@coderifts/agent-guard 6.1.0 → 6.3.0

package/dist/cjs/cas-adapters/fs.js

@@ -0,0 +1,224 @@
+/**
+ * Filesystem CAS adapter — mtime + content-hash VersionToken and atomic-rename write.
+ *
+ * Uses the host contract helper executeIfUnchanged (conditional-write.ts). Does not invent
+ * a parallel outcome shape. Token format is opaque to the guard (string equality only).
+ *
+ * Token encoding (this adapter only; not interpreted by the core):
+ *   fs:v1:<mtime_ms>:<sha256_hex_of_file_bytes>
+ * Missing file → createFsVersionToken still works for "absent" via a dedicated absent token
+ * only if we choose; for create we require the file to exist (ENOENT throws) so hosts
+ * measure an existing prior. For write of new files, expected_token may be ABSENT_TOKEN.
+ */
+'use strict';
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokensEqual = exports.FS_ABSENT_TOKEN = exports.FS_VERSION_TOKEN_PREFIX = void 0;
+exports.fsTokenContentHash = fsTokenContentHash;
+exports.createFsVersionToken = createFsVersionToken;
+exports.readVersionedFile = readVersionedFile;
+exports.writeFileIfUnchanged = writeFileIfUnchanged;
+exports.createFsPriorContentResolver = createFsPriorContentResolver;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const path = __importStar(require("node:path"));
+const conditional_write_js_1 = require("../conditional-write.js");
+Object.defineProperty(exports, "tokensEqual", { enumerable: true, get: function () { return conditional_write_js_1.tokensEqual; } });
+/** Prefix for this adapter's opaque tokens (equality-only outside this module). */
+exports.FS_VERSION_TOKEN_PREFIX = 'fs:v1:';
+/**
+ * Token used when the path does not exist yet (create-if-absent CAS).
+ * Hosts that measured absence should pass this as expected_token for first write.
+ */
+exports.FS_ABSENT_TOKEN = 'fs:v1:absent';
+function sha256hex(buf) {
+    return (0, node_crypto_1.createHash)('sha256').update(buf).digest('hex');
+}
+/** Extract content-hash segment from an fs:v1 token (null if absent/malformed). */
+function fsTokenContentHash(token) {
+    if (typeof token !== 'string' || !token.startsWith(exports.FS_VERSION_TOKEN_PREFIX))
+        return null;
+    if (token === exports.FS_ABSENT_TOKEN)
+        return null;
+    const rest = token.slice(exports.FS_VERSION_TOKEN_PREFIX.length);
+    const colon = rest.indexOf(':');
+    if (colon < 0)
+        return null;
+    const hash = rest.slice(colon + 1);
+    return /^[a-f0-9]{64}$/.test(hash) ? hash : null;
+}
+/**
+ * Build a VersionToken from path: mtime (ms) + sha256 of file bytes.
+ * Throws on I/O errors other than callers may catch. ENOENT → returns FS_ABSENT_TOKEN
+ * so hosts can CAS create vs create-raced.
+ */
+async function createFsVersionToken(filePath) {
+    let st;
+    try {
+        st = await node_fs_1.promises.stat(filePath);
+    }
+    catch (err) {
+        const code = err && typeof err === 'object' && 'code' in err
+            ? String(err.code)
+            : '';
+        if (code === 'ENOENT')
+            return exports.FS_ABSENT_TOKEN;
+        throw err;
+    }
+    if (!st.isFile()) {
+        // Directories / specials are not content CAS targets for this adapter.
+        throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+    }
+    const buf = await node_fs_1.promises.readFile(filePath);
+    const hash = sha256hex(buf);
+    const mtimeMs = Math.trunc(st.mtimeMs);
+    return `${exports.FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
+}
+/**
+ * Read file content + version token for VersionedContent (host reporting / preflight prior).
+ * ENOENT → content '' and FS_ABSENT_TOKEN.
+ */
+async function readVersionedFile(filePath) {
+    const version_token = await createFsVersionToken(filePath);
+    if (version_token === exports.FS_ABSENT_TOKEN) {
+        return { content: '', version_token };
+    }
+    const content = await node_fs_1.promises.readFile(filePath, 'utf8');
+    return { content, version_token };
+}
+/**
+ * Conditional write: re-stat+re-hash; if token matches expected → temp file + atomic rename.
+ *
+ * MEASURED windows (pre-fix, 2fcd74e-era):
+ *   1. executeIfUnchanged: current_token() then await write() — no re-check in between.
+ *   2. write(): writeFile(tmp) then rename(tmp,target) with NO re-stat of target before rename
+ *      (fs.ts former lines 106–108) — concurrent mutation of target is clobbered by rename.
+ *
+ * Closures:
+ *   - Pre-rename: re-createFsVersionToken(target); on mismatch abort rename, unlink tmp,
+ *     throw StaleVersionTokenAbort → refused/stale_version_token (write did not land).
+ *   - Post-rename: detect_stale_during_commit — content-hash of path must match sha256(body);
+ *     mismatch → committed_stale_detected (write landed; someone overwrote after rename).
+ *
+ * Wired through executeIfUnchanged — not a parallel path.
+ */
+async function writeFileIfUnchanged(args) {
+    const target = path.resolve(args.path);
+    const body = typeof args.content === 'string' ? Buffer.from(args.content, 'utf8') : args.content;
+    const writtenHash = sha256hex(body);
+    return (0, conditional_write_js_1.executeIfUnchanged)({
+        expected_token: args.expected_token,
+        current_token: () => createFsVersionToken(target),
+        detect_stale_during_commit: true,
+        // Post-commit: token content-hash must equal sha256 of what we wrote (mtime may vary).
+        expected_after_commit: async (result) => {
+            // Synthesize a comparable token: re-read path; equality is content-hash based via tokensEqual
+            // only if full token matches — mtime always changes on write, so we return the LIVE post
+            // token only when its hash matches writtenHash; else return a sentinel that cannot match.
+            const post = await createFsVersionToken(target);
+            const postHash = fsTokenContentHash(post);
+            if (postHash === result.written_content_hash)
+                return post;
+            // Force mismatch → committed_stale_detected (detection, not rollback).
+            return `${exports.FS_VERSION_TOKEN_PREFIX}0:stale_during_commit_mismatch`;
+        },
+        write: async () => {
+            const dir = path.dirname(target);
+            await node_fs_1.promises.mkdir(dir, { recursive: true });
+            const tmp = path.join(dir, `.coderifts-cas-${path.basename(target)}-${process.pid}-${(0, node_crypto_1.randomBytes)(6).toString('hex')}.tmp`);
+            try {
+                await node_fs_1.promises.writeFile(tmp, body);
+                // Close pre-rename window: if target moved since the executeIfUnchanged check, do not clobber.
+                const still = await createFsVersionToken(target);
+                if (!(0, conditional_write_js_1.tokensEqual)(args.expected_token, still)) {
+                    try {
+                        await node_fs_1.promises.unlink(tmp);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                    throw new conditional_write_js_1.StaleVersionTokenAbort(still);
+                }
+                // Atomic replace on same filesystem (POSIX rename; Windows overwrite where supported).
+                await node_fs_1.promises.rename(tmp, target);
+            }
+            catch (err) {
+                if (err instanceof conditional_write_js_1.StaleVersionTokenAbort)
+                    throw err;
+                // Best-effort cleanup of temp — never leave partial target from failed rename.
+                try {
+                    await node_fs_1.promises.unlink(tmp);
+                }
+                catch {
+                    /* ignore */
+                }
+                throw err;
+            }
+            return { path: target, bytes: body.length, written_content_hash: writtenHash };
+        },
+    });
+}
+/**
+ * Opt-in PriorContentResolver that reads a file path from tool arguments.
+ * Returns file utf8 content for freshness measurement (string only — tokens travel separately
+ * via versioned_content / conditioned_on_token on the call context).
+ *
+ * Plug-in: pass as GuardConfig.resolvePriorContent / withCodeRifts({ resolvePriorContent }).
+ */
+function createFsPriorContentResolver(options) {
+    const pathForArtifact = options?.pathForArtifact;
+    return async (req) => {
+        let filePath = typeof req.path === 'string' && req.path.length > 0 ? req.path : undefined;
+        if (!filePath && pathForArtifact) {
+            const mapped = pathForArtifact(req.artifactId);
+            if (typeof mapped === 'string' && mapped.length > 0)
+                filePath = mapped;
+        }
+        if (!filePath)
+            return null;
+        try {
+            return await node_fs_1.promises.readFile(filePath, 'utf8');
+        }
+        catch (err) {
+            const code = err && typeof err === 'object' && 'code' in err
+                ? String(err.code)
+                : '';
+            if (code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    };
+}
+//# sourceMappingURL=fs.js.map

package/dist/cjs/cas-adapters/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6Bb,gDAQC;AAOD,oDAmBC;AAMD,8CAOC;AA0BD,oDAwDC;AASD,oEA0BC;AA/LD,6CAAsD;AACtD,qCAA0C;AAC1C,gDAAkC;AAClC,kEAOiC;AAwLxB,4FA5LP,kCAAW,OA4LO;AArLpB,mFAAmF;AACtE,QAAA,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACU,QAAA,eAAe,GAAiB,cAAc,CAAC;AAE5D,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,SAAgB,kBAAkB,CAAC,KAAsC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,+BAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,KAAK,KAAK,uBAAe;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,+BAAuB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,kBAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,uBAAe,CAAC;QAC9C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,uEAAuE;QACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,GAAG,+BAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,uBAAe,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC;AAUD;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACjG,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAEpC,OAAO,IAAA,yCAAkB,EAAC;QACxB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;QACjD,0BAA0B,EAAE,IAAI;QAChC,uFAAuF;QACvF,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,8FAA8F;YAC9F,yFAAyF;YACzF,0FAA0F;YAC1F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,MAAM,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAC1D,uEAAuE;YACvE,OAAO,GAAG,+BAAuB,gCAAgC,CAAC;QACpE,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,kBAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CACnB,GAAG,EACH,kBAAkB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/F,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,kBAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/B,+FAA+F;gBAC/F,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAA,kCAAW,EAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;oBACD,MAAM,IAAI,6CAAsB,CAAC,KAAK,CAAC,CAAC;gBAC1C,CAAC;gBACD,uFAAuF;gBACvF,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,6CAAsB;oBAAE,MAAM,GAAG,CAAC;gBACrD,+EAA+E;gBAC/E,IAAI,CAAC;oBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC;QACjF,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAAC,OAM5C;IACC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;IACjD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,QAAQ,GACV,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;gBAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/cjs/cas-adapters/registry.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Registry compareAndSwap CAS adapter — opaque registry/version token discipline over host-injected I/O.
+ *
+ * Uses executeIfUnchanged (conditional-write.ts). Does not invent a parallel outcome shape.
+ * Token format is opaque to the guard (string equality only).
+ *
+ * Token encoding (this adapter only; not interpreted by the core):
+ *   registry:v1:<host_registry_token>
+ * Missing / empty token → REGISTRY_ABSENT_TOKEN.
+ *
+ * HONESTY: this adapter never talks to a registry client. The host callback performs
+ * compareAndSwap(expected, newValue) (or equivalent) and reports {swapped|conflict}.
+ * The adapter only normalizes tokens and maps the report onto ExecuteIfUnchangedOutcome.
+ *
+ * No registry SDKs — all I/O is host-injected.
+ */
+import { tokensEqual, type ExecuteIfUnchangedOutcome, type VersionToken } from '../conditional-write.js';
+/** Prefix for this adapter's opaque tokens (equality-only outside this module). */
+export declare const REGISTRY_VERSION_TOKEN_PREFIX = "registry:v1:";
+/**
+ * Token used when the registry key is absent / unversioned.
+ * Hosts that measured absence should pass this as expected_token for first put.
+ */
+export declare const REGISTRY_ABSENT_TOKEN: VersionToken;
+/**
+ * Build a VersionToken from a host registry revision / generation / etag-like value.
+ * null / undefined / empty → REGISTRY_ABSENT_TOKEN.
+ */
+export declare function createRegistryVersionToken(token: string | number | bigint | null | undefined): VersionToken;
+/** Raw value embedded in a registry:v1: token (for host CAS APIs). Absent → null. */
+export declare function registryTokenRaw(token: VersionToken | null | undefined): string | null;
+/**
+ * Host report after compareAndSwap (or equivalent).
+ */
+export type RegistryHostCasReport<T = unknown> = {
+    swapped: true;
+    /** New registry token after successful swap; null/omit when unknown. */
+    new_token?: string | number | bigint | null;
+    result?: T;
+} | {
+    swapped: false;
+    /** Current token if observed on conflict; omit → null (no invented token). */
+    current_token?: string | number | bigint | null;
+} | {
+    status: 'committed';
+    new_token?: string | number | bigint | null;
+    result?: T;
+} | {
+    status: 'conflict';
+    current_token?: string | number | bigint | null;
+};
+export type WriteRegistryIfUnchangedArgs<T = unknown> = {
+    /** Token measured before the host decided to write (from createRegistryVersionToken). */
+    expected_token: VersionToken;
+    /** Re-read the registry key's current token. Pre-write and post-write when detect is on. */
+    current_token: () => string | number | bigint | null | Promise<string | number | bigint | null>;
+    /**
+     * Host compareAndSwap. Receives the raw expected token for the CAS call.
+     * Adapter does not invoke any registry client.
+     */
+    compareAndSwap: (ctx: {
+        expected: string | null;
+        expected_token: VersionToken;
+    }) => RegistryHostCasReport<T> | Promise<RegistryHostCasReport<T>>;
+    /**
+     * Opt-in post-commit detection (default false).
+     * When host omits new_token on success, detection is a no-op.
+     */
+    detect_stale_during_commit?: boolean;
+};
+export type RegistryWriteResult<T = unknown> = {
+    new_token: string | null;
+    result: T | undefined;
+};
+/**
+ * Conditional registry write: re-read token; if matches → host compareAndSwap.
+ *
+ * Mapping (host report → ExecuteIfUnchangedOutcome):
+ *   swapped:true / status:committed   → committed
+ *   swapped:false / status:conflict   → refused / stale_version_token
+ *                                       current_token from host when supplied, else null
+ *
+ * Wired through executeIfUnchanged — not a parallel path.
+ */
+export declare function writeRegistryIfUnchanged<T = unknown>(args: WriteRegistryIfUnchangedArgs<T>): Promise<ExecuteIfUnchangedOutcome<RegistryWriteResult<T>>>;
+/** Re-export equality helper for hosts comparing tokens without importing core module. */
+export { tokensEqual };
+//# sourceMappingURL=registry.d.ts.map

package/dist/cjs/cas-adapters/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/cas-adapters/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAGL,WAAW,EACX,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAC;AAEjC,mFAAmF;AACnF,eAAO,MAAM,6BAA6B,iBAAiB,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,YAAmC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GACjD,YAAY,CAMd;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAOtF;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,GAAG,OAAO,IACzC;IACE,OAAO,EAAE,IAAI,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,CAAC,CAAC;CACZ,GACD;IACE,OAAO,EAAE,KAAK,CAAC;IACf,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACjD,GACD;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,CAAC,CAAC;CACZ,GACD;IACE,MAAM,EAAE,UAAU,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACjD,CAAC;AAEN,MAAM,MAAM,4BAA4B,CAAC,CAAC,GAAG,OAAO,IAAI;IACtD,yFAAyF;IACzF,cAAc,EAAE,YAAY,CAAC;IAC7B,4FAA4F;IAC5F,aAAa,EAAE,MACX,MAAM,GACN,MAAM,GACN,MAAM,GACN,IAAI,GACJ,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C;;;OAGG;IACH,cAAc,EAAE,CAAC,GAAG,EAAE;QACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,cAAc,EAAE,YAAY,CAAC;KAC9B,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE;;;OAGG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,CAAC,GAAG,OAAO,IAAI;IAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC;CACvB,CAAC;AA0BF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,GAAG,OAAO,EACxD,IAAI,EAAE,4BAA4B,CAAC,CAAC,CAAC,GACpC,OAAO,CAAC,yBAAyB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAsC5D;AAED,0FAA0F;AAC1F,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/cjs/cas-adapters/registry.js

@@ -0,0 +1,120 @@
+/**
+ * Registry compareAndSwap CAS adapter — opaque registry/version token discipline over host-injected I/O.
+ *
+ * Uses executeIfUnchanged (conditional-write.ts). Does not invent a parallel outcome shape.
+ * Token format is opaque to the guard (string equality only).
+ *
+ * Token encoding (this adapter only; not interpreted by the core):
+ *   registry:v1:<host_registry_token>
+ * Missing / empty token → REGISTRY_ABSENT_TOKEN.
+ *
+ * HONESTY: this adapter never talks to a registry client. The host callback performs
+ * compareAndSwap(expected, newValue) (or equivalent) and reports {swapped|conflict}.
+ * The adapter only normalizes tokens and maps the report onto ExecuteIfUnchangedOutcome.
+ *
+ * No registry SDKs — all I/O is host-injected.
+ */
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokensEqual = exports.REGISTRY_ABSENT_TOKEN = exports.REGISTRY_VERSION_TOKEN_PREFIX = void 0;
+exports.createRegistryVersionToken = createRegistryVersionToken;
+exports.registryTokenRaw = registryTokenRaw;
+exports.writeRegistryIfUnchanged = writeRegistryIfUnchanged;
+const conditional_write_js_1 = require("../conditional-write.js");
+Object.defineProperty(exports, "tokensEqual", { enumerable: true, get: function () { return conditional_write_js_1.tokensEqual; } });
+/** Prefix for this adapter's opaque tokens (equality-only outside this module). */
+exports.REGISTRY_VERSION_TOKEN_PREFIX = 'registry:v1:';
+/**
+ * Token used when the registry key is absent / unversioned.
+ * Hosts that measured absence should pass this as expected_token for first put.
+ */
+exports.REGISTRY_ABSENT_TOKEN = 'registry:v1:absent';
+/**
+ * Build a VersionToken from a host registry revision / generation / etag-like value.
+ * null / undefined / empty → REGISTRY_ABSENT_TOKEN.
+ */
+function createRegistryVersionToken(token) {
+    if (token == null)
+        return exports.REGISTRY_ABSENT_TOKEN;
+    if (typeof token === 'number' && !Number.isFinite(token))
+        return exports.REGISTRY_ABSENT_TOKEN;
+    const s = String(token).trim();
+    if (s.length === 0)
+        return exports.REGISTRY_ABSENT_TOKEN;
+    return `${exports.REGISTRY_VERSION_TOKEN_PREFIX}${s}`;
+}
+/** Raw value embedded in a registry:v1: token (for host CAS APIs). Absent → null. */
+function registryTokenRaw(token) {
+    if (typeof token !== 'string' || !token.startsWith(exports.REGISTRY_VERSION_TOKEN_PREFIX)) {
+        return null;
+    }
+    if (token === exports.REGISTRY_ABSENT_TOKEN)
+        return null;
+    const raw = token.slice(exports.REGISTRY_VERSION_TOKEN_PREFIX.length);
+    return raw.length > 0 ? raw : null;
+}
+function normalizeRegistryReport(report) {
+    if (!report || typeof report !== 'object') {
+        throw new Error('writeRegistryIfUnchanged: host compareAndSwap must return RegistryHostCasReport');
+    }
+    if ('swapped' in report) {
+        if (report.swapped === true) {
+            return { kind: 'committed', new_token: report.new_token, result: report.result };
+        }
+        return { kind: 'conflict', current_token: report.current_token };
+    }
+    if (report.status === 'committed') {
+        return { kind: 'committed', new_token: report.new_token, result: report.result };
+    }
+    if (report.status === 'conflict') {
+        return { kind: 'conflict', current_token: report.current_token };
+    }
+    throw new Error('writeRegistryIfUnchanged: unknown host report shape');
+}
+/**
+ * Conditional registry write: re-read token; if matches → host compareAndSwap.
+ *
+ * Mapping (host report → ExecuteIfUnchangedOutcome):
+ *   swapped:true / status:committed   → committed
+ *   swapped:false / status:conflict   → refused / stale_version_token
+ *                                       current_token from host when supplied, else null
+ *
+ * Wired through executeIfUnchanged — not a parallel path.
+ */
+async function writeRegistryIfUnchanged(args) {
+    const detect = args.detect_stale_during_commit === true;
+    return (0, conditional_write_js_1.executeIfUnchanged)({
+        expected_token: args.expected_token,
+        current_token: async () => createRegistryVersionToken(await args.current_token()),
+        detect_stale_during_commit: detect,
+        expected_after_commit: detect
+            ? async (written) => {
+                if (typeof written.new_token === 'string' && written.new_token.trim().length > 0) {
+                    return createRegistryVersionToken(written.new_token);
+                }
+                return createRegistryVersionToken(await args.current_token());
+            }
+            : undefined,
+        write: async () => {
+            const report = await args.compareAndSwap({
+                expected: registryTokenRaw(args.expected_token),
+                expected_token: args.expected_token,
+            });
+            const norm = normalizeRegistryReport(report);
+            if (norm.kind === 'conflict') {
+                const cur = norm.current_token !== undefined
+                    ? createRegistryVersionToken(norm.current_token)
+                    : null;
+                throw new conditional_write_js_1.StaleVersionTokenAbort(cur);
+            }
+            const new_token = norm.new_token === undefined || norm.new_token === null
+                ? null
+                : String(norm.new_token);
+            return {
+                new_token,
+                result: norm.result,
+            };
+        },
+    });
+}
+//# sourceMappingURL=registry.js.map

package/dist/cjs/cas-adapters/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/cas-adapters/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,YAAY,CAAC;;;AAuBb,gEAQC;AAGD,4CAOC;AA2FD,4DAwCC;AA1KD,kEAMiC;AAuKxB,4FA1KP,kCAAW,OA0KO;AArKpB,mFAAmF;AACtE,QAAA,6BAA6B,GAAG,cAAc,CAAC;AAE5D;;;GAGG;AACU,QAAA,qBAAqB,GAAiB,oBAAoB,CAAC;AAExE;;;GAGG;AACH,SAAgB,0BAA0B,CACxC,KAAkD;IAElD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,6BAAqB,CAAC;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,6BAAqB,CAAC;IACvF,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,6BAAqB,CAAC;IACjD,OAAO,GAAG,qCAA6B,GAAG,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,qFAAqF;AACrF,SAAgB,gBAAgB,CAAC,KAAsC;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,qCAA6B,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,KAAK,6BAAqB;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAA6B,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAyDD,SAAS,uBAAuB,CAAI,MAAgC;IAMlE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,wBAAwB,CAC5C,IAAqC;IAErC,MAAM,MAAM,GAAG,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC;IAExD,OAAO,IAAA,yCAAkB,EAAC;QACxB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QACjF,0BAA0B,EAAE,MAAM;QAClC,qBAAqB,EAAE,MAAM;YAC3B,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAChB,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjF,OAAO,0BAA0B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACvD,CAAC;gBACD,OAAO,0BAA0B,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAChE,CAAC;YACH,CAAC,CAAC,SAAS;QACb,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBACvC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC/C,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC7B,MAAM,GAAG,GACP,IAAI,CAAC,aAAa,KAAK,SAAS;oBAC9B,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,aAAa,CAAC;oBAChD,CAAC,CAAC,IAAI,CAAC;gBACX,MAAM,IAAI,6CAAsB,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;gBACrD,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO;gBACL,SAAS;gBACT,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/cas-attestation.d.ts

@@ -0,0 +1,94 @@
+/**
+ * CAS attestation binder (ID781 option A follow-on) — separate record linking a frozen
+ * GuardExecutionProof (v1) with an ExecuteIfUnchangedOutcome.
+ *
+ * Does NOT modify execution-proof.ts, the proof shape, or conditional-write outcome types.
+ * Does NOT claim that the host write is unique, that version tokens equal change_fp, or that
+ * committed_stale_detected is "safe". Those non-claims are always set on `limits`.
+ *
+ * The proof's own limit `conditional_write_is_host_asserted_not_cas_verified` names this gap;
+ * this module is the separate attestation surface that pairs proof + CAS outcome without
+ * widening the proof spec.
+ */
+import type { GuardExecutionProof, ExecutionResultHash } from './execution-proof.js';
+import type { ExecuteIfUnchangedOutcome, VersionToken } from './conditional-write.js';
+/** Machine-readable schema id — mirrors EXECUTION_PROOF_SPEC style. */
+export declare const CAS_ATTESTATION_SPEC: "cas-attestation.v1";
+/**
+ * Explicit non-claims. Always set (same discipline as GuardExecutionProof.limits).
+ * Readers that treat missing fields as "ok" are wrong.
+ */
+export type CasAttestationLimits = {
+    /** Host may have performed other writes outside executeIfUnchanged. */
+    does_not_claim_only_write_on_host: true;
+    /** version_token / post_commit_token are opaque CAS resource versions — not change_fp identity. */
+    does_not_claim_version_token_proves_change_fp_match: true;
+    /** committed_stale_detected means write ran and post-check disagreed — not "safe" or rolled back. */
+    does_not_claim_committed_stale_is_safe: true;
+    /** execution_result_hash hashes the factory return, not CAS file bytes / token equality. */
+    does_not_claim_execution_result_hash_equals_cas_bytes: true;
+    /** Same host-bypass residual as the proof family — package cannot force host CAS use. */
+    does_not_claim_host_cannot_bypass: true;
+    /** Attestation is linkage of two inputs, not a re-decision of governance ALLOW/BLOCK. */
+    does_not_claim_governance_redecision: true;
+};
+/** CAS branch projection — only fields present on the measured outcome branch. */
+export type CasAttestationCas = {
+    status: 'committed';
+    write_ran: true;
+    version_token: VersionToken;
+} | {
+    status: 'refused';
+    write_ran: false;
+    reason: 'stale_version_token';
+    expected_token: VersionToken;
+    current_token: VersionToken | null;
+} | {
+    status: 'committed_stale_detected';
+    write_ran: true;
+    reason: 'stale_during_commit';
+    expected_token: VersionToken;
+    post_commit_token: VersionToken | null;
+};
+/**
+ * Frozen cas-attestation.v1 record.
+ * References are lifted from the proof; cas is projected from the outcome; derived flags
+ * are only what is honestly computable from those two inputs.
+ */
+export type CasAttestation = {
+    attestation_spec: typeof CAS_ATTESTATION_SPEC;
+    references: {
+        decision_id: string | null;
+        change_fp: string | null;
+        operation: string | null;
+        execution_result_hash: ExecutionResultHash;
+        receipt_verified: boolean;
+    };
+    cas: CasAttestationCas;
+    derived: {
+        /**
+         * receipt.verified === true AND outcome.status === 'committed'
+         * (clean commit only — committed_stale_detected is NOT this flag).
+         */
+        authorized_and_committed: boolean;
+        /** Write mutation ran: committed or committed_stale_detected. */
+        write_ran: boolean;
+        /** outcome.status === 'committed_stale_detected'. */
+        stale_during_commit: boolean;
+        /** outcome.status === 'refused'. */
+        refused: boolean;
+    };
+    limits: CasAttestationLimits;
+};
+/** Type guard: object carries the frozen v1 proof_spec. */
+export declare function isGuardExecutionProof(x: unknown): x is GuardExecutionProof;
+/** Type guard: object is one of the three ExecuteIfUnchangedOutcome branches. */
+export declare function isExecuteIfUnchangedOutcome(x: unknown): x is ExecuteIfUnchangedOutcome<unknown>;
+/**
+ * Bind a frozen GuardExecutionProof with an ExecuteIfUnchangedOutcome into a cas-attestation.v1.
+ *
+ * Validation-first: rejects non-v1 proofs and non-outcome shapes (throws TypeError —
+ * builders fail closed; the human render layer soft-fails instead).
+ */
+export declare function buildCasAttestation(proof: GuardExecutionProof, outcome: ExecuteIfUnchangedOutcome<unknown>): CasAttestation;
+//# sourceMappingURL=cas-attestation.d.ts.map

package/dist/cjs/cas-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtF,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAgB/F;AAiCD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAC1C,cAAc,CAyChB"}