@emilia-protocol/gate 0.11.0 → 0.14.0

package/dist/adapters/gcp.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Google Cloud System-of-Record adapter.
+ *
+ * "Install this before your agent can change cloud permissions or delete a
+ * project." Guards the high-blast-radius GCP operations — IAM policy set,
+ * service-account key create, project delete, storage bucket delete — so they
+ * never reach GCP without a receipt bound to THIS resource/member/role. Client
+ * is injected (the @google-cloud SDKs or a thin wrapper).
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+export const GCP_ACTION_PACK = Object.freeze([
+    Object.freeze({
+        id: 'gcp.iam.set_policy', label: 'GCP IAM set policy', action_type: 'gcp.iam.set_policy',
+        risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+        match: { protocol: 'gcp', tool: 'set_iam_policy' },
+        why: 'Grants cloud permissions. Bind resource+member+role; quorum.',
+        execution_binding: { required_fields: ['action_type', 'resource', 'member', 'role'] },
+    }),
+    Object.freeze({
+        id: 'gcp.sa_key.create', label: 'GCP service-account key create', action_type: 'gcp.sa_key.create',
+        risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+        match: { protocol: 'gcp', tool: 'create_service_account_key' },
+        why: 'Mints long-lived cloud credentials. Bind the service account.',
+        execution_binding: { required_fields: ['action_type', 'service_account'] },
+    }),
+    Object.freeze({
+        id: 'gcp.project.delete', label: 'GCP project delete', action_type: 'gcp.project.delete',
+        risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+        match: { protocol: 'gcp', tool: 'delete_project' },
+        why: 'Deletes an entire project. Quorum.',
+        execution_binding: { required_fields: ['action_type', 'project'] },
+    }),
+    Object.freeze({
+        id: 'gcp.storage.bucket_delete', label: 'GCP bucket delete', action_type: 'gcp.storage.bucket_delete',
+        risk: 'high', receipt_required: true, assurance_class: 'class_a',
+        match: { protocol: 'gcp', tool: 'delete_bucket' },
+        why: 'Destroys a storage bucket and its objects. Bind the bucket.',
+        execution_binding: { required_fields: ['action_type', 'bucket'] },
+    }),
+]);
+const OPS = {
+    'iam.set_policy': {
+        selector: { protocol: 'gcp', tool: 'set_iam_policy' },
+        observed: (p) => ({ action_type: 'gcp.iam.set_policy', resource: p.resource, member: p.member, role: p.role }),
+        perform: (c, p) => c.setIamPolicy({ resource: p.resource, member: p.member, role: p.role }),
+    },
+    'sa_key.create': {
+        selector: { protocol: 'gcp', tool: 'create_service_account_key' },
+        observed: (p) => ({ action_type: 'gcp.sa_key.create', service_account: p.service_account }),
+        perform: (c, p) => c.createServiceAccountKey({ service_account: p.service_account }),
+    },
+    'project.delete': {
+        selector: { protocol: 'gcp', tool: 'delete_project' },
+        observed: (p) => ({ action_type: 'gcp.project.delete', project: p.project }),
+        perform: (c, p) => c.deleteProject({ project: p.project }),
+    },
+    'storage.bucket_delete': {
+        selector: { protocol: 'gcp', tool: 'delete_bucket' },
+        observed: (p) => ({ action_type: 'gcp.storage.bucket_delete', bucket: p.bucket }),
+        perform: (c, p) => c.deleteBucket({ bucket: p.bucket }),
+    },
+};
+const adapter = createAdapter({ system: 'gcp', ops: OPS });
+export const GCP_OPS = adapter.OPS;
+export function createGcpManifest(extraActions = []) { return manifestFromPack(GCP_ACTION_PACK, extraActions); }
+export function guardGcpMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { GCP_ACTION_PACK, GCP_OPS, createGcpManifest, guardGcpMutation };
+//# sourceMappingURL=gcp.js.map

package/dist/adapters/gcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp.js","sourceRoot":"","sources":["../../src/adapters/gcp.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE5D,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB;QACxF,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ;QACnE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE;QAClD,GAAG,EAAE,8DAA8D;QACnE,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;KACtF,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,gCAAgC,EAAE,WAAW,EAAE,mBAAmB;QAClG,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS;QACpE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC9D,GAAG,EAAE,+DAA+D;QACpE,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB;QACxF,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ;QACnE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE;QAClD,GAAG,EAAE,oCAAoC;QACzC,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE;KACnE,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,2BAA2B;QACrG,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS;QAChE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE;QACjD,GAAG,EAAE,6DAA6D;QAClE,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE;KAClE,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG;IACV,gBAAgB,EAAE;QAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACrD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9G,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;KAC5F;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE;QACjE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC;QAC3F,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC;KACrF;IACD,gBAAgB,EAAE;QAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACrD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5E,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;KAC3D;IACD,uBAAuB,EAAE;QACvB,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE;QACpD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;KACxD;CACF,CAAC;AAEF,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;AACnC,MAAM,UAAU,iBAAiB,CAAC,YAAY,GAAG,EAAE,IAAI,OAAO,gBAAgB,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AAChH,MAAM,UAAU,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAClG,eAAe,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/adapters/github.d.ts

@@ -0,0 +1,123 @@
+export declare const GITHUB_ACTION_PACK: readonly (Readonly<{
+    id: "github.repo.delete";
+    label: "GitHub repo delete";
+    action_type: "github.repo.delete";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "class_a";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Destroys a repository and its history. Bind owner/repo to a named human approval.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "github.permission.change";
+    label: "GitHub permission change";
+    action_type: "github.permission.change";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "quorum";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Changes who can act on the repo. Privilege change deserves the two-person rule.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "github.branch_protection.remove";
+    label: "GitHub branch-protection removal";
+    action_type: "github.branch_protection.remove";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "class_a";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Removes the guard rails on a protected branch.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}>)[];
+export declare const GITHUB_OPS: readonly string[];
+/** Build an action-risk manifest for the GitHub destructive ops (plus any extras). */
+export declare function createGithubManifest(extraActions?: never[]): {
+    '@version': string;
+    actions: any[];
+};
+/**
+ * Guard a destructive GitHub mutation behind the gate. The call never reaches
+ * GitHub unless a valid, sufficiently-assured, non-replayed receipt bound to
+ * THIS repo is present.
+ * @param {object} gate     a gate built with createGithubManifest()
+ * @param {object} octokit  an Octokit-like client (@octokit/rest or compatible)
+ * @param {object} o
+ * @param {string} o.op     'repo.delete' | 'permission.change' | 'branch_protection.remove'
+ * @param {object} o.params { owner, repo, [username], [permission], [branch] }
+ * @param {object} o.receipt the EMILIA receipt authorizing THIS exact op
+ * @returns {Promise<{ result:any, reliance:object, execution:object }>}
+ * @throws  Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the call never reaches GitHub
+ */
+export declare function guardGithubMutation(gate: any, octokit: any, args: any): Promise<{
+    result: any;
+    reliance: any;
+    execution: any;
+}>;
+declare const _default: {
+    GITHUB_ACTION_PACK: readonly (Readonly<{
+        id: "github.repo.delete";
+        label: "GitHub repo delete";
+        action_type: "github.repo.delete";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "class_a";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Destroys a repository and its history. Bind owner/repo to a named human approval.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "github.permission.change";
+        label: "GitHub permission change";
+        action_type: "github.permission.change";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "quorum";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Changes who can act on the repo. Privilege change deserves the two-person rule.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "github.branch_protection.remove";
+        label: "GitHub branch-protection removal";
+        action_type: "github.branch_protection.remove";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "class_a";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Removes the guard rails on a protected branch.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }>)[];
+    GITHUB_OPS: readonly string[];
+    createGithubManifest: typeof createGithubManifest;
+    guardGithubMutation: typeof guardGithubMutation;
+};
+export default _default;
+//# sourceMappingURL=github.d.ts.map

package/dist/adapters/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/adapters/github.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAkC7B,CAAC;AA0BH,eAAO,MAAM,UAAU,mBAAc,CAAC;AAEtC,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,YAAY,UAAK;;;EAErD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,KAAA,EAAE,OAAO,KAAA,EAAE,IAAI,KAAA;;;;GAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,wBAA6F"}

package/dist/adapters/github.js

@@ -0,0 +1,105 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — GitHub System-of-Record adapter.
+ *
+ * "Install this before your agent can touch production GitHub." Wraps destructive
+ * Octokit operations so the mutation NEVER reaches GitHub without a valid,
+ * sufficiently-assured, non-replayed human/quorum receipt bound to THIS repo —
+ * and on success returns a reliance packet proving exactly what was authorized
+ * and what executed.
+ *
+ *   import { Octokit } from '@octokit/rest';
+ *   import { createGate } from '@emilia-protocol/gate';
+ *   import { createGithubManifest, guardGithubMutation } from '@emilia-protocol/gate/adapters/github';
+ *
+ *   const gate = createGate({ manifest: createGithubManifest(), trustedKeys: [ISSUER], store: sharedConsumptionStore });
+ *   const octokit = new Octokit({ auth });
+ *   await guardGithubMutation(gate, octokit, {
+ *     op: 'repo.delete', params: { owner, repo }, receipt,  // throws if no valid receipt
+ *   });
+ *
+ * The receipt's claim must carry the same owner/repo (and username/permission or
+ * branch) as the call — a receipt for repo A cannot authorize deleting repo B.
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+export const GITHUB_ACTION_PACK = Object.freeze([
+    Object.freeze({
+        id: 'github.repo.delete',
+        label: 'GitHub repo delete',
+        action_type: 'github.repo.delete',
+        risk: 'critical',
+        receipt_required: true,
+        assurance_class: 'class_a',
+        match: { protocol: 'github', tool: 'delete_repo' },
+        why: 'Destroys a repository and its history. Bind owner/repo to a named human approval.',
+        execution_binding: { required_fields: ['action_type', 'owner', 'repo'] },
+    }),
+    Object.freeze({
+        id: 'github.permission.change',
+        label: 'GitHub permission change',
+        action_type: 'github.permission.change',
+        risk: 'critical',
+        receipt_required: true,
+        assurance_class: 'quorum',
+        match: { protocol: 'github', tool: 'update_collaborator_permission' },
+        why: 'Changes who can act on the repo. Privilege change deserves the two-person rule.',
+        execution_binding: { required_fields: ['action_type', 'owner', 'repo', 'username', 'permission'] },
+    }),
+    Object.freeze({
+        id: 'github.branch_protection.remove',
+        label: 'GitHub branch-protection removal',
+        action_type: 'github.branch_protection.remove',
+        risk: 'critical',
+        receipt_required: true,
+        assurance_class: 'class_a',
+        match: { protocol: 'github', tool: 'delete_branch_protection' },
+        why: 'Removes the guard rails on a protected branch.',
+        execution_binding: { required_fields: ['action_type', 'owner', 'repo', 'branch'] },
+    }),
+]);
+const OPS = {
+    'repo.delete': {
+        selector: { protocol: 'github', tool: 'delete_repo' },
+        observed: (p) => ({ action_type: 'github.repo.delete', owner: p.owner, repo: p.repo }),
+        perform: (octokit, p) => octokit.repos.delete({ owner: p.owner, repo: p.repo }),
+    },
+    'permission.change': {
+        selector: { protocol: 'github', tool: 'update_collaborator_permission' },
+        observed: (p) => ({
+            action_type: 'github.permission.change',
+            owner: p.owner, repo: p.repo, username: p.username, permission: p.permission,
+        }),
+        perform: (octokit, p) => octokit.repos.addCollaborator({
+            owner: p.owner, repo: p.repo, username: p.username, permission: p.permission,
+        }),
+    },
+    'branch_protection.remove': {
+        selector: { protocol: 'github', tool: 'delete_branch_protection' },
+        observed: (p) => ({ action_type: 'github.branch_protection.remove', owner: p.owner, repo: p.repo, branch: p.branch }),
+        perform: (octokit, p) => octokit.repos.deleteBranchProtection({ owner: p.owner, repo: p.repo, branch: p.branch }),
+    },
+};
+const adapter = createAdapter({ system: 'github', ops: OPS });
+export const GITHUB_OPS = adapter.OPS;
+/** Build an action-risk manifest for the GitHub destructive ops (plus any extras). */
+export function createGithubManifest(extraActions = []) {
+    return manifestFromPack(GITHUB_ACTION_PACK, extraActions);
+}
+/**
+ * Guard a destructive GitHub mutation behind the gate. The call never reaches
+ * GitHub unless a valid, sufficiently-assured, non-replayed receipt bound to
+ * THIS repo is present.
+ * @param {object} gate     a gate built with createGithubManifest()
+ * @param {object} octokit  an Octokit-like client (@octokit/rest or compatible)
+ * @param {object} o
+ * @param {string} o.op     'repo.delete' | 'permission.change' | 'branch_protection.remove'
+ * @param {object} o.params { owner, repo, [username], [permission], [branch] }
+ * @param {object} o.receipt the EMILIA receipt authorizing THIS exact op
+ * @returns {Promise<{ result:any, reliance:object, execution:object }>}
+ * @throws  Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the call never reaches GitHub
+ */
+export function guardGithubMutation(gate, octokit, args) {
+    return adapter.guard(gate, octokit, args);
+}
+export default { GITHUB_ACTION_PACK, GITHUB_OPS, createGithubManifest, guardGithubMutation };
+//# sourceMappingURL=github.js.map

package/dist/adapters/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/adapters/github.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,oBAAoB;QACjC,IAAI,EAAE,UAAU;QAChB,gBAAgB,EAAE,IAAI;QACtB,eAAe,EAAE,SAAS;QAC1B,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE;QAClD,GAAG,EAAE,mFAAmF;QACxF,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE;KACzE,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,0BAA0B;QAC9B,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,UAAU;QAChB,gBAAgB,EAAE,IAAI;QACtB,eAAe,EAAE,QAAQ;QACzB,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,gCAAgC,EAAE;QACrE,GAAG,EAAE,iFAAiF;QACtF,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE;KACnG,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,iCAAiC;QACrC,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,iCAAiC;QAC9C,IAAI,EAAE,UAAU;QAChB,gBAAgB,EAAE,IAAI;QACtB,eAAe,EAAE,SAAS;QAC1B,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,0BAA0B,EAAE;QAC/D,GAAG,EAAE,gDAAgD;QACrD,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;KACnF,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG;IACV,aAAa,EAAE;QACb,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE;QACrD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;KAChF;IACD,mBAAmB,EAAE;QACnB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,gCAAgC,EAAE;QACxE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,WAAW,EAAE,0BAA0B;YACvC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;SAC7E,CAAC;QACF,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;YACrD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;SAC7E,CAAC;KACH;IACD,0BAA0B,EAAE;QAC1B,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,0BAA0B,EAAE;QAClE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,iCAAiC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACrH,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;KAClH;CACF,CAAC;AAEF,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;AAEtC,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,YAAY,GAAG,EAAE;IACpD,OAAO,gBAAgB,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI;IACrD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/adapters/jira.d.ts

@@ -0,0 +1,109 @@
+export declare const JIRA_ACTION_PACK: readonly (Readonly<{
+    id: "jira.issue.bulk_delete";
+    label: "Bulk delete issues";
+    action_type: "jira.issue.bulk_delete";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "class_a";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Mass-destroys issues. Bind the exact JQL.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "jira.project.delete";
+    label: "Delete project";
+    action_type: "jira.project.delete";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "quorum";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Deletes a project and its issues. Quorum.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "jira.permission.grant";
+    label: "Grant permission";
+    action_type: "jira.permission.grant";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "quorum";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Changes who can act. Quorum + bind project/principal/role.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}>)[];
+export declare const JIRA_OPS: readonly string[];
+export declare function createJiraManifest(extra?: never[]): {
+    '@version': string;
+    actions: any[];
+};
+export declare function guardJiraMutation(gate: any, client: any, args: any): Promise<{
+    result: any;
+    reliance: any;
+    execution: any;
+}>;
+declare const _default: {
+    JIRA_ACTION_PACK: readonly (Readonly<{
+        id: "jira.issue.bulk_delete";
+        label: "Bulk delete issues";
+        action_type: "jira.issue.bulk_delete";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "class_a";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Mass-destroys issues. Bind the exact JQL.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "jira.project.delete";
+        label: "Delete project";
+        action_type: "jira.project.delete";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "quorum";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Deletes a project and its issues. Quorum.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "jira.permission.grant";
+        label: "Grant permission";
+        action_type: "jira.permission.grant";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "quorum";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Changes who can act. Quorum + bind project/principal/role.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }>)[];
+    JIRA_OPS: readonly string[];
+    createJiraManifest: typeof createJiraManifest;
+    guardJiraMutation: typeof guardJiraMutation;
+};
+export default _default;
+//# sourceMappingURL=jira.d.ts.map

package/dist/adapters/jira.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jira.d.ts","sourceRoot":"","sources":["../../src/adapters/jira.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAsB3B,CAAC;AAsBH,eAAO,MAAM,QAAQ,mBAAc,CAAC;AACpC,wBAAgB,kBAAkB,CAAC,KAAK,UAAK;;;EAAuD;AACpG,wBAAgB,iBAAiB,CAAC,IAAI,KAAA,EAAE,MAAM,KAAA,EAAE,IAAI,KAAA;;;;GAA+C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACnG,wBAAqF"}

package/dist/adapters/jira.js

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Jira System-of-Record adapter.
+ * Guards bulk issue delete, project delete, and permission grants so they never
+ * reach Jira without a receipt bound to THIS resource. Client injected.
+ */
+import { createAdapter, manifestFromPack, hashCanonical } from './_kit.js';
+export const JIRA_ACTION_PACK = Object.freeze([
+    Object.freeze({
+        id: 'jira.issue.bulk_delete', label: 'Bulk delete issues', action_type: 'jira.issue.bulk_delete',
+        risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+        match: { protocol: 'jira', tool: 'bulk_delete_issues' },
+        why: 'Mass-destroys issues. Bind the exact JQL.',
+        execution_binding: { required_fields: ['action_type', 'project', 'jql_hash'] },
+    }),
+    Object.freeze({
+        id: 'jira.project.delete', label: 'Delete project', action_type: 'jira.project.delete',
+        risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+        match: { protocol: 'jira', tool: 'delete_project' },
+        why: 'Deletes a project and its issues. Quorum.',
+        execution_binding: { required_fields: ['action_type', 'project_key'] },
+    }),
+    Object.freeze({
+        id: 'jira.permission.grant', label: 'Grant permission', action_type: 'jira.permission.grant',
+        risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+        match: { protocol: 'jira', tool: 'grant_permission' },
+        why: 'Changes who can act. Quorum + bind project/principal/role.',
+        execution_binding: { required_fields: ['action_type', 'project', 'principal', 'role'] },
+    }),
+]);
+const OPS = {
+    'issue.bulk_delete': {
+        selector: { protocol: 'jira', tool: 'bulk_delete_issues' },
+        observed: (p) => ({ action_type: 'jira.issue.bulk_delete', project: p.project, jql_hash: hashCanonical(String(p.jql || '').trim()) }),
+        actuator: (p, observed) => ({ ...observed, jql: p.jql }),
+        perform: (c, p) => c.bulkDeleteIssues({ project: p.project, jql: p.jql }),
+    },
+    'project.delete': {
+        selector: { protocol: 'jira', tool: 'delete_project' },
+        observed: (p) => ({ action_type: 'jira.project.delete', project_key: p.project_key }),
+        perform: (c, p) => c.deleteProject({ projectKey: p.project_key }),
+    },
+    'permission.grant': {
+        selector: { protocol: 'jira', tool: 'grant_permission' },
+        observed: (p) => ({ action_type: 'jira.permission.grant', project: p.project, principal: p.principal, role: p.role }),
+        perform: (c, p) => c.grantPermission({ project: p.project, principal: p.principal, role: p.role }),
+    },
+};
+const adapter = createAdapter({ system: 'jira', ops: OPS });
+export const JIRA_OPS = adapter.OPS;
+export function createJiraManifest(extra = []) { return manifestFromPack(JIRA_ACTION_PACK, extra); }
+export function guardJiraMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default { JIRA_ACTION_PACK, JIRA_OPS, createJiraManifest, guardJiraMutation };
+//# sourceMappingURL=jira.js.map

package/dist/adapters/jira.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jira.js","sourceRoot":"","sources":["../../src/adapters/jira.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,wBAAwB;QAChG,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS;QACpE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE;QACvD,GAAG,EAAE,2CAA2C;QAChD,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE;KAC/E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,qBAAqB;QACtF,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ;QACnE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACnD,GAAG,EAAE,2CAA2C;QAChD,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE;KACvE,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,uBAAuB;QAC5F,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ;QACnE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE;QACrD,GAAG,EAAE,4DAA4D;QACjE,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE;KACxF,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG;IACV,mBAAmB,EAAE;QACnB,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE;QAC1D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACrI,QAAQ,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QACxD,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;KAC1E;IACD,gBAAgB,EAAE;QAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACtD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACrF,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;KAClE;IACD,kBAAkB,EAAE;QAClB,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE;QACxD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrH,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;KACnG;CACF,CAAC;AAEF,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;AACpC,MAAM,UAAU,kBAAkB,CAAC,KAAK,GAAG,EAAE,IAAI,OAAO,gBAAgB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACpG,MAAM,UAAU,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACnG,eAAe,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/adapters/k8s.d.ts

@@ -0,0 +1,139 @@
+export declare const K8S_ACTION_PACK: readonly (Readonly<{
+    id: "k8s.namespace.delete";
+    label: "Delete namespace";
+    action_type: "k8s.namespace.delete";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "quorum";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Deletes an entire namespace and everything in it. Quorum.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "k8s.workload.delete";
+    label: "Delete workload";
+    action_type: "k8s.workload.delete";
+    risk: "high";
+    receipt_required: true;
+    assurance_class: "class_a";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Deletes a deployment/statefulset/job. Bind namespace+kind+name.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "k8s.rbac.bind";
+    label: "RBAC binding";
+    action_type: "k8s.rbac.bind";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "quorum";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Grants cluster permissions. Privilege change → two-person rule.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "k8s.secret.delete";
+    label: "Delete secret";
+    action_type: "k8s.secret.delete";
+    risk: "high";
+    receipt_required: true;
+    assurance_class: "class_a";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Destroys a secret. Bind namespace+name.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}>)[];
+export declare const K8S_OPS: readonly string[];
+export declare function createK8sManifest(extraActions?: never[]): {
+    '@version': string;
+    actions: any[];
+};
+export declare function guardK8sMutation(gate: any, client: any, args: any): Promise<{
+    result: any;
+    reliance: any;
+    execution: any;
+}>;
+declare const _default: {
+    K8S_ACTION_PACK: readonly (Readonly<{
+        id: "k8s.namespace.delete";
+        label: "Delete namespace";
+        action_type: "k8s.namespace.delete";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "quorum";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Deletes an entire namespace and everything in it. Quorum.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "k8s.workload.delete";
+        label: "Delete workload";
+        action_type: "k8s.workload.delete";
+        risk: "high";
+        receipt_required: true;
+        assurance_class: "class_a";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Deletes a deployment/statefulset/job. Bind namespace+kind+name.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "k8s.rbac.bind";
+        label: "RBAC binding";
+        action_type: "k8s.rbac.bind";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "quorum";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Grants cluster permissions. Privilege change → two-person rule.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "k8s.secret.delete";
+        label: "Delete secret";
+        action_type: "k8s.secret.delete";
+        risk: "high";
+        receipt_required: true;
+        assurance_class: "class_a";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Destroys a secret. Bind namespace+name.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }>)[];
+    K8S_OPS: readonly string[];
+    createK8sManifest: typeof createK8sManifest;
+    guardK8sMutation: typeof guardK8sMutation;
+};
+export default _default;
+//# sourceMappingURL=k8s.d.ts.map

package/dist/adapters/k8s.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k8s.d.ts","sourceRoot":"","sources":["../../src/adapters/k8s.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA6B1B,CAAC;AA0BH,eAAO,MAAM,OAAO,mBAAc,CAAC;AACnC,wBAAgB,iBAAiB,CAAC,YAAY,UAAK;;;EAA6D;AAChH,wBAAgB,gBAAgB,CAAC,IAAI,KAAA,EAAE,MAAM,KAAA,EAAE,IAAI,KAAA;;;;GAA+C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAClG,wBAAiF"}