@claude-flow/security 3.0.0-alpha.8 → 3.0.0

package/dist/policy/envelope.js

@@ -0,0 +1,90 @@
+function matches(patterns, value) {
+    if (!patterns?.length)
+        return true;
+    if (!value)
+        return false;
+    return patterns.some((pattern) => (pattern === '*'
+        || pattern === value
+        || (pattern.endsWith('*') && value.startsWith(pattern.slice(0, -1)))));
+}
+function subset(child, parent) {
+    if (!parent?.length)
+        return true;
+    if (!child?.length)
+        return false;
+    return child.every((value) => matches(parent, value));
+}
+export function checkCapabilityEnvelope(action, envelope, now = Date.now()) {
+    if (!envelope)
+        return { allowed: true };
+    if (envelope.expiresAt !== undefined && envelope.expiresAt <= now) {
+        return { allowed: false, reason: 'capability-envelope-expired' };
+    }
+    const checks = [
+        [matches(envelope.actions, action.type), 'action-outside-envelope'],
+        [matches(envelope.resources, action.resource), 'resource-outside-envelope'],
+        [matches(envelope.tools, action.tool), 'tool-outside-envelope'],
+        [matches(envelope.servers, action.server), 'server-outside-envelope'],
+        [matches(envelope.environments, action.environment), 'environment-outside-envelope'],
+    ];
+    if (action.namespace) {
+        const namespaces = action.type.includes('read')
+            ? envelope.readNamespaces
+            : envelope.writeNamespaces;
+        checks.push([matches(namespaces, action.namespace), 'namespace-outside-envelope']);
+    }
+    if (action.costUsd !== undefined && envelope.maxCostUsd !== undefined) {
+        checks.push([action.costUsd <= envelope.maxCostUsd, 'cost-outside-envelope']);
+    }
+    if (action.tokens !== undefined && envelope.maxTokens !== undefined) {
+        checks.push([action.tokens <= envelope.maxTokens, 'tokens-outside-envelope']);
+    }
+    if (action.concurrency !== undefined && envelope.maxConcurrency !== undefined) {
+        checks.push([action.concurrency <= envelope.maxConcurrency, 'concurrency-outside-envelope']);
+    }
+    if (action.network === true)
+        checks.push([envelope.network === true, 'network-outside-envelope']);
+    if (action.destructive === true)
+        checks.push([envelope.destructive === true, 'destructive-outside-envelope']);
+    const failed = checks.find(([allowed]) => !allowed);
+    return failed ? { allowed: false, reason: failed[1] } : { allowed: true };
+}
+export function isEnvelopeReduction(parent, child) {
+    const listChecks = [
+        subset(child.actions, parent.actions),
+        subset(child.resources, parent.resources),
+        subset(child.tools, parent.tools),
+        subset(child.servers, parent.servers),
+        subset(child.readNamespaces, parent.readNamespaces),
+        subset(child.writeNamespaces, parent.writeNamespaces),
+        subset(child.environments, parent.environments),
+    ];
+    const numericChecks = [
+        [child.maxCostUsd, parent.maxCostUsd],
+        [child.maxTokens, parent.maxTokens],
+        [child.maxConcurrency, parent.maxConcurrency],
+        [child.delegationDepth, parent.delegationDepth],
+        [child.expiresAt, parent.expiresAt],
+    ];
+    return listChecks.every(Boolean)
+        && numericChecks.every(([next, current]) => (current === undefined
+            ? true
+            : next !== undefined && next <= current))
+        && !(child.network === true && parent.network !== true)
+        && !(child.destructive === true && parent.destructive !== true);
+}
+export function delegateEnvelope(parent, child) {
+    if ((parent.delegationDepth ?? 0) <= 0) {
+        throw new Error('delegation-depth-exhausted');
+    }
+    const reduced = {
+        ...parent,
+        ...child,
+        delegationDepth: Math.min(child.delegationDepth ?? Number.MAX_SAFE_INTEGER, (parent.delegationDepth ?? 0) - 1),
+        expiresAt: Math.min(child.expiresAt ?? Number.MAX_SAFE_INTEGER, parent.expiresAt ?? Number.MAX_SAFE_INTEGER),
+    };
+    if (!isEnvelopeReduction(parent, reduced))
+        throw new Error('capability-envelope-cannot-grow');
+    return reduced;
+}
+//# sourceMappingURL=envelope.js.map

package/dist/policy/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/policy/envelope.ts"],"names":[],"mappings":"AAOA,SAAS,OAAO,CAAC,QAAuC,EAAE,KAAyB;IACjF,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAChC,OAAO,KAAK,GAAG;WACZ,OAAO,KAAK,KAAK;WACjB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACrE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAoC,EAAE,MAAqC;IACzF,IAAI,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAoB,EACpB,QAAwC,EACxC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAA6B;QACvC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,yBAAyB,CAAC;QACnE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;QAC3E,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,uBAAuB,CAAC;QAC/D,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAC;QACrE,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;KACrF,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC7C,CAAC,CAAC,QAAQ,CAAC,cAAc;YACzB,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,4BAA4B,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA0B,EAAE,KAAyB;IACvF,MAAM,UAAU,GAAG;QACjB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;KAChD,CAAC;IACF,MAAM,aAAa,GAAoD;QACrE,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;QACrC,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;QACnC,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC;QAC7C,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;QAC/C,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;KACpC,CAAC;IACF,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;WAC3B,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAC1C,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,OAAO,CAC1C,CAAC;WACC,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;WACpD,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,MAA0B,EAC1B,KAAyB;IAEzB,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,MAAM;QACT,GAAG,KAAK;QACR,eAAe,EAAE,IAAI,CAAC,GAAG,CACvB,KAAK,CAAC,eAAe,IAAI,MAAM,CAAC,gBAAgB,EAChD,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,CAClC;QACD,SAAS,EAAE,IAAI,CAAC,GAAG,CACjB,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,EAC1C,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAC5C;KACF,CAAC;IACF,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9F,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/policy/evaluator.d.ts

@@ -0,0 +1,4 @@
+import type { PolicyDecision, PolicyMode, PolicyRequest, PolicyRule } from './types.js';
+export declare function ruleMatches(rule: PolicyRule, request: PolicyRequest): boolean;
+export declare function evaluatePolicy(request: PolicyRequest, rules: readonly PolicyRule[], mode: PolicyMode, verifiedEvidenceIds?: readonly string[]): Omit<PolicyDecision, 'receiptId'>;
+//# sourceMappingURL=evaluator.d.ts.map

package/dist/policy/evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/policy/evaluator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,cAAc,EACd,UAAU,EACV,aAAa,EACb,UAAU,EACX,MAAM,YAAY,CAAC;AA0CpB,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAU7E;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,IAAI,EAAE,UAAU,EAChB,mBAAmB,GAAE,SAAS,MAAM,EAAO,GAC1C,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CA+DnC"}

package/dist/policy/evaluator.js

@@ -0,0 +1,119 @@
+import { checkCapabilityEnvelope } from './envelope.js';
+function matches(patterns, value) {
+    if (!patterns?.length)
+        return true;
+    if (!value)
+        return false;
+    return patterns.some((pattern) => (pattern === '*'
+        || pattern === value
+        || (pattern.endsWith('*') && value.startsWith(pattern.slice(0, -1)))));
+}
+function constraintsPass(request, constraints) {
+    if (!constraints)
+        return true;
+    const { action } = request;
+    const evidence = request.context?.evidence ?? [];
+    const verifiedIds = new Set(request.context?.metadata?.verifiedEvidenceIds instanceof Array
+        ? request.context.metadata.verifiedEvidenceIds
+        : []);
+    const verifiedEvidence = evidence.filter((item) => item.id && verifiedIds.has(item.id));
+    if (constraints.maxCostUsd !== undefined
+        && (action.costUsd === undefined || action.costUsd > constraints.maxCostUsd))
+        return false;
+    if (constraints.maxTokens !== undefined
+        && (action.tokens === undefined || action.tokens > constraints.maxTokens))
+        return false;
+    if (constraints.maxConcurrency !== undefined
+        && (action.concurrency === undefined || action.concurrency > constraints.maxConcurrency))
+        return false;
+    if (constraints.network === false && action.network === true)
+        return false;
+    if (constraints.destructive === false && action.destructive === true)
+        return false;
+    if (constraints.allowedNamespaces?.length && !matches(constraints.allowedNamespaces, action.namespace))
+        return false;
+    // Signature verification is performed by the engine's trusted verifier.
+    // A caller-authored `signed: true` flag is deliberately ignored.
+    if (constraints.requireSignedEvidence && verifiedEvidence.length === 0)
+        return false;
+    if (constraints.requiredProvenance?.length) {
+        const relevant = constraints.requireSignedEvidence ? verifiedEvidence : evidence;
+        const available = new Set(relevant.map((item) => item.provenance));
+        if (!constraints.requiredProvenance.every((type) => available.has(type)))
+            return false;
+    }
+    return true;
+}
+export function ruleMatches(rule, request) {
+    if (rule.enabled === false)
+        return false;
+    const { identity, action } = request;
+    return matches(rule.actions, action.type)
+        && matches(rule.resources, action.resource)
+        && matches(rule.principals, identity.id)
+        && (!rule.identityTypes?.length || rule.identityTypes.includes(identity.type))
+        && (!rule.roles?.length || rule.roles.some((role) => identity.roles?.includes(role)))
+        && matches(rule.environments, action.environment)
+        && constraintsPass(request, rule.constraints);
+}
+export function evaluatePolicy(request, rules, mode, verifiedEvidenceIds = []) {
+    const requestId = request.requestId ?? crypto.randomUUID();
+    const envelope = checkCapabilityEnvelope(request.action, request.context?.envelope, request.context?.now);
+    if (!envelope.allowed) {
+        return {
+            requestId,
+            outcome: 'denied',
+            // A capability envelope is delegated authority, not an observation-mode
+            // rule. Crossing it is always blocked, including legacy installations.
+            enforcedOutcome: 'denied',
+            mode,
+            reason: envelope.reason ?? 'capability-envelope-denied',
+            matchedRules: [],
+            obligations: [],
+        };
+    }
+    const verifiedRequest = {
+        ...request,
+        context: {
+            ...request.context,
+            metadata: {
+                ...request.context?.metadata,
+                verifiedEvidenceIds: [...verifiedEvidenceIds],
+            },
+        },
+    };
+    const matched = rules
+        .filter((rule) => ruleMatches(rule, verifiedRequest))
+        .sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0) || a.id.localeCompare(b.id));
+    const deny = matched.find((rule) => rule.effect === 'deny');
+    const approval = matched.find((rule) => rule.effect === 'require_approval');
+    const allow = matched.find((rule) => rule.effect === 'allow');
+    let outcome;
+    let reason;
+    if (deny) {
+        outcome = 'denied';
+        reason = `denied-by:${deny.id}`;
+    }
+    else if (approval) {
+        outcome = 'approval_required';
+        reason = `approval-required-by:${approval.id}`;
+    }
+    else if (allow) {
+        outcome = 'allowed';
+        reason = `allowed-by:${allow.id}`;
+    }
+    else {
+        outcome = mode === 'legacy' ? 'allowed' : 'denied';
+        reason = mode === 'legacy' ? 'legacy-default-allow' : 'default-deny';
+    }
+    return {
+        requestId,
+        outcome,
+        enforcedOutcome: mode === 'enforce' ? outcome : 'allowed',
+        mode,
+        reason,
+        matchedRules: matched.map((rule) => rule.id),
+        obligations: approval ? ['valid-human-approval'] : [],
+    };
+}
+//# sourceMappingURL=evaluator.js.map

package/dist/policy/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../src/policy/evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AASxD,SAAS,OAAO,CAAC,QAAuC,EAAE,KAAyB;IACjF,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAChC,OAAO,KAAK,GAAG;WACZ,OAAO,KAAK,KAAK;WACjB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACrE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,OAAsB,EAAE,WAA0C;IACzF,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,YAAY,KAAK;QAC7D,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;QAC9C,CAAC,CAAC,EAAE,CACP,CAAC;IACF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxF,IAAI,WAAW,CAAC,UAAU,KAAK,SAAS;WACnC,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS;WAClC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,WAAW,CAAC,cAAc,KAAK,SAAS;WACvC,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IACzG,IAAI,WAAW,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,WAAW,CAAC,WAAW,KAAK,KAAK,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,WAAW,CAAC,iBAAiB,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACrH,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,WAAW,CAAC,qBAAqB,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,IAAI,WAAW,CAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,OAAsB;IAClE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACrC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC;WACpC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC;WACxC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;WACrC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;WAC3E,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;WAClF,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC;WAC9C,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAAsB,EACtB,KAA4B,EAC5B,IAAgB,EAChB,sBAAyC,EAAE;IAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,uBAAuB,CACtC,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,OAAO,EAAE,QAAQ,EACzB,OAAO,CAAC,OAAO,EAAE,GAAG,CACrB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,SAAS;YACT,OAAO,EAAE,QAAQ;YACjB,wEAAwE;YACxE,uEAAuE;YACvE,eAAe,EAAE,QAAQ;YACzB,IAAI;YACJ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,4BAA4B;YACvD,YAAY,EAAE,EAAE;YAChB,WAAW,EAAE,EAAE;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAkB;QACrC,GAAG,OAAO;QACV,OAAO,EAAE;YACP,GAAG,OAAO,CAAC,OAAO;YAClB,QAAQ,EAAE;gBACR,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ;gBAC5B,mBAAmB,EAAE,CAAC,GAAG,mBAAmB,CAAC;aAC9C;SACF;KACF,CAAC;IACF,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;SACpD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAE9D,IAAI,OAAkC,CAAC;IACvC,IAAI,MAAc,CAAC;IACnB,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,GAAG,QAAQ,CAAC;QACnB,MAAM,GAAG,aAAa,IAAI,CAAC,EAAE,EAAE,CAAC;IAClC,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,OAAO,GAAG,mBAAmB,CAAC;QAC9B,MAAM,GAAG,wBAAwB,QAAQ,CAAC,EAAE,EAAE,CAAC;IACjD,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,OAAO,GAAG,SAAS,CAAC;QACpB,MAAM,GAAG,cAAc,KAAK,CAAC,EAAE,EAAE,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnD,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,cAAc,CAAC;IACvE,CAAC;IAED,OAAO;QACL,SAAS;QACT,OAAO;QACP,eAAe,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACzD,IAAI;QACJ,MAAM;QACN,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE;KACtD,CAAC;AACJ,CAAC"}

package/dist/policy/index.d.ts

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './canonical.js';
+export * from './envelope.js';
+export * from './evaluator.js';
+export * from './engine.js';
+export * from './product-plane.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC"}

package/dist/policy/index.js

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './canonical.js';
+export * from './envelope.js';
+export * from './evaluator.js';
+export * from './engine.js';
+export * from './product-plane.js';
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC"}

package/dist/policy/product-plane.d.ts

@@ -0,0 +1,238 @@
+/**
+ * Cognitum product-plane claim federation primitives.
+ *
+ * This module intentionally contains no grant-verification or domain mutation
+ * logic. It validates the portable, reference-only envelope that a local
+ * policy enforcement point can evaluate before consulting its authoritative
+ * identity, tenancy, and permission stores.
+ */
+import { type KeyLike } from 'node:crypto';
+export declare const PRODUCT_ACTION_ENVELOPE_VERSION: "cognitum.action.v1";
+export declare const PRODUCT_ACTIONS: readonly ["dashboard.read", "dashboard.status.read", "inference.invoke", "inference.stream", "usage.read", "pod.spawn", "benchmark.run", "evolution.propose", "evolution.promote", "comms.thread.read", "comms.thread.post", "comms.projection.read", "comms.board.admin", "cog.proposal.create", "cog.proposal.review", "cog.proposal.approve", "cog.instance.acquire", "cog.instance.operate", "cog.deploy", "cog.rollback", "ruview.space.read", "ruview.semantic.publish", "ruview.automation.propose", "ruview.automation.approve", "ruview.device.command", "cognition.route", "cognition.critique", "memory.recall", "memory.propose", "evidence.read", "memory.commit-validated"];
+export type ProductAction = (typeof PRODUCT_ACTIONS)[number];
+export declare const PRODUCT_AUTHORITIES: readonly ["cognitum.control-plane", "cognitum.cog", "meta-llm", "comms", "agentbbs", "ruview.edge", "ruflo.policy", "ruflo.memory"];
+export type ProductAuthority = (typeof PRODUCT_AUTHORITIES)[number];
+export declare const IDENTITY_NAMESPACES: readonly ["cognitum-principal", "firebase-subject", "meta-llm-account", "agentbbs-public-key", "workload", "ruflo-agent", "legacy-principal"];
+export type IdentityNamespace = (typeof IDENTITY_NAMESPACES)[number];
+export declare const TENANT_NAMESPACES: readonly ["cognitum-tenant", "meta-llm-account", "meta-llm-sub-tenant", "comms-tenant", "agentbbs-board", "ruview-space"];
+export type TenantNamespace = (typeof TENANT_NAMESPACES)[number];
+export type PrivacyClass = 'P0' | 'P1' | 'P2' | 'P3';
+export interface NamespacedIdentity {
+    namespace: IdentityNamespace;
+    id: string;
+}
+export interface NamespacedTenantRef {
+    namespace: TenantNamespace;
+    id: string;
+}
+export interface AuthoritativeReference {
+    authority: ProductAuthority;
+    tenantRef: NamespacedTenantRef;
+    /**
+     * Authority-qualified record kind, for example
+     * `meta-llm/inference` or `ruview.edge/semantic-observation`.
+     */
+    sourceType: string;
+    sourceId: string;
+    sourceVersion: string;
+    sourceDigest: `sha256:${string}`;
+}
+export interface ProductActionEnvelopeV1 {
+    schemaVersion: typeof PRODUCT_ACTION_ENVELOPE_VERSION;
+    eventId: string;
+    issuer: ProductAuthority;
+    audience: ProductAuthority;
+    subject: NamespacedIdentity;
+    actor?: NamespacedIdentity;
+    tenantRef: NamespacedTenantRef;
+    action: ProductAction;
+    resourceRefs: string[];
+    requestDigest?: `sha256:${string}`;
+    contentDigest?: `sha256:${string}`;
+    idempotencyKey?: string;
+    correlationId: string;
+    causationId?: string;
+    authoritativeSource: AuthoritativeReference;
+    sequence?: string;
+    policyReceiptId: string;
+    capabilityId?: string;
+    validationReceiptId?: string;
+    occurredAt: string;
+    expiresAt?: string;
+    privacyClass: PrivacyClass;
+}
+export type AvailabilityCheck = 'yes' | 'no' | 'unknown';
+export type IdentityAvailability = 'verified' | 'unverified' | 'invalid' | 'unknown';
+/**
+ * Independent integration-health dimensions. In particular, an authorized
+ * claim changes only `authorized`; it does not imply configuration,
+ * reachability, service health, or verified browser/workload identity.
+ */
+export interface ProductAvailabilityDimensions {
+    identity: IdentityAvailability;
+    configured: AvailabilityCheck;
+    reachable: AvailabilityCheck;
+    healthy: AvailabilityCheck;
+    authorized: AvailabilityCheck;
+}
+export type ProductAvailability = 'available' | 'degraded' | 'blocked' | 'unavailable';
+export declare function classifyProductAvailability(dimensions: ProductAvailabilityDimensions): ProductAvailability;
+export interface RuViewSemanticObservationV1 {
+    schemaVersion: 'ruview.semantic-observation.v1';
+    spaceRef: NamespacedTenantRef & {
+        namespace: 'ruview-space';
+    };
+    observationType: string;
+    /**
+     * Privacy-minimized semantic data only. Binary values, arrays, and raw
+     * sensing field names are rejected by the wire validator.
+     */
+    value: Record<string, string | number | boolean | null>;
+    confidence: number;
+    uncertainty?: number;
+    abstained: boolean;
+    modelDigest: `sha256:${string}`;
+    calibrationDigest?: `sha256:${string}`;
+    hardwareRef?: string;
+    privacyClass: 'P2' | 'P3';
+    observedAt: string;
+    expiresAt: string;
+    /** Canonical unsigned decimal string; JSON cannot safely carry bigint. */
+    sequence: string;
+}
+export interface ValidationIssue {
+    path: string;
+    code: 'invalid_type' | 'missing' | 'unknown_field' | 'unsupported_value' | 'invalid_format' | 'invalid_authority' | 'identity_namespace_required' | 'tenant_mismatch' | 'privacy_ceiling_exceeded';
+    message: string;
+}
+export type ValidationResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    issues: ValidationIssue[];
+};
+export interface ProductActionRequirements {
+    requestDigest: boolean;
+    contentDigest: boolean;
+    idempotencyKey: boolean;
+    expiry: boolean;
+    capability: boolean;
+    validationReceipt: boolean;
+}
+/**
+ * Actions must be anchored in the product that owns their authoritative
+ * outcome. Read-model actions permit the explicitly listed source domains.
+ */
+export declare const ACTION_AUTHORITIES: Readonly<Record<ProductAction, readonly ProductAuthority[]>>;
+/**
+ * Explicit obligations avoid inference from action spelling. New actions do
+ * not become privileged merely because a caller supplies a valid signature.
+ */
+export declare const PRODUCT_ACTION_REQUIREMENTS: Readonly<Record<ProductAction, ProductActionRequirements>>;
+export declare function identityKey(identity: NamespacedIdentity): string;
+export declare function sameIdentity(left: NamespacedIdentity, right: NamespacedIdentity): boolean;
+export declare function tenantRefKey(tenant: NamespacedTenantRef): string;
+export declare function isProductAction(value: unknown): value is ProductAction;
+export declare function validateAuthoritativeReference(input: unknown, options?: {
+    action?: ProductAction;
+    tenantRef?: NamespacedTenantRef;
+}): ValidationResult<AuthoritativeReference>;
+export declare function validateProductActionEnvelope(input: unknown): ValidationResult<ProductActionEnvelopeV1>;
+export type RuViewSemanticFieldKind = 'boolean' | 'number' | 'string' | 'nullable-string';
+export interface RuViewSemanticFieldSchema {
+    kind: RuViewSemanticFieldKind;
+    required?: boolean;
+    min?: number;
+    max?: number;
+    maxLength?: number;
+    enum?: readonly string[];
+}
+export interface RuViewObservationSchema {
+    privacyClasses: readonly ('P2' | 'P3')[];
+    fields: Readonly<Record<string, RuViewSemanticFieldSchema>>;
+}
+export type RuViewObservationRegistry = Readonly<Record<string, RuViewObservationSchema>>;
+/**
+ * The default edge-export surface is deliberately small and semantic. A new
+ * observation type or field requires explicit schema registration; arbitrary
+ * keys are never accepted based on a deny-list alone.
+ */
+export declare const DEFAULT_RUVIEW_OBSERVATION_REGISTRY: RuViewObservationRegistry;
+export declare function validateRuViewSemanticObservation(input: unknown, registry?: RuViewObservationRegistry): ValidationResult<RuViewSemanticObservationV1>;
+/**
+ * RFC 8785/JCS-compatible canonical JSON for this I-JSON profile.
+ *
+ * ECMAScript's JSON number serialization supplies the JCS number rendering.
+ * Non-finite numbers, sparse arrays, undefined values, non-plain objects, and
+ * invalid Unicode are rejected instead of being silently coerced.
+ */
+export declare function canonicalizeProductPlane(value: unknown): string;
+export declare function canonicalProductPlaneBytes(value: unknown): Uint8Array;
+export declare function canonicalProductPlaneDigest(value: unknown): `sha256:${string}`;
+export interface SignedProductActionEnvelopeV1 {
+    envelope: ProductActionEnvelopeV1;
+    algorithm: 'Ed25519';
+    keyId: string;
+    signature: string;
+}
+export type SignatureVerifier = (input: {
+    issuer: ProductAuthority;
+    keyId: string;
+    algorithm: 'Ed25519';
+    canonicalBytes: Uint8Array;
+    signature: Uint8Array;
+}) => boolean | Promise<boolean>;
+export type AuthorityKeyResolver = (issuer: ProductAuthority, keyId: string) => KeyLike | null | undefined | Promise<KeyLike | null | undefined>;
+export interface ReplayReservationInput {
+    key: string;
+    bindingDigest: `sha256:${string}`;
+    expiresAt: number;
+}
+export type ReplayReservation = 'reserved' | 'replay' | 'conflict';
+/**
+ * The implementation must reserve atomically. A lookup-then-insert adapter is
+ * not a conforming replay store under concurrent delivery.
+ */
+export interface ProductEnvelopeReplayStore {
+    reserve(input: ReplayReservationInput): ReplayReservation | Promise<ReplayReservation>;
+}
+export type LocalAuthorizationDecision = boolean | {
+    allowed: boolean;
+    reason?: string;
+};
+export interface ProductEnvelopeVerifierOptions {
+    expectedAudience: ProductAuthority;
+    expectedTenantRef: NamespacedTenantRef;
+    now?: () => number;
+    maxAgeMs?: number;
+    maxFutureSkewMs?: number;
+    resolveKey?: AuthorityKeyResolver;
+    verifySignature?: SignatureVerifier;
+    replayStore: ProductEnvelopeReplayStore;
+    policyVerifier: (envelope: ProductActionEnvelopeV1) => LocalAuthorizationDecision | Promise<LocalAuthorizationDecision>;
+    capabilityVerifier: (envelope: ProductActionEnvelopeV1) => LocalAuthorizationDecision | Promise<LocalAuthorizationDecision>;
+}
+export type ProductEnvelopeVerificationCode = 'malformed_signed_envelope' | 'invalid_envelope' | 'audience_mismatch' | 'tenant_mismatch' | 'not_yet_valid' | 'stale' | 'expired' | 'signature_configuration_missing' | 'key_not_found' | 'signature_invalid' | 'policy_denied' | 'capability_denied' | 'replay_detected' | 'idempotency_conflict' | 'verification_error';
+export type ProductEnvelopeVerificationResult = {
+    ok: true;
+    envelope: ProductActionEnvelopeV1;
+    canonicalDigest: `sha256:${string}`;
+    replayKey: string;
+} | {
+    ok: false;
+    code: ProductEnvelopeVerificationCode;
+    reason: string;
+    issues?: ValidationIssue[];
+};
+/**
+ * Verify a signed product action as an ingress policy-enforcement decision.
+ *
+ * Signature validity is necessary but insufficient: audience, tenant,
+ * freshness, replay state, local policy, and the action-bound capability are
+ * checked independently. Service availability is intentionally absent; a
+ * valid claim never implies that its target is configured, reachable, or
+ * healthy.
+ */
+export declare function verifySignedProductActionEnvelope(input: unknown, options: ProductEnvelopeVerifierOptions): Promise<ProductEnvelopeVerificationResult>;
+//# sourceMappingURL=product-plane.d.ts.map

package/dist/policy/product-plane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"product-plane.d.ts","sourceRoot":"","sources":["../../src/policy/product-plane.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAA+C,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAExF,eAAO,MAAM,+BAA+B,EAAG,oBAA6B,CAAC;AAE7E,eAAO,MAAM,eAAe,2pBAgClB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,eAAO,MAAM,mBAAmB,qIAStB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB,+IAQtB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,eAAO,MAAM,iBAAiB,2HAOpB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AACjE,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,iBAAiB,CAAC;IAC7B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,eAAe,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,SAAS,EAAE,mBAAmB,CAAC;IAC/B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,UAAU,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,OAAO,+BAA+B,CAAC;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;IACnC,aAAa,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,IAAI,GAAG,SAAS,CAAC;AACzD,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;AAErF;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAED,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAEvF,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,6BAA6B,GACxC,mBAAmB,CAerB;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,gCAAgC,CAAC;IAChD,QAAQ,EAAE,mBAAmB,GAAG;QAAE,SAAS,EAAE,cAAc,CAAA;KAAE,CAAC;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,UAAU,MAAM,EAAE,CAAC;IAChC,iBAAiB,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EACA,cAAc,GACd,SAAS,GACT,eAAe,GACf,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,GACnB,6BAA6B,GAC7B,iBAAiB,GACjB,0BAA0B,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC;AAE7C,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAoED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,gBAAgB,EAAE,CAAC,CA8C3F,CAAC;AA6BF;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAuClG,CAAC;AAkIF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAEhE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAEzF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAEhE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAEtE;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAAO,GACxE,gBAAgB,CAAC,sBAAsB,CAAC,CAqE1C;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAAC,uBAAuB,CAAC,CA0LvG;AAED,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAE1F,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;IACzC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;CAC7D;AAED,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAE1F;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAAE,yBAmChD,CAAC;AAiFH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,yBAA+D,GACxE,gBAAgB,CAAC,2BAA2B,CAAC,CA0G/C;AAiBD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAiC/D;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAErE;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,MAAM,EAAE,CAE9E;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,uBAAuB,CAAC;IAClC,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,EAAE,UAAU,CAAC;IAC3B,SAAS,EAAE,UAAU,CAAC;CACvB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjC,MAAM,MAAM,oBAAoB,GAAG,CACjC,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,MAAM,KACV,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEtE,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,UAAU,MAAM,EAAE,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACxF;AAED,MAAM,MAAM,0BAA0B,GAClC,OAAO,GACP;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,MAAM,WAAW,8BAA8B;IAC7C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,eAAe,CAAC,EAAE,iBAAiB,CAAC;IACpC,WAAW,EAAE,0BAA0B,CAAC;IACxC,cAAc,EAAE,CACd,QAAQ,EAAE,uBAAuB,KAC9B,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACtE,kBAAkB,EAAE,CAClB,QAAQ,EAAE,uBAAuB,KAC9B,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACvE;AAED,MAAM,MAAM,+BAA+B,GACvC,2BAA2B,GAC3B,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,eAAe,GACf,OAAO,GACP,SAAS,GACT,iCAAiC,GACjC,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,mBAAmB,GACnB,iBAAiB,GACjB,sBAAsB,GACtB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,iCAAiC,GACzC;IACA,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,uBAAuB,CAAC;IAClC,eAAe,EAAE,UAAU,MAAM,EAAE,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB,GACC;IACA,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,+BAA+B,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;CAC5B,CAAC;AAuCJ;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CACrD,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,iCAAiC,CAAC,CA+G5C"}