@aarmos/bridge 0.1.10 → 0.1.11

package/dist/lib/attest.js

@@ -1,167 +0,0 @@
-// Attestation export — the audit-ready wedge.
-//
-// `aarmos attest` produces a single self-contained JSON artifact:
-//
-//   {
-//     version: 1,
-//     createdAt, since, until,
-//     playbook?:  { name, hash, signed, pubKey? },
-//     policyHash?: <sha256 of aarmos.json()>,
-//     packs:      [{ name, version, hash }],
-//     receipts:   [ ... hash-chained records from .aarmos/receipts.jsonl ... ],
-//     rootHash:   <sha256 of the concatenated per-receipt hashes>,
-//     signature?: { alg: "ed25519", pubKey, sig } // over the body sans signature
-//   }
-//
-// `aarmos attest verify <file>` re-computes rootHash from the embedded
-// receipts and, if a signature is present, verifies it. The verifier
-// is a pure function of the file — no network, no daemon — so an
-// auditor can run it air-gapped.
-import fs from "node:fs/promises";
-import path from "node:path";
-import crypto from "node:crypto";
-import { canonicalize, hashPlaybook, loadPlaybook } from "./playbook.js";
-import { listInstalledPacks, hashPack } from "./pack.js";
-export async function buildAttestation(opts) {
-    const until = opts.until ?? new Date();
-    const since = opts.since ?? new Date(0);
-    // --- receipts ---
-    const receipts = [];
-    try {
-        const raw = await fs.readFile(opts.receiptsFile, "utf8");
-        for (const line of raw.split("\n")) {
-            const t = line.trim();
-            if (!t)
-                continue;
-            let obj;
-            try {
-                obj = JSON.parse(t);
-            }
-            catch {
-                continue;
-            }
-            const at = Date.parse(obj.ts);
-            if (Number.isFinite(at) && at >= since.getTime() && at <= until.getTime()) {
-                receipts.push(obj);
-            }
-        }
-    }
-    catch {
-        /* no receipts yet */
-    }
-    const rootHash = merkleRoot(receipts.map((r) => r.hash ?? ""));
-    // --- playbook ---
-    let playbookEntry;
-    if (opts.playbookFile) {
-        const pb = await loadPlaybook(opts.playbookFile);
-        playbookEntry = {
-            name: pb.name,
-            hash: hashPlaybook(pb),
-            signed: Boolean(pb.signature),
-            pubKey: pb.signature?.pubKey,
-        };
-    }
-    // --- policy config (aarmos.json()) ---
-    let policyHash;
-    if (opts.policyFile) {
-        try {
-            const raw = await fs.readFile(opts.policyFile, "utf8");
-            policyHash = crypto.createHash("sha256").update(raw).digest("hex");
-        }
-        catch {
-            /* no policy file — omit */
-        }
-    }
-    // --- installed packs ---
-    const packs = opts.packsDir
-        ? (await listInstalledPacks(opts.packsDir)).map((p) => ({
-            name: p.name,
-            version: p.version,
-            hash: hashPack(p),
-        }))
-        : [];
-    return {
-        version: 1,
-        createdAt: new Date().toISOString(),
-        since: since.toISOString(),
-        until: until.toISOString(),
-        playbook: playbookEntry,
-        policyHash,
-        packs,
-        receipts,
-        rootHash,
-    };
-}
-export function attestationBody(a) {
-    const { signature: _s, ...rest } = a;
-    void _s;
-    return canonicalize(rest);
-}
-export async function signAttestation(a, privateKeyPem) {
-    const key = crypto.createPrivateKey(privateKeyPem);
-    const sig = crypto.sign(null, Buffer.from(attestationBody(a)), key);
-    const pubDer = crypto.createPublicKey(key).export({ format: "der", type: "spki" });
-    const rawPub = pubDer.subarray(pubDer.length - 32);
-    const b64u = (b) => b.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-    return { ...a, signature: { alg: "ed25519", pubKey: b64u(rawPub), sig: b64u(sig) } };
-}
-export function verifyAttestation(a) {
-    const recomputed = merkleRoot(a.receipts.map((r) => r.hash ?? ""));
-    if (recomputed !== a.rootHash) {
-        return { ok: false, reason: `rootHash mismatch (bundle=${a.rootHash} computed=${recomputed})` };
-    }
-    if (!a.signature)
-        return { ok: true };
-    if (a.signature.alg !== "ed25519") {
-        return { ok: false, reason: `unsupported alg: ${a.signature.alg}` };
-    }
-    try {
-        const spkiPrefix = Buffer.from([
-            0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
-        ]);
-        const b64uDecode = (s) => Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((s.length + 3) % 4), "base64");
-        const rawPub = b64uDecode(a.signature.pubKey);
-        if (rawPub.length !== 32)
-            return { ok: false, reason: "pubKey must be 32 bytes" };
-        const der = Buffer.concat([spkiPrefix, rawPub]);
-        const key = crypto.createPublicKey({ key: der, format: "der", type: "spki" });
-        const ok = crypto.verify(null, Buffer.from(attestationBody(a)), key, b64uDecode(a.signature.sig));
-        return ok ? { ok: true } : { ok: false, reason: "signature does not match bundle body" };
-    }
-    catch (err) {
-        return { ok: false, reason: err.message };
-    }
-}
-/** Sequential hash chain: h(0) = sha256(""), h(i) = sha256(h(i-1) + receipts[i]). */
-function merkleRoot(hashes) {
-    let acc = crypto.createHash("sha256").update("").digest("hex");
-    for (const h of hashes) {
-        acc = crypto
-            .createHash("sha256")
-            .update(acc + h)
-            .digest("hex");
-    }
-    return acc;
-}
-export function parseSince(s) {
-    const m = /^(\d+)\s*([hdm])$/.exec(s.trim());
-    if (m) {
-        const n = Number(m[1]);
-        const unit = m[2];
-        const ms = unit === "h" ? n * 3_600_000 : unit === "d" ? n * 86_400_000 : n * 60_000;
-        return new Date(Date.now() - ms);
-    }
-    const t = Date.parse(s);
-    if (Number.isFinite(t))
-        return new Date(t);
-    throw new Error(`--since: expected e.g. 24h, 7d, 30m, or an ISO date (got: ${s})`);
-}
-export async function writeAttestation(file, a) {
-    await fs.mkdir(path.dirname(path.resolve(file)), { recursive: true });
-    await fs.writeFile(path.resolve(file), JSON.stringify(a, null, 2) + "\n", "utf8");
-}
-export async function readAttestation(file) {
-    const raw = await fs.readFile(path.resolve(file), "utf8");
-    return JSON.parse(raw);
-}
-//# sourceMappingURL=attest.js.map

package/dist/lib/attest.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../src/lib/attest.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,kEAAkE;AAClE,EAAE;AACF,MAAM;AACN,kBAAkB;AAClB,+BAA+B;AAC/B,mDAAmD;AACnD,8CAA8C;AAC9C,6CAA6C;AAC7C,gFAAgF;AAChF,mEAAmE;AACnE,kFAAkF;AAClF,MAAM;AACN,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,iEAAiE;AACjE,iCAAiC;AAEjC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAoCzD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAwB;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAExC,mBAAmB;IACnB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,GAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAkB,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAE/D,mBAAmB;IACnB,IAAI,aAA4C,CAAC;IACjD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjD,aAAa,GAAG;YACd,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YACtB,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC;YAC7B,MAAM,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACvD,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ;QACzB,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;SAClB,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;QAC1B,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;QAC1B,QAAQ,EAAE,aAAa;QACvB,UAAU;QACV,KAAK;QACL,QAAQ;QACR,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAoB;IAClD,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,KAAK,EAAE,CAAC;IACR,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAoB,EACpB,aAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAW,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CACzB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAoB;IACpD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,IAAI,UAAU,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC,QAAQ,aAAa,UAAU,GAAG,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;SACvE,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAC/B,MAAM,CAAC,IAAI,CACT,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EACzE,QAAQ,CACT,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAClF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CACtB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAC/B,GAAG,EACH,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAC5B,CAAC;QACF,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,MAAgB;IAClC,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM;aACT,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;aACf,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;QACrF,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,CAAoB;IACvE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;AAC9C,CAAC"}

package/dist/lib/http-broker.js

@@ -1,82 +0,0 @@
-// HTTP broker step kind — governed `http.call`.
-//
-// Scope model:
-//   - The operator opts hosts in via `--allow-http <host>` (repeatable).
-//     A step that targets a host outside the allowlist fails at simulate
-//     time and at run time, before any bytes leave the machine.
-//   - Bearer tokens are read from env vars named by the step
-//     (`bearerEnv`) — never inlined into the playbook JSON. Signing a
-//     playbook therefore does NOT bind a secret; the token is bound at
-//     the daemon.
-//   - Responses are capped at 1 MiB and previewed as
-//     `{ method, url, headers (redacted), bodyBytes }` so the PWA card
-//     stays useful without leaking a token.
-import { z } from "zod";
-export const HttpCallParams = z.object({
-    method: z.enum(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]).default("GET"),
-    url: z.string().url(),
-    headers: z.record(z.string()).optional(),
-    body: z.string().optional(), // caller stringifies JSON — keeps signing deterministic
-    bearerEnv: z.string().optional(),
-    timeoutMs: z.number().int().min(100).max(60_000).default(15_000),
-});
-export function hostOf(url) {
-    try {
-        return new URL(url).host;
-    }
-    catch {
-        return "";
-    }
-}
-export function previewHttpCall(p, allowed) {
-    const host = hostOf(p.url);
-    if (!allowed.has(host)) {
-        throw new Error(`http.call host not allowed: ${host} (start with --allow-http ${host} or add it to the pack)`);
-    }
-    const redactedHeaders = { ...(p.headers ?? {}) };
-    for (const k of Object.keys(redactedHeaders)) {
-        if (/^authorization$/i.test(k))
-            redactedHeaders[k] = "***";
-    }
-    if (p.bearerEnv)
-        redactedHeaders["Authorization"] = `Bearer $${p.bearerEnv}`;
-    return {
-        method: p.method,
-        url: p.url,
-        host,
-        headers: redactedHeaders,
-        bodyBytes: p.body?.length ?? 0,
-    };
-}
-export async function executeHttpCall(p, allowed) {
-    const host = hostOf(p.url);
-    if (!allowed.has(host))
-        throw new Error(`http.call host not allowed: ${host}`);
-    const headers = { ...(p.headers ?? {}) };
-    if (p.bearerEnv) {
-        const tok = process.env[p.bearerEnv];
-        if (!tok)
-            throw new Error(`http.call: env ${p.bearerEnv} is not set on this host`);
-        headers["Authorization"] = `Bearer ${tok}`;
-    }
-    const controller = new AbortController();
-    const t = setTimeout(() => controller.abort(), p.timeoutMs);
-    try {
-        const res = await fetch(p.url, {
-            method: p.method,
-            headers,
-            body: p.body,
-            signal: controller.signal,
-        });
-        const bodyBuf = new Uint8Array(await res.arrayBuffer());
-        const capped = bodyBuf.length > 1_048_576 ? bodyBuf.slice(0, 1_048_576) : bodyBuf;
-        const bodySnippet = new TextDecoder("utf-8", { fatal: false }).decode(capped).slice(0, 4_000);
-        const outHeaders = {};
-        res.headers.forEach((v, k) => (outHeaders[k] = v));
-        return { status: res.status, headers: outHeaders, bodySnippet, bytes: bodyBuf.length };
-    }
-    finally {
-        clearTimeout(t);
-    }
-}
-//# sourceMappingURL=http-broker.js.map

package/dist/lib/http-broker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http-broker.js","sourceRoot":"","sources":["../../src/lib/http-broker.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,eAAe;AACf,yEAAyE;AACzE,yEAAyE;AACzE,gEAAgE;AAChE,6DAA6D;AAC7D,sEAAsE;AACtE,uEAAuE;AACvE,kBAAkB;AAClB,qDAAqD;AACrD,uEAAuE;AACvE,4CAA4C;AAE5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,wDAAwD;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACjE,CAAC,CAAC;AAIH,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAW,EAAE,OAAoB;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,6BAA6B,IAAI,yBAAyB,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAA2B,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7C,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,eAAe,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,CAAC,SAAS;QAAE,eAAe,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC;IAC7E,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI;QACJ,OAAO,EAAE,eAAe;QACxB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAW,EACX,OAAoB;IAOpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IACjE,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,SAAS,0BAA0B,CAAC,CAAC;QACnF,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAClF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9F,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACzF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/lib/llm-test.js

@@ -1,174 +0,0 @@
-// Node-side "test connection" for a BYO-LLM config, mirroring the browser
-// helper in src/lib/llm/test-connection.ts. Exposed as the `aarmos.testConnection`
-// RPC so the CLI (via bridge) can dry-run a provider without minting a chat
-// receipt. Pure fetch — no dependency on browser-only modules.
-//
-// The classifier maps raw provider errors into stable LLM_* AarmosError codes
-// so every surface (Settings button, provider-health strip, CLI, bridge)
-// speaks the same language. Codes intentionally live here (not avar-core):
-// avar-core ships as the open verifier spec and must stay LLM-agnostic.
-const DOCS = "https://aarmos.io/docs/byo-llm";
-const DEFAULT_TIMEOUT_MS = 6_000;
-const TEMPLATES = {
-    LLM_AUTH_INVALID: {
-        message: "Provider rejected the API key.",
-        hint: "Re-check the key in Settings → AI Provider. Rotated keys need to be pasted again.",
-        docsUrl: DOCS,
-    },
-    LLM_RATE_LIMITED: {
-        message: "Provider rate-limited the test request.",
-        hint: "Wait a few seconds and retry. Persistent 429s usually mean a per-minute cap on the account.",
-        docsUrl: DOCS,
-    },
-    LLM_QUOTA_EXCEEDED: {
-        message: "Provider account is out of credit/quota.",
-        hint: "Top up or switch provider. Test-connection uses 1 token — this is a real account problem, not the test.",
-        docsUrl: DOCS,
-    },
-    LLM_NETWORK: {
-        message: "Could not reach the provider.",
-        hint: "Check the machine's network. For self-hosted endpoints, verify the daemon is running.",
-        docsUrl: DOCS,
-    },
-    LLM_UNREACHABLE: {
-        message: "Custom endpoint did not respond.",
-        hint: "Verify the base URL is reachable from this machine (curl it) and CORS isn't blocking the browser client.",
-        docsUrl: DOCS,
-    },
-    LLM_TIMEOUT: {
-        message: "Provider did not respond within the test window.",
-        hint: "Retry, or raise the timeout. A cold container can take >6s on the first request.",
-        docsUrl: DOCS,
-    },
-    LLM_BAD_REQUEST: {
-        message: "Provider rejected the request shape.",
-        hint: "Usually a wrong model name or an endpoint that doesn't speak OpenAI-compatible chat completions.",
-        docsUrl: DOCS,
-    },
-    LLM_MODEL_NOT_FOUND: {
-        message: "Provider does not know that model.",
-        hint: "Pick a model the account has access to. Model IDs are case-sensitive.",
-        docsUrl: DOCS,
-    },
-    LLM_UNKNOWN: {
-        message: "Provider returned an unexpected error.",
-        hint: "Re-run with the CLI to see the raw upstream response, then file an issue if it looks like a bug.",
-        docsUrl: DOCS,
-    },
-};
-function makeError(code, overrides = {}) {
-    const base = TEMPLATES[code];
-    return {
-        code,
-        message: overrides.message ?? base.message,
-        hint: overrides.hint ?? base.hint,
-        docsUrl: overrides.docsUrl ?? base.docsUrl,
-    };
-}
-export function classifyProviderError(status, message, providerId, isCustom, aborted = false) {
-    const msg = (message || "").toLowerCase();
-    const prefix = `${providerId}${status ? ` [${status}]` : ""}: `;
-    const wrap = (base) => ({
-        ...base,
-        message: `${prefix}${message || base.message}`,
-    });
-    if (aborted || /abort/.test(msg))
-        return wrap(makeError("LLM_TIMEOUT"));
-    if (status === 401 ||
-        status === 403 ||
-        /invalid api key|unauthori[sz]ed|permission|forbidden/.test(msg)) {
-        return wrap(makeError("LLM_AUTH_INVALID"));
-    }
-    if (status === 429 || /rate.?limit|too many requests|rpm/.test(msg)) {
-        if (/quota|exhausted|billing|insufficient|credit/.test(msg)) {
-            return wrap(makeError("LLM_QUOTA_EXCEEDED"));
-        }
-        return wrap(makeError("LLM_RATE_LIMITED"));
-    }
-    if (status === 402 || /quota|exhausted|billing|insufficient|credit/.test(msg)) {
-        return wrap(makeError("LLM_QUOTA_EXCEEDED"));
-    }
-    if (status === 404 || /model.*(not.?found|does not exist|unknown)/.test(msg)) {
-        return wrap(makeError("LLM_MODEL_NOT_FOUND"));
-    }
-    if (status === 400 || status === 422)
-        return wrap(makeError("LLM_BAD_REQUEST"));
-    if (status === 0 || /failed to fetch|network|econnrefused|etimedout|enotfound|dns/.test(msg)) {
-        return wrap(makeError(isCustom ? "LLM_UNREACHABLE" : "LLM_NETWORK"));
-    }
-    return wrap(makeError("LLM_UNKNOWN"));
-}
-/** Return true when the URL is a safe absolute http(s) endpoint. */
-function isValidEndpoint(u) {
-    try {
-        const url = new URL(u);
-        return url.protocol === "http:" || url.protocol === "https:";
-    }
-    catch {
-        return false;
-    }
-}
-export async function testLlmConnection(p) {
-    const providerId = p.providerId || "custom";
-    const isCustom = providerId === "custom" || !p.baseUrl.includes("api.openai.com");
-    if (!isValidEndpoint(p.baseUrl)) {
-        return {
-            ok: false,
-            latencyMs: 0,
-            error: classifyProviderError(0, `invalid baseUrl: ${p.baseUrl}`, providerId, isCustom),
-        };
-    }
-    if (!p.model) {
-        return {
-            ok: false,
-            latencyMs: 0,
-            error: classifyProviderError(400, "missing model id", providerId, isCustom),
-        };
-    }
-    const url = p.baseUrl.replace(/\/+$/, "") + "/chat/completions";
-    const headers = {
-        "Content-Type": "application/json",
-        ...(p.apiKey ? { Authorization: `Bearer ${p.apiKey}` } : {}),
-        ...(p.headers ?? {}),
-    };
-    const ctrl = new AbortController();
-    const timeoutMs = p.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
-    const started = Date.now();
-    let aborted = false;
-    try {
-        const res = await fetch(url, {
-            method: "POST",
-            headers,
-            body: JSON.stringify({
-                model: p.model,
-                messages: [{ role: "user", content: "ping" }],
-                max_tokens: 1,
-            }),
-            signal: ctrl.signal,
-        });
-        const latencyMs = Date.now() - started;
-        if (res.ok)
-            return { ok: true, latencyMs, providerId, model: p.model };
-        const body = await res.text().catch(() => "");
-        return {
-            ok: false,
-            latencyMs,
-            error: classifyProviderError(res.status, body.slice(0, 240), providerId, isCustom),
-        };
-    }
-    catch (e) {
-        const latencyMs = Date.now() - started;
-        const raw = e instanceof Error ? e.message : String(e);
-        aborted = ctrl.signal.aborted;
-        return {
-            ok: false,
-            latencyMs,
-            error: classifyProviderError(0, raw, providerId, isCustom, aborted),
-        };
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-//# sourceMappingURL=llm-test.js.map

package/dist/lib/llm-test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"llm-test.js","sourceRoot":"","sources":["../../src/lib/llm-test.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,mFAAmF;AACnF,4EAA4E;AAC5E,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AAiCxE,MAAM,IAAI,GAAG,gCAAgC,CAAC;AAC9C,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,MAAM,SAAS,GAAwD;IACrE,gBAAgB,EAAE;QAChB,OAAO,EAAE,gCAAgC;QACzC,IAAI,EAAE,mFAAmF;QACzF,OAAO,EAAE,IAAI;KACd;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE,yCAAyC;QAClD,IAAI,EAAE,6FAA6F;QACnG,OAAO,EAAE,IAAI;KACd;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE,0CAA0C;QACnD,IAAI,EAAE,yGAAyG;QAC/G,OAAO,EAAE,IAAI;KACd;IACD,WAAW,EAAE;QACX,OAAO,EAAE,+BAA+B;QACxC,IAAI,EAAE,uFAAuF;QAC7F,OAAO,EAAE,IAAI;KACd;IACD,eAAe,EAAE;QACf,OAAO,EAAE,kCAAkC;QAC3C,IAAI,EAAE,0GAA0G;QAChH,OAAO,EAAE,IAAI;KACd;IACD,WAAW,EAAE;QACX,OAAO,EAAE,kDAAkD;QAC3D,IAAI,EAAE,kFAAkF;QACxF,OAAO,EAAE,IAAI;KACd;IACD,eAAe,EAAE;QACf,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EAAE,kGAAkG;QACxG,OAAO,EAAE,IAAI;KACd;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE,oCAAoC;QAC7C,IAAI,EAAE,uEAAuE;QAC7E,OAAO,EAAE,IAAI;KACd;IACD,WAAW,EAAE;QACX,OAAO,EAAE,wCAAwC;QACjD,IAAI,EAAE,kGAAkG;QACxG,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,SAAS,SAAS,CAChB,IAAmB,EACnB,YAAmD,EAAE;IAErD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;QAC1C,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QACjC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,OAAe,EACf,UAAkB,EAClB,QAAiB,EACjB,OAAO,GAAG,KAAK;IAEf,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAkB,EAAE,CAAC,CAAC;QACtD,GAAG,IAAI;QACP,OAAO,EAAE,GAAG,MAAM,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE;KAC/C,CAAC,CAAC;IAEH,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IACxE,IACE,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,sDAAsD,CAAC,IAAI,CAAC,GAAG,CAAC,EAChE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,IAAI,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,KAAK,CAAC,IAAI,8DAA8D,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7F,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,oEAAoE;AACpE,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,CAAuB;IAC7D,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,IAAI,QAAQ,CAAC;IAC5C,MAAM,QAAQ,GAAG,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAElF,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,CAAC;YACZ,KAAK,EAAE,qBAAqB,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC;SACvF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,CAAC;YACZ,KAAK,EAAE,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,QAAQ,CAAC;SAC5E,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC;IAChE,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;KACrB,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC7C,UAAU,EAAE,CAAC;aACd,CAAC;YACF,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACvC,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS;YACT,KAAK,EAAE,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC;SACnF,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS;YACT,KAAK,EAAE,qBAAqB,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC;SACpE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/lib/mcp-broker.js

@@ -1,85 +0,0 @@
-// MCP broker step kind — governed `mcp.tool` calls over Streamable HTTP.
-//
-// The daemon speaks raw MCP JSON-RPC 2.0 to remote servers so the CLI
-// stays dependency-free (no @ai-sdk/mcp on the server surface). Every
-// endpoint must be opted in via `--allow-mcp <url>` — this is how we
-// stop a playbook from silently rerouting itself to an attacker's MCP
-// server after signing.
-import { z } from "zod";
-export const McpToolParams = z.object({
-    endpoint: z.string().url(),
-    tool: z.string().min(1),
-    args: z.record(z.unknown()).default({}),
-    bearerEnv: z.string().optional(),
-    /** Optional operator hint for the risk classifier. Defaults to "write". */
-    riskHint: z.enum(["read", "write", "destructive"]).optional(),
-    timeoutMs: z.number().int().min(100).max(60_000).default(15_000),
-});
-export function previewMcpTool(p, allowed) {
-    if (!allowed.has(p.endpoint)) {
-        throw new Error(`mcp.tool endpoint not allowed: ${p.endpoint} (start with --allow-mcp ${p.endpoint})`);
-    }
-    return {
-        endpoint: p.endpoint,
-        tool: p.tool,
-        argKeys: Object.keys(p.args ?? {}),
-        riskHint: p.riskHint ?? "write",
-    };
-}
-export async function executeMcpTool(p, allowed) {
-    if (!allowed.has(p.endpoint))
-        throw new Error(`mcp.tool endpoint not allowed: ${p.endpoint}`);
-    const headers = {
-        "Content-Type": "application/json",
-        // Streamable HTTP servers reject requests without both types.
-        Accept: "application/json, text/event-stream",
-    };
-    if (p.bearerEnv) {
-        const tok = process.env[p.bearerEnv];
-        if (!tok)
-            throw new Error(`mcp.tool: env ${p.bearerEnv} is not set on this host`);
-        headers["Authorization"] = `Bearer ${tok}`;
-    }
-    const body = JSON.stringify({
-        jsonrpc: "2.0",
-        id: Date.now(),
-        method: "tools/call",
-        params: { name: p.tool, arguments: p.args ?? {} },
-    });
-    const controller = new AbortController();
-    const t = setTimeout(() => controller.abort(), p.timeoutMs);
-    try {
-        const res = await fetch(p.endpoint, {
-            method: "POST",
-            headers,
-            body,
-            signal: controller.signal,
-        });
-        const text = await res.text();
-        // Streamable HTTP may return SSE frames; extract the first `data:` payload if so.
-        const payload = text.startsWith("event:") || text.includes("\ndata:") ? extractFirstSseData(text) : text;
-        let parsed = payload;
-        try {
-            parsed = JSON.parse(payload);
-        }
-        catch {
-            /* leave as text */
-        }
-        const envelope = parsed;
-        if (envelope && typeof envelope === "object" && "error" in envelope && envelope.error) {
-            return { ok: false, error: envelope.error };
-        }
-        return { ok: res.ok, result: envelope?.result ?? parsed };
-    }
-    finally {
-        clearTimeout(t);
-    }
-}
-function extractFirstSseData(text) {
-    for (const line of text.split(/\r?\n/)) {
-        if (line.startsWith("data:"))
-            return line.slice(5).trim();
-    }
-    return text;
-}
-//# sourceMappingURL=mcp-broker.js.map

package/dist/lib/mcp-broker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-broker.js","sourceRoot":"","sources":["../../src/lib/mcp-broker.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,wBAAwB;AAExB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACjE,CAAC,CAAC;AAGH,MAAM,UAAU,cAAc,CAAC,CAAc,EAAE,OAAoB;IACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,kCAAkC,CAAC,CAAC,QAAQ,4BAA4B,CAAC,CAAC,QAAQ,GAAG,CACtF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,OAAO;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,CAAc,EACd,OAAoB;IAEpB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,8DAA8D;QAC9D,MAAM,EAAE,qCAAqC;KAC9C,CAAC;IACF,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,SAAS,0BAA0B,CAAC,CAAC;QAClF,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;QACd,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE;KAClD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,kFAAkF;QAClF,MAAM,OAAO,GACX,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,IAAI,MAAM,GAAY,OAAO,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QACD,MAAM,QAAQ,GAAG,MAA+C,CAAC;QACjE,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,MAAM,EAAE,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/pack.js

@@ -1,84 +0,0 @@
-// Certified playbook packs — versioned bundles of playbooks, scope
-// templates, and pre-classified risk rankings.
-//
-// Format (single JSON file, optionally signed):
-//   {
-//     "name": "@aarmos/k8s-safeguards",
-//     "version": "0.1.0",
-//     "instructions": "Governed kubectl playbooks for restart / scale / drain.",
-//     "playbooks": [ Playbook, ... ],   // same shape as a standalone playbook
-//     "allow": {
-//       "shell": ["kubectl"],
-//       "http":  ["api.github.com"],
-//       "mcp":   ["https://mcp.example/atlassian"]
-//     },
-//     "signature"?: { alg: "ed25519", pubKey, sig }
-//   }
-//
-// The pack itself is signed with the SAME ed25519 primitive as
-// playbooks (see lib/playbook.ts). `aarmos pack verify` and
-// `aarmos run --enforce-signatures` both accept a pack pubkey.
-//
-// Install writes to `.aarmos/packs/<safe-name>-<version>/pack.json`
-// so packs are inspectable, diff-able in git, and never mutate the
-// operator's global state.
-import fs from "node:fs/promises";
-import path from "node:path";
-import crypto from "node:crypto";
-import { canonicalize } from "./playbook.js";
-export function packBody(pack) {
-    const { signature: _s, ...rest } = pack;
-    void _s;
-    return canonicalize(rest);
-}
-export function hashPack(pack) {
-    return crypto.createHash("sha256").update(packBody(pack)).digest("hex");
-}
-export async function loadPack(p) {
-    const raw = await fs.readFile(path.resolve(p), "utf8");
-    const parsed = JSON.parse(raw);
-    if (!parsed?.name || typeof parsed.name !== "string")
-        throw new Error("pack.name required");
-    if (!parsed.version || typeof parsed.version !== "string")
-        throw new Error("pack.version required");
-    if (!Array.isArray(parsed.playbooks) || parsed.playbooks.length === 0) {
-        throw new Error("pack.playbooks must be a non-empty array");
-    }
-    return parsed;
-}
-const SAFE_NAME_RE = /[^a-zA-Z0-9._-]/g;
-export function packInstallDir(pack, rootDir) {
-    const safe = pack.name.replace(SAFE_NAME_RE, "_");
-    return path.join(rootDir, `${safe}-${pack.version}`);
-}
-export async function installPack(source, rootDir) {
-    const pack = await loadPack(source);
-    const dir = packInstallDir(pack, rootDir);
-    await fs.mkdir(dir, { recursive: true });
-    const dest = path.join(dir, "pack.json");
-    await fs.writeFile(dest, JSON.stringify(pack, null, 2) + "\n", "utf8");
-    return { pack, installed: dest };
-}
-export async function listInstalledPacks(rootDir) {
-    const out = [];
-    try {
-        const entries = await fs.readdir(rootDir, { withFileTypes: true });
-        for (const e of entries) {
-            if (!e.isDirectory())
-                continue;
-            const file = path.join(rootDir, e.name, "pack.json");
-            try {
-                const raw = await fs.readFile(file, "utf8");
-                out.push(JSON.parse(raw));
-            }
-            catch {
-                /* ignore malformed */
-            }
-        }
-    }
-    catch {
-        /* no packs dir yet */
-    }
-    return out;
-}
-//# sourceMappingURL=pack.js.map

package/dist/lib/pack.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pack.js","sourceRoot":"","sources":["../../src/lib/pack.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,+CAA+C;AAC/C,EAAE;AACF,gDAAgD;AAChD,MAAM;AACN,wCAAwC;AACxC,0BAA0B;AAC1B,iFAAiF;AACjF,+EAA+E;AAC/E,iBAAiB;AACjB,8BAA8B;AAC9B,qCAAqC;AACrC,mDAAmD;AACnD,SAAS;AACT,oDAAoD;AACpD,MAAM;AACN,EAAE;AACF,+DAA+D;AAC/D,4DAA4D;AAC5D,+DAA+D;AAC/D,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,2BAA2B;AAE3B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAiB,MAAM,eAAe,CAAC;AAe5D,MAAM,UAAU,QAAQ,CAAC,IAAU;IACjC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxC,KAAK,EAAE,CAAC;IACR,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAU;IACjC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAS;IACtC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QACvD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAc,CAAC;AACxB,CAAC;AAED,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,UAAU,cAAc,CAAC,IAAU,EAAE,OAAe;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe;IACtD,MAAM,GAAG,GAAW,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,SAAS;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAS,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}