@aarmos/bridge 0.1.0

package/dist/lib/pack.js

@@ -0,0 +1,80 @@
+// Certified playbook packs — versioned bundles of playbooks, scope
+// templates, and pre-classified risk rankings.
+//
+// Format (single JSON file, optionally signed):
+//   {
+//     "name": "@aarmos/k8s-safeguards",
+//     "version": "0.1.0",
+//     "instructions": "Governed kubectl playbooks for restart / scale / drain.",
+//     "playbooks": [ Playbook, ... ],   // same shape as a standalone playbook
+//     "allow": {
+//       "shell": ["kubectl"],
+//       "http":  ["api.github.com"],
+//       "mcp":   ["https://mcp.example/atlassian"]
+//     },
+//     "signature"?: { alg: "ed25519", pubKey, sig }
+//   }
+//
+// The pack itself is signed with the SAME ed25519 primitive as
+// playbooks (see lib/playbook.ts). `aarmos pack verify` and
+// `aarmos run --enforce-signatures` both accept a pack pubkey.
+//
+// Install writes to `.aarmos/packs/<safe-name>-<version>/pack.json`
+// so packs are inspectable, diff-able in git, and never mutate the
+// operator's global state.
+import fs from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+import { canonicalize } from "./playbook.js";
+export function packBody(pack) {
+    const { signature: _s, ...rest } = pack;
+    void _s;
+    return canonicalize(rest);
+}
+export function hashPack(pack) {
+    return crypto.createHash("sha256").update(packBody(pack)).digest("hex");
+}
+export async function loadPack(p) {
+    const raw = await fs.readFile(path.resolve(p), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed?.name || typeof parsed.name !== "string")
+        throw new Error("pack.name required");
+    if (!parsed.version || typeof parsed.version !== "string")
+        throw new Error("pack.version required");
+    if (!Array.isArray(parsed.playbooks) || parsed.playbooks.length === 0) {
+        throw new Error("pack.playbooks must be a non-empty array");
+    }
+    return parsed;
+}
+const SAFE_NAME_RE = /[^a-zA-Z0-9._-]/g;
+export function packInstallDir(pack, rootDir) {
+    const safe = pack.name.replace(SAFE_NAME_RE, "_");
+    return path.join(rootDir, `${safe}-${pack.version}`);
+}
+export async function installPack(source, rootDir) {
+    const pack = await loadPack(source);
+    const dir = packInstallDir(pack, rootDir);
+    await fs.mkdir(dir, { recursive: true });
+    const dest = path.join(dir, "pack.json");
+    await fs.writeFile(dest, JSON.stringify(pack, null, 2) + "\n", "utf8");
+    return { pack, installed: dest };
+}
+export async function listInstalledPacks(rootDir) {
+    const out = [];
+    try {
+        const entries = await fs.readdir(rootDir, { withFileTypes: true });
+        for (const e of entries) {
+            if (!e.isDirectory())
+                continue;
+            const file = path.join(rootDir, e.name, "pack.json");
+            try {
+                const raw = await fs.readFile(file, "utf8");
+                out.push(JSON.parse(raw));
+            }
+            catch { /* ignore malformed */ }
+        }
+    }
+    catch { /* no packs dir yet */ }
+    return out;
+}
+//# sourceMappingURL=pack.js.map

package/dist/lib/pack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.js","sourceRoot":"","sources":["../../src/lib/pack.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,+CAA+C;AAC/C,EAAE;AACF,gDAAgD;AAChD,MAAM;AACN,wCAAwC;AACxC,0BAA0B;AAC1B,iFAAiF;AACjF,+EAA+E;AAC/E,iBAAiB;AACjB,8BAA8B;AAC9B,qCAAqC;AACrC,mDAAmD;AACnD,SAAS;AACT,oDAAoD;AACpD,MAAM;AACN,EAAE;AACF,+DAA+D;AAC/D,4DAA4D;AAC5D,+DAA+D;AAC/D,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,2BAA2B;AAE3B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAiB,MAAM,eAAe,CAAC;AAe5D,MAAM,UAAU,QAAQ,CAAC,IAAU;IACjC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxC,KAAK,EAAE,CAAC;IACR,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAU;IACjC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAS;IACtC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACpG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAc,CAAC;AACxB,CAAC;AAED,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,UAAU,cAAc,CAAC,IAAU,EAAE,OAAe;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,OAAe;IAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe;IACtD,MAAM,GAAG,GAAW,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,SAAS;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAS,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/playbook.js

@@ -0,0 +1,199 @@
+// Shared playbook loader, canonicalizer, and Ed25519 signer/verifier.
+//
+// Design contract:
+//   - Signing is OPTIONAL. Dev mode ignores signatures entirely; only
+//     `aarmos run --enforce-signatures` refuses unsigned/invalid playbooks.
+//   - Signature covers a canonical JSON of the playbook body with the
+//     `signature` field stripped, matching the shape used by the PWA's
+//     `signObject` in src/lib/observability/signer.ts (sorted keys, no
+//     whitespace). Same primitive — a receipt viewer can verify both.
+//   - Keys are Ed25519 raw 32-byte public keys, base64url-encoded. Private
+//     keys are PKCS8 PEM on disk. We never load private keys at `run` time.
+import fs from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+// ---------------- load + validate --------------------------------------------
+export async function loadPlaybook(p) {
+    const raw = await fs.readFile(path.resolve(p), "utf8");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`playbook is not valid JSON: ${err.message}`);
+    }
+    if (!parsed || typeof parsed !== "object")
+        throw new Error("playbook must be an object");
+    const pb = parsed;
+    if (!pb.name || typeof pb.name !== "string")
+        throw new Error("playbook.name is required");
+    if (!Array.isArray(pb.steps) || pb.steps.length === 0) {
+        throw new Error("playbook.steps must be a non-empty array");
+    }
+    const seen = new Set();
+    for (const s of pb.steps) {
+        if (!s.id || typeof s.id !== "string")
+            throw new Error("each step needs an id");
+        if (seen.has(s.id))
+            throw new Error(`duplicate step id: ${s.id}`);
+        seen.add(s.id);
+        if (s.kind !== "shell.exec" && s.kind !== "fs.write" && s.kind !== "http.call" && s.kind !== "mcp.tool") {
+            throw new Error(`step ${s.id}: kind must be one of shell.exec, fs.write, http.call, mcp.tool`);
+        }
+        if (!s.params || typeof s.params !== "object") {
+            throw new Error(`step ${s.id}: params object required`);
+        }
+    }
+    return pb;
+}
+/**
+ * Structural lint — catches the class of problems that don't need the
+ * runtime gate (unknown fields, missing intervals, autoApply on shell
+ * without an explicit allowlist hint, etc.). This is the compile-time
+ * safety net; runtime enforcement still runs on every step regardless.
+ */
+export function lintPlaybook(pb) {
+    const out = [];
+    if (pb.steps.length > 100) {
+        out.push({ level: "warn", message: `playbook has ${pb.steps.length} steps — consider splitting` });
+    }
+    for (const s of pb.steps) {
+        if (!s.label)
+            out.push({ level: "warn", stepId: s.id, message: "missing human-readable label" });
+        if (s.intervalSec !== undefined && (typeof s.intervalSec !== "number" || s.intervalSec < 1)) {
+            out.push({ level: "error", stepId: s.id, message: "intervalSec must be a positive number" });
+        }
+        if (s.kind === "shell.exec") {
+            const p = s.params;
+            if (typeof p.bin !== "string" || !p.bin) {
+                out.push({ level: "error", stepId: s.id, message: "shell.exec: params.bin (string) required" });
+            }
+            if (p.args !== undefined && !Array.isArray(p.args)) {
+                out.push({ level: "error", stepId: s.id, message: "shell.exec: params.args must be an array" });
+            }
+            if (s.autoApply) {
+                out.push({
+                    level: "info",
+                    stepId: s.id,
+                    message: "shell.exec has autoApply=true — will execute unattended if bin is in allowlist",
+                });
+            }
+        }
+        if (s.kind === "fs.write") {
+            const p = s.params;
+            if (typeof p.path !== "string" || !p.path) {
+                out.push({ level: "error", stepId: s.id, message: "fs.write: params.path (string) required" });
+            }
+            if (p.data !== undefined && typeof p.data !== "string") {
+                out.push({ level: "error", stepId: s.id, message: "fs.write: params.data must be a string" });
+            }
+        }
+        if (s.kind === "http.call") {
+            const p = s.params;
+            if (typeof p.url !== "string" || !/^https?:\/\//.test(p.url)) {
+                out.push({ level: "error", stepId: s.id, message: "http.call: params.url (http(s) URL) required" });
+            }
+            if (p.method !== undefined && typeof p.method !== "string") {
+                out.push({ level: "error", stepId: s.id, message: "http.call: params.method must be a string" });
+            }
+        }
+        if (s.kind === "mcp.tool") {
+            const p = s.params;
+            if (typeof p.endpoint !== "string" || !/^https?:\/\//.test(p.endpoint)) {
+                out.push({ level: "error", stepId: s.id, message: "mcp.tool: params.endpoint (http(s) URL) required" });
+            }
+            if (typeof p.tool !== "string" || !p.tool) {
+                out.push({ level: "error", stepId: s.id, message: "mcp.tool: params.tool (string) required" });
+            }
+        }
+    }
+    return out;
+}
+// ---------------- canonicalize + sign/verify ---------------------------------
+/** Sorted-key JSON, no whitespace. Matches PWA signer.ts canonicalize().
+ *  Skips keys whose values are `undefined` so the canonical form matches
+ *  what JSON.stringify produces after a write/read roundtrip. */
+export function canonicalize(v) {
+    if (v === undefined)
+        return "null";
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v);
+    if (Array.isArray(v))
+        return "[" + v.map((x) => canonicalize(x)).join(",") + "]";
+    const obj = v;
+    const keys = Object.keys(obj).filter((k) => obj[k] !== undefined).sort();
+    return ("{" +
+        keys.map((k) => JSON.stringify(k) + ":" + canonicalize(obj[k])).join(",") +
+        "}");
+}
+function playbookBody(pb) {
+    const { signature: _s, ...rest } = pb;
+    void _s;
+    return canonicalize(rest);
+}
+function b64u(buf) {
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function b64uDecode(s) {
+    const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((s.length + 3) % 4);
+    return Buffer.from(b64, "base64");
+}
+export async function generateSigningKeyPair(outDir, name) {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+    const pem = privateKey.export({ format: "pem", type: "pkcs8" }).toString();
+    const raw = publicKey.export({ format: "der", type: "spki" });
+    // Ed25519 SPKI DER header is 12 bytes; the trailing 32 are the raw key.
+    const rawKey = raw.subarray(raw.length - 32);
+    const pubB64u = b64u(rawKey);
+    await fs.mkdir(outDir, { recursive: true });
+    const privPath = path.join(outDir, `${name}.key.pem`);
+    const pubPath = path.join(outDir, `${name}.pub`);
+    await fs.writeFile(privPath, pem, { mode: 0o600 });
+    await fs.writeFile(pubPath, pubB64u + "\n");
+    return { privatePem: privPath, publicKey: pubB64u };
+}
+export async function signPlaybook(pb, privateKeyPem) {
+    const key = crypto.createPrivateKey(privateKeyPem);
+    const bytes = Buffer.from(playbookBody(pb));
+    const sig = crypto.sign(null, bytes, key);
+    // Derive matching public key so the signed file is self-verifiable.
+    const pubDer = crypto.createPublicKey(key).export({ format: "der", type: "spki" });
+    const rawPub = pubDer.subarray(pubDer.length - 32);
+    return {
+        ...pb,
+        signature: { alg: "ed25519", pubKey: b64u(rawPub), sig: b64u(sig) },
+    };
+}
+export function verifyPlaybookSignature(pb) {
+    if (!pb.signature)
+        return { ok: false, reason: "playbook is not signed" };
+    if (pb.signature.alg !== "ed25519") {
+        return { ok: false, reason: `unsupported alg: ${pb.signature.alg}` };
+    }
+    try {
+        // Reconstruct SPKI DER from raw 32-byte Ed25519 public key.
+        const spkiPrefix = Buffer.from([
+            0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+        ]);
+        const rawPub = b64uDecode(pb.signature.pubKey);
+        if (rawPub.length !== 32)
+            return { ok: false, reason: "pubKey must be 32 bytes" };
+        const der = Buffer.concat([spkiPrefix, rawPub]);
+        const key = crypto.createPublicKey({ key: der, format: "der", type: "spki" });
+        const bytes = Buffer.from(playbookBody(pb));
+        const sig = b64uDecode(pb.signature.sig);
+        const ok = crypto.verify(null, bytes, key, sig);
+        return ok ? { ok: true } : { ok: false, reason: "signature does not match playbook body" };
+    }
+    catch (err) {
+        return { ok: false, reason: err.message };
+    }
+}
+/** Deterministic sha256 over the canonical playbook body (sans signature). */
+export function hashPlaybook(pb) {
+    return crypto.createHash("sha256").update(playbookBody(pb)).digest("hex");
+}
+export async function writePlaybook(p, pb) {
+    await fs.writeFile(path.resolve(p), JSON.stringify(pb, null, 2) + "\n", "utf8");
+}
+//# sourceMappingURL=playbook.js.map

package/dist/lib/playbook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"playbook.js","sourceRoot":"","sources":["../../src/lib/playbook.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,mBAAmB;AACnB,sEAAsE;AACtE,4EAA4E;AAC5E,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AAkCjC,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAS;IAC1C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACzF,MAAM,EAAE,GAAG,MAA2B,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC1F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACxG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,iEAAiE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAc,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,EAAY;IACvC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,KAAK,CAAC,MAAM,6BAA6B,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,MAA2C,CAAC;YACxD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACxC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC;oBACP,KAAK,EAAE,MAAM;oBACb,MAAM,EAAE,CAAC,CAAC,EAAE;oBACZ,OAAO,EAAE,gFAAgF;iBAC1F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,MAA4C,CAAC;YACzD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,MAA6C,CAAC;YAC1D,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;YACtG,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAgD,CAAC;YAC7D,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;YAC1G,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAEhF;;iEAEiE;AACjE,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACjF,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,OAAO,CACL,GAAG;QACH,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACzE,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,EAAY;IAChC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;IACtC,KAAK,EAAE,CAAC;IACR,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AACD,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,IAAY;IACvE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3E,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAW,CAAC;IACxE,wEAAwE;IACxE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAY,EAAE,aAAqB;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAW,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACnD,OAAO;QACL,GAAG,EAAE;QACL,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAY;IAClD,IAAI,CAAC,EAAE,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC1E,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,CAAC;QACH,4DAA4D;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;SACvE,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAClF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,EAAY;IACvC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAS,EAAE,EAAY;IACzD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AAClF,CAAC"}

package/dist/lib/scope-templates.js

@@ -0,0 +1,129 @@
+// Scope templates + risk classification.
+//
+// Compile-time governance primitives shared by `simulate` and `run`.
+// Every step kind resolves to a `RiskRank`:
+//   - "read"        → observability only; safe to auto-apply
+//   - "write"       → mutating but reversible; auto-apply if autoApply=true
+//   - "destructive" → deletes / drops / drains / push --force; ALWAYS needs
+//                     human approval unless the step sets
+//                     `acknowledgeDestructive: true` AND the playbook is
+//                     signed with a trusted pubkey (enforced in run.ts).
+//
+// Templates are additive: unknown verbs default to "write" so we err on
+// the side of showing an approval card. Adding a new SaaS is a pure data
+// change (append to KUBECTL_VERBS / JIRA_ENDPOINTS / ...) — no gate rewrite.
+// ---------------- kubectl -----------------------------------------------------
+const KUBECTL_READ = new Set([
+    "get", "describe", "logs", "top", "version", "api-resources",
+    "api-versions", "explain", "config", "cluster-info", "auth",
+]);
+const KUBECTL_WRITE = new Set([
+    "apply", "create", "scale", "patch", "rollout", "edit", "label",
+    "annotate", "set", "expose", "run", "autoscale", "replace", "taint",
+]);
+const KUBECTL_DESTRUCTIVE = new Set([
+    "delete", "drain", "cordon", "uncordon", "evict", "exec",
+]);
+// ---------------- git ---------------------------------------------------------
+const GIT_DESTRUCTIVE_FLAGS = ["--force", "-f", "--hard", "-D"];
+const GIT_DESTRUCTIVE_SUBCMDS = new Set(["push", "reset", "clean", "branch", "rebase"]);
+// ---------------- gh (GitHub CLI) ---------------------------------------------
+const GH_READ = new Set(["view", "list", "status", "search", "browse", "auth"]);
+const GH_DESTRUCTIVE = new Set(["delete", "close"]);
+// ---------------- HTTP verbs --------------------------------------------------
+function httpRisk(method) {
+    const m = method.toUpperCase();
+    if (m === "GET" || m === "HEAD" || m === "OPTIONS")
+        return "read";
+    if (m === "DELETE")
+        return "destructive";
+    return "write";
+}
+// ---------------- classifier --------------------------------------------------
+export function classifyStep(step) {
+    const p = step.params;
+    // Explicit operator override on the step wins (used inside signed packs
+    // where the pack author has already reviewed the endpoint).
+    const explicit = step.risk;
+    if (explicit)
+        return { rank: explicit, reason: "explicit step.risk override" };
+    if (step.kind === "fs.write") {
+        return { rank: "write", reason: "fs.write mutates workspace" };
+    }
+    if (step.kind === "shell.exec") {
+        const bin = String(p.bin ?? "");
+        const args = Array.isArray(p.args) ? p.args : [];
+        if (bin === "kubectl") {
+            const sub = args.find((a) => !a.startsWith("-")) ?? "";
+            if (KUBECTL_DESTRUCTIVE.has(sub)) {
+                return { rank: "destructive", reason: `kubectl ${sub}`, template: "kubectl" };
+            }
+            if (KUBECTL_WRITE.has(sub)) {
+                return { rank: "write", reason: `kubectl ${sub}`, template: "kubectl" };
+            }
+            if (KUBECTL_READ.has(sub)) {
+                return { rank: "read", reason: `kubectl ${sub}`, template: "kubectl" };
+            }
+            return { rank: "write", reason: `kubectl ${sub || "(unknown)"} — defaulted`, template: "kubectl" };
+        }
+        if (bin === "git") {
+            const sub = args.find((a) => !a.startsWith("-")) ?? "";
+            const hasForce = args.some((a) => GIT_DESTRUCTIVE_FLAGS.includes(a));
+            if (GIT_DESTRUCTIVE_SUBCMDS.has(sub) && hasForce) {
+                return { rank: "destructive", reason: `git ${sub} with force flag`, template: "git" };
+            }
+            if (sub === "push")
+                return { rank: "write", reason: "git push", template: "git" };
+            if (sub === "commit" || sub === "add" || sub === "checkout") {
+                return { rank: "write", reason: `git ${sub}`, template: "git" };
+            }
+            return { rank: "read", reason: `git ${sub || "status"}`, template: "git" };
+        }
+        if (bin === "gh") {
+            const sub = args.find((a) => !a.startsWith("-")) ?? "";
+            if (GH_DESTRUCTIVE.has(sub)) {
+                return { rank: "destructive", reason: `gh ${sub}`, template: "gh" };
+            }
+            if (GH_READ.has(sub))
+                return { rank: "read", reason: `gh ${sub}`, template: "gh" };
+            return { rank: "write", reason: `gh ${sub || "(unknown)"}`, template: "gh" };
+        }
+        return { rank: "write", reason: `shell.exec ${bin} — defaulted` };
+    }
+    if (step.kind === "http.call") {
+        const method = String(p.method ?? "GET");
+        const url = String(p.url ?? "");
+        // Jira write endpoints of interest → mark destructive on hard deletes
+        if (/\/rest\/api\/\d+\/issue\/[^/]+$/.test(url) && method.toUpperCase() === "DELETE") {
+            return { rank: "destructive", reason: "Jira DELETE /issue/{id}", template: "jira" };
+        }
+        return { rank: httpRisk(method), reason: `HTTP ${method.toUpperCase()}` };
+    }
+    if (step.kind === "mcp.tool") {
+        const hint = String(p.riskHint ?? "");
+        if (hint === "read" || hint === "write" || hint === "destructive") {
+            return { rank: hint, reason: `mcp.tool riskHint=${hint}` };
+        }
+        return { rank: "write", reason: "mcp.tool defaulted to write" };
+    }
+    return { rank: "write", reason: `unknown kind ${String(step.kind)} — defaulted` };
+}
+/** Runtime approval resolver — used by `run.ts` on every tick. */
+export function resolveEffectiveApproval(step, cls, opts) {
+    const requested = Boolean(step.autoApply);
+    if (cls.rank !== "destructive") {
+        return { autoApply: requested, forcedApproval: false };
+    }
+    const ack = Boolean(step.acknowledgeDestructive);
+    if (ack && opts.playbookSigned) {
+        return { autoApply: requested, forcedApproval: false };
+    }
+    return {
+        autoApply: false,
+        forcedApproval: true,
+        reason: ack
+            ? "destructive + acknowledgeDestructive requires a signed playbook — forcing approval"
+            : "destructive step — forcing approval (set acknowledgeDestructive on a signed playbook to auto-apply)",
+    };
+}
+//# sourceMappingURL=scope-templates.js.map

package/dist/lib/scope-templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-templates.js","sourceRoot":"","sources":["../../src/lib/scope-templates.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,qEAAqE;AACrE,4CAA4C;AAC5C,6DAA6D;AAC7D,4EAA4E;AAC5E,4EAA4E;AAC5E,0DAA0D;AAC1D,yEAAyE;AACzE,yEAAyE;AACzE,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,6EAA6E;AAY7E,iFAAiF;AACjF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe;IAC5D,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM;CAC5D,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO;IAC/D,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO;CACpE,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM;CACzD,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAChE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAExF,iFAAiF;AACjF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAChF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpD,iFAAiF;AACjF,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAClE,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC;IACzC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,YAAY,CAAC,IAAkB;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAiC,CAAC;IAEjD,wEAAwE;IACxE,4DAA4D;IAC5D,MAAM,QAAQ,GAAI,IAA4B,CAAC,IAAI,CAAC;IACpD,IAAI,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAE/E,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,IAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;YAChF,CAAC;YACD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;YAC1E,CAAC;YACD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,WAAW,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACjD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,GAAG,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACxF,CAAC;YACD,IAAI,GAAG,KAAK,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAClF,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBAC5D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACtE,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC/E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,cAAc,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAChC,sEAAsE;QACtE,IAAI,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YACrF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAClE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,IAAI,EAAE,EAAE,CAAC;QAC7D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;AACpF,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,wBAAwB,CACtC,IAAkB,EAClB,GAAuB,EACvB,IAAiC;IAEjC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAE,IAA6C,CAAC,sBAAsB,CAAC,CAAC;IAC3F,IAAI,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,GAAG;YACT,CAAC,CAAC,oFAAoF;YACtF,CAAC,CAAC,qGAAqG;KAC1G,CAAC;AACJ,CAAC"}