@aid-framework/ir 0.0.0 → 0.1.48
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +201 -0
- package/README.md +199 -0
- package/dist/.tsbuildinfo +1 -0
- package/dist/build.d.ts +74 -0
- package/dist/build.d.ts.map +1 -0
- package/dist/build.js +1079 -0
- package/dist/build.js.map +1 -0
- package/dist/capabilities.d.ts +65 -0
- package/dist/capabilities.d.ts.map +1 -0
- package/dist/capabilities.js +176 -0
- package/dist/capabilities.js.map +1 -0
- package/dist/catalog/index.d.ts +36 -0
- package/dist/catalog/index.d.ts.map +1 -0
- package/dist/catalog/index.js +43 -0
- package/dist/catalog/index.js.map +1 -0
- package/dist/catalog/models.json +52 -0
- package/dist/diagnostics.d.ts +90 -0
- package/dist/diagnostics.d.ts.map +1 -0
- package/dist/diagnostics.js +103 -0
- package/dist/diagnostics.js.map +1 -0
- package/dist/gates/agents.d.ts +34 -0
- package/dist/gates/agents.d.ts.map +1 -0
- package/dist/gates/agents.js +233 -0
- package/dist/gates/agents.js.map +1 -0
- package/dist/gates/capability.d.ts +15 -0
- package/dist/gates/capability.d.ts.map +1 -0
- package/dist/gates/capability.js +81 -0
- package/dist/gates/capability.js.map +1 -0
- package/dist/gates/contract.d.ts +35 -0
- package/dist/gates/contract.d.ts.map +1 -0
- package/dist/gates/contract.js +19 -0
- package/dist/gates/contract.js.map +1 -0
- package/dist/gates/cost.d.ts +40 -0
- package/dist/gates/cost.d.ts.map +1 -0
- package/dist/gates/cost.js +167 -0
- package/dist/gates/cost.js.map +1 -0
- package/dist/gates/deploy.d.ts +23 -0
- package/dist/gates/deploy.d.ts.map +1 -0
- package/dist/gates/deploy.js +44 -0
- package/dist/gates/deploy.js.map +1 -0
- package/dist/gates/eval-coverage.d.ts +11 -0
- package/dist/gates/eval-coverage.d.ts.map +1 -0
- package/dist/gates/eval-coverage.js +50 -0
- package/dist/gates/eval-coverage.js.map +1 -0
- package/dist/gates/guardrails.d.ts +24 -0
- package/dist/gates/guardrails.d.ts.map +1 -0
- package/dist/gates/guardrails.js +112 -0
- package/dist/gates/guardrails.js.map +1 -0
- package/dist/gates/hitl.d.ts +17 -0
- package/dist/gates/hitl.d.ts.map +1 -0
- package/dist/gates/hitl.js +40 -0
- package/dist/gates/hitl.js.map +1 -0
- package/dist/gates/index.d.ts +66 -0
- package/dist/gates/index.d.ts.map +1 -0
- package/dist/gates/index.js +77 -0
- package/dist/gates/index.js.map +1 -0
- package/dist/gates/memory.d.ts +13 -0
- package/dist/gates/memory.d.ts.map +1 -0
- package/dist/gates/memory.js +67 -0
- package/dist/gates/memory.js.map +1 -0
- package/dist/gates/normalize.d.ts +26 -0
- package/dist/gates/normalize.d.ts.map +1 -0
- package/dist/gates/normalize.js +228 -0
- package/dist/gates/normalize.js.map +1 -0
- package/dist/gates/orchestration.d.ts +17 -0
- package/dist/gates/orchestration.d.ts.map +1 -0
- package/dist/gates/orchestration.js +46 -0
- package/dist/gates/orchestration.js.map +1 -0
- package/dist/gates/referential.d.ts +12 -0
- package/dist/gates/referential.d.ts.map +1 -0
- package/dist/gates/referential.js +554 -0
- package/dist/gates/referential.js.map +1 -0
- package/dist/gates/security.d.ts +22 -0
- package/dist/gates/security.d.ts.map +1 -0
- package/dist/gates/security.js +225 -0
- package/dist/gates/security.js.map +1 -0
- package/dist/index.d.ts +27 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +19 -0
- package/dist/index.js.map +1 -0
- package/dist/policy/ast.d.ts +61 -0
- package/dist/policy/ast.d.ts.map +1 -0
- package/dist/policy/ast.js +48 -0
- package/dist/policy/ast.js.map +1 -0
- package/dist/policy/index.d.ts +7 -0
- package/dist/policy/index.d.ts.map +1 -0
- package/dist/policy/index.js +4 -0
- package/dist/policy/index.js.map +1 -0
- package/dist/policy/lexer.d.ts +27 -0
- package/dist/policy/lexer.d.ts.map +1 -0
- package/dist/policy/lexer.js +147 -0
- package/dist/policy/lexer.js.map +1 -0
- package/dist/policy/parser.d.ts +15 -0
- package/dist/policy/parser.d.ts.map +1 -0
- package/dist/policy/parser.js +202 -0
- package/dist/policy/parser.js.map +1 -0
- package/dist/predicate/ast.d.ts +125 -0
- package/dist/predicate/ast.d.ts.map +1 -0
- package/dist/predicate/ast.js +111 -0
- package/dist/predicate/ast.js.map +1 -0
- package/dist/predicate/index.d.ts +7 -0
- package/dist/predicate/index.d.ts.map +1 -0
- package/dist/predicate/index.js +4 -0
- package/dist/predicate/index.js.map +1 -0
- package/dist/predicate/lexer.d.ts +30 -0
- package/dist/predicate/lexer.d.ts.map +1 -0
- package/dist/predicate/lexer.js +176 -0
- package/dist/predicate/lexer.js.map +1 -0
- package/dist/predicate/parser.d.ts +16 -0
- package/dist/predicate/parser.d.ts.map +1 -0
- package/dist/predicate/parser.js +317 -0
- package/dist/predicate/parser.js.map +1 -0
- package/dist/schema/ir.schema.json +1144 -0
- package/dist/serialize.d.ts +15 -0
- package/dist/serialize.d.ts.map +1 -0
- package/dist/serialize.js +53 -0
- package/dist/serialize.js.map +1 -0
- package/dist/shapes.d.ts +671 -0
- package/dist/shapes.d.ts.map +1 -0
- package/dist/shapes.js +159 -0
- package/dist/shapes.js.map +1 -0
- package/package.json +44 -14
|
@@ -0,0 +1,554 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Gate 1 — referential integrity (§7.1).
|
|
3
|
+
*
|
|
4
|
+
* Every reference resolves, and resolves to the right *kind*: a `tool` step naming
|
|
5
|
+
* a prompt is an error, not a lookup miss. Bindings are defined before use and
|
|
6
|
+
* unique within one pipeline scope, prompt placeholders and variables agree, and
|
|
7
|
+
* a model's fallback chain terminates.
|
|
8
|
+
*/
|
|
9
|
+
import { templatePlaceholders } from '../build.js';
|
|
10
|
+
import { IR_DIAGNOSTIC_CODES } from '../diagnostics.js';
|
|
11
|
+
import { reporter } from './contract.js';
|
|
12
|
+
/** The id namespaces a reference can name. */
|
|
13
|
+
const NAMESPACES = [
|
|
14
|
+
'types',
|
|
15
|
+
'models',
|
|
16
|
+
'prompts',
|
|
17
|
+
'tools',
|
|
18
|
+
'stores',
|
|
19
|
+
'retrievers',
|
|
20
|
+
'pipelines',
|
|
21
|
+
'guardrails',
|
|
22
|
+
'agents',
|
|
23
|
+
];
|
|
24
|
+
/**
|
|
25
|
+
* The spec declares no pipeline input schema in v0.1, so a step input that reads a
|
|
26
|
+
* request field cannot be checked against anything. That is a genuine gap, not a
|
|
27
|
+
* pass, so it is reported as suppressed rather than left silent.
|
|
28
|
+
*/
|
|
29
|
+
const SUPPRESSED = [
|
|
30
|
+
{
|
|
31
|
+
check: 'referential/request-input-fields',
|
|
32
|
+
reason: 'the spec DSL declares no pipeline input schema in v0.1, so a reference to an incoming request field (rather than to a prior step binding) cannot be validated against a declaration',
|
|
33
|
+
},
|
|
34
|
+
];
|
|
35
|
+
export function referentialGate(ir, options) {
|
|
36
|
+
const diagnostics = [];
|
|
37
|
+
const report = reporter(options);
|
|
38
|
+
const scope = {
|
|
39
|
+
names: {
|
|
40
|
+
types: new Set(ir.types.map((entry) => entry.id)),
|
|
41
|
+
models: new Set(ir.models.map((entry) => entry.id)),
|
|
42
|
+
prompts: new Set(ir.prompts.map((entry) => entry.id)),
|
|
43
|
+
tools: new Set(ir.tools.map((entry) => entry.id)),
|
|
44
|
+
stores: new Set(ir.stores.map((entry) => entry.id)),
|
|
45
|
+
retrievers: new Set(ir.retrievers.map((entry) => entry.id)),
|
|
46
|
+
pipelines: new Set(ir.pipelines.map((entry) => entry.id)),
|
|
47
|
+
guardrails: new Set(ir.guardrails.map((entry) => entry.id)),
|
|
48
|
+
agents: new Set(ir.agents.map((entry) => entry.id)),
|
|
49
|
+
},
|
|
50
|
+
};
|
|
51
|
+
checkTypeGraph(ir, diagnostics, report);
|
|
52
|
+
checkModels(ir, scope, diagnostics, report);
|
|
53
|
+
checkPrompts(ir, scope, diagnostics, report);
|
|
54
|
+
checkTools(ir, diagnostics, report);
|
|
55
|
+
checkRetrieval(ir, scope, diagnostics, report);
|
|
56
|
+
checkPipelines(ir, scope, diagnostics, report);
|
|
57
|
+
checkEvals(ir, scope, diagnostics, report);
|
|
58
|
+
return { diagnostics, suppressed: SUPPRESSED };
|
|
59
|
+
}
|
|
60
|
+
/** Reports a missed reference, distinguishing "wrong kind" from "does not exist". */
|
|
61
|
+
function reportRef(name, expected, scope, path, diagnostics, report) {
|
|
62
|
+
const singular = expected.slice(0, -1);
|
|
63
|
+
const foreign = NAMESPACES.find((kind) => kind !== expected && scope.names[kind].has(name));
|
|
64
|
+
if (foreign !== undefined) {
|
|
65
|
+
diagnostics.push(report.error({
|
|
66
|
+
code: IR_DIAGNOSTIC_CODES.refKindMismatch,
|
|
67
|
+
message: `the referential gate rejected this reference: "${name}" is a ${foreign.slice(0, -1)}, but a ${singular} is required here`,
|
|
68
|
+
path,
|
|
69
|
+
hint: `reference an existing ${singular}, or rename "${name}"`,
|
|
70
|
+
}));
|
|
71
|
+
return;
|
|
72
|
+
}
|
|
73
|
+
diagnostics.push(report.error({
|
|
74
|
+
code: IR_DIAGNOSTIC_CODES.refUnresolved,
|
|
75
|
+
message: `the referential gate rejected this reference: no ${singular} named "${name}" exists`,
|
|
76
|
+
path,
|
|
77
|
+
hint: 'declare it, or correct the name',
|
|
78
|
+
}));
|
|
79
|
+
}
|
|
80
|
+
function reportTypeRef(ref, path, diagnostics, report) {
|
|
81
|
+
if (ref.kind !== 'named' || ref.resolved)
|
|
82
|
+
return;
|
|
83
|
+
diagnostics.push(report.error({
|
|
84
|
+
code: IR_DIAGNOSTIC_CODES.typeUnresolved,
|
|
85
|
+
message: `the referential gate rejected this reference: type "${ref.name}" has no definition`,
|
|
86
|
+
path,
|
|
87
|
+
hint: 'declare it under types, or use a primitive type',
|
|
88
|
+
}));
|
|
89
|
+
}
|
|
90
|
+
function checkTypeGraph(ir, diagnostics, report) {
|
|
91
|
+
for (const type of ir.types) {
|
|
92
|
+
type.fields.forEach((field, index) => {
|
|
93
|
+
reportTypeRef(field.type, ['types', type.id, 'fields', index, 'type'], diagnostics, report);
|
|
94
|
+
});
|
|
95
|
+
}
|
|
96
|
+
const cycle = findTypeCycle(ir);
|
|
97
|
+
if (cycle === undefined)
|
|
98
|
+
return;
|
|
99
|
+
diagnostics.push(report.error({
|
|
100
|
+
code: IR_DIAGNOSTIC_CODES.typeCycle,
|
|
101
|
+
message: `the referential gate rejected this type: it participates in a reference cycle (${cycle.join(' -> ')})`,
|
|
102
|
+
path: ['types', cycle[0] ?? ''],
|
|
103
|
+
hint: 'a type graph must be acyclic so a generator can order declarations',
|
|
104
|
+
}));
|
|
105
|
+
}
|
|
106
|
+
/** Depth-first search returning the first cycle of a directed graph as `[a, b, a]`. */
|
|
107
|
+
function firstCycle(edges) {
|
|
108
|
+
const state = new Map();
|
|
109
|
+
const stack = [];
|
|
110
|
+
const visit = (id) => {
|
|
111
|
+
const seen = state.get(id);
|
|
112
|
+
if (seen === 'done')
|
|
113
|
+
return undefined;
|
|
114
|
+
if (seen === 'visiting')
|
|
115
|
+
return [...stack.slice(stack.indexOf(id)), id];
|
|
116
|
+
state.set(id, 'visiting');
|
|
117
|
+
stack.push(id);
|
|
118
|
+
for (const next of edges.get(id) ?? []) {
|
|
119
|
+
if (!edges.has(next))
|
|
120
|
+
continue;
|
|
121
|
+
const found = visit(next);
|
|
122
|
+
if (found !== undefined)
|
|
123
|
+
return found;
|
|
124
|
+
}
|
|
125
|
+
stack.pop();
|
|
126
|
+
state.set(id, 'done');
|
|
127
|
+
return undefined;
|
|
128
|
+
};
|
|
129
|
+
for (const id of edges.keys()) {
|
|
130
|
+
const found = visit(id);
|
|
131
|
+
if (found !== undefined)
|
|
132
|
+
return found;
|
|
133
|
+
}
|
|
134
|
+
return undefined;
|
|
135
|
+
}
|
|
136
|
+
function findTypeCycle(ir) {
|
|
137
|
+
return firstCycle(new Map(ir.types.map((type) => [
|
|
138
|
+
type.id,
|
|
139
|
+
type.fields.flatMap((field) => (field.type.kind === 'named' ? [field.type.name] : [])),
|
|
140
|
+
])));
|
|
141
|
+
}
|
|
142
|
+
function checkModels(ir, scope, diagnostics, report) {
|
|
143
|
+
for (const model of ir.models) {
|
|
144
|
+
model.fallbacks.forEach((alias, index) => {
|
|
145
|
+
if (scope.names.models.has(alias))
|
|
146
|
+
return;
|
|
147
|
+
reportRef(alias, 'models', scope, ['models', model.id, 'fallbacks', index], diagnostics, report);
|
|
148
|
+
});
|
|
149
|
+
}
|
|
150
|
+
const cycle = firstCycle(new Map(ir.models.map((model) => [model.id, model.fallbacks])));
|
|
151
|
+
if (cycle === undefined)
|
|
152
|
+
return;
|
|
153
|
+
diagnostics.push(report.error({
|
|
154
|
+
code: IR_DIAGNOSTIC_CODES.fallbackCycle,
|
|
155
|
+
message: `the referential gate rejected this fallback chain: it cycles (${cycle.join(' -> ')})`,
|
|
156
|
+
path: ['models', cycle[0] ?? '', 'fallbacks'],
|
|
157
|
+
hint: 'a fallback chain must terminate at a model that declares no fallbacks',
|
|
158
|
+
}));
|
|
159
|
+
}
|
|
160
|
+
function checkPrompts(ir, scope, diagnostics, report) {
|
|
161
|
+
for (const prompt of ir.prompts) {
|
|
162
|
+
if (!scope.names.models.has(prompt.model)) {
|
|
163
|
+
reportRef(prompt.model, 'models', scope, ['prompts', prompt.id, 'model'], diagnostics, report);
|
|
164
|
+
}
|
|
165
|
+
if (prompt.output.schema !== undefined) {
|
|
166
|
+
reportTypeRef(prompt.output.schema, ['prompts', prompt.id, 'output', 'schema'], diagnostics, report);
|
|
167
|
+
}
|
|
168
|
+
const declared = new Set(prompt.variables.map((variable) => variable.name));
|
|
169
|
+
const used = templatePlaceholders(prompt.template);
|
|
170
|
+
for (const placeholder of used) {
|
|
171
|
+
if (declared.has(placeholder))
|
|
172
|
+
continue;
|
|
173
|
+
diagnostics.push(report.error({
|
|
174
|
+
code: IR_DIAGNOSTIC_CODES.promptVariableUndeclared,
|
|
175
|
+
message: `the referential gate rejected this placeholder: prompt "${prompt.id}" uses "{{${placeholder}}}" but declares no variable named "${placeholder}"`,
|
|
176
|
+
path: ['prompts', prompt.id, 'template'],
|
|
177
|
+
hint: 'declare it under prompts.<id>.variables, or remove the placeholder',
|
|
178
|
+
}));
|
|
179
|
+
}
|
|
180
|
+
for (const variable of prompt.variables) {
|
|
181
|
+
if (used.includes(variable.name))
|
|
182
|
+
continue;
|
|
183
|
+
diagnostics.push(report.warn({
|
|
184
|
+
code: IR_DIAGNOSTIC_CODES.promptVariableUnused,
|
|
185
|
+
message: `the referential gate flagged this variable: prompt "${prompt.id}" declares "${variable.name}" but its template never uses "{{${variable.name}}}"`,
|
|
186
|
+
path: ['prompts', prompt.id, 'variables', variable.name],
|
|
187
|
+
}));
|
|
188
|
+
}
|
|
189
|
+
}
|
|
190
|
+
}
|
|
191
|
+
function checkTools(ir, diagnostics, report) {
|
|
192
|
+
for (const tool of ir.tools) {
|
|
193
|
+
reportTypeRef(tool.input, ['tools', tool.id, 'input'], diagnostics, report);
|
|
194
|
+
reportTypeRef(tool.output, ['tools', tool.id, 'output'], diagnostics, report);
|
|
195
|
+
}
|
|
196
|
+
}
|
|
197
|
+
/**
|
|
198
|
+
* A retriever's own references: the store it writes to and reads from, the model that
|
|
199
|
+
* embeds for it, and the model that reranks (when one is declared).
|
|
200
|
+
*
|
|
201
|
+
* The embedding model is held to a second condition the other references do not have:
|
|
202
|
+
* it must *declare* `embeddings`, because the IR derives the `embeddings` collection
|
|
203
|
+
* from exactly that declaration, and an embedder that cannot produce vectors would
|
|
204
|
+
* otherwise only fail at retrieval time, in the runtime, on a real query.
|
|
205
|
+
*/
|
|
206
|
+
function checkRetrieval(ir, scope, diagnostics, report) {
|
|
207
|
+
const models = new Map(ir.models.map((model) => [model.id, model]));
|
|
208
|
+
for (const retriever of ir.retrievers) {
|
|
209
|
+
const base = ['retrievers', retriever.id];
|
|
210
|
+
if (!scope.names.stores.has(retriever.store)) {
|
|
211
|
+
reportRef(retriever.store, 'stores', scope, [...base, 'store'], diagnostics, report);
|
|
212
|
+
}
|
|
213
|
+
const embedModel = models.get(retriever.embedModel);
|
|
214
|
+
if (embedModel === undefined) {
|
|
215
|
+
reportRef(retriever.embedModel, 'models', scope, [...base, 'embedModel'], diagnostics, report);
|
|
216
|
+
}
|
|
217
|
+
else if (!embedModel.capabilities.includes('embeddings')) {
|
|
218
|
+
diagnostics.push(report.error({
|
|
219
|
+
code: IR_DIAGNOSTIC_CODES.modelCapabilityMissing,
|
|
220
|
+
message: `the referential gate rejected this embedding model: retriever "${retriever.id}" embeds with model "${embedModel.id}", which does not declare the "embeddings" capability`,
|
|
221
|
+
path: [...base, 'embedModel'],
|
|
222
|
+
hint: 'declare "embeddings" on the model, or point embedModel at a model that does',
|
|
223
|
+
}));
|
|
224
|
+
}
|
|
225
|
+
if (retriever.rerank !== undefined && !scope.names.models.has(retriever.rerank.model)) {
|
|
226
|
+
reportRef(retriever.rerank.model, 'models', scope, [...base, 'rerank', 'model'], diagnostics, report);
|
|
227
|
+
}
|
|
228
|
+
}
|
|
229
|
+
}
|
|
230
|
+
function checkPipelines(ir, scope, diagnostics, report) {
|
|
231
|
+
for (const pipeline of ir.pipelines) {
|
|
232
|
+
checkPipelineSteps(pipeline, ir, scope, diagnostics, report);
|
|
233
|
+
}
|
|
234
|
+
}
|
|
235
|
+
function checkPipelineSteps(pipeline, ir, scope, diagnostics, report) {
|
|
236
|
+
const allBindings = new Set();
|
|
237
|
+
collectBindingNames(pipeline.steps, allBindings);
|
|
238
|
+
walkStepList(pipeline.steps, {
|
|
239
|
+
pipeline,
|
|
240
|
+
ir,
|
|
241
|
+
scope,
|
|
242
|
+
diagnostics,
|
|
243
|
+
report,
|
|
244
|
+
allBindings,
|
|
245
|
+
visible: new Map(),
|
|
246
|
+
base: ['pipelines', pipeline.id, 'steps'],
|
|
247
|
+
});
|
|
248
|
+
}
|
|
249
|
+
/**
|
|
250
|
+
* The path length of a top-level step list: `pipelines`, the pipeline id, `steps`. A
|
|
251
|
+
* nested list is longer, which is how a message tells the two apart.
|
|
252
|
+
*/
|
|
253
|
+
const TOP_LEVEL = 3;
|
|
254
|
+
/**
|
|
255
|
+
* The binding a step adds to the surrounding scope, or `undefined` if it adds none.
|
|
256
|
+
*
|
|
257
|
+
* `guard` binds nothing on purpose: it observes a payload, and the actions that could
|
|
258
|
+
* rewrite one are refused before generation, so there is no value to name.
|
|
259
|
+
*/
|
|
260
|
+
function bindingOf(step) {
|
|
261
|
+
return step.kind === 'emit' ||
|
|
262
|
+
step.kind === 'branch' ||
|
|
263
|
+
step.kind === 'parallel' ||
|
|
264
|
+
step.kind === 'guard'
|
|
265
|
+
? undefined
|
|
266
|
+
: step.as;
|
|
267
|
+
}
|
|
268
|
+
/** Render a step path as `pipelines.p.steps[2].branch.then[0]`, for a message. */
|
|
269
|
+
function locate(path) {
|
|
270
|
+
return path
|
|
271
|
+
.map((segment, index) => typeof segment === 'number' ? `[${segment}]` : `${index > 0 ? '.' : ''}${segment}`)
|
|
272
|
+
.join('');
|
|
273
|
+
}
|
|
274
|
+
/**
|
|
275
|
+
* Names that escape a step list and so can be referenced later. A `map` body is
|
|
276
|
+
* excluded on purpose: its bindings are per-item and never escape the iteration.
|
|
277
|
+
*/
|
|
278
|
+
function collectBindingNames(steps, into) {
|
|
279
|
+
for (const step of steps) {
|
|
280
|
+
const own = bindingOf(step);
|
|
281
|
+
if (own !== undefined)
|
|
282
|
+
into.add(own);
|
|
283
|
+
if (step.kind === 'branch') {
|
|
284
|
+
collectBindingNames(step.then, into);
|
|
285
|
+
collectBindingNames(step.else, into);
|
|
286
|
+
}
|
|
287
|
+
else if (step.kind === 'parallel') {
|
|
288
|
+
for (const arm of step.branches)
|
|
289
|
+
collectBindingNames(arm, into);
|
|
290
|
+
}
|
|
291
|
+
}
|
|
292
|
+
}
|
|
293
|
+
/**
|
|
294
|
+
* Walks a step list in order and returns the scope its successors see. Composite arms
|
|
295
|
+
* run in their own copy of the scope, so a name bound inside one arm is not visible in
|
|
296
|
+
* the next arm, and a name bound only inside a `map` iteration never escapes.
|
|
297
|
+
*/
|
|
298
|
+
function walkStepList(steps, state) {
|
|
299
|
+
const visible = new Map(state.visible);
|
|
300
|
+
steps.forEach((step, index) => {
|
|
301
|
+
const base = [...state.base, index];
|
|
302
|
+
const here = { ...state, base, visible };
|
|
303
|
+
checkStepReferences(step, here);
|
|
304
|
+
const own = bindingOf(step);
|
|
305
|
+
if (own !== undefined) {
|
|
306
|
+
const previous = visible.get(own);
|
|
307
|
+
if (previous !== undefined) {
|
|
308
|
+
state.diagnostics.push(state.report.error({
|
|
309
|
+
code: IR_DIAGNOSTIC_CODES.bindingDuplicate,
|
|
310
|
+
message: `the referential gate rejected this binding: "${own}" is already bound by ${previous} in pipeline "${state.pipeline.id}"`,
|
|
311
|
+
path: [...base, 'as'],
|
|
312
|
+
hint: 'a binding name is unique within one pipeline scope',
|
|
313
|
+
}));
|
|
314
|
+
}
|
|
315
|
+
else {
|
|
316
|
+
// A top-level step keeps the wording the message has always had; only a nested
|
|
317
|
+
// one needs the full path, because "step 2" alone does not say which arm it is in.
|
|
318
|
+
visible.set(own, state.base.length === TOP_LEVEL ? `step ${index}` : locate(base));
|
|
319
|
+
}
|
|
320
|
+
}
|
|
321
|
+
const escaped = walkComposite(step, here);
|
|
322
|
+
for (const [name, where] of escaped) {
|
|
323
|
+
visible.set(name, where);
|
|
324
|
+
}
|
|
325
|
+
});
|
|
326
|
+
return visible;
|
|
327
|
+
}
|
|
328
|
+
/**
|
|
329
|
+
* The names a composite makes visible afterwards. Per-kind on purpose: a `branch` runs
|
|
330
|
+
* one arm, so the same name in both arms is the sound shape and merges silently; a
|
|
331
|
+
* `parallel` runs every arm at once, so one name from two arms would be resolved by
|
|
332
|
+
* completion order and is a duplicate instead.
|
|
333
|
+
*/
|
|
334
|
+
function walkComposite(step, state) {
|
|
335
|
+
if (step.kind === 'branch') {
|
|
336
|
+
const thenScope = walkStepList(step.then, {
|
|
337
|
+
...state,
|
|
338
|
+
base: [...state.base, 'branch', 'then'],
|
|
339
|
+
});
|
|
340
|
+
const elseScope = walkStepList(step.else, {
|
|
341
|
+
...state,
|
|
342
|
+
base: [...state.base, 'branch', 'else'],
|
|
343
|
+
});
|
|
344
|
+
const merged = new Map(state.visible);
|
|
345
|
+
for (const [name, where] of thenScope)
|
|
346
|
+
merged.set(name, where);
|
|
347
|
+
for (const [name, where] of elseScope)
|
|
348
|
+
merged.set(name, where);
|
|
349
|
+
return merged;
|
|
350
|
+
}
|
|
351
|
+
if (step.kind === 'parallel') {
|
|
352
|
+
const merged = new Map(state.visible);
|
|
353
|
+
step.branches.forEach((arm, index) => {
|
|
354
|
+
const armScope = walkStepList(arm, {
|
|
355
|
+
...state,
|
|
356
|
+
base: [...state.base, 'parallel', 'branches', index],
|
|
357
|
+
});
|
|
358
|
+
for (const [name, where] of armScope) {
|
|
359
|
+
if (state.visible.has(name))
|
|
360
|
+
continue;
|
|
361
|
+
const rival = merged.get(name);
|
|
362
|
+
if (rival !== undefined) {
|
|
363
|
+
state.diagnostics.push(state.report.error({
|
|
364
|
+
code: IR_DIAGNOSTIC_CODES.bindingDuplicate,
|
|
365
|
+
message: `the referential gate rejected this binding: "${name}" is bound by two parallel branches (${rival} and ${where}) in pipeline "${state.pipeline.id}"`,
|
|
366
|
+
path: [...state.base, 'parallel', 'branches', index],
|
|
367
|
+
hint: 'parallel arms merge into one context, so a name bound by two arms would be resolved by which finished last',
|
|
368
|
+
}));
|
|
369
|
+
continue;
|
|
370
|
+
}
|
|
371
|
+
merged.set(name, where);
|
|
372
|
+
}
|
|
373
|
+
});
|
|
374
|
+
return merged;
|
|
375
|
+
}
|
|
376
|
+
if (step.kind === 'map') {
|
|
377
|
+
// `item` and `index` are what the iteration offers; the body's bindings are local.
|
|
378
|
+
const inner = new Map(state.visible);
|
|
379
|
+
inner.set('item', 'the `item` a map iteration binds');
|
|
380
|
+
inner.set('index', 'the `index` a map iteration binds');
|
|
381
|
+
walkStepList([step.step], { ...state, base: [...state.base, 'map', 'step'], visible: inner });
|
|
382
|
+
}
|
|
383
|
+
return state.visible;
|
|
384
|
+
}
|
|
385
|
+
/** The referential checks a single step's own fields need, excluding its composites. */
|
|
386
|
+
function checkStepReferences(step, state) {
|
|
387
|
+
const { base, ir, scope, diagnostics, report } = state;
|
|
388
|
+
if (step.kind === 'generate') {
|
|
389
|
+
if (scope.names.prompts.has(step.prompt)) {
|
|
390
|
+
checkPromptInput(step, ir, base, diagnostics, report);
|
|
391
|
+
}
|
|
392
|
+
else {
|
|
393
|
+
reportRef(step.prompt, 'prompts', scope, [...base, 'prompt'], diagnostics, report);
|
|
394
|
+
}
|
|
395
|
+
}
|
|
396
|
+
else if (step.kind === 'tool') {
|
|
397
|
+
if (!scope.names.tools.has(step.tool)) {
|
|
398
|
+
reportRef(step.tool, 'tools', scope, [...base, 'tool'], diagnostics, report);
|
|
399
|
+
}
|
|
400
|
+
}
|
|
401
|
+
else if (step.kind === 'retrieve') {
|
|
402
|
+
if (!scope.names.retrievers.has(step.retriever)) {
|
|
403
|
+
reportRef(step.retriever, 'retrievers', scope, [...base, 'retriever'], diagnostics, report);
|
|
404
|
+
}
|
|
405
|
+
}
|
|
406
|
+
else if (step.kind === 'emit') {
|
|
407
|
+
if (!scope.names.types.has(step.event)) {
|
|
408
|
+
reportRef(step.event, 'types', scope, [...base, 'event'], diagnostics, report);
|
|
409
|
+
}
|
|
410
|
+
}
|
|
411
|
+
else if (step.kind === 'guard') {
|
|
412
|
+
if (!scope.names.guardrails.has(step.guardrail)) {
|
|
413
|
+
reportRef(step.guardrail, 'guardrails', scope, [...base, 'guardrail'], diagnostics, report);
|
|
414
|
+
}
|
|
415
|
+
}
|
|
416
|
+
else if (step.kind === 'agent') {
|
|
417
|
+
if (!scope.names.agents.has(step.agent)) {
|
|
418
|
+
reportRef(step.agent, 'agents', scope, [...base, 'agent'], diagnostics, report);
|
|
419
|
+
}
|
|
420
|
+
}
|
|
421
|
+
if (step.kind === 'reduce' && !scope.names.prompts.has(step.prompt)) {
|
|
422
|
+
reportRef(step.prompt, 'prompts', scope, [...base, 'prompt'], diagnostics, report);
|
|
423
|
+
}
|
|
424
|
+
if ((step.kind === 'map' || step.kind === 'reduce') && !state.allBindings.has(step.over)) {
|
|
425
|
+
diagnostics.push(report.error({
|
|
426
|
+
code: IR_DIAGNOSTIC_CODES.refUnresolved,
|
|
427
|
+
message: `the referential gate rejected this reference: "${step.over}" names no binding in pipeline "${state.pipeline.id}", so a ${step.kind} has no list to iterate`,
|
|
428
|
+
path: [...base, step.kind, 'over'],
|
|
429
|
+
hint: `bind the list with an earlier step and point \`over\` at that binding name`,
|
|
430
|
+
}));
|
|
431
|
+
}
|
|
432
|
+
if (step.kind === 'rerank' && !state.allBindings.has(step.over)) {
|
|
433
|
+
diagnostics.push(report.error({
|
|
434
|
+
code: IR_DIAGNOSTIC_CODES.refUnresolved,
|
|
435
|
+
message: `the referential gate rejected this reference: "${step.over}" names no binding in pipeline "${state.pipeline.id}", so a rerank has no retrieved items to reorder`,
|
|
436
|
+
path: [...base, 'rerank', 'over'],
|
|
437
|
+
hint: 'point `over` at a `retrieve` (or earlier `rerank`) step binding',
|
|
438
|
+
}));
|
|
439
|
+
}
|
|
440
|
+
for (const { path, value } of stepReferences(step)) {
|
|
441
|
+
for (const root of referencedRoots(value)) {
|
|
442
|
+
if (state.visible.has(root) || !state.allBindings.has(root))
|
|
443
|
+
continue;
|
|
444
|
+
diagnostics.push(report.error({
|
|
445
|
+
code: IR_DIAGNOSTIC_CODES.bindingForwardReference,
|
|
446
|
+
message: `the referential gate rejected this reference: "${root}" is bound by a later step of pipeline "${state.pipeline.id}"`,
|
|
447
|
+
path: [...base, ...path],
|
|
448
|
+
hint: 'bindings are defined before use',
|
|
449
|
+
}));
|
|
450
|
+
}
|
|
451
|
+
}
|
|
452
|
+
}
|
|
453
|
+
/** Where one step's references live, so the forward-reference rule covers every kind. */
|
|
454
|
+
function stepReferences(step) {
|
|
455
|
+
if (step.kind === 'emit' || step.kind === 'branch' || step.kind === 'parallel')
|
|
456
|
+
return [];
|
|
457
|
+
if (step.kind === 'retrieve') {
|
|
458
|
+
return [{ path: ['query'], value: { kind: 'template', template: step.query } }];
|
|
459
|
+
}
|
|
460
|
+
if (step.kind === 'map' || step.kind === 'reduce') {
|
|
461
|
+
return [{ path: [step.kind, 'over'], value: { kind: 'reference', path: [step.over] } }];
|
|
462
|
+
}
|
|
463
|
+
if (step.kind === 'rerank') {
|
|
464
|
+
return [
|
|
465
|
+
{ path: ['rerank', 'over'], value: { kind: 'reference', path: [step.over] } },
|
|
466
|
+
{ path: ['rerank', 'query'], value: { kind: 'template', template: step.query } },
|
|
467
|
+
];
|
|
468
|
+
}
|
|
469
|
+
if (step.kind === 'guard') {
|
|
470
|
+
// At the `retrieval` stage `text` is one reference to a retrieval binding rather
|
|
471
|
+
// than template text; it is still a reference either way, and the projection the
|
|
472
|
+
// generator emits reads that binding's items.
|
|
473
|
+
return [{ path: ['guard', 'text'], value: { kind: 'template', template: step.text } }];
|
|
474
|
+
}
|
|
475
|
+
if (step.kind === 'agent') {
|
|
476
|
+
return [{ path: ['agent', 'text'], value: { kind: 'template', template: step.text } }];
|
|
477
|
+
}
|
|
478
|
+
const references = Object.entries(step.input).map(([key, value]) => ({ path: ['input', key], value }));
|
|
479
|
+
if (step.kind === 'generate' && step.context !== undefined) {
|
|
480
|
+
references.push({ path: ['context'], value: { kind: 'reference', path: [step.context] } });
|
|
481
|
+
}
|
|
482
|
+
return references;
|
|
483
|
+
}
|
|
484
|
+
/**
|
|
485
|
+
* A required prompt variable with no default has to be supplied by the step, or
|
|
486
|
+
* the generated call has nothing to render the placeholder from.
|
|
487
|
+
*
|
|
488
|
+
* A retrieved context is one of the ways a step supplies one: `context` names the
|
|
489
|
+
* binding whose items are inlined into the prompt, so a variable with that name is
|
|
490
|
+
* fed by it. That is the only channel the retrieved items reach the prompt through.
|
|
491
|
+
*/
|
|
492
|
+
function checkPromptInput(step, ir, base, diagnostics, report) {
|
|
493
|
+
const prompt = ir.prompts.find((entry) => entry.id === step.prompt);
|
|
494
|
+
if (prompt === undefined)
|
|
495
|
+
return;
|
|
496
|
+
for (const variable of prompt.variables) {
|
|
497
|
+
if (!variable.required || variable.default !== undefined)
|
|
498
|
+
continue;
|
|
499
|
+
if (Object.hasOwn(step.input, variable.name))
|
|
500
|
+
continue;
|
|
501
|
+
if (step.context === variable.name)
|
|
502
|
+
continue;
|
|
503
|
+
diagnostics.push(report.error({
|
|
504
|
+
code: IR_DIAGNOSTIC_CODES.promptInputMissing,
|
|
505
|
+
message: `the referential gate rejected this step: prompt "${prompt.id}" requires "${variable.name}", which this step's input does not supply`,
|
|
506
|
+
path: [...base, 'input'],
|
|
507
|
+
hint: `add "${variable.name}" to the step input, give the variable a default, or mark it optional`,
|
|
508
|
+
}));
|
|
509
|
+
}
|
|
510
|
+
}
|
|
511
|
+
function referencedRoots(value) {
|
|
512
|
+
if (value.kind === 'reference') {
|
|
513
|
+
const root = value.path[0];
|
|
514
|
+
return root === undefined ? [] : [root];
|
|
515
|
+
}
|
|
516
|
+
return value.kind === 'template' ? templatePlaceholders(value.template) : [];
|
|
517
|
+
}
|
|
518
|
+
function checkEvals(ir, scope, diagnostics, report) {
|
|
519
|
+
for (const evalShape of ir.evals) {
|
|
520
|
+
const path = ['evals', evalShape.id, 'target'];
|
|
521
|
+
if (!evalShape.target.valid) {
|
|
522
|
+
diagnostics.push(report.error({
|
|
523
|
+
code: IR_DIAGNOSTIC_CODES.evalTargetInvalid,
|
|
524
|
+
message: `the referential gate rejected this target: "${evalShape.target.qualified}" is not a "kind:id" pair naming a known kind`,
|
|
525
|
+
path,
|
|
526
|
+
hint: 'Phase 0 accepts "pipeline:<id>" or "prompt:<id>"',
|
|
527
|
+
}));
|
|
528
|
+
}
|
|
529
|
+
else {
|
|
530
|
+
const expected = evalShape.target.kind === 'pipeline' ? 'pipelines' : 'prompts';
|
|
531
|
+
if (!scope.names[expected].has(evalShape.target.id)) {
|
|
532
|
+
reportRef(evalShape.target.id, expected, scope, path, diagnostics, report);
|
|
533
|
+
}
|
|
534
|
+
}
|
|
535
|
+
evalShape.metrics.forEach((metric, index) => {
|
|
536
|
+
const metricPath = ['evals', evalShape.id, 'metrics', index];
|
|
537
|
+
if (metric.kind === 'json-schema') {
|
|
538
|
+
reportTypeRef(metric.schema, [...metricPath, 'schema'], diagnostics, report);
|
|
539
|
+
}
|
|
540
|
+
if (metric.kind !== 'tool-trace')
|
|
541
|
+
return;
|
|
542
|
+
metric.expect.forEach((name, position) => {
|
|
543
|
+
if (scope.names.tools.has(name))
|
|
544
|
+
return;
|
|
545
|
+
diagnostics.push(report.error({
|
|
546
|
+
code: IR_DIAGNOSTIC_CODES.metricToolUnresolved,
|
|
547
|
+
message: `the referential gate rejected this tool-trace expectation: no tool named "${name}" exists`,
|
|
548
|
+
path: [...metricPath, 'expect', position],
|
|
549
|
+
}));
|
|
550
|
+
});
|
|
551
|
+
});
|
|
552
|
+
}
|
|
553
|
+
}
|
|
554
|
+
//# sourceMappingURL=referential.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"referential.js","sourceRoot":"","sources":["../../src/gates/referential.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAqB,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EAAqC,QAAQ,EAAwB,MAAM,eAAe,CAAC;AAElG,8CAA8C;AAC9C,MAAM,UAAU,GAAG;IACjB,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,QAAQ;CACA,CAAC;AAQX;;;;GAIG;AACH,MAAM,UAAU,GAAsB;IACpC;QACE,KAAK,EAAE,kCAAkC;QACzC,MAAM,EACJ,qLAAqL;KACxL;CACF,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,EAAM,EAAE,OAAoB;IAC1D,MAAM,WAAW,GAAmB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,KAAK,GAAU;QACnB,KAAK,EAAE;YACL,KAAK,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrD,KAAK,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnD,UAAU,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3D,SAAS,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzD,UAAU,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3D,MAAM,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACpD;KACF,CAAC;IAEF,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACxC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5C,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7C,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACpC,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/C,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/C,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAE3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC;AAID,qFAAqF;AACrF,SAAS,SAAS,CAChB,IAAY,EACZ,QAAmB,EACnB,KAAY,EACZ,IAAyB,EACzB,WAA2B,EAC3B,MAAgB;IAEhB,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;YACX,IAAI,EAAE,mBAAmB,CAAC,eAAe;YACzC,OAAO,EAAE,kDAAkD,IAAI,UAAU,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,QAAQ,mBAAmB;YACnI,IAAI;YACJ,IAAI,EAAE,yBAAyB,QAAQ,gBAAgB,IAAI,GAAG;SAC/D,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IACD,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;QACX,IAAI,EAAE,mBAAmB,CAAC,aAAa;QACvC,OAAO,EAAE,oDAAoD,QAAQ,WAAW,IAAI,UAAU;QAC9F,IAAI;QACJ,IAAI,EAAE,iCAAiC;KACxC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,GAAY,EACZ,IAAyB,EACzB,WAA2B,EAC3B,MAAgB;IAEhB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO;IACjD,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;QACX,IAAI,EAAE,mBAAmB,CAAC,cAAc;QACxC,OAAO,EAAE,uDAAuD,GAAG,CAAC,IAAI,qBAAqB;QAC7F,IAAI;QACJ,IAAI,EAAE,iDAAiD;KACxD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,EAAM,EAAE,WAA2B,EAAE,MAAgB;IAC3E,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACnC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;QACX,IAAI,EAAE,mBAAmB,CAAC,SAAS;QACnC,OAAO,EAAE,kFAAkF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;QAChH,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,EAAE,oEAAoE;KAC3E,CAAC,CACH,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,KAA4B;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAwB,EAAE;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QACtC,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,CAAC;QACZ,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,EAAM;IAC3B,OAAO,UAAU,CACf,IAAI,GAAG,CACL,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,EAAE;QACP,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KACvF,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,EAAM,EAAE,KAAY,EAAE,WAA2B,EAAE,MAAgB;IACtF,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACvC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC1C,SAAS,CACP,KAAK,EACL,QAAQ,EACR,KAAK,EACL,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,EACxC,WAAW,EACX,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;QACX,IAAI,EAAE,mBAAmB,CAAC,aAAa;QACvC,OAAO,EAAE,iEAAiE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;QAC/F,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC;QAC7C,IAAI,EAAE,uEAAuE;KAC9E,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,EAAM,EAAE,KAAY,EAAE,WAA2B,EAAE,MAAgB;IACvF,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,SAAS,CACP,MAAM,CAAC,KAAK,EACZ,QAAQ,EACR,KAAK,EACL,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAC/B,WAAW,EACX,MAAM,CACP,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACvC,aAAa,CACX,MAAM,CAAC,MAAM,CAAC,MAAM,EACpB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC1C,WAAW,EACX,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,KAAK,MAAM,WAAW,IAAI,IAAI,EAAE,CAAC;YAC/B,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YACxC,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;gBACX,IAAI,EAAE,mBAAmB,CAAC,wBAAwB;gBAClD,OAAO,EAAE,2DAA2D,MAAM,CAAC,EAAE,aAAa,WAAW,uCAAuC,WAAW,GAAG;gBAC1J,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC;gBACxC,IAAI,EAAE,oEAAoE;aAC3E,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3C,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mBAAmB,CAAC,oBAAoB;gBAC9C,OAAO,EAAE,uDAAuD,MAAM,CAAC,EAAE,eAAe,QAAQ,CAAC,IAAI,oCAAoC,QAAQ,CAAC,IAAI,KAAK;gBAC3J,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC;aACzD,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,EAAM,EAAE,WAA2B,EAAE,MAAgB;IACvE,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5E,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,EAAM,EAAE,KAAY,EAAE,WAA2B,EAAE,MAAgB;IACzF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,SAAS,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,SAAS,CACP,SAAS,CAAC,UAAU,EACpB,QAAQ,EACR,KAAK,EACL,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC,EACvB,WAAW,EACX,MAAM,CACP,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3D,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;gBACX,IAAI,EAAE,mBAAmB,CAAC,sBAAsB;gBAChD,OAAO,EAAE,kEAAkE,SAAS,CAAC,EAAE,wBAAwB,UAAU,CAAC,EAAE,uDAAuD;gBACnL,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;gBAC7B,IAAI,EAAE,6EAA6E;aACpF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,SAAS,CACP,SAAS,CAAC,MAAM,CAAC,KAAK,EACtB,QAAQ,EACR,KAAK,EACL,CAAC,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAC5B,WAAW,EACX,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,EAAM,EAAE,KAAY,EAAE,WAA2B,EAAE,MAAgB;IACzF,KAAK,MAAM,QAAQ,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACpC,kBAAkB,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAuB,EACvB,EAAM,EACN,KAAY,EACZ,WAA2B,EAC3B,MAAgB;IAEhB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACjD,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE;QAC3B,QAAQ;QACR,EAAE;QACF,KAAK;QACL,WAAW;QACX,MAAM;QACN,WAAW;QACX,OAAO,EAAE,IAAI,GAAG,EAAkB;QAClC,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;KAC1C,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB;;;;;GAKG;AACH,SAAS,SAAS,CAAC,IAAe;IAChC,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM;QACzB,IAAI,CAAC,IAAI,KAAK,QAAQ;QACtB,IAAI,CAAC,IAAI,KAAK,UAAU;QACxB,IAAI,CAAC,IAAI,KAAK,OAAO;QACrB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,SAAS,MAAM,CAAC,IAAkC;IAChD,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACtB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CACnF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAA2B,EAAE,IAAiB;IACzE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ;gBAAE,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAgBD;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAA2B,EAAE,KAAgB;IACjE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEvC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,GAAc,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAEpD,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEhC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;oBACjB,IAAI,EAAE,mBAAmB,CAAC,gBAAgB;oBAC1C,OAAO,EAAE,gDAAgD,GAAG,yBAAyB,QAAQ,iBAAiB,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG;oBAClI,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;oBACrB,IAAI,EAAE,oDAAoD;iBAC3D,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,+EAA+E;gBAC/E,mFAAmF;gBACnF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAAe,EAAE,KAAgB;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE;YACxC,GAAG,KAAK;YACR,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE;YACxC,GAAG,KAAK;YACR,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE;gBACjC,GAAG,KAAK;gBACR,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC;aACrD,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;wBACjB,IAAI,EAAE,mBAAmB,CAAC,gBAAgB;wBAC1C,OAAO,EAAE,gDAAgD,IAAI,wCAAwC,KAAK,QAAQ,KAAK,kBAAkB,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG;wBAC7J,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC;wBACpD,IAAI,EAAE,4GAA4G;qBACnH,CAAC,CACH,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,mFAAmF;QACnF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;QACtD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAC;QACxD,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,wFAAwF;AACxF,SAAS,mBAAmB,CAAC,IAAe,EAAE,KAAgB;IAC5D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAEvD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzF,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;YACX,IAAI,EAAE,mBAAmB,CAAC,aAAa;YACvC,OAAO,EAAE,kDAAkD,IAAI,CAAC,IAAI,mCAAmC,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,IAAI,CAAC,IAAI,yBAAyB;YACrK,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;YAClC,IAAI,EAAE,4EAA4E;SACnF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;YACX,IAAI,EAAE,mBAAmB,CAAC,aAAa;YACvC,OAAO,EAAE,kDAAkD,IAAI,CAAC,IAAI,mCAAmC,KAAK,CAAC,QAAQ,CAAC,EAAE,kDAAkD;YAC1K,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;YACjC,IAAI,EAAE,iEAAiE;SACxE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtE,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;gBACX,IAAI,EAAE,mBAAmB,CAAC,uBAAuB;gBACjD,OAAO,EAAE,kDAAkD,IAAI,2CAA2C,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG;gBAC9H,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;gBACxB,IAAI,EAAE,iCAAiC;aACxC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,SAAS,cAAc,CAAC,IAAe;IACrC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAC1F,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YAC7E,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE;SACjF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,iFAAiF;QACjF,iFAAiF;QACjF,8CAA8C;QAC9C,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,UAAU,GAA2D,MAAM,CAAC,OAAO,CACvF,IAAI,CAAC,KAAK,CACX,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3D,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CACvB,IAAsC,EACtC,EAAM,EACN,IAAyB,EACzB,WAA2B,EAC3B,MAAgB;IAEhB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACnE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACvD,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,IAAI;YAAE,SAAS;QAC7C,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;YACX,IAAI,EAAE,mBAAmB,CAAC,kBAAkB;YAC5C,OAAO,EAAE,oDAAoD,MAAM,CAAC,EAAE,eAAe,QAAQ,CAAC,IAAI,4CAA4C;YAC9I,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YACxB,IAAI,EAAE,QAAQ,QAAQ,CAAC,IAAI,uEAAuE;SACnG,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAqB;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,UAAU,CAAC,EAAM,EAAE,KAAY,EAAE,WAA2B,EAAE,MAAgB;IACrF,KAAK,MAAM,SAAS,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5B,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;gBACX,IAAI,EAAE,mBAAmB,CAAC,iBAAiB;gBAC3C,OAAO,EAAE,+CAA+C,SAAS,CAAC,MAAM,CAAC,SAAS,+CAA+C;gBACjI,IAAI;gBACJ,IAAI,EAAE,kDAAkD;aACzD,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAc,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3F,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpD,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YAC1C,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,UAAU,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO;YACzC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACvC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO;gBACxC,WAAW,CAAC,IAAI,CACd,MAAM,CAAC,KAAK,CAAC;oBACX,IAAI,EAAE,mBAAmB,CAAC,oBAAoB;oBAC9C,OAAO,EAAE,6EAA6E,IAAI,UAAU;oBACpG,IAAI,EAAE,CAAC,GAAG,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC;iBAC1C,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Gate 5 — security. Fail-closed by default.
|
|
3
|
+
*
|
|
4
|
+
* The asymmetry is deliberate: a tool that writes or destroys and declares no `auth`
|
|
5
|
+
* is an error rather than a warning, because the safe reading of "no policy" is "no
|
|
6
|
+
* access", never "open access". Every rule this gate states is now live: the one it
|
|
7
|
+
* used to suppress is enforced below.
|
|
8
|
+
*
|
|
9
|
+
* The same asymmetry covers retrieval: a store reaches its backing service through
|
|
10
|
+
* `env:NAME`, so a connection string that appears literally in the IR is an error. No
|
|
11
|
+
* required gate touches a database -- the rule reads the declarations, never the store.
|
|
12
|
+
*/
|
|
13
|
+
import type { PolicyNode } from '../policy/index.js';
|
|
14
|
+
import type { IR } from '../shapes.js';
|
|
15
|
+
import { type GateOptions, type GateResult } from './contract.js';
|
|
16
|
+
export declare function securityGate(ir: IR, options: GateOptions): GateResult;
|
|
17
|
+
/**
|
|
18
|
+
* True when the policy mentions a builtin that establishes caller identity. `not` is
|
|
19
|
+
* deliberately not transparent: `not isAuthenticated()` denies what it names, so
|
|
20
|
+
* treating it as authenticating would be the fail-open reading.
|
|
21
|
+
*/ export declare function policyAuthenticates(node: PolicyNode): boolean;
|
|
22
|
+
//# sourceMappingURL=security.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/gates/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,EAAE,EAAgD,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAkC,MAAM,eAAe,CAAC;AAiClG,wBAAgB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,UAAU,CAkBrE;AAsLD;;;;GAIG,CAAC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAiBjE"}
|