@emilia-protocol/gate 0.11.0 → 0.14.0

package/dist/adapters/supabase.d.ts

@@ -0,0 +1,127 @@
+export declare const RLS_DEFINITION_BINDING_VERSION = "EP-SUPABASE-RLS-DEFINITION-v1";
+/** Heuristic: is this SQL destructive (DELETE/DROP/TRUNCATE/ALTER, or UPDATE without WHERE)? */
+export declare function isDestructiveSql(sql: any): boolean;
+/** Canonical hash of a SQL statement, whitespace-collapsed and lowercased. */
+export declare function statementHash(sql: any): string;
+/** Digest the exact canonical RLS definition without placing it in evidence. */
+export declare function rlsDefinitionDigest(definition: any): string;
+export declare const SUPABASE_ACTION_PACK: readonly (Readonly<{
+    id: "supabase.sql.destructive";
+    label: "Destructive SQL";
+    action_type: "supabase.sql.destructive";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "class_a";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "DELETE/DROP/TRUNCATE/ALTER destroys or rewrites system-of-record state. Bind the exact statement.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "supabase.data.export";
+    label: "Bulk data export";
+    action_type: "supabase.data.export";
+    risk: "high";
+    receipt_required: true;
+    assurance_class: "class_a";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Moves data out of its system of record. Bind table + recipient to the approval.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "supabase.rls.change";
+    label: "RLS policy change";
+    action_type: "supabase.rls.change";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "quorum";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Changes who can read/write rows. Row-Level-Security changes deserve the two-person rule.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}>)[];
+export declare const SUPABASE_OPS: readonly string[];
+export declare function createSupabaseManifest(extraActions?: never[]): {
+    '@version': string;
+    actions: any[];
+};
+/**
+ * Guard a destructive Supabase/Postgres mutation behind the gate.
+ * @param {object} gate    a gate built with createSupabaseManifest()
+ * @param {object} client  a client exposing { query(sql), export(table,recipient), alterPolicy(table,policy,def) }
+ * @param {object} args    { op:'sql.destructive'|'data.export'|'rls.change', params, receipt }
+ * @throws Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the statement never executes
+ */
+export declare function guardSupabaseMutation(gate: any, client: any, args: any): Promise<{
+    result: any;
+    reliance: any;
+    execution: any;
+}>;
+declare const _default: {
+    SUPABASE_ACTION_PACK: readonly (Readonly<{
+        id: "supabase.sql.destructive";
+        label: "Destructive SQL";
+        action_type: "supabase.sql.destructive";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "class_a";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "DELETE/DROP/TRUNCATE/ALTER destroys or rewrites system-of-record state. Bind the exact statement.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "supabase.data.export";
+        label: "Bulk data export";
+        action_type: "supabase.data.export";
+        risk: "high";
+        receipt_required: true;
+        assurance_class: "class_a";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Moves data out of its system of record. Bind table + recipient to the approval.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "supabase.rls.change";
+        label: "RLS policy change";
+        action_type: "supabase.rls.change";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "quorum";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Changes who can read/write rows. Row-Level-Security changes deserve the two-person rule.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }>)[];
+    SUPABASE_OPS: readonly string[];
+    createSupabaseManifest: typeof createSupabaseManifest;
+    guardSupabaseMutation: typeof guardSupabaseMutation;
+    isDestructiveSql: typeof isDestructiveSql;
+    statementHash: typeof statementHash;
+    rlsDefinitionDigest: typeof rlsDefinitionDigest;
+    RLS_DEFINITION_BINDING_VERSION: string;
+};
+export default _default;
+//# sourceMappingURL=supabase.d.ts.map

package/dist/adapters/supabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../src/adapters/supabase.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,8BAA8B,kCAAkC,CAAC;AAK9E,gGAAgG;AAChG,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,WAGnC;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,GAAG,KAAA,UAEhC;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,UAAU,KAAA,UAK7C;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA0B/B,CAAC;AA6BH,eAAO,MAAM,YAAY,mBAAc,CAAC;AAExC,wBAAgB,sBAAsB,CAAC,YAAY,UAAK;;;EAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,KAAA,EAAE,MAAM,KAAA,EAAE,IAAI,KAAA;;;;GAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,wBAGE"}

package/dist/adapters/supabase.js

@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Supabase / Postgres System-of-Record adapter.
+ *
+ * "Install this before your agent can run destructive SQL." Wraps the dangerous
+ * database operations — destructive SQL (DELETE/DROP/TRUNCATE/UPDATE), bulk
+ * export, and RLS-policy change — so they never execute without a valid,
+ * sufficiently-assured, non-replayed receipt bound to THIS statement/table. The
+ * exact statement is bound by hash, so an approval for one DELETE cannot be
+ * swapped for a DROP.
+ *
+ *   import { createGate } from '@emilia-protocol/gate';
+ *   import { createSupabaseManifest, guardSupabaseMutation, isDestructiveSql } from '@emilia-protocol/gate/adapters/supabase';
+ *
+ *   const gate = createGate({ manifest: createSupabaseManifest(), trustedKeys: [ISSUER], store: sharedConsumptionStore });
+ *   // client: anything with .query(sql) (node-postgres / a Supabase RPC wrapper).
+ *   await guardSupabaseMutation(gate, client, {
+ *     op: 'sql.destructive', params: { sql: 'DELETE FROM payments WHERE id=1', table: 'payments' }, receipt,
+ *   });
+ */
+import { createAdapter, manifestFromPack, hashCanonical } from './_kit.js';
+export const RLS_DEFINITION_BINDING_VERSION = 'EP-SUPABASE-RLS-DEFINITION-v1';
+const DESTRUCTIVE = /\b(delete|drop|truncate|alter\s+table)\b/i;
+const UPDATE_NO_WHERE = /\bupdate\b(?:(?!\bwhere\b).)*$/is;
+/** Heuristic: is this SQL destructive (DELETE/DROP/TRUNCATE/ALTER, or UPDATE without WHERE)? */
+export function isDestructiveSql(sql) {
+    const s = String(sql || '');
+    return DESTRUCTIVE.test(s) || UPDATE_NO_WHERE.test(s.trim());
+}
+/** Canonical hash of a SQL statement, whitespace-collapsed and lowercased. */
+export function statementHash(sql) {
+    return hashCanonical(String(sql || '').replace(/\s+/g, ' ').trim().toLowerCase());
+}
+/** Digest the exact canonical RLS definition without placing it in evidence. */
+export function rlsDefinitionDigest(definition) {
+    return hashCanonical({
+        version: RLS_DEFINITION_BINDING_VERSION,
+        definition,
+    });
+}
+export const SUPABASE_ACTION_PACK = Object.freeze([
+    Object.freeze({
+        id: 'supabase.sql.destructive', label: 'Destructive SQL', action_type: 'supabase.sql.destructive',
+        risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+        match: { protocol: 'supabase', tool: 'execute_sql' },
+        why: 'DELETE/DROP/TRUNCATE/ALTER destroys or rewrites system-of-record state. Bind the exact statement.',
+        execution_binding: { required_fields: ['action_type', 'statement_hash'] },
+    }),
+    Object.freeze({
+        id: 'supabase.data.export', label: 'Bulk data export', action_type: 'supabase.data.export',
+        risk: 'high', receipt_required: true, assurance_class: 'class_a',
+        match: { protocol: 'supabase', tool: 'export_table' },
+        why: 'Moves data out of its system of record. Bind table + recipient to the approval.',
+        execution_binding: { required_fields: ['action_type', 'table', 'recipient'] },
+    }),
+    Object.freeze({
+        id: 'supabase.rls.change', label: 'RLS policy change', action_type: 'supabase.rls.change',
+        risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+        match: { protocol: 'supabase', tool: 'alter_policy' },
+        why: 'Changes who can read/write rows. Row-Level-Security changes deserve the two-person rule.',
+        execution_binding: {
+            required_fields: [
+                'action_type', 'table', 'policy', 'rls_definition_digest', 'rls_definition_version',
+            ],
+        },
+    }),
+]);
+const OPS = {
+    'sql.destructive': {
+        selector: { protocol: 'supabase', tool: 'execute_sql' },
+        observed: (p) => ({ action_type: 'supabase.sql.destructive', statement_hash: statementHash(p.sql) }),
+        actuator: (p, observed) => ({ ...observed, sql: p.sql }),
+        perform: (client, p) => client.query(p.sql),
+    },
+    'data.export': {
+        selector: { protocol: 'supabase', tool: 'export_table' },
+        observed: (p) => ({ action_type: 'supabase.data.export', table: p.table, recipient: p.recipient }),
+        perform: (client, p) => client.export(p.table, p.recipient),
+    },
+    'rls.change': {
+        selector: { protocol: 'supabase', tool: 'alter_policy' },
+        observed: (p) => ({
+            action_type: 'supabase.rls.change',
+            table: p.table,
+            policy: p.policy,
+            rls_definition_digest: rlsDefinitionDigest(p.definition),
+            rls_definition_version: RLS_DEFINITION_BINDING_VERSION,
+        }),
+        actuator: (p, observed) => ({ ...observed, definition: p.definition }),
+        perform: (client, p) => client.alterPolicy(p.table, p.policy, p.definition),
+    },
+};
+const adapter = createAdapter({ system: 'supabase', ops: OPS });
+export const SUPABASE_OPS = adapter.OPS;
+export function createSupabaseManifest(extraActions = []) {
+    return manifestFromPack(SUPABASE_ACTION_PACK, extraActions);
+}
+/**
+ * Guard a destructive Supabase/Postgres mutation behind the gate.
+ * @param {object} gate    a gate built with createSupabaseManifest()
+ * @param {object} client  a client exposing { query(sql), export(table,recipient), alterPolicy(table,policy,def) }
+ * @param {object} args    { op:'sql.destructive'|'data.export'|'rls.change', params, receipt }
+ * @throws Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the statement never executes
+ */
+export function guardSupabaseMutation(gate, client, args) {
+    return adapter.guard(gate, client, args);
+}
+export default {
+    SUPABASE_ACTION_PACK, SUPABASE_OPS, createSupabaseManifest, guardSupabaseMutation,
+    isDestructiveSql, statementHash, rlsDefinitionDigest, RLS_DEFINITION_BINDING_VERSION,
+};
+//# sourceMappingURL=supabase.js.map

package/dist/adapters/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../src/adapters/supabase.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,+BAA+B,CAAC;AAE9E,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAChE,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,GAAG;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,GAAG;IAC/B,OAAO,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,UAAU;IAC5C,OAAO,aAAa,CAAC;QACnB,OAAO,EAAE,8BAA8B;QACvC,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,0BAA0B;QACjG,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS;QACpE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE;QACpD,GAAG,EAAE,mGAAmG;QACxG,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE;KAC1E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,sBAAsB;QAC1F,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS;QAChE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE;QACrD,GAAG,EAAE,iFAAiF;QACtF,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE;KAC9E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,qBAAqB;QACzF,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ;QACnE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE;QACrD,GAAG,EAAE,0FAA0F;QAC/F,iBAAiB,EAAE;YACjB,eAAe,EAAE;gBACf,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,wBAAwB;aACpF;SACF;KACF,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG;IACV,iBAAiB,EAAE;QACjB,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE;QACvD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACpG,QAAQ,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QACxD,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;KAC5C;IACD,aAAa,EAAE;QACb,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE;QACxD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QAClG,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;KAC5D;IACD,YAAY,EAAE;QACZ,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE;QACxD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,WAAW,EAAE,qBAAqB;YAClC,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,qBAAqB,EAAE,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC;YACxD,sBAAsB,EAAE,8BAA8B;SACvD,CAAC;QACF,QAAQ,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QACtE,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC;KAC5E;CACF,CAAC;AAEF,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC;AAExC,MAAM,UAAU,sBAAsB,CAAC,YAAY,GAAG,EAAE;IACtD,OAAO,gBAAgB,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI;IACtD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,eAAe;IACb,oBAAoB,EAAE,YAAY,EAAE,sBAAsB,EAAE,qBAAqB;IACjF,gBAAgB,EAAE,aAAa,EAAE,mBAAmB,EAAE,8BAA8B;CACrF,CAAC"}

package/dist/adapters/terraform.d.ts

@@ -0,0 +1,109 @@
+export declare const TERRAFORM_ACTION_PACK: readonly (Readonly<{
+    id: "terraform.apply.destroy";
+    label: "Terraform destroy";
+    action_type: "terraform.apply.destroy";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "quorum";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Tears down real infrastructure. Bind the workspace + plan hash; quorum.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "terraform.state.rm";
+    label: "Terraform state rm";
+    action_type: "terraform.state.rm";
+    risk: "high";
+    receipt_required: true;
+    assurance_class: "class_a";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Detaches a resource from state (orphans real infra). Bind workspace+address.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "terraform.workspace.delete";
+    label: "Terraform workspace delete";
+    action_type: "terraform.workspace.delete";
+    risk: "high";
+    receipt_required: true;
+    assurance_class: "class_a";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Deletes a workspace and its state. Bind the workspace.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}>)[];
+export declare const TERRAFORM_OPS: readonly string[];
+export declare function createTerraformManifest(extraActions?: never[]): {
+    '@version': string;
+    actions: any[];
+};
+export declare function guardTerraformMutation(gate: any, runner: any, args: any): Promise<{
+    result: any;
+    reliance: any;
+    execution: any;
+}>;
+declare const _default: {
+    TERRAFORM_ACTION_PACK: readonly (Readonly<{
+        id: "terraform.apply.destroy";
+        label: "Terraform destroy";
+        action_type: "terraform.apply.destroy";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "quorum";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Tears down real infrastructure. Bind the workspace + plan hash; quorum.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "terraform.state.rm";
+        label: "Terraform state rm";
+        action_type: "terraform.state.rm";
+        risk: "high";
+        receipt_required: true;
+        assurance_class: "class_a";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Detaches a resource from state (orphans real infra). Bind workspace+address.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "terraform.workspace.delete";
+        label: "Terraform workspace delete";
+        action_type: "terraform.workspace.delete";
+        risk: "high";
+        receipt_required: true;
+        assurance_class: "class_a";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Deletes a workspace and its state. Bind the workspace.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }>)[];
+    TERRAFORM_OPS: readonly string[];
+    createTerraformManifest: typeof createTerraformManifest;
+    guardTerraformMutation: typeof guardTerraformMutation;
+};
+export default _default;
+//# sourceMappingURL=terraform.d.ts.map

package/dist/adapters/terraform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../src/adapters/terraform.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAsBhC,CAAC;AAqBH,eAAO,MAAM,aAAa,mBAAc,CAAC;AACzC,wBAAgB,uBAAuB,CAAC,YAAY,UAAK;;;EAAmE;AAC5H,wBAAgB,sBAAsB,CAAC,IAAI,KAAA,EAAE,MAAM,KAAA,EAAE,IAAI,KAAA;;;;GAA+C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACxG,wBAAyG"}

package/dist/adapters/terraform.js

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Terraform System-of-Record adapter.
+ *
+ * "Install this before your agent can destroy infrastructure." Guards the
+ * irreversible Terraform operations — destroy, state rm, workspace delete — so
+ * they never run without a receipt bound to THIS workspace/plan. The destroy
+ * plan is bound by hash, so an approved small destroy cannot be swapped for a
+ * full teardown. Runner is injected (a `terraform`/`tofu` CLI wrapper or Cloud
+ * API client).
+ */
+import { createAdapter, manifestFromPack } from './_kit.js';
+export const TERRAFORM_ACTION_PACK = Object.freeze([
+    Object.freeze({
+        id: 'terraform.apply.destroy', label: 'Terraform destroy', action_type: 'terraform.apply.destroy',
+        risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+        match: { protocol: 'terraform', tool: 'destroy' },
+        why: 'Tears down real infrastructure. Bind the workspace + plan hash; quorum.',
+        execution_binding: { required_fields: ['action_type', 'workspace', 'plan_hash'] },
+    }),
+    Object.freeze({
+        id: 'terraform.state.rm', label: 'Terraform state rm', action_type: 'terraform.state.rm',
+        risk: 'high', receipt_required: true, assurance_class: 'class_a',
+        match: { protocol: 'terraform', tool: 'state_rm' },
+        why: 'Detaches a resource from state (orphans real infra). Bind workspace+address.',
+        execution_binding: { required_fields: ['action_type', 'workspace', 'address'] },
+    }),
+    Object.freeze({
+        id: 'terraform.workspace.delete', label: 'Terraform workspace delete', action_type: 'terraform.workspace.delete',
+        risk: 'high', receipt_required: true, assurance_class: 'class_a',
+        match: { protocol: 'terraform', tool: 'workspace_delete' },
+        why: 'Deletes a workspace and its state. Bind the workspace.',
+        execution_binding: { required_fields: ['action_type', 'workspace'] },
+    }),
+]);
+const OPS = {
+    'apply.destroy': {
+        selector: { protocol: 'terraform', tool: 'destroy' },
+        observed: (p) => ({ action_type: 'terraform.apply.destroy', workspace: p.workspace, plan_hash: p.plan_hash }),
+        perform: (r, p) => r.destroy({ workspace: p.workspace, plan_hash: p.plan_hash }),
+    },
+    'state.rm': {
+        selector: { protocol: 'terraform', tool: 'state_rm' },
+        observed: (p) => ({ action_type: 'terraform.state.rm', workspace: p.workspace, address: p.address }),
+        perform: (r, p) => r.stateRm({ workspace: p.workspace, address: p.address }),
+    },
+    'workspace.delete': {
+        selector: { protocol: 'terraform', tool: 'workspace_delete' },
+        observed: (p) => ({ action_type: 'terraform.workspace.delete', workspace: p.workspace }),
+        perform: (r, p) => r.workspaceDelete({ workspace: p.workspace }),
+    },
+};
+const adapter = createAdapter({ system: 'terraform', ops: OPS });
+export const TERRAFORM_OPS = adapter.OPS;
+export function createTerraformManifest(extraActions = []) { return manifestFromPack(TERRAFORM_ACTION_PACK, extraActions); }
+export function guardTerraformMutation(gate, runner, args) { return adapter.guard(gate, runner, args); }
+export default { TERRAFORM_ACTION_PACK, TERRAFORM_OPS, createTerraformManifest, guardTerraformMutation };
+//# sourceMappingURL=terraform.js.map

package/dist/adapters/terraform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform.js","sourceRoot":"","sources":["../../src/adapters/terraform.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;;GASG;AACH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,yBAAyB;QACjG,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ;QACnE,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;QACjD,GAAG,EAAE,yEAAyE;QAC9E,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE;KAClF,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB;QACxF,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS;QAChE,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;QAClD,GAAG,EAAE,8EAA8E;QACnF,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE;KAChF,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,4BAA4B,EAAE,KAAK,EAAE,4BAA4B,EAAE,WAAW,EAAE,4BAA4B;QAChH,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS;QAChE,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE;QAC1D,GAAG,EAAE,wDAAwD;QAC7D,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG;IACV,eAAe,EAAE;QACf,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;QACpD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7G,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;KACjF;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;QACrD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACpG,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;KAC7E;IACD,kBAAkB,EAAE;QAClB,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE;QAC7D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,4BAA4B,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QACxF,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;KACjE;CACF,CAAC;AAEF,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC;AACzC,MAAM,UAAU,uBAAuB,CAAC,YAAY,GAAG,EAAE,IAAI,OAAO,gBAAgB,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AAC5H,MAAM,UAAU,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACxG,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/adapters/vercel.d.ts

@@ -0,0 +1,114 @@
+export declare const SECRET_VALUE_BINDING_VERSION = "EP-VERCEL-SECRET-VALUE-v1";
+/** Digest an exact secret value for receipt binding; callers must never log it. */
+export declare function secretValueDigest(value: any): string;
+export declare const VERCEL_ACTION_PACK: readonly (Readonly<{
+    id: "vercel.deploy.promote";
+    label: "Promote to production";
+    action_type: "vercel.deploy.promote";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "quorum";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Changes live production. Quorum for the prod cutover.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "vercel.project.delete";
+    label: "Delete project";
+    action_type: "vercel.project.delete";
+    risk: "critical";
+    receipt_required: true;
+    assurance_class: "class_a";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Destroys a project and its deployments. Bind the project.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}> | Readonly<{
+    id: "vercel.env.set";
+    label: "Set env / secret";
+    action_type: "vercel.env.set";
+    risk: "high";
+    receipt_required: true;
+    assurance_class: "class_a";
+    match: {
+        protocol: string;
+        tool: string;
+    };
+    why: "Changes production secrets/config. Bind project+key+target.";
+    execution_binding: {
+        required_fields: string[];
+    };
+}>)[];
+export declare const VERCEL_OPS: readonly string[];
+export declare function createVercelManifest(extra?: never[]): {
+    '@version': string;
+    actions: any[];
+};
+export declare function guardVercelMutation(gate: any, client: any, args: any): Promise<{
+    result: any;
+    reliance: any;
+    execution: any;
+}>;
+declare const _default: {
+    VERCEL_ACTION_PACK: readonly (Readonly<{
+        id: "vercel.deploy.promote";
+        label: "Promote to production";
+        action_type: "vercel.deploy.promote";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "quorum";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Changes live production. Quorum for the prod cutover.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "vercel.project.delete";
+        label: "Delete project";
+        action_type: "vercel.project.delete";
+        risk: "critical";
+        receipt_required: true;
+        assurance_class: "class_a";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Destroys a project and its deployments. Bind the project.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }> | Readonly<{
+        id: "vercel.env.set";
+        label: "Set env / secret";
+        action_type: "vercel.env.set";
+        risk: "high";
+        receipt_required: true;
+        assurance_class: "class_a";
+        match: {
+            protocol: string;
+            tool: string;
+        };
+        why: "Changes production secrets/config. Bind project+key+target.";
+        execution_binding: {
+            required_fields: string[];
+        };
+    }>)[];
+    VERCEL_OPS: readonly string[];
+    SECRET_VALUE_BINDING_VERSION: string;
+    secretValueDigest: typeof secretValueDigest;
+    createVercelManifest: typeof createVercelManifest;
+    guardVercelMutation: typeof guardVercelMutation;
+};
+export default _default;
+//# sourceMappingURL=vercel.d.ts.map

package/dist/adapters/vercel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../../src/adapters/vercel.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,4BAA4B,8BAA8B,CAAC;AAExE,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,KAAK,KAAA,UAKtC;AAED,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA0B7B,CAAC;AA6BH,eAAO,MAAM,UAAU,mBAAc,CAAC;AACtC,wBAAgB,oBAAoB,CAAC,KAAK,UAAK;;;EAAyD;AACxG,wBAAgB,mBAAmB,CAAC,IAAI,KAAA,EAAE,MAAM,KAAA,EAAE,IAAI,KAAA;;;;GAA+C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACrG,wBAOE"}

package/dist/adapters/vercel.js

@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — Vercel System-of-Record adapter.
+ * Guards promote-to-production, project delete, and env/secret changes so they
+ * never reach Vercel without a receipt bound to THIS project. Client injected
+ * (the Vercel REST client or a thin wrapper).
+ */
+import { createAdapter, manifestFromPack, hashCanonical } from './_kit.js';
+export const SECRET_VALUE_BINDING_VERSION = 'EP-VERCEL-SECRET-VALUE-v1';
+/** Digest an exact secret value for receipt binding; callers must never log it. */
+export function secretValueDigest(value) {
+    return hashCanonical({
+        version: SECRET_VALUE_BINDING_VERSION,
+        value,
+    });
+}
+export const VERCEL_ACTION_PACK = Object.freeze([
+    Object.freeze({
+        id: 'vercel.deploy.promote', label: 'Promote to production', action_type: 'vercel.deploy.promote',
+        risk: 'critical', receipt_required: true, assurance_class: 'quorum',
+        match: { protocol: 'vercel', tool: 'promote_deployment' },
+        why: 'Changes live production. Quorum for the prod cutover.',
+        execution_binding: { required_fields: ['action_type', 'project', 'deployment_id'] },
+    }),
+    Object.freeze({
+        id: 'vercel.project.delete', label: 'Delete project', action_type: 'vercel.project.delete',
+        risk: 'critical', receipt_required: true, assurance_class: 'class_a',
+        match: { protocol: 'vercel', tool: 'delete_project' },
+        why: 'Destroys a project and its deployments. Bind the project.',
+        execution_binding: { required_fields: ['action_type', 'project'] },
+    }),
+    Object.freeze({
+        id: 'vercel.env.set', label: 'Set env / secret', action_type: 'vercel.env.set',
+        risk: 'high', receipt_required: true, assurance_class: 'class_a',
+        match: { protocol: 'vercel', tool: 'upsert_env' },
+        why: 'Changes production secrets/config. Bind project+key+target.',
+        execution_binding: {
+            required_fields: [
+                'action_type', 'project', 'key', 'target', 'secret_value_digest', 'secret_value_version',
+            ],
+        },
+    }),
+]);
+const OPS = {
+    'deploy.promote': {
+        selector: { protocol: 'vercel', tool: 'promote_deployment' },
+        observed: (p) => ({ action_type: 'vercel.deploy.promote', project: p.project, deployment_id: p.deployment_id }),
+        perform: (c, p) => c.promoteDeployment({ project: p.project, deploymentId: p.deployment_id }),
+    },
+    'project.delete': {
+        selector: { protocol: 'vercel', tool: 'delete_project' },
+        observed: (p) => ({ action_type: 'vercel.project.delete', project: p.project }),
+        perform: (c, p) => c.deleteProject({ project: p.project }),
+    },
+    'env.set': {
+        selector: { protocol: 'vercel', tool: 'upsert_env' },
+        observed: (p) => ({
+            action_type: 'vercel.env.set',
+            project: p.project,
+            key: p.key,
+            target: p.target,
+            secret_value_digest: secretValueDigest(p.value),
+            secret_value_version: SECRET_VALUE_BINDING_VERSION,
+        }),
+        actuator: (p, observed) => ({ ...observed, value: p.value }),
+        perform: (c, p) => c.upsertEnv({ project: p.project, key: p.key, value: p.value, target: p.target }),
+    },
+};
+const adapter = createAdapter({ system: 'vercel', ops: OPS });
+export const VERCEL_OPS = adapter.OPS;
+export function createVercelManifest(extra = []) { return manifestFromPack(VERCEL_ACTION_PACK, extra); }
+export function guardVercelMutation(gate, client, args) { return adapter.guard(gate, client, args); }
+export default {
+    VERCEL_ACTION_PACK,
+    VERCEL_OPS,
+    SECRET_VALUE_BINDING_VERSION,
+    secretValueDigest,
+    createVercelManifest,
+    guardVercelMutation,
+};
+//# sourceMappingURL=vercel.js.map

package/dist/adapters/vercel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../src/adapters/vercel.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE3E,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAExE,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,KAAK;IACrC,OAAO,aAAa,CAAC;QACnB,OAAO,EAAE,4BAA4B;QACrC,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,uBAAuB;QACjG,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ;QACnE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE;QACzD,GAAG,EAAE,uDAAuD;QAC5D,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE;KACpF,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,uBAAuB;QAC1F,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS;QACpE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACrD,GAAG,EAAE,2DAA2D;QAChE,iBAAiB,EAAE,EAAE,eAAe,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE;KACnE,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB;QAC9E,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS;QAChE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;QACjD,GAAG,EAAE,6DAA6D;QAClE,iBAAiB,EAAE;YACjB,eAAe,EAAE;gBACf,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,qBAAqB,EAAE,sBAAsB;aACzF;SACF;KACF,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG;IACV,gBAAgB,EAAE;QAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE;QAC5D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/G,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;KAC9F;IACD,gBAAgB,EAAE;QAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACxD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/E,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;KAC3D;IACD,SAAS,EAAE;QACT,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;QACpD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,WAAW,EAAE,gBAAgB;YAC7B,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;YAC/C,oBAAoB,EAAE,4BAA4B;SACnD,CAAC;QACF,QAAQ,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5D,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;KACrG;CACF,CAAC;AAEF,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;AACtC,MAAM,UAAU,oBAAoB,CAAC,KAAK,GAAG,EAAE,IAAI,OAAO,gBAAgB,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACxG,MAAM,UAAU,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACrG,eAAe;IACb,kBAAkB;IAClB,UAAU;IACV,4BAA4B;IAC5B,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;CACpB,CAAC"}