@apexops/capabilities 0.10.0-next.0

package/dist/terraform-registry-client.js

@@ -0,0 +1,388 @@
+const REGISTRY_ORIGIN = "https://registry.terraform.io";
+const IDENTIFIER = /^(?=.*[A-Za-z0-9])[A-Za-z0-9._-]+$/u;
+const MAX_IDENTIFIER_LENGTH = 100;
+const MAX_VERSION_LENGTH = 200;
+const MAX_TIMEOUT_MS = 60_000;
+const MAX_RESPONSE_BYTES = 5_000_000;
+const MAX_CACHE_TTL_MS = 3_600_000;
+const MAX_RETRY_DELAY_MS = 10_000;
+const SEMVER = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-((?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/u;
+function invalid(note) {
+    return { status: "invalid", note };
+}
+function identifier(value, label) {
+    return value.length <= MAX_IDENTIFIER_LENGTH && value !== "." && value !== ".." && IDENTIFIER.test(value)
+        ? value
+        : invalid(`${label} must be a Terraform Registry identifier`);
+}
+function parseSemver(value) {
+    if (value.length > MAX_VERSION_LENGTH)
+        return null;
+    const match = SEMVER.exec(value);
+    if (match === null)
+        return null;
+    return {
+        value,
+        major: BigInt(match[1]),
+        minor: BigInt(match[2]),
+        patch: BigInt(match[3]),
+        prerelease: match[4] ?? null,
+    };
+}
+function compareStableVersions(left, right) {
+    for (const key of ["major", "minor", "patch"]) {
+        if (left[key] < right[key])
+            return 1;
+        if (left[key] > right[key])
+            return -1;
+    }
+    if (left.value < right.value)
+        return 1;
+    if (left.value > right.value)
+        return -1;
+    return 0;
+}
+function stableVersions(values) {
+    const parsed = values.map(parseSemver);
+    if (parsed.some((value) => value === null))
+        return null;
+    return [
+        ...new Map(parsed.filter(({ prerelease }) => prerelease === null).map((value) => [value.value, value])).values(),
+    ]
+        .sort(compareStableVersions)
+        .map(({ value }) => value);
+}
+function plainObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function stringValue(value) {
+    return typeof value === "string" ? value : null;
+}
+function nonNegativeInteger(value) {
+    return Number.isSafeInteger(value) && Number(value) >= 0 ? Number(value) : null;
+}
+async function boundedText(response, maxBytes, signal) {
+    if (response.body === null) {
+        const text = await response.text();
+        if (Buffer.byteLength(text, "utf8") > maxBytes)
+            throw new RangeError("response-too-large");
+        return text;
+    }
+    const reader = response.body.getReader();
+    const cancel = () => void reader.cancel().catch(() => undefined);
+    signal.addEventListener("abort", cancel, { once: true });
+    const chunks = [];
+    let bytes = 0;
+    try {
+        while (true) {
+            const part = await reader.read();
+            if (part.done)
+                break;
+            bytes += part.value.byteLength;
+            if (bytes > maxBytes) {
+                void reader.cancel().catch(() => undefined);
+                throw new RangeError("response-too-large");
+            }
+            chunks.push(part.value);
+        }
+        return Buffer.concat(chunks).toString("utf8");
+    }
+    finally {
+        signal.removeEventListener("abort", cancel);
+    }
+}
+async function cancelBody(response) {
+    try {
+        void response.body?.cancel().catch(() => undefined);
+    }
+    catch {
+        // Error responses are already unavailable; cleanup failures do not replace that result.
+    }
+}
+function moduleSummary(value) {
+    const row = plainObject(value);
+    if (row === null)
+        return null;
+    const id = stringValue(row.id);
+    const namespace = stringValue(row.namespace);
+    const name = stringValue(row.name);
+    const provider = stringValue(row.provider);
+    const version = stringValue(row.version);
+    const description = stringValue(row.description);
+    const downloads = nonNegativeInteger(row.downloads);
+    if (id === null ||
+        namespace === null ||
+        name === null ||
+        provider === null ||
+        version === null ||
+        description === null ||
+        downloads === null ||
+        typeof row.verified !== "boolean") {
+        return null;
+    }
+    if (typeof identifier(namespace, "namespace") !== "string" ||
+        typeof identifier(name, "name") !== "string" ||
+        typeof identifier(provider, "provider") !== "string" ||
+        parseSemver(version) === null ||
+        id !== `${namespace}/${name}/${provider}/${version}`) {
+        return null;
+    }
+    return { id, namespace, name, provider, version, description, downloads, verified: row.verified };
+}
+export class TerraformRegistryClient {
+    #fetch;
+    #now;
+    #sleep;
+    #timeoutMs;
+    #maxResponseBytes;
+    #cacheTtlMs;
+    #maxCacheEntries;
+    #retries;
+    #retryDelayMs;
+    #cache = new Map();
+    constructor(options = {}) {
+        this.#fetch = options.fetch ?? fetch;
+        this.#now = options.now ?? Date.now;
+        this.#sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+        this.#timeoutMs = options.timeoutMs ?? 8_000;
+        this.#maxResponseBytes = options.maxResponseBytes ?? 1_000_000;
+        this.#cacheTtlMs = options.cacheTtlMs ?? 300_000;
+        this.#maxCacheEntries = options.maxCacheEntries ?? 128;
+        this.#retries = options.retries ?? 1;
+        this.#retryDelayMs = options.retryDelayMs ?? 250;
+        if (!Number.isSafeInteger(this.#timeoutMs) ||
+            this.#timeoutMs <= 0 ||
+            this.#timeoutMs > MAX_TIMEOUT_MS ||
+            !Number.isSafeInteger(this.#maxResponseBytes) ||
+            this.#maxResponseBytes <= 0 ||
+            this.#maxResponseBytes > MAX_RESPONSE_BYTES ||
+            !Number.isSafeInteger(this.#cacheTtlMs) ||
+            this.#cacheTtlMs < 0 ||
+            this.#cacheTtlMs > MAX_CACHE_TTL_MS ||
+            !Number.isSafeInteger(this.#maxCacheEntries) ||
+            this.#maxCacheEntries < 1 ||
+            this.#maxCacheEntries > 1_024 ||
+            !Number.isSafeInteger(this.#retries) ||
+            this.#retries < 0 ||
+            this.#retries > 3 ||
+            !Number.isSafeInteger(this.#retryDelayMs) ||
+            this.#retryDelayMs < 0 ||
+            this.#retryDelayMs > MAX_RETRY_DELAY_MS) {
+            throw new TypeError("Terraform Registry client bounds are invalid");
+        }
+    }
+    async searchModules(query, options = {}) {
+        const normalizedQuery = query.trim();
+        const offset = options.offset ?? 0;
+        const limit = options.limit ?? 20;
+        if (normalizedQuery.length === 0 || normalizedQuery.length > 100)
+            return invalid("query must contain 1-100 characters");
+        if (!Number.isSafeInteger(offset) || offset < 0 || offset > 1_000)
+            return invalid("offset must be between 0 and 1000");
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 50)
+            return invalid("limit must be between 1 and 50");
+        const params = new URLSearchParams({ q: normalizedQuery, offset: String(offset), limit: String(limit) });
+        return await this.#request(`/v1/modules/search?${params}`, (body) => {
+            const root = plainObject(body);
+            const metadata = plainObject(root?.meta);
+            if (root === null || metadata === null || !Array.isArray(root.modules))
+                return null;
+            const modules = root.modules.map(moduleSummary);
+            const currentOffset = nonNegativeInteger(metadata.current_offset);
+            const responseLimit = nonNegativeInteger(metadata.limit);
+            const rawNextOffset = metadata.next_offset;
+            const nextOffset = rawNextOffset === null || rawNextOffset === undefined ? null : nonNegativeInteger(rawNextOffset);
+            if (modules.some((module) => module === null) ||
+                currentOffset === null ||
+                responseLimit === null ||
+                currentOffset !== offset ||
+                responseLimit < 1 ||
+                responseLimit > limit ||
+                modules.length > responseLimit ||
+                (nextOffset === null && rawNextOffset !== null && rawNextOffset !== undefined) ||
+                (nextOffset !== null && (nextOffset <= currentOffset || nextOffset > 1_000))) {
+                return null;
+            }
+            return { modules: modules, offset: currentOffset, nextOffset, limit: responseLimit };
+        });
+    }
+    async getModuleDetails(namespace, name, provider, version) {
+        const parts = [identifier(namespace, "namespace"), identifier(name, "name"), identifier(provider, "provider")];
+        if (parts.some((part) => typeof part !== "string"))
+            return parts.find((part) => typeof part !== "string");
+        if (version.length > MAX_VERSION_LENGTH || parseSemver(version) === null) {
+            return invalid("version must be a bounded exact semantic version");
+        }
+        return await this.#request(`/v1/modules/${parts.join("/")}/${version}`, (body) => {
+            const summary = moduleSummary(body);
+            const source = stringValue(plainObject(body)?.source);
+            const expectedId = `${namespace}/${name}/${provider}/${version}`;
+            return summary === null ||
+                source === null ||
+                summary.namespace.toLowerCase() !== namespace.toLowerCase() ||
+                summary.name.toLowerCase() !== name.toLowerCase() ||
+                summary.provider.toLowerCase() !== provider.toLowerCase() ||
+                summary.version !== version ||
+                summary.id.toLowerCase() !== expectedId.toLowerCase()
+                ? null
+                : { ...summary, source };
+        });
+    }
+    async getModuleVersions(namespace, name, provider) {
+        return await this.#versions(`/v1/modules/${namespace}/${name}/${provider}/versions`, [namespace, name, provider], {
+            shape: "modules",
+            expectedSource: `${namespace}/${name}/${provider}`,
+        });
+    }
+    async getProviderVersions(namespace, name) {
+        return await this.#versions(`/v1/providers/${namespace}/${name}/versions`, [namespace, name], {
+            shape: "versions",
+            expectedSource: `${namespace}/${name}`,
+        });
+    }
+    async #versions(path, segments, options) {
+        for (const [index, segment] of segments.entries()) {
+            const checked = identifier(segment, `segment ${index + 1}`);
+            if (typeof checked !== "string")
+                return checked;
+        }
+        return await this.#request(path, (body) => {
+            const root = plainObject(body);
+            let rawVersions;
+            if (options.shape === "versions" &&
+                typeof root?.id === "string" &&
+                root.id.toLowerCase() === options.expectedSource?.toLowerCase()) {
+                rawVersions = root.versions;
+            }
+            else if (Array.isArray(root?.modules) && root.modules.length === 1) {
+                const module = plainObject(root.modules[0]);
+                rawVersions =
+                    module !== null &&
+                        typeof module.source === "string" &&
+                        module.source.toLowerCase() === options.expectedSource?.toLowerCase()
+                        ? module.versions
+                        : undefined;
+            }
+            if (!Array.isArray(rawVersions))
+                return null;
+            const versionValues = rawVersions.map((entry) => stringValue(plainObject(entry)?.version));
+            if (versionValues.some((value) => value === null))
+                return null;
+            const versions = stableVersions(versionValues);
+            if (versions === null)
+                return null;
+            return { versions, latestStable: versions[0] ?? null };
+        });
+    }
+    async #request(path, parse) {
+        const url = new URL(path, REGISTRY_ORIGIN);
+        if (url.origin !== REGISTRY_ORIGIN)
+            return invalid("Registry request origin is not allowed");
+        const cached = this.#cache.get(url.href);
+        if (cached !== undefined && cached.expiresAt > this.#now()) {
+            return { ...structuredClone(cached.result), cached: true };
+        }
+        this.#cache.delete(url.href);
+        for (let attempt = 0; attempt <= this.#retries; attempt += 1) {
+            const controller = new AbortController();
+            let response;
+            let timer;
+            const deadline = new Promise((_resolve, reject) => {
+                timer = setTimeout(() => {
+                    controller.abort();
+                    reject(new DOMException("Registry request timed out", "AbortError"));
+                }, this.#timeoutMs);
+            });
+            try {
+                response = await Promise.race([
+                    this.#fetch(url, {
+                        method: "GET",
+                        headers: { accept: "application/json" },
+                        redirect: "error",
+                        signal: controller.signal,
+                    }),
+                    deadline,
+                ]);
+                if (response.status === 404) {
+                    await cancelBody(response);
+                    return this.#cacheResult(url.href, {
+                        status: "missing",
+                        note: "Registry resource was not found",
+                        cached: false,
+                    });
+                }
+                if (response.status === 429) {
+                    await cancelBody(response);
+                    if (attempt < this.#retries) {
+                        await this.#sleep(this.#retryDelayMs * 2 ** attempt);
+                        continue;
+                    }
+                    return { status: "unavailable", reason: "rate-limited", note: "Registry request was rate-limited" };
+                }
+                if (!response.ok) {
+                    await cancelBody(response);
+                    if (response.status >= 500 && attempt < this.#retries) {
+                        await this.#sleep(this.#retryDelayMs * 2 ** attempt);
+                        continue;
+                    }
+                    return { status: "unavailable", reason: "http", note: `Registry returned HTTP ${response.status}` };
+                }
+                const text = await Promise.race([boundedText(response, this.#maxResponseBytes, controller.signal), deadline]);
+                let body;
+                try {
+                    body = JSON.parse(text);
+                }
+                catch {
+                    return { status: "unavailable", reason: "malformed-response", note: "Registry response was not valid JSON" };
+                }
+                const value = parse(body);
+                if (value === null)
+                    return {
+                        status: "unavailable",
+                        reason: "malformed-response",
+                        note: "Registry response did not match the expected schema",
+                    };
+                return this.#cacheResult(url.href, { status: "ok", value, cached: false });
+            }
+            catch (error) {
+                if (error instanceof RangeError && error.message === "response-too-large") {
+                    return {
+                        status: "unavailable",
+                        reason: "response-too-large",
+                        note: "Registry response exceeded the byte limit",
+                    };
+                }
+                const timeout = controller.signal.aborted || (error instanceof Error && error.name === "AbortError");
+                if (attempt < this.#retries) {
+                    await this.#sleep(this.#retryDelayMs * 2 ** attempt);
+                    continue;
+                }
+                return {
+                    status: "unavailable",
+                    reason: timeout ? "timeout" : "transport",
+                    note: timeout ? "Registry request timed out" : "Registry transport was unavailable",
+                };
+            }
+            finally {
+                if (timer !== undefined)
+                    clearTimeout(timer);
+            }
+        }
+        return { status: "unavailable", reason: "transport", note: "Registry transport was unavailable" };
+    }
+    #cacheResult(key, result) {
+        if (this.#cacheTtlMs > 0 && (result.status === "ok" || result.status === "missing")) {
+            while (this.#cache.size >= this.#maxCacheEntries) {
+                const oldest = this.#cache.keys().next().value;
+                if (oldest === undefined)
+                    break;
+                this.#cache.delete(oldest);
+            }
+            this.#cache.set(key, { expiresAt: this.#now() + this.#cacheTtlMs, result: structuredClone(result) });
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=terraform-registry-client.js.map

package/dist/terraform-registry-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-registry-client.js","sourceRoot":"","sources":["../src/terraform-registry-client.ts"],"names":[],"mappings":"AAAA,MAAM,eAAe,GAAG,+BAA+B,CAAC;AACxD,MAAM,UAAU,GAAG,qCAAqC,CAAC;AACzD,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AACnC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,MAAM,GACV,2MAA2M,CAAC;AA+D9M,SAAS,OAAO,CAAI,IAAY;IAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,KAAa;IAC9C,OAAO,KAAK,CAAC,MAAM,IAAI,qBAAqB,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACvG,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO;QACL,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QACxB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAkB,EAAE,KAAmB;IACpE,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO;QACL,GAAG,IAAI,GAAG,CACP,MAAyB,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAChH,CAAC,MAAM,EAAE;KACX;SACE,IAAI,CAAC,qBAAqB,CAAC;SAC3B,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAkB,EAAE,QAAgB,EAAE,MAAmB;IAClF,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YACrB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC5C,MAAM,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,IAAI,CAAC;QACH,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpD,IACE,EAAE,KAAK,IAAI;QACX,SAAS,KAAK,IAAI;QAClB,IAAI,KAAK,IAAI;QACb,QAAQ,KAAK,IAAI;QACjB,OAAO,KAAK,IAAI;QAChB,WAAW,KAAK,IAAI;QACpB,SAAS,KAAK,IAAI;QAClB,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,EACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,QAAQ;QACtD,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,QAAQ;QAC5C,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,QAAQ;QACpD,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI;QAC7B,EAAE,KAAK,GAAG,SAAS,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,EAAE,EACpD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;AACpG,CAAC;AAED,MAAM,OAAO,uBAAuB;IACzB,MAAM,CAAe;IACrB,IAAI,CAAe;IACnB,MAAM,CAA0C;IAChD,UAAU,CAAS;IACnB,iBAAiB,CAAS;IAC1B,WAAW,CAAS;IACpB,gBAAgB,CAAS;IACzB,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEhD,YAAY,OAAO,GAAmC,EAAE;QACtD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/G,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC7C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,CAAC;QACjD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YACtC,IAAI,CAAC,UAAU,IAAI,CAAC;YACpB,IAAI,CAAC,UAAU,GAAG,cAAc;YAChC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAC7C,IAAI,CAAC,iBAAiB,IAAI,CAAC;YAC3B,IAAI,CAAC,iBAAiB,GAAG,kBAAkB;YAC3C,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;YACvC,IAAI,CAAC,WAAW,GAAG,CAAC;YACpB,IAAI,CAAC,WAAW,GAAG,gBAAgB;YACnC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAC5C,IAAI,CAAC,gBAAgB,GAAG,CAAC;YACzB,IAAI,CAAC,gBAAgB,GAAG,KAAK;YAC7B,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;YACpC,IAAI,CAAC,QAAQ,GAAG,CAAC;YACjB,IAAI,CAAC,QAAQ,GAAG,CAAC;YACjB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;YACzC,IAAI,CAAC,aAAa,GAAG,CAAC;YACtB,IAAI,CAAC,aAAa,GAAG,kBAAkB,EACvC,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,OAAO,GAA0D,EAAE;QAEnE,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,GAAG;YAC9D,OAAO,OAAO,CAAC,qCAAqC,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK;YAC/D,OAAO,OAAO,CAAC,mCAAmC,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAC9G,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzG,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,sBAAsB,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;YAClE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAClE,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC3C,MAAM,UAAU,GACd,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YACnG,IACE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC;gBACzC,aAAa,KAAK,IAAI;gBACtB,aAAa,KAAK,IAAI;gBACtB,aAAa,KAAK,MAAM;gBACxB,aAAa,GAAG,CAAC;gBACjB,aAAa,GAAG,KAAK;gBACrB,OAAO,CAAC,MAAM,GAAG,aAAa;gBAC9B,CAAC,UAAU,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,SAAS,CAAC;gBAC9E,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,UAAU,IAAI,aAAa,IAAI,UAAU,GAAG,KAAK,CAAC,CAAC,EAC5E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,OAAmC,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACnH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,SAAiB,EACjB,IAAY,EACZ,QAAgB,EAChB,OAAe;QAEf,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QAC/G,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAE,CAAC;QAC3G,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC,kDAAkD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/E,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;YACjE,OAAO,OAAO,KAAK,IAAI;gBACrB,MAAM,KAAK,IAAI;gBACf,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE;gBAC3D,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;gBACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;gBACzD,OAAO,CAAC,OAAO,KAAK,OAAO;gBAC3B,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE;gBACrD,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,SAAiB,EACjB,IAAY,EACZ,QAAgB;QAEhB,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,SAAS,IAAI,IAAI,IAAI,QAAQ,WAAW,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE;YAChH,KAAK,EAAE,SAAS;YAChB,cAAc,EAAE,GAAG,SAAS,IAAI,IAAI,IAAI,QAAQ,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,IAAY;QACvD,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,SAAS,IAAI,IAAI,WAAW,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE;YAC5F,KAAK,EAAE,UAAU;YACjB,cAAc,EAAE,GAAG,SAAS,IAAI,IAAI,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CACb,IAAY,EACZ,QAA2B,EAC3B,OAAqF;QAErF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,WAAoB,CAAC;YACzB,IACE,OAAO,CAAC,KAAK,KAAK,UAAU;gBAC5B,OAAO,IAAI,EAAE,EAAE,KAAK,QAAQ;gBAC5B,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE,EAC/D,CAAC;gBACD,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC9B,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5C,WAAW;oBACT,MAAM,KAAK,IAAI;wBACf,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;wBACjC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE;wBACnE,CAAC,CAAC,MAAM,CAAC,QAAQ;wBACjB,CAAC,CAAC,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7C,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3F,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/D,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAyB,CAAC,CAAC;YAC3D,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,IAAY,EAAE,KAAkC;QAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3D,OAAO,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAgC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE7B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,IAAI,QAA8B,CAAC;YACnC,IAAI,KAAiC,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACvD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC,CAAC;gBACvE,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;oBAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;wBACf,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;wBACvC,QAAQ,EAAE,OAAO;wBACjB,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC;oBACF,QAAQ;iBACT,CAAC,CAAC;gBACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE;wBACjC,MAAM,EAAE,SAAS;wBACjB,IAAI,EAAE,iCAAiC;wBACvC,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAC3B,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;wBACrD,SAAS;oBACX,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC;gBACtG,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAC3B,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACtD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;wBACrD,SAAS;oBACX,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtG,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC9G,IAAI,IAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC;gBAC/G,CAAC;gBACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,IAAI;oBAChB,OAAO;wBACL,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,oBAAoB;wBAC5B,IAAI,EAAE,qDAAqD;qBAC5D,CAAC;gBACJ,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,oBAAoB,EAAE,CAAC;oBAC1E,OAAO;wBACL,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,oBAAoB;wBAC5B,IAAI,EAAE,2CAA2C;qBAClD,CAAC;gBACJ,CAAC;gBACD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;gBACrG,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;oBACrD,SAAS;gBACX,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;oBACzC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,oCAAoC;iBACpF,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,IAAI,KAAK,KAAK,SAAS;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAAC;IACpG,CAAC;IAED,YAAY,CAAI,GAAW,EAAE,MAAkC;QAC7D,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;gBACrE,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM;gBAChC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/test/bound-envelope-transport.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bound-envelope-transport.test.d.ts.map

package/dist/test/bound-envelope-transport.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-envelope-transport.test.d.ts","sourceRoot":"","sources":["../../src/test/bound-envelope-transport.test.ts"],"names":[],"mappings":""}

package/dist/test/bound-envelope-transport.test.js

@@ -0,0 +1,30 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { BoundEnvelopeTransport } from "../index.js";
+const instant = new Date("2026-07-17T08:00:00.000Z");
+const payload = Buffer.from("authority", "utf8");
+function transport(now = instant) {
+    return new BoundEnvelopeTransport(() => now);
+}
+test("bound envelopes preserve payload integrity and canonical bindings", () => {
+    const envelope = transport().create(payload, {
+        kind: "authority",
+        recipient: "ci",
+        ttlMs: 60_000,
+        bindings: { zeta: 2, alpha: "one" },
+    });
+    assert.deepEqual(envelope.metadata.bindings, { alpha: "one", zeta: 2 });
+    assert.deepEqual(transport().open(envelope, "ci"), payload);
+});
+test("bound envelopes reject wrong recipients, expiry, and tampering", () => {
+    const envelope = transport().create(payload, {
+        kind: "authority",
+        recipient: "ci",
+        ttlMs: 60_000,
+        bindings: { previewHash: "a".repeat(64) },
+    });
+    assert.throws(() => transport().open(envelope, "other"), /recipient/);
+    assert.throws(() => transport(new Date("2026-07-17T08:01:00.000Z")).open(envelope, "ci"), /expired/);
+    assert.throws(() => transport().open({ ...envelope, payload: Buffer.from("changed").toString("base64") }, "ci"), /digest/);
+});
+//# sourceMappingURL=bound-envelope-transport.test.js.map

package/dist/test/bound-envelope-transport.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-envelope-transport.test.js","sourceRoot":"","sources":["../../src/test/bound-envelope-transport.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AACrD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAEjD,SAAS,SAAS,CAAC,GAAG,GAAG,OAAO;IAC9B,OAAO,IAAI,sBAAsB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;QAC3C,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;QAC3C,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;KAC1C,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;IACtE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACrG,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EACjG,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/test/capabilities.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=capabilities.test.d.ts.map

package/dist/test/capabilities.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.test.d.ts","sourceRoot":"","sources":["../../src/test/capabilities.test.ts"],"names":[],"mappings":""}

package/dist/test/capabilities.test.js

@@ -0,0 +1,86 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { CapabilityError, CapabilityRegistry } from "../capability.js";
+import { designCapabilityIds, registerUnavailableDesignCapabilities } from "../design-capabilities.js";
+const hash = "a".repeat(64);
+function envelope(overrides = {}) {
+    return {
+        schemaVersion: "1.0.0",
+        projectId: "project",
+        runId: "run",
+        taskId: "task",
+        role: "deployer",
+        taskType: "test",
+        expectedHead: hash,
+        ownerEpoch: 1,
+        createdAt: "2026-07-13T00:00:00.000Z",
+        expiresAt: "2026-07-13T02:00:00.000Z",
+        inputRefs: [],
+        allowedOutputKinds: [],
+        capabilityGrants: [{ capability: "test.run", sideEffect: "remote", expiresAt: "2026-07-13T02:00:00.000Z" }],
+        maxOutputBytes: 100,
+        ...overrides,
+    };
+}
+const capability = {
+    id: "test.run",
+    sideEffect: "remote",
+    requiredRole: "deployer",
+    timeoutMs: 20,
+    retries: 0,
+    idempotency: "required",
+    async execute(_context, input) {
+        return { value: input };
+    },
+};
+test("registry denies missing grants, wrong roles, expiry, and unknown capabilities", async () => {
+    const registry = new CapabilityRegistry({ now: () => new Date("2026-07-13T01:00:00.000Z") });
+    registry.register(capability);
+    await assert.rejects(registry.execute("missing", envelope(), "x"), errorCode("CAPABILITY_UNKNOWN"));
+    await assert.rejects(registry.execute("test.run", envelope({ capabilityGrants: [] }), "x"), errorCode("CAPABILITY_GRANT_DENIED"));
+    await assert.rejects(registry.execute("test.run", envelope({ role: "reader" }), "x"), errorCode("CAPABILITY_ROLE_DENIED"));
+    await assert.rejects(registry.execute("test.run", envelope({ expiresAt: "2026-07-13T00:30:00.000Z" }), "x"), errorCode("CAPABILITY_EXPIRED"));
+});
+test("registry rejects duplicate capabilities, timeouts, and oversized output", async () => {
+    const registry = new CapabilityRegistry({ now: () => new Date("2026-07-13T01:00:00.000Z") });
+    registry.register(capability);
+    assert.throws(() => registry.register(capability), errorCode("CAPABILITY_DUPLICATE"));
+    const slow = {
+        ...capability,
+        id: "test.slow",
+        sideEffect: "none",
+        timeoutMs: 1,
+        async execute() {
+            return await new Promise(() => undefined);
+        },
+    };
+    registry.register(slow);
+    await assert.rejects(registry.execute("test.slow", envelope({
+        capabilityGrants: [{ capability: "test.slow", sideEffect: "none", expiresAt: "2026-07-13T02:00:00.000Z" }],
+    }), undefined), errorCode("CAPABILITY_TIMEOUT"));
+    await assert.rejects(registry.execute("test.run", envelope({ maxOutputBytes: 5 }), "too-large"), errorCode("CAPABILITY_OUTPUT_LIMIT"));
+});
+test("registry rejects implemented capabilities until they are qualified", async () => {
+    const registry = new CapabilityRegistry({ now: () => new Date("2026-07-13T01:00:00.000Z") });
+    registry.register({ ...capability, lifecycle: "implemented-unqualified" });
+    await assert.rejects(registry.execute("test.run", envelope(), "x"), errorCode("CAPABILITY_UNQUALIFIED"));
+});
+test("registry permits trusted external capabilities through their envelope controls", async () => {
+    const registry = new CapabilityRegistry({ now: () => new Date("2026-07-13T01:00:00.000Z") });
+    registry.register({ ...capability, lifecycle: "external-trusted" });
+    assert.deepEqual(await registry.execute("test.run", envelope(), "x"), { value: "x" });
+});
+test("unqualified design capabilities return only the stable unavailable error", async () => {
+    const registry = new CapabilityRegistry({ now: () => new Date("2026-07-13T01:00:00.000Z") });
+    registerUnavailableDesignCapabilities(registry);
+    for (const id of Object.values(designCapabilityIds)) {
+        await assert.rejects(registry.execute(id, envelope({
+            role: "architect",
+            capabilityGrants: [{ capability: id, sideEffect: "none", expiresAt: "2026-07-13T02:00:00.000Z" }],
+        }), { request: "test" }), errorCode("CAPABILITY_UNAVAILABLE"));
+    }
+});
+function errorCode(code) {
+    return (error) => error instanceof CapabilityError && error.code === code;
+}
+//# sourceMappingURL=capabilities.test.js.map

package/dist/test/capabilities.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.test.js","sourceRoot":"","sources":["../../src/test/capabilities.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAmB,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,qCAAqC,EAAE,MAAM,2BAA2B,CAAC;AAEvG,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE5B,SAAS,QAAQ,CAAC,SAAS,GAA4B,EAAE;IACvD,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,CAAC;QACb,SAAS,EAAE,0BAA0B;QACrC,SAAS,EAAE,0BAA0B;QACrC,SAAS,EAAE,EAAE;QACb,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;QAC3G,cAAc,EAAE,GAAG;QACnB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAA0C;IACxD,EAAE,EAAE,UAAU;IACd,UAAU,EAAE,QAAQ;IACpB,YAAY,EAAE,UAAU;IACxB,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,CAAC;IACV,WAAW,EAAE,UAAU;IACvB,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;CACF,CAAC;AAEF,IAAI,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;IAC/F,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC7F,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE9B,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACpG,MAAM,MAAM,CAAC,OAAO,CAClB,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,EACrE,SAAS,CAAC,yBAAyB,CAAC,CACrC,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAClB,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAC/D,SAAS,CAAC,wBAAwB,CAAC,CACpC,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAClB,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,EAAE,GAAG,CAAC,EACtF,SAAS,CAAC,oBAAoB,CAAC,CAChC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;IACzF,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC7F,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAEtF,MAAM,IAAI,GAAe;QACvB,GAAG,UAAU;QACb,EAAE,EAAE,WAAW;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,CAAC;QACZ,KAAK,CAAC,OAAO;YACX,OAAO,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;IACF,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,MAAM,CAAC,OAAO,CAClB,QAAQ,CAAC,OAAO,CACd,WAAW,EACX,QAAQ,CAAC;QACP,gBAAgB,EAAE,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;KAC3G,CAAC,EACF,SAAS,CACV,EACD,SAAS,CAAC,oBAAoB,CAAC,CAChC,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAClB,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,EAC1E,SAAS,CAAC,yBAAyB,CAAC,CACrC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;IACpF,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC7F,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAE3E,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAC3G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC7F,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAEpE,MAAM,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC7F,qCAAqC,CAAC,QAAQ,CAAC,CAAC;IAEhD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,CAAC,OAAO,CAClB,QAAQ,CAAC,OAAO,CACd,EAAE,EACF,QAAQ,CAAC;YACP,IAAI,EAAE,WAAW;YACjB,gBAAgB,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;SAClG,CAAC,EACF,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,EACD,SAAS,CAAC,wBAAwB,CAAC,CACpC,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC5E,CAAC"}

package/dist/test/encrypted-envelope-transport.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=encrypted-envelope-transport.test.d.ts.map

package/dist/test/encrypted-envelope-transport.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-envelope-transport.test.d.ts","sourceRoot":"","sources":["../../src/test/encrypted-envelope-transport.test.ts"],"names":[],"mappings":""}

package/dist/test/encrypted-envelope-transport.test.js

@@ -0,0 +1,74 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { EncryptedEnvelopeTransport } from "../index.js";
+const key = Buffer.alloc(32, 7);
+const now = new Date("2026-07-15T10:00:00.000Z");
+const transport = () => new EncryptedEnvelopeTransport(() => now, () => Buffer.alloc(12, 3));
+function encrypted() {
+    return transport().encrypt(Buffer.from("repository state"), key, {
+        kind: "apex-repository-state",
+        recipient: "ci-workflow",
+        ttlMs: 60_000,
+        bindings: { runId: "run-1", ownerEpoch: 1, projectId: "demo" },
+    });
+}
+test("encrypted envelopes are deterministic with fixed time and nonce and canonicalize bindings", () => {
+    const first = encrypted();
+    const second = transport().encrypt(Buffer.from("repository state"), key, {
+        kind: "apex-repository-state",
+        recipient: "ci-workflow",
+        ttlMs: 60_000,
+        bindings: { projectId: "demo", ownerEpoch: 1, runId: "run-1" },
+    });
+    assert.deepEqual(first, second);
+    assert.deepEqual(first.metadata.bindings, { ownerEpoch: 1, projectId: "demo", runId: "run-1" });
+    assert.equal(transport().decrypt(first, key, "ci-workflow").toString(), "repository state");
+});
+test("encrypted envelopes enforce key, kind, recipient, and positive TTL", () => {
+    assert.throws(() => transport().decrypt(encrypted(), Buffer.alloc(31), "ci-workflow"), /32-byte key/);
+    assert.throws(() => transport().decrypt(encrypted(), key, "other"), /recipient/);
+    assert.throws(() => transport().encrypt(Buffer.from("state"), key, {
+        kind: "",
+        recipient: "ci",
+        ttlMs: 1,
+        bindings: {},
+    }), /kind, recipient, and positive TTL/);
+    assert.throws(() => transport().encrypt(Buffer.from("state"), key, {
+        kind: "state",
+        recipient: "ci",
+        ttlMs: 0,
+        bindings: {},
+    }), /positive TTL/);
+    assert.throws(() => transport().encrypt(Buffer.from("state"), key, {
+        kind: "state",
+        recipient: "ci",
+        ttlMs: 1,
+        bindings: { ["bad-key"]: "invalid" },
+    }), /identifier-shaped/);
+});
+test("encrypted envelopes reject expiry and authenticated tampering", () => {
+    const envelope = encrypted();
+    const expired = new EncryptedEnvelopeTransport(() => new Date("2026-07-15T10:01:00.000Z"));
+    assert.throws(() => expired.decrypt(envelope, key, "ci-workflow"), /expired/);
+    for (const tampered of [
+        { ...envelope, metadata: { ...envelope.metadata, kind: "other" } },
+        { ...envelope, metadata: { ...envelope.metadata, unexpected: "value" } },
+        { ...envelope, authTag: `${envelope.authTag.slice(0, -2)}AA` },
+        { ...envelope, ciphertext: `${envelope.ciphertext.slice(0, -2)}AA` },
+    ]) {
+        assert.throws(() => transport().decrypt(tampered, key, "ci-workflow"));
+    }
+});
+test("encrypted envelopes detect plaintext digest mismatch", () => {
+    const envelope = encrypted();
+    const digest = "0".repeat(64);
+    const forged = transport().encrypt(Buffer.from("repository state"), key, {
+        kind: "apex-repository-state",
+        recipient: "ci-workflow",
+        ttlMs: 60_000,
+        bindings: {},
+    });
+    assert.throws(() => transport().decrypt({ ...forged, metadata: { ...forged.metadata, digest } }, key, "ci-workflow"));
+    assert.notEqual(envelope.metadata.digest, digest);
+});
+//# sourceMappingURL=encrypted-envelope-transport.test.js.map