@intutic/gate 2.9.1 → 3.0.0

package/dist/decideHostGuard.js

@@ -0,0 +1,194 @@
+/**
+ * The self-hosted guard on a decide engine's URL.
+ *
+ * A decide engine sees every tool call a rule asks about, so it must run on
+ * hardware the user controls. The guard judges the literal URL, with no DNS
+ * lookup: loopback and private addresses pass, a name passes only when it is
+ * `localhost`, ends in `.local`, or is listed in
+ * `INTUTIC_SELF_HOSTED_DECISION_HOSTS`, and the hosted decision APIs are
+ * refused even when listed.
+ *
+ * The parser is deliberately narrower than WHATWG's: a URL with anything but
+ * printable ASCII, a backslash, a percent sign, a query or a fragment is
+ * refused rather than normalised, so every HTTP client reaches the host the
+ * guard judged.
+ *
+ * Byte-identical copy in `packages/gate-js/src/`; the Python
+ * (`intutic_clawde/gate/decide_engine.py`) and Rust (`proxy/src/decide/guard.rs`)
+ * guards run the same `fixtures/decide-engine-vectors.json` host cases.
+ *
+ * @module
+ */
+/** Hosted decision APIs, matched on the host or any subdomain of it. */
+export const DECIDE_HOSTED_DENYLIST = [
+    'typesafe.ai',
+    'fastino.ai',
+    'api.openai.com',
+    'openai.azure.com',
+    'services.ai.azure.com',
+    'gateway.ai.cloudflare.com',
+    'ai-gateway.vercel.sh',
+    'api.fireworks.ai',
+    'api.perplexity.ai',
+    'cloud.databricks.com',
+    'azuredatabricks.net',
+];
+/** Decision routes that are refused on any host that is not loopback or private. */
+const DECISION_ROUTES = ['/v1/decisions', '/v1/systemone'];
+export class DecideHostRefusedError extends Error {
+    verdict;
+    code = 'host_refused';
+    constructor(verdict) {
+        super(`decide engine host refused (${verdict.reason}): ${verdict.host || '<none>'}`);
+        this.verdict = verdict;
+        this.name = 'DecideHostRefusedError';
+    }
+}
+function hostMatches(host, name) {
+    return host === name || host.endsWith('.' + name);
+}
+function normaliseName(name) {
+    const lower = name.trim().toLowerCase();
+    return lower.endsWith('.') ? lower.slice(0, -1) : lower;
+}
+function parseIpv4(host) {
+    const parts = host.split('.');
+    if (parts.length !== 4)
+        return null;
+    const out = [];
+    for (const p of parts) {
+        if (!/^(0|[1-9][0-9]{0,2})$/.test(p))
+            return null;
+        const n = Number(p);
+        if (n > 255)
+            return null;
+        out.push(n);
+    }
+    return out;
+}
+/** The eight 16-bit groups of an IPv6 literal, or null. */
+function parseIpv6(text) {
+    if (!/^[0-9a-f:.]+$/.test(text))
+        return null;
+    const halves = text.split('::');
+    if (halves.length > 2)
+        return null;
+    const groups = (part) => {
+        if (part === '')
+            return [];
+        const out = [];
+        const items = part.split(':');
+        for (let i = 0; i < items.length; i++) {
+            const item = items[i];
+            if (i === items.length - 1 && item.includes('.')) {
+                const v4 = parseIpv4(item);
+                if (!v4)
+                    return null;
+                out.push((v4[0] << 8) | v4[1], (v4[2] << 8) | v4[3]);
+            }
+            else if (/^[0-9a-f]{1,4}$/.test(item)) {
+                out.push(parseInt(item, 16));
+            }
+            else {
+                return null;
+            }
+        }
+        return out;
+    };
+    const head = groups(halves[0]);
+    const tail = halves.length === 2 ? groups(halves[1]) : [];
+    if (!head || !tail)
+        return null;
+    if (halves.length === 1)
+        return head.length === 8 ? head : null;
+    const fill = 8 - head.length - tail.length;
+    if (fill < 1)
+        return null;
+    return [...head, ...new Array(fill).fill(0), ...tail];
+}
+/** Parses INTUTIC_SELF_HOSTED_DECISION_HOSTS: exact names, or `.suffix` for a name and its subdomains. */
+function listedNames(listed) {
+    return (listed ?? '')
+        .split(',')
+        .map((e) => normaliseName(e))
+        .map((e) => (e.startsWith('.') ? e.slice(1) : e))
+        .filter((e) => e !== '');
+}
+/**
+ * Judges a decide engine's base URL. `listed` is the value of
+ * `INTUTIC_SELF_HOSTED_DECISION_HOSTS` (a comma list).
+ */
+export function checkSelfHostedDecisionHost(url, listed) {
+    const scheme = /^(https?):\/\//i.exec(url);
+    if (!scheme)
+        return { ok: false, host: '', reason: 'scheme' };
+    const rest = url.slice(scheme[0].length);
+    if (/[^\x21-\x7e]|[\\%?#]/.test(rest))
+        return { ok: false, host: '', reason: 'bad_url' };
+    const slash = rest.indexOf('/');
+    const authority = slash === -1 ? rest : rest.slice(0, slash);
+    const path = slash === -1 ? '' : rest.slice(slash);
+    if (authority.includes('@'))
+        return { ok: false, host: '', reason: 'credentials' };
+    const m = /^(?:\[([0-9A-Fa-f:.]+)\]|([A-Za-z0-9._-]+))(?::([0-9]{1,5}))?$/.exec(authority);
+    if (!m || (m[3] !== undefined && Number(m[3]) > 65535))
+        return { ok: false, host: '', reason: 'bad_url' };
+    const v6 = m[1] !== undefined ? parseIpv6(m[1].toLowerCase()) : null;
+    if (m[1] !== undefined && !v6)
+        return { ok: false, host: '', reason: 'bad_url' };
+    const host = m[1] !== undefined ? m[1].toLowerCase() : normaliseName(m[2]);
+    if (host === '')
+        return { ok: false, host: '', reason: 'bad_url' };
+    if (DECIDE_HOSTED_DENYLIST.some((d) => hostMatches(host, d)))
+        return { ok: false, host, reason: 'denylist' };
+    let local = null;
+    if (v6) {
+        if (v6.slice(0, 7).every((g) => g === 0) && v6[7] === 1)
+            local = 'loopback';
+        else if ((v6[0] & 0xfe00) === 0xfc00)
+            local = 'private';
+    }
+    else {
+        const v4 = parseIpv4(host);
+        if (v4) {
+            if (v4[0] === 127)
+                local = 'loopback';
+            else if (v4[0] === 10 ||
+                (v4[0] === 172 && v4[1] >= 16 && v4[1] <= 31) ||
+                (v4[0] === 192 && v4[1] === 168) ||
+                (v4[0] === 169 && v4[1] === 254))
+                local = 'private';
+        }
+        else if (host === 'localhost')
+            local = 'loopback';
+        else if (host.endsWith('.local'))
+            local = 'private';
+    }
+    if (local)
+        return { ok: true, host, reason: local };
+    const lowerPath = path.toLowerCase();
+    if (DECISION_ROUTES.some((r) => lowerPath.includes(r)))
+        return { ok: false, host, reason: 'decision_path' };
+    if (listedNames(listed).some((name) => hostMatches(host, name)))
+        return { ok: true, host, reason: 'listed' };
+    return { ok: false, host, reason: 'not_listed' };
+}
+/** As {@link checkSelfHostedDecisionHost}, throwing {@link DecideHostRefusedError}; returns the host. */
+export function assertSelfHostedDecisionHost(url, listed) {
+    const verdict = checkSelfHostedDecisionHost(url, listed);
+    if (!verdict.ok)
+        throw new DecideHostRefusedError(verdict);
+    return verdict.host;
+}
+/**
+ * {@link checkSelfHostedDecisionHost} as JavaScript source, with the
+ * constants and helpers it reads, for the hook gates to embed. A CommonJS
+ * build names an exported constant `exports.X` inside a function; the source
+ * defines each as a plain `X`, so that prefix is dropped.
+ */
+export const DECIDE_HOST_GUARD_JS_SOURCE = [
+    `const DECIDE_HOSTED_DENYLIST = ${JSON.stringify(DECIDE_HOSTED_DENYLIST)};`,
+    `const DECISION_ROUTES = ${JSON.stringify(DECISION_ROUTES)};`,
+    ...[hostMatches, normaliseName, parseIpv4, parseIpv6, listedNames, checkSelfHostedDecisionHost].map((fn) => fn.toString().replace(/\bexports\./g, '')),
+].join('\n');
+//# sourceMappingURL=decideHostGuard.js.map

package/dist/decideHostGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decideHostGuard.js","sourceRoot":"","sources":["../src/decideHostGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,kBAAkB;IAClB,uBAAuB;IACvB,2BAA2B;IAC3B,sBAAsB;IACtB,kBAAkB;IAClB,mBAAmB;IACnB,sBAAsB;IACtB,qBAAqB;CACb,CAAA;AAEV,oFAAoF;AACpF,MAAM,eAAe,GAAG,CAAC,eAAe,EAAE,eAAe,CAAC,CAAA;AAU1D,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE1B;IADZ,IAAI,GAAG,cAAuB,CAAA;IACvC,YAAqB,OAAkD;QACrE,KAAK,CAAC,+BAA+B,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAA;QADjE,YAAO,GAAP,OAAO,CAA2C;QAErE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACvC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QACjD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QACxB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACb,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,2DAA2D;AAC3D,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAmB,EAAE;QAC/C,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1B,MAAM,GAAG,GAAa,EAAE,CAAA;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACrB,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;gBAC1B,IAAI,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAA;gBACpB,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;YACtD,CAAC;iBAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;YAC9B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACzD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1C,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACzB,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;AAC/D,CAAC;AAED,0GAA0G;AAC1G,SAAS,WAAW,CAAC,MAA0B;IAC7C,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW,EAAE,MAAe;IACtE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACxF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,SAAS,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAElF,MAAM,CAAC,GAAG,gEAAgE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC1F,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACzG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAChF,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1E,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAElE,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAE5G,IAAI,KAAK,GAAkC,IAAI,CAAA;IAC/C,IAAI,EAAE,EAAE,CAAC;QACP,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,UAAU,CAAA;aACtE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM;YAAE,KAAK,GAAG,SAAS,CAAA;IACzD,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,KAAK,GAAG,UAAU,CAAA;iBAChC,IACH,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE;gBACZ,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;gBAChC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;gBAEhC,KAAK,GAAG,SAAS,CAAA;QACrB,CAAC;aAAM,IAAI,IAAI,KAAK,WAAW;YAAE,KAAK,GAAG,UAAU,CAAA;aAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,KAAK,GAAG,SAAS,CAAA;IACrD,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAEnD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IACpC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC3G,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC5G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;AAClD,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,MAAe;IACvE,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACxD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAC1D,OAAO,OAAO,CAAC,IAAI,CAAA;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,kCAAkC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,GAAG;IAC3E,2BAA2B,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG;IAC7D,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CACzG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAC1C;CACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA"}

package/dist/decideLog.d.ts

@@ -0,0 +1,287 @@
+/**
+ * The decide log, and the drift alarm it feeds.
+ *
+ * Every process that evaluates a call's decide rules appends one line to
+ * `~/.intutic/logs/decide-YYYY-MM-DD.jsonl` (the UTC date), mode 0600, with
+ * a single append write: what was asked, of which model, and what came back.
+ * Stored by default: the hash of each state sent, the rule hashes, the model
+ * digest, every answer's probability and band, the outcome and the mode, and
+ * the call's arguments only after redaction, cut to
+ * {@link DECIDE_ARGS_EXCERPT_MAX_BYTES}. A line is at most
+ * {@link DECIDE_LOG_LINE_MAX_BYTES}; the excerpt is shortened first. The log
+ * is its own file, never a trace file, so nothing that uploads and deletes
+ * traces touches it.
+ *
+ * Drift (engine protection 8): each rule keeps its last
+ * {@link DECIDE_STATS_KEEP} decisions in `~/.intutic/decide/stats/<ruleHash>.json`.
+ * Against the eval run the rule's pin came from, `decide.drift` fires when
+ * the escalation rate moves more than {@link DECIDE_DRIFT_ESCALATION_DELTA}
+ * from the run's, or a question's median probability leaves the run's
+ * [p10, p90], at most once per {@link DECIDE_DRIFT_INTERVAL_MS} per rule and
+ * only once {@link DECIDE_DRIFT_MIN_DECISIONS} decisions are kept.
+ *
+ * Every gate that evaluates decide rules writes it, with the same record and
+ * redaction and under the same home directory ({@link decideLogDeps}):
+ * `intutic decide check` for the shell and n8n gates, the JavaScript hook
+ * gates (which embed {@link DECIDE_LOG_JS_SOURCE}), and both gate SDKs. A
+ * write that fails never changes the decision.
+ *
+ * Self-contained but for the decide modules beside it, so `@intutic/gate`
+ * carries a byte-identical copy. Files are reached through the `fs` its
+ * caller passes. The Python port is `intutic_clawde/gate/decide_log.py`; both
+ * run `fixtures/decide-log-vectors.json`.
+ *
+ * @module
+ */
+import { type DecideRule } from './decide.js';
+import { type DecideAnswer } from './decideEngine.js';
+import type { DecideEvaluation, DecideRuleEntry, DecideRuleReport } from './decideEvaluate.js';
+/** The longest line the log holds, in UTF-8 bytes. */
+export declare const DECIDE_LOG_LINE_MAX_BYTES = 8192;
+/** The longest arguments excerpt, in UTF-8 bytes, cut on a character boundary. */
+export declare const DECIDE_ARGS_EXCERPT_MAX_BYTES = 2048;
+/** Days a decide log file is kept before housekeeping deletes it. */
+export declare const DECIDE_LOG_RETENTION_DAYS = 30;
+/** Decisions kept per rule for the drift alarm. */
+export declare const DECIDE_STATS_KEEP = 200;
+/** Fewer kept decisions than this never raise drift: one escalation in three is noise, not drift. */
+export declare const DECIDE_DRIFT_MIN_DECISIONS = 20;
+/** An escalation rate this far (absolute) from the eval run's is drift. */
+export declare const DECIDE_DRIFT_ESCALATION_DELTA = 0.15;
+/** At most one `decide.drift` per rule in this window. */
+export declare const DECIDE_DRIFT_INTERVAL_MS = 86400000;
+/** What a redacted match is replaced with. */
+export declare const DECIDE_REDACTED = "[REDACTED]";
+export type DecideLogEvent = 'decide.decision' | 'decide.unavailable' | 'decide.canary_failed' | 'decide.drift' | 'decide.not_evaluated';
+/** `decide-YYYY-MM-DD.jsonl` for the UTC date of `atMs`; `decide-state-…` for raw states. */
+export declare function decideLogFileName(atMs: number, kind?: 'decide' | 'decide-state'): string;
+/** The UTC date a decide log file name carries, as epoch milliseconds at midnight, or null when the name is not one. */
+export declare function decideLogFileDate(name: string): number | null;
+/** The longest prefix of whole characters within `max` UTF-8 bytes. */
+export declare function decideUtf8Prefix(s: string, max: number): string;
+/**
+ * `text` with every match of each source replaced by {@link DECIDE_REDACTED},
+ * the sources applied in order. A source that does not compile is skipped.
+ */
+export declare function decideRedact(text: string, sources: readonly string[]): string;
+/** The call's arguments as canonical JSON, redacted, then cut to `maxBytes`. */
+export declare function decideArgsExcerpt(toolInput: unknown, sources: readonly string[], maxBytes?: number): string;
+export interface DecideLogEngine {
+    adapter: string;
+    /** `host:port` of the engine URL; never the key. */
+    host: string;
+    model: string | null;
+    digest: string | null;
+    digestStrength: 'strong' | 'weak' | null;
+    canary: 'ok' | 'cached' | 'failed' | null;
+}
+export interface DecideLogContext {
+    /** Epoch milliseconds. */
+    atMs: number;
+    harness: string;
+    workspaceId: string;
+    sessionId: string;
+    tool: string;
+    toolInput: unknown;
+    cwd: string;
+    lastUserTurn?: string | null;
+    budgetMs: number;
+    latencyMs: number;
+    engine: DecideLogEngine;
+    /** Regex sources the arguments excerpt is redacted with. */
+    redact: readonly string[];
+    /**
+     * The call's reversibility class (`laneOf` of the tokens it
+     * classifies to, lanes.ts), or null when it has none or the caller cannot
+     * say. Logged so calibrations can be stratified by consequence.
+     */
+    lane?: 'irreversible' | 'reversible_wide' | 'reversible_contained' | null;
+    /** The subject's role-level revert or rejection rate, or null when none is published. */
+    revertRate?: number | null;
+}
+/** One question's answer as the log keeps it. */
+export type DecideLogAnswer = {
+    type: 'yes_no';
+    p: number | null;
+    pRaw: number | null;
+    value: 'T' | 'F' | 'U';
+    band: [number, number];
+} | {
+    type: 'choice';
+    p: Record<string, number>;
+    spread: Record<string, number>;
+    atoms: Record<string, 'T' | 'F' | 'U'>;
+    band: [number, number];
+};
+export interface DecideLogRule {
+    ref: string;
+    ruleHash: string;
+    /** The record's stamp. */
+    rollout: 'shadow' | 'enforce';
+    effective: 'enforce' | 'shadow';
+    why: string | null;
+    /** sha256 of the exact state bytes sent for this rule, `sha256:<hex>`. */
+    stateHash: string | null;
+    modelDigest: string | null;
+    answers: Record<string, DecideLogAnswer> | null;
+    when: 'T' | 'F' | 'U' | null;
+    outcome: DecideRuleReport['outcome'];
+    escalate: 'ask' | 'review' | 'refuse';
+    error: string | null;
+}
+export interface DecideDecisionRecord {
+    v: 1;
+    event: 'decide.decision';
+    at: string;
+    harness: string;
+    workspaceId: string;
+    sessionId: string;
+    tool: string;
+    /** The call's reversibility class, or null. Readers ignore fields they do not know. */
+    lane: 'irreversible' | 'reversible_wide' | 'reversible_contained' | null;
+    /** The subject's revert or rejection rate, or null. */
+    revertRate: number | null;
+    stateHash: string | null;
+    argsExcerpt: string;
+    engine: DecideLogEngine;
+    budgetMs: number;
+    latencyMs: number;
+    outcome: 'allow' | 'refuse' | 'escalate';
+    code: string | null;
+    rules: DecideLogRule[];
+    skipped: string[];
+    truncated?: true;
+}
+/**
+ * The `decide.decision` record of one evaluated call. `rules` are the
+ * entries the call was evaluated over; each report's state is rebuilt from
+ * its entry and the call (it is deterministic) and hashed with `sha256Hex`.
+ */
+export declare function buildDecideDecisionRecord(evaluation: DecideEvaluation, rules: readonly DecideRuleEntry[], ctx: DecideLogContext, sha256Hex: (text: string) => string): DecideDecisionRecord;
+/** An event other than a decision, in the same envelope. */
+export declare function buildDecideEventRecord(event: Exclude<DecideLogEvent, 'decide.decision'>, ctx: Pick<DecideLogContext, 'atMs' | 'harness' | 'workspaceId' | 'sessionId'>, body: Record<string, unknown>): Record<string, unknown>;
+/**
+ * The record as one JSON line (with its newline) of at most `max` bytes.
+ * Over it, the arguments excerpt is shortened first, by halves down to
+ * nothing; then each choice answer keeps only its atoms; then the answers
+ * go. Whatever was cut, `truncated` says so.
+ */
+export declare function decideLogLine(record: Record<string, unknown>, max?: number): string;
+/** The parts of `node:fs` the log and the stats use. */
+export interface DecideLogFs {
+    mkdirSync(path: string, options: {
+        recursive: true;
+        mode: number;
+    }): unknown;
+    openSync(path: string, flags: string, mode: number): number;
+    writeSync(fd: number, data: string): number;
+    closeSync(fd: number): void;
+    readFileSync(path: string, encoding: 'utf8'): string;
+    writeFileSync(path: string, data: string, options: {
+        mode: number;
+    }): void;
+    renameSync(from: string, to: string): void;
+}
+/** Appends one line to `dir/file` with a single write to a file opened for append, mode 0600 in a 0700 directory. */
+export declare function appendDecideLogLine(fs: DecideLogFs, dir: string, file: string, line: string): void;
+/** One kept decision: the rule's own outcome and each question's probability. */
+export interface DecideStatsDecision {
+    atMs: number;
+    outcome: 'allow' | 'refuse' | 'escalate';
+    /** p(yes) for a yes/no question; the top option's averaged probability for a choice. */
+    p: Record<string, number>;
+}
+export interface DecideStats {
+    v: 1;
+    ruleHash: string;
+    decisions: DecideStatsDecision[];
+    /** When `decide.drift` last fired for this rule. */
+    lastDriftAtMs: number | null;
+}
+/** What an eval run measured, as drift compares against it. */
+export interface DecideEvalRunBaseline {
+    evalRunId: string;
+    escalationRate: number;
+    /** Per question: the 10th and 90th percentile of its probability over the run's cases. */
+    questions: Record<string, {
+        p10: number;
+        p90: number;
+    }>;
+}
+export interface DecideDrift {
+    measure: 'escalation_rate' | 'median_p';
+    question: string | null;
+    value: number;
+    /** The run's escalation rate, or its [p10, p90]. */
+    expected: number | [number, number];
+    threshold: number | null;
+    n: number;
+}
+/** The probability a question's answer is tracked by, or null when it has none. */
+export declare function decideTrackedP(rule: DecideRule, name: string, a: DecideAnswer): number | null;
+/** `stats` with `d` appended and only the last {@link DECIDE_STATS_KEEP} kept. */
+export declare function recordDecideStats(stats: DecideStats | null, ruleHash: string, d: DecideStatsDecision): DecideStats;
+/**
+ * Whether the kept decisions have drifted from the eval run. Null below
+ * {@link DECIDE_DRIFT_MIN_DECISIONS}, inside {@link DECIDE_DRIFT_INTERVAL_MS}
+ * of the last drift, or when nothing moved. The escalation rate is checked
+ * first, then each question in name order.
+ */
+export declare function checkDecideDrift(stats: DecideStats, run: DecideEvalRunBaseline, nowMs: number): DecideDrift | null;
+/** A rule's stats file, `dir/<ruleHash>.json`, replaced whole by a rename. A file that does not read is no stats. */
+export declare function readDecideStats(fs: DecideLogFs, dir: string, ruleHash: string): DecideStats | null;
+export declare function writeDecideStats(fs: DecideLogFs, dir: string, stats: DecideStats): void;
+export interface DecideLogWriteDeps {
+    fs: DecideLogFs;
+    /** `~/.intutic/logs`. */
+    logsDir: string;
+    /** `~/.intutic/decide/stats`. */
+    statsDir: string;
+    sha256Hex: (text: string) => string;
+    /** The baseline of an eval run a rule's pin names, or null when there is none on this machine. */
+    evalRun: (ruleHash: string, evalRunId: string) => DecideEvalRunBaseline | null;
+}
+/**
+ * Writes one evaluated call: its `decide.decision` line, a `decide.canary_failed`,
+ * `decide.unavailable` or `decide.not_evaluated` line when one applies, then
+ * each answered rule's stats, and a `decide.drift` line for each rule that
+ * drifted from the eval run of the pin it ran under. Returns the drifts.
+ * Throws on a write error; a caller on the decision path catches it, because
+ * a log that cannot be written must not change the decision.
+ */
+export declare function writeDecideCallLog(evaluation: DecideEvaluation, rules: readonly DecideRuleEntry[], ctx: DecideLogContext, deps: DecideLogWriteDeps): DecideDrift[];
+/** `host:port` of an engine URL, as the log records it; never its path, query or credentials. */
+export declare function decideEngineHost(url: string): string;
+/**
+ * The engine as a call's record names it: the configured adapter, host and
+ * model (`cfg` is null when the engine is not configured), and the model,
+ * digest and canary the evaluation reported.
+ */
+export declare function decideLogEngine(cfg: {
+    adapter: string;
+    url: string;
+    model: string;
+} | null, evaluation: Pick<DecideEvaluation, 'engine' | 'canary'>): DecideLogEngine;
+/**
+ * The drift baseline of the eval run `intutic decide eval` stored at
+ * `decideDir/evals/<ruleHash>/runs/<evalRunId>.json`, or null when there is
+ * none, it does not read, or either name is not a plain file name.
+ */
+export declare function readDecideEvalRunBaseline(fs: Pick<DecideLogFs, 'readFileSync'>, decideDir: string, ruleHash: string, evalRunId: string): DecideEvalRunBaseline | null;
+/**
+ * Where a gate writes the decide log and its drift stats under the home
+ * directory `home`, as `intutic decide check` does: `~/.intutic/logs`,
+ * `~/.intutic/decide/stats`, and the eval runs `decide eval` stored under
+ * `~/.intutic/decide/evals`.
+ */
+export declare function decideLogDeps(fs: DecideLogFs, home: string, sha256Hex: (text: string) => string): DecideLogWriteDeps;
+/**
+ * This module as JavaScript source, for the hook gates to embed: every
+ * constant and every function above. The embedding scope supplies what it
+ * imports from `decide.ts` (`bandValue`, `choiceAtoms`, `decideOptions`,
+ * `decideQuestionBand`, `parseWhen`, `validateDecideRule`) and
+ * `decideEngine.ts` (`buildDecideToolCallState`, `decideCanonicalJson`). A
+ * test holds the list to the functions this file declares.
+ */
+export declare const DECIDE_LOG_JS_SOURCE: string;
+//# sourceMappingURL=decideLog.d.ts.map

package/dist/decideLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decideLog.d.ts","sourceRoot":"","sources":["../src/decideLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAA6G,KAAK,UAAU,EAAE,MAAM,aAAa,CAAA;AACxJ,OAAO,EAAqE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACxH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAE9F,sDAAsD;AACtD,eAAO,MAAM,yBAAyB,OAAO,CAAA;AAC7C,kFAAkF;AAClF,eAAO,MAAM,6BAA6B,OAAO,CAAA;AACjD,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,KAAK,CAAA;AAC3C,mDAAmD;AACnD,eAAO,MAAM,iBAAiB,MAAM,CAAA;AACpC,qGAAqG;AACrG,eAAO,MAAM,0BAA0B,KAAK,CAAA;AAC5C,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,OAAO,CAAA;AACjD,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB,WAAa,CAAA;AAClD,8CAA8C;AAC9C,eAAO,MAAM,eAAe,eAAe,CAAA;AAE3C,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,sBAAsB,GAAG,cAAc,GAAG,sBAAsB,CAAA;AAMxI,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,QAAQ,GAAG,cAAyB,GAAG,MAAM,CAElG;AAED,wHAAwH;AACxH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7D;AAMD,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAW/D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAY7E;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,GAAE,MAAsC,GAAG,MAAM,CAE1I;AAMD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;IACxC,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAA;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,OAAO,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,eAAe,CAAA;IACvB,4DAA4D;IAC5D,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,GAAG,iBAAiB,GAAG,sBAAsB,GAAG,IAAI,CAAA;IACzE,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,iDAAiD;AACjD,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACzG;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAA;IACtC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACvB,CAAA;AAEL,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,0BAA0B;IAC1B,OAAO,EAAE,QAAQ,GAAG,SAAS,CAAA;IAC7B,SAAS,EAAE,SAAS,GAAG,QAAQ,CAAA;IAC/B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,IAAI,CAAA;IAC/C,IAAI,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,CAAA;IAC5B,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACpC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACrC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAA;IACJ,KAAK,EAAE,iBAAiB,CAAA;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,uFAAuF;IACvF,IAAI,EAAE,cAAc,GAAG,iBAAiB,GAAG,sBAAsB,GAAG,IAAI,CAAA;IACxE,uDAAuD;IACvD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAA;IACxC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAyCD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,gBAAgB,EAC5B,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAClC,oBAAoB,CAmEtB;AAED,4DAA4D;AAC5D,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,CAAC,cAAc,EAAE,iBAAiB,CAAC,EACjD,GAAG,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,CAAC,EAC7E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAE,MAAkC,GAAG,MAAM,CAiC9G;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAA;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3D,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAA;IACpD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC1E,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3C;AAED,qHAAqH;AACrH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAQlG;AAMD,iFAAiF;AACjF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAA;IACxC,wFAAwF;IACxF,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAA;IACJ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,mBAAmB,EAAE,CAAA;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACxD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,iBAAiB,GAAG,UAAU,CAAA;IACvC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,oDAAoD;IACpD,QAAQ,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,CAAC,EAAE,MAAM,CAAA;CACV;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAO7F;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAGlH;AASD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAgBlH;AAeD,qHAAqH;AACrH,wBAAgB,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAMlG;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAKvF;AAMD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,WAAW,CAAA;IACf,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACnC,kGAAkG;IAClG,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,qBAAqB,GAAG,IAAI,CAAA;CAC/E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,gBAAgB,EAC5B,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,kBAAkB,GACvB,WAAW,EAAE,CA2Cf;AAMD,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC3D,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,QAAQ,CAAC,GACtD,eAAe,CASjB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,qBAAqB,GAAG,IAAI,CAU9B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,kBAAkB,CASpH;AAMD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAkC/B,CAAA"}