@grindfree/guard 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 GrindFree / Rob
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,131 @@
-# Temporary Holding Version
+# @grindfree/guard
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Drop-in guards that screen **[GrindFree](https://grindfree.net)** x402 agent-security APIs **before** an agent acts, then enforce `allow | review | deny`. Payments use the **caller’s** Base USDC wallet via the official [`@x402/fetch`](https://www.npmjs.com/package/@x402/fetch) / Python `x402` clients. This repo never ships or accepts GrindFree keys.
+
+| Service | Endpoint | Price | What it checks |
+|---|---|---|---|
+| **PromptShield** | `POST https://promptshield.grindfree.net/v1/screen` · `/v1/clean` | $0.002 | Prompt-injection screen + HTML→LLM clean text |
+| **CrawlSafe** | `POST https://crawlsafe.grindfree.net/v1/check` | $0.002 | robots.txt / X-Robots-Tag crawl gate (not malware scanning) |
+| **ToolGuard** | `POST https://toolguard.grindfree.net/v1/evaluate` | $0.002 | Pre-tool-call `allow \| review \| deny` vs owner policy |
+| **CommandGuard** | `POST https://commandguard.grindfree.net/v1/command` · `/v1/sql` | $0.001 | Shell + SQL check: `allow \| warn \| block` |
+| **MemoryGuard** | `POST https://memoryguard.grindfree.net/v1/screen` | $0.002 | Content before it is written to agent memory |
+| **WireShield** | `POST https://wireshield.grindfree.net/v1/scan` | $0.002 | Outbound leak check on agent output |
+| **DocShield** | `POST https://docshield.grindfree.net/v1/scan` | $0.004 | Hidden instructions in PDF / Office / HTML / Markdown |
+| **SafeRead** | `POST https://saferead.grindfree.net/v1/read` | $0.003 | Fetch a URL as clean Markdown with hidden text + prompt injections removed (`allow \| warn \| block`) |
+
+Network: Base (`eip155:8453`). The remote API is advisory — **your adapter must enforce the decision**. This package does that: `deny` / `block` / high risk throws `GuardDenied` and does not run the action; `review` / `warn` / medium risk throws `GuardReviewRequired` unless you set `onReview: "allow"`. Transport failures **fail closed** (`onError: "deny"` by default).
+
+Also available: the MCP server [`@grindfree/agent-security-mcp`](https://github.com/ronin93/grindfree-agent-security) (`npx -y @grindfree/agent-security-mcp`).
+
+Contact: [rob@grindfree.net](mailto:rob@grindfree.net) · [@grindfreelabs](https://x.com/grindfreelabs)
+
+---
+
+## Install
+
+```bash
+npm i @grindfree/guard
+```
+
+```bash
+pip install 'grindfree-guard[x402]'
+# until PyPI is published: pip install -e 'python/[x402]'
+```
+
+Set the **caller’s** funded Base USDC key (never commit it):
+
+```bash
+export X402_PRIVATE_KEY=0xYOUR_BASE_USDC_PRIVATE_KEY
+# PRIVATE_KEY and EVM_PRIVATE_KEY are also accepted
+```
+
+## Quickstart (TypeScript)
+
+```ts
+import { createGuard, GuardDenied, GuardReviewRequired } from "@grindfree/guard";
+
+const guard = createGuard({
+  policy: { allow_tools: ["http.fetch"], allow_hosts: ["api.example.com"], require_https: true },
+});
+
+const { value } = await guard.guardToolCall(
+  { tool: "http.fetch", destination: { host: "api.example.com", scheme: "https", port: 443 }, arg_classes: ["url"] },
+  () => fetch("https://api.example.com/items").then((r) => r.json()),
+);
+
+// Shell: CommandGuard runs first. A wipe like `rm -rf $HOME` throws GuardDenied and is not executed.
+await guard.guardCommand({ command: "ls -la" }, () => runShell("ls -la"));
+
+// Web pages: SafeRead fetches the URL for you and returns clean Markdown with injected
+// instructions already removed. safeRead never throws on "block"; requireSafeRead does.
+const page = await guard.safeRead("https://example.com/blog/post");
+console.log(page.title, page.decision.verdict, page.text);
+```
+
+Python: `text, decision = guard.safe_read("https://example.com/blog/post")` (or `require_safe_read` to enforce).
+
+`createGuard({ fetch })` (JS) or `create_guard(post=...)` (Python) injects a mock for tests — unit tests in this repo never make a funded call.
+
+### Verdicts
+
+| Service result | Normalized `verdict` | Default handling |
+|---|---|---|
+| ToolGuard `allow`; CommandGuard `allow`; PromptShield `low`; CrawlSafe `crawl_allowed: true` | `allow` | run the action |
+| ToolGuard `review`; CommandGuard `warn`; PromptShield `medium`; Memory/Wire/Doc `review` | `review` | throw `GuardReviewRequired` (or set `onReview: "allow"` / `"deny"` / a callback) |
+| ToolGuard `deny`; CommandGuard `block`; PromptShield `high`; CrawlSafe not allowed; Memory/Wire/Doc `block` | `deny` | throw `GuardDenied`, do not run the action |
+| Timeout / HTTP error | (fail closed) | throw `GuardDenied` unless `onError: "throw"` or `"allow"` |
+
+## Framework examples
+
+Copy-paste starters (wallet still comes from `X402_PRIVATE_KEY`):
+
+- [`examples/basic.ts`](examples/basic.ts) — `guardToolCall` + `guardCommand`
+- [`examples/langchain-js/guard-tools.ts`](examples/langchain-js/guard-tools.ts) — wrap LangChain JS tools
+- [`examples/langchain-py/guard_tools.py`](examples/langchain-py/guard_tools.py) — LangChain Python wrapper + callback
+- [`examples/openai-agents/guardrails.ts`](examples/openai-agents/guardrails.ts) — OpenAI Agents SDK input/output guardrails
+- [`examples/mcp-client/wrap-mcp.ts`](examples/mcp-client/wrap-mcp.ts) — wrap `client.callTool` (CommandGuard for shell/SQL tools, ToolGuard otherwise)
+
+```ts
+import { wrapMcpClient } from "@grindfree/guard";
+const client = wrapMcpClient(mcpClient, { policy: { allow_tools: ["mcp.search"] } });
+// Shell/SQL-named tools go through CommandGuard; everything else through ToolGuard.
+```
+
+Python twin (`guard_tool_call`, `guard_command`, `require_safe_prompt`, …) lives in [`python/`](python/).
+
+## API (JS)
+
+```ts
+const guard = createGuard({
+  privateKey,          // optional; otherwise env
+  fetch,               // optional mock / pre-wrapped paid fetch
+  policy,              // default owner policy
+  onReview: "throw",   // or "allow" | "deny" | async (d) => "allow"
+  onError: "deny",     // or "throw" | "allow"
+  timeoutMs: 15_000,
+});
+
+await guard.guardToolCall(call, fn);
+guard.wrapTool(name, fn, classify?);
+await guard.guardCommand({ command }, fn);
+await guard.guardSql({ sql }, fn);
+await guard.requireSafePrompt({ content, format });
+await guard.requireCrawlAllowed({ url });
+await guard.requireSafeMemory({ content, source });
+await guard.requireSafeOutput({ content, format });
+await guard.requireSafeDocument({ content, format });
+// plus evaluateTool / checkCommand / screenPrompt / … for inspect-only
+```
+
+## Honest limits
+
+- Heuristic / policy layers, not a full security program.
+- CrawlSafe is not malware, phishing, or legal advice.
+- Deterministic rule packs can miss novel phrasing. Decisions are advisory at the API; **this library enforces them in-process** and cannot stop a caller who bypasses it.
+- DocShield parses structure and text; it does not OCR images. Legacy `.doc` / `.xls` / `.ppt` return 415 and are not charged.
+- Missing ToolGuard policy → `review`.
+- Unit tests mock payment. Do not point tests at the live paid endpoints without a separate spend approval.
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/dist/client.d.ts

@@ -0,0 +1,18 @@
+export type PaidFetch = typeof fetch;
+export type ClientOptions = {
+    /** Caller wallet. Falls back to X402_PRIVATE_KEY, PRIVATE_KEY, or EVM_PRIVATE_KEY. */
+    privateKey?: string;
+    /**
+     * Injected fetch. Use this in tests (mocked, never pays) or to supply a
+     * pre-wrapped x402 fetch. When set, no private key is read or required.
+     */
+    fetch?: PaidFetch;
+    timeoutMs?: number;
+};
+export declare function readPrivateKey(explicit?: string): string | undefined;
+export declare function createPaidFetch(opts?: ClientOptions): PaidFetch;
+export declare function postJson(paidFetch: PaidFetch, url: string, body: unknown, opts?: {
+    timeoutMs?: number;
+    service: string;
+}): Promise<Record<string, unknown>>;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAErC,MAAM,MAAM,aAAa,GAAG;IAC1B,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAgB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,aAAkB,GAAG,SAAS,CAenE;AAED,wBAAsB,QAAQ,CAC5B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,OAAO,EACb,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAA2B,GACrE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoClC"}

package/dist/client.js

@@ -0,0 +1,65 @@
+import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
+import { ExactEvmScheme } from "@x402/evm";
+import { privateKeyToAccount } from "viem/accounts";
+import { GuardConfigError, GuardError } from "./errors.js";
+import { NETWORK } from "./services.js";
+const KEY_RE = /^0x[0-9a-fA-F]{64}$/;
+const DEFAULT_TIMEOUT_MS = 15_000;
+export function readPrivateKey(explicit) {
+    return explicit || process.env.X402_PRIVATE_KEY || process.env.PRIVATE_KEY || process.env.EVM_PRIVATE_KEY;
+}
+export function createPaidFetch(opts = {}) {
+    if (opts.fetch)
+        return opts.fetch;
+    const pk = readPrivateKey(opts.privateKey);
+    if (!pk) {
+        throw new GuardConfigError("Missing X402_PRIVATE_KEY (or PRIVATE_KEY / EVM_PRIVATE_KEY). Set the caller's Base USDC wallet key. GrindFree never supplies keys. For tests, pass { fetch } with a mock.");
+    }
+    if (!KEY_RE.test(pk)) {
+        throw new GuardConfigError("X402_PRIVATE_KEY / PRIVATE_KEY / EVM_PRIVATE_KEY must be 0x + 64 hex characters (caller wallet only).");
+    }
+    const account = privateKeyToAccount(pk);
+    return wrapFetchWithPaymentFromConfig(fetch, {
+        schemes: [{ network: NETWORK, client: new ExactEvmScheme(account) }],
+    });
+}
+export async function postJson(paidFetch, url, body, opts = { service: "unknown" }) {
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    try {
+        res = await paidFetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json", accept: "application/json" },
+            body: JSON.stringify(body ?? {}),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        const aborted = err instanceof Error && err.name === "AbortError";
+        throw new GuardError(aborted ? `Request timed out after ${timeoutMs}ms` : err instanceof Error ? err.message : String(err), {
+            service: opts.service,
+        });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    const text = await res.text();
+    let json;
+    try {
+        json = text ? JSON.parse(text) : {};
+    }
+    catch {
+        json = { raw: text.slice(0, 2000) };
+    }
+    if (!res.ok) {
+        throw new GuardError(`${opts.service} HTTP ${res.status}`, {
+            service: opts.service,
+            status: res.status,
+            body: json,
+        });
+    }
+    return json;
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAelC,MAAM,UAAU,cAAc,CAAC,QAAiB;IAC9C,OAAO,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAsB,EAAE;IACtD,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAClC,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,gBAAgB,CACxB,2KAA2K,CAC5K,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CAAC,uGAAuG,CAAC,CAAC;IACtI,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAmB,CAAC,CAAC;IACzD,OAAO,8BAA8B,CAAC,KAAK,EAAE;QAC3C,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,SAAoB,EACpB,GAAW,EACX,IAAa,EACb,OAAgD,EAAE,OAAO,EAAE,SAAS,EAAE;IAEtE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC1H,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO,SAAS,GAAG,CAAC,MAAM,EAAE,EAAE;YACzD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/decisions.d.ts

@@ -0,0 +1,35 @@
+import type { ServiceName } from "./services.js";
+/** Unified verdict used by every GrindFree check. */
+export type Verdict = "allow" | "review" | "deny";
+export type ReviewMode = "throw" | "allow" | "deny";
+export type ErrorMode = "deny" | "throw" | "allow";
+export interface NormalizedDecision {
+    /** allow = proceed; review = pause for a human (CommandGuard "warn", medium risk); deny = do not proceed (block / high risk). */
+    verdict: Verdict;
+    service: ServiceName;
+    endpoint: string;
+    /** Raw service decision when present (allow/review/deny/warn/block). */
+    rawDecision?: string;
+    /** PromptShield risk when present. */
+    risk?: "low" | "medium" | "high";
+    reasons: string[];
+    findings: unknown[];
+    advice?: string;
+    sanitized?: string;
+    safeText?: string;
+    crawlAllowed?: boolean;
+    raw: Record<string, unknown>;
+}
+export type EnforceOptions = {
+    onReview?: ReviewMode | ((d: NormalizedDecision) => ReviewMode | Promise<ReviewMode>);
+    onError?: ErrorMode;
+};
+export declare function normalizeDecision(service: ServiceName, endpoint: string, raw: Record<string, unknown>): NormalizedDecision;
+/**
+ * Apply allow/review/deny policy. Deny and (by default) review throw.
+ * Timeouts and transport errors should be turned into GuardError first,
+ * then passed through enforceError.
+ */
+export declare function enforce(decision: NormalizedDecision, opts?: EnforceOptions): Promise<NormalizedDecision>;
+export declare function enforceError(err: unknown, service: string, opts?: EnforceOptions): never;
+//# sourceMappingURL=decisions.d.ts.map

package/dist/decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../src/decisions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,qDAAqD;AACrD,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AACpD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEnD,MAAM,WAAW,kBAAkB;IACjC,iIAAiI;IACjI,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB,CAAC;AAEF,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,kBAAkB,CA6CpB;AA4CD;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,KAAK,CAyB5F"}

package/dist/decisions.js

@@ -0,0 +1,139 @@
+import { GuardDenied, GuardError, GuardReviewRequired } from "./errors.js";
+export function normalizeDecision(service, endpoint, raw) {
+    const findings = Array.isArray(raw.findings)
+        ? raw.findings
+        : service === "saferead"
+            ? [...(Array.isArray(raw.removed) ? raw.removed : []), ...(Array.isArray(raw.flagged) ? raw.flagged : [])]
+            : [];
+    const reasons = collectReasons(raw, findings);
+    const sanitized = asString(raw.sanitized);
+    const safeText = asString(raw.safe_text) ?? asString(raw.safeText) ?? (service === "saferead" ? asString(raw.content) : undefined);
+    const advice = asString(raw.advice);
+    const rawDecision = typeof raw.decision === "string"
+        ? raw.decision.toLowerCase()
+        : service === "saferead" && typeof raw.verdict === "string"
+            ? raw.verdict.toLowerCase()
+            : undefined;
+    const risk = asRisk(raw.risk);
+    let verdict;
+    if (service === "promptshield" && endpoint === "screen") {
+        verdict = risk === "high" ? "deny" : risk === "medium" ? "review" : "allow";
+    }
+    else if (service === "crawlsafe") {
+        const allowed = raw.crawl_allowed === true || raw.crawlAllowed === true;
+        verdict = allowed ? "allow" : "deny";
+    }
+    else {
+        verdict = mapRawDecision(rawDecision);
+    }
+    const crawlAllowed = service === "crawlsafe" ? raw.crawl_allowed === true || raw.crawlAllowed === true : undefined;
+    return {
+        verdict,
+        service,
+        endpoint,
+        rawDecision,
+        risk,
+        reasons,
+        findings,
+        advice,
+        sanitized,
+        safeText,
+        crawlAllowed,
+        raw,
+    };
+}
+function mapRawDecision(raw) {
+    if (!raw)
+        return "review";
+    if (raw === "allow")
+        return "allow";
+    if (raw === "review" || raw === "warn")
+        return "review";
+    if (raw === "deny" || raw === "block")
+        return "deny";
+    return "review";
+}
+function collectReasons(raw, findings) {
+    const out = [];
+    if (Array.isArray(raw.reasons)) {
+        for (const r of raw.reasons) {
+            if (typeof r === "string")
+                out.push(r);
+            else if (r && typeof r === "object" && "reason" in r && typeof r.reason === "string") {
+                out.push(r.reason);
+            }
+        }
+    }
+    for (const f of findings) {
+        if (f && typeof f === "object") {
+            const rec = f;
+            const rule = typeof rec.rule === "string" ? rec.rule : undefined;
+            const reason = typeof rec.reason === "string" ? rec.reason : undefined;
+            if (rule && reason)
+                out.push(`${rule}: ${reason}`);
+            else if (rule)
+                out.push(rule);
+            else if (reason)
+                out.push(reason);
+        }
+        else if (typeof f === "string") {
+            out.push(f);
+        }
+    }
+    return out;
+}
+function asString(v) {
+    return typeof v === "string" ? v : undefined;
+}
+function asRisk(v) {
+    if (v === "low" || v === "medium" || v === "high")
+        return v;
+    return undefined;
+}
+/**
+ * Apply allow/review/deny policy. Deny and (by default) review throw.
+ * Timeouts and transport errors should be turned into GuardError first,
+ * then passed through enforceError.
+ */
+export async function enforce(decision, opts = {}) {
+    if (decision.verdict === "allow")
+        return decision;
+    if (decision.verdict === "deny")
+        throw new GuardDenied(decision);
+    const mode = await resolveReview(opts.onReview ?? "throw", decision);
+    if (mode === "allow")
+        return decision;
+    if (mode === "deny")
+        throw new GuardDenied(decision, `GrindFree ${decision.service} review treated as deny`);
+    throw new GuardReviewRequired(decision);
+}
+export function enforceError(err, service, opts = {}) {
+    const mode = opts.onError ?? "deny";
+    if (err instanceof GuardDenied || err instanceof GuardReviewRequired)
+        throw err;
+    const wrapped = err instanceof GuardError
+        ? err
+        : new GuardError(err instanceof Error ? err.message : String(err), { service });
+    if (mode === "throw")
+        throw wrapped;
+    if (mode === "allow") {
+        // Caller asked to proceed on transport failure. Still throw so they can
+        // distinguish this path if they catch GuardError; use mode "allow" only
+        // via tryGuard helpers that swallow this.
+        throw wrapped;
+    }
+    throw new GuardDenied({
+        verdict: "deny",
+        service: service,
+        endpoint: "error",
+        reasons: [wrapped.message],
+        findings: [],
+        raw: { error: wrapped.message, status: wrapped.status },
+    }, `GrindFree ${service} failed closed: ${wrapped.message}`);
+}
+async function resolveReview(onReview, decision) {
+    if (typeof onReview === "function")
+        return onReview(decision);
+    return onReview;
+}
+//# sourceMappingURL=decisions.js.map

package/dist/decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.js","sourceRoot":"","sources":["../src/decisions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AA+B3E,MAAM,UAAU,iBAAiB,CAC/B,OAAoB,EACpB,QAAgB,EAChB,GAA4B;IAE5B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ;QACd,CAAC,CAAC,OAAO,KAAK,UAAU;YACtB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1G,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnI,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAC9B,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE;QAC5B,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YACzD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE;YAC3B,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,OAAgB,CAAC;IACrB,IAAI,OAAO,KAAK,cAAc,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9E,CAAC;SAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC;QACxE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,YAAY,GAChB,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAEhG,OAAO;QACL,OAAO;QACP,OAAO;QACP,QAAQ;QACR,WAAW;QACX,IAAI;QACJ,OAAO;QACP,QAAQ;QACR,MAAM;QACN,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACpC,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IACxD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACrD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,QAAmB;IACvE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBAClC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,QAAQ,IAAI,CAAC,IAAI,OAAQ,CAAyB,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9G,GAAG,CAAC,IAAI,CAAE,CAAwB,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,CAA4B,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACjE,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,IAAI,IAAI,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;iBAC9C,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACzB,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,QAA4B,EAC5B,OAAuB,EAAE;IAEzB,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM;QAAE,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;IAEjE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACtC,IAAI,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,aAAa,QAAQ,CAAC,OAAO,yBAAyB,CAAC,CAAC;IAC7G,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,OAAe,EAAE,OAAuB,EAAE;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IACpC,IAAI,GAAG,YAAY,WAAW,IAAI,GAAG,YAAY,mBAAmB;QAAE,MAAM,GAAG,CAAC;IAChF,MAAM,OAAO,GACX,GAAG,YAAY,UAAU;QACvB,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACpF,IAAI,IAAI,KAAK,OAAO;QAAE,MAAM,OAAO,CAAC;IACpC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,wEAAwE;QACxE,wEAAwE;QACxE,0CAA0C;QAC1C,MAAM,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,WAAW,CACnB;QACE,OAAO,EAAE,MAAM;QACf,OAAO,EAAE,OAAsB;QAC/B,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;KACxD,EACD,aAAa,OAAO,mBAAmB,OAAO,CAAC,OAAO,EAAE,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAoF,EACpF,QAA4B;IAE5B,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,31 @@
+import type { NormalizedDecision } from "./decisions.js";
+export declare class GuardConfigError extends Error {
+    readonly code = "GUARD_CONFIG";
+    constructor(message: string);
+}
+export declare class GuardError extends Error {
+    readonly code = "GUARD_ERROR";
+    readonly status?: number;
+    readonly service: string;
+    readonly body?: unknown;
+    constructor(message: string, opts: {
+        service: string;
+        status?: number;
+        body?: unknown;
+    });
+}
+export declare class GuardDenied extends Error {
+    readonly code = "GUARD_DENIED";
+    readonly verdict: "deny";
+    readonly service: string;
+    readonly decision: NormalizedDecision;
+    constructor(decision: NormalizedDecision, message?: string);
+}
+export declare class GuardReviewRequired extends Error {
+    readonly code = "GUARD_REVIEW";
+    readonly verdict: "review";
+    readonly service: string;
+    readonly decision: NormalizedDecision;
+    constructor(decision: NormalizedDecision, message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,kBAAkB;gBACnB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;CAOxF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,OAAO,EAAG,MAAM,CAAU;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;gBAC1B,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,MAAM;CAM3D;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,OAAO,EAAG,QAAQ,CAAU;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;gBAC1B,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,MAAM;CAM3D"}

package/dist/errors.js

@@ -0,0 +1,49 @@
+export class GuardConfigError extends Error {
+    code = "GUARD_CONFIG";
+    constructor(message) {
+        super(message);
+        this.name = "GuardConfigError";
+    }
+}
+export class GuardError extends Error {
+    code = "GUARD_ERROR";
+    status;
+    service;
+    body;
+    constructor(message, opts) {
+        super(message);
+        this.name = "GuardError";
+        this.service = opts.service;
+        this.status = opts.status;
+        this.body = opts.body;
+    }
+}
+export class GuardDenied extends Error {
+    code = "GUARD_DENIED";
+    verdict = "deny";
+    service;
+    decision;
+    constructor(decision, message) {
+        super(message ?? defaultMessage(decision, "denied"));
+        this.name = "GuardDenied";
+        this.service = decision.service;
+        this.decision = decision;
+    }
+}
+export class GuardReviewRequired extends Error {
+    code = "GUARD_REVIEW";
+    verdict = "review";
+    service;
+    decision;
+    constructor(decision, message) {
+        super(message ?? defaultMessage(decision, "needs review"));
+        this.name = "GuardReviewRequired";
+        this.service = decision.service;
+        this.decision = decision;
+    }
+}
+function defaultMessage(d, kind) {
+    const reason = d.reasons[0] ?? d.advice ?? d.rawDecision ?? d.risk ?? kind;
+    return `GrindFree ${d.service} ${kind}: ${reason}`;
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,GAAG,cAAc,CAAC;IAC/B,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,GAAG,aAAa,CAAC;IACrB,MAAM,CAAU;IAChB,OAAO,CAAS;IAChB,IAAI,CAAW;IACxB,YAAY,OAAe,EAAE,IAA0D;QACrF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,cAAc,CAAC;IACtB,OAAO,GAAG,MAAe,CAAC;IAC1B,OAAO,CAAS;IAChB,QAAQ,CAAqB;IACtC,YAAY,QAA4B,EAAE,OAAgB;QACxD,KAAK,CAAC,OAAO,IAAI,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,GAAG,cAAc,CAAC;IACtB,OAAO,GAAG,QAAiB,CAAC;IAC5B,OAAO,CAAS;IAChB,QAAQ,CAAqB;IACtC,YAAY,QAA4B,EAAE,OAAgB;QACxD,KAAK,CAAC,OAAO,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,SAAS,cAAc,CAAC,CAAqB,EAAE,IAAY;IACzD,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC;IAC3E,OAAO,aAAa,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;AACrD,CAAC"}