@adtl/gateway 0.5.1 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +152 -9
- package/dist/approvals.d.ts +22 -6
- package/dist/approvals.d.ts.map +1 -1
- package/dist/approvals.js +56 -26
- package/dist/approvals.js.map +1 -1
- package/dist/audit.d.ts +8 -0
- package/dist/audit.d.ts.map +1 -1
- package/dist/audit.js.map +1 -1
- package/dist/auditCli.d.ts +2 -0
- package/dist/auditCli.d.ts.map +1 -1
- package/dist/auditCli.js +13 -10
- package/dist/auditCli.js.map +1 -1
- package/dist/cedar.d.ts +27 -0
- package/dist/cedar.d.ts.map +1 -0
- package/dist/cedar.js +134 -0
- package/dist/cedar.js.map +1 -0
- package/dist/cli.js +17 -1
- package/dist/cli.js.map +1 -1
- package/dist/config.d.ts +330 -21
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +74 -1
- package/dist/config.js.map +1 -1
- package/dist/elicitation.d.ts +25 -0
- package/dist/elicitation.d.ts.map +1 -0
- package/dist/elicitation.js +46 -0
- package/dist/elicitation.js.map +1 -0
- package/dist/gateway.d.ts +30 -5
- package/dist/gateway.d.ts.map +1 -1
- package/dist/gateway.js +96 -14
- package/dist/gateway.js.map +1 -1
- package/dist/hooks/claudeCode.d.ts +4 -0
- package/dist/hooks/claudeCode.d.ts.map +1 -1
- package/dist/hooks/claudeCode.js +8 -1
- package/dist/hooks/claudeCode.js.map +1 -1
- package/dist/hooks/run.d.ts.map +1 -1
- package/dist/hooks/run.js +6 -3
- package/dist/hooks/run.js.map +1 -1
- package/dist/index.d.ts +6 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +6 -0
- package/dist/index.js.map +1 -1
- package/dist/init/presets.d.ts.map +1 -1
- package/dist/init/presets.js +54 -0
- package/dist/init/presets.js.map +1 -1
- package/dist/invoker.d.ts +21 -1
- package/dist/invoker.d.ts.map +1 -1
- package/dist/invoker.js +19 -2
- package/dist/invoker.js.map +1 -1
- package/dist/ledgerCli.d.ts +1 -1
- package/dist/ledgerCli.d.ts.map +1 -1
- package/dist/ledgerCli.js +9 -3
- package/dist/ledgerCli.js.map +1 -1
- package/dist/ntfy.d.ts +3 -1
- package/dist/ntfy.d.ts.map +1 -1
- package/dist/ntfy.js +2 -1
- package/dist/ntfy.js.map +1 -1
- package/dist/playgroundCli.d.ts +8 -0
- package/dist/playgroundCli.d.ts.map +1 -0
- package/dist/playgroundCli.js +57 -0
- package/dist/playgroundCli.js.map +1 -0
- package/dist/receipt.d.ts +62 -0
- package/dist/receipt.d.ts.map +1 -0
- package/dist/receipt.js +117 -0
- package/dist/receipt.js.map +1 -0
- package/dist/receiptCli.d.ts +8 -0
- package/dist/receiptCli.d.ts.map +1 -0
- package/dist/receiptCli.js +87 -0
- package/dist/receiptCli.js.map +1 -0
- package/dist/roles.d.ts +9 -0
- package/dist/roles.d.ts.map +1 -0
- package/dist/roles.js +41 -0
- package/dist/roles.js.map +1 -0
- package/dist/startup.d.ts +14 -0
- package/dist/startup.d.ts.map +1 -1
- package/dist/startup.js +92 -7
- package/dist/startup.js.map +1 -1
- package/package.json +16 -4
- package/playground/fake-github.mjs +98 -0
- package/playground/fake-memory.mjs +130 -0
- package/playground/index.html +411 -0
- package/playground/playground.yaml +40 -0
- package/playground/server.mjs +290 -0
- package/src/approvals.ts +63 -26
- package/src/audit.ts +5 -0
- package/src/auditCli.ts +11 -8
- package/src/cedar.ts +140 -0
- package/src/cli.ts +16 -1
- package/src/config.ts +80 -1
- package/src/elicitation.ts +69 -0
- package/src/gateway.ts +108 -17
- package/src/hooks/claudeCode.ts +13 -2
- package/src/hooks/run.ts +6 -3
- package/src/index.ts +6 -0
- package/src/init/presets.ts +54 -0
- package/src/invoker.ts +39 -2
- package/src/ledgerCli.ts +9 -3
- package/src/ntfy.ts +4 -1
- package/src/playgroundCli.ts +60 -0
- package/src/receipt.ts +148 -0
- package/src/receiptCli.ts +85 -0
- package/src/roles.ts +55 -0
- package/src/startup.ts +88 -6
package/dist/auditCli.js
CHANGED
|
@@ -16,6 +16,18 @@ removed, reordered or inserted (exit 1 if one was), and prints the hash of
|
|
|
16
16
|
the last line. Lines cut off the end are not detected; note that hash
|
|
17
17
|
somewhere else if you need to check later. Without <file>, the log is
|
|
18
18
|
gateway.audit from the config.`;
|
|
19
|
+
/** The audit log: `file` if given, else `gateway.audit` from `config`. */
|
|
20
|
+
export async function resolveAuditPath(file, config, usage) {
|
|
21
|
+
if (file)
|
|
22
|
+
return resolve(file);
|
|
23
|
+
if (!config)
|
|
24
|
+
throw new Error(`Give the audit log file, or -c <adtl.yaml> with gateway.audit set\n\n${usage}`);
|
|
25
|
+
const abs = resolve(config);
|
|
26
|
+
const gw = (parseYaml(await readFile(abs, "utf8")) ?? {}).gateway ?? {};
|
|
27
|
+
if (typeof gw.audit !== "string")
|
|
28
|
+
throw new Error(`${config} has no gateway.audit`);
|
|
29
|
+
return resolve(dirname(abs), gw.audit);
|
|
30
|
+
}
|
|
19
31
|
export async function runAuditCommand(argv) {
|
|
20
32
|
const [cmd, ...rest] = argv;
|
|
21
33
|
let config;
|
|
@@ -35,16 +47,7 @@ export async function runAuditCommand(argv) {
|
|
|
35
47
|
throw new Error(`Unknown audit command: ${cmd}\n\n${AUDIT_USAGE}`);
|
|
36
48
|
if (files.length > 1)
|
|
37
49
|
throw new Error(`Unexpected argument: ${files[1]}\n\n${AUDIT_USAGE}`);
|
|
38
|
-
|
|
39
|
-
if (!path) {
|
|
40
|
-
if (!config)
|
|
41
|
-
throw new Error(`Give the audit log file, or -c <adtl.yaml> with gateway.audit set\n\n${AUDIT_USAGE}`);
|
|
42
|
-
const abs = resolve(config);
|
|
43
|
-
const gw = (parseYaml(await readFile(abs, "utf8")) ?? {}).gateway ?? {};
|
|
44
|
-
if (typeof gw.audit !== "string")
|
|
45
|
-
throw new Error(`${config} has no gateway.audit`);
|
|
46
|
-
path = resolve(dirname(abs), gw.audit);
|
|
47
|
-
}
|
|
50
|
+
const path = await resolveAuditPath(files[0], config, AUDIT_USAGE);
|
|
48
51
|
const v = verifyAuditLog(path);
|
|
49
52
|
if (!v.ok)
|
|
50
53
|
return { stdout: `${path}: TAMPERED: ${v.problem}`, exitCode: 1 };
|
package/dist/auditCli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auditCli.js","sourceRoot":"","sources":["../src/auditCli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;+BAMI,CAAC;AAOhC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAc;IAClD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,MAA0B,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAClD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC;;YACnF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvG,IAAI,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,OAAO,WAAW,EAAE,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC;IAE5F,
|
|
1
|
+
{"version":3,"file":"auditCli.js","sourceRoot":"","sources":["../src/auditCli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;+BAMI,CAAC;AAOhC,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAwB,EAAE,MAA0B,EAAE,KAAa;IACxG,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,KAAK,EAAE,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAuC,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/G,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,uBAAuB,CAAC,CAAC;IACpF,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAc;IAClD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,MAA0B,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAClD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC;;YACnF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvG,IAAI,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,OAAO,WAAW,EAAE,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC;IAE5F,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAEnE,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,KAAK,SAAS,MAAM,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACzH,CAAC"}
|
package/dist/cedar.d.ts
ADDED
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
import type { AuthorizationDecision, AuthorizationRequest, Authorizer } from "./authorizer.js";
|
|
2
|
+
import type { CedarConfig } from "./config.js";
|
|
3
|
+
type CedarValue = boolean | number | string | CedarValue[] | {
|
|
4
|
+
[key: string]: CedarValue;
|
|
5
|
+
};
|
|
6
|
+
export declare class CedarAuthorizer implements Authorizer {
|
|
7
|
+
private readonly cedar;
|
|
8
|
+
private readonly policies;
|
|
9
|
+
private readonly entities;
|
|
10
|
+
private readonly timeZone;
|
|
11
|
+
readonly name = "cedar";
|
|
12
|
+
private constructor();
|
|
13
|
+
/** Load the Cedar engine and the policy files. Throws on a missing package or files that don't parse. */
|
|
14
|
+
static load(cfg: CedarConfig, resolvePath: (p: string) => string): Promise<CedarAuthorizer>;
|
|
15
|
+
check(req: AuthorizationRequest): AuthorizationDecision;
|
|
16
|
+
}
|
|
17
|
+
/** Hour, minute and weekday ("Mon") in `timeZone`, for working-hours rules. */
|
|
18
|
+
export declare function clock(now: Date, timeZone: string | undefined): Record<string, CedarValue>;
|
|
19
|
+
/**
|
|
20
|
+
* Tool arguments as Cedar context values. Cedar has no null or fractions, so
|
|
21
|
+
* nulls are left out and fractions become strings. An object with `__entity`
|
|
22
|
+
* or `__extn` would be read as an entity or extension value, so the agent
|
|
23
|
+
* could name any entity; it is passed as a JSON string instead.
|
|
24
|
+
*/
|
|
25
|
+
export declare function toCedar(v: unknown): CedarValue | undefined;
|
|
26
|
+
export {};
|
|
27
|
+
//# sourceMappingURL=cedar.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cedar.d.ts","sourceRoot":"","sources":["../src/cedar.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,KAAK,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,CAAC;AAY3F,qBAAa,eAAgB,YAAW,UAAU;IAI9C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAN3B,QAAQ,CAAC,IAAI,WAAW;IAExB,OAAO;IAOP,yGAAyG;WAC5F,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAsBjG,KAAK,CAAC,GAAG,EAAE,oBAAoB,GAAG,qBAAqB;CAsCxD;AAED,+EAA+E;AAC/E,wBAAgB,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAIzF;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAe1D"}
|
package/dist/cedar.js
ADDED
|
@@ -0,0 +1,134 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Attribute-based authorization with Cedar (`gateway.cedar`):
|
|
3
|
+
*
|
|
4
|
+
* cedar:
|
|
5
|
+
* policies: ./adtl.cedar # Cedar policies, relative to adtl.yaml
|
|
6
|
+
* entities: ./entities.json # optional: Cedar entities (groups, attributes)
|
|
7
|
+
* timeZone: Europe/Berlin # optional: for context.time (default: the gateway's)
|
|
8
|
+
*
|
|
9
|
+
* Every call becomes a Cedar request:
|
|
10
|
+
*
|
|
11
|
+
* principal User::"alice", Service::"ci", or Anonymous::"anonymous" without an id
|
|
12
|
+
* action Action::"tools/call", Action::"resources/read" or Action::"prompts/get"
|
|
13
|
+
* resource Tool::"github.add_issue_comment", Prompt::"github.triage" or Resource::"<uri>"
|
|
14
|
+
* context { server, principalId, listing, time: { hour, minute, weekday }, arguments }
|
|
15
|
+
*
|
|
16
|
+
* Cedar denies unless a policy permits, and a `forbid` wins over any permit.
|
|
17
|
+
* Tool lists are filtered with `listing: true` and no `arguments`, so a policy
|
|
18
|
+
* on arguments should start with `context.listing ||`.
|
|
19
|
+
*
|
|
20
|
+
* Needs the optional dependency @cedar-policy/cedar-wasm, loaded only when
|
|
21
|
+
* `gateway.cedar` is set.
|
|
22
|
+
*/
|
|
23
|
+
import { readFileSync } from "node:fs";
|
|
24
|
+
export class CedarAuthorizer {
|
|
25
|
+
cedar;
|
|
26
|
+
policies;
|
|
27
|
+
entities;
|
|
28
|
+
timeZone;
|
|
29
|
+
name = "cedar";
|
|
30
|
+
constructor(cedar, policies, entities, timeZone) {
|
|
31
|
+
this.cedar = cedar;
|
|
32
|
+
this.policies = policies;
|
|
33
|
+
this.entities = entities;
|
|
34
|
+
this.timeZone = timeZone;
|
|
35
|
+
}
|
|
36
|
+
/** Load the Cedar engine and the policy files. Throws on a missing package or files that don't parse. */
|
|
37
|
+
static async load(cfg, resolvePath) {
|
|
38
|
+
let cedar;
|
|
39
|
+
try {
|
|
40
|
+
cedar = (await import("@cedar-policy/cedar-wasm/nodejs"));
|
|
41
|
+
}
|
|
42
|
+
catch {
|
|
43
|
+
throw new Error("gateway.cedar needs the Cedar engine: npm install @cedar-policy/cedar-wasm");
|
|
44
|
+
}
|
|
45
|
+
const policies = readFileSync(resolvePath(cfg.policies), "utf8");
|
|
46
|
+
const parsed = cedar.checkParsePolicySet({ staticPolicies: policies });
|
|
47
|
+
if (parsed.type === "failure")
|
|
48
|
+
throw new Error(`gateway.cedar.policies: ${parsed.errors.map((e) => e.message).join("; ")}`);
|
|
49
|
+
let entities = [];
|
|
50
|
+
if (cfg.entities) {
|
|
51
|
+
const json = JSON.parse(readFileSync(resolvePath(cfg.entities), "utf8"));
|
|
52
|
+
if (!Array.isArray(json))
|
|
53
|
+
throw new Error("gateway.cedar.entities: expected a JSON array of Cedar entities");
|
|
54
|
+
const ok = cedar.checkParseEntities({ entities: json });
|
|
55
|
+
if (ok.type === "failure")
|
|
56
|
+
throw new Error(`gateway.cedar.entities: ${ok.errors.map((e) => e.message).join("; ")}`);
|
|
57
|
+
entities = json;
|
|
58
|
+
}
|
|
59
|
+
return new CedarAuthorizer(cedar, policies, entities, cfg.timeZone);
|
|
60
|
+
}
|
|
61
|
+
check(req) {
|
|
62
|
+
const { principal } = req;
|
|
63
|
+
const [type, id] = req.event === "tools/call"
|
|
64
|
+
? ["Tool", `${req.server}.${req.tool}`]
|
|
65
|
+
: req.event === "prompts/get"
|
|
66
|
+
? ["Prompt", `${req.server}.${req.prompt}`]
|
|
67
|
+
: ["Resource", req.resource ?? ""];
|
|
68
|
+
const context = {
|
|
69
|
+
server: req.server,
|
|
70
|
+
listing: req.arguments === undefined,
|
|
71
|
+
time: clock(new Date(), this.timeZone),
|
|
72
|
+
...(principal.id !== undefined ? { principalId: principal.id } : {}),
|
|
73
|
+
...(req.arguments !== undefined ? { arguments: toCedar(req.arguments) ?? {} } : {}),
|
|
74
|
+
};
|
|
75
|
+
const answer = this.cedar.isAuthorized({
|
|
76
|
+
principal: principal.id === undefined
|
|
77
|
+
? { type: "Anonymous", id: "anonymous" }
|
|
78
|
+
: { type: principal.type === "service" ? "Service" : "User", id: principal.id },
|
|
79
|
+
action: { type: "Action", id: req.event },
|
|
80
|
+
resource: { type, id },
|
|
81
|
+
context,
|
|
82
|
+
policies: { staticPolicies: this.policies },
|
|
83
|
+
entities: this.entities,
|
|
84
|
+
});
|
|
85
|
+
if (answer.type === "failure")
|
|
86
|
+
throw new Error(answer.errors.map((e) => e.message).join("; "));
|
|
87
|
+
const { decision, diagnostics } = answer.response;
|
|
88
|
+
if (decision === "allow")
|
|
89
|
+
return { allow: true };
|
|
90
|
+
const who = principal.id ?? "an anonymous caller";
|
|
91
|
+
const what = `the ${type.toLowerCase()} ${id}`;
|
|
92
|
+
return {
|
|
93
|
+
allow: false,
|
|
94
|
+
reason: diagnostics.reason.length
|
|
95
|
+
? `Cedar policy ${diagnostics.reason.join(", ")} forbids ${who} to use ${what}`
|
|
96
|
+
: `No Cedar policy permits ${who} to use ${what}`,
|
|
97
|
+
};
|
|
98
|
+
}
|
|
99
|
+
}
|
|
100
|
+
/** Hour, minute and weekday ("Mon") in `timeZone`, for working-hours rules. */
|
|
101
|
+
export function clock(now, timeZone) {
|
|
102
|
+
const parts = new Intl.DateTimeFormat("en-US", { timeZone, hourCycle: "h23", hour: "numeric", minute: "numeric", weekday: "short" }).formatToParts(now);
|
|
103
|
+
const part = (t) => parts.find((p) => p.type === t)?.value ?? "";
|
|
104
|
+
return { hour: Number(part("hour")), minute: Number(part("minute")), weekday: part("weekday") };
|
|
105
|
+
}
|
|
106
|
+
/**
|
|
107
|
+
* Tool arguments as Cedar context values. Cedar has no null or fractions, so
|
|
108
|
+
* nulls are left out and fractions become strings. An object with `__entity`
|
|
109
|
+
* or `__extn` would be read as an entity or extension value, so the agent
|
|
110
|
+
* could name any entity; it is passed as a JSON string instead.
|
|
111
|
+
*/
|
|
112
|
+
export function toCedar(v) {
|
|
113
|
+
if (v === null || v === undefined)
|
|
114
|
+
return undefined;
|
|
115
|
+
if (typeof v === "boolean" || typeof v === "string")
|
|
116
|
+
return v;
|
|
117
|
+
if (typeof v === "number")
|
|
118
|
+
return Number.isSafeInteger(v) ? v : String(v);
|
|
119
|
+
if (Array.isArray(v))
|
|
120
|
+
return v.map(toCedar).filter((x) => x !== undefined);
|
|
121
|
+
if (typeof v === "object") {
|
|
122
|
+
if ("__entity" in v || "__extn" in v)
|
|
123
|
+
return JSON.stringify(v);
|
|
124
|
+
const out = {};
|
|
125
|
+
for (const [k, x] of Object.entries(v)) {
|
|
126
|
+
const c = toCedar(x);
|
|
127
|
+
if (c !== undefined)
|
|
128
|
+
out[k] = c;
|
|
129
|
+
}
|
|
130
|
+
return out;
|
|
131
|
+
}
|
|
132
|
+
return String(v);
|
|
133
|
+
}
|
|
134
|
+
//# sourceMappingURL=cedar.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cedar.js","sourceRoot":"","sources":["../src/cedar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgBvC,MAAM,OAAO,eAAe;IAIP;IACA;IACA;IACA;IANV,IAAI,GAAG,OAAO,CAAC;IAExB,YACmB,KAAgB,EAChB,QAAgB,EAChB,QAAmB,EACnB,QAA4B;QAH5B,UAAK,GAAL,KAAK,CAAW;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAW;QACnB,aAAQ,GAAR,QAAQ,CAAoB;IAC5C,CAAC;IAEJ,yGAAyG;IACzG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAgB,EAAE,WAAkC;QACpE,IAAI,KAAgB,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAyB,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5H,IAAI,QAAQ,GAAc,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAClF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YAC7G,MAAM,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpH,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,GAAyB;QAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;QAC1B,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GACd,GAAG,CAAC,KAAK,KAAK,YAAY;YACxB,CAAC,CAAE,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAW;YAClD,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,aAAa;gBAC3B,CAAC,CAAE,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAW;gBACtD,CAAC,CAAE,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAW,CAAC;QACpD,MAAM,OAAO,GAA+B;YAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC;YACtC,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YACrC,SAAS,EACP,SAAS,CAAC,EAAE,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE;gBACxC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE;YACnF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE;YACzC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACtB,OAAO;YACP,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/F,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAClD,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,IAAI,qBAAqB,CAAC;QAClD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM;gBAC/B,CAAC,CAAC,gBAAgB,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,WAAW,IAAI,EAAE;gBAC/E,CAAC,CAAC,2BAA2B,GAAG,WAAW,IAAI,EAAE;SACpD,CAAC;IACJ,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,UAAU,KAAK,CAAC,GAAS,EAAE,QAA4B;IAC3D,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACxJ,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IACzE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,CAAU;IAChC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,UAAU,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,GAA+B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC"}
|
package/dist/cli.js
CHANGED
|
@@ -8,6 +8,9 @@
|
|
|
8
8
|
* adtl-gateway hook --config adtl.yaml [--gateway-server adtl]
|
|
9
9
|
* adtl-gateway ledger stats|verify|declassify|declassified
|
|
10
10
|
* adtl-gateway audit verify [<file>]
|
|
11
|
+
* adtl-gateway receipt list|<session>|verify <file>
|
|
12
|
+
* adtl-gateway key
|
|
13
|
+
* adtl-gateway playground [--port 4317] [--no-open]
|
|
11
14
|
*
|
|
12
15
|
* Point your MCP client (e.g. Claude Code's .mcp.json) at this command.
|
|
13
16
|
* Logs go to stderr; stdout carries MCP JSON-RPC only.
|
|
@@ -16,6 +19,8 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
|
|
|
16
19
|
import { EnvExpansionError } from "./config.js";
|
|
17
20
|
import { GATEWAY_VERSION } from "./gateway.js";
|
|
18
21
|
import { runAuditCommand } from "./auditCli.js";
|
|
22
|
+
import { runKeyCommand, runReceiptCommand } from "./receiptCli.js";
|
|
23
|
+
import { runPlayground } from "./playgroundCli.js";
|
|
19
24
|
import { runHook } from "./hooks/run.js";
|
|
20
25
|
import { runLedgerCommand } from "./ledgerCli.js";
|
|
21
26
|
import { runInit } from "./init/run.js";
|
|
@@ -25,6 +30,9 @@ const USAGE = `Usage: adtl-gateway --config <adtl.yaml> [--audit]
|
|
|
25
30
|
adtl-gateway hook --config <adtl.yaml> [--gateway-server <name>]
|
|
26
31
|
adtl-gateway ledger stats|verify|declassify|declassified (see: adtl-gateway ledger --help)
|
|
27
32
|
adtl-gateway audit verify [<file>] (see: adtl-gateway audit --help)
|
|
33
|
+
adtl-gateway receipt list|<session>|verify <file> (see: adtl-gateway receipt --help)
|
|
34
|
+
adtl-gateway key
|
|
35
|
+
adtl-gateway playground [--port <n>] [--no-open] (a local web UI with fake servers)
|
|
28
36
|
|
|
29
37
|
Runs an MCP server over stdio that forwards tool calls to the upstream
|
|
30
38
|
servers in the config, checking and labeling each call with ADTL.
|
|
@@ -100,6 +108,14 @@ async function main() {
|
|
|
100
108
|
process.exitCode = r.exitCode;
|
|
101
109
|
return;
|
|
102
110
|
}
|
|
111
|
+
if (process.argv[2] === "playground")
|
|
112
|
+
return runPlayground(process.argv.slice(3));
|
|
113
|
+
if (process.argv[2] === "receipt" || process.argv[2] === "key") {
|
|
114
|
+
const r = process.argv[2] === "key" ? await runKeyCommand() : await runReceiptCommand(process.argv.slice(3));
|
|
115
|
+
console.log(r.stdout);
|
|
116
|
+
process.exitCode = r.exitCode;
|
|
117
|
+
return;
|
|
118
|
+
}
|
|
103
119
|
const args = parseArgs(process.argv.slice(2));
|
|
104
120
|
// --help and --version print to stdout and exit; MCP is never served in these modes.
|
|
105
121
|
if (args.help)
|
|
@@ -202,7 +218,7 @@ async function init(path, write, from) {
|
|
|
202
218
|
process.exitCode = 1;
|
|
203
219
|
}
|
|
204
220
|
main().catch((err) => {
|
|
205
|
-
const known = err instanceof GatewayConfigError || err instanceof EnvExpansionError || ["ledger", "audit"].includes(process.argv[2] ?? "");
|
|
221
|
+
const known = err instanceof GatewayConfigError || err instanceof EnvExpansionError || ["ledger", "audit", "receipt", "key", "playground"].includes(process.argv[2] ?? "");
|
|
206
222
|
console.error(known ? `[adtl-gateway] ${err.message}` : err);
|
|
207
223
|
// For Claude Code hooks only exit code 2 stops the call; any other code lets it run.
|
|
208
224
|
process.exit(process.argv[2] === "hook" ? 2 : 1);
|
package/dist/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAmB,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEnF,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAwCyB,CAAC;AAcxC,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAS,EAAE,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aAC7C,IAAI,CAAC,KAAK,kBAAkB,IAAI,GAAG,CAAC,IAAI;YAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aACxE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aAClD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,WAAW;YAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;aACxD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;aACzE,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;aACtC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;aAClD,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;;YACrD,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY;QAAE,OAAO,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/D,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7G,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,qFAAqF;IACrF,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IAE9C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAE7C,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,kBAAkB,eAAe,mBAAmB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,SAAS,CAAC,CAAa,EAAE,IAAY,EAAE,KAAc;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrH,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,8BAA8B,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACnG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACtF,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,yBAAyB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC3G,CAAC,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;IACxG,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC,OAAO;QAAE,IAAI,GAAG,iBAAiB,CAAC;SAClC,IAAI,CAAC,KAAK;QAAE,IAAI,GAAG,qEAAqE,CAAC;SACzF,CAAC;QACJ,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,uBAAuB,IAAI,QAAQ,CAAC;QACzF,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO;YAAE,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,4CAA4C,CAAC,CAAC,GAAG,CAAC,IAAI,iCAAiC,CAAC;QAClI,IAAI,IAAI,qCAAqC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,aAAsB;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,SAAS,EAAE,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzH,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,KAAc,EAAE,IAAa;IAC7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,mBAAmB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnI,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,wBAAwB,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,KAAK,GAAG,GAAG,YAAY,kBAAkB,IAAI,GAAG,YAAY,iBAAiB,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3K,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAmB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,qFAAqF;IACrF,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC"}
|