@coderifts/agent-guard 1.0.0 → 1.2.0

package/dist/cjs/session-taint.js

@@ -0,0 +1,317 @@
+"use strict";
+/**
+ * @coderifts/agent-guard — process-local session-taint detector (SEPARATE surface).
+ *
+ * Implements session-taint-detector-SPEC.md verbatim: a multi-call taint tracker that flags when a
+ * session both accumulates contract taint AND emits an SSOT sink — closing the gap where a sequence
+ * passes single-call DG-1 yet mutates SSOT. Additive: the frozen `builtinDetector.detect()` is NOT
+ * touched. Versioned SEPARATELY (session-taint/1.0.0), monotonic toward caution.
+ *
+ * Normative: flag ⇔ ssot_sink_events ≠ ∅ ∧ tainted. Fixture-faithful classifier order (§1.6: NON_SINK
+ * first, so snapshot/prettier stay under-set — a documented, Peter-accepted quirk; flag unaffected).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionTaintTracker = exports.SESSION_TAINT_VERSION = void 0;
+exports.pathClass = pathClass;
+exports.emptySessionState = emptySessionState;
+exports.projectState = projectState;
+exports.classifyCommand = classifyCommand;
+exports.updateSession = updateSession;
+exports.computeTainted = computeTainted;
+exports.deriveKeySignal = deriveKeySignal;
+exports.evaluate = evaluate;
+exports.SESSION_TAINT_VERSION = 'session-taint/1.0.0';
+// ── §1.3 classifiers ─────────────────────────────────────────────────────────────────────────
+const NON_SSOT_RE = /(^|\/)(tests?|__tests__|fixtures?|__mocks__|src\/internal)\//i;
+const PIPELINE_SCRATCH_RE = /(^|\/)(build|\.cache|codegen|idl)(\/|$)/i;
+const PROSE_RE = /(^|\/)(README|CHANGELOG|LICENSE)(\.\w+)?$|\.md$/i;
+const SSOT_PATH_RE = /(^|\/)(openapi|swagger|asyncapi)[^/]*\.(ya?ml|json)$|(^|\/)mcp\.json$|\.graphql$|\.gql$|(^|\/)idl\/.*\.proto$|(^|\/)specs?\/.*\.(ya?ml|json)$|openapi\.yaml|schema\.graphql|asyncapi\.yaml/i;
+const MIGRATION_RE = /(^|\/)migrations?\//i;
+const CODE_OR_CONFIG_RE = /\.(ts|tsx|js|jsx)$/i;
+const CONTRACT_CONTENT_RE = /\bopenapi\s*[:=]|\bswagger\s*[:=]|\basyncapi\s*[:=]|syntax\s*=\s*["']proto3|["']inputSchema["']|\btype\s+Query\b|(^|\n)\s*paths\s*:/i;
+const STAGING_NAME_RE = /\.b64$|enc\/|field-map|flags\.json|optional_fields|required_fields|service\.idl|frags\/|BREAKING_DROP/i;
+const NON_SINK_RE = /validate-frags|gen-docs|reload-flags|snapshot-spec|prettier|npm test|npm install|npx prettier/i;
+const SSOT_INVALIDATE_RE = /archive-old-spec/i;
+const SSOT_SINK_RE = /dsl-to-openapi|merge-spec|publish-fixture|promote-spec|sync-graphql|b64join-write|decode-promote|apply-field-map|render-openapi|idl\/compile|generate-and-test|compile_spec_bundle|install-proto|install-mcp|promote-asyncapi|repack-extract|codegen\/build\.js|codegen\/apply|codegen\/render/i;
+function pathClass(p) {
+    if (PROSE_RE.test(p))
+        return 'prose';
+    if (NON_SSOT_RE.test(p) || PIPELINE_SCRATCH_RE.test(p))
+        return 'scratch';
+    if (MIGRATION_RE.test(p))
+        return 'migration';
+    if (SSOT_PATH_RE.test(p))
+        return 'ssot';
+    if (CODE_OR_CONFIG_RE.test(p) || p.startsWith('src/') || p.startsWith('config/') || p === 'package.json')
+        return 'code_or_config';
+    return 'other';
+}
+function emptySessionState() {
+    return {
+        scratch_writes: [], contract_looking_scratch: [], encoded_fragments: [], intermediate_artifacts: [],
+        pending_renames: [], optional_fields_added: [], required_fields_declared: [], ssot_paths_touched: [],
+        ssot_sink_events: [], ssot_invalidated: false, reverse_snapshot: false, formatter_only_ssot: false,
+        store_keys: [], tainted: false,
+    };
+}
+/** Serialize to the fixture's projected form (pending_renames -> "from->to" | "drop:name"). */
+function projectState(s) {
+    return {
+        scratch_writes: s.scratch_writes.slice(),
+        encoded_fragments: s.encoded_fragments.slice(),
+        pending_renames: s.pending_renames.map((r) => ('drop' in r ? `drop:${r.drop}` : `${r.from}->${r.to}`)),
+        optional_fields_added: s.optional_fields_added.slice(),
+        required_fields_declared: s.required_fields_declared.slice(),
+        ssot_paths_touched: s.ssot_paths_touched.slice(),
+        contract_looking_scratch: s.contract_looking_scratch.slice(),
+        intermediate_artifacts: s.intermediate_artifacts.slice(),
+        ssot_sink_events: s.ssot_sink_events.slice(),
+        ssot_invalidated: s.ssot_invalidated,
+        reverse_snapshot: s.reverse_snapshot,
+        formatter_only_ssot: s.formatter_only_ssot,
+        store_keys: s.store_keys.slice(),
+        tainted: s.tainted,
+    };
+}
+// ── §2.2 extractors ──────────────────────────────────────────────────────────────────────────
+function asRecord(args) { return args && typeof args === 'object' ? args : {}; }
+function extractPaths(args) {
+    const a = asRecord(args);
+    const out = [];
+    for (const k of ['path', 'target', 'file', 'dest', 'filename', 'destination'])
+        if (typeof a[k] === 'string')
+            out.push(a[k]);
+    return out;
+}
+function extractContent(args) {
+    const a = asRecord(args);
+    const parts = [];
+    for (const k of ['contents', 'content', 'new_string', 'old_string', 'patch', 'value', 'command'])
+        if (typeof a[k] === 'string')
+            parts.push(a[k]);
+    return parts.join('\n');
+}
+// ── §2.3 encoded-fragment heuristic (fixture-faithful — do not "fix" without regenerating) ──────
+function isEncodedFragment(path, content) {
+    if (path && /part\.|enc\/|\.b64$|pkg\.part/i.test(path))
+        return true;
+    const c = content.replace(/\s+/g, '');
+    if (c.length >= 8 && c.length < 80 && /^[A-Za-z0-9+/=]+$/.test(c))
+        return true;
+    return false;
+}
+function classifyCommand(command, action, cfg = {}) {
+    const s = `${command || ''} ${action || ''}`;
+    const extraNon = cfg.extraNonSinkPatterns || [];
+    const extraSink = cfg.extraSinkPatterns || [];
+    if (NON_SINK_RE.test(s) || extraNon.some((r) => r.test(s)))
+        return 'non_sink';
+    if (SSOT_INVALIDATE_RE.test(s))
+        return 'ssot_invalidate';
+    if (SSOT_SINK_RE.test(s) || action === 'compile_spec_bundle' || extraSink.some((r) => r.test(s)))
+        return 'ssot_sink';
+    if (/snapshot/i.test(s))
+        return 'reverse_snapshot';
+    if (/prettier|format/i.test(s))
+        return 'formatter';
+    return 'unknown_script';
+}
+function pushUniq(arr, v) { if (v != null && !arr.includes(v))
+    arr.push(v); }
+// ── §2.5 transition ────────────────────────────────────────────────────────────────────────────
+function updateSession(state, call, cfg = {}) {
+    const s = JSON.parse(JSON.stringify(state)); // pure: new state
+    const args = asRecord(call && call.arguments);
+    const paths = extractPaths(args);
+    const content = extractContent(args);
+    const tool = call && call.toolName;
+    // store
+    if (tool === 'store' && typeof args.key === 'string') {
+        pushUniq(s.store_keys, args.key);
+        if (/spec_|api_|openapi|schema/i.test(args.key) || /BREAKING|ROUTE|FIELD|REMOVE|MANDATORY|required|optional/i.test(String(args.value))) {
+            pushUniq(s.intermediate_artifacts, `store:${args.key}`);
+        }
+    }
+    // apply
+    if (tool === 'apply' && typeof args.action === 'string') {
+        if (classifyCommand('', args.action, cfg) === 'ssot_sink')
+            s.ssot_sink_events.push(args.action);
+    }
+    // Bash / command
+    if (tool === 'Bash' || typeof args.command === 'string') {
+        const cmd = typeof args.command === 'string' ? args.command : '';
+        const kind = classifyCommand(cmd, '', cfg);
+        if (kind === 'ssot_sink')
+            s.ssot_sink_events.push(cmd);
+        if (kind === 'ssot_invalidate')
+            s.ssot_invalidated = true;
+        if (kind === 'reverse_snapshot')
+            s.reverse_snapshot = true;
+        if (kind === 'formatter' && (SSOT_PATH_RE.test(cmd) || /openapi|swagger|asyncapi|\.graphql|\.gql|mcp\.json|schema/i.test(cmd)))
+            s.formatter_only_ssot = true;
+    }
+    // path-bearing writes/edits
+    for (const p of paths) {
+        const pc = pathClass(p);
+        const isScratch = pc === 'scratch' || NON_SSOT_RE.test(p) || PIPELINE_SCRATCH_RE.test(p);
+        if (isScratch) {
+            pushUniq(s.scratch_writes, p);
+            if (CONTRACT_CONTENT_RE.test(content) || STAGING_NAME_RE.test(p + content))
+                pushUniq(s.contract_looking_scratch, p);
+            if (PIPELINE_SCRATCH_RE.test(p))
+                pushUniq(s.intermediate_artifacts, p);
+            if (isEncodedFragment(p, content) || /\.b64$/i.test(p) || /enc\//i.test(p) || /pkg\.part/i.test(p))
+                pushUniq(s.encoded_fragments, p);
+            if (/field-map|flags\.json|optional_fields|required_fields|\.idl$/i.test(p))
+                pushUniq(s.intermediate_artifacts, p);
+        }
+        if (pc === 'ssot' && !(tool === 'Bash' && /prettier/i.test(typeof args.command === 'string' ? args.command : '')))
+            pushUniq(s.ssot_paths_touched, p);
+        // field-map JSON
+        if (/field-map/i.test(p)) {
+            let obj;
+            try {
+                obj = JSON.parse(content);
+            }
+            catch {
+                obj = null;
+            }
+            if (obj && typeof obj === 'object' && !Array.isArray(obj)) {
+                for (const [k, v] of Object.entries(obj)) {
+                    if (k === '__drop' && Array.isArray(v)) {
+                        for (const d of v)
+                            s.pending_renames.push({ drop: String(d) });
+                    }
+                    else if (typeof v === 'string')
+                        s.pending_renames.push({ from: k, to: v });
+                }
+            }
+        }
+        // flags.json optional/required
+        if (/flags\.json/i.test(p)) {
+            for (const m of content.matchAll(/"(\w+)":\s*"optional"/g))
+                pushUniq(s.optional_fields_added, m[1]);
+            for (const m of content.matchAll(/"(\w+)":\s*"required"/g))
+                pushUniq(s.required_fields_declared, m[1]);
+        }
+        // list files
+        if (/optional_fields/i.test(p))
+            for (const line of content.split('\n'))
+                if (line.trim())
+                    pushUniq(s.optional_fields_added, line.trim());
+        if (/required_fields/i.test(p))
+            for (const line of content.split('\n'))
+                if (line.trim())
+                    pushUniq(s.required_fields_declared, line.trim());
+        // ST-009 yaml heuristics
+        if (NON_SSOT_RE.test(p) && /required:\s*\[[^\]]*owner_id/.test(content))
+            pushUniq(s.required_fields_declared, 'owner_id');
+        if (NON_SSOT_RE.test(p) && /owner_id:\s*\{type: string\}/.test(content))
+            pushUniq(s.optional_fields_added, 'owner_id');
+        if (/\.idl$/i.test(p) || p.startsWith('idl/'))
+            pushUniq(s.intermediate_artifacts, p);
+    }
+    // body flags (with/without path)
+    if (/BREAKING_DROP|FIELD .* REMOVE|MANDATORY/i.test(content))
+        pushUniq(s.intermediate_artifacts, paths[0] || 'inline_flag');
+    s.tainted = computeTainted(s);
+    return s;
+}
+// ── §3.2 taint predicate ─────────────────────────────────────────────────────────────────────
+function computeTainted(s) {
+    return (s.contract_looking_scratch.length > 0
+        || s.encoded_fragments.length > 0
+        || s.intermediate_artifacts.length > 0
+        || s.store_keys.some((k) => /spec_|api_|schema|openapi/i.test(k))
+        || s.pending_renames.length > 0
+        || s.optional_fields_added.some((f) => s.required_fields_declared.includes(f))
+        || (s.required_fields_declared.length > 0 && s.optional_fields_added.length > 0)
+        || s.ssot_invalidated === true);
+}
+function deriveKeySignal(s) {
+    if (s.ssot_invalidated)
+        return 'delete_recreate_ssot_via_session';
+    if (s.encoded_fragments.length)
+        return 'encoded_scratch_then_ssot_promotion';
+    if (s.optional_fields_added.some((f) => s.required_fields_declared.includes(f)) || (s.required_fields_declared.length && s.optional_fields_added.length))
+        return 'cumulative_required_flip';
+    if (s.pending_renames.length)
+        return 'cumulative_rename_via_codegen';
+    if (s.contract_looking_scratch.length)
+        return 'scratch_to_ssot_promotion';
+    if (s.intermediate_artifacts.length)
+        return 'cross_call_reassembly_to_ssot';
+    return 'session_ssot_sink_with_taint';
+}
+/** flag ⇔ (ssot_sink_events ≠ ∅ || sink_seen) ∧ (tainted || overflow). */
+function evaluate(state, prevFlagged = false, opts = {}) {
+    const sink = state.ssot_sink_events.length > 0 || opts.sinkSeen === true;
+    const taint = state.tainted || opts.overflow === true;
+    const flag = sink && taint;
+    return { flag, trip: flag && !prevFlagged, key_signal: flag ? deriveKeySignal(state) : null };
+}
+const DEF = { maxCalls: 256, maxPathsTracked: 512, maxSinkEvents: 64, maxStateBytes: 256_000, ttlMs: 3_600_000 };
+class SessionTaintTracker {
+    version = exports.SESSION_TAINT_VERSION;
+    state = emptySessionState();
+    prevFlag = false;
+    callCount = 0;
+    overflow = false;
+    sinkSeen = false;
+    lastObserveAt = 0;
+    cfg;
+    constructor(config = {}) { this.cfg = config; }
+    pathTotal() {
+        const s = this.state;
+        return s.scratch_writes.length + s.contract_looking_scratch.length + s.encoded_fragments.length
+            + s.intermediate_artifacts.length + s.ssot_paths_touched.length;
+    }
+    observe(call) {
+        const now = this.now();
+        // §4.3 TTL: soft reset to a fresh session on expiry.
+        if (this.lastObserveAt && now - this.lastObserveAt > (this.cfg.ttlMs ?? DEF.ttlMs))
+            this.reset();
+        this.lastObserveAt = now;
+        const next = updateSession(this.state, call, this.cfg);
+        // §4.3 caps → sticky overflow forces taint (monotonic caution; NOT drop-oldest).
+        this.callCount++;
+        if (this.callCount > (this.cfg.maxCalls ?? DEF.maxCalls))
+            this.overflow = true;
+        if (this.pathTotal() > (this.cfg.maxPathsTracked ?? DEF.maxPathsTracked))
+            this.overflow = true;
+        if (JSON.stringify(next).length > (this.cfg.maxStateBytes ?? DEF.maxStateBytes))
+            this.overflow = true;
+        // maxSinkEvents: stop growing the list but keep sink presence sticky.
+        if (next.ssot_sink_events.length > (this.cfg.maxSinkEvents ?? DEF.maxSinkEvents)) {
+            next.ssot_sink_events = next.ssot_sink_events.slice(0, this.cfg.maxSinkEvents ?? DEF.maxSinkEvents);
+        }
+        this.state = next;
+        if (this.state.ssot_sink_events.length > 0)
+            this.sinkSeen = true;
+        return this.snapshot();
+    }
+    status() { return this.snapshot(); }
+    reset() {
+        this.state = emptySessionState();
+        this.prevFlag = false;
+        this.callCount = 0;
+        this.overflow = false;
+        this.sinkSeen = false;
+        this.lastObserveAt = 0;
+    }
+    snapshot() {
+        const eva = evaluate(this.state, this.prevFlag, { overflow: this.overflow, sinkSeen: this.sinkSeen });
+        if (eva.flag)
+            this.prevFlag = true;
+        return {
+            flag: eva.flag, trip: eva.trip, key_signal: eva.key_signal,
+            state: projectState(this.state),
+            version: exports.SESSION_TAINT_VERSION, overflow: this.overflow,
+            severity: this.cfg.sessionTaintSeverity || 'caution',
+        };
+    }
+    // Date.now is fine at runtime; isolated for testability.
+    now() { return Date.now(); }
+}
+exports.SessionTaintTracker = SessionTaintTracker;
+//# sourceMappingURL=session-taint.js.map

package/dist/cjs/session-taint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-taint.js","sourceRoot":"","sources":["../../src/session-taint.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAuBH,8BAOC;AAsBD,8CAOC;AAGD,oCAiBC;AA2BD,0CAUC;AAKD,sCA0EC;AAGD,wCAWC;AAKD,0CAQC;AAGD,4BAKC;AAlOY,QAAA,qBAAqB,GAAG,qBAAqB,CAAC;AAE3D,gGAAgG;AAChG,MAAM,WAAW,GAAG,+DAA+D,CAAC;AACpF,MAAM,mBAAmB,GAAG,0CAA0C,CAAC;AACvE,MAAM,QAAQ,GAAG,kDAAkD,CAAC;AACpE,MAAM,YAAY,GAAG,6LAA6L,CAAC;AACnN,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEhD,MAAM,mBAAmB,GAAG,sIAAsI,CAAC;AACnK,MAAM,eAAe,GAAG,wGAAwG,CAAC;AAEjI,MAAM,WAAW,GAAG,gGAAgG,CAAC;AACrH,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAC/C,MAAM,YAAY,GAAG,iSAAiS,CAAC;AAIvT,SAAgB,SAAS,CAAC,CAAS;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC;IAC7C,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,cAAc;QAAE,OAAO,gBAAgB,CAAC;IAClI,OAAO,OAAO,CAAC;AACjB,CAAC;AAsBD,SAAgB,iBAAiB;IAC/B,OAAO;QACL,cAAc,EAAE,EAAE,EAAE,wBAAwB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE;QACnG,eAAe,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,wBAAwB,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE;QACpG,gBAAgB,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK;QAClG,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAgB,YAAY,CAAC,CAAe;IAC1C,OAAO;QACL,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE;QACxC,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE;QAC9C,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtG,qBAAqB,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE;QACtD,wBAAwB,EAAE,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE;QAC5D,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE;QAChD,wBAAwB,EAAE,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE;QAC5D,sBAAsB,EAAE,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE;QACxD,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE;QAC5C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,IAAa,IAA6B,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE/I,SAAS,YAAY,CAAC,IAAa;IACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,GAAG,GAAa,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC;QAAE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IACtI,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,cAAc,CAAC,IAAa;IACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,KAAK,GAAa,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;QAAE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IAC3J,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,IAAwB,EAAE,OAAe;IAClE,IAAI,IAAI,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAKD,SAAgB,eAAe,CAAC,OAAe,EAAE,MAAc,EAAE,MAA0B,EAAE;IAC3F,MAAM,CAAC,GAAG,GAAG,OAAO,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9E,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACzD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,KAAK,qBAAqB,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC;IACrH,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACnD,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC;IACnD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,QAAQ,CAAC,GAAa,EAAE,CAAS,IAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAErG,kGAAkG;AAClG,SAAgB,aAAa,CAAC,KAAmB,EAAE,IAAgD,EAAE,MAA0B,EAAE;IAC/H,MAAM,CAAC,GAAiB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB;IAC7E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;IAEnC,QAAQ;IACR,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrD,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,0DAA0D,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACvI,QAAQ,CAAC,CAAC,CAAC,sBAAsB,EAAE,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,QAAQ;IACR,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxD,IAAI,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,WAAW;YAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClG,CAAC;IACD,iBAAiB;IACjB,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,WAAW;YAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,iBAAiB;YAAE,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC1D,IAAI,IAAI,KAAK,kBAAkB;YAAE,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC3D,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,4DAA4D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,CAAC,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAC/J,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,EAAE,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEzF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;YAC9B,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC;gBAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;YACpH,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;YACvE,IAAI,iBAAiB,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;YACrI,IAAI,+DAA+D,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;QACrH,CAAC;QAED,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAErJ,iBAAiB;QACjB,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,GAAG,GAAG,IAAI,CAAC;YAAC,CAAC;YACxD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;oBACpE,IAAI,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;wBAAC,KAAK,MAAM,CAAC,IAAI,CAAC;4BAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAAC,CAAC;yBACtG,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;QACD,+BAA+B;QAC/B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;gBAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpG,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;gBAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,CAAC;QACD,aAAa;QACb,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,IAAI,CAAC,IAAI,EAAE;oBAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,IAAI,CAAC,IAAI,EAAE;oBAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3I,yBAAyB;QACzB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC;QAC1H,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;QAEvH,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,iCAAiC;IACjC,IAAI,0CAA0C,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC;IAE5H,CAAC,CAAC,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gGAAgG;AAChG,SAAgB,cAAc,CAAC,CAAe;IAC5C,OAAO,CACL,CAAC,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC;WAClC,CAAC,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;WAC9B,CAAC,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC;WACnC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;WAC9D,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;WAC5B,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;WAC3E,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,CAAC;WAC7E,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAC/B,CAAC;AACJ,CAAC;AAKD,SAAgB,eAAe,CAAC,CAAe;IAC7C,IAAI,CAAC,CAAC,gBAAgB;QAAE,OAAO,kCAAkC,CAAC;IAClE,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM;QAAE,OAAO,qCAAqC,CAAC;IAC7E,IAAI,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,IAAI,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAC5L,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM;QAAE,OAAO,+BAA+B,CAAC;IACrE,IAAI,CAAC,CAAC,wBAAwB,CAAC,MAAM;QAAE,OAAO,2BAA2B,CAAC;IAC1E,IAAI,CAAC,CAAC,sBAAsB,CAAC,MAAM;QAAE,OAAO,+BAA+B,CAAC;IAC5E,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,SAAgB,QAAQ,CAAC,KAAmB,EAAE,WAAW,GAAG,KAAK,EAAE,OAAmD,EAAE;IACtH,MAAM,IAAI,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,IAAI,KAAK,CAAC;IAC3B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAChG,CAAC;AA0BD,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAEjH,MAAa,mBAAmB;IACrB,OAAO,GAAG,6BAAqB,CAAC;IACjC,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAC5B,QAAQ,GAAG,KAAK,CAAC;IACjB,SAAS,GAAG,CAAC,CAAC;IACd,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC;IACjB,aAAa,GAAG,CAAC,CAAC;IAClB,GAAG,CAAqB;IAEhC,YAAY,SAA6B,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC;IAE3D,SAAS;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QACrB,OAAO,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC,iBAAiB,CAAC,MAAM;cAC3F,CAAC,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,IAAwB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,qDAAqD;QACrD,IAAI,IAAI,CAAC,aAAa,IAAI,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACjG,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;QAEzB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,iFAAiF;QACjF,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC/E,IAAI,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC/F,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtG,sEAAsE;QACtE,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACjF,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAEjE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,KAA8B,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAE7D,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;IACvE,CAAC;IAEO,QAAQ;QACd,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtG,IAAI,GAAG,CAAC,IAAI;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1D,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAA4B;YAC1D,OAAO,EAAE,6BAAqB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS;SACrD,CAAC;IACJ,CAAC;IAED,yDAAyD;IACjD,GAAG,KAAa,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;CAC7C;AA5DD,kDA4DC"}

package/dist/cjs/tool-registry.d.ts

@@ -0,0 +1,88 @@
+/**
+ * guardToolRegistry — the agent-runtime inescapability layer (guard-tool-registry-SPEC v1.0).
+ *
+ * The layer ABOVE the shipped `guardToolCall`: it takes the host's raw tool list and returns the ONLY
+ * tool table the agent is allowed to see — every mutating capability wrapped so it cannot execute
+ * without entering `guardToolCall`, and construction FAILS CLOSED if a mutator would remain raw.
+ *
+ * Scope honesty (enforcement-architecture §1): this secures **Placement A — the agent-host runtime
+ * tool boundary ONLY**. It NEVER claims merge (Placement B / sibling #7) or deploy inescapability;
+ * `claim.inescapable_merge` / `claim.inescapable_deploy` are ALWAYS false here.
+ *
+ * Determinism (§7): same tool names + classes + config flags → same registry, coverage, guarded set.
+ * Anti-fabrication: unknown tools default to MUTATING (never a false COMPLETE); never invent a tool.
+ * Non-leakage (§1.2): each raw `execute` is captured in a NEW closure, is never a property of the
+ * returned ProtectedTool, the tools array + each tool are frozen, and raw executors live only in a
+ * WeakMap keyed by the protected object. `result.tools` is the sole return surface.
+ */
+import type { GuardConfig, ToolCallDescriptor } from './types.js';
+export type ToolMutationClass = 'readonly' | 'mutating' | 'mutating_shell' | 'mutating_vcs' | 'mutating_deploy' | 'mutating_publish' | 'mutating_schema';
+export type RawTool = {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+    execute: (args: unknown) => Promise<unknown> | unknown;
+    mutationClass?: ToolMutationClass;
+    meta?: Record<string, unknown>;
+};
+export type ProtectedTool = {
+    readonly name: string;
+    readonly description?: string;
+    readonly inputSchema?: unknown;
+    readonly meta?: Record<string, unknown>;
+    /** The ONLY entry point exposed to the agent runtime (guarded for mutators, direct for readonly). */
+    readonly execute: (args: unknown) => Promise<unknown>;
+    readonly _coderifts: {
+        readonly guarded: boolean;
+        readonly mutationClass: ToolMutationClass;
+        /** guard operation bound for this tool (diagnostic; mutators only). */
+        readonly operation?: string;
+    };
+};
+export type EnforcementCoverage = 'COMPLETE' | 'PARTIAL' | 'BYPASSED' | 'UNKNOWN';
+export type RegistryCoverageReport = {
+    version: 'guard-tool-registry-report/1.0';
+    coverage: EnforcementCoverage;
+    protected_tools: string[];
+    guarded_mutators: string[];
+    readonly_passthrough: string[];
+    unguarded_mutators: string[];
+    unknown_treated_as: 'mutating' | 'readonly' | 'reject';
+    claim: {
+        inescapable_runtime: boolean;
+        inescapable_merge: false;
+        inescapable_deploy: false;
+    };
+    siblings: {
+        merge_gate: 'required_separate_#7';
+        artifact_resolver: 'sibling_#4';
+    };
+    warnings: string[];
+};
+export type ToolBinder = (tool: RawTool, args: unknown, cls: ToolMutationClass) => ToolCallDescriptor;
+export type GuardToolRegistryConfig = {
+    guard?: GuardConfig;
+    unknownToolPolicy?: 'mutating' | 'readonly' | 'reject';
+    classify?: Record<string, ToolMutationClass>;
+    failOnUnguardedMutator?: boolean;
+    binders?: Record<string, ToolBinder>;
+    forceReadonly?: string[];
+};
+export type RegistryResult = {
+    tools: ProtectedTool[];
+    coverage: EnforcementCoverage;
+    report: RegistryCoverageReport;
+};
+export type RegistryConstructionErrorCode = 'GUARD_CONFIG_INVALID' | 'UNKNOWN_TOOL' | 'DUPLICATE_TOOL_NAME' | 'INVALID_TOOL' | 'FORCE_READONLY_MUTATOR';
+/** Fail-closed construction error (§3) — thrown at CONSTRUCTION, never at first agent call. */
+export declare class RegistryConstructionError extends Error {
+    readonly code: RegistryConstructionErrorCode;
+    readonly toolName?: string;
+    constructor(code: RegistryConstructionErrorCode, message: string, toolName?: string);
+}
+/**
+ * Construct the frozen, fail-closed protected tool registry (§1.3). Pure + deterministic.
+ * @throws {RegistryConstructionError} per §3 (default failOnUnguardedMutator=true).
+ */
+export declare function guardToolRegistry(rawTools: RawTool[], config?: GuardToolRegistryConfig): RegistryResult;
+//# sourceMappingURL=tool-registry.d.ts.map

package/dist/cjs/tool-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-registry.d.ts","sourceRoot":"","sources":["../../src/tool-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAA0B,MAAM,YAAY,CAAC;AAG1F,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,UAAU,GACV,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,OAAO,GAAG;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACvD,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAC1C,uEAAuE;QACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,gCAAgC,CAAC;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACvD,KAAK,EAAE;QACL,mBAAmB,EAAE,OAAO,CAAC;QAC7B,iBAAiB,EAAE,KAAK,CAAC;QACzB,kBAAkB,EAAE,KAAK,CAAC;KAC3B,CAAC;IACF,QAAQ,EAAE;QACR,UAAU,EAAE,sBAAsB,CAAC;QACnC,iBAAiB,EAAE,YAAY,CAAC;KACjC,CAAC;IACF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,KAAK,kBAAkB,CAAC;AAEtG,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,iBAAiB,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,sBAAsB,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GACrC,sBAAsB,GACtB,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,wBAAwB,CAAC;AAE7B,+FAA+F;AAC/F,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;gBACf,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;CAMpF;AA2HD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,GAAE,uBAA4B,GAAG,cAAc,CAoI3G"}