@decionis/agent-safe-pipeline 0.1.3 → 0.2.0

package/dist/audit/AuditRecorder.js

@@ -0,0 +1,312 @@
+import { randomUUID } from "node:crypto";
+const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const AUDIT_AUTHORITIES = new Set([
+    "AUTHORITATIVE",
+    "OBSERVATIONAL",
+    "NON_AUTHORITATIVE",
+]);
+const AUDIT_VERDICTS = new Set(["ALLOW", "ESCALATE", "BLOCK"]);
+const RESTRICTED_METADATA_KEY = /authorization|credential|password|secret|token|parameters|context|provider[_-]?result/i;
+const MAX_METADATA_DEPTH = 4;
+const MAX_METADATA_ENTRIES = 50;
+const MAX_METADATA_ARRAY = 20;
+const MAX_METADATA_STRING = 500;
+const MAX_METADATA_BYTES = 4 * 1024;
+/**
+ * Emits immutable, redacted lifecycle records through one bounded sink call.
+ * Sink failures are converted to `false`; the recorder never retries because
+ * retries could reorder evidence or couple provider execution to sink health.
+ */
+export class AuditRecorder {
+    options;
+    timeoutMs;
+    failurePolicy;
+    metadataAllowlist;
+    clock;
+    createId;
+    constructor(options) {
+        this.options = options;
+        this.timeoutMs = Math.min(Math.max(options.timeoutMs ?? 100, 1), 5_000);
+        this.failurePolicy = options.failurePolicy ?? "BEST_EFFORT";
+        this.metadataAllowlist = new Set(options.metadataAllowlist ?? []);
+        this.clock = options.clock ?? (() => new Date());
+        this.createId = options.createId ?? randomUUID;
+        if (this.metadataAllowlist.size > MAX_METADATA_ENTRIES) {
+            throw new Error("AUDIT_METADATA_ALLOWLIST_TOO_LARGE");
+        }
+        for (const key of this.metadataAllowlist)
+            AuditRecorder.assertIdentifier(key);
+    }
+    get requiresDeliveryBeforeExecution() {
+        return this.failurePolicy === "REQUIRE_BEFORE_EXECUTION";
+    }
+    async record(input) {
+        try {
+            const event = this.event(input);
+            const delivered = await new Promise((resolve) => {
+                let settled = false;
+                const settle = (result) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    clearTimeout(timeout);
+                    resolve(result);
+                };
+                const timeout = setTimeout(() => settle(false), this.timeoutMs);
+                void Promise.resolve()
+                    .then(async () => await this.options.sink.write(event))
+                    .then(() => settle(true), () => settle(false));
+            });
+            return delivered;
+        }
+        catch {
+            return false;
+        }
+    }
+    event(input) {
+        AuditRecorder.assertIdentifier(input.captured.intent.intentId);
+        AuditRecorder.assertDigest(input.captured.intentHash);
+        if (input.durationMs !== undefined &&
+            (!Number.isFinite(input.durationMs) || input.durationMs < 0)) {
+            throw new Error("AUDIT_DURATION_INVALID");
+        }
+        const reasonCodes = input.reasonCodes ?? input.decision?.reasonCodes ?? [];
+        if (reasonCodes.length > 50)
+            throw new Error("AUDIT_REASON_CODES_TOO_MANY");
+        for (const reasonCode of reasonCodes) {
+            AuditRecorder.assertIdentifier(reasonCode);
+        }
+        const authority = input.authority ?? AuditRecorder.defaultAuthority(input.eventType);
+        if (!AUDIT_AUTHORITIES.has(authority))
+            throw new Error("AUDIT_AUTHORITY_INVALID");
+        if (input.eventType === "SHADOW_EVALUATED" && authority !== "OBSERVATIONAL") {
+            throw new Error("AUDIT_SHADOW_MUST_BE_OBSERVATIONAL");
+        }
+        const verdict = input.verdict ?? input.decision?.verdict ?? null;
+        if (verdict !== null && !AUDIT_VERDICTS.has(verdict)) {
+            throw new Error("AUDIT_VERDICT_INVALID");
+        }
+        const decisionId = input.decisionId ?? input.decision?.decisionId;
+        const dossierId = input.dossierId ?? input.decision?.dossierId ?? undefined;
+        const grantId = input.grantId ?? input.authorization?.grantId;
+        // Observational evidence must never correlate to an execution grant.
+        if (authority === "OBSERVATIONAL" && (grantId !== undefined || input.authorization)) {
+            throw new Error("AUDIT_OBSERVATIONAL_GRANT_FORBIDDEN");
+        }
+        if (decisionId !== undefined)
+            AuditRecorder.assertIdentifier(decisionId);
+        if (dossierId !== undefined)
+            AuditRecorder.assertIdentifier(dossierId);
+        if (grantId !== undefined)
+            AuditRecorder.assertIdentifier(grantId);
+        if (input.captured.intent.correlationId !== undefined) {
+            AuditRecorder.assertIdentifier(input.captured.intent.correlationId);
+        }
+        const evaluation = input.decision
+            ? this.evaluation(input.captured, input.decision, input.evaluation)
+            : null;
+        const event = {
+            schemaVersion: "agent-safe.audit/1",
+            eventId: this.boundedId(this.createId()),
+            occurredAt: this.validDate(this.clock()).toISOString(),
+            eventType: input.eventType,
+            authority,
+            correlation: {
+                intentId: input.captured.intent.intentId,
+                intentHash: input.captured.intentHash,
+                ...(input.captured.intent.correlationId === undefined
+                    ? {}
+                    : { correlationId: input.captured.intent.correlationId }),
+                ...(decisionId === undefined ? {} : { decisionId }),
+                ...(dossierId === undefined ? {} : { dossierId }),
+                ...(grantId === undefined ? {} : { grantId }),
+            },
+            evaluation,
+            verdict,
+            reasonCodes: [...reasonCodes],
+            durationMs: input.durationMs === undefined ? null : Math.round(input.durationMs * 1_000) / 1_000,
+            metadata: this.metadata(input.metadata),
+        };
+        return AuditRecorder.deepFreeze(event);
+    }
+    evaluation(captured, decision, evidence) {
+        const evaluationId = evidence?.evaluationId ?? decision.decisionId;
+        const materialInputDigest = evidence?.materialInputDigest ?? captured.intentHash;
+        const evidenceReference = evidence?.evidenceReference ?? decision.dossierId;
+        AuditRecorder.assertIdentifier(evaluationId);
+        AuditRecorder.assertDigest(materialInputDigest);
+        if (evidenceReference !== null)
+            AuditRecorder.assertIdentifier(evidenceReference);
+        let policy = null;
+        if (evidence?.policy !== undefined) {
+            AuditRecorder.assertIdentifier(evidence.policy.policyId);
+            AuditRecorder.assertIdentifier(evidence.policy.revisionId);
+            if (/^(?:current|latest)$/i.test(evidence.policy.revisionId)) {
+                throw new Error("AUDIT_POLICY_REVISION_MUTABLE_ALIAS");
+            }
+            if (evidence.policy.version !== undefined) {
+                AuditRecorder.assertIdentifier(evidence.policy.version);
+            }
+            AuditRecorder.assertDigest(evidence.policy.digest);
+            policy = { ...evidence.policy };
+        }
+        return {
+            evaluationId,
+            materialInputDigest,
+            policy,
+            evidenceReference,
+        };
+    }
+    metadata(input) {
+        if (input === undefined)
+            return Object.freeze({});
+        const output = {};
+        for (const [key, value] of Object.entries(input)) {
+            if (!this.metadataAllowlist.has(key) || RESTRICTED_METADATA_KEY.test(key))
+                continue;
+            const redacted = this.options.redactMetadata === undefined ? value : this.options.redactMetadata(key, value);
+            if (redacted !== undefined)
+                output[key] = this.copyJson(redacted, 0, { entries: 0 });
+        }
+        if (Buffer.byteLength(JSON.stringify(output), "utf8") > MAX_METADATA_BYTES) {
+            throw new Error("AUDIT_METADATA_TOO_LARGE");
+        }
+        return AuditRecorder.deepFreeze(output);
+    }
+    copyJson(value, depth, count) {
+        if (depth > MAX_METADATA_DEPTH)
+            throw new Error("AUDIT_METADATA_TOO_DEEP");
+        if (typeof value === "string") {
+            if (value.length > MAX_METADATA_STRING)
+                throw new Error("AUDIT_METADATA_STRING_TOO_LONG");
+            return value;
+        }
+        if (typeof value === "number" && !Number.isFinite(value)) {
+            throw new Error("AUDIT_METADATA_NUMBER_INVALID");
+        }
+        if (value === null || typeof value !== "object")
+            return value;
+        if (Array.isArray(value)) {
+            if (value.length > MAX_METADATA_ARRAY)
+                throw new Error("AUDIT_METADATA_ARRAY_TOO_LONG");
+            return value.map((entry) => {
+                count.entries += 1;
+                if (count.entries > MAX_METADATA_ENTRIES)
+                    throw new Error("AUDIT_METADATA_TOO_COMPLEX");
+                return this.copyJson(entry, depth + 1, count);
+            });
+        }
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new Error("AUDIT_METADATA_OBJECT_INVALID");
+        }
+        const copy = {};
+        for (const [key, entry] of Object.entries(value)) {
+            if (key === "__proto__" || key === "constructor" || key === "prototype") {
+                throw new Error("AUDIT_METADATA_KEY_INVALID");
+            }
+            count.entries += 1;
+            if (count.entries > MAX_METADATA_ENTRIES)
+                throw new Error("AUDIT_METADATA_TOO_COMPLEX");
+            copy[key] = this.copyJson(entry, depth + 1, count);
+        }
+        return copy;
+    }
+    boundedId(value) {
+        AuditRecorder.assertIdentifier(value);
+        return value;
+    }
+    validDate(value) {
+        if (!(value instanceof Date) || !Number.isFinite(value.valueOf())) {
+            throw new Error("AUDIT_CLOCK_INVALID");
+        }
+        return value;
+    }
+    static defaultAuthority(eventType) {
+        if (eventType === "INTENT_CAPTURED")
+            return "NON_AUTHORITATIVE";
+        if (eventType === "SHADOW_EVALUATED")
+            return "OBSERVATIONAL";
+        if (eventType === "PRESENCE_ESCALATED" || eventType === "PRESENCE_RESOLVED") {
+            return "NON_AUTHORITATIVE";
+        }
+        return "AUTHORITATIVE";
+    }
+    static assertIdentifier(value) {
+        if (!isBoundedIdentifier(value))
+            throw new Error("AUDIT_IDENTIFIER_INVALID");
+    }
+    static assertDigest(value) {
+        if (!DIGEST_PATTERN.test(value))
+            throw new Error("AUDIT_DIGEST_INVALID");
+    }
+    static deepFreeze(value) {
+        if (typeof value === "object" && value !== null && !Object.isFrozen(value)) {
+            Object.freeze(value);
+            for (const child of Object.values(value)) {
+                AuditRecorder.deepFreeze(child);
+            }
+        }
+        return value;
+    }
+}
+/** Resolves historical policy evidence by its pinned revision, never by a mutable alias. */
+export class AuditPolicyRevisionVerifier {
+    resolver;
+    timeoutMs;
+    constructor(resolver, timeoutMs = 1_000) {
+        this.resolver = resolver;
+        this.timeoutMs = Math.min(Math.max(timeoutMs, 1), 15_000);
+    }
+    async verify(event) {
+        const reference = event.evaluation?.policy;
+        if (reference === null || reference === undefined) {
+            return { status: "NOT_REFERENCED", artifact: null };
+        }
+        const resolved = await new Promise((resolve) => {
+            let settled = false;
+            const settle = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timeout);
+                resolve(value);
+            };
+            const timeout = setTimeout(() => settle(undefined), this.timeoutMs);
+            void Promise.resolve()
+                .then(async () => await this.resolver.resolve(reference.policyId, reference.revisionId))
+                .then((artifact) => settle(artifact), () => settle(undefined));
+        });
+        if (resolved === undefined)
+            return { status: "UNAVAILABLE", artifact: null };
+        if (resolved === null)
+            return { status: "MISSING", artifact: null };
+        if (resolved.policyId !== reference.policyId || resolved.revisionId !== reference.revisionId) {
+            return { status: "IDENTITY_MISMATCH", artifact: null };
+        }
+        if (resolved.digest !== reference.digest) {
+            return { status: "DIGEST_MISMATCH", artifact: null };
+        }
+        if (!isBoundedIdentifier(resolved.artifactReference) ||
+            !isBoundedIdentifier(resolved.policyId) ||
+            !isBoundedIdentifier(resolved.revisionId) ||
+            !DIGEST_PATTERN.test(resolved.digest)) {
+            return { status: "UNAVAILABLE", artifact: null };
+        }
+        return {
+            status: "VERIFIED",
+            artifact: Object.freeze({ ...resolved }),
+        };
+    }
+}
+function isBoundedIdentifier(value) {
+    if (value.length < 1 || value.length > 200)
+        return false;
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit <= 0x1f || codeUnit === 0x7f)
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=AuditRecorder.js.map

package/dist/audit/AuditRecorder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditRecorder.js","sourceRoot":"","sources":["../../src/audit/AuditRecorder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqHzC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAiB;IAChD,eAAe;IACf,eAAe;IACf,mBAAmB;CACpB,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AACxF,MAAM,uBAAuB,GAC3B,wFAAwF,CAAC;AAC3F,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAOY;IANnB,SAAS,CAAS;IAClB,aAAa,CAA6C;IAC1D,iBAAiB,CAAsB;IACvC,KAAK,CAAa;IAClB,QAAQ,CAAe;IAExC,YAAoC,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;QAC/D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,aAAa,CAAC;QAC5D,IAAI,CAAC,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;QAC/C,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB;YAAE,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;IAED,IAAW,+BAA+B;QACxC,OAAO,IAAI,CAAC,aAAa,KAAK,0BAA0B,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAuB;QACzC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;gBACvD,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,MAAe,EAAQ,EAAE;oBACvC,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC,CAAC;gBACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChE,KAAK,OAAO,CAAC,OAAO,EAAE;qBACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;qBACtD,IAAI,CACH,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAClB,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CACpB,CAAC;YACN,CAAC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAuB;QACnC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/D,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtD,IACE,KAAK,CAAC,UAAU,KAAK,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,EAC5D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC;QAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC5E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC;QACjE,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QAClE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,SAAS,IAAI,SAAS,CAAC;QAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC;QAC9D,qEAAqE;QACrE,IAAI,SAAS,KAAK,eAAe,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,UAAU,KAAK,SAAS;YAAE,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,SAAS,KAAK,SAAS;YAAE,aAAa,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtD,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ;YAC/B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;YACnE,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,KAAK,GAAiB;YAC1B,aAAa,EAAE,oBAAoB;YACnC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS;YACT,WAAW,EAAE;gBACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBACxC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;gBACrC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS;oBACnD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC3D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;gBACjD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAC9C;YACD,UAAU;YACV,OAAO;YACP,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;YAC7B,UAAU,EACR,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,KAAK;YACtF,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;SACxC,CAAC;QACF,OAAO,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEO,UAAU,CAChB,QAAwB,EACxB,QAAsB,EACtB,QAAkC;QAElC,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY,IAAI,QAAQ,CAAC,UAAU,CAAC;QACnE,MAAM,mBAAmB,GAAG,QAAQ,EAAE,mBAAmB,IAAI,QAAQ,CAAC,UAAU,CAAC;QACjF,MAAM,iBAAiB,GAAG,QAAQ,EAAE,iBAAiB,IAAI,QAAQ,CAAC,SAAS,CAAC;QAC5E,aAAa,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC7C,aAAa,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAChD,IAAI,iBAAiB,KAAK,IAAI;YAAE,aAAa,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAElF,IAAI,MAAM,GAA+B,IAAI,CAAC;QAC9C,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzD,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1C,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1D,CAAC;YACD,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClC,CAAC;QACD,OAAO;YACL,YAAY;YACZ,mBAAmB;YACnB,MAAM;YACN,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,KAA2C;QAC1D,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpF,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9F,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAEO,QAAQ,CAAC,KAAgB,EAAE,KAAa,EAAE,KAA0B;QAC1E,IAAI,KAAK,GAAG,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC1F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACnB,IAAI,KAAK,CAAC,OAAO,GAAG,oBAAoB;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBACxF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAY,CAAC;QAC1D,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,IAAI,KAAK,CAAC,OAAO,GAAG,oBAAoB;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACxF,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,SAAS,CAAC,KAAW;QAC3B,IAAI,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,SAAyB;QACvD,IAAI,SAAS,KAAK,iBAAiB;YAAE,OAAO,mBAAmB,CAAC;QAChE,IAAI,SAAS,KAAK,kBAAkB;YAAE,OAAO,eAAe,CAAC;QAC7D,IAAI,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,mBAAmB,EAAE,CAAC;YAC5E,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,KAAa;QAC3C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/E,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,KAAa;QACvC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC3E,CAAC;IAEO,MAAM,CAAC,UAAU,CAAI,KAAQ;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;gBACpE,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,4FAA4F;AAC5F,MAAM,OAAO,2BAA2B;IAInB;IAHF,SAAS,CAAS;IAEnC,YACmB,QAAqC,EACtD,SAAS,GAAG,KAAK;QADA,aAAQ,GAAR,QAAQ,CAA6B;QAGtD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAmB;QACrC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QAC3C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAChC,CAAC,OAAO,EAAE,EAAE;YACV,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,KAAqD,EAAQ,EAAE;gBAC7E,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACpE,KAAK,OAAO,CAAC,OAAO,EAAE;iBACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;iBACvF,IAAI,CACH,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC9B,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACxB,CAAC;QACN,CAAC,CACF,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC7E,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpE,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;YAC7F,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,IACE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAChD,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzC,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EACrC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnD,CAAC;QACD,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;SACzC,CAAC;IACJ,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACzD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/decision/CreateGate.d.ts

@@ -0,0 +1,123 @@
+import { type AuthorizationVerifier } from "../execution/AuthorizationVerifier.js";
+import type { ClientSource } from "../http/ClientIdentification.js";
+import { type CredentialFiles } from "../http/StoredCredentials.js";
+import type { DecisionAuthority, DecisionEvaluationMode } from "./DecisionAuthority.js";
+import { type SignedDossierSummary } from "../report/DossierReport.js";
+import { type ProvisionOptions, type ProvisionedWorkspace } from "./Provision.js";
+export type GateMode = "LOCAL" | DecisionEvaluationMode;
+/** An authority and the verifier that can claim the grants it issues. */
+export interface AuthorityPair {
+    readonly authority: DecisionAuthority;
+    readonly verifier: AuthorizationVerifier;
+}
+export interface SelectedGate extends AuthorityPair {
+    readonly mode: GateMode;
+    /**
+     * The tenant a captured intent must name. In a hosted mode this is the
+     * key's own organization, because Decionis binds every intent to it; in
+     * `LOCAL` mode it is the `tenantId` the caller passed.
+     */
+    readonly tenantId: string;
+}
+export interface CreateGateOptions {
+    /**
+     * The pair that runs when no key is set. It keeps governing execution in
+     * `SHADOW` mode, and in `ENFORCEMENT` mode its authority can only tighten
+     * the hosted decision.
+     */
+    readonly local: AuthorityPair;
+    /** The tenant used when no key is set. */
+    readonly tenantId: string;
+    /** Defaults to `process.env`. */
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly fetch?: typeof fetch;
+    /** Carried in the `User-Agent` of hosted calls only; never sent without a key. */
+    readonly source?: ClientSource;
+}
+/**
+ * Selects the gate from the environment.
+ *
+ * `DECIONIS_API_KEY` unset: returns `local` itself, the same authority and
+ * verifier objects, with no client constructed and no network call. A caller
+ * that sets nothing gets exactly what it gets today.
+ *
+ * `DECIONIS_API_KEY` set: `DecionisGate` runs beside `local` through
+ * `ShadowGate`, in `DECIONIS_MODE` (`SHADOW` by default, `ENFORCEMENT` on
+ * request). `DECIONIS_TENANT_ID` is then required, because Decionis binds
+ * every intent to the key's own organization and refuses any other tenant.
+ * `DECIONIS_API_URL`, `DECIONIS_TIMEOUT_MS` and `DECIONIS_ALLOW_INSECURE_LOOPBACK`
+ * configure the connection the way the trusted executor's do.
+ */
+export declare function createGate(options: CreateGateOptions): SelectedGate;
+export type HostedCredentialSource = "environment" | "stored" | "provisioned";
+/** Where the hosted key came from, for the run to say so; null when the gate is local. */
+export interface HostedCredentials {
+    readonly source: HostedCredentialSource;
+    readonly tenantId: string;
+    readonly endpoint: string;
+    /** The file the key is kept in, when it is kept. */
+    readonly path: string | null;
+    readonly provisional: boolean;
+    /** How a person claims a provisioned workspace, as the authority stated it. */
+    readonly claim: Readonly<Record<string, unknown>> | null;
+}
+export interface HostedGate extends SelectedGate {
+    readonly credentials: HostedCredentials | null;
+    /**
+     * Fetches a dossier this gate's key minted and summarizes its proof; null
+     * when the gate is local. The key stays inside the closure.
+     */
+    readonly fetchDossier: ((dossierId: string) => Promise<{
+        readonly summary: SignedDossierSummary;
+        readonly body: unknown;
+    }>) | null;
+}
+export interface CreateHostedGateOptions extends CreateGateOptions, ResolveHostedCredentialsOptions {
+}
+/** Whether `DECIONIS_HOSTED` asks for the hosted gate. */
+export declare function hostedRequested(env: Readonly<Record<string, string | undefined>>): boolean;
+export interface ResolveHostedCredentialsOptions {
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly fetch?: typeof fetch;
+    readonly source?: ClientSource;
+    /**
+     * Where a provisioned key is kept between runs, so a second run reuses the
+     * workspace instead of minting another: the user's `agentsafe` credential
+     * file by default; `false` keeps nothing.
+     */
+    readonly store?: {
+        readonly home?: string;
+        readonly files?: CredentialFiles;
+    } | false;
+    /** Mints the workspace; the authority's own route by default. */
+    readonly provision?: (options: ProvisionOptions) => Promise<ProvisionedWorkspace>;
+    /** Where the one-time note about a provisioned workspace goes; standard error by default. */
+    readonly notice?: (line: string) => void;
+}
+/** The credentials a hosted run uses, and the environment overlay that carries them. */
+export interface ResolvedHostedCredentials {
+    readonly credentials: HostedCredentials;
+    /** The key, for the one place that must hold it: the environment of the gate or process. */
+    readonly apiKey: string;
+    readonly env: Readonly<Record<string, string | undefined>>;
+}
+/**
+ * Where a hosted run's key comes from, in order: the environment, the
+ * credential this user keeps for this authority, and when there is none and
+ * `DECIONIS_HOSTED` asks, a free provisional workspace minted now, kept for
+ * the next run and named on standard error once. Null when nothing asks for
+ * the hosted path at all.
+ */
+export declare function resolveHostedCredentials(options?: ResolveHostedCredentialsOptions): Promise<ResolvedHostedCredentials | null>;
+/**
+ * The gate `createGate` selects, with one more way onto Decionis: a single
+ * variable. `DECIONIS_HOSTED=1` with no key means the key this user already
+ * keeps for this authority, and when there is none, a free provisional
+ * workspace minted now, kept for the next run, and named on standard error
+ * once. A key in the environment still wins, and no variable at all is
+ * still the local pair. A provisional key evaluates in `SHADOW` only:
+ * recorded beside the local verdict, with a signed dossier, never governing
+ * execution; an owned key set in the environment takes the mode asked for.
+ */
+export declare function createHostedGate(options: CreateHostedGateOptions): Promise<HostedGate>;
+//# sourceMappingURL=CreateGate.d.ts.map

package/dist/decision/CreateGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateGate.d.ts","sourceRoot":"","sources":["../../src/decision/CreateGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAsB,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AAGxB,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,sBAAsB,CAAC;AAExD,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;CAC1C;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAKD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,YAAY,CAkCnE;AAgBD,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE9E,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC9C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,YAAY,EACjB,CAAC,CACC,SAAS,EAAE,MAAM,KACd,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GACjF,IAAI,CAAC;CACV;AAED,MAAM,WAAW,uBACf,SAAQ,iBAAiB,EAAE,+BAA+B;CAAG;AAI/D,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,OAAO,CAG1F;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAA;KAAE,GAAG,KAAK,CAAC;IACtF,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClF,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,wFAAwF;AACxF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CAC5D;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,+BAAoC,GAC5C,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAkG3C;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,UAAU,CAAC,CAyB5F"}