@claude-flow/cli 3.54.0 → 3.55.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude/helpers/helpers.manifest.json +3 -3
- package/.claude/helpers/hook-handler.cjs +65 -3
- package/bin/cli.js +1 -1
- package/bin/mcp-server.js +1 -1
- package/catalog-manifest.json +2 -2
- package/dist/src/blocking-stdio.d.ts +11 -0
- package/dist/src/blocking-stdio.js +23 -0
- package/dist/src/commands/autopilot.js +2 -2
- package/dist/src/commands/daemon.js +21 -1
- package/dist/src/commands/hive-mind.js +7 -0
- package/dist/src/commands/mcp.js +35 -1
- package/dist/src/commands/policy.js +10 -2
- package/dist/src/commands/session.js +11 -37
- package/dist/src/index.js +3 -0
- package/dist/src/init/executor.js +1 -0
- package/dist/src/init/helpers-generator.js +65 -3
- package/dist/src/mcp-server.d.ts +33 -0
- package/dist/src/mcp-server.js +96 -4
- package/dist/src/mcp-tools/agentdb-tools.js +13 -1
- package/dist/src/mcp-tools/hive-mind-tools.d.ts +2 -4
- package/dist/src/mcp-tools/hive-mind-tools.js +214 -40
- package/dist/src/mcp-tools/hooks-tools.js +1 -1
- package/dist/src/mcp-tools/session-tools.js +4 -1
- package/dist/src/memory/graph-edge-writer.js +3 -2
- package/dist/src/memory/lucene-bm25.js +11 -19
- package/dist/src/memory/memory-bridge.d.ts +1 -0
- package/dist/src/memory/memory-bridge.js +14 -1
- package/dist/src/memory/memory-initializer.js +5 -4
- package/dist/src/memory/shared-sqlite.d.ts +7 -0
- package/dist/src/memory/shared-sqlite.js +45 -0
- package/dist/src/mods/probe.d.ts +7 -0
- package/dist/src/mods/probe.js +29 -1
- package/dist/src/parser.d.ts +3 -0
- package/dist/src/parser.js +64 -13
- package/dist/src/production/monitoring.d.ts +2 -0
- package/dist/src/production/monitoring.js +8 -3
- package/dist/src/production/rate-limiter.js +8 -5
- package/dist/src/production/retry.js +3 -1
- package/dist/src/services/bounded-worker-pool.js +3 -0
- package/dist/src/services/config-file-manager.d.ts +3 -0
- package/dist/src/services/config-file-manager.js +24 -7
- package/dist/src/services/git-workspace-identity.js +20 -3
- package/dist/src/services/policy-ledger-anchor.d.ts +42 -0
- package/dist/src/services/policy-ledger-anchor.js +163 -0
- package/dist/src/services/policy-runtime.d.ts +11 -5
- package/dist/src/services/policy-runtime.js +70 -15
- package/dist/src/services/worker-daemon.d.ts +1 -0
- package/dist/src/services/worker-daemon.js +12 -0
- package/dist/src/services/worker-queue.d.ts +1 -0
- package/dist/src/services/worker-queue.js +20 -3
- package/node_modules/@claude-flow/mcp/dist/connection-pool.d.ts.map +1 -1
- package/node_modules/@claude-flow/mcp/dist/connection-pool.js +5 -2
- package/node_modules/@claude-flow/mcp/dist/connection-pool.js.map +1 -1
- package/node_modules/@claude-flow/mcp/dist/transport/http.d.ts +7 -1
- package/node_modules/@claude-flow/mcp/dist/transport/http.d.ts.map +1 -1
- package/node_modules/@claude-flow/mcp/dist/transport/http.js +60 -47
- package/node_modules/@claude-flow/mcp/dist/transport/http.js.map +1 -1
- package/node_modules/@claude-flow/mcp/package.json +1 -1
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.js +1 -1
- package/node_modules/@claude-flow/plugin-agent-federation/dist/application/federation-coordinator.js.map +1 -1
- package/node_modules/@claude-flow/plugin-agent-federation/dist/bin.js +0 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.d.ts +3 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.d.ts.map +1 -1
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.js +4 -1
- package/node_modules/@claude-flow/plugin-agent-federation/dist/domain/services/routing-service.js.map +1 -1
- package/node_modules/@claude-flow/plugin-agent-federation/dist/plugin.d.ts.map +1 -1
- package/node_modules/@claude-flow/plugin-agent-federation/dist/plugin.js +1 -0
- package/node_modules/@claude-flow/plugin-agent-federation/dist/plugin.js.map +1 -1
- package/node_modules/@claude-flow/plugin-agent-federation/package.json +1 -1
- package/node_modules/@claude-flow/security/dist/policy/engine.d.ts +11 -1
- package/node_modules/@claude-flow/security/dist/policy/engine.d.ts.map +1 -1
- package/node_modules/@claude-flow/security/dist/policy/engine.js +19 -3
- package/node_modules/@claude-flow/security/dist/policy/engine.js.map +1 -1
- package/node_modules/@claude-flow/security/dist/policy/types.d.ts +4 -2
- package/node_modules/@claude-flow/security/dist/policy/types.d.ts.map +1 -1
- package/node_modules/@claude-flow/security/package.json +1 -1
- package/package.json +7 -7
- package/plugins/ruflo-metaharness/.claude-plugin/plugin.json +1 -1
- package/plugins/ruflo-metaharness/scripts/_invoke.mjs +80 -7
- package/plugins/ruflo-metaharness/scripts/smoke.sh +4 -4
- package/plugins/ruflo-metaharness/scripts/test-cli-resolution-3558.mjs +141 -0
- package/plugins/ruflo-metaharness/scripts/test-no-tool-time-npx.mjs +5 -0
|
@@ -0,0 +1,163 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Second, hash-chained copy of the policy ledger anchor (#3602, ADR-475).
|
|
3
|
+
*
|
|
4
|
+
* The primary anchor (`ledgerLength` / `ledgerHead`) lives inside state.json,
|
|
5
|
+
* the same file it protects, so deleting it together with receipts used to
|
|
6
|
+
* make `verify` bless the truncated chain. This module keeps an append-only
|
|
7
|
+
* chain of anchor entries in a SEPARATE file plus a mirror of the newest entry
|
|
8
|
+
* outside the project directory (~/.config/ruflo/policy-trust/<project>/).
|
|
9
|
+
*
|
|
10
|
+
* Threat model: this detects any tampering confined to state.json, and any
|
|
11
|
+
* tampering confined to the project directory. It does NOT stop an attacker
|
|
12
|
+
* who can rewrite both the project directory and the user's home directory.
|
|
13
|
+
*/
|
|
14
|
+
import { createHash } from 'node:crypto';
|
|
15
|
+
import { existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
|
|
16
|
+
import { dirname, join, resolve } from 'node:path';
|
|
17
|
+
import { userInfo } from 'node:os';
|
|
18
|
+
const LOG_FILE = 'ledger-anchors.json';
|
|
19
|
+
const MIRROR_FILE = 'ledger-anchor-head.json';
|
|
20
|
+
export const anchorLogPath = (projectRoot) => join(resolve(projectRoot), '.claude-flow', 'policy', LOG_FILE);
|
|
21
|
+
function mirrorPath(projectRoot) {
|
|
22
|
+
const id = createHash('sha256').update(realpathSync(projectRoot)).digest('hex');
|
|
23
|
+
return join(userInfo().homedir, '.config', 'ruflo', 'policy-trust', id, MIRROR_FILE);
|
|
24
|
+
}
|
|
25
|
+
function entryHash(entry) {
|
|
26
|
+
return createHash('sha256').update(JSON.stringify([
|
|
27
|
+
entry.seq, entry.length, entry.headHash, entry.prevAnchorHash, entry.ts, entry.event, entry.by ?? null,
|
|
28
|
+
])).digest('hex');
|
|
29
|
+
}
|
|
30
|
+
function validEntry(value, seq, prev) {
|
|
31
|
+
const e = value;
|
|
32
|
+
return !!e && typeof e === 'object'
|
|
33
|
+
&& e.seq === seq
|
|
34
|
+
&& Number.isInteger(e.length) && e.length >= 0
|
|
35
|
+
&& (e.headHash === null || typeof e.headHash === 'string')
|
|
36
|
+
&& e.prevAnchorHash === prev
|
|
37
|
+
&& typeof e.ts === 'number'
|
|
38
|
+
&& ['append', 'migrated-from-state', 'establish-anchor'].includes(e.event)
|
|
39
|
+
&& typeof e.hash === 'string'
|
|
40
|
+
&& e.hash === entryHash({ ...e, hash: undefined });
|
|
41
|
+
}
|
|
42
|
+
function readLog(projectRoot) {
|
|
43
|
+
const file = anchorLogPath(projectRoot);
|
|
44
|
+
if (!existsSync(file))
|
|
45
|
+
return [];
|
|
46
|
+
try {
|
|
47
|
+
const parsed = JSON.parse(readFileSync(file, 'utf8'));
|
|
48
|
+
if (parsed.version !== 1 || !Array.isArray(parsed.entries))
|
|
49
|
+
return 'corrupt';
|
|
50
|
+
let prev = null;
|
|
51
|
+
for (let i = 0; i < parsed.entries.length; i++) {
|
|
52
|
+
if (!validEntry(parsed.entries[i], i, prev))
|
|
53
|
+
return 'corrupt';
|
|
54
|
+
prev = parsed.entries[i].hash;
|
|
55
|
+
}
|
|
56
|
+
return parsed.entries;
|
|
57
|
+
}
|
|
58
|
+
catch {
|
|
59
|
+
return 'corrupt';
|
|
60
|
+
}
|
|
61
|
+
}
|
|
62
|
+
function readMirror(projectRoot) {
|
|
63
|
+
const file = mirrorPath(projectRoot);
|
|
64
|
+
if (!existsSync(file))
|
|
65
|
+
return null;
|
|
66
|
+
try {
|
|
67
|
+
const parsed = JSON.parse(readFileSync(file, 'utf8'));
|
|
68
|
+
return typeof parsed?.hash === 'string' && parsed.hash === entryHash({ ...parsed, hash: undefined })
|
|
69
|
+
? parsed
|
|
70
|
+
: 'corrupt';
|
|
71
|
+
}
|
|
72
|
+
catch {
|
|
73
|
+
return 'corrupt';
|
|
74
|
+
}
|
|
75
|
+
}
|
|
76
|
+
/**
|
|
77
|
+
* How the stored anchors relate to `state`; read-only. `rebuild` is the
|
|
78
|
+
* explicit-establish path: an unreadable log or mirror is treated as absent, but
|
|
79
|
+
* whatever readable anchor remains must still agree with the chain, so it can
|
|
80
|
+
* never bless a truncation the anchors still remember.
|
|
81
|
+
*/
|
|
82
|
+
export function assessAnchors(projectRoot, state, rebuild = false) {
|
|
83
|
+
let entries = readLog(projectRoot);
|
|
84
|
+
if (entries === 'corrupt') {
|
|
85
|
+
if (!rebuild)
|
|
86
|
+
return { kind: 'fail', error: 'policy-anchor-log-corrupt' };
|
|
87
|
+
entries = [];
|
|
88
|
+
}
|
|
89
|
+
let mirror = readMirror(projectRoot);
|
|
90
|
+
if (mirror === 'corrupt') {
|
|
91
|
+
if (!rebuild)
|
|
92
|
+
return { kind: 'fail', error: 'policy-anchor-mirror-corrupt' };
|
|
93
|
+
mirror = null;
|
|
94
|
+
}
|
|
95
|
+
if (entries.length === 0) {
|
|
96
|
+
if (!mirror)
|
|
97
|
+
return { kind: 'absent' };
|
|
98
|
+
if (!rebuild)
|
|
99
|
+
return { kind: 'fail', error: 'policy-anchor-log-missing' };
|
|
100
|
+
if (state.receipts.length < mirror.length)
|
|
101
|
+
return { kind: 'fail', error: 'policy-ledger-truncated' };
|
|
102
|
+
if (mirror.length > 0 && state.receipts[mirror.length - 1].hash !== mirror.headHash) {
|
|
103
|
+
return { kind: 'fail', error: 'policy-ledger-anchor-mismatch' };
|
|
104
|
+
}
|
|
105
|
+
return { kind: 'absent' };
|
|
106
|
+
}
|
|
107
|
+
if (mirror && !entries.some((entry) => entry.hash === mirror.hash)) {
|
|
108
|
+
return { kind: 'fail', error: 'policy-anchor-log-rolled-back' };
|
|
109
|
+
}
|
|
110
|
+
const last = entries[entries.length - 1];
|
|
111
|
+
for (const anchor of mirror ? [last, mirror] : [last]) {
|
|
112
|
+
if (state.receipts.length < anchor.length)
|
|
113
|
+
return { kind: 'fail', error: 'policy-ledger-truncated' };
|
|
114
|
+
if (anchor.length > 0 && state.receipts[anchor.length - 1].hash !== anchor.headHash) {
|
|
115
|
+
return { kind: 'fail', error: 'policy-ledger-anchor-mismatch' };
|
|
116
|
+
}
|
|
117
|
+
}
|
|
118
|
+
return { kind: 'ok', last, behind: state.receipts.length > last.length };
|
|
119
|
+
}
|
|
120
|
+
/**
|
|
121
|
+
* Append an entry for the current state if the newest entry does not already
|
|
122
|
+
* describe it. Must run under the policy lock. Throws if the log is corrupt:
|
|
123
|
+
* only an explicit establish may replace a corrupt log.
|
|
124
|
+
*/
|
|
125
|
+
export async function recordAnchor(projectRoot, state, write, event = 'append', by) {
|
|
126
|
+
if (state.receipts.length === 0)
|
|
127
|
+
return;
|
|
128
|
+
const loaded = readLog(projectRoot);
|
|
129
|
+
const entries = loaded === 'corrupt' ? [] : loaded;
|
|
130
|
+
if (loaded === 'corrupt' && event !== 'establish-anchor')
|
|
131
|
+
throw new Error('policy-anchor-log-corrupt');
|
|
132
|
+
const last = entries[entries.length - 1];
|
|
133
|
+
const length = state.receipts.length;
|
|
134
|
+
const headHash = state.receipts[length - 1].hash;
|
|
135
|
+
let tip = last;
|
|
136
|
+
if (!last || last.length !== length || last.headHash !== headHash) {
|
|
137
|
+
const base = {
|
|
138
|
+
seq: entries.length,
|
|
139
|
+
length,
|
|
140
|
+
headHash,
|
|
141
|
+
prevAnchorHash: last?.hash ?? null,
|
|
142
|
+
ts: Date.now(),
|
|
143
|
+
event,
|
|
144
|
+
...(by ? { by } : {}),
|
|
145
|
+
};
|
|
146
|
+
tip = { ...base, hash: entryHash(base) };
|
|
147
|
+
await write(anchorLogPath(projectRoot), { version: 1, entries: [...entries, tip] });
|
|
148
|
+
}
|
|
149
|
+
try {
|
|
150
|
+
const mirror = mirrorPath(projectRoot);
|
|
151
|
+
mkdirSync(dirname(mirror), { recursive: true, mode: 0o700 });
|
|
152
|
+
await write(mirror, tip);
|
|
153
|
+
}
|
|
154
|
+
catch (error) {
|
|
155
|
+
// A read-only home must not stop the ledger; verify reports the weaker
|
|
156
|
+
// posture (no mirror) rather than failing closed on every decision.
|
|
157
|
+
process.stderr.write(`[policy] anchor mirror not written: ${error.message}\n`);
|
|
158
|
+
}
|
|
159
|
+
}
|
|
160
|
+
export function anchorPosture(projectRoot) {
|
|
161
|
+
return { log: existsSync(anchorLogPath(projectRoot)), mirror: existsSync(mirrorPath(projectRoot)) };
|
|
162
|
+
}
|
|
163
|
+
//# sourceMappingURL=policy-ledger-anchor.js.map
|
|
@@ -22,13 +22,19 @@ export declare function issuePolicyApproval(approval: Omit<PolicyApproval, 'uses
|
|
|
22
22
|
issuedAt?: number;
|
|
23
23
|
}, projectRoot?: string, approvalIssuerVerifier?: (issuer: string) => boolean): Promise<PolicyApproval>;
|
|
24
24
|
export declare function revokePolicyApproval(id: string, projectRoot?: string): Promise<boolean>;
|
|
25
|
+
export type PolicyLedgerVerification = ReturnType<AgenticPolicyEngine['verifyLedger']> & {
|
|
26
|
+
/** How the second anchor was brought in line during this call. */
|
|
27
|
+
secondaryAnchor?: 'recorded-from-state' | 'restored-primary' | 'established-explicitly';
|
|
28
|
+
};
|
|
25
29
|
/**
|
|
26
|
-
*
|
|
27
|
-
*
|
|
28
|
-
* `policy-ledger-verification-failed` and hides which check failed.
|
|
29
|
-
*
|
|
30
|
+
* Verification (#3568, #3602). It must not run inside `withPolicyTransaction`,
|
|
31
|
+
* whose own post-operation check throws a generic
|
|
32
|
+
* `policy-ledger-verification-failed` and hides which check failed. It writes
|
|
33
|
+
* only to bring the second anchor in line, or on an explicit `establishAnchor`.
|
|
30
34
|
*/
|
|
31
|
-
export declare function verifyPolicyLedger(projectRoot?: string
|
|
35
|
+
export declare function verifyPolicyLedger(projectRoot?: string, options?: {
|
|
36
|
+
establishAnchor?: boolean;
|
|
37
|
+
}): Promise<PolicyLedgerVerification>;
|
|
32
38
|
export declare function authorizeMcpTool(toolName: string, input: Record<string, unknown>, context?: Record<string, unknown>, attributes?: Readonly<{
|
|
33
39
|
actionType?: string;
|
|
34
40
|
network?: boolean;
|
|
@@ -5,6 +5,7 @@ import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync,
|
|
|
5
5
|
import { dirname, join, resolve } from 'node:path';
|
|
6
6
|
import { hostname, userInfo } from 'node:os';
|
|
7
7
|
import { syncPolicyProjection } from '../mods/policy-projection.js';
|
|
8
|
+
import { assessAnchors, recordAnchor } from './policy-ledger-anchor.js';
|
|
8
9
|
const POLICY_DIR = join('.claude-flow', 'policy');
|
|
9
10
|
const POLICY_FILE = 'state.json';
|
|
10
11
|
const LOCK_FILE = 'state.lock';
|
|
@@ -231,8 +232,11 @@ function verifyStateAnchor(projectRoot, state) {
|
|
|
231
232
|
throw new Error('policy-state-authentication-failed');
|
|
232
233
|
}
|
|
233
234
|
}
|
|
234
|
-
async function writePolicyState(projectRoot, statePath, state) {
|
|
235
|
+
async function writePolicyState(projectRoot, statePath, state, anchorEvent = 'append', by) {
|
|
235
236
|
await writePolicyStateFiles(projectRoot, statePath, state);
|
|
237
|
+
// #3602: the second anchor is written after the state, so a crash leaves the
|
|
238
|
+
// state AHEAD of the log (caught up on the next write), never behind it.
|
|
239
|
+
await recordAnchor(projectRoot, state, writeJsonAtomic, anchorEvent, by);
|
|
236
240
|
// ADR-404: the ruflo mod reads Claude Code tool rules from a small
|
|
237
241
|
// projection, never from state.json. Written only after the state and its
|
|
238
242
|
// anchor are safely down; a failure here never fails the state write. A
|
|
@@ -350,20 +354,26 @@ export async function withPolicyTransaction(projectRoot, operation, options = {}
|
|
|
350
354
|
mkdirSync(target.dir, { recursive: true, mode: 0o700 });
|
|
351
355
|
const release = await acquireLock(target.lock);
|
|
352
356
|
try {
|
|
353
|
-
const
|
|
357
|
+
const loaded = loadPolicyState(projectRoot);
|
|
358
|
+
const engine = AgenticPolicyEngine.fromState(loaded, {
|
|
354
359
|
signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,
|
|
355
360
|
keyId: process.env.CLAUDE_FLOW_POLICY_KEY_ID,
|
|
356
361
|
evidenceVerifier: verifyPolicyEvidence,
|
|
357
362
|
approvalIssuerVerifier: options.approvalIssuerVerifier,
|
|
358
363
|
});
|
|
364
|
+
// #3602: refuse to operate on a ledger whose anchors are missing or
|
|
365
|
+
// disagree; a restored primary anchor is persisted by the write below.
|
|
366
|
+
const gate = reconcileLedger(projectRoot, engine, {});
|
|
367
|
+
if (!gate.result.valid) {
|
|
368
|
+
throw new Error(gate.result.error === 'anchor-missing'
|
|
369
|
+
? `policy-ledger-anchor-missing: receipts exist but no ledger anchor was found. If this ledger predates anchors, run \`ruflo policy verify --establish-anchor\`; otherwise treat it as tampering.`
|
|
370
|
+
: gate.result.error ?? 'policy-ledger-verification-failed');
|
|
371
|
+
}
|
|
359
372
|
const result = await operation(engine);
|
|
360
|
-
// Verify before exporting: verification establishes the ledger anchor
|
|
361
|
-
// (#3568) on state written before the anchor existed, and that anchor
|
|
362
|
-
// must be part of what is persisted.
|
|
363
373
|
if (!engine.verifyLedger().valid)
|
|
364
374
|
throw new Error('policy-ledger-verification-failed');
|
|
365
375
|
const nextState = engine.exportState();
|
|
366
|
-
await writePolicyState(projectRoot, target.state, nextState);
|
|
376
|
+
await writePolicyState(projectRoot, target.state, nextState, gate.event);
|
|
367
377
|
return result;
|
|
368
378
|
}
|
|
369
379
|
finally {
|
|
@@ -416,12 +426,56 @@ export async function revokePolicyApproval(id, projectRoot = process.cwd()) {
|
|
|
416
426
|
return withPolicyTransaction(projectRoot, (engine) => engine.revokeApproval(id));
|
|
417
427
|
}
|
|
418
428
|
/**
|
|
419
|
-
*
|
|
420
|
-
*
|
|
421
|
-
*
|
|
422
|
-
*
|
|
429
|
+
* Decide whether the ledger may be trusted, using the chain, the primary anchor
|
|
430
|
+
* in state.json and the second anchor (#3602). It never creates an anchor over
|
|
431
|
+
* existing receipts on its own: only an authentic second anchor (restoring a
|
|
432
|
+
* deleted primary) or an explicit `establishAnchor` does.
|
|
433
|
+
*/
|
|
434
|
+
function reconcileLedger(projectRoot, engine, options) {
|
|
435
|
+
const state = engine.exportState();
|
|
436
|
+
const length = state.receipts.length;
|
|
437
|
+
const primary = typeof state.ledgerLength === 'number';
|
|
438
|
+
const base = engine.verifyLedger();
|
|
439
|
+
const fail = (error) => ({ result: { valid: false, length, error }, persist: false });
|
|
440
|
+
if (!base.valid && base.error !== 'anchor-missing')
|
|
441
|
+
return { result: base, persist: false };
|
|
442
|
+
const assessed = assessAnchors(projectRoot, state, options.establishAnchor === true);
|
|
443
|
+
if (assessed.kind === 'fail')
|
|
444
|
+
return fail(assessed.error);
|
|
445
|
+
if (primary) {
|
|
446
|
+
if (assessed.kind === 'absent' && length > 0) {
|
|
447
|
+
return options.establishAnchor
|
|
448
|
+
? { result: { ...base, secondaryAnchor: 'established-explicitly' }, persist: true, event: 'establish-anchor' }
|
|
449
|
+
: { result: { ...base, secondaryAnchor: 'recorded-from-state' }, persist: true, event: 'migrated-from-state' };
|
|
450
|
+
}
|
|
451
|
+
return { result: base, persist: assessed.kind === 'ok' && assessed.behind, event: 'append' };
|
|
452
|
+
}
|
|
453
|
+
// No primary anchor.
|
|
454
|
+
if (length === 0)
|
|
455
|
+
return { result: { valid: true, length, state: 'empty' }, persist: false };
|
|
456
|
+
if (assessed.kind === 'ok') {
|
|
457
|
+
// The second anchor is authentic and agrees with the chain: the deleted
|
|
458
|
+
// primary can be restored from it. Truncation was already rejected above.
|
|
459
|
+
engine.verifyLedger({ establishAnchor: true });
|
|
460
|
+
return { result: { valid: true, length, secondaryAnchor: 'restored-primary' }, persist: true, event: 'append' };
|
|
461
|
+
}
|
|
462
|
+
if (options.establishAnchor) {
|
|
463
|
+
const established = engine.verifyLedger({ establishAnchor: true });
|
|
464
|
+
return {
|
|
465
|
+
result: { ...established, secondaryAnchor: 'established-explicitly' },
|
|
466
|
+
persist: true,
|
|
467
|
+
event: 'establish-anchor',
|
|
468
|
+
};
|
|
469
|
+
}
|
|
470
|
+
return fail('anchor-missing');
|
|
471
|
+
}
|
|
472
|
+
/**
|
|
473
|
+
* Verification (#3568, #3602). It must not run inside `withPolicyTransaction`,
|
|
474
|
+
* whose own post-operation check throws a generic
|
|
475
|
+
* `policy-ledger-verification-failed` and hides which check failed. It writes
|
|
476
|
+
* only to bring the second anchor in line, or on an explicit `establishAnchor`.
|
|
423
477
|
*/
|
|
424
|
-
export async function verifyPolicyLedger(projectRoot = process.cwd()) {
|
|
478
|
+
export async function verifyPolicyLedger(projectRoot = process.cwd(), options = {}) {
|
|
425
479
|
const target = paths(projectRoot);
|
|
426
480
|
mkdirSync(target.dir, { recursive: true, mode: 0o700 });
|
|
427
481
|
const release = await acquireLock(target.lock);
|
|
@@ -430,11 +484,12 @@ export async function verifyPolicyLedger(projectRoot = process.cwd()) {
|
|
|
430
484
|
signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,
|
|
431
485
|
keyId: process.env.CLAUDE_FLOW_POLICY_KEY_ID,
|
|
432
486
|
});
|
|
433
|
-
const
|
|
434
|
-
if (
|
|
435
|
-
|
|
487
|
+
const outcome = reconcileLedger(projectRoot, engine, options);
|
|
488
|
+
if (outcome.persist) {
|
|
489
|
+
const by = outcome.event === 'establish-anchor' ? userInfo().username : undefined;
|
|
490
|
+
await writePolicyState(projectRoot, target.state, engine.exportState(), outcome.event, by);
|
|
436
491
|
}
|
|
437
|
-
return result;
|
|
492
|
+
return outcome.result;
|
|
438
493
|
}
|
|
439
494
|
finally {
|
|
440
495
|
release();
|
|
@@ -193,6 +193,7 @@ export class WorkerDaemon extends EventEmitter {
|
|
|
193
193
|
?? fileConfig.aiWorkersEnabled
|
|
194
194
|
?? (process.env.RUFLO_DAEMON_AI_WORKERS === '1'),
|
|
195
195
|
workers: config?.workers ?? DEFAULT_WORKERS,
|
|
196
|
+
enabledWorkers: config?.enabledWorkers,
|
|
196
197
|
};
|
|
197
198
|
// #2935 — deferred from readDaemonConfigFromFile(): this.config (and
|
|
198
199
|
// therefore this.config.logDir) doesn't exist until the assignment
|
|
@@ -700,6 +701,17 @@ export class WorkerDaemon extends EventEmitter {
|
|
|
700
701
|
// Ignore parse errors, start fresh
|
|
701
702
|
}
|
|
702
703
|
}
|
|
704
|
+
// #3547 (#1968 follow-up): an explicit `--workers` selection wins over
|
|
705
|
+
// both DEFAULT_WORKERS and whatever daemon-state.json just restored
|
|
706
|
+
// above — otherwise `daemon start --workers map,audit` always ran the
|
|
707
|
+
// full default set (or a stale saved selection) because nothing ever
|
|
708
|
+
// applied the requested list to `enabled`.
|
|
709
|
+
if (this.config.enabledWorkers) {
|
|
710
|
+
const selected = new Set(this.config.enabledWorkers);
|
|
711
|
+
for (const workerConfig of this.config.workers) {
|
|
712
|
+
workerConfig.enabled = selected.has(workerConfig.type);
|
|
713
|
+
}
|
|
714
|
+
}
|
|
703
715
|
// Initialize any missing workers
|
|
704
716
|
for (const workerConfig of this.config.workers) {
|
|
705
717
|
if (!this.workers.has(workerConfig.type)) {
|
|
@@ -162,6 +162,7 @@ export class WorkerQueue extends EventEmitter {
|
|
|
162
162
|
workerId;
|
|
163
163
|
heartbeatTimer;
|
|
164
164
|
processingTasks = new Set();
|
|
165
|
+
retryTimers = new Set();
|
|
165
166
|
isShuttingDown = false;
|
|
166
167
|
maxConcurrent = 1;
|
|
167
168
|
initialized = false;
|
|
@@ -232,8 +233,9 @@ export class WorkerQueue extends EventEmitter {
|
|
|
232
233
|
// Check queues in priority order
|
|
233
234
|
for (const workerType of workerTypes) {
|
|
234
235
|
const queueName = this.getQueueName(workerType);
|
|
235
|
-
|
|
236
|
-
|
|
236
|
+
let taskId;
|
|
237
|
+
// Cancelled or otherwise stale entries do not exhaust this worker type.
|
|
238
|
+
while ((taskId = this.store.popFromQueue(queueName)) !== null) {
|
|
237
239
|
const task = this.store.getTask(taskId);
|
|
238
240
|
if (task && task.status === 'pending') {
|
|
239
241
|
task.status = 'processing';
|
|
@@ -257,6 +259,10 @@ export class WorkerQueue extends EventEmitter {
|
|
|
257
259
|
this.emit('warning', { message: `Task ${taskId} not found for completion` });
|
|
258
260
|
return;
|
|
259
261
|
}
|
|
262
|
+
// Late or duplicate outcomes must not rewrite a settled task.
|
|
263
|
+
if (['completed', 'failed', 'timeout', 'cancelled'].includes(task.status)) {
|
|
264
|
+
return;
|
|
265
|
+
}
|
|
260
266
|
task.status = 'completed';
|
|
261
267
|
task.completedAt = new Date();
|
|
262
268
|
task.result = result;
|
|
@@ -275,6 +281,10 @@ export class WorkerQueue extends EventEmitter {
|
|
|
275
281
|
this.emit('warning', { message: `Task ${taskId} not found for failure` });
|
|
276
282
|
return;
|
|
277
283
|
}
|
|
284
|
+
// Late or duplicate outcomes must not rewrite a settled task.
|
|
285
|
+
if (['completed', 'failed', 'timeout', 'cancelled'].includes(task.status)) {
|
|
286
|
+
return;
|
|
287
|
+
}
|
|
278
288
|
this.processingTasks.delete(taskId);
|
|
279
289
|
// Check if we should retry
|
|
280
290
|
if (retryable && task.retryCount < task.maxRetries) {
|
|
@@ -286,10 +296,13 @@ export class WorkerQueue extends EventEmitter {
|
|
|
286
296
|
this.store.setTask(taskId, task);
|
|
287
297
|
// Re-queue with delay (exponential backoff)
|
|
288
298
|
const delay = Math.min(30000, 1000 * Math.pow(2, task.retryCount));
|
|
289
|
-
|
|
299
|
+
// Tracked so shutdown() can release it
|
|
300
|
+
const timer = setTimeout(() => {
|
|
301
|
+
this.retryTimers.delete(timer);
|
|
290
302
|
const queueName = this.getQueueName(task.workerType);
|
|
291
303
|
this.store.pushToQueue(queueName, taskId, PRIORITY_SCORES[task.priority]);
|
|
292
304
|
}, delay);
|
|
305
|
+
this.retryTimers.add(timer);
|
|
293
306
|
this.emit('taskRetrying', { taskId, retryCount: task.retryCount, delay });
|
|
294
307
|
}
|
|
295
308
|
else {
|
|
@@ -469,6 +482,10 @@ export class WorkerQueue extends EventEmitter {
|
|
|
469
482
|
for (const taskId of this.processingTasks) {
|
|
470
483
|
await this.fail(taskId, 'Worker shutdown', false);
|
|
471
484
|
}
|
|
485
|
+
// Release scheduled retry timers (they would hold the process open)
|
|
486
|
+
for (const timer of this.retryTimers)
|
|
487
|
+
clearTimeout(timer);
|
|
488
|
+
this.retryTimers.clear();
|
|
472
489
|
// Stop store cleanup
|
|
473
490
|
this.store.stopCleanup();
|
|
474
491
|
await this.unregisterWorker();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connection-pool.d.ts","sourceRoot":"","sources":["../src/connection-pool.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EAEpB,eAAe,EACf,OAAO,EACP,aAAa,EACd,MAAM,YAAY,CAAC;AAoDpB,qBAAa,cAAe,SAAQ,YAAa,YAAW,eAAe;IAmBvE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAnBhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6C;IACzE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,aAAa,CAAC,CAAiB;IACvC,OAAO,CAAC,iBAAiB,CAAa;IACtC,OAAO,CAAC,cAAc,CAAkB;IAExC,OAAO,CAAC,KAAK,CAOX;gBAGA,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,YAAK,EACzB,MAAM,EAAE,OAAO,EACf,aAAa,GAAE,aAA4B;YAQhD,wBAAwB;YAWxB,gBAAgB;
|
|
1
|
+
{"version":3,"file":"connection-pool.d.ts","sourceRoot":"","sources":["../src/connection-pool.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EAEpB,eAAe,EACf,OAAO,EACP,aAAa,EACd,MAAM,YAAY,CAAC;AAoDpB,qBAAa,cAAe,SAAQ,YAAa,YAAW,eAAe;IAmBvE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAnBhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6C;IACzE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,aAAa,CAAC,CAAiB;IACvC,OAAO,CAAC,iBAAiB,CAAa;IACtC,OAAO,CAAC,cAAc,CAAkB;IAExC,OAAO,CAAC,KAAK,CAOX;gBAGA,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,YAAK,EACzB,MAAM,EAAE,OAAO,EACf,aAAa,GAAE,aAA4B;YAQhD,wBAAwB;YAWxB,gBAAgB;IAexB,OAAO,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAiC1C,OAAO,CAAC,iBAAiB;IA4BzB,OAAO,CAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI;IAuB3C,OAAO,CAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI;IAoB3C,QAAQ,IAAI,mBAAmB;IAwBzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA0BtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,oBAAoB;IAwB5B,OAAO,CAAC,iBAAiB;IAMzB,cAAc,IAAI,gBAAgB,EAAE;IAIpC,SAAS,IAAI,OAAO;CAGrB;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,YAAK,EAC1C,MAAM,EAAE,OAAO,EACf,aAAa,GAAE,aAA4B,GAC1C,cAAc,CAEhB"}
|
|
@@ -80,9 +80,12 @@ export class ConnectionPool extends EventEmitter {
|
|
|
80
80
|
minConnections: this.config.minConnections,
|
|
81
81
|
});
|
|
82
82
|
}
|
|
83
|
-
async createConnection() {
|
|
83
|
+
async createConnection(reserved = false) {
|
|
84
84
|
const id = `conn-${++this.connectionCounter}-${Date.now()}`;
|
|
85
85
|
const connection = new ManagedConnection(id, this.transportType);
|
|
86
|
+
// Reserve before exposing it in the map or yielding to another acquirer.
|
|
87
|
+
if (reserved)
|
|
88
|
+
connection.state = 'busy';
|
|
86
89
|
this.connections.set(id, connection);
|
|
87
90
|
this.stats.totalCreated++;
|
|
88
91
|
this.emit('pool:connection:created', { connectionId: id });
|
|
@@ -105,7 +108,7 @@ export class ConnectionPool extends EventEmitter {
|
|
|
105
108
|
}
|
|
106
109
|
}
|
|
107
110
|
if (this.connections.size < this.config.maxConnections) {
|
|
108
|
-
const connection = await this.createConnection();
|
|
111
|
+
const connection = await this.createConnection(true);
|
|
109
112
|
connection.acquire();
|
|
110
113
|
this.stats.totalAcquired++;
|
|
111
114
|
this.recordAcquireTime(startTime);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connection-pool.js","sourceRoot":"","sources":["../src/connection-pool.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAWtC,MAAM,mBAAmB,GAAyB;IAChD,cAAc,EAAE,EAAE;IAClB,cAAc,EAAE,CAAC;IACjB,WAAW,EAAE,KAAK;IAClB,cAAc,EAAE,IAAI;IACpB,iBAAiB,EAAE,EAAE;IACrB,mBAAmB,EAAE,KAAK;CAC3B,CAAC;AAEF,MAAM,iBAAiB;IAMH;IACA;IACA;IACT;IARF,KAAK,GAAoB,MAAM,CAAC;IAChC,UAAU,CAAO;IACjB,QAAQ,GAAW,CAAC,CAAC;IAE5B,YACkB,EAAU,EACV,SAAwB,EACxB,YAAkB,IAAI,IAAI,EAAE,EACrC,QAAkC;QAHzB,OAAE,GAAF,EAAE,CAAQ;QACV,cAAS,GAAT,SAAS,CAAe;QACxB,cAAS,GAAT,SAAS,CAAmB;QACrC,aAAQ,GAAR,QAAQ,CAA0B;QAEzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;IACnC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED,OAAO;QACL,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,SAAS,CAAC,WAAmB;QAC3B,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC;IAC9D,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;IAC3D,CAAC;CACF;AAQD,MAAM,OAAO,cAAe,SAAQ,YAAY;IAmB3B;IACA;IAnBF,MAAM,CAAuB;IAC7B,WAAW,GAAmC,IAAI,GAAG,EAAE,CAAC;IACxD,cAAc,GAAoB,EAAE,CAAC;IAC9C,aAAa,CAAkB;IAC/B,iBAAiB,GAAW,CAAC,CAAC;IAC9B,cAAc,GAAY,KAAK,CAAC;IAEhC,KAAK,GAAG;QACd,aAAa,EAAE,CAAC;QAChB,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC;QACf,cAAc,EAAE,CAAC;QACjB,gBAAgB,EAAE,CAAC;QACnB,YAAY,EAAE,CAAC;KAChB,CAAC;IAEF,YACE,SAAwC,EAAE,EACzB,MAAe,EACf,gBAA+B,YAAY;QAE5D,KAAK,EAAE,CAAC;QAHS,WAAM,GAAN,MAAM,CAAS;QACf,kBAAa,GAAb,aAAa,CAA8B;QAG5D,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,MAAM,EAAE,CAAC;QACpD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,CAAC,wBAAwB,EAAE,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,MAAM,QAAQ,GAAiC,EAAE,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;YAC/C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;SAC3C,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,gBAAgB;
|
|
1
|
+
{"version":3,"file":"connection-pool.js","sourceRoot":"","sources":["../src/connection-pool.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAWtC,MAAM,mBAAmB,GAAyB;IAChD,cAAc,EAAE,EAAE;IAClB,cAAc,EAAE,CAAC;IACjB,WAAW,EAAE,KAAK;IAClB,cAAc,EAAE,IAAI;IACpB,iBAAiB,EAAE,EAAE;IACrB,mBAAmB,EAAE,KAAK;CAC3B,CAAC;AAEF,MAAM,iBAAiB;IAMH;IACA;IACA;IACT;IARF,KAAK,GAAoB,MAAM,CAAC;IAChC,UAAU,CAAO;IACjB,QAAQ,GAAW,CAAC,CAAC;IAE5B,YACkB,EAAU,EACV,SAAwB,EACxB,YAAkB,IAAI,IAAI,EAAE,EACrC,QAAkC;QAHzB,OAAE,GAAF,EAAE,CAAQ;QACV,cAAS,GAAT,SAAS,CAAe;QACxB,cAAS,GAAT,SAAS,CAAmB;QACrC,aAAQ,GAAR,QAAQ,CAA0B;QAEzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;IACnC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED,OAAO;QACL,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,SAAS,CAAC,WAAmB;QAC3B,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC;IAC9D,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;IAC3D,CAAC;CACF;AAQD,MAAM,OAAO,cAAe,SAAQ,YAAY;IAmB3B;IACA;IAnBF,MAAM,CAAuB;IAC7B,WAAW,GAAmC,IAAI,GAAG,EAAE,CAAC;IACxD,cAAc,GAAoB,EAAE,CAAC;IAC9C,aAAa,CAAkB;IAC/B,iBAAiB,GAAW,CAAC,CAAC;IAC9B,cAAc,GAAY,KAAK,CAAC;IAEhC,KAAK,GAAG;QACd,aAAa,EAAE,CAAC;QAChB,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC;QACf,cAAc,EAAE,CAAC;QACjB,gBAAgB,EAAE,CAAC;QACnB,YAAY,EAAE,CAAC;KAChB,CAAC;IAEF,YACE,SAAwC,EAAE,EACzB,MAAe,EACf,gBAA+B,YAAY;QAE5D,KAAK,EAAE,CAAC;QAHS,WAAM,GAAN,MAAM,CAAS;QACf,kBAAa,GAAb,aAAa,CAA8B;QAG5D,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,MAAM,EAAE,CAAC;QACpD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,CAAC,wBAAwB,EAAE,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,MAAM,QAAQ,GAAiC,EAAE,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;YAC/C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;SAC3C,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAQ,GAAG,KAAK;QAC7C,MAAM,EAAE,GAAG,QAAQ,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,IAAI,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACjE,yEAAyE;QACzE,IAAI,QAAQ;YAAE,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC;QAExC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAE1B,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QAE9E,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IAAI,UAAU,CAAC,KAAK,KAAK,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC1D,UAAU,CAAC,OAAO,EAAE,CAAC;gBACrB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBAC3B,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAElC,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;gBAE1E,OAAO,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACrD,UAAU,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAElC,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YACvE,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAEO,iBAAiB,CAAC,SAAiB;QACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC,CAAC;gBAC7E,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAkB;gBAC5B,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE;oBACtB,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;oBAClC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACtB,CAAC;gBACD,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YAEF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAEjC,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;oBACrC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;gBACxF,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAA4B;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAClD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YACvE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,OAAO,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,CAAC,UAA4B;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAE5B,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAEjE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/E,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,QAAQ;QACN,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IAAI,UAAU,CAAC,KAAK,KAAK,MAAM;gBAAE,SAAS,EAAE,CAAC;iBACxC,IAAI,UAAU,CAAC,KAAK,KAAK,MAAM;gBAAE,SAAS,EAAE,CAAC;QACpD,CAAC;QAED,OAAO;YACL,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YACvC,eAAe,EAAE,SAAS;YAC1B,eAAe,EAAE,SAAS;YAC1B,eAAe,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;YAC3C,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa;YACvC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa;YACvC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACrC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;YACzC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC;gBACzC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY;gBACvD,CAAC,CAAC,CAAC;SACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAE7C,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC3C,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;YACxC,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnD,IAAI,UAAU,CAAC,KAAK,KAAK,MAAM;oBAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;YAED,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAE3B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAEnB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC9C,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9B,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QACjC,CAAC;IACH,CAAC;IAEO,oBAAoB;QAC1B,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAEhC,MAAM,OAAO,GAAwB,EAAE,CAAC;QAExC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IACE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC7C,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAClD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,SAAiB;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,QAAQ,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED,cAAc;QACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,SAAS;QACP,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;IACrF,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAClC,SAAwC,EAAE,EAC1C,MAAe,EACf,gBAA+B,YAAY;IAE3C,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;AAC3D,CAAC"}
|
|
@@ -51,9 +51,15 @@ export declare class HttpTransport extends EventEmitter implements ITransport {
|
|
|
51
51
|
private handleHttpRequest;
|
|
52
52
|
private handleWebSocketMessage;
|
|
53
53
|
/**
|
|
54
|
-
* SECURITY:
|
|
54
|
+
* SECURITY: constant-time token comparison. Both sides are hashed first so
|
|
55
|
+
* the comparison is over equal-length digests and leaks neither content nor
|
|
56
|
+
* length.
|
|
55
57
|
*/
|
|
56
58
|
private timingSafeCompare;
|
|
59
|
+
/** Only GET/HEAD of exactly /health (any case, optional trailing slash) is public. */
|
|
60
|
+
private isPublicHealthRequest;
|
|
61
|
+
/** One generic 401 for every failure mode: no hint about what was wrong. */
|
|
62
|
+
private rejectUnauthorized;
|
|
57
63
|
private validateAuth;
|
|
58
64
|
}
|
|
59
65
|
export declare function createHttpTransport(logger: ILogger, config: HttpTransportConfig): HttpTransport;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transport/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAQtC,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EAGb,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,OAAO,EACP,UAAU,EACX,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,qBAAa,aAAc,SAAQ,YAAa,YAAW,UAAU;IAmBjE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAnBzB,SAAgB,IAAI,EAAE,aAAa,CAAU;IAE7C,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,mBAAmB,CAAC,CAAsB;IAClD,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,GAAG,CAAC,CAAkB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,iBAAiB,CAAwB;IACjD,OAAO,CAAC,UAAU,CAA+B;IAEjD,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,UAAU,CAAK;gBAGJ,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,mBAAmB;IAQxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgCtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqC3B,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAIxC,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAI5C,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAcjD,gBAAgB,CAAC,YAAY,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpE,OAAO,CAAC,eAAe;
|
|
1
|
+
{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transport/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAQtC,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EAGb,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,OAAO,EACP,UAAU,EACX,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,qBAAa,aAAc,SAAQ,YAAa,YAAW,UAAU;IAmBjE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAnBzB,SAAgB,IAAI,EAAE,aAAa,CAAU;IAE7C,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,mBAAmB,CAAC,CAAsB;IAClD,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,GAAG,CAAC,CAAkB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,iBAAiB,CAAwB;IACjD,OAAO,CAAC,UAAU,CAA+B;IAEjD,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,UAAU,CAAK;gBAGJ,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,mBAAmB;IAQxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgCtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqC3B,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAIxC,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAI5C,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAcjD,gBAAgB,CAAC,YAAY,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpE,OAAO,CAAC,eAAe;IAkGvB,OAAO,CAAC,WAAW;IA+EnB,OAAO,CAAC,sBAAsB;YA2DhB,iBAAiB;YAkFjB,sBAAsB;IAuDpC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAMzB,sFAAsF;IACtF,OAAO,CAAC,qBAAqB;IAK7B,4EAA4E;IAC5E,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,YAAY;CAsBrB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,mBAAmB,GAC1B,aAAa,CAEf"}
|