@coderifts/agent-guard 1.0.0

package/README.md

@@ -0,0 +1,46 @@
+# @coderifts/agent-guard
+
+Fail-closed guard for AI agent tool calls — preflight contract changes before they execute.
+
+Security core **FROZEN** (agent-guard-api v1.0). Built on [`@coderifts/sdk`](https://www.npmjs.com/package/@coderifts/sdk) `^1.1.1`.
+
+```bash
+npm install @coderifts/agent-guard @coderifts/sdk
+```
+
+```typescript
+import { guardToolCall } from '@coderifts/agent-guard';
+import { CodeRifts } from '@coderifts/sdk';
+
+const client = new CodeRifts({ apiKey: 'cr_live_...' });
+
+const outcome = await guardToolCall(
+  { toolName: 'Edit', arguments: { path: 'openapi.yaml' }, filesTouched: ['openapi.yaml'], diff: '...' },
+  // The mutating work is created ONLY here, after the verdict — never eagerly (closes TOCTOU).
+  async (envelope, redactedCall) => applyEdit(redactedCall),
+  { client },
+);
+
+if (!outcome.executed) console.error('blocked:', outcome.verdict);
+// Retry ONLY when outcome.executionAttempted === false (the safe-to-retry signal).
+```
+
+## Guarantees (tsc-verified)
+
+- **Fail-closed by default** — any ambiguity, integrity failure, or unknown state resolves to `STOP`.
+- **No TOCTOU** — the factory creates the mutating work *after* the verdict.
+- **Retry-safe** — `executionAttempted` is the only safe-to-retry signal; a post-authorization throw
+  is `executionAttempted:true` (the remote side effect may have landed).
+- **`enforced:true` only on a LIVE, receipt-verified `ALLOW`/`MONITOR`** — never on cached/LKG,
+  SKIPPED, observeOnly, or fail-open paths (unrepresentable at compile time).
+- **Integrity failures never fail open** — a bad signature, schema-invalid response, detector/config
+  error, or request-attributable rejection (413/422) always resolves closed + trips the breaker.
+
+## Trigger detection
+
+`builtinDetector` (fail-safe, versioned) decides whether a tool call touches a contract artifact
+(OpenAPI/GraphQL/gRPC/AsyncAPI/MCP manifest/migrations/CI gates). Precedence: explicit artifacts >
+filesTouched patterns > diff/content markers > toolName > intent (add-only). Ambiguity triggers
+(`confident=false ⇒ trigger=true`). It passes all 68 vectors of the Grok trigger corpus.
+
+See `agent-guard-api.FROZEN-v1.0.md` for the full frozen contract.

package/dist/cjs/detector.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @coderifts/agent-guard — builtinDetector (the trust core).
+ *
+ * Fail-safe + versioned. Precedence (frozen spec): explicit artifacts > filesTouched patterns >
+ * diff/content markers > toolName > intent (add-only). A contract surface whose change cannot be
+ * proven inert triggers (confident=false => trigger=true). The Grok corpus of 68 vectors is the
+ * mandatory fixture set; this detector passes all 68 (46 trigger, 22 no-trigger).
+ */
+import type { TriggerDetector } from './types.js';
+export declare const DETECTOR_VERSION = "builtin/1.0.0";
+export declare const builtinDetector: TriggerDetector;
+//# sourceMappingURL=detector.d.ts.map

package/dist/cjs/detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/detector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AA8OhD,eAAO,MAAM,eAAe,EAAE,eA4C7B,CAAC"}

package/dist/cjs/detector.js

@@ -0,0 +1,352 @@
+"use strict";
+/**
+ * @coderifts/agent-guard — builtinDetector (the trust core).
+ *
+ * Fail-safe + versioned. Precedence (frozen spec): explicit artifacts > filesTouched patterns >
+ * diff/content markers > toolName > intent (add-only). A contract surface whose change cannot be
+ * proven inert triggers (confident=false => trigger=true). The Grok corpus of 68 vectors is the
+ * mandatory fixture set; this detector passes all 68 (46 trigger, 22 no-trigger).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.builtinDetector = exports.DETECTOR_VERSION = void 0;
+exports.DETECTOR_VERSION = 'builtin/1.0.0';
+// ── Path classification ────────────────────────────────────────────────────────
+const CONTRACT_PATH_RE = [
+    /openapi/i, /swagger/i, /asyncapi/i,
+    /\.graphql$/i, /\.gql$/i, /\.proto$/i, /\.pb($|\.)/i,
+    /(^|\/)[\w.-]*mcp[\w.-]*\.json$/i, /tools-catalog\.json$/i,
+    /schema\.prisma$/i, /(^|\/)migrations?\//i, /(^|\/)alembic\//i,
+    /(^|\/)buf\.ya?ml$/i, /\.spectral\.ya?ml$/i,
+    /(^|\/)\.github\/workflows\//i, /(^|\/)\.husky\//i,
+    /api[-_]?contract/i, /service-definition/i, /(^|\/)contracts?\//i,
+    /schemas?\/components?\//i, /\bcontract\.json$/i,
+    /(^|\/)spec\.(ya?ml|json)$/i, /api[-_/]spec\.(ya?ml|json)$/i, /-api\.(ya?ml|yml)$/i, /current-api/i,
+    /(^|\/)(src\/)?generated\//i, /(^|\/)gen\//i, /\.pb\.go$/i, /openapi\.d\.ts$/i,
+];
+// Paths whose content is NOT a production SSOT — contract-looking content there does not trigger.
+const NON_SSOT_PATH_RE = [
+    /(^|\/)tests?\//i, /(^|\/)__tests__\//i, /\/fixtures?\//i,
+    /\.test\.[jt]sx?$/i, /\.spec\.[jt]sx?$/i,
+    /(^|\/)src\/internal\//i,
+    /(^|\/)node_modules\//i,
+];
+// Prose files: never a contract regardless of content markers inside them.
+const PROSE_PATH_RE = [/(^|\/)README(\.\w+)?$/i, /(^|\/)CHANGELOG(\.\w+)?$/i, /(^|\/)LICENSE(\.\w+)?$/i, /\.md$/i];
+// Code files that ARE a wire/contract surface when they carry route/dto/rpc markers.
+const CODE_CONTRACT_PATH_RE = [/(^|\/)src\/routes?\//i, /(^|\/)routes?\//i, /(^|\/)app\/api\//i, /(^|\/)src\/dto\//i, /dto/i, /routers?\//i, /\.prisma$/i, /\.tf$/i, /server\/routers?\//i];
+const GATE_PATH_RE = [/(^|\/)\.github\/workflows\//i, /(^|\/)\.husky\//i, /\.spectral\.ya?ml$/i, /(^|\/)buf\.ya?ml$/i];
+const LOCKFILE_RE = /(package-lock\.json|pnpm-lock\.ya?ml|yarn\.lock|composer\.lock|Cargo\.lock)$/i;
+// ── Content markers ────────────────────────────────────────────────────────────
+const CONTRACT_CONTENT_RE = [
+    /\bopenapi\s*[:=]\s*["']?3/i, /["']openapi["']\s*:/i, /\bswagger\s*[:=]/i, /["']swagger["']\s*:/i,
+    /\basyncapi\s*[:=]/i, /["']asyncapi["']\s*:/i,
+    /(^|\n)\s*paths\s*:/i, /["']paths["']\s*:/i,
+    /syntax\s*=\s*["']proto3/i, /(^|\n)\s*message\s+\w+\s*\{/i,
+    /\btype\s+(Query|Mutation|Subscription)\b/i,
+    /["']tools["']\s*:\s*\[/i, /["']inputSchema["']\s*:/i,
+    /\/v\d+\/[\w{}.-]*\s*:/, // versioned route-path key
+    /\bchannels\s*:/i,
+];
+const CONTRACT_STRUCTURE_RE = [
+    /(get|post|put|delete|patch)\s*:\s*\{?/i,
+    /message\s+\w+\s*\{[^}]*=\s*\d+/i,
+    /\/v\d+\/[\w{}.-]*\s*:/,
+    /"name"\s*:\s*"[^"]+"[\s,}]*"?inputSchema/i,
+];
+// Real (breaking-capable) change markers on a single changed line.
+const REAL_CHANGE_RE = [
+    /required\s*:\s*\[/i, /["']required["']\s*:\s*\[/i,
+    /\btype\s*:\s*\w+/i, /nullable\s*:/i, /:\s*\w+!/,
+    /additionalProperties\s*:\s*(true|false)/i, /["']additionalProperties["']/i,
+    /\bDROP\s+COLUMN\b/i, /\bALTER\s+COLUMN\b/i, /alter_column\s*\(/i, /new_column_name/i, /\bRENAME\b/i, /DROP\s+TABLE/i,
+    /@IsString|@IsOptional|response_model|z\.string|@unique/i,
+    /app\.(get|post|put|delete|patch)\s*\(/i, /@router\.(get|post|put|delete|patch)/i,
+    /\/v\d+\//,
+    /continue-on-error|if:\s*false|:\s*off\b|'off'|"off"/i, /\bignore\s*:/i, /(^|\n)\s*breaking\s*:/i,
+];
+// Inert keys (a change touching ONLY these is a contract no-op).
+const INERT_KEY_RE = [
+    /^description\s*:/i, /^["']description["']\s*:/i,
+    /^summary\s*:/i, /^title\s*:/i, /^contact\s*:/i, /^name\s*:/i,
+    /^examples?\s*:/i, /^["']examples?["']\s*:/i,
+    /^x-[\w-]+\s*:/i, /^["']x-[\w-]+["']\s*:/i,
+];
+const READ_ONLY_TOOLS = new Set(['read', 'grep', 'glob', 'ls', 'cat', 'view', 'search', 'list']);
+const FORMATTER_RE = /\b(prettier|eslint\s+--fix|gofmt|rustfmt|black|clang-format|dprint)\b/i;
+const GATE_KEYWORD_RE = /coderifts|agent-guard|contract-check|contract\b|preflight|spectral|\bbuf\b/i;
+function anyMatch(res, s) { return res.some((r) => r.test(s)); }
+function argString(args) {
+    if (args == null)
+        return '';
+    if (typeof args === 'string')
+        return args;
+    try {
+        return JSON.stringify(args);
+    }
+    catch {
+        return '';
+    }
+}
+function changeText(call) {
+    const parts = [];
+    if (call.diff)
+        parts.push(call.diff);
+    const a = call.arguments;
+    if (a && typeof a === 'object') {
+        for (const k of ['new_string', 'old_string', 'contents', 'content', 'patch', 'command']) {
+            const v = a[k];
+            if (typeof v === 'string')
+                parts.push(v);
+        }
+        const edits = a.edits;
+        if (Array.isArray(edits))
+            for (const e of edits)
+                parts.push(argString(e));
+    }
+    return parts.join('\n');
+}
+function commandText(call) {
+    const a = call.arguments;
+    const c = a && typeof a === 'object' ? a.command : undefined;
+    return typeof c === 'string' ? c : '';
+}
+function allPaths(call) {
+    const out = [...(call.filesTouched || [])];
+    const a = call.arguments;
+    if (a && typeof a === 'object' && typeof a.path === 'string')
+        out.push(a.path);
+    return out;
+}
+function isContractPath(p) {
+    if (anyMatch(NON_SSOT_PATH_RE, p))
+        return false;
+    if (anyMatch(PROSE_PATH_RE, p))
+        return false;
+    return anyMatch(CONTRACT_PATH_RE, p);
+}
+/** The lines a change ACTUALLY adds/removes: diff +/- when a diff is present, else set-difference of
+ * old_string vs new_string (context lines shared by both are NOT changes). */
+function changedLines(call) {
+    if (call.diff) {
+        return call.diff.split('\n').filter((l) => l.startsWith('+') || l.startsWith('-')).map((l) => l.slice(1));
+    }
+    const out = [];
+    const a = call.arguments;
+    const pushSetDiff = (oldS, newS) => {
+        const oldL = typeof oldS === 'string' ? oldS.split('\n') : [];
+        const newL = typeof newS === 'string' ? newS.split('\n') : [];
+        const oldSet = new Set(oldL.map((l) => l.trim()));
+        const newSet = new Set(newL.map((l) => l.trim()));
+        for (const l of newL)
+            if (!oldSet.has(l.trim()))
+                out.push(l);
+        for (const l of oldL)
+            if (!newSet.has(l.trim()))
+                out.push(l);
+    };
+    if (a && typeof a === 'object') {
+        pushSetDiff(a.old_string, a.new_string);
+        const contents = a.contents ?? a.content;
+        if (typeof contents === 'string')
+            for (const l of contents.split('\n'))
+                out.push(l); // new file: all lines are "added"
+        const patch = a.patch;
+        if (typeof patch === 'string')
+            for (const l of patch.split('\n'))
+                if (l.startsWith('+') || l.startsWith('-'))
+                    out.push(l.slice(1));
+        const edits = a.edits;
+        if (Array.isArray(edits))
+            for (const e of edits)
+                if (e && typeof e === 'object')
+                    pushSetDiff(e.old_string, e.new_string);
+    }
+    return out;
+}
+function migrationDestructive(text) {
+    return /\bDROP\s+COLUMN\b|\bALTER\s+COLUMN\b|new_column_name|alter_column|\bRENAME\b|DROP\s+TABLE|DROP\s+CONSTRAINT/i.test(text);
+}
+function migrationIndexOnly(text) {
+    return /CREATE\s+INDEX/i.test(text) && !migrationDestructive(text) && !/ADD\s+COLUMN|DROP\b/i.test(text);
+}
+/** Gate/policy file whose change disables or weakens a contract gate. */
+function gateDisabled(call) {
+    const paths = allPaths(call);
+    if (!paths.some((p) => anyMatch(GATE_PATH_RE, p)))
+        return false;
+    const text = changeText(call);
+    if (!GATE_KEYWORD_RE.test(text))
+        return false;
+    const lines = changedLines(call);
+    // an added comment-out of a gate line, OR an explicit weakening keyword
+    const commentedOut = lines.some((l) => /^\s*(#|\/\/)/.test(l) && GATE_KEYWORD_RE.test(l));
+    const weakened = anyMatch(REAL_CHANGE_RE, text) || /continue-on-error|if:\s*false|:\s*off\b|ignore\s*:/i.test(text);
+    return commentedOut || weakened;
+}
+/** Lockfile whose change redirects/major-bumps a CONTRACT package. */
+function lockfileContractChange(call) {
+    const paths = allPaths(call);
+    if (!paths.some((p) => LOCKFILE_RE.test(p)))
+        return false;
+    const text = changeText(call);
+    const contractPkg = /@[\w.-]+\/(openapi|graphql|proto|asyncapi|schema)\b|(openapi|graphql|proto|asyncapi|schema)@\d/i.test(text);
+    if (!contractPkg)
+        return false;
+    return /"resolved"\s*:/i.test(text) || /@\d+\.\d+\.\d+/.test(text) || /@\d+['":]/.test(text);
+}
+function isInertOnly(call) {
+    const text = changeText(call);
+    const paths = allPaths(call);
+    // lockfile integrity-only (no resolved redirect / contract-package change)
+    if (paths.some((p) => LOCKFILE_RE.test(p)) && !lockfileContractChange(call)) {
+        if (/"integrity"\s*:/i.test(text) && !/"resolved"\s*:/i.test(text))
+            return true;
+    }
+    // migration index-only
+    if (paths.some((p) => /migrations?\/|alembic\//i.test(p)) && migrationIndexOnly(text))
+        return true;
+    // gate files: unrelated change (no gate keyword) is inert; a gate change is NOT inert (realChangePresent decides).
+    if (paths.some((p) => anyMatch(GATE_PATH_RE, p))) {
+        if (!GATE_KEYWORD_RE.test(text) && !anyMatch(REAL_CHANGE_RE, text))
+            return true;
+        return false;
+    }
+    // formatter command on a contract file (semantic no-op)
+    const cmd = commandText(call);
+    if (cmd && FORMATTER_RE.test(cmd))
+        return true;
+    // example/value payload change only (not a schema change)
+    if (/\b(examples?|value)\s*:/i.test(text) && !anyMatch(REAL_CHANGE_RE, text))
+        return true;
+    const lines = changedLines(call);
+    if (lines.length === 0)
+        return false;
+    let sawReal = false;
+    let sawInert = false;
+    for (const raw of lines) {
+        const t = raw.trim();
+        if (t === '') {
+            sawInert = true;
+            continue;
+        }
+        if (/^#|^\/\/|^\/\*|\*\/|^\*/.test(t)) {
+            sawInert = true;
+            continue;
+        } // comment
+        if (/^```/.test(t)) {
+            sawInert = true;
+            continue;
+        } // md fence
+        if (/^["'].*["']$/.test(t) && !t.includes(':')) {
+            sawInert = true;
+            continue;
+        } // bare quoted string (e.g. graphql description), not "key":"val"
+        if (/generated|timestamp/i.test(t)) {
+            sawInert = true;
+            continue;
+        }
+        if (anyMatch(INERT_KEY_RE, t)) {
+            sawInert = true;
+            continue;
+        } // description/summary/x-*/name/...
+        if (anyMatch(REAL_CHANGE_RE, t) || anyMatch(CONTRACT_STRUCTURE_RE, t) || anyMatch(CONTRACT_CONTENT_RE, t)) {
+            sawReal = true;
+            continue;
+        }
+        if (/^[\w"']+\??\s*:\s*\S/.test(t)) {
+            sawReal = true;
+            continue;
+        } // a field/property declaration (add/remove)
+        // neutral line: ignore
+    }
+    return sawInert && !sawReal;
+}
+function realChangePresent(call) {
+    const text = changeText(call);
+    if (migrationDestructive(text))
+        return true;
+    if (gateDisabled(call))
+        return true;
+    if (lockfileContractChange(call))
+        return true;
+    for (const raw of changedLines(call)) {
+        const t = raw.trim();
+        if (anyMatch(INERT_KEY_RE, t))
+            continue;
+        if (anyMatch(REAL_CHANGE_RE, t))
+            return true;
+        if (/^[\w"']+\??\s*:\s*\S/.test(t) && !/^(paths|components|info|servers|channels|tools|get|post|put|delete|patch)\s*:/i.test(t))
+            return true; // field decl add/remove
+    }
+    return false;
+}
+function intentMentionsContract(intent) {
+    if (!intent)
+        return false;
+    return /openapi|swagger|graphql|protobuf|\bproto\b|asyncapi|mcp\s*manifest|mcp\.json|json\s*schema|\bschema\b|required\s+field|\bendpoint\b|wire\s*format|api\s*spec|contract\s*(file|change|surface)/i.test(intent);
+}
+function commandMutatesContract(call) {
+    const cmd = commandText(call);
+    if (!cmd)
+        return false;
+    if (FORMATTER_RE.test(cmd))
+        return false;
+    const touchesContract = allPaths(call).some(isContractPath)
+        || /(>|>>|-o\s|mv\s|ln\s+-sf?\s|git\s+mv\s|cp\s)[^\n|]*(openapi|swagger|asyncapi|\.graphql|\.gql|\.proto|\.pb\b|mcp[.-]?\w*\.json|schema\.prisma|spec\.(ya?ml|json))/i.test(cmd)
+        || anyMatch(CONTRACT_CONTENT_RE, cmd);
+    const mutates = /(>|>>|\bmv\b|\bcp\b|\bln\s|git\s+mv|curl|wget|-o\b|base64\s+-d|xxd|\bjq\b|\bsed\b|\btee\b|echo|printf|\bcat\b)/i.test(cmd);
+    return touchesContract && mutates;
+}
+exports.builtinDetector = {
+    version: exports.DETECTOR_VERSION,
+    detect(call) {
+        const signals = [];
+        const artifacts = Array.isArray(call.artifacts) ? call.artifacts : [];
+        if (artifacts.length > 0)
+            return { trigger: true, artifacts, signals: ['explicit_artifacts'], confident: true };
+        if (READ_ONLY_TOOLS.has(String(call.toolName).toLowerCase()) && !commandMutatesContract(call)) {
+            return { trigger: false, artifacts: [], signals: ['non_mutating_tool'], confident: true };
+        }
+        const paths = allPaths(call);
+        const contractPath = paths.some(isContractPath);
+        const codeContractPath = paths.some((p) => anyMatch(CODE_CONTRACT_PATH_RE, p) && !anyMatch(NON_SSOT_PATH_RE, p));
+        const change = changeText(call);
+        const inProse = paths.length > 0 && paths.every((p) => anyMatch(PROSE_PATH_RE, p));
+        const contentMarker = anyMatch(CONTRACT_CONTENT_RE, change) && !paths.some((p) => anyMatch(NON_SSOT_PATH_RE, p)) && !inProse;
+        const shellMutation = commandMutatesContract(call);
+        const gate = gateDisabled(call);
+        const lockContract = lockfileContractChange(call);
+        const contractSurface = contractPath || contentMarker || shellMutation || codeContractPath || gate || lockContract;
+        if (contractSurface) {
+            if (shellMutation) {
+                signals.push('shell_mutates_contract');
+                return { trigger: true, artifacts, signals, confident: true };
+            }
+            if (gate) {
+                signals.push('contract_gate_disabled');
+                return { trigger: true, artifacts, signals, confident: true };
+            }
+            if (lockContract) {
+                signals.push('lockfile_contract_redirect');
+                return { trigger: true, artifacts, signals, confident: true };
+            }
+            if (isInertOnly(call)) {
+                signals.push('inert_change_only');
+                return { trigger: false, artifacts: [], signals, confident: true };
+            }
+            if (realChangePresent(call) || contentMarker || anyMatch(CONTRACT_STRUCTURE_RE, change)) {
+                signals.push('contract_change');
+                return { trigger: true, artifacts, signals, confident: true };
+            }
+            signals.push('ambiguous_contract_surface');
+            return { trigger: true, artifacts, signals, confident: false };
+        }
+        if (intentMentionsContract(call.intent)) {
+            signals.push('intent_contract_reference');
+            return { trigger: true, artifacts, signals, confident: false };
+        }
+        signals.push('no_contract_signal');
+        return { trigger: false, artifacts: [], signals, confident: true };
+    },
+};
+//# sourceMappingURL=detector.js.map

package/dist/cjs/detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/detector.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAIU,QAAA,gBAAgB,GAAG,eAAe,CAAC;AAEhD,kFAAkF;AAClF,MAAM,gBAAgB,GAAG;IACvB,UAAU,EAAE,UAAU,EAAE,WAAW;IACnC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa;IACpD,iCAAiC,EAAE,uBAAuB;IAC1D,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB;IAC9D,oBAAoB,EAAE,qBAAqB;IAC3C,8BAA8B,EAAE,kBAAkB;IAClD,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB;IACjE,0BAA0B,EAAE,oBAAoB;IAChD,4BAA4B,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,cAAc;IACnG,4BAA4B,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB;CAC/E,CAAC;AACF,kGAAkG;AAClG,MAAM,gBAAgB,GAAG;IACvB,iBAAiB,EAAE,oBAAoB,EAAE,gBAAgB;IACzD,mBAAmB,EAAE,mBAAmB;IACxC,wBAAwB;IACxB,uBAAuB;CACxB,CAAC;AACF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,CAAC,wBAAwB,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,QAAQ,CAAC,CAAC;AACnH,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,CAAC,uBAAuB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AAC5L,MAAM,YAAY,GAAG,CAAC,8BAA8B,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;AACvH,MAAM,WAAW,GAAG,+EAA+E,CAAC;AAEpG,kFAAkF;AAClF,MAAM,mBAAmB,GAAG;IAC1B,4BAA4B,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,sBAAsB;IACjG,oBAAoB,EAAE,uBAAuB;IAC7C,qBAAqB,EAAE,oBAAoB;IAC3C,0BAA0B,EAAE,8BAA8B;IAC1D,2CAA2C;IAC3C,yBAAyB,EAAE,0BAA0B;IACrD,uBAAuB,EAAoC,2BAA2B;IACtF,iBAAiB;CAClB,CAAC;AACF,MAAM,qBAAqB,GAAG;IAC5B,wCAAwC;IACxC,iCAAiC;IACjC,uBAAuB;IACvB,2CAA2C;CAC5C,CAAC;AACF,mEAAmE;AACnE,MAAM,cAAc,GAAG;IACrB,oBAAoB,EAAE,4BAA4B;IAClD,mBAAmB,EAAE,eAAe,EAAE,UAAU;IAChD,0CAA0C,EAAE,+BAA+B;IAC3E,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,aAAa,EAAE,eAAe;IACrH,yDAAyD;IACzD,wCAAwC,EAAE,uCAAuC;IACjF,UAAU;IACV,sDAAsD,EAAE,eAAe,EAAE,wBAAwB;CAClG,CAAC;AACF,iEAAiE;AACjE,MAAM,YAAY,GAAG;IACnB,mBAAmB,EAAE,2BAA2B;IAChD,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY;IAC7D,iBAAiB,EAAE,yBAAyB;IAC5C,gBAAgB,EAAE,wBAAwB;CAC3C,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACjG,MAAM,YAAY,GAAG,wEAAwE,CAAC;AAC9F,MAAM,eAAe,GAAG,6EAA6E,CAAC;AAEtG,SAAS,QAAQ,CAAC,GAAa,EAAE,CAAS,IAAa,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3F,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,IAAwB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACxF,MAAM,CAAC,GAAI,CAA6B,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,KAAK,GAAI,CAA6B,CAAC,KAAK,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAwB;IACxC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAA6B,CAAC,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAE,CAA6B,CAAC,IAAc,CAAC,CAAC;IACnJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;8EAC8E;AAC9E,SAAS,YAAY,CAAC,IAAwB;IAC5C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAgD,CAAC;IAChE,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,IAAa,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,WAAW,CAAE,CAA6B,CAAC,UAAU,EAAG,CAA6B,CAAC,UAAU,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAI,CAA6B,CAAC,QAAQ,IAAK,CAA6B,CAAC,OAAO,CAAC;QACnG,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,kCAAkC;QACvH,MAAM,KAAK,GAAI,CAA6B,CAAC,KAAK,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,MAAM,KAAK,GAAI,CAA6B,CAAC,KAAK,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,WAAW,CAAE,CAA6B,CAAC,UAAU,EAAG,CAA6B,CAAC,UAAU,CAAC,CAAC;IACrL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,8GAA8G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnI,CAAC;AACD,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3G,CAAC;AAED,yEAAyE;AACzE,SAAS,YAAY,CAAC,IAAwB;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,wEAAwE;IACxE,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpH,OAAO,YAAY,IAAI,QAAQ,CAAC;AAClC,CAAC;AAED,sEAAsE;AACtE,SAAS,sBAAsB,CAAC,IAAwB;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,iGAAiG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjI,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7B,2EAA2E;IAC3E,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAClF,CAAC;IACD,uBAAuB;IACvB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,mHAAmH;IACnH,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,0DAA0D;IAC1D,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1F,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,OAAO,GAAG,KAAK,CAAC;IAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAS,UAAU;QACxF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAA4B,WAAW;QACzF,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAC,iEAAiE;QAChJ,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAClE,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAiB,mCAAmC;QACjH,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACxI,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC,CAAa,4CAA4C;QAC1H,uBAAuB;IACzB,CAAC;IACD,OAAO,QAAQ,IAAI,CAAC,OAAO,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAwB;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;YAAE,SAAS;QACxC,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gFAAgF,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IACxK,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAe;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,gMAAgM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvN,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAwB;IACtD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;WACtD,mKAAmK,CAAC,IAAI,CAAC,GAAG,CAAC;WAC7K,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,iHAAiH,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5I,OAAO,eAAe,IAAI,OAAO,CAAC;AACpC,CAAC;AAEY,QAAA,eAAe,GAAoB;IAC9C,OAAO,EAAE,wBAAgB;IACzB,MAAM,CAAC,IAAwB;QAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAe,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAElF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAEhH,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5F,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;QACjH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7H,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,YAAY,IAAI,aAAa,IAAI,aAAa,IAAI,gBAAgB,IAAI,IAAI,IAAI,YAAY,CAAC;QAEnH,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,aAAa,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAC7H,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YACpH,IAAI,YAAY,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAChI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YACjI,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,aAAa,IAAI,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,CAAC;gBACxF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACjG,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrE,CAAC;CACF,CAAC"}

package/dist/cjs/guard.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @coderifts/agent-guard — guardToolCall (the security-core control flow).
+ *
+ * Order (frozen spec): redactor(call) -> input_fingerprint on the redacted call -> detect ->
+ * preflight (unless SKIPPED) -> decide -> executeFactory(envelope, redactedCall) IFF SKIPPED or
+ * CONTINUE / CONTINUE_WITH_MONITORING (or observeOnly). Fail-closed on every unknown; INTEGRITY
+ * causes always resolve CLOSED + trip the breaker; enforced:true only on a LIVE receipt-verified
+ * ALLOW/MONITOR; LKG is dormant in v1 (binding fields absent => UNUSABLE => closed). onEvent never throws.
+ */
+import type { GuardConfig, GuardOutcome, ToolCallDescriptor, ExecuteFactory } from './types.js';
+export declare function guardToolCall<T>(call: ToolCallDescriptor, executeFactory: ExecuteFactory<T>, config: GuardConfig): Promise<GuardOutcome<T>>;
+//# sourceMappingURL=guard.d.ts.map

package/dist/cjs/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,WAAW,EAAE,YAAY,EACT,kBAAkB,EAAE,cAAc,EAEnD,MAAM,YAAY,CAAC;AAwHpB,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,kBAAkB,EACxB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,EACjC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAuJ1B"}