@coderifts/agent-guard 3.0.0 → 4.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +46 -1
- package/dist/cjs/artifact-resolver.d.ts +8 -0
- package/dist/cjs/artifact-resolver.d.ts.map +1 -1
- package/dist/cjs/artifact-resolver.js +12 -1
- package/dist/cjs/artifact-resolver.js.map +1 -1
- package/dist/cjs/deploy-bind.d.ts +123 -0
- package/dist/cjs/deploy-bind.d.ts.map +1 -0
- package/dist/cjs/deploy-bind.js +112 -0
- package/dist/cjs/deploy-bind.js.map +1 -0
- package/dist/cjs/enforcement-gate.d.ts +13 -4
- package/dist/cjs/enforcement-gate.d.ts.map +1 -1
- package/dist/cjs/enforcement-gate.js +32 -7
- package/dist/cjs/enforcement-gate.js.map +1 -1
- package/dist/cjs/execution-proof.d.ts +132 -0
- package/dist/cjs/execution-proof.d.ts.map +1 -0
- package/dist/cjs/execution-proof.js +157 -0
- package/dist/cjs/execution-proof.js.map +1 -0
- package/dist/cjs/freshness.d.ts +244 -0
- package/dist/cjs/freshness.d.ts.map +1 -0
- package/dist/cjs/freshness.js +395 -0
- package/dist/cjs/freshness.js.map +1 -0
- package/dist/cjs/guard.d.ts +7 -1
- package/dist/cjs/guard.d.ts.map +1 -1
- package/dist/cjs/guard.js +114 -38
- package/dist/cjs/guard.js.map +1 -1
- package/dist/cjs/index.d.ts +10 -4
- package/dist/cjs/index.d.ts.map +1 -1
- package/dist/cjs/index.js +28 -3
- package/dist/cjs/index.js.map +1 -1
- package/dist/cjs/read-decision.d.ts +47 -0
- package/dist/cjs/read-decision.d.ts.map +1 -0
- package/dist/cjs/read-decision.js +161 -0
- package/dist/cjs/read-decision.js.map +1 -0
- package/dist/cjs/tool-registry.d.ts.map +1 -1
- package/dist/cjs/tool-registry.js +12 -1
- package/dist/cjs/tool-registry.js.map +1 -1
- package/dist/cjs/types.d.ts +28 -1
- package/dist/cjs/types.d.ts.map +1 -1
- package/dist/cjs/with-coderifts.d.ts +70 -8
- package/dist/cjs/with-coderifts.d.ts.map +1 -1
- package/dist/cjs/with-coderifts.js +177 -14
- package/dist/cjs/with-coderifts.js.map +1 -1
- package/dist/esm/artifact-resolver.d.ts +8 -0
- package/dist/esm/artifact-resolver.d.ts.map +1 -1
- package/dist/esm/artifact-resolver.js +11 -1
- package/dist/esm/artifact-resolver.js.map +1 -1
- package/dist/esm/deploy-bind.d.ts +123 -0
- package/dist/esm/deploy-bind.d.ts.map +1 -0
- package/dist/esm/deploy-bind.js +108 -0
- package/dist/esm/deploy-bind.js.map +1 -0
- package/dist/esm/enforcement-gate.d.ts +13 -4
- package/dist/esm/enforcement-gate.d.ts.map +1 -1
- package/dist/esm/enforcement-gate.js +32 -7
- package/dist/esm/enforcement-gate.js.map +1 -1
- package/dist/esm/execution-proof.d.ts +132 -0
- package/dist/esm/execution-proof.d.ts.map +1 -0
- package/dist/esm/execution-proof.js +151 -0
- package/dist/esm/execution-proof.js.map +1 -0
- package/dist/esm/freshness.d.ts +244 -0
- package/dist/esm/freshness.d.ts.map +1 -0
- package/dist/esm/freshness.js +384 -0
- package/dist/esm/freshness.js.map +1 -0
- package/dist/esm/guard.d.ts +7 -1
- package/dist/esm/guard.d.ts.map +1 -1
- package/dist/esm/guard.js +113 -37
- package/dist/esm/guard.js.map +1 -1
- package/dist/esm/index.d.ts +10 -4
- package/dist/esm/index.d.ts.map +1 -1
- package/dist/esm/index.js +10 -2
- package/dist/esm/index.js.map +1 -1
- package/dist/esm/read-decision.d.ts +47 -0
- package/dist/esm/read-decision.d.ts.map +1 -0
- package/dist/esm/read-decision.js +153 -0
- package/dist/esm/read-decision.js.map +1 -0
- package/dist/esm/tool-registry.d.ts.map +1 -1
- package/dist/esm/tool-registry.js +12 -1
- package/dist/esm/tool-registry.js.map +1 -1
- package/dist/esm/types.d.ts +28 -1
- package/dist/esm/types.d.ts.map +1 -1
- package/dist/esm/with-coderifts.d.ts +70 -8
- package/dist/esm/with-coderifts.d.ts.map +1 -1
- package/dist/esm/with-coderifts.js +177 -14
- package/dist/esm/with-coderifts.js.map +1 -1
- package/package.json +2 -10
package/README.md
CHANGED
|
@@ -8,6 +8,22 @@ Security core **FROZEN** (agent-guard-api v1.0). Built on [`@coderifts/sdk`](htt
|
|
|
8
8
|
npm install @coderifts/agent-guard @coderifts/sdk
|
|
9
9
|
```
|
|
10
10
|
|
|
11
|
+
### Host git wiring (example in-repo, not in the tarball)
|
|
12
|
+
|
|
13
|
+
The package is pure: `resolveArtifacts` reads a host-supplied `blobs` map keyed by
|
|
14
|
+
`blobMapKey(ref, path)` (`${ref}:${path}`). Git I/O is the host’s job.
|
|
15
|
+
|
|
16
|
+
A **worked example** (injectable fake git, offline-runnable) lives in the git tree at
|
|
17
|
+
[`examples/host-git-resolve.mjs`](./examples/host-git-resolve.mjs) — it is **not**
|
|
18
|
+
published in the npm package (`files` is only `dist` + `README.md`), so the tarball
|
|
19
|
+
stays free of git/fs. Production PR artifact derivation:
|
|
20
|
+
[`coderifts/contract-gate`](https://github.com/coderifts/contract-gate) `src/artifacts.js`
|
|
21
|
+
(do not copy it here).
|
|
22
|
+
|
|
23
|
+
**TOCTOU is unclosed.** Resolving content proves what was true *at measurement time*;
|
|
24
|
+
a host that then writes unconditionally still races. Neither the example nor this
|
|
25
|
+
package supplies a version token or conditional write.
|
|
26
|
+
|
|
11
27
|
```typescript
|
|
12
28
|
import { guardToolCall } from '@coderifts/agent-guard';
|
|
13
29
|
import { CodeRifts } from '@coderifts/sdk';
|
|
@@ -202,13 +218,42 @@ That overstates coverage.
|
|
|
202
218
|
a report it produced alone would either guess the other three or assert they do not apply — neither is
|
|
203
219
|
honest, so the composition hands the caller the piece it owns and stops.
|
|
204
220
|
|
|
221
|
+
#### `deployGate` and deploy-time `bindDeploy`
|
|
222
|
+
|
|
223
|
+
`deployGate` is the pure decision. **`bindDeploy`** is the pure **caller** at the moment of
|
|
224
|
+
deploying: the host supplies `{ environment, artifact_id, receipt, pipeline_enforcement }`; the
|
|
225
|
+
package composes `deployGate` and returns a decision. No I/O, no receipt re-verify, no CD call.
|
|
226
|
+
|
|
227
|
+
Same shape as the merge gate (`gateDecision` is pure; GitHub enforces outside us). Deploy differs:
|
|
228
|
+
there is no PR status check to hang on, and **the environment name is a host assertion** — the
|
|
229
|
+
receipt’s `bound_environment` is signed evidence; the target environment string is not. A host can
|
|
230
|
+
claim `staging` while deploying to production; the package cannot tell. The result always reports
|
|
231
|
+
`environment.provenance: 'host_asserted'` (never `verified`).
|
|
232
|
+
|
|
233
|
+
```typescript
|
|
234
|
+
import { bindDeploy } from '@coderifts/agent-guard';
|
|
235
|
+
|
|
236
|
+
const r = bindDeploy({
|
|
237
|
+
environment: { name: 'production', provenance: 'host_asserted' },
|
|
238
|
+
artifact_id: digest,
|
|
239
|
+
receipt: receiptView, // finished view — not re-verified here
|
|
240
|
+
pipeline_enforcement: { enforcement: 'ENFORCING', bypass_possible: false },
|
|
241
|
+
});
|
|
242
|
+
// r.decision_allows_deploy — pure decision only
|
|
243
|
+
// r.pipeline_action — always 'not_observed' (we did not block or run the pipeline)
|
|
244
|
+
// r.environment.provenance — always 'host_asserted'
|
|
245
|
+
// r.inescapable_deploy — only true under ENFORCING ∧ ¬bypass (from the gate, not a host flag)
|
|
246
|
+
if (!r.decision_allows_deploy) process.exit(1); // host pipeline chooses to honour
|
|
247
|
+
```
|
|
248
|
+
|
|
205
249
|
#### `deployGate` is also the publish / register gate
|
|
206
250
|
|
|
207
251
|
`deployGate` gates any **artifact-bound application** operation — not only CD deploys. The target is
|
|
208
252
|
`{ environment, artifact_id }`; the operation label is `requiredContext.operation` (default
|
|
209
253
|
`'deploy'`). The receipt must have been issued for **that same** operation: merge is not deploy is not
|
|
210
254
|
publish. Binding checks are the same regardless of the label (environment + artifact match, allow-class
|
|
211
|
-
verdict, enforcement residual).
|
|
255
|
+
verdict, enforcement residual). Prefer **`bindDeploy`** at the live step; raw `deployGate` remains
|
|
256
|
+
for hosts that already build the full input.
|
|
212
257
|
|
|
213
258
|
```typescript
|
|
214
259
|
import { deployGate } from '@coderifts/agent-guard';
|
|
@@ -78,5 +78,13 @@ export type ResolveResult = {
|
|
|
78
78
|
* Returns null when the path is not a known contract-artifact name (e.g. README.md).
|
|
79
79
|
*/
|
|
80
80
|
export declare function classifyByName(path: string): ArtifactType | null;
|
|
81
|
+
/**
|
|
82
|
+
* Pure snapshot map key for a blob at a given ref and path.
|
|
83
|
+
*
|
|
84
|
+
* Format: `${ref}:${path}` — the same shape `git show <ref>:<path>` accepts.
|
|
85
|
+
* Hosts that build `ResolveInput.blobs` MUST use this helper (or an identical
|
|
86
|
+
* concatenation). Do not invent a second key scheme.
|
|
87
|
+
*/
|
|
88
|
+
export declare function blobMapKey(ref: string, path: string): string;
|
|
81
89
|
export declare function resolve(input: ResolveInput, config?: ResolveConfig): ResolveResult;
|
|
82
90
|
//# sourceMappingURL=artifact-resolver.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"artifact-resolver.d.ts","sourceRoot":"","sources":["../../src/artifact-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,GAAG,cAAc,CAAC;AAExF,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GAAG,oBAAoB,GAAG,WAAW,GAAG,oBAAoB,GAC7E,gBAAgB,GAAG,sBAAsB,GAAG,gBAAgB,GAAG,wBAAwB,GACvF,qBAAqB,GAAG,wBAAwB,GAAG,aAAa,CAAC;AAErE,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEpH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC;AAE9E,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,IAAI,GAAG;IAAE,KAAK,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,eAAe,GAAG,WAAW,CAAC;IAChD,oDAAoD;IACpD,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,yBAAyB,GAAG,QAAQ,CAAA;CAAE,CAAC;AAEhI,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE;QACN,OAAO,EAAE,8BAA8B,CAAC;QACxC,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,yBAAyB,EAAE,MAAM,EAAE,CAAC;QACpC,oBAAoB,EAAE,MAAM,EAAE,CAAC;QAC/B,eAAe,EAAE,aAAa,EAAE,CAAC;QACjC,KAAK,EAAE;YAAE,6BAA6B,EAAE,OAAO,CAAC;YAAC,gBAAgB,EAAE,KAAK,CAAA;SAAE,CAAC;KAC5E,CAAC;CACH,CAAC;AAoCF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAUhE;
|
|
1
|
+
{"version":3,"file":"artifact-resolver.d.ts","sourceRoot":"","sources":["../../src/artifact-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,GAAG,cAAc,CAAC;AAExF,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GAAG,oBAAoB,GAAG,WAAW,GAAG,oBAAoB,GAC7E,gBAAgB,GAAG,sBAAsB,GAAG,gBAAgB,GAAG,wBAAwB,GACvF,qBAAqB,GAAG,wBAAwB,GAAG,aAAa,CAAC;AAErE,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEpH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC;AAE9E,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,IAAI,GAAG;IAAE,KAAK,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,eAAe,GAAG,WAAW,CAAC;IAChD,oDAAoD;IACpD,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,yBAAyB,GAAG,QAAQ,CAAA;CAAE,CAAC;AAEhI,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE;QACN,OAAO,EAAE,8BAA8B,CAAC;QACxC,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,yBAAyB,EAAE,MAAM,EAAE,CAAC;QACpC,oBAAoB,EAAE,MAAM,EAAE,CAAC;QAC/B,eAAe,EAAE,aAAa,EAAE,CAAC;QACjC,KAAK,EAAE;YAAE,6BAA6B,EAAE,OAAO,CAAC;YAAC,gBAAgB,EAAE,KAAK,CAAA;SAAE,CAAC;KAC5E,CAAC;CACH,CAAC;AAoCF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAUhE;AA0GD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5D;AAoGD,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,GAAE,aAAkB,GAAG,aAAa,CAgGtF"}
|
|
@@ -14,6 +14,7 @@
|
|
|
14
14
|
*/
|
|
15
15
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
16
|
exports.classifyByName = classifyByName;
|
|
17
|
+
exports.blobMapKey = blobMapKey;
|
|
17
18
|
exports.resolve = resolve;
|
|
18
19
|
const resolver_yaml_js_1 = require("./resolver-yaml.js");
|
|
19
20
|
const resolver_glob_js_1 = require("./resolver-glob.js");
|
|
@@ -200,8 +201,18 @@ function assembleSide(rootPath, rootText, refSide, input, config, deps) {
|
|
|
200
201
|
return (0, resolver_yaml_js_1.stableStringify)(inlinedRoot);
|
|
201
202
|
}
|
|
202
203
|
// ── blob access ───────────────────────────────────────────────────────────────────────────────
|
|
204
|
+
/**
|
|
205
|
+
* Pure snapshot map key for a blob at a given ref and path.
|
|
206
|
+
*
|
|
207
|
+
* Format: `${ref}:${path}` — the same shape `git show <ref>:<path>` accepts.
|
|
208
|
+
* Hosts that build `ResolveInput.blobs` MUST use this helper (or an identical
|
|
209
|
+
* concatenation). Do not invent a second key scheme.
|
|
210
|
+
*/
|
|
211
|
+
function blobMapKey(ref, path) {
|
|
212
|
+
return `${ref}:${path}`;
|
|
213
|
+
}
|
|
203
214
|
function getBlob(input, ref, path) {
|
|
204
|
-
return input.blobs[
|
|
215
|
+
return input.blobs[blobMapKey(ref, path)];
|
|
205
216
|
}
|
|
206
217
|
function loadRoot(path, type, input, config) {
|
|
207
218
|
const baseBlob = getBlob(input, input.baseRef, path);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"artifact-resolver.js","sourceRoot":"","sources":["../../src/artifact-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAkGH,wCAUC;AA4MD,0BAgGC;AAtZD,yDAA8E;AAC9E,yDAA+D;AAwD/D,MAAM,iBAAiB,GAAG,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;AAC3D,MAAM,YAAY,GAAG,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;AAE5D,oGAAoG;AACpG,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AACD,SAAS,eAAe,CAAC,GAAW,EAAE,GAAW;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS;QACxC,IAAI,GAAG,KAAK,IAAI;YAAE,GAAG,CAAC,GAAG,EAAE,CAAC;;YACvB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,mGAAmG;AACnG;;;;GAIG;AACH,SAAgB,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,CAAC;IACnE,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnF,IAAI,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,oBAAoB;QAAE,OAAO,cAAc,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,iBAAiB,CAAC,IAAwB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtI,IAAI,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACpE,IAAI,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtF,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,aAAa,IAAK,CAAY,CAAC;YAAE,OAAO,cAAc,CAAC;IACvJ,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AACD,wGAAwG;AACxG,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC;AAC3E,CAAC;AAED,qGAAqG;AACrG,MAAM,MAAM,GAAG,0CAA0C,CAAC;AAC1D,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAyB,CAAC;IAC9B,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,aAAa,CAAC,GAAW,IAAa,OAAO,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrH,SAAS,aAAa,CAAC,GAAW,IAAa,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5E,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AACtG,CAAC;AACD,SAAS,WAAW,CAAC,GAAY,EAAE,OAAe;IAChD,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1G,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAK,GAA+B;YAAE,GAAG,GAAI,GAA+B,CAAC,IAAI,CAAC,CAAC;;YACxH,OAAO,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,OAAO,CAAC,CAAS,IAAY,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAEhF,MAAM,QAAS,SAAQ,KAAK;IAC1B,MAAM,CAAmB;IACzB,OAAO,CAAU;IACjB,YAAY,MAAwB,EAAE,OAAgB,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;CACzH;AAED,0GAA0G;AAC1G,SAAS,YAAY,CACnB,QAAgB,EAAE,QAAgB,EAAE,OAAe,EAAE,KAAmB,EAAE,MAAqB,EAAE,IAAiB;IAElH,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;IACzC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAA,2BAAQ,EAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,YAAY,gCAAa;YAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,UAAU,GAA4B,EAAE,CAAC;IAE/C,MAAM,MAAM,GAAG,CAAC,IAAa,EAAE,MAAc,EAAE,KAAa,EAAE,KAAkB,EAAW,EAAE;QAC3F,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACjF,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAA+B,CAAC;YAC5C,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;gBACrB,IAAI,aAAa,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B;gBAClG,IAAI,aAAa,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,uDAAuD;gBAClG,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACxC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACjD,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;gBACvC,IAAI,KAAK,GAAG,CAAC,GAAG,QAAQ;oBAAE,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;gBAC/E,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;gBAChE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;gBACjD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;oBAAE,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;gBAC9F,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBACzE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACrB,IAAI,SAAkB,CAAC;gBACvB,IAAI,CAAC;oBAAC,SAAS,GAAG,IAAA,2BAAQ,EAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;gBAAC,CAAC;gBAC5F,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACjD,IAAI,QAAQ,KAAK,SAAS;oBAAE,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;gBACjF,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC3F,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,UAAU,KAAK,OAAO,EAAE,CAAC,CAAC;gBAClD,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAAC;YAC1C,CAAC;YACD,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAChF,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAA4B,CAAC;IAC7F,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,UAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjJ,WAAW,CAAC,UAAU,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAA,kCAAe,EAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,iGAAiG;AACjG,SAAS,OAAO,CAAC,KAAmB,EAAE,GAAW,EAAE,IAAY;IAC7D,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAKD,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAkB,EAAE,KAAmB,EAAE,MAAqB;IAC5F,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAErD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IACtG,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IAEtG,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC;IAC7D,IAAI,QAAQ,IAAI,QAAQ;QAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,CAAC;IAE5F,IAAI,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,QAAmB,CAAC;IAClD,IAAI,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,QAAmB,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,QAAQ,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,eAAe,CAAC,KAAK,eAAe,CAAC;IAChI,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,IAAI,MAAM,KAAK,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9I,IAAI,KAAK,KAAK,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBAAE,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5I,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACnI,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACxF,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;AACpE,CAAC;AAKD,SAAS,YAAY,CAAC,UAAuB,EAAE,MAAqB,EAAE,cAAwB;IAE5F,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhJ,sDAAsD;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,oGAAoG;IACpG,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,2BAAQ,EAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;YAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAEjH,MAAM,UAAU,GAAoB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,+BAA+B;QAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAA,kCAAe,EAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QACvH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAE,CAAC,CAAC,CAAC;YAC3E,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACjH,SAAS;QACX,CAAC;QACD,qEAAqE;QACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,2BAAQ,EAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAE,CAAC,CAAC,CAAC;YAC3E,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC9H,SAAS;QACX,CAAC;QACD,qCAAqC;QACrC,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED,mGAAmG;AACnG,SAAgB,OAAO,CAAC,KAAmB,EAAE,SAAwB,EAAE;IACrE,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,iBAAiB,CAAC;IAElE,+CAA+C;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACxD,CAAC;IAED,6DAA6D;IAC7D,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAA,2BAAQ,EAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7D,IAAI,IAAI,GAAwB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,IAAI,KAAK,IAAI,IAAI,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAClG,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,yBAAyB,CAAC,CAAC,CAAC;gBAAE,IAAI,GAAG,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;;gBAChG,IAAI,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,IAAI,mBAAmB,GAAG,UAAU,CAAC;IAErC,iGAAiG;IACjG,IAAI,MAAM,CAAC,uBAAuB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrG,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,2BAAQ,EAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,OAAO;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC3F,mBAAmB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,2BAAQ,EAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qCAAqC;QAC1H,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAEvG,wFAAwF;IACxF,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,GAAG,IAAI,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACrC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI;oBAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,GAAG;gBAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;IAC3B,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;IAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,IAAI,QAAyB,CAAC;IAC9B,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,QAAQ,GAAG,OAAO,CAAC;SAChD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,WAAW;QAAE,QAAQ,GAAG,UAAU,CAAC;SAClE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,QAAQ,GAAG,SAAS,CAAC;;QAC3C,QAAQ,GAAG,YAAY,CAAC;IAE7B,uCAAuC;IACvC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnI,OAAO,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IAEjF,OAAO;QACL,SAAS;QACT,UAAU;QACV,QAAQ;QACR,MAAM,EAAE;YACN,OAAO,EAAE,8BAA8B;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,yBAAyB,EAAE,kBAAkB;YAC7C,oBAAoB,EAAE,OAAO;YAC7B,eAAe,EAAE,UAAU;YAC3B,KAAK,EAAE;gBACL,6BAA6B,EAAE,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,OAAO;gBAC9E,gBAAgB,EAAE,KAAK;aACxB;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAG,IAA+B;IAC1D,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,SAAS,WAAW,CAAC,CAAS,IAAa,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,SAAS,YAAY,CAAC,KAAmB,EAAE,IAAY;IACrD,OAAO,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC;AAC5H,CAAC"}
|
|
1
|
+
{"version":3,"file":"artifact-resolver.js","sourceRoot":"","sources":["../../src/artifact-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAkGH,wCAUC;AAiHD,gCAEC;AAoGD,0BAgGC;AAjaD,yDAA8E;AAC9E,yDAA+D;AAwD/D,MAAM,iBAAiB,GAAG,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;AAC3D,MAAM,YAAY,GAAG,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;AAE5D,oGAAoG;AACpG,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AACD,SAAS,eAAe,CAAC,GAAW,EAAE,GAAW;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS;QACxC,IAAI,GAAG,KAAK,IAAI;YAAE,GAAG,CAAC,GAAG,EAAE,CAAC;;YACvB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,mGAAmG;AACnG;;;;GAIG;AACH,SAAgB,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,CAAC;IACnE,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnF,IAAI,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,oBAAoB;QAAE,OAAO,cAAc,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,iBAAiB,CAAC,IAAwB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtI,IAAI,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACpE,IAAI,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtF,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,aAAa,IAAK,CAAY,CAAC;YAAE,OAAO,cAAc,CAAC;IACvJ,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AACD,wGAAwG;AACxG,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC;AAC3E,CAAC;AAED,qGAAqG;AACrG,MAAM,MAAM,GAAG,0CAA0C,CAAC;AAC1D,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAyB,CAAC;IAC9B,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,aAAa,CAAC,GAAW,IAAa,OAAO,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrH,SAAS,aAAa,CAAC,GAAW,IAAa,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5E,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AACtG,CAAC;AACD,SAAS,WAAW,CAAC,GAAY,EAAE,OAAe;IAChD,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1G,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAK,GAA+B;YAAE,GAAG,GAAI,GAA+B,CAAC,IAAI,CAAC,CAAC;;YACxH,OAAO,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,OAAO,CAAC,CAAS,IAAY,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAEhF,MAAM,QAAS,SAAQ,KAAK;IAC1B,MAAM,CAAmB;IACzB,OAAO,CAAU;IACjB,YAAY,MAAwB,EAAE,OAAgB,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;CACzH;AAED,0GAA0G;AAC1G,SAAS,YAAY,CACnB,QAAgB,EAAE,QAAgB,EAAE,OAAe,EAAE,KAAmB,EAAE,MAAqB,EAAE,IAAiB;IAElH,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;IACzC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAA,2BAAQ,EAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,YAAY,gCAAa;YAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,UAAU,GAA4B,EAAE,CAAC;IAE/C,MAAM,MAAM,GAAG,CAAC,IAAa,EAAE,MAAc,EAAE,KAAa,EAAE,KAAkB,EAAW,EAAE;QAC3F,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACjF,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAA+B,CAAC;YAC5C,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;gBACrB,IAAI,aAAa,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B;gBAClG,IAAI,aAAa,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,uDAAuD;gBAClG,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACxC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACjD,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;gBACvC,IAAI,KAAK,GAAG,CAAC,GAAG,QAAQ;oBAAE,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;gBAC/E,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;gBAChE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;gBACjD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;oBAAE,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;gBAC9F,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBACzE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACrB,IAAI,SAAkB,CAAC;gBACvB,IAAI,CAAC;oBAAC,SAAS,GAAG,IAAA,2BAAQ,EAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;gBAAC,CAAC;gBAC5F,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACjD,IAAI,QAAQ,KAAK,SAAS;oBAAE,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;gBACjF,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC3F,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,UAAU,KAAK,OAAO,EAAE,CAAC,CAAC;gBAClD,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAAC;YAC1C,CAAC;YACD,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAChF,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAA4B,CAAC;IAC7F,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,UAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjJ,WAAW,CAAC,UAAU,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAA,kCAAe,EAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,iGAAiG;AACjG;;;;;;GAMG;AACH,SAAgB,UAAU,CAAC,GAAW,EAAE,IAAY;IAClD,OAAO,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,OAAO,CAAC,KAAmB,EAAE,GAAW,EAAE,IAAY;IAC7D,OAAO,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAKD,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAkB,EAAE,KAAmB,EAAE,MAAqB;IAC5F,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAErD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IACtG,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IAEtG,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC;IAC7D,IAAI,QAAQ,IAAI,QAAQ;QAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,CAAC;IAE5F,IAAI,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,QAAmB,CAAC;IAClD,IAAI,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,QAAmB,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,QAAQ,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,eAAe,CAAC,KAAK,eAAe,CAAC;IAChI,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,IAAI,MAAM,KAAK,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9I,IAAI,KAAK,KAAK,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBAAE,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5I,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,QAAQ;gBAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACnI,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACxF,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;AACpE,CAAC;AAKD,SAAS,YAAY,CAAC,UAAuB,EAAE,MAAqB,EAAE,cAAwB;IAE5F,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhJ,sDAAsD;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,oGAAoG;IACpG,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,2BAAQ,EAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;YAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAEjH,MAAM,UAAU,GAAoB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,+BAA+B;QAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAA,kCAAe,EAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QACvH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAE,CAAC,CAAC,CAAC;YAC3E,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACjH,SAAS;QACX,CAAC;QACD,qEAAqE;QACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,2BAAQ,EAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAE,CAAC,CAAC,CAAC;YAC3E,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC9H,SAAS;QACX,CAAC;QACD,qCAAqC;QACrC,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED,mGAAmG;AACnG,SAAgB,OAAO,CAAC,KAAmB,EAAE,SAAwB,EAAE;IACrE,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,iBAAiB,CAAC;IAElE,+CAA+C;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACxD,CAAC;IAED,6DAA6D;IAC7D,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAA,2BAAQ,EAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7D,IAAI,IAAI,GAAwB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,IAAI,KAAK,IAAI,IAAI,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAClG,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,yBAAyB,CAAC,CAAC,CAAC;gBAAE,IAAI,GAAG,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;;gBAChG,IAAI,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,IAAI,mBAAmB,GAAG,UAAU,CAAC;IAErC,iGAAiG;IACjG,IAAI,MAAM,CAAC,uBAAuB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACrG,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,2BAAQ,EAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,OAAO;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC3F,mBAAmB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,2BAAQ,EAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qCAAqC;QAC1H,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAEvG,wFAAwF;IACxF,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,GAAG,IAAI,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACrC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI;oBAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,GAAG;gBAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;IAC3B,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;IAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,IAAI,QAAyB,CAAC;IAC9B,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,QAAQ,GAAG,OAAO,CAAC;SAChD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,WAAW;QAAE,QAAQ,GAAG,UAAU,CAAC;SAClE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,QAAQ,GAAG,SAAS,CAAC;;QAC3C,QAAQ,GAAG,YAAY,CAAC;IAE7B,uCAAuC;IACvC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnI,OAAO,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IAEjF,OAAO;QACL,SAAS;QACT,UAAU;QACV,QAAQ;QACR,MAAM,EAAE;YACN,OAAO,EAAE,8BAA8B;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,yBAAyB,EAAE,kBAAkB;YAC7C,oBAAoB,EAAE,OAAO;YAC7B,eAAe,EAAE,UAAU;YAC3B,KAAK,EAAE;gBACL,6BAA6B,EAAE,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,OAAO;gBAC9E,gBAAgB,EAAE,KAAK;aACxB;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAG,IAA+B;IAC1D,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,SAAS,WAAW,CAAC,CAAS,IAAa,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,SAAS,YAAY,CAAC,KAAmB,EAAE,IAAY;IACrD,OAAO,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC;AAC5H,CAAC"}
|
|
@@ -0,0 +1,123 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* bindDeploy — pure deploy-TIME composition over deployGate (#8).
|
|
3
|
+
*
|
|
4
|
+
* Why this exists: deployGate is the pure decision; nothing in this package used to
|
|
5
|
+
* invoke it at the moment of deploying. The merge gate has the same shape
|
|
6
|
+
* (gateDecision is pure; GitHub enforces via required checks the package does not
|
|
7
|
+
* control). Deploy generalises that pattern with two differences:
|
|
8
|
+
* 1. There is no pull request / required status check to hang on — the host must
|
|
9
|
+
* call this from the CD step itself.
|
|
10
|
+
* 2. The environment name is a HOST ASSERTION. The receipt's bound_environment is
|
|
11
|
+
* signed evidence; the deploy target's environment string is not verified by us.
|
|
12
|
+
* A host can claim "staging" while deploying to production. The output says so.
|
|
13
|
+
*
|
|
14
|
+
* This module performs NO I/O, does NOT re-verify receipts, and does NOT act on a
|
|
15
|
+
* pipeline. pipeline_action is always 'not_observed'. inescapable_deploy still comes
|
|
16
|
+
* only from deployGate (ENFORCING ∧ ¬bypass) — never flipped here.
|
|
17
|
+
*
|
|
18
|
+
* External note: coderifts-app CLI `deploy-gate` historically inlined a similar bind
|
|
19
|
+
* (deployBind). That is a consumer; this is the package-local pure entry hosts should
|
|
20
|
+
* call so the decision logic has a first-class caller in-repo.
|
|
21
|
+
*/
|
|
22
|
+
import { type DeployEnforcementState, type DeployGateDecision, type DeployGateReason, type DeployReceiptView, type GateStatusState } from './deploy-gate.js';
|
|
23
|
+
/** Reasons a fresh re-preflight for this { env, artifact } can repair. */
|
|
24
|
+
declare const REPAIRABLE: ReadonlySet<DeployGateReason>;
|
|
25
|
+
/**
|
|
26
|
+
* Environment as supplied by the host at deploy time.
|
|
27
|
+
*
|
|
28
|
+
* provenance is ALWAYS 'host_asserted'. The package cannot observe the real CD
|
|
29
|
+
* target; treating this as verified would be the honesty failure this project keeps
|
|
30
|
+
* finding. Signed evidence lives on the receipt (bound_environment), not here.
|
|
31
|
+
*/
|
|
32
|
+
export type HostAssertedEnvironment = {
|
|
33
|
+
name: string;
|
|
34
|
+
/** Fixed literal — never 'verified'. */
|
|
35
|
+
provenance: 'host_asserted';
|
|
36
|
+
};
|
|
37
|
+
export type BindDeployInput = {
|
|
38
|
+
/**
|
|
39
|
+
* Host-asserted deploy environment. Pass a string (wrapped as host_asserted) or
|
|
40
|
+
* an explicit HostAssertedEnvironment. Never reported as package-verified.
|
|
41
|
+
*/
|
|
42
|
+
environment: string | HostAssertedEnvironment;
|
|
43
|
+
/** Artifact / digest being deployed (host-supplied identity for this moment). */
|
|
44
|
+
artifact_id: string;
|
|
45
|
+
service?: string;
|
|
46
|
+
pipeline_run_id?: string;
|
|
47
|
+
/**
|
|
48
|
+
* Finished receipt VIEW (fields already produced + lifecycle-evaluated elsewhere).
|
|
49
|
+
* This function does not verify signatures or re-issue receipts. null → no_receipt.
|
|
50
|
+
*/
|
|
51
|
+
receipt: DeployReceiptView | null;
|
|
52
|
+
/**
|
|
53
|
+
* Host-observed pipeline enforcement (CD config / step policy). Same role as
|
|
54
|
+
* ProtectionState for merge — an input, not a package discovery.
|
|
55
|
+
*/
|
|
56
|
+
pipeline_enforcement: DeployEnforcementState;
|
|
57
|
+
/** Operation the receipt must match (default 'deploy'). */
|
|
58
|
+
operation?: string;
|
|
59
|
+
expected_fingerprint?: string;
|
|
60
|
+
expected_body_hash?: string;
|
|
61
|
+
allowPending?: boolean;
|
|
62
|
+
allowWarnDeploy?: boolean;
|
|
63
|
+
allowPrefixCompare?: boolean;
|
|
64
|
+
};
|
|
65
|
+
/**
|
|
66
|
+
* Result of a deploy-time bind. Distinguish carefully:
|
|
67
|
+
* - gate / decision_allows_deploy — pure decision from deployGate
|
|
68
|
+
* - pipeline_action — always 'not_observed' (we never block or run a deploy)
|
|
69
|
+
* - environment.provenance — always 'host_asserted' (we never verified the target)
|
|
70
|
+
*/
|
|
71
|
+
export type BindDeployResult = {
|
|
72
|
+
/** Full pure gate decision (includes inescapable_deploy, residual, detail). */
|
|
73
|
+
gate: DeployGateDecision;
|
|
74
|
+
/**
|
|
75
|
+
* Whether the pure decision allows deploy. Naming avoids "deploy was blocked"
|
|
76
|
+
* (that would claim pipeline enforcement). Same bit as gate.deploy_allowed.
|
|
77
|
+
*/
|
|
78
|
+
decision_allows_deploy: boolean;
|
|
79
|
+
/** Mirror of gate.state for check-run / step status UIs. */
|
|
80
|
+
deploy_check_status: GateStatusState;
|
|
81
|
+
/** Gate reason code (or no_receipt when receipt was null). */
|
|
82
|
+
reason: DeployGateReason;
|
|
83
|
+
/** Whether re-preflighting this target can repair a deny. */
|
|
84
|
+
must_re_preflight: boolean;
|
|
85
|
+
/**
|
|
86
|
+
* Environment as accepted into the gate. provenance is always host_asserted —
|
|
87
|
+
* never verified, never measured by this package.
|
|
88
|
+
*/
|
|
89
|
+
environment: HostAssertedEnvironment;
|
|
90
|
+
artifact_id: string;
|
|
91
|
+
/**
|
|
92
|
+
* Always 'not_observed'. The package does not run, block, or skip a pipeline
|
|
93
|
+
* step. Whether the host CD job exits non-zero on decision_allows_deploy:false
|
|
94
|
+
* is entirely the pipeline's business.
|
|
95
|
+
*/
|
|
96
|
+
pipeline_action: 'not_observed';
|
|
97
|
+
/**
|
|
98
|
+
* Convenience: inescapable_deploy from the gate only (never a host flag).
|
|
99
|
+
* True only when pipeline_enforcement is ENFORCING and bypass_possible is false
|
|
100
|
+
* AND the gate would allow — same honesty as deployGate.
|
|
101
|
+
*/
|
|
102
|
+
inescapable_deploy: boolean;
|
|
103
|
+
};
|
|
104
|
+
/**
|
|
105
|
+
* Pure deploy-time entry: bind host claims + finished receipt view into deployGate.
|
|
106
|
+
*
|
|
107
|
+
* @example
|
|
108
|
+
* ```ts
|
|
109
|
+
* const r = bindDeploy({
|
|
110
|
+
* environment: { name: 'production', provenance: 'host_asserted' },
|
|
111
|
+
* artifact_id: digest,
|
|
112
|
+
* receipt: receiptView,
|
|
113
|
+
* pipeline_enforcement: { enforcement: 'ENFORCING', bypass_possible: false },
|
|
114
|
+
* });
|
|
115
|
+
* // r.decision_allows_deploy — decision only
|
|
116
|
+
* // r.pipeline_action === 'not_observed' — we did not enforce
|
|
117
|
+
* // r.environment.provenance === 'host_asserted' — we did not verify the target name
|
|
118
|
+
* if (!r.decision_allows_deploy) process.exit(1); // host pipeline chooses to honour
|
|
119
|
+
* ```
|
|
120
|
+
*/
|
|
121
|
+
export declare function bindDeploy(input: BindDeployInput): BindDeployResult;
|
|
122
|
+
export { REPAIRABLE as DEPLOY_REPAIRABLE_REASONS };
|
|
123
|
+
//# sourceMappingURL=deploy-bind.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"deploy-bind.d.ts","sourceRoot":"","sources":["../../src/deploy-bind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAE1B,0EAA0E;AAC1E,QAAA,MAAM,UAAU,EAAE,WAAW,CAAC,gBAAgB,CAS5C,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,UAAU,EAAE,eAAe,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B;;;OAGG;IACH,WAAW,EAAE,MAAM,GAAG,uBAAuB,CAAC;IAC9C,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC;;;OAGG;IACH,oBAAoB,EAAE,sBAAsB,CAAC;IAC7C,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,+EAA+E;IAC/E,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC,4DAA4D;IAC5D,mBAAmB,EAAE,eAAe,CAAC;IACrC,8DAA8D;IAC9D,MAAM,EAAE,gBAAgB,CAAC;IACzB,6DAA6D;IAC7D,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,EAAE,uBAAuB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;CAC7B,CAAC;AAWF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAmDnE;AAED,OAAO,EAAE,UAAU,IAAI,yBAAyB,EAAE,CAAC"}
|
|
@@ -0,0 +1,112 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* bindDeploy — pure deploy-TIME composition over deployGate (#8).
|
|
4
|
+
*
|
|
5
|
+
* Why this exists: deployGate is the pure decision; nothing in this package used to
|
|
6
|
+
* invoke it at the moment of deploying. The merge gate has the same shape
|
|
7
|
+
* (gateDecision is pure; GitHub enforces via required checks the package does not
|
|
8
|
+
* control). Deploy generalises that pattern with two differences:
|
|
9
|
+
* 1. There is no pull request / required status check to hang on — the host must
|
|
10
|
+
* call this from the CD step itself.
|
|
11
|
+
* 2. The environment name is a HOST ASSERTION. The receipt's bound_environment is
|
|
12
|
+
* signed evidence; the deploy target's environment string is not verified by us.
|
|
13
|
+
* A host can claim "staging" while deploying to production. The output says so.
|
|
14
|
+
*
|
|
15
|
+
* This module performs NO I/O, does NOT re-verify receipts, and does NOT act on a
|
|
16
|
+
* pipeline. pipeline_action is always 'not_observed'. inescapable_deploy still comes
|
|
17
|
+
* only from deployGate (ENFORCING ∧ ¬bypass) — never flipped here.
|
|
18
|
+
*
|
|
19
|
+
* External note: coderifts-app CLI `deploy-gate` historically inlined a similar bind
|
|
20
|
+
* (deployBind). That is a consumer; this is the package-local pure entry hosts should
|
|
21
|
+
* call so the decision logic has a first-class caller in-repo.
|
|
22
|
+
*/
|
|
23
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
24
|
+
exports.DEPLOY_REPAIRABLE_REASONS = void 0;
|
|
25
|
+
exports.bindDeploy = bindDeploy;
|
|
26
|
+
const deploy_gate_js_1 = require("./deploy-gate.js");
|
|
27
|
+
/** Reasons a fresh re-preflight for this { env, artifact } can repair. */
|
|
28
|
+
const REPAIRABLE = new Set([
|
|
29
|
+
'env_mismatch',
|
|
30
|
+
'stale_artifact',
|
|
31
|
+
'operation_mismatch',
|
|
32
|
+
'receipt_not_authorized',
|
|
33
|
+
'fingerprint_mismatch',
|
|
34
|
+
'body_hash_mismatch',
|
|
35
|
+
'no_receipt',
|
|
36
|
+
'inputs_incomplete',
|
|
37
|
+
]);
|
|
38
|
+
exports.DEPLOY_REPAIRABLE_REASONS = REPAIRABLE;
|
|
39
|
+
function asHostAssertedEnvironment(env) {
|
|
40
|
+
if (typeof env === 'string') {
|
|
41
|
+
return { name: env, provenance: 'host_asserted' };
|
|
42
|
+
}
|
|
43
|
+
const name = env && typeof env.name === 'string' ? env.name : '';
|
|
44
|
+
// Force provenance — a host cannot pass provenance: 'verified' through this API.
|
|
45
|
+
return { name, provenance: 'host_asserted' };
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* Pure deploy-time entry: bind host claims + finished receipt view into deployGate.
|
|
49
|
+
*
|
|
50
|
+
* @example
|
|
51
|
+
* ```ts
|
|
52
|
+
* const r = bindDeploy({
|
|
53
|
+
* environment: { name: 'production', provenance: 'host_asserted' },
|
|
54
|
+
* artifact_id: digest,
|
|
55
|
+
* receipt: receiptView,
|
|
56
|
+
* pipeline_enforcement: { enforcement: 'ENFORCING', bypass_possible: false },
|
|
57
|
+
* });
|
|
58
|
+
* // r.decision_allows_deploy — decision only
|
|
59
|
+
* // r.pipeline_action === 'not_observed' — we did not enforce
|
|
60
|
+
* // r.environment.provenance === 'host_asserted' — we did not verify the target name
|
|
61
|
+
* if (!r.decision_allows_deploy) process.exit(1); // host pipeline chooses to honour
|
|
62
|
+
* ```
|
|
63
|
+
*/
|
|
64
|
+
function bindDeploy(input) {
|
|
65
|
+
const environment = asHostAssertedEnvironment(input.environment);
|
|
66
|
+
const artifact_id = input.artifact_id == null ? '' : String(input.artifact_id);
|
|
67
|
+
const operation = input.operation ?? 'deploy';
|
|
68
|
+
const deployTarget = {
|
|
69
|
+
environment: environment.name,
|
|
70
|
+
artifact_id,
|
|
71
|
+
...(input.service != null ? { service: input.service } : {}),
|
|
72
|
+
...(input.pipeline_run_id != null ? { pipeline_run_id: input.pipeline_run_id } : {}),
|
|
73
|
+
};
|
|
74
|
+
const requiredContext = {
|
|
75
|
+
operation,
|
|
76
|
+
enforcement: input.pipeline_enforcement || { enforcement: 'UNKNOWN', bypass_possible: true },
|
|
77
|
+
...(input.service != null ? { service: input.service } : {}),
|
|
78
|
+
...(input.expected_fingerprint != null
|
|
79
|
+
? { expected_fingerprint: input.expected_fingerprint }
|
|
80
|
+
: {}),
|
|
81
|
+
...(input.expected_body_hash != null
|
|
82
|
+
? { expected_body_hash: input.expected_body_hash }
|
|
83
|
+
: {}),
|
|
84
|
+
...(input.allowPending != null ? { allowPending: input.allowPending } : {}),
|
|
85
|
+
...(input.allowWarnDeploy != null ? { allowWarnDeploy: input.allowWarnDeploy } : {}),
|
|
86
|
+
...(input.allowPrefixCompare != null
|
|
87
|
+
? { allowPrefixCompare: input.allowPrefixCompare }
|
|
88
|
+
: {}),
|
|
89
|
+
};
|
|
90
|
+
const gate = (0, deploy_gate_js_1.deployGate)({
|
|
91
|
+
deployTarget,
|
|
92
|
+
receipt: input.receipt,
|
|
93
|
+
requiredContext,
|
|
94
|
+
...(input.allowPending != null ? { allowPending: input.allowPending } : {}),
|
|
95
|
+
...(input.allowWarnDeploy != null ? { allowWarnDeploy: input.allowWarnDeploy } : {}),
|
|
96
|
+
...(input.allowPrefixCompare != null
|
|
97
|
+
? { allowPrefixCompare: input.allowPrefixCompare }
|
|
98
|
+
: {}),
|
|
99
|
+
});
|
|
100
|
+
return {
|
|
101
|
+
gate,
|
|
102
|
+
decision_allows_deploy: gate.deploy_allowed === true,
|
|
103
|
+
deploy_check_status: gate.state,
|
|
104
|
+
reason: gate.reason,
|
|
105
|
+
must_re_preflight: REPAIRABLE.has(gate.reason),
|
|
106
|
+
environment, // always provenance: 'host_asserted'
|
|
107
|
+
artifact_id,
|
|
108
|
+
pipeline_action: 'not_observed',
|
|
109
|
+
inescapable_deploy: gate.inescapable_deploy === true,
|
|
110
|
+
};
|
|
111
|
+
}
|
|
112
|
+
//# sourceMappingURL=deploy-bind.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"deploy-bind.js","sourceRoot":"","sources":["../../src/deploy-bind.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AAoIH,gCAmDC;AArLD,qDAQ0B;AAE1B,0EAA0E;AAC1E,MAAM,UAAU,GAAkC,IAAI,GAAG,CAAC;IACxD,cAAc;IACd,gBAAgB;IAChB,oBAAoB;IACpB,wBAAwB;IACxB,sBAAsB;IACtB,oBAAoB;IACpB,YAAY;IACZ,mBAAmB;CACpB,CAAC,CAAC;AAmKoB,+CAAyB;AA/EhD,SAAS,yBAAyB,CAAC,GAAqC;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,iFAAiF;IACjF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,WAAW,GAAG,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC;IAE9C,MAAM,YAAY,GAAiB;QACjC,WAAW,EAAE,WAAW,CAAC,IAAI;QAC7B,WAAW;QACX,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC;IAEF,MAAM,eAAe,GAAG;QACtB,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,oBAAoB,IAAI,EAAE,WAAW,EAAE,SAAkB,EAAE,eAAe,EAAE,IAAI,EAAE;QACrG,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,IAAI;YACpC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,IAAI,GAAG,IAAA,2BAAU,EAAC;QACtB,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe;QACf,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,sBAAsB,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;QACpD,mBAAmB,EAAE,IAAI,CAAC,KAAK;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,iBAAiB,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9C,WAAW,EAAE,qCAAqC;QAClD,WAAW;QACX,eAAe,EAAE,cAAc;QAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,KAAK,IAAI;KACrD,CAAC;AACJ,CAAC"}
|
|
@@ -1,7 +1,14 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Client-side authorization gate (P0-b/c) — mirrors the server §106 (binding), §111 (fail-closed on
|
|
3
|
-
* degraded) and §115 (safe_for_agent) in the guard
|
|
4
|
-
*
|
|
3
|
+
* degraded) and §115 (safe_for_agent) in the guard. All checks are LOCAL and fail-closed.
|
|
4
|
+
*
|
|
5
|
+
* Threat model (bounded): a raw execution_action is not trusted alone when the response has NO
|
|
6
|
+
* receipt — without a signed decision_body_hash, a proxy or intermediary can flip fields. When a
|
|
7
|
+
* receipt IS present, decision_body_hash covers the RFC 8785-canonical envelope (minus receipt and
|
|
8
|
+
* the hash field itself) and the receipt signature covers that hash, so execution_action cannot be
|
|
9
|
+
* flipped without the recomputed hash diverging or a forged signature. The gate still reconciles
|
|
10
|
+
* decision↔action locally (stricter wins), fails closed on a PRESENT-but-unrecognised action
|
|
11
|
+
* (version skew — not a missing-action fallback), and never treats an unknown value as permission.
|
|
5
12
|
*
|
|
6
13
|
* Composes with the P0-a receipt binding (receipt-binding.ts). This module reconciles the DECISION
|
|
7
14
|
* itself; receipt-binding authenticates the envelope the decision rides on.
|
|
@@ -25,6 +32,8 @@ export type GateResult = {
|
|
|
25
32
|
};
|
|
26
33
|
/**
|
|
27
34
|
* Reconcile an envelope's decision fail-closed. Order:
|
|
35
|
+
* 0. execution_action PRESENT but not in closed set → EXECUTION_ACTION_UNRECOGNISED
|
|
36
|
+
* (version skew; distinct from DECISION_INCONSISTENT — reconciliation is impossible)
|
|
28
37
|
* 1. decision present + valid enum (CE-EP-04) → DECISION_INCONSISTENT
|
|
29
38
|
* 2. effective decision = STRICTEST(envelope.decision, action-implied, top-level decision/action)
|
|
30
39
|
* (CE-EP-01, CE-CC-01) — BLOCK/REQUIRE_APPROVAL → clean block (positive control CE-EP-02 kept)
|
|
@@ -34,9 +43,9 @@ export type GateResult = {
|
|
|
34
43
|
*
|
|
35
44
|
* @param response the raw preflight response (for the top-level decision/action, CE-CC-01)
|
|
36
45
|
* @param envelope the decision_result envelope
|
|
37
|
-
* @param executionAction rd.executionAction from readDecision
|
|
46
|
+
* @param executionAction rd.executionAction from readDecision (closed Action, or raw string if unrecognised)
|
|
38
47
|
* @param sentArtifacts the artifacts the guard sent to preflight (for the digest bind)
|
|
39
48
|
*/
|
|
40
|
-
export declare function evaluateEnvelope(response: unknown, envelope: Record<string, unknown>, executionAction: Action, sentArtifacts: Artifact[]): GateResult;
|
|
49
|
+
export declare function evaluateEnvelope(response: unknown, envelope: Record<string, unknown>, executionAction: Action | string, sentArtifacts: Artifact[]): GateResult;
|
|
41
50
|
export {};
|
|
42
51
|
//# sourceMappingURL=enforcement-gate.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"enforcement-gate.d.ts","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"enforcement-gate.d.ts","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3D,KAAK,MAAM,GAAG,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAoBpF,wGAAwG;AACxG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAMnE;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAKtE;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,OAAO,GAAG,kBAAkB,CAAA;CAAE,GACnE;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,eAAe,EAAE,MAAM,GAAG,MAAM,EAChC,aAAa,EAAE,QAAQ,EAAE,GACxB,UAAU,CAoEZ"}
|
|
@@ -1,8 +1,15 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
/**
|
|
3
3
|
* Client-side authorization gate (P0-b/c) — mirrors the server §106 (binding), §111 (fail-closed on
|
|
4
|
-
* degraded) and §115 (safe_for_agent) in the guard
|
|
5
|
-
*
|
|
4
|
+
* degraded) and §115 (safe_for_agent) in the guard. All checks are LOCAL and fail-closed.
|
|
5
|
+
*
|
|
6
|
+
* Threat model (bounded): a raw execution_action is not trusted alone when the response has NO
|
|
7
|
+
* receipt — without a signed decision_body_hash, a proxy or intermediary can flip fields. When a
|
|
8
|
+
* receipt IS present, decision_body_hash covers the RFC 8785-canonical envelope (minus receipt and
|
|
9
|
+
* the hash field itself) and the receipt signature covers that hash, so execution_action cannot be
|
|
10
|
+
* flipped without the recomputed hash diverging or a forged signature. The gate still reconciles
|
|
11
|
+
* decision↔action locally (stricter wins), fails closed on a PRESENT-but-unrecognised action
|
|
12
|
+
* (version skew — not a missing-action fallback), and never treats an unknown value as permission.
|
|
6
13
|
*
|
|
7
14
|
* Composes with the P0-a receipt binding (receipt-binding.ts). This module reconciles the DECISION
|
|
8
15
|
* itself; receipt-binding authenticates the envelope the decision rides on.
|
|
@@ -45,6 +52,8 @@ function computeBundleFingerprint(artifacts) {
|
|
|
45
52
|
}
|
|
46
53
|
/**
|
|
47
54
|
* Reconcile an envelope's decision fail-closed. Order:
|
|
55
|
+
* 0. execution_action PRESENT but not in closed set → EXECUTION_ACTION_UNRECOGNISED
|
|
56
|
+
* (version skew; distinct from DECISION_INCONSISTENT — reconciliation is impossible)
|
|
48
57
|
* 1. decision present + valid enum (CE-EP-04) → DECISION_INCONSISTENT
|
|
49
58
|
* 2. effective decision = STRICTEST(envelope.decision, action-implied, top-level decision/action)
|
|
50
59
|
* (CE-EP-01, CE-CC-01) — BLOCK/REQUIRE_APPROVAL → clean block (positive control CE-EP-02 kept)
|
|
@@ -54,18 +63,34 @@ function computeBundleFingerprint(artifacts) {
|
|
|
54
63
|
*
|
|
55
64
|
* @param response the raw preflight response (for the top-level decision/action, CE-CC-01)
|
|
56
65
|
* @param envelope the decision_result envelope
|
|
57
|
-
* @param executionAction rd.executionAction from readDecision
|
|
66
|
+
* @param executionAction rd.executionAction from readDecision (closed Action, or raw string if unrecognised)
|
|
58
67
|
* @param sentArtifacts the artifacts the guard sent to preflight (for the digest bind)
|
|
59
68
|
*/
|
|
60
69
|
function evaluateEnvelope(response, envelope, executionAction, sentArtifacts) {
|
|
70
|
+
const top = (response && typeof response === 'object') ? response : {};
|
|
71
|
+
// 0. PRESENT-but-unrecognised action — before any decision map or reconciliation.
|
|
72
|
+
// Missing action is not handled here (readDecision maps legacy missing → closed Action).
|
|
73
|
+
const candidates = [executionAction, envelope.execution_action, top.execution_action];
|
|
74
|
+
for (const cand of candidates) {
|
|
75
|
+
if (cand === undefined || cand === null || cand === '')
|
|
76
|
+
continue; // missing — skip
|
|
77
|
+
if (!isAction(cand)) {
|
|
78
|
+
return {
|
|
79
|
+
verdict: 'fail-closed',
|
|
80
|
+
cause: 'EXECUTION_ACTION_UNRECOGNISED',
|
|
81
|
+
detail: `execution_action=${JSON.stringify(cand)} is present but not in the closed set`,
|
|
82
|
+
};
|
|
83
|
+
}
|
|
84
|
+
}
|
|
61
85
|
// 1. decision required + valid enum.
|
|
62
86
|
const dec = envelope.decision;
|
|
63
87
|
if (!isDecision(dec)) {
|
|
64
88
|
return { verdict: 'fail-closed', cause: 'DECISION_INCONSISTENT', detail: `decision=${JSON.stringify(dec)} is missing/invalid` };
|
|
65
89
|
}
|
|
90
|
+
// Known closed action from here (step 0 rejected unknowns).
|
|
91
|
+
const action = executionAction;
|
|
66
92
|
// 2. Strictest of every decision signal present (envelope, action-implied, top-level).
|
|
67
|
-
const signals = [dec, ACTION_TO_DECISION[
|
|
68
|
-
const top = (response && typeof response === 'object') ? response : {};
|
|
93
|
+
const signals = [dec, ACTION_TO_DECISION[action]];
|
|
69
94
|
if (isDecision(top.decision))
|
|
70
95
|
signals.push(top.decision);
|
|
71
96
|
if (isAction(top.execution_action))
|
|
@@ -76,8 +101,8 @@ function evaluateEnvelope(response, envelope, executionAction, sentArtifacts) {
|
|
|
76
101
|
return { verdict: 'block-strict', decision: effective };
|
|
77
102
|
}
|
|
78
103
|
// (effective is ALLOW or WARN — but ALSO require the envelope's own action to agree, else tamper.)
|
|
79
|
-
if (DECISION_TO_ACTION[dec] !==
|
|
80
|
-
return { verdict: 'fail-closed', cause: 'DECISION_INCONSISTENT', detail: `decision=${dec} ≠ execution_action=${
|
|
104
|
+
if (DECISION_TO_ACTION[dec] !== action) {
|
|
105
|
+
return { verdict: 'fail-closed', cause: 'DECISION_INCONSISTENT', detail: `decision=${dec} ≠ execution_action=${action}` };
|
|
81
106
|
}
|
|
82
107
|
// 3. §115 — safe_for_agent=false is NEVER executable, regardless of action.
|
|
83
108
|
if (envelope.safe_for_agent === false) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"enforcement-gate.js","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":";AAAA
|
|
1
|
+
{"version":3,"file":"enforcement-gate.js","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AA2BH,sDAMC;AAGD,4DAKC;AAuBD,4CAyEC;AAvID,6CAAyC;AAMzC,MAAM,aAAa,GAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACrG,MAAM,kBAAkB,GAA6B;IACnD,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO;CACzG,CAAC;AACF,MAAM,kBAAkB,GAA6B;IACnD,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM;CACzG,CAAC;AACF,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,OAAO,CAAC;AACpF,CAAC;AACD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,0BAA0B,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,MAAM,CAAC;AAC1G,CAAC;AAED,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,sDAAsD;AAC1E,SAAS,SAAS,CAAC,CAAS,IAAY,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9F,SAAS,OAAO,CAAC,CAAU,IAAY,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH,wGAAwG;AACxG,SAAgB,qBAAqB,CAAC,SAAqB;IACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE;SAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;SAC3E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,UAAU,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,6FAA6F;AAC7F,SAAgB,wBAAwB,CAAC,SAAqB;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE;SAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,OAAO,UAAU,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAOD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,gBAAgB,CAC9B,QAAiB,EACjB,QAAiC,EACjC,eAAgC,EAChC,aAAyB;IAEzB,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElG,kFAAkF;IAClF,4FAA4F;IAC5F,MAAM,UAAU,GAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACjG,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS,CAAC,iBAAiB;QACnF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,aAAa;gBACtB,KAAK,EAAE,+BAA+B;gBACtC,MAAM,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,uCAAuC;aACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;IAClI,CAAC;IAED,4DAA4D;IAC5D,MAAM,MAAM,GAAG,eAAyB,CAAC;IAEzC,uFAAuF;IACvF,MAAM,OAAO,GAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;QAC/D,2FAA2F;QAC3F,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAyC,EAAE,CAAC;IAC1F,CAAC;IAED,mGAAmG;IACnG,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,GAAG,uBAAuB,MAAM,EAAE,EAAE,CAAC;IAC5H,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC/H,CAAC;IAED,mEAAmE;IACnE,MAAM,eAAe,GAAG,QAAQ,CAAC,gBAAgB,CAAC;IAClD,IAAI,QAAQ,CAAC,iBAAiB,KAAK,KAAK;WACjC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;WAC9D,QAAQ,CAAC,QAAQ,KAAK,IAAI;WAC1B,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAC1G,CAAC;IAED,6FAA6F;IAC7F,sGAAsG;IACtG,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;WACrD,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ;WAC5C,QAAQ,CAAC,eAAe,KAAK,qBAAqB,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IACzI,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACjF,CAAC"}
|