@farmslot/recipe-runner 0.23.0

package/dist/core/suite.js

@@ -0,0 +1,76 @@
+import { mkdir, readFile } from 'node:fs/promises';
+import { digestRecipeDocument, digestRecipeSuiteScope, RECIPE_SUITE_RESULT_SCHEMA_URL, validateRecipeSuitePackage, validateRecipeSuiteScopeDocument, } from '@farmslot/protocol';
+import { writeFileWithinRoot } from './path.js';
+export function freezeRecipeSuiteScope(scope) {
+    const validation = validateRecipeSuiteScopeDocument(scope);
+    if (validation.status === 'invalid') {
+        throw new Error(formatSuiteValidationFailure('Recipe suite scope is invalid', validation.findings));
+    }
+    const retained = structuredClone(scope);
+    deepFreeze(retained);
+    return Object.freeze({ scope: retained, digest: digestRecipeSuiteScope(retained) });
+}
+export async function finalizeRecipeSuite(request) {
+    if (digestRecipeSuiteScope(request.scope.scope) !== request.scope.digest) {
+        throw new Error('Recipe suite scope changed after it was frozen.');
+    }
+    const summaries = {};
+    const summaryFiles = [];
+    const resolutions = [];
+    let summaryIndex = 0;
+    for (const input of request.resolutions) {
+        if (input.kind === 'not_executed') {
+            resolutions.push(structuredClone(input));
+            continue;
+        }
+        const summary = JSON.parse(await readFile(input.result.summaryPath, 'utf8'));
+        const summaryPath = `summaries/${String(++summaryIndex).padStart(4, '0')}.json`;
+        summaries[summaryPath] = summary;
+        summaryFiles.push({ path: summaryPath, content: `${JSON.stringify(summary, null, 2)}\n` });
+        resolutions.push({
+            id: input.id,
+            kind: 'verdict',
+            status: input.result.status,
+            summary_path: summaryPath,
+            summary_digest: digestRecipeDocument(summary),
+        });
+    }
+    const result = {
+        $schema: RECIPE_SUITE_RESULT_SCHEMA_URL,
+        suite_id: request.scope.scope.suite_id,
+        scope_digest: request.scope.digest,
+        totals: {
+            declared: request.scope.scope.cases.length,
+            executed: resolutions.filter((entry) => entry.kind === 'verdict').length,
+            not_executed: resolutions.filter((entry) => entry.kind === 'not_executed').length,
+        },
+        resolutions,
+    };
+    const validation = validateRecipeSuitePackage({
+        scope: request.scope.scope,
+        result,
+        summaries,
+    });
+    if (validation.status === 'invalid') {
+        throw new Error(formatSuiteValidationFailure('Recipe suite result is invalid', validation.findings));
+    }
+    await mkdir(request.outputDir, { recursive: true, mode: 0o700 });
+    for (const file of summaryFiles) {
+        await writeFileWithinRoot(request.outputDir, file.path, file.content);
+    }
+    const scopePath = await writeFileWithinRoot(request.outputDir, 'suite-scope.json', `${JSON.stringify(request.scope.scope, null, 2)}\n`);
+    const resultPath = await writeFileWithinRoot(request.outputDir, 'suite-result.json', `${JSON.stringify(result, null, 2)}\n`);
+    return { scopePath, resultPath, result };
+}
+function deepFreeze(value) {
+    if (value && typeof value === 'object') {
+        Object.freeze(value);
+        for (const child of Object.values(value))
+            deepFreeze(child);
+    }
+    return value;
+}
+function formatSuiteValidationFailure(prefix, findings) {
+    return `${prefix}: ${findings.map((finding) => `${finding.code} ${finding.path}`).join(', ')}.`;
+}
+//# sourceMappingURL=suite.js.map

package/dist/core/suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suite.js","sourceRoot":"","sources":["../../src/core/suite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,8BAA8B,EAK9B,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AA8BhD,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,UAAU,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,4BAA4B,CAAC,+BAA+B,EAAE,UAAU,CAAC,QAAQ,CAAC,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAA6B,CAAC;IACpE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAmC;IAEnC,IAAI,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,MAAM,YAAY,GAA6C,EAAE,CAAC;IAClE,MAAM,WAAW,GAA6C,EAAE,CAAC;IACjE,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACtF,MAAM,WAAW,GAAG,aAAa,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC;QAChF,SAAS,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;QACjC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,WAAW,CAAC,IAAI,CAAC;YACf,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;YAC3B,YAAY,EAAE,WAAW;YACzB,cAAc,EAAE,oBAAoB,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAA8B;QACxC,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ;QACtC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;QAClC,MAAM,EAAE;YACN,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM;YAC1C,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM;YACxE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,MAAM;SAClF;QACD,WAAW;KACZ,CAAC;IACF,MAAM,UAAU,GAAG,0BAA0B,CAAC;QAC5C,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;QAC1B,MAAM;QACN,SAAS;KACV,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,4BAA4B,CAAC,gCAAgC,EAAE,UAAU,CAAC,QAAQ,CAAC,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CACzC,OAAO,CAAC,SAAS,EACjB,kBAAkB,EAClB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACpD,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAC1C,OAAO,CAAC,SAAS,EACjB,mBAAmB,EACnB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACvC,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAc,EACd,QAA4C;IAE5C,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAClG,CAAC"}

package/dist/core/trace.d.ts

@@ -0,0 +1,5 @@
+import type { RecipeFailureCause } from '@farmslot/protocol';
+import type { ActionResult, TraceEntry, TraceWriter } from './types.js';
+export declare function recordSyntheticFailure(traceWriter: TraceWriter, nodeId: string, error: Error, action: string | undefined, causeClass: RecipeFailureCause): void;
+export declare function traceNodeMetadata(node: Record<string, unknown>, result?: ActionResult): Pick<TraceEntry, 'intent' | 'proves' | 'artifacts'>;
+//# sourceMappingURL=trace.d.ts.map

package/dist/core/trace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/core/trace.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAExE,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,UAAU,EAAE,kBAAkB,GAC7B,IAAI,CAYN;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,CAAC,EAAE,YAAY,GACpB,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC,CAUrD"}

package/dist/core/trace.js

@@ -0,0 +1,25 @@
+export function recordSyntheticFailure(traceWriter, nodeId, error, action, causeClass) {
+    const now = new Date().toISOString();
+    traceWriter.record({
+        nodeId,
+        action: action ?? 'unknown',
+        startedAt: now,
+        endedAt: now,
+        durationMs: 0,
+        ok: false,
+        cause_class: causeClass,
+        error: error.message,
+    });
+}
+export function traceNodeMetadata(node, result) {
+    const metadata = {};
+    if (typeof node.intent === 'string' && node.intent.trim())
+        metadata.intent = node.intent;
+    if (Array.isArray(node.proves)) {
+        metadata.proves = node.proves.filter((proofTarget) => typeof proofTarget === 'string');
+    }
+    if (result?.artifacts?.length)
+        metadata.artifacts = result.artifacts;
+    return metadata;
+}
+//# sourceMappingURL=trace.js.map

package/dist/core/trace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.js","sourceRoot":"","sources":["../../src/core/trace.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,sBAAsB,CACpC,WAAwB,EACxB,MAAc,EACd,KAAY,EACZ,MAA0B,EAC1B,UAA8B;IAE9B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,WAAW,CAAC,MAAM,CAAC;QACjB,MAAM;QACN,MAAM,EAAE,MAAM,IAAI,SAAS;QAC3B,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,CAAC;QACb,EAAE,EAAE,KAAK;QACT,WAAW,EAAE,UAAU;QACvB,KAAK,EAAE,KAAK,CAAC,OAAO;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAA6B,EAC7B,MAAqB;IAErB,MAAM,QAAQ,GAAwD,EAAE,CAAC;IACzE,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAClC,CAAC,WAAW,EAAyB,EAAE,CAAC,OAAO,WAAW,KAAK,QAAQ,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,EAAE,SAAS,EAAE,MAAM;QAAE,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACrE,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/core/trust-error.d.ts

@@ -0,0 +1,9 @@
+import type { RecipeTrustFailure } from '@farmslot/protocol';
+export declare class RecipeTrustError extends Error {
+    readonly code: RecipeTrustFailure['code'];
+    readonly userAction: string;
+    readonly failure: RecipeTrustFailure;
+    constructor(failure: RecipeTrustFailure);
+}
+export declare function invalidRecipeSource(message: string, userAction: string): RecipeTrustError;
+//# sourceMappingURL=trust-error.d.ts.map

package/dist/core/trust-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-error.d.ts","sourceRoot":"","sources":["../../src/core/trust-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;gBAEzB,OAAO,EAAE,kBAAkB;CAOxC;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAOzF"}

package/dist/core/trust-error.js

@@ -0,0 +1,18 @@
+export class RecipeTrustError extends Error {
+    constructor(failure) {
+        super(failure.message);
+        this.name = 'RecipeTrustError';
+        this.code = failure.code;
+        this.userAction = failure.userAction;
+        this.failure = failure;
+    }
+}
+export function invalidRecipeSource(message, userAction) {
+    return new RecipeTrustError({
+        code: 'RECIPE_SOURCE_INVALID',
+        message,
+        userAction,
+        reason: 'invalid-source',
+    });
+}
+//# sourceMappingURL=trust-error.js.map

package/dist/core/trust-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-error.js","sourceRoot":"","sources":["../../src/core/trust-error.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAKzC,YAAY,OAA2B;QACrC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,UAAkB;IACrE,OAAO,IAAI,gBAAgB,CAAC;QAC1B,IAAI,EAAE,uBAAuB;QAC7B,OAAO;QACP,UAAU;QACV,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC"}

package/dist/core/trust-input.d.ts

@@ -0,0 +1,20 @@
+import { type RecipeExecutionApproval, type RecipeSourceProvenance } from '@farmslot/protocol';
+export declare const RECIPE_TRUST_ENV: {
+    readonly sourceTrust: "FARMSLOT_RECIPE_SOURCE_TRUST";
+    readonly sourceKind: "FARMSLOT_RECIPE_SOURCE_KIND";
+    readonly sourceName: "FARMSLOT_RECIPE_SOURCE_NAME";
+    readonly sourceDigest: "FARMSLOT_RECIPE_SOURCE_DIGEST";
+    readonly approvalDigest: "FARMSLOT_RECIPE_APPROVE_PLAN";
+};
+export interface RecipeTrustInput {
+    source?: RecipeSourceProvenance;
+    approval?: RecipeExecutionApproval;
+}
+export declare function resolveRecipeTrustInput(options?: {
+    sourceTrust?: string;
+    sourceKind?: string;
+    sourceName?: string;
+    sourceDigest?: string;
+    approvalDigest?: string;
+}, env?: Record<string, string | undefined>): RecipeTrustInput;
+//# sourceMappingURL=trust-input.d.ts.map

package/dist/core/trust-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-input.d.ts","sourceRoot":"","sources":["../../src/core/trust-input.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,uBAAuB,EAE5B,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAI5B,eAAO,MAAM,gBAAgB;;;;;;CAMnB,CAAC;AAYX,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,wBAAgB,uBAAuB,CACrC,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACpB,EACN,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,gBAAgB,CAsBlB"}

package/dist/core/trust-input.js

@@ -0,0 +1,68 @@
+import { invalidRecipeSource } from './trust-error.js';
+export const RECIPE_TRUST_ENV = {
+    sourceTrust: 'FARMSLOT_RECIPE_SOURCE_TRUST',
+    sourceKind: 'FARMSLOT_RECIPE_SOURCE_KIND',
+    sourceName: 'FARMSLOT_RECIPE_SOURCE_NAME',
+    sourceDigest: 'FARMSLOT_RECIPE_SOURCE_DIGEST',
+    approvalDigest: 'FARMSLOT_RECIPE_APPROVE_PLAN',
+};
+const sourceTrustValues = new Set(['trusted', 'untrusted', 'unknown']);
+const sourceKindValues = new Set([
+    'bundled',
+    'operator',
+    'task',
+    'recipe-file',
+    'library',
+    'custom-adapter',
+]);
+export function resolveRecipeTrustInput(options = {}, env = process.env) {
+    const optionSource = parseSource(options, 'option');
+    const environmentSource = parseSource({
+        sourceTrust: env[RECIPE_TRUST_ENV.sourceTrust],
+        sourceKind: env[RECIPE_TRUST_ENV.sourceKind],
+        sourceName: env[RECIPE_TRUST_ENV.sourceName],
+        sourceDigest: env[RECIPE_TRUST_ENV.sourceDigest],
+    }, 'environment');
+    const source = restrictSource(environmentSource, optionSource);
+    const environmentApproval = env[RECIPE_TRUST_ENV.approvalDigest];
+    const approvalDigest = environmentSource && environmentSource.trust !== 'trusted'
+        ? environmentApproval
+        : (options.approvalDigest ?? environmentApproval);
+    return {
+        ...(source ? { source } : {}),
+        ...(approvalDigest ? { approval: { planDigest: approvalDigest } } : {}),
+    };
+}
+function parseSource(values, input) {
+    const { sourceTrust, sourceKind, sourceName, sourceDigest } = values;
+    if ((sourceTrust == null) !== (sourceKind == null)) {
+        throw invalidRecipeSource(`Recipe source trust and kind must be supplied together in the ${input}.`, `set both ${RECIPE_TRUST_ENV.sourceTrust} and ${RECIPE_TRUST_ENV.sourceKind}`);
+    }
+    if ((sourceName != null || sourceDigest != null) && (sourceTrust == null || sourceKind == null)) {
+        throw invalidRecipeSource(`Recipe source name or digest requires source trust and kind in the ${input}.`, `set both ${RECIPE_TRUST_ENV.sourceTrust} and ${RECIPE_TRUST_ENV.sourceKind}`);
+    }
+    if (sourceTrust && !sourceTrustValues.has(sourceTrust)) {
+        throw invalidRecipeSource(`Unknown recipe source trust ${JSON.stringify(sourceTrust)}.`, 'use trusted, untrusted, or unknown');
+    }
+    if (sourceKind && !sourceKindValues.has(sourceKind)) {
+        throw invalidRecipeSource(`Unknown recipe source kind ${JSON.stringify(sourceKind)}.`, 'use a Recipe Protocol source kind reported by the runner');
+    }
+    if (!sourceTrust || !sourceKind)
+        return undefined;
+    return {
+        trust: sourceTrust,
+        kind: sourceKind,
+        ...(sourceName ? { name: sourceName } : {}),
+        ...(sourceDigest ? { digest: sourceDigest } : {}),
+    };
+}
+function restrictSource(environmentSource, optionSource) {
+    if (!environmentSource)
+        return optionSource;
+    if (!optionSource)
+        return environmentSource;
+    if (environmentSource.trust !== 'trusted')
+        return environmentSource;
+    return optionSource;
+}
+//# sourceMappingURL=trust-input.js.map

package/dist/core/trust-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-input.js","sourceRoot":"","sources":["../../src/core/trust-input.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,8BAA8B;IAC3C,UAAU,EAAE,6BAA6B;IACzC,UAAU,EAAE,6BAA6B;IACzC,YAAY,EAAE,+BAA+B;IAC7C,cAAc,EAAE,8BAA8B;CACtC,CAAC;AAEX,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AACvE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,SAAS;IACT,UAAU;IACV,MAAM;IACN,aAAa;IACb,SAAS;IACT,gBAAgB;CACjB,CAAC,CAAC;AAOH,MAAM,UAAU,uBAAuB,CACrC,UAMI,EAAE,EACN,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,WAAW,CACnC;QACE,WAAW,EAAE,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC;QAC9C,UAAU,EAAE,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAC5C,UAAU,EAAE,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAC5C,YAAY,EAAE,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC;KACjD,EACD,aAAa,CACd,CAAC;IACF,MAAM,MAAM,GAAG,cAAc,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GAAG,GAAG,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACjE,MAAM,cAAc,GAClB,iBAAiB,IAAI,iBAAiB,CAAC,KAAK,KAAK,SAAS;QACxD,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,CAAC;IAEtD,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,MAKC,EACD,KAA+B;IAE/B,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACrE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,mBAAmB,CACvB,iEAAiE,KAAK,GAAG,EACzE,YAAY,gBAAgB,CAAC,WAAW,QAAQ,gBAAgB,CAAC,UAAU,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,UAAU,IAAI,IAAI,CAAC,EAAE,CAAC;QAChG,MAAM,mBAAmB,CACvB,sEAAsE,KAAK,GAAG,EAC9E,YAAY,gBAAgB,CAAC,WAAW,QAAQ,gBAAgB,CAAC,UAAU,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,MAAM,mBAAmB,CACvB,+BAA+B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,EAC7D,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,mBAAmB,CACvB,8BAA8B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,EAC3D,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO;QACL,KAAK,EAAE,WAA8C;QACrD,IAAI,EAAE,UAA8B;QACpC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,iBAAqD,EACrD,YAAgD;IAEhD,IAAI,CAAC,iBAAiB;QAAE,OAAO,YAAY,CAAC;IAC5C,IAAI,CAAC,YAAY;QAAE,OAAO,iBAAiB,CAAC;IAC5C,IAAI,iBAAiB,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC;IACpE,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/core/trust.d.ts

@@ -0,0 +1,28 @@
+import { type RecipeActionManifestDocument, type RecipeExecutionCapability, type RecipeExecutionPlan, type RecipeSourceProvenance } from '@farmslot/protocol';
+import type { ResolvedLibraryRecipe } from './library.js';
+import type { DefaultObserverRefs } from './passive-observations.js';
+import type { ActionAdapter, RecipeHudOptions, RecipeRunRequest } from './types.js';
+export declare function recipeSourceForRequest(request: RecipeRunRequest, recipe: unknown, sourceRecipePath?: string, defaultSource?: RecipeSourceProvenance): RecipeSourceProvenance;
+export declare function buildRecipeExecutionPlan({ recipe, params, source, recipes, adapters, actionManifest, defaultObserverRefs, projectRoot, artifactsDir, env, hud, recordVideo, }: {
+    recipe: Record<string, unknown>;
+    params: Record<string, unknown>;
+    source: RecipeSourceProvenance;
+    recipes: ReadonlyMap<string, ResolvedLibraryRecipe>;
+    adapters: ReadonlyMap<string, ActionAdapter>;
+    actionManifest: RecipeActionManifestDocument;
+    defaultObserverRefs: DefaultObserverRefs;
+    projectRoot: string;
+    artifactsDir: string;
+    env: Record<string, string | undefined>;
+    hud?: RecipeHudOptions | false;
+    recordVideo?: RecipeRunRequest['recordVideo'];
+}): RecipeExecutionPlan;
+export declare function enforceRecipeExecutionPlan(plan: RecipeExecutionPlan, request: Pick<RecipeRunRequest, 'approval'>, blockedCapabilities?: readonly RecipeExecutionCapability[]): void;
+export declare function verifyExecutableSource(executable: Pick<ActionAdapter, 'source' | 'resolveSourceDigest'>, label: string): Promise<void>;
+/**
+ * The environment an approval binds to. Only the volatile package-manager values above are
+ * dropped, plus the per-invocation shim folder Yarn puts first on PATH, so repeated runs through
+ * the same invocation path (for example `yarn farmslot recipe run`) approve the same digest.
+ */
+export declare function planEnvironment(env: Readonly<Record<string, string | undefined>>): Record<string, string | undefined>;
+//# sourceMappingURL=trust.d.ts.map

package/dist/core/trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../../src/core/trust.ts"],"names":[],"mappings":"AAEA,OAAO,EAML,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EAExB,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGrE,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AASpF,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,OAAO,EACf,gBAAgB,CAAC,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,sBAAsB,GACrC,sBAAsB,CAoBxB;AAED,wBAAgB,wBAAwB,CAAC,EACvC,MAAM,EACN,MAAM,EACN,MAAM,EACN,OAAO,EACP,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,GAAG,EACH,GAAG,EACH,WAAW,GACZ,EAAE;IACD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACpD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,cAAc,EAAE,4BAA4B,CAAC;IAC7C,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,GAAG,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAC;IAC/B,WAAW,CAAC,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;CAC/C,GAAG,mBAAmB,CA2GtB;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAC3C,mBAAmB,GAAE,SAAS,yBAAyB,EAAkD,GACxG,IAAI,CA6DN;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,qBAAqB,CAAC,EACjE,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAef;AA8GD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAChD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAYpC"}

package/dist/core/trust.js

@@ -0,0 +1,284 @@
+import path from 'node:path';
+import { DEFAULT_UNTRUSTED_RECIPE_BLOCKED_CAPABILITIES, digestRecipeDocument, normalizeRecipeRef, OFFICIAL_RECIPE_ACTIONS, officialRecipeActionCapabilities, } from '@farmslot/protocol';
+import { extractWorkflowGraph } from './graph.js';
+import { isRecord } from './json.js';
+import { resolveRecipeParams, resolveRecipeValue } from './parameters.js';
+import { RecipeResolutionError } from './resolution-error.js';
+import { invalidRecipeSource, RecipeTrustError } from './trust-error.js';
+const officialActions = new Set(OFFICIAL_RECIPE_ACTIONS);
+const bundledSource = {
+    kind: 'bundled',
+    trust: 'trusted',
+    name: '@farmslot/recipe-runner',
+};
+export function recipeSourceForRequest(request, recipe, sourceRecipePath, defaultSource) {
+    const digest = digestValue(recipe);
+    const claimedDigest = request.source?.digest ?? defaultSource?.digest;
+    if (claimedDigest && claimedDigest !== digest) {
+        throw invalidRecipeSource(`Recipe source digest ${claimedDigest} does not match the loaded document.`, `use the loaded recipe digest ${digest} or omit the caller digest`);
+    }
+    const fallback = {
+        kind: request.recipeDocument == null ? 'recipe-file' : 'operator',
+        trust: 'unknown',
+    };
+    return {
+        ...fallback,
+        ...defaultSource,
+        ...request.source,
+        ...(sourceRecipePath ? { path: sourceRecipePath } : {}),
+        digest,
+    };
+}
+export function buildRecipeExecutionPlan({ recipe, params, source, recipes, adapters, actionManifest, defaultObserverRefs, projectRoot, artifactsDir, env, hud, recordVideo, }) {
+    const nodes = [];
+    const digestNodes = [];
+    const addNode = (nodeId, node, origin, invocationOrigin) => {
+        if (typeof node.action !== 'string' || !node.action.trim())
+            return;
+        const adapter = adapters.get(node.action);
+        const adapterOrigin = adapterSource(node.action, adapter);
+        const observerRefs = [...(defaultObserverRefs.get(node.action) ?? [])];
+        const capabilities = actionCapabilities(node.action, adapter, adapterOrigin, declaredActionCapabilities(actionManifest, node.action), observerRefs.length > 0);
+        const planNode = {
+            nodeId,
+            action: node.action,
+            capabilities,
+            origin,
+            ...(observerRefs.length > 0 ? { observerRefs } : {}),
+            ...(containsRecipeOutputTemplate(node) ? { runtimeOutputDependent: true } : {}),
+            ...(invocationOrigin ? { invocationOrigin } : {}),
+            ...(adapterOrigin ? { adapterOrigin } : {}),
+        };
+        nodes.push(planNode);
+        digestNodes.push({ plan: planNode, node });
+    };
+    const visitRecipe = (activeRecipe, activeParams, origin, invocationOrigin, prefix) => {
+        const activeGraph = extractWorkflowGraph(activeRecipe);
+        for (const [nodeId, rawNode] of Object.entries(activeGraph.nodes)) {
+            const resolvedNode = resolveRecipeValue(rawNode, activeParams);
+            if (!isRecord(resolvedNode)) {
+                throw new RecipeResolutionError('RECIPE_PARAMS_INVALID', `Recipe node ${prefix}${nodeId} did not resolve to an object.`, `inspect parameter templates used by ${prefix}${nodeId}`);
+            }
+            const planNodeId = `${prefix}${nodeId}`;
+            addNode(planNodeId, resolvedNode, origin, invocationOrigin);
+            if (resolvedNode.action !== 'call' || typeof resolvedNode.ref !== 'string')
+                continue;
+            const ref = normalizeRecipeRef(resolvedNode.ref);
+            const dependency = recipes.get(ref);
+            if (!dependency) {
+                throw new RecipeResolutionError('RECIPE_REFERENCE_NOT_FOUND', `Recipe ${ref} is not available from configured libraries.`, `add ${ref} to a configured recipe library or correct call.ref`);
+            }
+            const childInput = isRecord(resolvedNode.params) ? resolvedNode.params : {};
+            const childParams = resolveRecipeParams(ref, dependency.document, childInput, {
+                allowTemplates: true,
+            });
+            visitRecipe(dependency.document, childParams, dependency.provenance, effectiveInvocationOrigin(origin, invocationOrigin), `${planNodeId}/`);
+        }
+    };
+    visitRecipe(recipe, params, source, undefined, '');
+    if (hud !== false && hud?.enabled !== false && adapters.has('app.hud')) {
+        addNode('run:hud', { action: 'app.hud', automatic: true, options: hud ?? {} }, source);
+    }
+    if (recordVideo && recordVideo !== 'off') {
+        const planNode = {
+            nodeId: 'run:recording',
+            action: 'recording',
+            capabilities: ['host-read-export'],
+            origin: source,
+            adapterOrigin: bundledSource,
+        };
+        nodes.push(planNode);
+        digestNodes.push({ plan: planNode, node: { recordVideo } });
+    }
+    const executionContextDigest = digestValue({
+        projectRoot,
+        artifactsDir,
+        env: planEnvironment(env),
+        params,
+    });
+    const planBody = { schemaVersion: 1, executionContextDigest, source, nodes };
+    return {
+        ...planBody,
+        digest: digestValue({ recipe, source, executionContextDigest, nodes: digestNodes }),
+    };
+}
+export function enforceRecipeExecutionPlan(plan, request, blockedCapabilities = DEFAULT_UNTRUSTED_RECIPE_BLOCKED_CAPABILITIES) {
+    for (const node of plan.nodes) {
+        if (node.capabilities.includes('arbitrary-code') &&
+            node.adapterOrigin?.trust !== 'trusted' &&
+            !node.adapterOrigin?.digest) {
+            throw invalidRecipeSource(`Custom implementation ${node.action} has no content digest.`, 'register a trusted adapter or supply provenance with a digest before approval');
+        }
+    }
+    const blockedSet = new Set(blockedCapabilities);
+    const blocked = plan.nodes.filter((node) => {
+        const untrustedRecipe = node.origin.trust !== 'trusted';
+        const untrustedInvocation = node.invocationOrigin != null && node.invocationOrigin.trust !== 'trusted';
+        const untrustedAdapter = node.adapterOrigin?.trust !== 'trusted';
+        return node.capabilities.some((capability) => blockedSet.has(capability) && (untrustedRecipe || untrustedInvocation || untrustedAdapter));
+    });
+    if (blocked.length === 0)
+        return;
+    const runtimeDependent = blocked.filter((node) => node.runtimeOutputDependent);
+    if (runtimeDependent.length > 0) {
+        throw new RecipeTrustError({
+            code: 'RECIPE_TRUST_REQUIRED',
+            message: 'Untrusted restricted recipe nodes cannot derive executable values from runtime outputs.',
+            userAction: 'replace {{outputs.*}} executable values with reviewed recipe parameters, or move the behavior into a trusted recipe',
+            reason: 'blocked-capability',
+            recipeDigest: plan.digest,
+            trust: plan.source.trust,
+            blocked: runtimeDependent.map(redactPlanNodeProvenance),
+        });
+    }
+    if (request.approval?.planDigest === plan.digest)
+        return;
+    const publicBlocked = blocked.map(redactPlanNodeProvenance);
+    if (request.approval) {
+        throw new RecipeTrustError({
+            code: 'RECIPE_APPROVAL_MISMATCH',
+            message: 'Recipe approval does not match the resolved execution plan.',
+            userAction: approvalUserAction(plan.digest),
+            reason: 'approval-mismatch',
+            recipeDigest: plan.digest,
+            trust: plan.source.trust,
+            blocked: publicBlocked,
+        });
+    }
+    throw new RecipeTrustError({
+        code: 'RECIPE_TRUST_REQUIRED',
+        message: 'Untrusted recipe sources cannot execute restricted capabilities.',
+        userAction: approvalUserAction(plan.digest),
+        reason: 'blocked-capability',
+        recipeDigest: plan.digest,
+        trust: plan.source.trust,
+        blocked: publicBlocked,
+    });
+}
+export async function verifyExecutableSource(executable, label) {
+    if (!executable.resolveSourceDigest)
+        return;
+    if (!executable.source?.digest) {
+        throw invalidRecipeSource(`${label} has an integrity verifier but no approved source digest.`, 'resolve the implementation again and review its content digest before execution');
+    }
+    const actualDigest = await executable.resolveSourceDigest();
+    if (actualDigest !== executable.source.digest) {
+        throw invalidRecipeSource(`${label} changed after the execution plan was resolved.`, 'resolve and review a new execution plan for the current implementation bytes');
+    }
+}
+function approvalUserAction(planDigest) {
+    return (`review the resolved plan, then approve ${planDigest} through the trusted caller ` +
+        `(direct CLI: --approve-plan ${planDigest}; managed run: ` +
+        `FARMSLOT_RECIPE_APPROVE_PLAN=${planDigest})`);
+}
+function effectiveInvocationOrigin(definitionOrigin, invocationOrigin) {
+    if (invocationOrigin && invocationOrigin.trust !== 'trusted')
+        return invocationOrigin;
+    if (definitionOrigin.trust !== 'trusted')
+        return definitionOrigin;
+    return invocationOrigin ?? definitionOrigin;
+}
+function redactPlanNodeProvenance(node) {
+    return {
+        ...node,
+        origin: redactSourceDetails(node.origin),
+        ...(node.invocationOrigin
+            ? { invocationOrigin: redactSourceDetails(node.invocationOrigin) }
+            : {}),
+        ...(node.adapterOrigin ? { adapterOrigin: redactSourceDetails(node.adapterOrigin) } : {}),
+    };
+}
+function redactSourceDetails(source) {
+    const { name: _name, path: _path, ...publicSource } = source;
+    return publicSource;
+}
+function actionCapabilities(action, adapter, adapterOrigin, manifestCapabilities, observes) {
+    const declared = adapter?.capabilities;
+    const official = officialActions.has(action)
+        ? officialRecipeActionCapabilities(action)
+        : [];
+    const observerCapabilities = observes ? ['host-read-export'] : [];
+    const base = officialActions.has(action)
+        ? [
+            ...new Set([
+                ...official,
+                ...manifestCapabilities,
+                ...(declared ?? []),
+                ...observerCapabilities,
+            ]),
+        ]
+        : declared
+            ? [...new Set([...manifestCapabilities, ...declared, ...observerCapabilities])]
+            : action === 'call'
+                ? observerCapabilities
+                : [
+                    ...new Set([
+                        'arbitrary-code',
+                        ...manifestCapabilities,
+                        ...observerCapabilities,
+                    ]),
+                ];
+    if (adapterOrigin?.trust === 'trusted' || base.includes('arbitrary-code'))
+        return [...base];
+    return [...base, 'arbitrary-code'];
+}
+function declaredActionCapabilities(manifest, action) {
+    return manifest.actions[action]?.execution_capabilities ?? [];
+}
+function adapterSource(action, adapter) {
+    if (action === 'call' || action === 'end')
+        return bundledSource;
+    if (adapter?.source)
+        return adapter.source;
+    return {
+        kind: 'custom-adapter',
+        trust: 'unknown',
+        name: action,
+    };
+}
+/**
+ * Values Yarn (via Corepack) sets on every `yarn <script>` that say nothing about what the run does:
+ * the per-invocation shim paths, and package metadata. Everything else, including user-set
+ * `npm_config_*` and `COREPACK_*` settings such as a registry, stays bound to the approval.
+ */
+const VOLATILE_PACKAGE_MANAGER_ENV = new Set([
+    'BERRY_BIN_FOLDER',
+    'npm_execpath',
+    'npm_node_execpath',
+    'npm_config_user_agent',
+    'INIT_CWD',
+    'PROJECT_CWD',
+    'COREPACK_ROOT',
+    'COREPACK_ENABLE_DOWNLOAD_PROMPT',
+]);
+const PACKAGE_METADATA_ENV = /^npm_package_/u;
+/**
+ * The environment an approval binds to. Only the volatile package-manager values above are
+ * dropped, plus the per-invocation shim folder Yarn puts first on PATH, so repeated runs through
+ * the same invocation path (for example `yarn farmslot recipe run`) approve the same digest.
+ */
+export function planEnvironment(env) {
+    const shims = env.BERRY_BIN_FOLDER;
+    return Object.fromEntries(Object.entries(env)
+        .filter(([key]) => !VOLATILE_PACKAGE_MANAGER_ENV.has(key) && !PACKAGE_METADATA_ENV.test(key))
+        .map(([key, value]) => {
+        if (key !== 'PATH' || !shims || !value)
+            return [key, value];
+        const [first, ...rest] = value.split(path.delimiter);
+        // Only Yarn's own shim entry at the front of PATH is volatile.
+        return [key, first === shims ? rest.join(path.delimiter) : value];
+    }));
+}
+function digestValue(value) {
+    return digestRecipeDocument(value);
+}
+function containsRecipeOutputTemplate(value) {
+    if (typeof value === 'string')
+        return value.includes('{{outputs.');
+    if (Array.isArray(value))
+        return value.some(containsRecipeOutputTemplate);
+    if (!isRecord(value))
+        return false;
+    return Object.values(value).some(containsRecipeOutputTemplate);
+}
+//# sourceMappingURL=trust.js.map

package/dist/core/trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.js","sourceRoot":"","sources":["../../src/core/trust.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,6CAA6C,EAC7C,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,gCAAgC,GAMjC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,uBAAuB,CAAC,CAAC;AACjE,MAAM,aAAa,GAA2B;IAC5C,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,yBAAyB;CAChC,CAAC;AAEF,MAAM,UAAU,sBAAsB,CACpC,OAAyB,EACzB,MAAe,EACf,gBAAyB,EACzB,aAAsC;IAEtC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,CAAC;IACtE,IAAI,aAAa,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,mBAAmB,CACvB,wBAAwB,aAAa,sCAAsC,EAC3E,gCAAgC,MAAM,4BAA4B,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAA2B;QACvC,IAAI,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU;QACjE,KAAK,EAAE,SAAS;KACjB,CAAC;IACF,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,aAAa;QAChB,GAAG,OAAO,CAAC,MAAM;QACjB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,EACvC,MAAM,EACN,MAAM,EACN,MAAM,EACN,OAAO,EACP,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,GAAG,EACH,GAAG,EACH,WAAW,GAcZ;IACC,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,WAAW,GAAmE,EAAE,CAAC;IAEvF,MAAM,OAAO,GAAG,CACd,MAAc,EACd,IAA6B,EAC7B,MAA8B,EAC9B,gBAAyC,EACnC,EAAE;QACR,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,kBAAkB,CACrC,IAAI,CAAC,MAAM,EACX,OAAO,EACP,aAAa,EACb,0BAA0B,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,EACvD,YAAY,CAAC,MAAM,GAAG,CAAC,CACxB,CAAC;QACF,MAAM,QAAQ,GAAmB;YAC/B,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY;YACZ,MAAM;YACN,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAClB,YAAqC,EACrC,YAAqC,EACrC,MAA8B,EAC9B,gBAAoD,EACpD,MAAc,EACR,EAAE;QACR,MAAM,WAAW,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,qBAAqB,CAC7B,uBAAuB,EACvB,eAAe,MAAM,GAAG,MAAM,gCAAgC,EAC9D,uCAAuC,MAAM,GAAG,MAAM,EAAE,CACzD,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;YACxC,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC5D,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,YAAY,CAAC,GAAG,KAAK,QAAQ;gBAAE,SAAS;YACrF,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,qBAAqB,CAC7B,4BAA4B,EAC5B,UAAU,GAAG,8CAA8C,EAC3D,OAAO,GAAG,qDAAqD,CAChE,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE;gBAC5E,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YACH,WAAW,CACT,UAAU,CAAC,QAAQ,EACnB,WAAW,EACX,UAAU,CAAC,UAAU,EACrB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACnD,GAAG,UAAU,GAAG,CACjB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAEnD,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,EAAE,OAAO,KAAK,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,WAAW,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAmB;YAC/B,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,WAAW;YACnB,YAAY,EAAE,CAAC,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,aAAa;SAC7B,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,sBAAsB,GAAG,WAAW,CAAC;QACzC,WAAW;QACX,YAAY;QACZ,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC;QACzB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,EAAE,aAAa,EAAE,CAAU,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtF,OAAO;QACL,GAAG,QAAQ;QACX,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAyB,EACzB,OAA2C,EAC3C,sBAA4D,6CAA6C;IAEzG,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IACE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC5C,IAAI,CAAC,aAAa,EAAE,KAAK,KAAK,SAAS;YACvC,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAC3B,CAAC;YACD,MAAM,mBAAmB,CACvB,yBAAyB,IAAI,CAAC,MAAM,yBAAyB,EAC7D,+EAA+E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACzC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC;QACxD,MAAM,mBAAmB,GACvB,IAAI,CAAC,gBAAgB,IAAI,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,KAAK,SAAS,CAAC;QAC7E,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,KAAK,SAAS,CAAC;QACjE,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAC3B,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,IAAI,mBAAmB,IAAI,gBAAgB,CAAC,CAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/E,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EACL,yFAAyF;YAC3F,UAAU,EACR,qHAAqH;YACvH,MAAM,EAAE,oBAAoB;YAC5B,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,wBAAwB,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,UAAU,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO;IACzD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,6DAA6D;YACtE,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAC3C,MAAM,EAAE,mBAAmB;YAC3B,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,gBAAgB,CAAC;QACzB,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,kEAAkE;QAC3E,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3C,MAAM,EAAE,oBAAoB;QAC5B,YAAY,EAAE,IAAI,CAAC,MAAM;QACzB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;QACxB,OAAO,EAAE,aAAa;KACvB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAiE,EACjE,KAAa;IAEb,IAAI,CAAC,UAAU,CAAC,mBAAmB;QAAE,OAAO;IAC5C,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,mBAAmB,CACvB,GAAG,KAAK,2DAA2D,EACnE,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,mBAAmB,EAAE,CAAC;IAC5D,IAAI,YAAY,KAAK,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,mBAAmB,CACvB,GAAG,KAAK,iDAAiD,EACzD,8EAA8E,CAC/E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,OAAO,CACL,0CAA0C,UAAU,8BAA8B;QAClF,+BAA+B,UAAU,iBAAiB;QAC1D,gCAAgC,UAAU,GAAG,CAC9C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,gBAAwC,EACxC,gBAAyC;IAEzC,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC;IACtF,IAAI,gBAAgB,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC;IAClE,OAAO,gBAAgB,IAAI,gBAAgB,CAAC;AAC9C,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAoB;IACpD,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,gBAAgB;YACvB,CAAC,CAAC,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA8B;IACzD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC;IAC7D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAc,EACd,OAAkC,EAClC,aAAiD,EACjD,oBAA0D,EAC1D,QAAiB;IAEjB,MAAM,QAAQ,GAAG,OAAO,EAAE,YAAY,CAAC;IACvC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,gCAAgC,CAC9B,MAAgE,CACjE;QACH,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,oBAAoB,GAAgC,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,IAAI,GAAgC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QACnE,CAAC,CAAC;YACE,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,QAAQ;gBACX,GAAG,oBAAoB;gBACvB,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,GAAG,oBAAoB;aACxB,CAAC;SACH;QACH,CAAC,CAAC,QAAQ;YACR,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,oBAAoB,EAAE,GAAG,QAAQ,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC;YAC/E,CAAC,CAAC,MAAM,KAAK,MAAM;gBACjB,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC;oBACE,GAAG,IAAI,GAAG,CAA4B;wBACpC,gBAAgB;wBAChB,GAAG,oBAAoB;wBACvB,GAAG,oBAAoB;qBACxB,CAAC;iBACH,CAAC;IACV,IAAI,aAAa,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,0BAA0B,CACjC,QAAsC,EACtC,MAAc;IAEd,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,sBAAsB,IAAI,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,OAAkC;IAElC,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IAChE,IAAI,OAAO,EAAE,MAAM;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IAC3C,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,MAAM;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,kBAAkB;IAClB,cAAc;IACd,mBAAmB;IACnB,uBAAuB;IACvB,UAAU;IACV,aAAa;IACb,eAAe;IACf,iCAAiC;CAClC,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAiD;IAEjD,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACnC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC5F,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACpB,IAAI,GAAG,KAAK,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,+DAA+D;QAC/D,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;AACjE,CAAC"}