAAmF,CAAC;KAChG,cAAc,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;KACnE,MAAM,CAAC,QAAQ,EAAE,uCAAuC,EAAE,KAAK,CAAC;KAChE,MAAM,CAAC,OAAO,EAAE,sEAAsE,EAAE,KAAK,CAAC;KAC9F,MAAM,CAAC,sBAAsB,EAAE,uDAAuD,EAAE,KAAK,CAAC;KAC9F,MAAM,CACL,wBAAwB,EACxB,yFAAyF,EACzF,OAAO,EACP,EAAc,CACf;KACA,MAAM,CAAC,sBAAsB,EAAE,uCAAuC,CAAC;KACvE,MAAM,CAAC,mBAAmB,EAAE,qCAAqC,EAAE,wBAAwB,CAAC;KAC5F,MAAM,CAAC,oBAAoB,EAAE,6CAA6C,EAAE,IAAI,CAAC;KACjF,MAAM,CAAC,uBAAuB,EAAE,6CAA6C,CAAC;KAC9E,MAAM,CAAC,2BAA2B,EAAE,0CAA0C,CAAC;KAC/E,MAAM,CAAC,oBAAoB,EAAE,yCAAyC,CAAC;KACvE,MAAM,CACL,sBAAsB,EACtB,8EAA8E,EAC9E,EAAE,CACH;KACA,MAAM,CACL,qBAAqB,EACrB,gEAAgE,EAChE,OAAO,EACP,EAAc,CACf;KACA,MAAM,CACL,mBAAmB,EACnB,wEAAwE,EACxE,OAAO,EACP,EAAc,CACf;KACA,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,QAAQ,CAAC;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QACtB,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClD,cAAc,EAAE,IAAI,CAAC,aAAyB;QAC9C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACnC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,eAAe,EAAE,IAAI,CAAC,UAAU;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACjF,CAAC,CAAC,EAAE;QACN,SAAS,EAAE,IAAI,CAAC,SAAqB;QACrC,QAAQ,EAAE,IAAI,CAAC,QAAoB;KACpC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,mGAAmG,CAAC;KAChH,cAAc,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;KACnE,MAAM,CAAC,oBAAoB,EAAE,8CAA8C,CAAC;KAC5E,MAAM,CAAC,QAAQ,EAAE,qCAAqC,EAAE,KAAK,CAAC;KAC9D,MAAM,CAAC,UAAU,EAAE,sCAAsC,EAAE,KAAK,CAAC;KACjE,MAAM,CAAC,sBAAsB,EAAE,oDAAoD,EAAE,EAAE,CAAC;KACxF,MAAM,CAAC,qBAAqB,EAAE,2CAA2C,EAAE,OAAO,EAAE,EAAc,CAAC;KACnG,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,EAAE,OAAO,EAAE,EAAc,CAAC;KAC7G,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,WAAW,CAAC;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5B,eAAe,EAAE,IAAI,CAAC,UAAU;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACjF,CAAC,CAAC,EAAE;QACN,SAAS,EAAE,IAAI,CAAC,SAAqB;QACrC,QAAQ,EAAE,IAAI,CAAC,QAAoB;KACpC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,QAAQ,GAAG,OAAO;KACrB,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,0GAA0G,CAAC,CAAC;AAE3H,QAAQ;KACL,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,qCAAqC,CAAC;KAClD,MAAM,CAAC,aAAa,EAAE,8BAA8B,EAAE,cAAc,CAAC;KACrE,MAAM,CAAC,eAAe,EAAE,4BAA4B,EAAE,UAAU,CAAC;KACjE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC;AAEL,QAAQ;KACL,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wCAAwC,CAAC;KACrD,cAAc,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;KACvD,cAAc,CAAC,aAAa,EAAE,8BAA8B,CAAC;KAC7D,MAAM,CAAC,cAAc,EAAE,0DAA0D,CAAC;KAClF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAChF,CAAC,CAAC,CAAC;AAEL,QAAQ;KACL,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,0BAA0B,CAAC;KACvC,cAAc,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;KACzD,MAAM,CAAC,wBAAwB,EAAE,qCAAqC,CAAC;KACvE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC;AAGL,MAAM,IAAI,GAAG,OAAO;KACjB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,mGAAmG,CAAC,CAAC;AAEpH,IAAI;KACD,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,qDAAqD,CAAC;KAClE,cAAc,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;KAC7D,MAAM,CAAC,oBAAoB,EAAE,0CAA0C,CAAC;KACxE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sBAAsB,CAAC;KACnC,MAAM,CAAC,oBAAoB,EAAE,qCAAqC,CAAC;KACnE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,mCAAmC,CAAC;KAChD,cAAc,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;KAC7D,MAAM,CAAC,wBAAwB,EAAE,qCAAqC,CAAC;KACvE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEL,MAAM,MAAM,GAAG,OAAO;KACnB,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,qGAAqG,CAAC;KAClH,MAAM,CAAC,kBAAkB,EAAE,oEAAoE,EAAE,KAAK,CAAC;KACvG,MAAM,CAAC,cAAc,EAAE,qCAAqC,EAAE,mBAAmB,CAAC;KAClF,MAAM,CAAC,oBAAoB,EAAE,4CAA4C,CAAC;KAC1E,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,EAAE,wBAAwB,CAAC;KAClF,MAAM,CAAC,mBAAmB,EAAE,0CAA0C,CAAC;KACvE,MAAM,CAAC,iBAAiB,EAAE,wDAAwD,CAAC;KACnF,MAAM,CAAC,kBAAkB,EAAE,2EAA2E,CAAC;KACvG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,SAAS,CAAC;QACd,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM;KACH,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,iFAAiF,CAAC;KAC9F,cAAc,CAAC,eAAe,EAAE,4BAA4B,CAAC;KAC7D,MAAM,CAAC,wBAAwB,EAAE,qCAAqC,CAAC;KACvE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;AAChF,CAAC,CAAC,CAAC;AAEL,+DAA+D;AAC/D,kEAAkE;AAClE,oEAAoE;AACpE,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,2CAA2C,CAAC;KACxD,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAC;KAClD,MAAM,CAAC,QAAQ,EAAE,+CAA+C,CAAC;KACjE,MAAM,CAAC,SAAS,EAAE,oCAAoC,CAAC;KACvD,MAAM,CAAC,UAAU,EAAE,wCAAwC,CAAC;KAC5D,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;IACrC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;QAC3B,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;QACjB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lib/attest.js

@@ -0,0 +1,160 @@
+// Attestation export — the audit-ready wedge.
+//
+// `aarmos attest` produces a single self-contained JSON artifact:
+//
+//   {
+//     version: 1,
+//     createdAt, since, until,
+//     playbook?:  { name, hash, signed, pubKey? },
+//     policyHash?: <sha256 of aarmos.json>,
+//     packs:      [{ name, version, hash }],
+//     receipts:   [ ... hash-chained records from .aarmos/receipts.jsonl ... ],
+//     rootHash:   <sha256 of the concatenated per-receipt hashes>,
+//     signature?: { alg: "ed25519", pubKey, sig } // over the body sans signature
+//   }
+//
+// `aarmos attest verify <file>` re-computes rootHash from the embedded
+// receipts and, if a signature is present, verifies it. The verifier
+// is a pure function of the file — no network, no daemon — so an
+// auditor can run it air-gapped.
+import fs from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+import { canonicalize, hashPlaybook, loadPlaybook, } from "./playbook.js";
+import { listInstalledPacks, hashPack } from "./pack.js";
+export async function buildAttestation(opts) {
+    const until = opts.until ?? new Date();
+    const since = opts.since ?? new Date(0);
+    // --- receipts ---
+    const receipts = [];
+    try {
+        const raw = await fs.readFile(opts.receiptsFile, "utf8");
+        for (const line of raw.split("\n")) {
+            const t = line.trim();
+            if (!t)
+                continue;
+            let obj;
+            try {
+                obj = JSON.parse(t);
+            }
+            catch {
+                continue;
+            }
+            const at = Date.parse(obj.ts);
+            if (Number.isFinite(at) && at >= since.getTime() && at <= until.getTime()) {
+                receipts.push(obj);
+            }
+        }
+    }
+    catch { /* no receipts yet */ }
+    const rootHash = merkleRoot(receipts.map((r) => r.hash ?? ""));
+    // --- playbook ---
+    let playbookEntry;
+    if (opts.playbookFile) {
+        const pb = await loadPlaybook(opts.playbookFile);
+        playbookEntry = {
+            name: pb.name,
+            hash: hashPlaybook(pb),
+            signed: Boolean(pb.signature),
+            pubKey: pb.signature?.pubKey,
+        };
+    }
+    // --- policy config (aarmos.json) ---
+    let policyHash;
+    if (opts.policyFile) {
+        try {
+            const raw = await fs.readFile(opts.policyFile, "utf8");
+            policyHash = crypto.createHash("sha256").update(raw).digest("hex");
+        }
+        catch { /* no policy file — omit */ }
+    }
+    // --- installed packs ---
+    const packs = opts.packsDir
+        ? (await listInstalledPacks(opts.packsDir)).map((p) => ({
+            name: p.name,
+            version: p.version,
+            hash: hashPack(p),
+        }))
+        : [];
+    return {
+        version: 1,
+        createdAt: new Date().toISOString(),
+        since: since.toISOString(),
+        until: until.toISOString(),
+        playbook: playbookEntry,
+        policyHash,
+        packs,
+        receipts,
+        rootHash,
+    };
+}
+export function attestationBody(a) {
+    const { signature: _s, ...rest } = a;
+    void _s;
+    return canonicalize(rest);
+}
+export async function signAttestation(a, privateKeyPem) {
+    const key = crypto.createPrivateKey(privateKeyPem);
+    const sig = crypto.sign(null, Buffer.from(attestationBody(a)), key);
+    const pubDer = crypto.createPublicKey(key).export({ format: "der", type: "spki" });
+    const rawPub = pubDer.subarray(pubDer.length - 32);
+    const b64u = (b) => b.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    return { ...a, signature: { alg: "ed25519", pubKey: b64u(rawPub), sig: b64u(sig) } };
+}
+export function verifyAttestation(a) {
+    const recomputed = merkleRoot(a.receipts.map((r) => r.hash ?? ""));
+    if (recomputed !== a.rootHash) {
+        return { ok: false, reason: `rootHash mismatch (bundle=${a.rootHash} computed=${recomputed})` };
+    }
+    if (!a.signature)
+        return { ok: true };
+    if (a.signature.alg !== "ed25519") {
+        return { ok: false, reason: `unsupported alg: ${a.signature.alg}` };
+    }
+    try {
+        const spkiPrefix = Buffer.from([
+            0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+        ]);
+        const b64uDecode = (s) => Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((s.length + 3) % 4), "base64");
+        const rawPub = b64uDecode(a.signature.pubKey);
+        if (rawPub.length !== 32)
+            return { ok: false, reason: "pubKey must be 32 bytes" };
+        const der = Buffer.concat([spkiPrefix, rawPub]);
+        const key = crypto.createPublicKey({ key: der, format: "der", type: "spki" });
+        const ok = crypto.verify(null, Buffer.from(attestationBody(a)), key, b64uDecode(a.signature.sig));
+        return ok ? { ok: true } : { ok: false, reason: "signature does not match bundle body" };
+    }
+    catch (err) {
+        return { ok: false, reason: err.message };
+    }
+}
+/** Sequential hash chain: h(0) = sha256(""), h(i) = sha256(h(i-1) + receipts[i]). */
+function merkleRoot(hashes) {
+    let acc = crypto.createHash("sha256").update("").digest("hex");
+    for (const h of hashes) {
+        acc = crypto.createHash("sha256").update(acc + h).digest("hex");
+    }
+    return acc;
+}
+export function parseSince(s) {
+    const m = /^(\d+)\s*([hdm])$/.exec(s.trim());
+    if (m) {
+        const n = Number(m[1]);
+        const unit = m[2];
+        const ms = unit === "h" ? n * 3_600_000 : unit === "d" ? n * 86_400_000 : n * 60_000;
+        return new Date(Date.now() - ms);
+    }
+    const t = Date.parse(s);
+    if (Number.isFinite(t))
+        return new Date(t);
+    throw new Error(`--since: expected e.g. 24h, 7d, 30m, or an ISO date (got: ${s})`);
+}
+export async function writeAttestation(file, a) {
+    await fs.mkdir(path.dirname(path.resolve(file)), { recursive: true });
+    await fs.writeFile(path.resolve(file), JSON.stringify(a, null, 2) + "\n", "utf8");
+}
+export async function readAttestation(file) {
+    const raw = await fs.readFile(path.resolve(file), "utf8");
+    return JSON.parse(raw);
+}
+//# sourceMappingURL=attest.js.map

package/dist/lib/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../src/lib/attest.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,kEAAkE;AAClE,EAAE;AACF,MAAM;AACN,kBAAkB;AAClB,+BAA+B;AAC/B,mDAAmD;AACnD,4CAA4C;AAC5C,6CAA6C;AAC7C,gFAAgF;AAChF,mEAAmE;AACnE,kFAAkF;AAClF,MAAM;AACN,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,iEAAiE;AACjE,iCAAiC;AAEjC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAoCzD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAwB;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAExC,mBAAmB;IACnB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,GAAkB,CAAC;YACvB,IAAI,CAAC;gBAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAkB,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAE/D,mBAAmB;IACnB,IAAI,aAA4C,CAAC;IACjD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjD,aAAa,GAAG;YACd,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YACtB,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC;YAC7B,MAAM,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED,sCAAsC;IACtC,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACvD,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACzC,CAAC;IAED,0BAA0B;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ;QACzB,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;SAClB,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;QAC1B,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;QAC1B,QAAQ,EAAE,aAAa;QACvB,UAAU;QACV,KAAK;QACL,QAAQ;QACR,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAoB;IAClD,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,KAAK,EAAE,CAAC;IACR,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAoB,EACpB,aAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAW,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CACzB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAoB;IACpD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,IAAI,UAAU,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC,QAAQ,aAAa,UAAU,GAAG,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;SACvE,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAC/B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAClF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAClG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,MAAgB;IAClC,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;QACrF,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,CAAoB;IACvE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;AAC9C,CAAC"}

package/dist/lib/http-broker.js

@@ -0,0 +1,82 @@
+// HTTP broker step kind — governed `http.call`.
+//
+// Scope model:
+//   - The operator opts hosts in via `--allow-http <host>` (repeatable).
+//     A step that targets a host outside the allowlist fails at simulate
+//     time and at run time, before any bytes leave the machine.
+//   - Bearer tokens are read from env vars named by the step
+//     (`bearerEnv`) — never inlined into the playbook JSON. Signing a
+//     playbook therefore does NOT bind a secret; the token is bound at
+//     the daemon.
+//   - Responses are capped at 1 MiB and previewed as
+//     `{ method, url, headers (redacted), bodyBytes }` so the PWA card
+//     stays useful without leaking a token.
+import { z } from "zod";
+export const HttpCallParams = z.object({
+    method: z.enum(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]).default("GET"),
+    url: z.string().url(),
+    headers: z.record(z.string()).optional(),
+    body: z.string().optional(), // caller stringifies JSON — keeps signing deterministic
+    bearerEnv: z.string().optional(),
+    timeoutMs: z.number().int().min(100).max(60_000).default(15_000),
+});
+export function hostOf(url) {
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return "";
+    }
+}
+export function previewHttpCall(p, allowed) {
+    const host = hostOf(p.url);
+    if (!allowed.has(host)) {
+        throw new Error(`http.call host not allowed: ${host} (start with --allow-http ${host} or add it to the pack)`);
+    }
+    const redactedHeaders = { ...(p.headers ?? {}) };
+    for (const k of Object.keys(redactedHeaders)) {
+        if (/^authorization$/i.test(k))
+            redactedHeaders[k] = "***";
+    }
+    if (p.bearerEnv)
+        redactedHeaders["Authorization"] = `Bearer $${p.bearerEnv}`;
+    return {
+        method: p.method,
+        url: p.url,
+        host,
+        headers: redactedHeaders,
+        bodyBytes: p.body?.length ?? 0,
+    };
+}
+export async function executeHttpCall(p, allowed) {
+    const host = hostOf(p.url);
+    if (!allowed.has(host))
+        throw new Error(`http.call host not allowed: ${host}`);
+    const headers = { ...(p.headers ?? {}) };
+    if (p.bearerEnv) {
+        const tok = process.env[p.bearerEnv];
+        if (!tok)
+            throw new Error(`http.call: env ${p.bearerEnv} is not set on this host`);
+        headers["Authorization"] = `Bearer ${tok}`;
+    }
+    const controller = new AbortController();
+    const t = setTimeout(() => controller.abort(), p.timeoutMs);
+    try {
+        const res = await fetch(p.url, {
+            method: p.method,
+            headers,
+            body: p.body,
+            signal: controller.signal,
+        });
+        const bodyBuf = new Uint8Array(await res.arrayBuffer());
+        const capped = bodyBuf.length > 1_048_576 ? bodyBuf.slice(0, 1_048_576) : bodyBuf;
+        const bodySnippet = new TextDecoder("utf-8", { fatal: false }).decode(capped).slice(0, 4_000);
+        const outHeaders = {};
+        res.headers.forEach((v, k) => (outHeaders[k] = v));
+        return { status: res.status, headers: outHeaders, bodySnippet, bytes: bodyBuf.length };
+    }
+    finally {
+        clearTimeout(t);
+    }
+}
+//# sourceMappingURL=http-broker.js.map

package/dist/lib/http-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-broker.js","sourceRoot":"","sources":["../../src/lib/http-broker.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,eAAe;AACf,yEAAyE;AACzE,yEAAyE;AACzE,gEAAgE;AAChE,6DAA6D;AAC7D,sEAAsE;AACtE,uEAAuE;AACvE,kBAAkB;AAClB,qDAAqD;AACrD,uEAAuE;AACvE,4CAA4C;AAE5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,wDAAwD;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACjE,CAAC,CAAC;AAIH,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAW,EAAE,OAAoB;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,6BAA6B,IAAI,yBAAyB,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAA2B,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7C,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,eAAe,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,CAAC,SAAS;QAAE,eAAe,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC;IAC7E,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI;QACJ,OAAO,EAAE,eAAe;QACxB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAW,EACX,OAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IACjE,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,SAAS,0BAA0B,CAAC,CAAC;QACnF,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAClF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9F,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACzF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/lib/mcp-broker.js

@@ -0,0 +1,80 @@
+// MCP broker step kind — governed `mcp.tool` calls over Streamable HTTP.
+//
+// The daemon speaks raw MCP JSON-RPC 2.0 to remote servers so the CLI
+// stays dependency-free (no @ai-sdk/mcp on the server surface). Every
+// endpoint must be opted in via `--allow-mcp <url>` — this is how we
+// stop a playbook from silently rerouting itself to an attacker's MCP
+// server after signing.
+import { z } from "zod";
+export const McpToolParams = z.object({
+    endpoint: z.string().url(),
+    tool: z.string().min(1),
+    args: z.record(z.unknown()).default({}),
+    bearerEnv: z.string().optional(),
+    /** Optional operator hint for the risk classifier. Defaults to "write". */
+    riskHint: z.enum(["read", "write", "destructive"]).optional(),
+    timeoutMs: z.number().int().min(100).max(60_000).default(15_000),
+});
+export function previewMcpTool(p, allowed) {
+    if (!allowed.has(p.endpoint)) {
+        throw new Error(`mcp.tool endpoint not allowed: ${p.endpoint} (start with --allow-mcp ${p.endpoint})`);
+    }
+    return {
+        endpoint: p.endpoint,
+        tool: p.tool,
+        argKeys: Object.keys(p.args ?? {}),
+        riskHint: p.riskHint ?? "write",
+    };
+}
+export async function executeMcpTool(p, allowed) {
+    if (!allowed.has(p.endpoint))
+        throw new Error(`mcp.tool endpoint not allowed: ${p.endpoint}`);
+    const headers = {
+        "Content-Type": "application/json",
+        // Streamable HTTP servers reject requests without both types.
+        Accept: "application/json, text/event-stream",
+    };
+    if (p.bearerEnv) {
+        const tok = process.env[p.bearerEnv];
+        if (!tok)
+            throw new Error(`mcp.tool: env ${p.bearerEnv} is not set on this host`);
+        headers["Authorization"] = `Bearer ${tok}`;
+    }
+    const body = JSON.stringify({
+        jsonrpc: "2.0",
+        id: Date.now(),
+        method: "tools/call",
+        params: { name: p.tool, arguments: p.args ?? {} },
+    });
+    const controller = new AbortController();
+    const t = setTimeout(() => controller.abort(), p.timeoutMs);
+    try {
+        const res = await fetch(p.endpoint, { method: "POST", headers, body, signal: controller.signal });
+        const text = await res.text();
+        // Streamable HTTP may return SSE frames; extract the first `data:` payload if so.
+        const payload = text.startsWith("event:") || text.includes("\ndata:")
+            ? extractFirstSseData(text)
+            : text;
+        let parsed = payload;
+        try {
+            parsed = JSON.parse(payload);
+        }
+        catch { /* leave as text */ }
+        const envelope = parsed;
+        if (envelope && typeof envelope === "object" && "error" in envelope && envelope.error) {
+            return { ok: false, error: envelope.error };
+        }
+        return { ok: res.ok, result: envelope?.result ?? parsed };
+    }
+    finally {
+        clearTimeout(t);
+    }
+}
+function extractFirstSseData(text) {
+    for (const line of text.split(/\r?\n/)) {
+        if (line.startsWith("data:"))
+            return line.slice(5).trim();
+    }
+    return text;
+}
+//# sourceMappingURL=mcp-broker.js.map

package/dist/lib/mcp-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-broker.js","sourceRoot":"","sources":["../../src/lib/mcp-broker.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,wBAAwB;AAExB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACjE,CAAC,CAAC;AAGH,MAAM,UAAU,cAAc,CAAC,CAAc,EAAE,OAAoB;IACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,kCAAkC,CAAC,CAAC,QAAQ,4BAA4B,CAAC,CAAC,QAAQ,GAAG,CACtF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,OAAO;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,CAAc,EACd,OAAoB;IAEpB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,8DAA8D;QAC9D,MAAM,EAAE,qCAAqC;KAC9C,CAAC;IACF,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,SAAS,0BAA0B,CAAC,CAAC;QAClF,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;QACd,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE;KAClD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAClG,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,kFAAkF;QAClF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YACnE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAC3B,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,MAAM,GAAY,OAAO,CAAC;QAC9B,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAA+C,CAAC;QACjE,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,MAAM,EAAE,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}