@coderifts/agent-guard 1.0.0 → 1.2.0

package/dist/esm/guard.js

@@ -10,6 +10,8 @@
 import { createHash } from 'node:crypto';
 import { readDecision } from '@coderifts/sdk';
 import { builtinDetector } from './detector.js';
+import { bindReceiptToEnvelope } from './receipt-binding.js';
+import { evaluateEnvelope } from './enforcement-gate.js';
 // Per-config breaker state (time-window; not consecutive).
 const breakers = new WeakMap();
 const nowMs = () => Date.now();
@@ -93,22 +95,33 @@ async function preflightWithRetry(config, request) {
     }
     return { ok: false, ...last };
 }
-/** Verify the envelope's receipt via the SDK. Returns the BRANDED envelope only when verified. */
+/**
+ * Verify the envelope's receipt AND bind it to THIS envelope (P0 substitution fix). Returns the
+ * BRANDED envelope only when the receipt is valid, current, AND the LOCALLY-recomputed decision body
+ * hash + fingerprint + operation/environment/audience scope all match. On a valid-but-unbound receipt
+ * the `cause` is RECEIPT_ENVELOPE_MISMATCH; on a bad signature it is RECEIPT_UNVERIFIED. Fail-closed:
+ * any mismatch returns { verified: null }.
+ */
 async function verifyEnvelope(config, envelope) {
     if (!envelope)
-        return null;
+        return { verified: null };
     if (config.verifyReceipts === false)
-        return null; // opt-out => cannot brand => unenforceable + LKG unusable
+        return { verified: null }; // opt-out => cannot brand => unenforceable + LKG unusable
     const token = envelope.receipt?.token;
     if (!token)
-        return null;
+        return { verified: null };
     try {
         const r = await config.client.verifyReceipt(token);
-        if (r && r.valid === true)
-            return envelope;
+        const bind = bindReceiptToEnvelope(envelope, r, { operation: config.operation, environment: config.environment, audience: config.audience });
+        if (bind.ok)
+            return { verified: envelope };
+        emit(config, { type: 'receipt_unverified', at: iso(), decisionId: envelope.decision_id, cause: bind.detail });
+        return { verified: null, cause: bind.cause };
+    }
+    catch {
+        // verification threw => treat as unverified (bad signature / transport)
+        return { verified: null, cause: 'RECEIPT_UNVERIFIED' };
     }
-    catch { /* verification failure is handled as RECEIPT_UNVERIFIED by the caller */ }
-    return null;
 }
 // ── Outcome builders (keep the discriminated union satisfied) ────────────────────
 async function runEnforced(config, factory, approved, redacted) {
@@ -136,6 +149,23 @@ async function runUnenforced(config, factory, envelope, verdict, preflighted, re
 function blocked(verdict, preflighted) {
     return { executionAttempted: false, executed: false, enforced: false, verdict, preflighted };
 }
+/**
+ * True iff at least one supplied artifact carries analyzable before/after content. A preflight
+ * trigger with no such content cannot be analyzed by the server (an empty list comes back as an
+ * opaque REQUEST_REJECTED), so the guard fails closed LOCALLY with MISSING_ARTIFACT_CONTENT instead.
+ * Reads defensively — the caller's artifacts are untrusted runtime data.
+ */
+function hasAnalyzableContent(artifacts) {
+    if (!Array.isArray(artifacts) || artifacts.length === 0)
+        return false;
+    return artifacts.some((a) => {
+        if (!a || typeof a !== 'object')
+            return false;
+        const before = a.before;
+        const after = a.after;
+        return (typeof before === 'string' && before.length > 0) || (typeof after === 'string' && after.length > 0);
+    });
+}
 function unavailableVerdict(parts, count) {
     return { kind: 'UNAVAILABLE', decisionMissing: true, unavailableCount: count, ...parts };
 }
@@ -171,6 +201,20 @@ export async function guardToolCall(call, executeFactory, config) {
         const verdict = { kind: 'SKIPPED', reason: 'NOT_A_CONTRACT_CALL', signals: detection.signals, detectorVersion: detector.version };
         return runUnenforced(config, executeFactory, null, verdict, false, redacted);
     }
+    // MISSING_ARTIFACT_CONTENT — developer-adoption fail-closed (audit #1). The detector says a contract
+    // change is happening (trigger:true) but the caller supplied NO analyzable content: no artifacts, or
+    // artifacts without before/after. Sending an empty list to the server returns an opaque
+    // REQUEST_REJECTED; instead fail closed LOCALLY with a clear, actionable cause so the developer knows
+    // to pass artifacts:[{ id, type, before, after }]. The tool does NOT execute (fail-closed preserved).
+    // This can only fire when preflight is genuinely required — a non-contract/readonly call already
+    // returned via the SKIPPED path above. It is NOT a server-availability failure, so it does NOT trip
+    // the breaker (a developer's missing content must not degrade the open-policy path for later calls).
+    if (!hasAnalyzableContent(detection.artifacts)) {
+        emit(config, { type: 'artifact_content_missing', at: iso(), cause: 'MISSING_ARTIFACT_CONTENT', signals: detection.signals });
+        const count = (breakers.get(config)?.fails.length) ?? 0;
+        const v = unavailableVerdict({ cause: 'MISSING_ARTIFACT_CONTENT', failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
+        return blocked(v, false);
+    }
     // config validation: lkg policy requires an LkgStore.
     if (failPolicy === 'lkg' && !config.lkg) {
         breakerRecord(config);
@@ -231,29 +275,41 @@ export async function guardToolCall(call, executeFactory, config) {
     const envelope = rd.envelope;
     // 5. expiry check before honoring any decision.
     const expired = isExpired(envelope);
-    const verified = await verifyEnvelope(config, envelope);
+    const bindResult = await verifyEnvelope(config, envelope);
+    const verified = bindResult.verified;
     const receiptVerified = !!verified;
     if (!receiptVerified)
         emit(config, { type: 'receipt_unverified', at: iso(), decisionId: envelope.decision_id });
     emit(config, { type: 'preflight_result', at: iso(), action: rd.executionAction, decisionId: envelope.decision_id });
-    // A bad signature (verifyReceipts on, token present, verify failed) is an INTEGRITY attack signal.
+    // A receipt that fails to verify OR fails to BIND to this envelope (P0 substitution/replay/scope) is
+    // an INTEGRITY attack signal => fail closed. RECEIPT_ENVELOPE_MISMATCH names a valid-but-unbound
+    // receipt (e.g. a real BLOCK receipt wrapped in a forged ALLOW envelope); RECEIPT_UNVERIFIED a bad
+    // signature. Both trip the breaker and STOP — the guard NEVER executes off an unbound receipt.
     if (config.verifyReceipts !== false && !receiptVerified && envelope.receipt?.token) {
         breakerRecord(config);
-        return closedIntegrity(config, 'RECEIPT_UNVERIFIED', failPolicy);
+        return closedIntegrity(config, bindResult.cause ?? 'RECEIPT_UNVERIFIED', failPolicy);
+    }
+    // ── Client-side authorization gate (P0-b/c): mirror §106/§111/§115 before honoring any action. ──
+    // A raw execution_action is NEVER trusted alone. The gate reconciles decision↔action (stricter
+    // wins), honors safe_for_agent, fails closed on degraded, and binds the analyzed artifacts to what
+    // we actually sent. Only an allow-class, safe, non-degraded, artifact-bound verdict is executable.
+    const gate = evaluateEnvelope(pf.response, envelope, rd.executionAction, detection.artifacts);
+    if (gate.verdict === 'fail-closed') {
+        breakerRecord(config);
+        return closedIntegrity(config, gate.cause, failPolicy);
+    }
+    if (gate.verdict === 'block-strict') {
+        // A real (or stricter-reconciled) BLOCK / REQUIRE_APPROVAL — clean block; the factory never runs.
+        return gate.decision === 'BLOCK'
+            ? blocked({ kind: 'BLOCK', action: 'STOP', envelope, receiptVerified }, true)
+            : blocked({ kind: 'APPROVAL', action: 'REQUEST_APPROVAL', envelope, receiptVerified }, true);
     }
-    const action = rd.executionAction;
-    // Non-executable decisions.
-    if (action === 'STOP')
-        return blocked({ kind: 'BLOCK', action: 'STOP', envelope, receiptVerified }, true);
-    if (action === 'REQUEST_APPROVAL')
-        return blocked({ kind: 'APPROVAL', action: 'REQUEST_APPROVAL', envelope, receiptVerified }, true);
+    const kind = gate.kind; // 'ALLOW' | 'MONITOR' — allow-class, safe, non-degraded, artifact-bound.
     // An expired decision cannot be honored fresh => closed (integrity: wrong-time state).
     if (expired) {
         breakerRecord(config);
         return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy);
     }
-    // Executable: CONTINUE (ALLOW) or CONTINUE_WITH_MONITORING (MONITOR).
-    const kind = action === 'CONTINUE' ? 'ALLOW' : 'MONITOR';
     const sinkWired = !!config.onEvent; // v1: onEvent is the telemetry sink for MONITOR.
     if (kind === 'MONITOR') {
         if (sinkWired)
@@ -261,15 +317,19 @@ export async function guardToolCall(call, executeFactory, config) {
         else
             emit(config, { type: 'monitoring_unwired', at: iso(), decisionId: envelope.decision_id });
     }
-    // observeOnly executes but never enforces.
+    // observeOnly is an EXPLICIT report-only opt-in: execute but never enforce (the one sanctioned
+    // unenforced-execution mode alongside failPolicy=open; both are documented opt-ins, not the default).
     if (config.observeOnly) {
-        emit(config, { type: 'observe_only_passthrough', at: iso(), action });
+        emit(config, { type: 'observe_only_passthrough', at: iso(), action: rd.executionAction });
         const verdict = kind === 'ALLOW'
             ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
             : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
         return runUnenforced(config, executeFactory, envelope, verdict, true, redacted);
     }
-    // enforced:true requires a LIVE receipt-verified ALLOW/MONITOR, and (MONITOR) a wired sink.
+    // ── enforced ⟺ executed INVARIANT (contract-triggering path): execute ONLY when we can ENFORCE. ──
+    // enforceable = a bound-verified receipt AND (MONITOR) a wired sink. Anything else FAILS CLOSED —
+    // the guard NEVER runs the factory unenforced on a contract change. Closes CE-EP-06 (no receipt),
+    // CE-EP-08 (verifyReceipts:false), CE-CC-04 (MONITOR without a monitoring sink).
     const enforceable = receiptVerified && (kind === 'ALLOW' || sinkWired);
     if (enforceable) {
         const approved = kind === 'ALLOW'
@@ -277,11 +337,8 @@ export async function guardToolCall(call, executeFactory, config) {
             : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified: true };
         return runEnforced(config, executeFactory, approved, redacted);
     }
-    // MONITOR with no sink (monitoring_unwired): execute but enforced:false.
-    const verdict = kind === 'ALLOW'
-        ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
-        : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
-    return runUnenforced(config, executeFactory, envelope, verdict, true, redacted);
+    breakerRecord(config);
+    return closedIntegrity(config, receiptVerified ? 'MONITORING_UNWIRED' : 'RECEIPT_MISSING', failPolicy);
 }
 function closedIntegrity(config, cause, failPolicy) {
     const count = (breakers.get(config)?.fails.length) ?? 1;
@@ -310,8 +367,9 @@ async function tryLkg(config, inputFp) {
     }
     if (!cached)
         return null;
-    // Receipt verification is UNCONDITIONAL for LKG (with verifyReceipts:false it cannot brand => unusable).
-    const verified = await verifyEnvelope(config, cached);
+    // Receipt verification + BINDING is UNCONDITIONAL for LKG (verifyReceipts:false => cannot brand =>
+    // unusable). An LKG envelope whose receipt does not bind to it (substitution) is also unusable.
+    const { verified } = await verifyEnvelope(config, cached);
     if (!verified)
         return null;
     // Eligibility (rule 15): decision ALLOW|WARN, unexpired, age<lkgMaxAgeMs, fingerprint + ruleset_hash

package/dist/esm/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAM9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,2DAA2D;AAC3D,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAoC,CAAC;AAEjE,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;AAC/B,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAE3C,SAAS,IAAI,CAAC,MAAmB,EAAE,CAAa;IAC9C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;IAAC,CAAC;AAC7F,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClK,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB;IACxC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACrF,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AACxB,CAAC;AACD,SAAS,cAAc,CAAC,MAAmB;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC;IAC5C,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,MAAmB;IACtD,MAAM,CAAC,GAAG,GAAkH,CAAC;IAC7H,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC;IACrB,MAAM,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC;IAC5C,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,EAAE,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC/H,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3E,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9G,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpG,IAAI,IAAI,KAAK,WAAW,IAAI,wDAAwD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7J,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC5E,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,sCAAsC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACjJ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAmB,EAAE,OAAgB;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;IACtB,IAAI,IAAI,GAAoD,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACnG,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC;QAC7C,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAE,MAAM,CAAC,MAA+D,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YACxK,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,yBAAyB;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,kGAAkG;AAClG,KAAK,UAAU,cAAc,CAAC,MAAmB,EAAE,QAAuC;IACxF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,0DAA0D;IAC5G,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAO,MAAM,CAAC,MAAqE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACnH,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,QAAmC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC,CAAC,yEAAyE,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,WAAW,CAAI,MAAmB,EAAE,OAA0B,EAAE,QAAyB,EAAE,QAA4B;IACpI,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3H,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1D,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpH,CAAC;AACH,CAAC;AACD,KAAK,UAAU,aAAa,CAAI,MAAmB,EAAE,OAA0B,EAAE,QAAuC,EAAE,OAAqB,EAAE,WAAoB,EAAE,QAA4B;IACjM,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACrG,CAAC;AACH,CAAC;AACD,SAAS,OAAO,CAAI,OAAqB,EAAE,WAAoB;IAC7D,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC/F,CAAC;AAQD,SAAS,kBAAkB,CAAC,KAAY,EAAE,KAAa;IACrD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAwB,EACxB,cAAiC,EACjC,MAAmB;IAEnB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC;IAEjD,+EAA+E;IAC/E,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,sCAAsC;IAE7E,oFAAoF;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC;IACpD,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,kGAAkG;IAClG,MAAM,kBAAkB,GAAG,MAAM,CAAC,wBAAwB,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI;WAC/F,CAAC,CAAC,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;IAE7G,uFAAuF;IACvF,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,MAAM,OAAO,GAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChJ,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/E,CAAC;IAED,sDAAsD;IACtD,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACxC,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED,2DAA2D;IAC3D,MAAM,OAAO,GAAG;QACd,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QACnH,gBAAgB,EAAE,SAA+B;QACjD,eAAe,EAAE,SAA+B;KACjD,CAAC;IAEF,+EAA+E;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,SAAS,CAAC;IAChD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAC7D,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErD,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,iFAAiF;QACjF,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAuB,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;YAC7H,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,eAAe;QACf,MAAM,UAAU,GAAG,EAAE,CAAC,KAA0B,CAAC;QACjD,IAAI,UAAU,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAClG,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;YACnI,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1C,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClG,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC7J,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB;YACvG,CAAC;YACD,iEAAiE;QACnE,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACpG,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7G,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,iFAAiF;IACjF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxD,uDAAuD;QACvD,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC;IAE7B,gDAAgD;IAChD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,CAAC,CAAC,QAAQ,CAAC;IACnC,IAAI,CAAC,eAAe;QAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAEpH,mGAAmG;IACnG,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACnF,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,eAAe,CAAC;IAElC,4BAA4B;IAC5B,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;IAErI,uFAAuF;IACvF,IAAI,OAAO,EAAE,CAAC;QAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAAC,CAAC;IAErG,sEAAsE;IACtE,MAAM,IAAI,GAAG,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,iDAAiD;IACrF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,SAAS;YAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;;YACrG,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,2CAA2C;IAC3C,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAiB,IAAI,KAAK,OAAO;YAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE;YAClE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QACvF,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,4FAA4F;IAC5F,MAAM,WAAW,GAAG,eAAe,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,CAAC;IACvE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAoB,IAAI,KAAK,OAAO;YAChD,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE;YACxE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAC7F,OAAO,WAAW,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IACD,yEAAyE;IACzE,MAAM,OAAO,GAAiB,IAAI,KAAK,OAAO;QAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE;QAClE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACvF,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,eAAe,CAAI,MAAmB,EAAE,KAAqB,EAAE,UAAqC;IAC3G,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IACjG,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS,CAAC,QAAgC;IACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC9C,CAAC;AAED;wGACwG;AACxG,KAAK,UAAU,MAAM,CAAC,MAAmB,EAAE,OAAe;IACxD,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,MAAqC,CAAC;IAC1C,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,yGAAyG;IACzG,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,qGAAqG;IACrG,oGAAoG;IACpG,MAAM,GAAG,GAAI,MAAM,CAAC,QAAmB,IAAI,EAAE,CAAC;IAC9C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IACzE,mGAAmG;IACnG,MAAM,QAAQ,GAAmB;QAC9B,MAA6C,CAAC,YAAY;QAC1D,MAA6C,CAAC,WAAW;QACzD,MAA6C,CAAC,SAAS;QACvD,MAA6C,CAAC,QAAQ;KACxD,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IACnG,MAAM,MAAM,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACzE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAM9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,2DAA2D;AAC3D,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAoC,CAAC;AAEjE,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;AAC/B,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAE3C,SAAS,IAAI,CAAC,MAAmB,EAAE,CAAa;IAC9C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;IAAC,CAAC;AAC7F,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClK,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB;IACxC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACrF,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AACxB,CAAC;AACD,SAAS,cAAc,CAAC,MAAmB;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC;IAC5C,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,MAAmB;IACtD,MAAM,CAAC,GAAG,GAAkH,CAAC;IAC7H,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC;IACrB,MAAM,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC;IAC5C,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,EAAE,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC/H,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3E,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9G,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpG,IAAI,IAAI,KAAK,WAAW,IAAI,wDAAwD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7J,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC5E,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,sCAAsC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACjJ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAmB,EAAE,OAAgB;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;IACtB,IAAI,IAAI,GAAoD,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACnG,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC;QAC7C,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAE,MAAM,CAAC,MAA+D,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YACxK,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,yBAAyB;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,MAAmB,EACnB,QAAuC;IAEvC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,0DAA0D;IAC1H,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAO,MAAM,CAAC,MAEtB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,qBAAqB,CAChC,QAA8C,EAC9C,CAAC,EACD,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAC5F,CAAC;QACF,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,QAAQ,EAAE,QAAmC,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9G,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzD,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,WAAW,CAAI,MAAmB,EAAE,OAA0B,EAAE,QAAyB,EAAE,QAA4B;IACpI,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3H,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1D,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpH,CAAC;AACH,CAAC;AACD,KAAK,UAAU,aAAa,CAAI,MAAmB,EAAE,OAA0B,EAAE,QAAuC,EAAE,OAAqB,EAAE,WAAoB,EAAE,QAA4B;IACjM,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACrG,CAAC;AACH,CAAC;AACD,SAAS,OAAO,CAAI,OAAqB,EAAE,WAAoB;IAC7D,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,SAAiC;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,MAAM,GAAI,CAA0B,CAAC,MAAM,CAAC;QAClD,MAAM,KAAK,GAAI,CAAyB,CAAC,KAAK,CAAC;QAC/C,OAAO,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9G,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,SAAS,kBAAkB,CAAC,KAAY,EAAE,KAAa;IACrD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAwB,EACxB,cAAiC,EACjC,MAAmB;IAEnB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC;IAEjD,+EAA+E;IAC/E,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,sCAAsC;IAE7E,oFAAoF;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC;IACpD,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,kGAAkG;IAClG,MAAM,kBAAkB,GAAG,MAAM,CAAC,wBAAwB,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI;WAC/F,CAAC,CAAC,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;IAE7G,uFAAuF;IACvF,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,MAAM,OAAO,GAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChJ,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/E,CAAC;IAED,qGAAqG;IACrG,qGAAqG;IACrG,wFAAwF;IACxF,sGAAsG;IACtG,sGAAsG;IACtG,iGAAiG;IACjG,oGAAoG;IACpG,qGAAqG;IACrG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7H,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,sDAAsD;IACtD,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACxC,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED,2DAA2D;IAC3D,MAAM,OAAO,GAAG;QACd,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QACnH,gBAAgB,EAAE,SAA+B;QACjD,eAAe,EAAE,SAA+B;KACjD,CAAC;IAEF,+EAA+E;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,SAAS,CAAC;IAChD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAC7D,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErD,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,iFAAiF;QACjF,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAuB,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;YAC7H,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,eAAe;QACf,MAAM,UAAU,GAAG,EAAE,CAAC,KAA0B,CAAC;QACjD,IAAI,UAAU,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAClG,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;YACnI,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1C,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClG,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC7J,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB;YACvG,CAAC;YACD,iEAAiE;QACnE,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACpG,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7G,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,iFAAiF;IACjF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxD,uDAAuD;QACvD,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC;IAE7B,gDAAgD;IAChD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEpC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACrC,MAAM,eAAe,GAAG,CAAC,CAAC,QAAQ,CAAC;IACnC,IAAI,CAAC,eAAe;QAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAEpH,qGAAqG;IACrG,iGAAiG;IACjG,mGAAmG;IACnG,+FAA+F;IAC/F,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACnF,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,IAAI,oBAAoB,EAAE,UAAU,CAAC,CAAC;IACvF,CAAC;IAED,mGAAmG;IACnG,+FAA+F;IAC/F,mGAAmG;IACnG,mGAAmG;IACnG,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAA8C,EAAE,EAAE,CAAC,eAAe,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACpI,IAAI,IAAI,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QACnC,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACpC,kGAAkG;QAClG,OAAO,IAAI,CAAC,QAAQ,KAAK,OAAO;YAC9B,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC;YAC7E,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,yEAAyE;IAEjG,uFAAuF;IACvF,IAAI,OAAO,EAAE,CAAC;QAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAAC,CAAC;IAErG,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,iDAAiD;IACrF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,SAAS;YAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;;YACrG,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,+FAA+F;IAC/F,sGAAsG;IACtG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAiB,IAAI,KAAK,OAAO;YAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE;YAClE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QACvF,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,oGAAoG;IACpG,kGAAkG;IAClG,kGAAkG;IAClG,iFAAiF;IACjF,MAAM,WAAW,GAAG,eAAe,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,CAAC;IACvE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAoB,IAAI,KAAK,OAAO;YAChD,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE;YACxE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAC7F,OAAO,WAAW,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IACD,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,eAAe,CAAI,MAAmB,EAAE,KAAqB,EAAE,UAAqC;IAC3G,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IACjG,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS,CAAC,QAAgC;IACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC9C,CAAC;AAED;wGACwG;AACxG,KAAK,UAAU,MAAM,CAAC,MAAmB,EAAE,OAAe;IACxD,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,MAAqC,CAAC;IAC1C,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,mGAAmG;IACnG,gGAAgG;IAChG,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,qGAAqG;IACrG,oGAAoG;IACpG,MAAM,GAAG,GAAI,MAAM,CAAC,QAAmB,IAAI,EAAE,CAAC;IAC9C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IACzE,mGAAmG;IACnG,MAAM,QAAQ,GAAmB;QAC9B,MAA6C,CAAC,YAAY;QAC1D,MAA6C,CAAC,WAAW;QACzD,MAA6C,CAAC,SAAS;QACvD,MAA6C,CAAC,QAAQ;KACxD,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IACnG,MAAM,MAAM,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACzE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/esm/index.d.ts

@@ -19,6 +19,17 @@
  */
 export { guardToolCall } from './guard.js';
 export { builtinDetector, DETECTOR_VERSION } from './detector.js';
+export { bindReceiptToEnvelope, computeBodyHash, canonicalJson } from './receipt-binding.js';
+export type { BindResult, BindCause, BindContext, VerifyReceiptResultLike } from './receipt-binding.js';
+export { evaluateEnvelope, computeArtifactDigest, computeBundleFingerprint } from './enforcement-gate.js';
+export type { GateResult } from './enforcement-gate.js';
 export { readDecision } from '@coderifts/sdk';
+export { SessionTaintTracker, SESSION_TAINT_VERSION, updateSession, evaluate, computeTainted, emptySessionState, projectState, classifyCommand, pathClass, deriveKeySignal, } from './session-taint.js';
+export type { SessionState, SessionTaintConfig, SessionTaintObservation, SessionEval, PendingRename, PathClass, CmdClass, } from './session-taint.js';
 export type { ReceiptVerifiedEnvelope, GuardConfig, ToolCallDescriptor, ExecuteFactory, ApprovedVerdict, GuardOutcome, GuardVerdict, UnavailableVerdict, AvailabilityCause, IntegrityCause, UnavailableCause, TriggerDetector, LkgStore, GuardEvent, CodeRifts, DecisionResultEnvelope, ExecutionAction, Artifact, } from './types.js';
+export { resolve as resolveArtifacts } from './artifact-resolver.js';
+export type { ResolveInput, ResolveConfig, ResolveResult, ResolvedArtifact, ResolveCoverage, UnresolvedEntry, UnresolvedReason, BlobValue, SsotSelection, ArtifactType as ResolverArtifactType, } from './artifact-resolver.js';
+export { matchGlob, globToRegExp } from './resolver-glob.js';
+export { guardToolRegistry, RegistryConstructionError } from './tool-registry.js';
+export type { RawTool, ProtectedTool, ToolMutationClass, EnforcementCoverage, RegistryCoverageReport, GuardToolRegistryConfig, RegistryResult, ToolBinder, RegistryConstructionErrorCode, } from './tool-registry.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,GACT,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAGxG,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,GACT,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC"}

package/dist/esm/index.js

@@ -19,5 +19,18 @@
  */
 export { guardToolCall } from './guard.js';
 export { builtinDetector, DETECTOR_VERSION } from './detector.js';
+// P0 receipt-substitution fix: client-side receipt→envelope binding (mirrors server §106).
+export { bindReceiptToEnvelope, computeBodyHash, canonicalJson } from './receipt-binding.js';
+// P0-b/c client-enforcement gate: decision↔action reconciliation, §111 degraded, §115 safe_for_agent,
+// and local artifact_digest / input_fingerprint recomputation.
+export { evaluateEnvelope, computeArtifactDigest, computeBundleFingerprint } from './enforcement-gate.js';
 export { readDecision } from '@coderifts/sdk';
+// Additive session-taint surface (SEPARATE from the frozen single-call detector; own version).
+export { SessionTaintTracker, SESSION_TAINT_VERSION, updateSession, evaluate, computeTainted, emptySessionState, projectState, classifyCommand, pathClass, deriveKeySignal, } from './session-taint.js';
+// artifactResolver — automatic base/head contract artifacts from a pure git snapshot (upstream of
+// preflight; produces artifacts, never decides). Companion to MISSING_ARTIFACT_CONTENT.
+export { resolve as resolveArtifacts } from './artifact-resolver.js';
+export { matchGlob, globToRegExp } from './resolver-glob.js';
+// guardToolRegistry — the agent-runtime inescapability layer ABOVE guardToolCall (Placement A only).
+export { guardToolRegistry, RegistryConstructionError } from './tool-registry.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,2FAA2F;AAC3F,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE7F,sGAAsG;AACtG,+DAA+D;AAC/D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,+FAA+F;AAC/F,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AA0B5B,kGAAkG;AAClG,wFAAwF;AACxF,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAKrE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7D,qGAAqG;AACrG,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/esm/receipt-binding.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Client-side receipt→envelope BINDING (P0 fix: receipt-substitution).
+ *
+ * A valid receipt authenticates a decision the SERVER signed — it does NOT authenticate whatever
+ * envelope an attacker wraps around it. Before executing with enforced:true, the guard must bind the
+ * receipt to THIS envelope by LOCALLY RECOMPUTING the canonical decision body hash and comparing it
+ * to the receipt's SIGNED `bh` (never trusting the envelope's own claimed `decision_body_hash`, which
+ * an attacker rewrites). This mirrors the server's §106 isCurrentlyAuthorized binding, applied in the
+ * client — the guard is the component that authorizes execution, so the binding must live here too.
+ *
+ * The canonicalization is ported VERBATIM from the server's canonical-json.js + decision-result.js
+ * computeBodyHash so the recomputed hash is byte-identical to the server's decision_body_hash.
+ */
+/**
+ * RFC 8785 (JCS) canonical JSON for the envelope domain (ASCII keys, JSON-representable scalars).
+ * Ported verbatim from the server canonicalizer so client + server hash identically.
+ */
+export declare function canonicalJson(value: unknown): string;
+/**
+ * decision_body_hash = 'sha256:' + sha256(canonicalJson(envelope MINUS receipt MINUS
+ * decision_body_hash)). Recomputed LOCALLY from the presented envelope so a rewritten field can
+ * never pass — identical algorithm to the server's decision-result.js computeBodyHash.
+ */
+export declare function computeBodyHash(envelope: Record<string, unknown>): string;
+/** Minimal shape of the SDK verifyReceipt result the binding consumes. */
+export interface VerifyReceiptResultLike {
+    valid?: boolean;
+    status?: string;
+    reason?: string | null;
+    payload?: Record<string, unknown>;
+}
+/** Host context the receipt scope must match (from GuardConfig). */
+export interface BindContext {
+    operation?: string;
+    environment?: string;
+    audience?: string;
+}
+export type BindCause = 'RECEIPT_UNVERIFIED' | 'RECEIPT_ENVELOPE_MISMATCH';
+export interface BindResult {
+    ok: boolean;
+    cause?: BindCause;
+    detail?: string;
+}
+/**
+ * Bind a verified receipt to THIS envelope. Fail-closed on ANY mismatch. Ordered checks:
+ *  1. valid === true                              (bad signature → RECEIPT_UNVERIFIED)
+ *  2. status === 'VERIFIED_CURRENT'               (expired / superseded / wrong-audience / wrong-env
+ *                                                  / scope-mismatch → RECEIPT_ENVELOPE_MISMATCH)
+ *  3. signed bh === LOCALLY-recomputed body hash  (the anti-substitution anchor — binds the ENTIRE
+ *                                                  decision body incl. decision/execution_action/fp)
+ *  4. signed fp === envelope.fingerprint          (explicit fingerprint binding)
+ *  5. operation / environment / audience scope    (when the AUTHENTICATED envelope carries them —
+ *                                                  bh already binds their presence/value)
+ *
+ * @param envelope  the presented decision envelope (attacker-influenced; NOT trusted for bh/fp)
+ * @param vr        the SDK verifyReceipt result ({ valid, status, payload:{ fp, bh, … } })
+ * @param ctx       host operation/environment/audience the receipt must match
+ */
+export declare function bindReceiptToEnvelope(envelope: Record<string, unknown> | null | undefined, vr: VerifyReceiptResultLike | null | undefined, ctx?: BindContext): BindResult;
+//# sourceMappingURL=receipt-binding.d.ts.map

package/dist/esm/receipt-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-binding.d.ts","sourceRoot":"","sources":["../../src/receipt-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAwBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAKzE;AAED,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,oEAAoE;AACpE,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG,2BAA2B,CAAC;AAE3E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACpD,EAAE,EAAE,uBAAuB,GAAG,IAAI,GAAG,SAAS,EAC9C,GAAG,GAAE,WAAgB,GACpB,UAAU,CAkCZ"}

package/dist/esm/receipt-binding.js

@@ -0,0 +1,105 @@
+/**
+ * Client-side receipt→envelope BINDING (P0 fix: receipt-substitution).
+ *
+ * A valid receipt authenticates a decision the SERVER signed — it does NOT authenticate whatever
+ * envelope an attacker wraps around it. Before executing with enforced:true, the guard must bind the
+ * receipt to THIS envelope by LOCALLY RECOMPUTING the canonical decision body hash and comparing it
+ * to the receipt's SIGNED `bh` (never trusting the envelope's own claimed `decision_body_hash`, which
+ * an attacker rewrites). This mirrors the server's §106 isCurrentlyAuthorized binding, applied in the
+ * client — the guard is the component that authorizes execution, so the binding must live here too.
+ *
+ * The canonicalization is ported VERBATIM from the server's canonical-json.js + decision-result.js
+ * computeBodyHash so the recomputed hash is byte-identical to the server's decision_body_hash.
+ */
+import { createHash } from 'node:crypto';
+/**
+ * RFC 8785 (JCS) canonical JSON for the envelope domain (ASCII keys, JSON-representable scalars).
+ * Ported verbatim from the server canonicalizer so client + server hash identically.
+ */
+export function canonicalJson(value) {
+    return encode(value);
+}
+function encode(value) {
+    if (value === null)
+        return 'null';
+    const t = typeof value;
+    if (t === 'boolean' || t === 'string')
+        return JSON.stringify(value);
+    if (t === 'number') {
+        if (!Number.isFinite(value))
+            throw new TypeError('canonicalJson: non-finite number is not representable');
+        return JSON.stringify(value);
+    }
+    if (t === 'undefined')
+        throw new TypeError('canonicalJson: undefined is not representable (omit the key instead)');
+    if (Array.isArray(value))
+        return `[${value.map(encode).join(',')}]`;
+    if (t === 'object') {
+        const obj = value;
+        const keys = Object.keys(obj).sort();
+        return `{${keys.map((k) => `${JSON.stringify(k)}:${encode(obj[k])}`).join(',')}}`;
+    }
+    throw new TypeError(`canonicalJson: unsupported type ${t}`);
+}
+function sha256hex(s) {
+    return createHash('sha256').update(s).digest('hex');
+}
+/**
+ * decision_body_hash = 'sha256:' + sha256(canonicalJson(envelope MINUS receipt MINUS
+ * decision_body_hash)). Recomputed LOCALLY from the presented envelope so a rewritten field can
+ * never pass — identical algorithm to the server's decision-result.js computeBodyHash.
+ */
+export function computeBodyHash(envelope) {
+    const rest = { ...envelope };
+    delete rest.receipt;
+    delete rest.decision_body_hash;
+    return `sha256:${sha256hex(canonicalJson(rest))}`;
+}
+/**
+ * Bind a verified receipt to THIS envelope. Fail-closed on ANY mismatch. Ordered checks:
+ *  1. valid === true                              (bad signature → RECEIPT_UNVERIFIED)
+ *  2. status === 'VERIFIED_CURRENT'               (expired / superseded / wrong-audience / wrong-env
+ *                                                  / scope-mismatch → RECEIPT_ENVELOPE_MISMATCH)
+ *  3. signed bh === LOCALLY-recomputed body hash  (the anti-substitution anchor — binds the ENTIRE
+ *                                                  decision body incl. decision/execution_action/fp)
+ *  4. signed fp === envelope.fingerprint          (explicit fingerprint binding)
+ *  5. operation / environment / audience scope    (when the AUTHENTICATED envelope carries them —
+ *                                                  bh already binds their presence/value)
+ *
+ * @param envelope  the presented decision envelope (attacker-influenced; NOT trusted for bh/fp)
+ * @param vr        the SDK verifyReceipt result ({ valid, status, payload:{ fp, bh, … } })
+ * @param ctx       host operation/environment/audience the receipt must match
+ */
+export function bindReceiptToEnvelope(envelope, vr, ctx = {}) {
+    if (!envelope)
+        return { ok: false, cause: 'RECEIPT_ENVELOPE_MISMATCH', detail: 'no envelope' };
+    if (!vr || vr.valid !== true)
+        return { ok: false, cause: 'RECEIPT_UNVERIFIED', detail: `valid=${vr ? vr.valid : 'none'}` };
+    if (vr.status !== 'VERIFIED_CURRENT') {
+        return { ok: false, cause: 'RECEIPT_ENVELOPE_MISMATCH', detail: `status ${vr.status ?? 'unknown'} != VERIFIED_CURRENT` };
+    }
+    const payload = (vr.payload || {});
+    // 3. LOCAL body-hash recomputation — the load-bearing anti-substitution check.
+    const localBh = computeBodyHash(envelope);
+    if (typeof payload.bh !== 'string' || payload.bh !== localBh) {
+        return { ok: false, cause: 'RECEIPT_ENVELOPE_MISMATCH', detail: 'decision_body_hash mismatch (receipt was signed over a different envelope)' };
+    }
+    // 4. Signed fingerprint must bind the envelope's fingerprint.
+    if (typeof payload.fp !== 'string' || payload.fp !== envelope.fingerprint) {
+        return { ok: false, cause: 'RECEIPT_ENVELOPE_MISMATCH', detail: 'verdict_fingerprint mismatch' };
+    }
+    // 5. Scope: operation / environment / audience (bh already authenticates these values; this asserts
+    //    the receipt was issued for the CURRENTLY-REQUESTED context — the merge≠deploy / §106 rule).
+    const requestedOp = ctx.operation ?? 'tool_call';
+    if (envelope.operation != null && requestedOp != null && envelope.operation !== requestedOp) {
+        return { ok: false, cause: 'RECEIPT_ENVELOPE_MISMATCH', detail: `operation ${String(envelope.operation)} != ${String(requestedOp)}` };
+    }
+    if (ctx.environment != null && envelope.environment != null && envelope.environment !== ctx.environment) {
+        return { ok: false, cause: 'RECEIPT_ENVELOPE_MISMATCH', detail: `environment ${String(envelope.environment)} != ${String(ctx.environment)}` };
+    }
+    if (ctx.audience != null && envelope.audience != null && envelope.audience !== ctx.audience) {
+        return { ok: false, cause: 'RECEIPT_ENVELOPE_MISMATCH', detail: `audience ${String(envelope.audience)} != ${String(ctx.audience)}` };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=receipt-binding.js.map

package/dist/esm/receipt-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-binding.js","sourceRoot":"","sources":["../../src/receipt-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,MAAM,CAAC,GAAG,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAe,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;QACpH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,KAAK,WAAW;QAAE,MAAM,IAAI,SAAS,CAAC,sEAAsE,CAAC,CAAC;IACnH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpE,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAiC;IAC/D,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC;IACpB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IAC/B,OAAO,UAAU,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAyBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAoD,EACpD,EAA8C,EAC9C,MAAmB,EAAE;IAErB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC/F,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC3H,IAAI,EAAE,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,MAAM,IAAI,SAAS,sBAAsB,EAAE,CAAC;IAC3H,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;IAE9D,+EAA+E;IAC/E,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,4EAA4E,EAAE,CAAC;IACjJ,CAAC;IAED,8DAA8D;IAC9D,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACnG,CAAC;IAED,oGAAoG;IACpG,iGAAiG;IACjG,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,IAAI,WAAW,CAAC;IACjD,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,IAAI,WAAW,IAAI,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,aAAa,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;IACxI,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,IAAI,QAAQ,CAAC,WAAW,IAAI,IAAI,IAAI,QAAQ,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;QACxG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,eAAe,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;IAChJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,YAAY,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;IACvI,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/esm/resolver-glob.d.ts

@@ -0,0 +1,15 @@
+/**
+ * resolver-glob — a correct POSIX-path glob matcher for SSOT selection (§5). The naive `fnmatch`
+ * fails on the double-star token (which must span zero-or-more path segments); this handles it (plus
+ * `*` / `?`) precisely so a `generated` double-star pattern matches `generated/x.json`,
+ * `a/generated/b.yaml`, etc., but not `src/x.yaml`.
+ */
+/** Compile a glob to an anchored RegExp. Double-star spans segments; `*`/`?` stay within a segment. */
+export declare function globToRegExp(glob: string): RegExp;
+/** True iff `path` matches `glob`. */
+export declare function matchGlob(glob: string, path: string): boolean;
+/** True iff `path` matches ANY of the globs (also accepts an exact-path equality). */
+export declare function matchAny(globs: string[] | undefined, path: string): boolean;
+/** Index of the FIRST glob matching `path` (exact or glob), else -1 (first-match-wins). */
+export declare function firstMatchIndex(globs: string[] | undefined, path: string): number;
+//# sourceMappingURL=resolver-glob.d.ts.map

package/dist/esm/resolver-glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-glob.d.ts","sourceRoot":"","sources":["../../src/resolver-glob.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,uGAAuG;AACvG,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBjD;AAED,sCAAsC;AACtC,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAG3E;AAED,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjF"}

package/dist/esm/resolver-glob.js

@@ -0,0 +1,59 @@
+/**
+ * resolver-glob — a correct POSIX-path glob matcher for SSOT selection (§5). The naive `fnmatch`
+ * fails on the double-star token (which must span zero-or-more path segments); this handles it (plus
+ * `*` / `?`) precisely so a `generated` double-star pattern matches `generated/x.json`,
+ * `a/generated/b.yaml`, etc., but not `src/x.yaml`.
+ */
+/** Compile a glob to an anchored RegExp. Double-star spans segments; `*`/`?` stay within a segment. */
+export function globToRegExp(glob) {
+    let re = '';
+    for (let i = 0; i < glob.length; i += 1) {
+        const c = glob[i];
+        if (c === '*') {
+            if (glob[i + 1] === '*') {
+                i += 1;
+                if (glob[i + 1] === '/') {
+                    re += '(?:.*/)?';
+                    i += 1;
+                }
+                else {
+                    re += '.*';
+                }
+            }
+            else {
+                re += '[^/]*';
+            }
+        }
+        else if (c === '?') {
+            re += '[^/]';
+        }
+        else if ('.+^${}()|[]\\'.includes(c)) {
+            re += `\\${c}`;
+        }
+        else {
+            re += c;
+        }
+    }
+    return new RegExp(`^${re}$`);
+}
+/** True iff `path` matches `glob`. */
+export function matchGlob(glob, path) {
+    return globToRegExp(glob).test(path);
+}
+/** True iff `path` matches ANY of the globs (also accepts an exact-path equality). */
+export function matchAny(globs, path) {
+    if (!Array.isArray(globs))
+        return false;
+    return globs.some((g) => g === path || matchGlob(g, path));
+}
+/** Index of the FIRST glob matching `path` (exact or glob), else -1 (first-match-wins). */
+export function firstMatchIndex(globs, path) {
+    if (!Array.isArray(globs))
+        return -1;
+    for (let i = 0; i < globs.length; i += 1) {
+        if (globs[i] === path || matchGlob(globs[i], path))
+            return i;
+    }
+    return -1;
+}
+//# sourceMappingURL=resolver-glob.js.map

package/dist/esm/resolver-glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-glob.js","sourceRoot":"","sources":["../../src/resolver-glob.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,uGAAuG;AACvG,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,EAAE,IAAI,UAAU,CAAC;oBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;qBAAM,CAAC;oBAAC,EAAE,IAAI,IAAI,CAAC;gBAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,KAA2B,EAAE,IAAY;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,eAAe,CAAC,KAA2B,EAAE,IAAY;IACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC"}

package/dist/esm/resolver-yaml.d.ts

@@ -0,0 +1,20 @@
+/**
+ * resolver-yaml — a MINIMAL, deterministic YAML/JSON reader for the artifact resolver's $ref bundler.
+ *
+ * The guard package has no YAML dependency; the resolver only needs to parse the constrained YAML
+ * that appears in OpenAPI/AsyncAPI contract docs (block mappings, flow mappings, quoted keys, scalar
+ * values, and `$ref` strings) to inline external file refs into a deterministic JSON bundle (§4.3).
+ * It is NOT a general YAML engine — anything outside the supported subset throws, and the resolver
+ * turns that into a `parse_error` unresolved entry (never a fabricated document).
+ *
+ * Determinism: plain scalars are kept as raw strings (no lossy type coercion), so parse→serialize is
+ * byte-stable per input.
+ */
+export declare class YamlLiteError extends Error {
+    constructor(message: string);
+}
+/** Parse a JSON or (subset) YAML document to a plain JS value. Throws YamlLiteError on unsupported input. */
+export declare function parseDoc(text: string): unknown;
+/** Deterministic JSON serialization with recursively sorted object keys (byte-stable — §4.3, A6). */
+export declare function stableStringify(value: unknown): string;
+//# sourceMappingURL=resolver-yaml.d.ts.map

package/dist/esm/resolver-yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-yaml.d.ts","sourceRoot":"","sources":["../../src/resolver-yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAC5B;AAID,6GAA6G;AAC7G,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAc9C;AAiJD,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}