@decionis/agent-safe-pipeline 0.1.3 → 0.1.4

package/dist/testing/LocalPresence.js

@@ -0,0 +1,473 @@
+/**
+ * Loopback stand-in for the Presence verification-request surface that the
+ * `@decionis/presence-node` human-approval gate uses, with the semantics an
+ * execution authority relies on: a request is bound to the exact intent hash
+ * (structurally through `action_context.intent_hash`, with the mandatory
+ * `Intent hash` display field as the fallback), a receipt exists only after a
+ * ceremony, the projection carries who approved in which role and with which
+ * authenticator, and receipt verification checks everything Decionis checks.
+ *
+ * It is a local double for developers and tests. It does not run a FIDO2
+ * ceremony, sign receipts, or reproduce the Presence Authority envelope
+ * protocol; the ceremony is completed by `approve`, `deny`, or the local
+ * control route. Every identity it mints is synthetic.
+ */
+import { createHash } from "node:crypto";
+import { createServer } from "node:http";
+import { z } from "zod";
+export const LOCAL_PRESENCE_API_KEY = "test-key";
+const LOOPBACK_ORIGIN = "http://127.0.0.1";
+const MAX_REQUEST_BYTES = 64 * 1024;
+const SOCKET_TIMEOUT_MS = 10_000;
+const IDEMPOTENCY_KEY_PATTERN = /^[\w.:-]{8,128}$/;
+const INTENT_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const boundedString = z.string().min(1).max(500);
+/** `CreateVerificationRequest` as the Presence contract accepts it, including the structural binding. */
+const CreateVerificationRequestSchema = z.object({
+    action_context: z
+        .object({
+        intent: boundedString,
+        surface: boundedString,
+        actor_id: boundedString,
+        target_resource_id: boundedString,
+        intent_hash: z.string().regex(INTENT_HASH_PATTERN).optional(),
+        amount: z.number().nonnegative().optional(),
+        currency: z.string().length(3).optional(),
+    })
+        .passthrough(),
+    originator: z
+        .object({
+        organization_name: boundedString,
+        actor_id: boundedString.optional(),
+        display_name: boundedString.optional(),
+        role: boundedString.optional(),
+    })
+        .passthrough(),
+    presentation: z.object({
+        locale: z.string().min(1).max(35),
+        title: boundedString,
+        description: z.string().min(1).max(2_000),
+        display_fields: z
+            .array(z.object({ key: boundedString, label: boundedString, value: boundedString }).strict())
+            .max(50),
+    }),
+    verification_requirements: z
+        .object({
+        level: z.enum(["STANDARD", "HIGH_CONFIDENCE"]),
+        methods: z
+            .array(z.enum(["WEBAUTHN", "MOBILE_DEVICE", "ACTIVE_LIVENESS"]))
+            .min(1)
+            .max(3),
+        hardware_pki_required: z.boolean(),
+        disallow_virtual_cameras: z.boolean(),
+        mobile_device_policy: z.enum(["WEB_OR_JIT_DEVICE", "MANAGED_DEVICE_REQUIRED"]).optional(),
+    })
+        .passthrough(),
+    ttl_seconds: z.number().int().min(30).max(600).default(120),
+});
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map((item) => canonical(item)).join(",")}]`;
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    const record = value;
+    const entries = Object.keys(record)
+        .sort()
+        .filter((key) => record[key] !== undefined)
+        .map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`);
+    return `{${entries.join(",")}}`;
+}
+function sha256Hex(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+export class LocalPresence {
+    /** Every request seen, oldest first. */
+    requests = [];
+    /** Receipts sealed, keyed by receipt dossier id. */
+    receipts = new Map();
+    verifications = new Map();
+    byIdempotencyKey = new Map();
+    apiKey;
+    pendingLookups;
+    autoComplete;
+    defaultRole;
+    roles;
+    authenticator;
+    clock;
+    nextStatus = null;
+    sequence = 0;
+    server = null;
+    port = 0;
+    constructor(options = {}) {
+        if (process.env.NODE_ENV === "production")
+            throw new Error("LOCAL_DOUBLE_FORBIDDEN");
+        this.apiKey = options.apiKey ?? LOCAL_PRESENCE_API_KEY;
+        this.pendingLookups = options.pendingLookups ?? 1;
+        this.autoComplete = options.autoComplete ?? "APPROVE";
+        this.defaultRole = options.defaultRole ?? "APPROVER";
+        this.roles = options.roles ?? {};
+        this.authenticator = options.authenticator ?? { method: "WEBAUTHN", user_verified: true };
+        this.clock = options.clock ?? Date.now;
+    }
+    get baseUrl() {
+        return `${LOOPBACK_ORIGIN}:${this.port}`;
+    }
+    async start() {
+        const server = createServer((req, res) => {
+            void this.handle(req, res);
+        });
+        server.setTimeout(SOCKET_TIMEOUT_MS);
+        await new Promise((resolve) => server.listen(0, "127.0.0.1", () => resolve()));
+        const address = server.address();
+        this.port = typeof address === "object" && address !== null ? address.port : 0;
+        this.server = server;
+    }
+    async stop() {
+        const server = this.server;
+        if (server === null)
+            return;
+        server.closeAllConnections();
+        await new Promise((resolve) => server.close(() => resolve()));
+        this.server = null;
+    }
+    /**
+     * Terminal status of the next request created: `"ALLOWED"` approves,
+     * `"BLOCKED"` denies, `"MANUAL"` waits for an explicit completion.
+     */
+    scriptNextStatus(status) {
+        this.nextStatus = status === "ALLOWED" ? "APPROVE" : status === "BLOCKED" ? "DENY" : "MANUAL";
+    }
+    /** The current state of one verification request without counting a lookup, or null. */
+    verification(requestId) {
+        const record = this.verifications.get(requestId);
+        return record === undefined ? null : this.expireIfDue(record);
+    }
+    /**
+     * One outcome lookup, as the authority or the SDK performs it: counts toward
+     * the pending lookups, applies automatic completion and expiry, and returns
+     * the current state.
+     */
+    poll(requestId) {
+        const record = this.verifications.get(requestId);
+        if (record === undefined)
+            return null;
+        this.expireIfDue(record);
+        if (record.status === "PENDING" || record.status === "DELIVERED") {
+            record.lookups += 1;
+            if (record.scheduledResponse !== "MANUAL" && record.lookups > this.pendingLookups) {
+                this.complete(requestId, record.scheduledResponse);
+            }
+        }
+        return record;
+    }
+    /** Completes the ceremony as an approval by the bound subject. */
+    approve(requestId) {
+        return this.complete(requestId, "APPROVE");
+    }
+    /** Completes the ceremony as a denial by the bound subject. */
+    deny(requestId) {
+        return this.complete(requestId, "DENY");
+    }
+    cancel(requestId) {
+        const record = this.verifications.get(requestId);
+        if (record === undefined || this.isTerminal(record))
+            return false;
+        record.status = "CANCELLED";
+        record.result = "BLOCK";
+        return true;
+    }
+    /** Forces expiry regardless of the clock. */
+    expire(requestId) {
+        const record = this.verifications.get(requestId);
+        if (record === undefined || this.isTerminal(record))
+            return false;
+        record.status = "EXPIRED";
+        record.result = "BLOCK";
+        return true;
+    }
+    /** Compatibility check used by the contract harness: receipt, request, and hash agree. */
+    verifyReceipt(approval, binding) {
+        return this.verifyReceiptDetailed(approval, binding).ok;
+    }
+    /**
+     * Mirrors the authority-side checks: terminal ALLOWED with result ALLOW, the
+     * receipt the request produced, action type and target, the intent hash
+     * (structural when present, otherwise the display field), an approver with
+     * a role, an optional required role, and the request's own expiry.
+     */
+    verifyReceiptDetailed(approval, binding) {
+        const expected = typeof binding === "string" ? { intentHash: binding } : binding;
+        const record = this.verifications.get(approval.requestId);
+        if (record === undefined)
+            return { ok: false, reasonCode: "PRESENCE_REQUEST_UNKNOWN" };
+        this.expireIfDue(record);
+        const receipt = this.receipts.get(approval.receiptDossierId);
+        if (receipt === undefined ||
+            receipt.requestId !== approval.requestId ||
+            record.receiptDossierId !== approval.receiptDossierId) {
+            return { ok: false, reasonCode: "PRESENCE_DOSSIER_INVALID" };
+        }
+        if (record.status !== "ALLOWED" || record.result !== "ALLOW" || receipt.result !== "ALLOW") {
+            return { ok: false, reasonCode: "PRESENCE_OUTCOME_NOT_ALLOW" };
+        }
+        if ((expected.actionType !== undefined && record.action.intent !== expected.actionType) ||
+            (expected.resource !== undefined && record.action.target !== expected.resource)) {
+            return { ok: false, reasonCode: "PRESENCE_ACTION_MISMATCH" };
+        }
+        if (record.intentHash !== expected.intentHash) {
+            return { ok: false, reasonCode: "PRESENCE_INTENT_HASH_MISMATCH" };
+        }
+        if (expected.requiredRole !== undefined && receipt.approverRole !== expected.requiredRole) {
+            return { ok: false, reasonCode: "PRESENCE_APPROVER_ROLE_MISMATCH" };
+        }
+        if (Date.parse(record.expiresAt) <= this.clock()) {
+            return { ok: false, reasonCode: "PRESENCE_APPROVAL_EXPIRED" };
+        }
+        return {
+            ok: true,
+            approverIdentity: receipt.approverIdentity,
+            approverRole: receipt.approverRole,
+            authenticator: this.authenticator,
+        };
+    }
+    /** Creates a request without HTTP; the same path the route uses. */
+    createRequest(body, idempotencyKey) {
+        return this.createVerificationRequest(body, idempotencyKey);
+    }
+    async handle(req, res) {
+        const url = new URL(req.url ?? "/", this.baseUrl);
+        const record = {
+            method: req.method ?? "GET",
+            path: url.pathname,
+            headers: {
+                authorization: headerString(req.headers.authorization),
+                "idempotency-key": headerString(req.headers["idempotency-key"]),
+            },
+            body: null,
+            response: null,
+            at: new Date(this.clock()).toISOString(),
+        };
+        this.requests.push(record);
+        const raw = await readBody(req, MAX_REQUEST_BYTES);
+        if (raw === null)
+            return this.send(res, record, 413, { reason: "REQUEST_TOO_LARGE" });
+        try {
+            record.body = raw.length === 0 ? null : JSON.parse(raw);
+        }
+        catch {
+            return this.send(res, record, 400, { reason: "REQUEST_MALFORMED" });
+        }
+        if (req.headers.authorization !== `Bearer ${this.apiKey}`) {
+            return this.send(res, record, 401, { reason: "UNAUTHORIZED" });
+        }
+        const requestMatch = url.pathname.match(/^\/v1\/verification-requests\/([^/]+)$/);
+        const completeMatch = url.pathname.match(/^\/local\/verification-requests\/([^/]+)\/complete$/);
+        const dossierMatch = url.pathname.match(/^\/v1\/dossiers\/([^/]+)\/verify$/);
+        let computed;
+        if (req.method === "POST" && url.pathname === "/v1/verification-requests") {
+            computed = this.createVerificationRequest(record.body, record.headers["idempotency-key"] ?? "");
+        }
+        else if (req.method === "GET" && requestMatch !== null) {
+            computed = this.projection(decodeURIComponent(requestMatch[1] ?? ""));
+        }
+        else if (req.method === "DELETE" && requestMatch !== null) {
+            const cancelled = this.cancel(decodeURIComponent(requestMatch[1] ?? ""));
+            computed = cancelled
+                ? this.projection(decodeURIComponent(requestMatch[1] ?? ""))
+                : { status: 409, body: { reason: "request_not_cancellable" } };
+        }
+        else if (req.method === "POST" && completeMatch !== null) {
+            const response = record.body?.response;
+            if (response !== "APPROVE" && response !== "DENY") {
+                computed = { status: 400, body: { reason: "REQUEST_INVALID" } };
+            }
+            else {
+                const receipt = this.complete(decodeURIComponent(completeMatch[1] ?? ""), response);
+                computed =
+                    receipt === null
+                        ? { status: 409, body: { reason: "request_not_completable" } }
+                        : this.projection(decodeURIComponent(completeMatch[1] ?? ""));
+            }
+        }
+        else if (req.method === "GET" && dossierMatch !== null) {
+            const dossierId = decodeURIComponent(dossierMatch[1] ?? "");
+            const receipt = this.receipts.get(dossierId);
+            computed = {
+                status: receipt === undefined ? 404 : 200,
+                body: {
+                    dossier_id: dossierId,
+                    valid: receipt !== undefined,
+                    signature_valid: receipt !== undefined,
+                    chain_valid: receipt !== undefined,
+                },
+            };
+        }
+        else {
+            computed = { status: 404, body: { reason: "NOT_FOUND" } };
+        }
+        return this.send(res, record, computed.status, computed.body);
+    }
+    createVerificationRequest(body, idempotencyKey) {
+        if (!IDEMPOTENCY_KEY_PATTERN.test(idempotencyKey)) {
+            return { status: 400, body: { reason: "invalid_idempotency_key" } };
+        }
+        const parsed = CreateVerificationRequestSchema.safeParse(body);
+        if (!parsed.success)
+            return { status: 400, body: { reason: "REQUEST_INVALID" } };
+        const input = parsed.data;
+        const existingId = this.byIdempotencyKey.get(idempotencyKey);
+        if (existingId !== undefined)
+            return this.created(existingId);
+        const displayed = input.presentation.display_fields.find((field) => field.key === "intent_hash")?.value ?? null;
+        const structural = input.action_context.intent_hash ?? null;
+        if (structural !== null && displayed !== null && structural !== displayed) {
+            // A structural binding that disagrees with what the person would see is
+            // an integration defect, never something to seal.
+            return { status: 400, body: { reason: "intent_binding_mismatch" } };
+        }
+        this.sequence += 1;
+        const requestId = `synthetic-presence-request-${this.sequence}`;
+        const now = this.clock();
+        const subjectActorId = input.action_context.actor_id;
+        const record = {
+            requestId,
+            sessionId: `synthetic-presence-session-${this.sequence}`,
+            intentDigest: sha256Hex(canonical(input.action_context)),
+            idempotencyKey,
+            subjectActorId,
+            subjectRole: this.roles[subjectActorId] ?? this.defaultRole,
+            action: {
+                intent: input.action_context.intent,
+                target: input.action_context.target_resource_id,
+            },
+            intentHash: structural ?? displayed,
+            bindingSource: structural !== null ? "structural" : displayed !== null ? "display_field" : "none",
+            actionContext: input.action_context,
+            presentation: input.presentation,
+            requirements: input.verification_requirements,
+            createdAt: new Date(now).toISOString(),
+            expiresAt: new Date(now + input.ttl_seconds * 1_000).toISOString(),
+            status: "PENDING",
+            result: null,
+            receiptDossierId: null,
+            approvedAt: null,
+            lookups: 0,
+            scheduledResponse: this.nextStatus ?? this.autoComplete,
+        };
+        this.nextStatus = null;
+        this.verifications.set(requestId, record);
+        this.byIdempotencyKey.set(idempotencyKey, requestId);
+        return this.created(requestId);
+    }
+    created(requestId) {
+        const record = this.verifications.get(requestId);
+        if (record === undefined)
+            return { status: 404, body: { reason: "request_not_found" } };
+        return {
+            status: 200,
+            body: {
+                request_id: requestId,
+                invitation_token: `presence_it_synthetic_${this.sequence}`,
+                invitation_url: `https://presence.example.invalid/verify#invitation_token=presence_it_synthetic_${this.sequence}`,
+                invitation_expires_at: record.expiresAt,
+                channel: "handoff",
+            },
+        };
+    }
+    projection(requestId) {
+        const record = this.poll(requestId);
+        if (record === null)
+            return { status: 404, body: { reason: "request_not_found" } };
+        const receipt = record.receiptDossierId === null ? undefined : this.receipts.get(record.receiptDossierId);
+        return {
+            status: 200,
+            body: {
+                request_id: record.requestId,
+                session_id: record.sessionId,
+                intent_digest: record.intentDigest,
+                status: record.status,
+                ...(record.result === null ? {} : { result: record.result }),
+                ...(record.receiptDossierId === null
+                    ? {}
+                    : { receipt_dossier_id: record.receiptDossierId }),
+                ...(record.approvedAt === null ? {} : { approved_at: record.approvedAt }),
+                expires_at: record.expiresAt,
+                envelope: {
+                    envelope_version: "presence.intent/1",
+                    action_context: record.actionContext,
+                    subject_actor_id: record.subjectActorId,
+                    presentation: record.presentation,
+                    verification_requirements: record.requirements,
+                    expires_at: record.expiresAt,
+                },
+                ...(receipt === undefined
+                    ? {}
+                    : {
+                        approver: { id: receipt.approverIdentity, role: receipt.approverRole },
+                        approver_identity: receipt.approverIdentity,
+                        approver_role: receipt.approverRole,
+                        authenticator: this.authenticator,
+                    }),
+            },
+        };
+    }
+    complete(requestId, response) {
+        const record = this.verifications.get(requestId);
+        if (record === undefined)
+            return null;
+        this.expireIfDue(record);
+        if (this.isTerminal(record))
+            return null;
+        const receiptDossierId = `synthetic-presence-receipt-${requestId.split("-").at(-1) ?? "0"}`;
+        const sealedAt = new Date(this.clock()).toISOString();
+        const receipt = {
+            requestId,
+            intentHash: record.intentHash,
+            result: response === "APPROVE" ? "ALLOW" : "BLOCK",
+            approverIdentity: record.subjectActorId,
+            approverRole: record.subjectRole,
+            sealedAt,
+        };
+        this.receipts.set(receiptDossierId, receipt);
+        record.receiptDossierId = receiptDossierId;
+        record.result = receipt.result;
+        record.status = response === "APPROVE" ? "ALLOWED" : "BLOCKED";
+        record.approvedAt = response === "APPROVE" ? sealedAt : null;
+        return receipt;
+    }
+    expireIfDue(record) {
+        if (!this.isTerminal(record) && Date.parse(record.expiresAt) <= this.clock()) {
+            record.status = "EXPIRED";
+            record.result = "BLOCK";
+        }
+        return record;
+    }
+    isTerminal(record) {
+        return record.status !== "PENDING" && record.status !== "DELIVERED";
+    }
+    send(res, record, status, body) {
+        record.response = { status, body };
+        res.writeHead(status, { "content-type": "application/json" });
+        res.end(JSON.stringify(body));
+    }
+}
+function headerString(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value))
+        return value[0] ?? null;
+    return null;
+}
+export async function readBody(req, maxBytes) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+        total += buffer.length;
+        if (total > maxBytes)
+            return null;
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+//# sourceMappingURL=LocalPresence.js.map

package/dist/testing/LocalPresence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalPresence.js","sourceRoot":"","sources":["../../src/testing/LocalPresence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AACnD,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAEpD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEjD,yGAAyG;AACzG,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,cAAc,EAAE,CAAC;SACd,MAAM,CAAC;QACN,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,aAAa;QACvB,kBAAkB,EAAE,aAAa;QACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;QAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC1C,CAAC;SACD,WAAW,EAAE;IAChB,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,iBAAiB,EAAE,aAAa;QAChC,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE;QAClC,YAAY,EAAE,aAAa,CAAC,QAAQ,EAAE;QACtC,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;KAC/B,CAAC;SACD,WAAW,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QACzC,cAAc,EAAE,CAAC;aACd,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aAC5F,GAAG,CAAC,EAAE,CAAC;KACX,CAAC;IACF,yBAAyB,EAAE,CAAC;SACzB,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAC9C,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC;aAC/D,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,CAAC,CAAC;QACT,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;QAClC,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;QACrC,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC1F,CAAC;SACD,WAAW,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CAC5D,CAAC,CAAC;AAgGH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAChC,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;SAC1C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,OAAO,aAAa;IACxB,wCAAwC;IACxB,QAAQ,GAAiC,EAAE,CAAC;IAC5D,oDAAoD;IACpC,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC1C,aAAa,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC3D,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,CAAS;IACf,cAAc,CAAS;IACvB,YAAY,CAAmC;IAC/C,WAAW,CAAS;IACpB,KAAK,CAAmC;IACxC,aAAa,CAAqB;IAClC,KAAK,CAAe;IAC7B,UAAU,GAA4C,IAAI,CAAC;IAC3D,QAAQ,GAAG,CAAC,CAAC;IACb,MAAM,GAAkB,IAAI,CAAC;IAC7B,IAAI,GAAG,CAAC,CAAC;IAEjB,YAAmB,UAAgC,EAAE;QACnD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC;QACvD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,SAAS,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC1F,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACzC,CAAC;IAED,IAAW,OAAO;QAChB,OAAO,GAAG,eAAe,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QACrC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,IAAI;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO;QAC5B,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED;;;OAGG;IACI,gBAAgB,CAAC,MAAwC;QAC9D,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChG,CAAC;IAED,wFAAwF;IACjF,YAAY,CAAC,SAAiB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACI,IAAI,CAAC,SAAiB;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjE,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpB,IAAI,MAAM,CAAC,iBAAiB,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClF,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kEAAkE;IAC3D,OAAO,CAAC,SAAiB;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED,+DAA+D;IACxD,IAAI,CAAC,SAAiB;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAEM,MAAM,CAAC,SAAiB;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC;QAC5B,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6CAA6C;IACtC,MAAM,CAAC,SAAiB;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0FAA0F;IACnF,aAAa,CAClB,QAA2E,EAC3E,OAAqC;QAErC,OAAO,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;OAKG;IACI,qBAAqB,CAC1B,QAA2E,EAC3E,OAAqC;QAErC,MAAM,QAAQ,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACjF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC;QACvF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC7D,IACE,OAAO,KAAK,SAAS;YACrB,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;YACxC,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB,EACrD,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,4BAA4B,EAAE,CAAC;QACjE,CAAC;QACD,IACE,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,CAAC;YACnF,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,EAC/E,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,+BAA+B,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,iCAAiC,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,2BAA2B,EAAE,CAAC;QAChE,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;IACJ,CAAC;IAED,oEAAoE;IAC7D,aAAa,CAClB,IAAa,EACb,cAAsB;QAEtB,OAAO,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAA+B;YACzC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;YAC3B,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,OAAO,EAAE;gBACP,aAAa,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;gBACtD,iBAAiB,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;aAChE;YACD,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,IAAI;YACd,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;SACzC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACnD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAChG,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC7E,IAAI,QAA0B,CAAC;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,2BAA2B,EAAE,CAAC;YAC1E,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CACvC,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CACxC,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YACzD,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACzE,QAAQ,GAAG,SAAS;gBAClB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACnE,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3D,MAAM,QAAQ,GAAI,MAAM,CAAC,IAAsC,EAAE,QAAQ,CAAC;YAC1E,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAClD,QAAQ,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACpF,QAAQ;oBACN,OAAO,KAAK,IAAI;wBACd,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE;wBAC9D,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YACzD,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7C,QAAQ,GAAG;gBACT,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;gBACzC,IAAI,EAAE;oBACJ,UAAU,EAAE,SAAS;oBACrB,KAAK,EAAE,OAAO,KAAK,SAAS;oBAC5B,eAAe,EAAE,OAAO,KAAK,SAAS;oBACtC,WAAW,EAAE,OAAO,KAAK,SAAS;iBACnC;aACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAEO,yBAAyB,CAAC,IAAa,EAAE,cAAsB;QACrE,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC;QACjF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7D,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE9D,MAAM,SAAS,GACb,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,aAAa,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;QAChG,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,WAAW,IAAI,IAAI,CAAC;QAC5D,IAAI,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1E,wEAAwE;YACxE,kDAAkD;YAClD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,8BAA8B,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;QACrD,MAAM,MAAM,GAA4B;YACtC,SAAS;YACT,SAAS,EAAE,8BAA8B,IAAI,CAAC,QAAQ,EAAE;YACxD,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACxD,cAAc;YACd,cAAc;YACd,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,WAAW;YAC3D,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;gBACnC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,kBAAkB;aAChD;YACD,UAAU,EAAE,UAAU,IAAI,SAAS;YACnC,aAAa,EACX,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM;YACpF,aAAa,EAAE,KAAK,CAAC,cAAc;YACnC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,KAAK,CAAC,yBAAyB;YAC7C,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACtC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;YAClE,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,IAAI;YACZ,gBAAgB,EAAE,IAAI;YACtB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,CAAC;YACV,iBAAiB,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY;SACxD,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC;QACxF,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,UAAU,EAAE,SAAS;gBACrB,gBAAgB,EAAE,yBAAyB,IAAI,CAAC,QAAQ,EAAE;gBAC1D,cAAc,EAAE,kFAAkF,IAAI,CAAC,QAAQ,EAAE;gBACjH,qBAAqB,EAAE,MAAM,CAAC,SAAS;gBACvC,OAAO,EAAE,SAAS;aACnB;SACF,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,SAAiB;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC;QACnF,MAAM,OAAO,GACX,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5F,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC5D,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,IAAI;oBAClC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBACpD,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;gBACzE,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,QAAQ,EAAE;oBACR,gBAAgB,EAAE,mBAAmB;oBACrC,cAAc,EAAE,MAAM,CAAC,aAAa;oBACpC,gBAAgB,EAAE,MAAM,CAAC,cAAc;oBACvC,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,yBAAyB,EAAE,MAAM,CAAC,YAAY;oBAC9C,UAAU,EAAE,MAAM,CAAC,SAAS;iBAC7B;gBACD,GAAG,CAAC,OAAO,KAAK,SAAS;oBACvB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE;wBACtE,iBAAiB,EAAE,OAAO,CAAC,gBAAgB;wBAC3C,aAAa,EAAE,OAAO,CAAC,YAAY;wBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;qBAClC,CAAC;aACP;SACF,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,SAAiB,EAAE,QAA+B;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,gBAAgB,GAAG,8BAA8B,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QAC5F,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,OAAO,GAAiB;YAC5B,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;YAClD,gBAAgB,EAAE,MAAM,CAAC,cAAc;YACvC,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,QAAQ;SACT,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QAC3C,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,MAAM,CAAC,UAAU,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,WAAW,CAAC,MAA+B;QACjD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7E,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;YAC1B,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,UAAU,CAAC,MAA+B;QAChD,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC;IACtE,CAAC;IAEO,IAAI,CACV,GAAmB,EACnB,MAAkC,EAClC,MAAc,EACd,IAAa;QAEb,MAAM,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAoC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,QAAgB;IACnE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC;QAClF,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,KAAK,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}

package/package.json

@@ -1,7 +1,39 @@
 {
   "name": "@decionis/agent-safe-pipeline",
-  "version": "0.1.3",
-  "description": "An execution architecture where AI agents may propose actions but cannot authorize their own execution.",
+  "version": "0.1.4",
+  "description": "Execution Authority for AI agents: agents propose, Decionis independently decides ALLOW / ESCALATE / BLOCK, Presence verifies human approval on escalation, and a SafeExecutor runs only on a single-use intent-bound grant. Every decision leaves a Decision Dossier.",
+  "keywords": [
+    "execution-authority",
+    "ai-agents",
+    "agentic-ai",
+    "ai-agent-permissions",
+    "agent-guardrails",
+    "agent-security",
+    "ai-safety",
+    "ai-governance",
+    "authorization",
+    "policy-as-code",
+    "policy-enforcement",
+    "human-in-the-loop",
+    "human-approval",
+    "approval-workflow",
+    "decision-dossier",
+    "decision-evidence",
+    "audit-trail",
+    "fail-closed",
+    "single-use-grant",
+    "intent-binding",
+    "least-privilege",
+    "shadow-mode",
+    "mcp",
+    "model-context-protocol",
+    "tool-calling",
+    "llm-agents",
+    "reference-architecture",
+    "typescript",
+    "decionis",
+    "presence"
+  ],
   "license": "Apache-2.0",
   "author": "Decionis, Inc.",
   "repository": {
@@ -27,6 +59,10 @@
     ".": {
       "types": "./dist/Index.d.ts",
       "import": "./dist/Index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/Index.d.ts",
+      "import": "./dist/testing/Index.js"
     }
   },
   "engines": {
@@ -34,8 +70,8 @@
   },
   "dependencies": {
     "@decionis/presence-node": "^0.2.0",
-    "jose": "^6.2.9",
-    "zod": "^4.4.3"
+    "jose": "^6.2.10",
+    "zod": "^4.5.4"
   },
   "devDependencies": {
     "@stryker-mutator/core": "10.0.0",