@cuna_labs/cli 0.1.0

package/dist/local-actions/local-service-actions.js

@@ -0,0 +1,347 @@
+import { createHash } from "node:crypto";
+import { request as httpRequest } from "node:http";
+import { assertLoopbackHost, assertPort, isLoopbackPeer } from "./loopback.js";
+import { SensitiveAuthorityError, assertSensitiveAuthority, identifier, requireConsentOnce, validateSensitiveContext, } from "./sensitive-consent.js";
+const SHA256 = /^sha256:[0-9a-f]{64}$/u;
+const MEDIA_TYPE = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,63}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,127}$/u;
+const METHOD = /^(?:DELETE|GET|HEAD|OPTIONS|PATCH|POST|PUT)$/u;
+const MAX_SERVICE_BODY_BYTES = 65_536;
+export class LocalServiceActions {
+    #options;
+    #registrations = new Map();
+    constructor(options) {
+        this.#options = options;
+    }
+    register(registration) {
+        const stored = validateAndFreezeRegistration(registration);
+        if (this.#registrations.has(stored.descriptor.registrationId))
+            throw new LocalServiceError("registration_exists");
+        this.#registrations.set(stored.descriptor.registrationId, stored);
+    }
+    revoke(registrationId) {
+        const registration = this.#registrations.get(registrationId);
+        if (registration === undefined)
+            return;
+        this.#registrations.delete(registrationId);
+        for (const controller of registration.controllers)
+            controller.abort("registration_revoked");
+        registration.controllers.clear();
+    }
+    dispose() {
+        for (const id of this.#registrations.keys())
+            this.revoke(id);
+    }
+    async request(args, context, signal) {
+        validateSensitiveContext(context);
+        if (!identifier(args.registrationId) || !identifier(args.operationId))
+            throw new LocalServiceError("request_invalid");
+        const registration = this.#registrations.get(args.registrationId);
+        const operation = registration?.operations.get(args.operationId);
+        if (registration === undefined || operation === undefined)
+            throw new LocalServiceError("operation_unregistered");
+        if (registration.controllers.size >= registration.descriptor.maximumConcurrent)
+            throw new LocalServiceError("service_busy");
+        const prepared = decodeRequestBody(args, operation);
+        if (!this.#options.schemas.validate(operation.requestSchemaId, prepared.schemaValue)) {
+            throw new LocalServiceError("request_schema_invalid");
+        }
+        await requireConsentOnce(this.#options.consent, context, {
+            action: "local_service.request",
+            operationDigest: args.bodySha256,
+            summary: `${operation.method} ${operation.path} via ${registration.descriptor.registrationId}`,
+        }, signal).catch(normalizeAuthorityError);
+        if (this.#registrations.get(args.registrationId) !== registration || registration.operations.get(args.operationId) !== operation) {
+            throw new LocalServiceError("registration_changed");
+        }
+        const revalidated = decodeRequestBody(args, operation);
+        if (digest(revalidated.bytes) !== digest(prepared.bytes))
+            throw new LocalServiceError("request_changed");
+        await assertSensitiveAuthority(context, signal).catch(normalizeAuthorityError);
+        const controller = new AbortController();
+        const detachAbort = forwardAbort(signal, controller);
+        registration.controllers.add(controller);
+        try {
+            let response;
+            try {
+                response = await this.#options.transport.request(Object.freeze({
+                    host: registration.descriptor.host,
+                    port: registration.descriptor.port,
+                    method: operation.method,
+                    path: operation.path,
+                    contentType: operation.requestContentType,
+                    body: Buffer.from(revalidated.bytes),
+                    maximumResponseBytes: operation.maximumResponseBytes,
+                    timeoutMs: operation.timeoutMs,
+                    signal: controller.signal,
+                }));
+            }
+            catch (error) {
+                if (controller.signal.aborted || signal?.aborted === true)
+                    throw new LocalServiceError("cancelled", { cause: error });
+                if (error instanceof LocalServiceTransportError && error.code === "timeout")
+                    return emptyTimeoutResult();
+                throw new LocalServiceError("service_unavailable", { cause: error });
+            }
+            await assertSensitiveAuthority(context, signal).catch(normalizeAuthorityError);
+            return validateServiceResponse(response, operation, this.#options.schemas);
+        }
+        finally {
+            detachAbort();
+            registration.controllers.delete(controller);
+            controller.abort("operation_complete");
+        }
+    }
+}
+export function createNodeLoopbackServiceTransport() {
+    return Object.freeze({
+        request(input) {
+            assertLoopbackHost(input.host, "service host");
+            assertPort(input.port, "service port");
+            return new Promise((resolve, reject) => {
+                let settled = false;
+                const finish = (callback) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.signal.removeEventListener("abort", onAbort);
+                    callback();
+                };
+                const request = httpRequest({
+                    host: input.host,
+                    port: input.port,
+                    method: input.method,
+                    path: input.path,
+                    agent: false,
+                    headers: {
+                        "content-type": input.contentType,
+                        "content-length": String(input.body.byteLength),
+                        "connection": "close",
+                    },
+                    lookup(_hostname, _options, callback) {
+                        callback(new LocalServiceTransportError("dns_forbidden"), "", 4);
+                    },
+                }, (response) => {
+                    const chunks = [];
+                    let total = 0;
+                    const declaredLength = Number(response.headers["content-length"] ?? "0");
+                    if (Number.isFinite(declaredLength) && declaredLength > input.maximumResponseBytes) {
+                        request.destroy(new LocalServiceTransportError("response_too_large"));
+                        return;
+                    }
+                    response.on("data", (chunk) => {
+                        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                        total += bytes.byteLength;
+                        if (total > input.maximumResponseBytes) {
+                            request.destroy(new LocalServiceTransportError("response_too_large"));
+                            return;
+                        }
+                        chunks.push(bytes);
+                    });
+                    response.once("end", () => finish(() => resolve(Object.freeze({
+                        statusCode: response.statusCode ?? 0,
+                        contentType: typeof response.headers["content-type"] === "string" ? response.headers["content-type"] : null,
+                        body: Buffer.concat(chunks, total),
+                        remoteAddress: response.socket.remoteAddress ?? "",
+                        redirected: false,
+                    }))));
+                    response.once("aborted", () => finish(() => reject(new LocalServiceTransportError("response_aborted"))));
+                    response.once("error", (error) => finish(() => reject(error)));
+                });
+                const onAbort = () => { request.destroy(new LocalServiceTransportError("cancelled")); };
+                input.signal.addEventListener("abort", onAbort, { once: true });
+                request.setTimeout(input.timeoutMs, () => request.destroy(new LocalServiceTransportError("timeout")));
+                request.once("error", (error) => finish(() => reject(error)));
+                request.end(input.body);
+            });
+        },
+    });
+}
+export class LocalServiceError extends Error {
+    code;
+    constructor(code, options) {
+        super(`Cuna local service request failed: ${code}.`, options);
+        this.code = code;
+        this.name = "LocalServiceError";
+    }
+}
+export class LocalServiceTransportError extends Error {
+    code;
+    constructor(code) {
+        super(`Cuna loopback transport failed: ${code}.`);
+        this.code = code;
+        this.name = "LocalServiceTransportError";
+    }
+}
+function validateAndFreezeRegistration(registration) {
+    exactKeys(registration, ["registrationId", "host", "port", "maximumConcurrent", "operations"]);
+    if (!identifier(registration.registrationId))
+        throw new LocalServiceError("registration_invalid");
+    assertLoopbackHost(registration.host, "service host");
+    assertPort(registration.port, "service port");
+    if (!boundedInteger(registration.maximumConcurrent, 1, 32) || !Array.isArray(registration.operations) ||
+        registration.operations.length < 1 || registration.operations.length > 128)
+        throw new LocalServiceError("registration_invalid");
+    const operations = new Map();
+    const frozen = registration.operations.map((candidate) => {
+        exactKeys(candidate, [
+            "operationId", "method", "path", "requestEncoding", "responseEncoding", "requestContentType", "responseContentType",
+            "requestSchemaId", "responseSchemaId", "maximumRequestBytes", "maximumResponseBytes", "timeoutMs", "idempotent",
+        ]);
+        if (!identifier(candidate.operationId) || !METHOD.test(candidate.method) || !exactPath(candidate.path) ||
+            !bodyEncoding(candidate.requestEncoding) || !bodyEncoding(candidate.responseEncoding) ||
+            !MEDIA_TYPE.test(candidate.requestContentType) || !MEDIA_TYPE.test(candidate.responseContentType) ||
+            !identifier(candidate.requestSchemaId) || !identifier(candidate.responseSchemaId) ||
+            !boundedInteger(candidate.maximumRequestBytes, 0, MAX_SERVICE_BODY_BYTES) ||
+            !boundedInteger(candidate.maximumResponseBytes, 0, MAX_SERVICE_BODY_BYTES) ||
+            !boundedInteger(candidate.timeoutMs, 1, 60_000) || typeof candidate.idempotent !== "boolean" ||
+            operations.has(candidate.operationId))
+            throw new LocalServiceError("operation_invalid");
+        const operation = Object.freeze({ ...candidate });
+        operations.set(operation.operationId, operation);
+        return operation;
+    });
+    const descriptor = Object.freeze({ ...registration, operations: Object.freeze(frozen) });
+    return { descriptor, operations, controllers: new Set() };
+}
+function decodeRequestBody(args, operation) {
+    if (args.bodyEncoding !== operation.requestEncoding || !Number.isSafeInteger(args.decodedLength) ||
+        args.decodedLength < 0 || args.decodedLength > operation.maximumRequestBytes || !SHA256.test(args.bodySha256)) {
+        throw new LocalServiceError("request_integrity_invalid");
+    }
+    const prepared = encodeBody(args.bodyEncoding, args.body, operation.maximumRequestBytes);
+    if (prepared.bytes.byteLength !== args.decodedLength || digest(prepared.bytes) !== args.bodySha256) {
+        throw new LocalServiceError("request_integrity_invalid");
+    }
+    return prepared;
+}
+function validateServiceResponse(response, operation, schemas) {
+    if (!Number.isSafeInteger(response.statusCode) || response.statusCode < 100 || response.statusCode > 599 ||
+        response.redirected || (response.statusCode >= 300 && response.statusCode < 400))
+        throw new LocalServiceError("redirect_rejected");
+    if (!isLoopbackPeer(response.remoteAddress))
+        throw new LocalServiceError("response_peer_not_loopback");
+    if (response.body.byteLength > operation.maximumResponseBytes)
+        throw new LocalServiceError("response_too_large");
+    if (normalizeContentType(response.contentType) !== operation.responseContentType)
+        throw new LocalServiceError("response_content_type_invalid");
+    const prepared = decodeResponseBody(operation.responseEncoding, response.body);
+    if (!schemas.validate(operation.responseSchemaId, prepared.schemaValue))
+        throw new LocalServiceError("response_schema_invalid");
+    const stable = decodeResponseBody(operation.responseEncoding, response.body);
+    return Object.freeze({
+        outcome: response.statusCode >= 200 && response.statusCode < 300 ? "ok" : "service_error",
+        bodyEncoding: operation.responseEncoding,
+        body: stable.body,
+        decodedLength: response.body.byteLength,
+        bodySha256: digest(response.body),
+    });
+}
+function encodeBody(encoding, body, maximumBytes) {
+    if (encoding === "canonical_json") {
+        const canonical = canonicalJson(body);
+        const bytes = Buffer.from(canonical, "utf8");
+        if (bytes.byteLength > maximumBytes)
+            throw new LocalServiceError("body_too_large");
+        return { bytes, schemaValue: body };
+    }
+    if (typeof body !== "string" || !/^[A-Za-z0-9_-]*$/u.test(body) || body.length > Math.ceil(maximumBytes * 4 / 3) + 2) {
+        throw new LocalServiceError("body_encoding_invalid");
+    }
+    const bytes = Buffer.from(body, "base64url");
+    if (bytes.byteLength > maximumBytes || bytes.toString("base64url") !== body)
+        throw new LocalServiceError("body_encoding_invalid");
+    return { bytes, schemaValue: bytes };
+}
+function decodeResponseBody(encoding, bytes) {
+    if (encoding === "base64url") {
+        const copy = Buffer.from(bytes);
+        return { body: copy.toString("base64url"), schemaValue: copy };
+    }
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new LocalServiceError("response_encoding_invalid");
+    }
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new LocalServiceError("response_encoding_invalid");
+    }
+    if (canonicalJson(value) !== text)
+        throw new LocalServiceError("response_not_canonical");
+    return { body: value, schemaValue: value };
+}
+function canonicalJson(value, seen = new Set()) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new LocalServiceError("body_encoding_invalid");
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        if (seen.has(value))
+            throw new LocalServiceError("body_encoding_invalid");
+        seen.add(value);
+        const output = `[${value.map((item) => canonicalJson(item, seen)).join(",")}]`;
+        seen.delete(value);
+        return output;
+    }
+    if (typeof value !== "object" || value === undefined)
+        throw new LocalServiceError("body_encoding_invalid");
+    const record = value;
+    if (seen.has(record) || Object.getPrototypeOf(record) !== Object.prototype)
+        throw new LocalServiceError("body_encoding_invalid");
+    seen.add(record);
+    const keys = Object.keys(record).sort();
+    if (keys.some((key) => record[key] === undefined))
+        throw new LocalServiceError("body_encoding_invalid");
+    const output = `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key], seen)}`).join(",")}}`;
+    seen.delete(record);
+    return output;
+}
+function emptyTimeoutResult() {
+    const bytes = Buffer.alloc(0);
+    return Object.freeze({ outcome: "timeout", bodyEncoding: "base64url", body: "", decodedLength: 0, bodySha256: digest(bytes) });
+}
+function normalizeContentType(value) {
+    return (value ?? "").split(";", 1)[0].trim().toLowerCase();
+}
+function exactPath(value) {
+    return value.startsWith("/") && value.length <= 2_048 && !value.includes("\\") && !value.includes("\0") &&
+        !value.includes("?") && !value.includes("#") && !value.split("/").some((part, index) => index > 0 && (part === "" || part === "." || part === ".."));
+}
+function exactKeys(value, keys) {
+    const actual = Object.keys(value);
+    if (actual.length !== keys.length || actual.some((key) => !keys.includes(key)))
+        throw new LocalServiceError("descriptor_not_closed");
+}
+function boundedInteger(value, minimum, maximum) {
+    return Number.isSafeInteger(value) && value >= minimum && value <= maximum;
+}
+function bodyEncoding(value) {
+    return value === "canonical_json" || value === "base64url";
+}
+function digest(bytes) {
+    return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+function forwardAbort(signal, controller) {
+    if (signal === undefined)
+        return () => undefined;
+    const abort = () => controller.abort(signal.reason);
+    if (signal.aborted)
+        abort();
+    else
+        signal.addEventListener("abort", abort, { once: true });
+    return () => signal.removeEventListener("abort", abort);
+}
+function normalizeAuthorityError(error) {
+    if (error instanceof SensitiveAuthorityError)
+        throw new LocalServiceError(error.code, { cause: error });
+    throw error;
+}
+//# sourceMappingURL=local-service-actions.js.map

package/dist/local-actions/local-service-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-service-actions.js","sourceRoot":"","sources":["../../src/local-actions/local-service-actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,cAAc,EAAqB,MAAM,eAAe,CAAC;AAClG,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,UAAU,EACV,kBAAkB,EAClB,wBAAwB,GAGzB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,UAAU,GAAG,sEAAsE,CAAC;AAC1F,MAAM,MAAM,GAAG,+CAA+C,CAAC;AAC/D,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAqFtC,MAAM,OAAO,mBAAmB;IACrB,QAAQ,CAA6B;IACrC,cAAc,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEhE,YAAY,OAAmC;QAC7C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,QAAQ,CAAC,YAAsC;QAC7C,MAAM,MAAM,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAClH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,cAAsB;QAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7D,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO;QACvC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC3C,KAAK,MAAM,UAAU,IAAI,YAAY,CAAC,WAAW;YAAE,UAAU,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5F,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,OAAO;QACL,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAAsB,EACtB,OAAkC,EAClC,MAAoB;QAEpB,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;QACtH,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,YAAY,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QACjH,IAAI,YAAY,CAAC,WAAW,CAAC,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,iBAAiB;YAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC5H,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE;YACvD,MAAM,EAAE,uBAAuB;YAC/B,eAAe,EAAE,IAAI,CAAC,UAAU;YAChC,OAAO,EAAE,GAAG,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,QAAQ,YAAY,CAAC,UAAU,CAAC,cAAc,EAAE;SAC/F,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,YAAY,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACjI,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;QACzG,MAAM,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAE/E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrD,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,QAAuC,CAAC;YAC5C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC7D,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,IAAI;oBAClC,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,IAAI;oBAClC,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,WAAW,EAAE,SAAS,CAAC,kBAAkB;oBACzC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBACpC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;oBACpD,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;oBAAE,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBACtH,IAAI,KAAK,YAAY,0BAA0B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;oBAAE,OAAO,kBAAkB,EAAE,CAAC;gBACzG,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC/E,OAAO,uBAAuB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC;gBAAS,CAAC;YACT,WAAW,EAAE,CAAC;YACd,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC5C,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,kCAAkC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,CAAC,KAAmC;YACzC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAC/C,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACvC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,QAAoB,EAAQ,EAAE;oBAC5C,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACnD,QAAQ,EAAE,CAAC;gBACb,CAAC,CAAC;gBACF,MAAM,OAAO,GAAG,WAAW,CAAC;oBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP,cAAc,EAAE,KAAK,CAAC,WAAW;wBACjC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;wBAC/C,YAAY,EAAE,OAAO;qBACtB;oBACD,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ;wBAClC,QAAQ,CAAC,IAAI,0BAA0B,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;oBACnE,CAAC;iBACF,EAAE,CAAC,QAAQ,EAAE,EAAE;oBACd,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;oBACd,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;oBACzE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAC;wBACnF,OAAO,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,oBAAoB,CAAC,CAAC,CAAC;wBACtE,OAAO;oBACT,CAAC;oBACD,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;wBAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAClE,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;wBAC1B,IAAI,KAAK,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAC;4BACvC,OAAO,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,oBAAoB,CAAC,CAAC,CAAC;4BACtE,OAAO;wBACT,CAAC;wBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACrB,CAAC,CAAC,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;wBAC5D,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;wBACpC,WAAW,EAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;wBAC3G,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;wBAClC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE;wBAClD,UAAU,EAAE,KAAK;qBAClB,CAAC,CAAC,CAAC,CAAC,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjE,CAAC,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,GAAS,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9F,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACtG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,IAAY,EAAE,OAAsB;QACvD,KAAK,CAAC,sCAAsC,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC;QAD3C,SAAI,GAAJ,IAAI,CAAQ;QAE/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC9B;IAArB,YAAqB,IAAY;QAC/B,KAAK,CAAC,mCAAmC,IAAI,GAAG,CAAC,CAAC;QAD/B,SAAI,GAAJ,IAAI,CAAQ;QAE/B,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,SAAS,6BAA6B,CAAC,YAAsC;IAC3E,SAAS,CAAC,YAAkD,EAAE,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAAC,CAAC;IACrI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;IAClG,kBAAkB,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACtD,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9C,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC;QACnG,YAAY,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;IAClI,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6C,CAAC;IACxE,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QACvD,SAAS,CAAC,SAA+C,EAAE;YACzD,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,qBAAqB;YACnH,iBAAiB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,WAAW,EAAE,YAAY;SAChH,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC;YACpG,CAAC,YAAY,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,gBAAgB,CAAC;YACrF,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;YACjG,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,gBAAgB,CAAC;YACjF,CAAC,cAAc,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,EAAE,sBAAsB,CAAC;YACzE,CAAC,cAAc,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC,EAAE,sBAAsB,CAAC;YAC1E,CAAC,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,SAAS;YAC5F,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QAC1F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAClD,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAsB,EACtB,SAA4C;IAE5C,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;QAC9F,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC,mBAAmB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACzF,IAAI,QAAQ,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACnG,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAAuC,EACvC,SAA4C,EAC5C,OAAmC;IAEnC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG;QACtG,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IACrI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;IACvG,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,oBAAoB;QAAE,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IACjH,IAAI,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,mBAAmB;QAAE,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;IAC/I,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;IAChI,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,QAAQ,CAAC,UAAU,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe;QACzF,YAAY,EAAE,SAAS,CAAC,gBAAgB;QACxC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;QACvC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,QAAkC,EAAE,IAAa,EAAE,YAAoB;IACzF,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,UAAU,GAAG,YAAY;YAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACrH,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,UAAU,GAAG,YAAY,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IAClI,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAkC,EAAE,KAAiB;IAC/E,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAAC,CAAC;IAC3I,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAAC,CAAC;IACrG,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,OAAO,IAAI,GAAG,EAAU;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5G,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IACjI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAChH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACjI,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAoB;IAChD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;AACzJ,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,IAAuB;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;AACvI,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe;IACrE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,OAAO,IAAI,KAAK,IAAI,OAAO,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,KAAK,gBAAgB,IAAI,KAAK,KAAK,WAAW,CAAC;AAC7D,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B,EAAE,UAA2B;IAChF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IACjD,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,EAAE,CAAC;;QACvB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,uBAAuB;QAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxG,MAAM,KAAK,CAAC;AACd,CAAC"}

package/dist/local-actions/loopback.d.ts

@@ -0,0 +1,5 @@
+export type LoopbackHost = "127.0.0.1" | "::1";
+export declare function assertLoopbackHost(value: string, label: string): asserts value is LoopbackHost;
+export declare function assertPort(value: number, label: string, allowZero?: boolean): void;
+export declare function isLoopbackPeer(value: string | undefined): boolean;
+//# sourceMappingURL=loopback.d.ts.map

package/dist/local-actions/loopback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../../src/local-actions/loopback.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,KAAK,CAAC;AAE/C,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAI9F;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,UAAQ,GAAG,IAAI,CAIhF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEjE"}

package/dist/local-actions/loopback.js

@@ -0,0 +1,15 @@
+import { isIP } from "node:net";
+export function assertLoopbackHost(value, label) {
+    if ((value !== "127.0.0.1" && value !== "::1") || isIP(value) === 0) {
+        throw new TypeError(`${label} must be the literal loopback address 127.0.0.1 or ::1.`);
+    }
+}
+export function assertPort(value, label, allowZero = false) {
+    if (!Number.isSafeInteger(value) || value < (allowZero ? 0 : 1) || value > 65_535) {
+        throw new TypeError(`${label} must be an integer port in the allowed range.`);
+    }
+}
+export function isLoopbackPeer(value) {
+    return value === "127.0.0.1" || value === "::1" || value === "::ffff:127.0.0.1";
+}
+//# sourceMappingURL=loopback.js.map

package/dist/local-actions/loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../src/local-actions/loopback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAIhC,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,KAAa;IAC7D,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,yDAAyD,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,SAAS,GAAG,KAAK;IACxE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;QAClF,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,gDAAgD,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAyB;IACtD,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,kBAAkB,CAAC;AAClF,CAAC"}

package/dist/local-actions/policy-store.d.ts

@@ -0,0 +1,7 @@
+import type { PlatformAdapter } from "../platform/adapter.js";
+import type { LocalActionPolicyInput } from "./policy.js";
+export declare const LOCAL_ACTION_POLICY_FILE = "local-actions.json";
+export declare const MAX_LOCAL_ACTION_POLICY_BYTES: number;
+export declare function loadLocalActionDevicePolicy(adapter: PlatformAdapter): Promise<LocalActionPolicyInput>;
+export declare function parseLocalActionDevicePolicy(text: string): LocalActionPolicyInput;
+//# sourceMappingURL=policy-store.d.ts.map

package/dist/local-actions/policy-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-store.d.ts","sourceRoot":"","sources":["../../src/local-actions/policy-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAG9D,OAAO,KAAK,EAAE,sBAAsB,EAAyB,MAAM,aAAa,CAAC;AAEjF,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAC7D,eAAO,MAAM,6BAA6B,QAAa,CAAC;AAExD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAM3G;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CASjF"}

package/dist/local-actions/policy-store.js

@@ -0,0 +1,70 @@
+import { join } from "node:path";
+import { LOCAL_ACTION_PROVIDERS } from "./providers.js";
+export const LOCAL_ACTION_POLICY_FILE = "local-actions.json";
+export const MAX_LOCAL_ACTION_POLICY_BYTES = 64 * 1_024;
+export async function loadLocalActionDevicePolicy(adapter) {
+    const path = join(adapter.paths.configDirectory, LOCAL_ACTION_POLICY_FILE);
+    const snapshot = await adapter.readSafeConfig(path, MAX_LOCAL_ACTION_POLICY_BYTES);
+    if (!snapshot.exists)
+        return Object.freeze({ localDevicePolicy: Object.freeze([]) });
+    if (snapshot.text === undefined)
+        throw new TypeError("The local action policy file has no readable text.");
+    return parseLocalActionDevicePolicy(snapshot.text);
+}
+export function parseLocalActionDevicePolicy(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new TypeError("The local action policy is not valid JSON.");
+    }
+    if (!record(value) || value.version !== 1 || !Array.isArray(value.rules) ||
+        Object.keys(value).some((key) => key !== "version" && key !== "rules") || value.rules.length > 128) {
+        throw new TypeError("The local action policy must be a closed version 1 document.");
+    }
+    const rules = value.rules.map(parseRule);
+    return Object.freeze({ localDevicePolicy: Object.freeze(rules) });
+}
+function parseRule(value) {
+    if (!record(value) || typeof value.kind !== "string" || !localActionKind(value.kind) ||
+        (value.decision !== "deny" && value.decision !== "ask") ||
+        Object.keys(value).some((key) => !["kind", "providers", "scopes", "decision", "userApproved"].includes(key))) {
+        throw new TypeError("A local action policy rule is malformed or attempts to persist allow_once.");
+    }
+    const providers = value.providers === undefined ? undefined : parseProviders(value.providers);
+    const scopes = value.scopes === undefined ? undefined : parseScopes(value.scopes);
+    if (value.userApproved !== undefined)
+        throw new TypeError("Persistent policy cannot store an interactive grant.");
+    return Object.freeze({
+        kind: value.kind,
+        decision: value.decision,
+        ...(providers === undefined ? {} : { providers }),
+        ...(scopes === undefined ? {} : { scopes }),
+    });
+}
+function parseProviders(value) {
+    if (!Array.isArray(value) || value.length < 1 || value.length > 3 ||
+        !value.every((item) => typeof item === "string" && item in LOCAL_ACTION_PROVIDERS)) {
+        throw new TypeError("Local action policy providers are invalid.");
+    }
+    return Object.freeze([...new Set(value)]);
+}
+function parseScopes(value) {
+    if (!Array.isArray(value) || value.length < 1 || value.length > 32 ||
+        !value.every((item) => typeof item === "string" && /^[A-Za-z0-9._:@/-]{1,256}$/u.test(item))) {
+        throw new TypeError("Local action policy scopes are invalid.");
+    }
+    return Object.freeze([...new Set(value)]);
+}
+function localActionKind(value) {
+    return new Set([
+        "browser.open", "auth.device.present", "auth.callback.relay", "auth.result.observe", "clipboard.write",
+        "port.forward", "file.select", "attachment.import", "artifact.save", "preview.open", "diff.open",
+        "editor.open", "notification.show", "git.sign", "local_service.request", "device.select",
+    ]).has(value);
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=policy-store.js.map

package/dist/local-actions/policy-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-store.js","sourceRoot":"","sources":["../../src/local-actions/policy-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAC7D,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,KAAK,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAwB;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACnF,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC3G,OAAO,4BAA4B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IAAC,CAAC;IAC9G,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACrG,MAAM,IAAI,SAAS,CAAC,8DAA8D,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;QAClF,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/G,MAAM,IAAI,SAAS,CAAC,4EAA4E,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAC/D,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,sBAAsB,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAA8B,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAChE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAiB,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,GAAG,CAAkB;QAC9B,cAAc,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,iBAAiB;QACtG,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW;QAChG,aAAa,EAAE,mBAAmB,EAAE,UAAU,EAAE,uBAAuB,EAAE,eAAe;KACzF,CAAC,CAAC,GAAG,CAAC,KAAwB,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/local-actions/policy.d.ts

@@ -0,0 +1,21 @@
+import type { LocalActionKind, LocalActionProvider, LocalActionRequest, PolicyDecision } from "./contracts.js";
+export interface LocalActionPolicyRule {
+    readonly kind: LocalActionKind;
+    readonly providers?: readonly LocalActionProvider[];
+    readonly scopes?: readonly string[];
+    readonly decision: "deny" | "ask" | "allow_once" | "allow_scoped";
+    /** Required for a persisted allow_scoped rule; records an earlier interactive decision. */
+    readonly userApproved?: boolean;
+}
+export interface LocalActionPolicyInput {
+    /** Workspace-controlled declarations are a ceiling and can never grant. */
+    readonly projectRequestCeiling?: readonly LocalActionPolicyRule[];
+    /** User-owned device rules may allow only requests admitted by the ceiling. */
+    readonly localDevicePolicy?: readonly LocalActionPolicyRule[];
+}
+export declare class LocalActionPolicyEvaluator {
+    #private;
+    constructor(input?: LocalActionPolicyInput);
+    evaluate(request: LocalActionRequest, now?: number): PolicyDecision;
+}
+//# sourceMappingURL=policy.d.ts.map

package/dist/local-actions/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/local-actions/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC;IAClE,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClE,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC/D;AAED,qBAAa,0BAA0B;;gBAIzB,KAAK,GAAE,sBAA2B;IAK9C,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,SAAa,GAAG,cAAc;CAUxE"}

package/dist/local-actions/policy.js

@@ -0,0 +1,43 @@
+export class LocalActionPolicyEvaluator {
+    #project;
+    #device;
+    constructor(input = {}) {
+        this.#project = freezeRules(input.projectRequestCeiling ?? []);
+        this.#device = freezeRules(input.localDevicePolicy ?? []);
+    }
+    evaluate(request, now = Date.now()) {
+        const project = strongestMatchingRule(this.#project, request);
+        if (project?.decision === "deny")
+            return decision(request.id, "deny", null, "project_request_ceiling", now);
+        const device = strongestMatchingRule(this.#device, request);
+        if (device?.decision === "deny")
+            return decision(request.id, "deny", null, "local_device_policy", now);
+        // Device policy is a ceiling/preferences file, never a live grant. Every
+        // effect still needs a request-bound interactive decision for this exact
+        // identity and deadline.
+        return decision(request.id, "ask", null, "interactive_user", now);
+    }
+}
+function freezeRules(rules) {
+    return Object.freeze(rules.map((rule) => Object.freeze({
+        ...rule,
+        ...(rule.providers === undefined ? {} : { providers: Object.freeze([...rule.providers]) }),
+        ...(rule.scopes === undefined ? {} : { scopes: Object.freeze([...rule.scopes]) }),
+    })));
+}
+function strongestMatchingRule(rules, request) {
+    const matches = rules.filter((rule) => rule.kind === request.kind &&
+        (rule.providers === undefined || rule.providers.includes(request.provider)) &&
+        (rule.scopes === undefined || rule.scopes.includes(request.requestedScope)));
+    const priority = {
+        deny: 0,
+        ask: 1,
+        allow_once: 2,
+        allow_scoped: 3,
+    };
+    return matches.sort((left, right) => priority[left.decision] - priority[right.decision])[0];
+}
+function decision(requestId, value, grantedScope, source, decidedAt) {
+    return Object.freeze({ requestId, decision: value, grantedScope, policySource: source, decidedAt });
+}
+//# sourceMappingURL=policy.js.map

package/dist/local-actions/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/local-actions/policy.ts"],"names":[],"mappings":"AAuBA,MAAM,OAAO,0BAA0B;IAC5B,QAAQ,CAAmC;IAC3C,OAAO,CAAmC;IAEnD,YAAY,QAAgC,EAAE;QAC5C,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,QAAQ,CAAC,OAA2B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACpD,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,OAAO,EAAE,QAAQ,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,MAAM,EAAE,QAAQ,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QACvG,yEAAyE;QACzE,yEAAyE;QACzE,yBAAyB;QACzB,OAAO,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAuC;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACrD,GAAG,IAAI;QACP,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAuC,EACvC,OAA2B;IAE3B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;QAC/D,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3E,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAgE;QAC5E,IAAI,EAAE,CAAC;QACP,GAAG,EAAE,CAAC;QACN,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,CAAC;KAChB,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,QAAQ,CACf,SAAiB,EACjB,KAAiC,EACjC,YAA2B,EAC3B,MAAsC,EACtC,SAAiB;IAEjB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AACtG,CAAC"}

package/dist/local-actions/private-port-forward.d.ts

@@ -0,0 +1,36 @@
+import { type Socket } from "node:net";
+import { type LoopbackHost } from "./loopback.js";
+export interface PrivateForwardTarget {
+    readonly host: LoopbackHost;
+    readonly port: number;
+}
+export interface PrivateForwardConnector {
+    connect(target: PrivateForwardTarget): Socket;
+}
+export interface PrivatePortForwardHandle {
+    readonly localHost: LoopbackHost;
+    readonly localPort: number;
+    readonly remoteHost: LoopbackHost;
+    readonly remotePort: number;
+    readonly closed: Promise<void>;
+    readonly transferredBytes: () => number;
+    close(): Promise<void>;
+}
+export interface PrivatePortForwardOptions {
+    readonly localHost: LoopbackHost;
+    readonly requestedLocalPort: number;
+    readonly remoteHost: LoopbackHost;
+    readonly remotePort: number;
+    readonly deadlineMs: number;
+    readonly maximumConnections: number;
+    readonly maximumBytes: number;
+    readonly connector?: PrivateForwardConnector;
+    readonly signal?: AbortSignal;
+    readonly now?: () => number;
+}
+export declare class PrivatePortForwardError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function startPrivatePortForward(options: PrivatePortForwardOptions): Promise<PrivatePortForwardHandle>;
+//# sourceMappingURL=private-port-forward.d.ts.map

package/dist/local-actions/private-port-forward.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-port-forward.d.ts","sourceRoot":"","sources":["../../src/local-actions/private-port-forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAEpF,OAAO,EAAkD,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAElG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAAC;CAC/C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,MAAM,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;aACb,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAIjE;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAwGnH"}