@loomwork/effect-runtime 0.0.0-stage → 0.1.0

package/dist/effects/LazyEffect.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LazyEffect = void 0;
+function isHandlerRef(spec) {
+    return spec._loomHandlerRef === true;
+}
+class LazyEffect {
+    spec;
+    kind = "tool";
+    resolved;
+    constructor(spec) {
+        this.spec = spec;
+    }
+    async execute(input, ctx) {
+        if (!this.resolved) {
+            if (isHandlerRef(this.spec)) {
+                this.resolved = this.spec.fn;
+            }
+            else {
+                const mod = await this.spec();
+                this.resolved = mod.default;
+            }
+        }
+        return this.resolved(input, ctx);
+    }
+}
+exports.LazyEffect = LazyEffect;
+//# sourceMappingURL=LazyEffect.js.map

package/dist/effects/LazyEffect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LazyEffect.js","sourceRoot":"","sources":["../../src/effects/LazyEffect.ts"],"names":[],"mappings":";;;AAGA,SAAS,YAAY,CAAY,IAA4B;IAC3D,OAAQ,IAA8B,CAAC,eAAe,KAAK,IAAI,CAAC;AAClE,CAAC;AAED,MAAa,UAAU;IAIQ;IAHpB,IAAI,GAAG,MAAe,CAAC;IACxB,QAAQ,CAAmC;IAEnD,YAA6B,IAA4B;QAA5B,SAAI,GAAJ,IAAI,CAAwB;IAAG,CAAC;IAE7D,KAAK,CAAC,OAAO,CAAC,KAAU,EAAE,GAAkB;QAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAA0B,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,MAAO,IAAI,CAAC,IAAiC,EAAE,CAAC;gBAC5D,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;CACF;AAjBD,gCAiBC"}

package/dist/effects/LlmEffect.d.ts

@@ -0,0 +1,27 @@
+import type { TaintedValue } from "@loomwork/classify";
+import type { Effect, EffectContext, EffectDelta, EffectReasoningHook } from "../types";
+export interface LlmEffectOptions {
+    /**
+     * Advisory pre-warm — invoked by the kernel ahead of use to keep the
+     * provider's connection/model cache hot (see {@link Effect.warm}). Wired by
+     * `createLlmEffect` to the provider's `warm()`. Latency-only.
+     */
+    warm?: () => void | Promise<void>;
+    /** ADR 0119 — the configured delta sink the runtime guards (see `Effect.deltaSink`). */
+    deltaSink?: (chunk: EffectDelta, ctx: EffectContext) => void;
+    /** ADR 0133 D6 - the configured reasoning sink the runtime guards (see `Effect.reasoningSink`). */
+    reasoningSink?: (delta: TaintedValue<string>, ctx: EffectContext) => void;
+    /** ADR 0133 D7 - what the composition root may ask about the effect's reasoning posture. */
+    reasoning?: EffectReasoningHook;
+}
+export declare class LlmEffect<TIn = unknown, TOut = unknown> implements Effect<TIn, TOut> {
+    private readonly fn;
+    readonly kind: "llm";
+    readonly warm?: () => void | Promise<void>;
+    readonly deltaSink?: (chunk: EffectDelta, ctx: EffectContext) => void;
+    readonly reasoningSink?: (delta: TaintedValue<string>, ctx: EffectContext) => void;
+    readonly reasoning?: EffectReasoningHook;
+    constructor(fn: (input: TIn, ctx: EffectContext) => Promise<TOut>, options?: LlmEffectOptions);
+    execute(input: TIn, ctx: EffectContext): Promise<TOut>;
+}
+//# sourceMappingURL=LlmEffect.d.ts.map

package/dist/effects/LlmEffect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LlmEffect.d.ts","sourceRoot":"","sources":["../../src/effects/LlmEffect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAExF,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,wFAAwF;IACxF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,KAAK,IAAI,CAAC;IAC7D,mGAAmG;IACnG,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,aAAa,KAAK,IAAI,CAAC;IAC1E,4FAA4F;IAC5F,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,qBAAa,SAAS,CAAC,GAAG,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO,CAAE,YAAW,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;IAQ9E,OAAO,CAAC,QAAQ,CAAC,EAAE;IAPrB,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,KAAK,IAAI,CAAC;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,aAAa,KAAK,IAAI,CAAC;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;gBAGtB,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,EACtE,OAAO,GAAE,gBAAqB;IAQhC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAGvD"}

package/dist/effects/LlmEffect.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LlmEffect = void 0;
+class LlmEffect {
+    fn;
+    kind = "llm";
+    warm;
+    deltaSink;
+    reasoningSink;
+    reasoning;
+    constructor(fn, options = {}) {
+        this.fn = fn;
+        if (options.warm !== undefined)
+            this.warm = options.warm;
+        if (options.deltaSink !== undefined)
+            this.deltaSink = options.deltaSink;
+        if (options.reasoningSink !== undefined)
+            this.reasoningSink = options.reasoningSink;
+        if (options.reasoning !== undefined)
+            this.reasoning = options.reasoning;
+    }
+    execute(input, ctx) {
+        return this.fn(input, ctx);
+    }
+}
+exports.LlmEffect = LlmEffect;
+//# sourceMappingURL=LlmEffect.js.map

package/dist/effects/LlmEffect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LlmEffect.js","sourceRoot":"","sources":["../../src/effects/LlmEffect.ts"],"names":[],"mappings":";;;AAkBA,MAAa,SAAS;IAQD;IAPV,IAAI,GAAG,KAAc,CAAC;IACtB,IAAI,CAA8B;IAClC,SAAS,CAAoD;IAC7D,aAAa,CAA6D;IAC1E,SAAS,CAAuB;IAEzC,YACmB,EAAqD,EACtE,UAA4B,EAAE;QADb,OAAE,GAAF,EAAE,CAAmD;QAGtE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACxE,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QACpF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAC1E,CAAC;IAED,OAAO,CAAC,KAAU,EAAE,GAAkB;QACpC,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;CACF;AApBD,8BAoBC"}

package/dist/effects/ToolEffect.d.ts

@@ -0,0 +1,38 @@
+import type { Effect, EffectContext, EffectMode, ErrorChannelSchema } from "../types";
+export interface ToolEffectOptions {
+    /**
+     * K9.3 — declared delivery semantic for this tool (see {@link Effect.idempotent}).
+     * `false` = mutating & non-idempotent: recovery parks an unknown-state attempt at
+     * EFFECT_INDOUBT instead of silently re-running it. Omit for the legacy
+     * at-least-once re-run.
+     */
+    idempotent?: boolean;
+    /**
+     * DE-4 — declared failure channels for this tool (see {@link Effect.errors}).
+     * Pass the same map declared on the `tool$` contract so the kernel's registry
+     * fallback sees it. Omit for legacy untyped failure semantics.
+     */
+    errors?: Record<string, ErrorChannelSchema>;
+    /**
+     * ADR 0073 — which invocation seam this tool belongs to. Pass the same value
+     * declared on the `tool$` contract; this registered copy is the enforced one.
+     * Omit to keep today's behaviour on both seams.
+     */
+    mode?: EffectMode;
+    /**
+     * R12 — the sub-resource a call targets, for per-resource authorization (see
+     * {@link Effect.resourceOf}). Omit for effect-wide authorization only.
+     */
+    resourceOf?: (input: any) => string | undefined;
+}
+export declare class ToolEffect<TIn = unknown, TOut = unknown> implements Effect<TIn, TOut> {
+    private readonly fn;
+    readonly kind: "tool";
+    readonly idempotent?: boolean;
+    readonly errors?: Record<string, ErrorChannelSchema>;
+    readonly mode?: EffectMode;
+    readonly resourceOf?: (input: TIn) => string | undefined;
+    constructor(fn: (input: TIn, ctx: EffectContext) => Promise<TOut>, options?: ToolEffectOptions);
+    execute(input: TIn, ctx: EffectContext): Promise<TOut>;
+}
+//# sourceMappingURL=ToolEffect.d.ts.map

package/dist/effects/ToolEffect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ToolEffect.d.ts","sourceRoot":"","sources":["../../src/effects/ToolEffect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEtF,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC5C;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;OAGG;IAEH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC;CACjD;AAED,qBAAa,UAAU,CAAC,GAAG,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO,CAAE,YAAW,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;IAQ/E,OAAO,CAAC,QAAQ,CAAC,EAAE;IAPrB,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAU;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC;gBAGtC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,EACtE,OAAO,GAAE,iBAAsB;IAgBjC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAGvD"}

package/dist/effects/ToolEffect.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolEffect = void 0;
+class ToolEffect {
+    fn;
+    kind = "tool";
+    idempotent;
+    errors;
+    mode;
+    resourceOf;
+    constructor(fn, options = {}) {
+        this.fn = fn;
+        if (options.idempotent !== undefined) {
+            this.idempotent = options.idempotent;
+        }
+        if (options.errors !== undefined) {
+            this.errors = options.errors;
+        }
+        if (options.mode !== undefined) {
+            this.mode = options.mode;
+        }
+        if (options.resourceOf !== undefined) {
+            this.resourceOf = options.resourceOf;
+        }
+    }
+    execute(input, ctx) {
+        return this.fn(input, ctx);
+    }
+}
+exports.ToolEffect = ToolEffect;
+//# sourceMappingURL=ToolEffect.js.map

package/dist/effects/ToolEffect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ToolEffect.js","sourceRoot":"","sources":["../../src/effects/ToolEffect.ts"],"names":[],"mappings":";;;AA8BA,MAAa,UAAU;IAQF;IAPV,IAAI,GAAG,MAAe,CAAC;IACvB,UAAU,CAAW;IACrB,MAAM,CAAsC;IAC5C,IAAI,CAAc;IAClB,UAAU,CAAsC;IAEzD,YACmB,EAAqD,EACtE,UAA6B,EAAE;QADd,OAAE,GAAF,EAAE,CAAmD;QAGtE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACvC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAU,EAAE,GAAkB;QACpC,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;CACF;AA5BD,gCA4BC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { EffectRuntime } from "./EffectRuntime";
+export { LazyEffect } from "./effects/LazyEffect";
+export { ToolEffect, type ToolEffectOptions } from "./effects/ToolEffect";
+export { LlmEffect, type LlmEffectOptions } from "./effects/LlmEffect";
+export { HumanEffect } from "./effects/HumanEffect";
+export { EffectModeViolationError } from "./types";
+export type { DeltaSink, Effect, EffectDelta, EffectContext, EffectKind, EffectMiddleware, EffectReasoningDefaults, EffectReasoningHook, EffectMode, EffectNext, ErrorChannelSchema, ResourceSnapshot, TransientIdentity, TransientInvokeOptions, Warmer, } from "./types";
+export { CapabilityDeniedError, capabilityIds, GrantTable, DelegationAuthorizer, signDelegation, verifyDelegation, attenuateDelegation, delegationDigest, principalBlocked, principalIdentityKey, identityKeyOf, } from "./authz";
+export { PolicyAuthorizer } from "./policy";
+export type { PolicyRules, PolicyMatchRule, PolicyAuthorizerOptions } from "./policy";
+export type { CapabilityAuthorizer, CapabilityDecision, CapabilityRequest, DelegatedGrant, DelegationAuthorizerOptions, EffectRuntimeOptions, GrantTableOptions, PrincipalChain, } from "./authz";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AACnD,YAAY,EACV,SAAS,EACT,MAAM,EACN,WAAW,EACX,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,MAAM,GACP,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACtF,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,2BAA2B,EAC3B,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,GACf,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyAuthorizer = exports.identityKeyOf = exports.principalIdentityKey = exports.principalBlocked = exports.delegationDigest = exports.attenuateDelegation = exports.verifyDelegation = exports.signDelegation = exports.DelegationAuthorizer = exports.GrantTable = exports.capabilityIds = exports.CapabilityDeniedError = exports.EffectModeViolationError = exports.HumanEffect = exports.LlmEffect = exports.ToolEffect = exports.LazyEffect = exports.EffectRuntime = void 0;
+var EffectRuntime_1 = require("./EffectRuntime");
+Object.defineProperty(exports, "EffectRuntime", { enumerable: true, get: function () { return EffectRuntime_1.EffectRuntime; } });
+var LazyEffect_1 = require("./effects/LazyEffect");
+Object.defineProperty(exports, "LazyEffect", { enumerable: true, get: function () { return LazyEffect_1.LazyEffect; } });
+var ToolEffect_1 = require("./effects/ToolEffect");
+Object.defineProperty(exports, "ToolEffect", { enumerable: true, get: function () { return ToolEffect_1.ToolEffect; } });
+var LlmEffect_1 = require("./effects/LlmEffect");
+Object.defineProperty(exports, "LlmEffect", { enumerable: true, get: function () { return LlmEffect_1.LlmEffect; } });
+var HumanEffect_1 = require("./effects/HumanEffect");
+Object.defineProperty(exports, "HumanEffect", { enumerable: true, get: function () { return HumanEffect_1.HumanEffect; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "EffectModeViolationError", { enumerable: true, get: function () { return types_1.EffectModeViolationError; } });
+var authz_1 = require("./authz");
+Object.defineProperty(exports, "CapabilityDeniedError", { enumerable: true, get: function () { return authz_1.CapabilityDeniedError; } });
+Object.defineProperty(exports, "capabilityIds", { enumerable: true, get: function () { return authz_1.capabilityIds; } });
+Object.defineProperty(exports, "GrantTable", { enumerable: true, get: function () { return authz_1.GrantTable; } });
+Object.defineProperty(exports, "DelegationAuthorizer", { enumerable: true, get: function () { return authz_1.DelegationAuthorizer; } });
+Object.defineProperty(exports, "signDelegation", { enumerable: true, get: function () { return authz_1.signDelegation; } });
+Object.defineProperty(exports, "verifyDelegation", { enumerable: true, get: function () { return authz_1.verifyDelegation; } });
+Object.defineProperty(exports, "attenuateDelegation", { enumerable: true, get: function () { return authz_1.attenuateDelegation; } });
+Object.defineProperty(exports, "delegationDigest", { enumerable: true, get: function () { return authz_1.delegationDigest; } });
+Object.defineProperty(exports, "principalBlocked", { enumerable: true, get: function () { return authz_1.principalBlocked; } });
+Object.defineProperty(exports, "principalIdentityKey", { enumerable: true, get: function () { return authz_1.principalIdentityKey; } });
+Object.defineProperty(exports, "identityKeyOf", { enumerable: true, get: function () { return authz_1.identityKeyOf; } });
+var policy_1 = require("./policy");
+Object.defineProperty(exports, "PolicyAuthorizer", { enumerable: true, get: function () { return policy_1.PolicyAuthorizer; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,mDAAkD;AAAzC,wGAAA,UAAU,OAAA;AACnB,mDAA0E;AAAjE,wGAAA,UAAU,OAAA;AACnB,iDAAuE;AAA9D,sGAAA,SAAS,OAAA;AAClB,qDAAoD;AAA3C,0GAAA,WAAW,OAAA;AACpB,iCAAmD;AAA1C,iHAAA,wBAAwB,OAAA;AAkBjC,iCAYiB;AAXf,8GAAA,qBAAqB,OAAA;AACrB,sGAAA,aAAa,OAAA;AACb,mGAAA,UAAU,OAAA;AACV,6GAAA,oBAAoB,OAAA;AACpB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,4GAAA,mBAAmB,OAAA;AACnB,yGAAA,gBAAgB,OAAA;AAChB,yGAAA,gBAAgB,OAAA;AAChB,6GAAA,oBAAoB,OAAA;AACpB,sGAAA,aAAa,OAAA;AAEf,mCAA4C;AAAnC,0GAAA,gBAAgB,OAAA"}

package/dist/policy.d.ts

@@ -0,0 +1,76 @@
+import type { PolicyDefinition } from "@loomwork/core";
+import type { CapabilityAuthorizer, CapabilityDecision, CapabilityRequest } from "./authz";
+/**
+ * A single matcher rule (the "rich" form). Every present field must match the
+ * request (an omitted field is a wildcard); `deny` flips a match from allow to deny.
+ * `effect`/`tenant`/`step` are globs (`*` matches any run of characters).
+ */
+export interface PolicyMatchRule {
+    /** Glob on the effect (tool) id, e.g. `"external-*"`. */
+    effect?: string;
+    /** Glob on `principal.tenant`. */
+    tenant?: string;
+    /** Glob on the step id. */
+    step?: string;
+    /** When true, a match DENIES (default: a match ALLOWS). */
+    deny?: boolean;
+}
+/**
+ * The interpreted shape of `PolicyDefinition.rules`. Both forms may be combined:
+ * the simple `allow`/`deny` effect lists AND the richer `match` rules. Semantics
+ * are deny-wins — see {@link PolicyAuthorizer}.
+ */
+export interface PolicyRules {
+    /** Effect ids / globs that are permitted (an allow-list restricts to these). */
+    allow?: readonly string[];
+    /** Effect ids / globs that are forbidden (deny wins over allow). */
+    deny?: readonly string[];
+    /** Richer matchers, evaluated in order; deny matches win. */
+    match?: readonly PolicyMatchRule[];
+}
+export interface PolicyAuthorizerOptions {
+    /**
+     * App-global policies applied to EVERY request, on top of the per-principal set.
+     * (From `defineConfig({ policies })`.)
+     */
+    global?: readonly PolicyDefinition[];
+    /**
+     * The authorizer this one composes UNDER — an effect is allowed only if the base
+     * ALSO allows (defense in depth). If the base denies, that denial is returned
+     * verbatim and the policy rules are never consulted.
+     */
+    base?: CapabilityAuthorizer;
+    /**
+     * Which request field identifies the principal whose policies apply. Default: the
+     * `workflowId` (a flow is the unit of authority, matching `GrantTable`).
+     */
+    principal?: (req: CapabilityRequest) => string;
+}
+/**
+ * Enforces `policy$` definitions as a {@link CapabilityAuthorizer}. Evaluation over
+ * the applicable policies (global ∪ the principal's) is **deny-wins**:
+ *
+ * 1. any `deny` entry or `deny` match that fires → **denied**;
+ * 2. else if an allow-constraint exists (a non-empty `allow` list, or any allow
+ *    `match` rule) and nothing allows the effect → **denied**;
+ * 3. else → **allowed**.
+ *
+ * A principal with no policies (and no global policies) is allowed — policies are
+ * purely additive tightening, so wiring the authorizer never denies an effect that
+ * has no policy governing it (the composed `base`, if any, still applies).
+ */
+export declare class PolicyAuthorizer implements CapabilityAuthorizer {
+    private readonly byPrincipal;
+    private readonly global;
+    private readonly base;
+    private readonly principalOf;
+    constructor(policiesByPrincipal: Record<string, readonly PolicyDefinition[]>, options?: PolicyAuthorizerOptions);
+    authorize(req: CapabilityRequest): CapabilityDecision;
+    private evaluate;
+    /**
+     * Scan one policy group. Returns a denial (deny-wins → final) or `undefined`, mutating `state`
+     * with any allow-list constraint seen. `undefined` policies (no group for the principal) no-op.
+     */
+    private scan;
+}
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE3F;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,oEAAoE;IACpE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACpC;AAuID,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACrC;;;;OAIG;IACH,IAAI,CAAC,EAAE,oBAAoB,CAAC;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,MAAM,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,gBAAiB,YAAW,oBAAoB;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmC;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;gBAG/D,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC,EAChE,OAAO,GAAE,uBAA4B;IAUvC,SAAS,CAAC,GAAG,EAAE,iBAAiB,GAAG,kBAAkB;IASrD,OAAO,CAAC,QAAQ;IAkBhB;;;OAGG;IACH,OAAO,CAAC,IAAI;CA+Bb"}

package/dist/policy.js

@@ -0,0 +1,212 @@
+"use strict";
+// ── Policy enforcement (policy$ → the K2 protection ring) ─────────────────────
+//
+// A `PolicyAuthorizer` turns declarative `policy$` definitions into per-effect
+// authorization decisions, so a `PolicyDefinition` attached to a flow/agent (or
+// declared app-globally) is actually ENFORCED at the one boundary every side
+// effect flows through (`EffectRuntime.execute`). It composes UNDER an existing
+// authorizer (e.g. a `GrantTable`): an effect runs only if BOTH allow — policy
+// can tighten, never widen, a grant (defense in depth). Pure + synchronous like
+// every authorizer, so the decision is deterministic and replay-safe.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyAuthorizer = void 0;
+const authz_1 = require("./authz");
+/** Compile a glob (`*` → `.*`) to an anchored RegExp, escaping every other regex metachar. */
+function globToRegExp(glob) {
+    const escaped = glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+    return new RegExp(`^${escaped}$`);
+}
+function compilePatterns(entries) {
+    const exact = new Set();
+    const globs = [];
+    const qualified = new Map();
+    for (const entry of entries) {
+        if (entry.includes("*"))
+            globs.push(globToRegExp(entry));
+        else
+            exact.add(entry);
+        const colon = entry.indexOf(":");
+        if (colon > 0) {
+            const prefix = entry.slice(0, colon);
+            const list = qualified.get(prefix) ?? [];
+            list.push(entry);
+            qualified.set(prefix, list);
+        }
+    }
+    const q = new Map();
+    for (const [prefix, list] of qualified) {
+        const e = new Set();
+        const g = [];
+        for (const entry of list) {
+            if (entry.includes("*"))
+                g.push(globToRegExp(entry));
+            else
+                e.add(entry);
+        }
+        q.set(prefix, { exact: e, globs: g, qualified: new Map() });
+    }
+    return { exact, globs, qualified: q };
+}
+function patternSetMatches(set, value) {
+    return set.exact.has(value) || set.globs.some((g) => g.test(value));
+}
+/** DENY: stricter is safe — the bare effect id OR the qualified id may trigger it. */
+function denyMatches(set, req) {
+    if (patternSetMatches(set, req.toolId))
+        return true;
+    return req.resource !== undefined && patternSetMatches(set, (0, authz_1.capabilityId)(req));
+}
+/** ALLOW: the bare effect id; the qualified id only through a pattern naming this effect exactly. */
+function allowMatches(set, req) {
+    if (patternSetMatches(set, req.toolId))
+        return true;
+    if (req.resource === undefined)
+        return false;
+    const q = set.qualified.get(req.toolId);
+    return q !== undefined && patternSetMatches(q, (0, authz_1.capabilityId)(req));
+}
+function patternSetEmpty(set) {
+    return set.exact.size === 0 && set.globs.length === 0;
+}
+function asRules(rules) {
+    // `PolicyDefinition.rules` is a freeform bag; read the fields we interpret and
+    // ignore the rest (forward-compatible). Non-array fields degrade to empty.
+    const arr = (v) => (Array.isArray(v) ? v : []);
+    return {
+        allow: arr(rules.allow).filter((x) => typeof x === "string"),
+        deny: arr(rules.deny).filter((x) => typeof x === "string"),
+        match: arr(rules.match).filter((x) => typeof x === "object" && x !== null),
+    };
+}
+function compile(policy) {
+    const rules = asRules(policy.rules);
+    return {
+        allow: compilePatterns(rules.allow ?? []),
+        deny: compilePatterns(rules.deny ?? []),
+        match: (rules.match ?? []).map((m) => ({
+            deny: m.deny === true,
+            ...(m.effect !== undefined && {
+                effect: globToRegExp(m.effect),
+                ...(m.effect.indexOf(":") > 0 && {
+                    effectQualifiedFor: [m.effect.slice(0, m.effect.indexOf(":"))],
+                }),
+            }),
+            ...(m.tenant !== undefined && { tenant: globToRegExp(m.tenant) }),
+            ...(m.step !== undefined && { step: globToRegExp(m.step) }),
+        })),
+    };
+}
+/**
+ * R12 — a DENY rule fires on the bare or qualified id; an ALLOW rule on the qualified id only
+ * when its own pattern names this effect exactly before the first `:`.
+ */
+function effectMatches(rule, req) {
+    if (rule.effect === undefined)
+        return true;
+    if (rule.effect.test(req.toolId))
+        return true;
+    if (req.resource === undefined)
+        return false;
+    if (!rule.deny && !rule.effectQualifiedFor?.includes(req.toolId))
+        return false;
+    return rule.effect.test((0, authz_1.capabilityId)(req));
+}
+/** A compiled match rule fires when every present field matches the request. */
+function matchFires(rule, req) {
+    if (rule.effect && !effectMatches(rule, req))
+        return false;
+    if (rule.tenant && !rule.tenant.test(req.principal?.tenant ?? ""))
+        return false;
+    if (rule.step && !rule.step.test(req.stepId))
+        return false;
+    return true;
+}
+/**
+ * Enforces `policy$` definitions as a {@link CapabilityAuthorizer}. Evaluation over
+ * the applicable policies (global ∪ the principal's) is **deny-wins**:
+ *
+ * 1. any `deny` entry or `deny` match that fires → **denied**;
+ * 2. else if an allow-constraint exists (a non-empty `allow` list, or any allow
+ *    `match` rule) and nothing allows the effect → **denied**;
+ * 3. else → **allowed**.
+ *
+ * A principal with no policies (and no global policies) is allowed — policies are
+ * purely additive tightening, so wiring the authorizer never denies an effect that
+ * has no policy governing it (the composed `base`, if any, still applies).
+ */
+class PolicyAuthorizer {
+    byPrincipal;
+    global;
+    base;
+    principalOf;
+    constructor(policiesByPrincipal, options = {}) {
+        this.byPrincipal = new Map(Object.entries(policiesByPrincipal).map(([k, v]) => [k, v.map(compile)]));
+        this.global = (options.global ?? []).map(compile);
+        this.base = options.base;
+        this.principalOf = options.principal ?? ((req) => req.workflowId);
+    }
+    authorize(req) {
+        // Defense in depth: the base authorizer must allow first; its denial is final.
+        if (this.base !== undefined) {
+            const baseDecision = this.base.authorize(req);
+            if (!baseDecision.allowed)
+                return baseDecision;
+        }
+        return this.evaluate(req);
+    }
+    evaluate(req) {
+        // Scan the global group then the principal's group directly — no merged-array allocation on
+        // this per-effect hot path. `state` accumulates the allow-list constraint across both groups.
+        const state = { constrained: false, allowed: false };
+        const denial = this.scan(this.global, req, state) ??
+            this.scan(this.byPrincipal.get(this.principalOf(req)), req, state);
+        if (denial !== undefined)
+            return denial;
+        if (state.constrained && !state.allowed) {
+            return {
+                allowed: false,
+                reason: `effect "${(0, authz_1.capabilityId)(req)}" not permitted by policy allow-list`,
+            };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Scan one policy group. Returns a denial (deny-wins → final) or `undefined`, mutating `state`
+     * with any allow-list constraint seen. `undefined` policies (no group for the principal) no-op.
+     */
+    scan(policies, req, state) {
+        if (policies === undefined)
+            return undefined;
+        const deny = {
+            allowed: false,
+            reason: `effect "${(0, authz_1.capabilityId)(req)}" denied by policy`,
+        };
+        for (const policy of policies) {
+            // (1) deny-wins — an explicit deny list entry.
+            if (denyMatches(policy.deny, req))
+                return deny;
+            // (2) allow-list — its presence restricts to matching effects.
+            if (!patternSetEmpty(policy.allow)) {
+                state.constrained = true;
+                if (allowMatches(policy.allow, req))
+                    state.allowed = true;
+            }
+            // (3) rich match rules — deny fires immediately; allow contributes.
+            for (const rule of policy.match) {
+                const fires = matchFires(rule, req);
+                if (rule.deny) {
+                    if (fires)
+                        return deny;
+                }
+                else {
+                    state.constrained = true;
+                    if (fires)
+                        state.allowed = true;
+                }
+            }
+        }
+        return undefined;
+    }
+}
+exports.PolicyAuthorizer = PolicyAuthorizer;
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":";AAAA,iFAAiF;AACjF,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;;;AAGtE,mCAAuC;AAiCvC,8FAA8F;AAC9F,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChF,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,CAAC;AAiBD,SAAS,eAAe,CAAC,OAA0B;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;;YACpD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,GAAG,EAAsB,CAAC;IACxC,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5B,MAAM,CAAC,GAAa,EAAE,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;;gBAChD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AACxC,CAAC;AACD,SAAS,iBAAiB,CAAC,GAAe,EAAE,KAAa;IACvD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AACD,sFAAsF;AACtF,SAAS,WAAW,CAAC,GAAe,EAAE,GAAsB;IAC1D,IAAI,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,EAAE,IAAA,oBAAY,EAAC,GAAG,CAAC,CAAC,CAAC;AACjF,CAAC;AACD,qGAAqG;AACrG,SAAS,YAAY,CAAC,GAAe,EAAE,GAAsB;IAC3D,IAAI,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,KAAK,SAAS,IAAI,iBAAiB,CAAC,CAAC,EAAE,IAAA,oBAAY,EAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AACD,SAAS,eAAe,CAAC,GAAe;IACtC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AACxD,CAAC;AAgBD,SAAS,OAAO,CAAC,KAA8B;IAC7C,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,GAAG,GAAG,CAAC,CAAU,EAAa,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACzE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACvE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAwB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CACjE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,MAAwB;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QACvC,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI;YACrB,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI;gBAC5B,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC9B,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;oBAC/B,kBAAkB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;iBAC/D,CAAC;aACH,CAAC;YACF,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAmB,EAAE,GAAsB;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAA,oBAAY,EAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,IAAmB,EAAE,GAAsB;IAC7D,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAqBD;;;;;;;;;;;;GAYG;AACH,MAAa,gBAAgB;IACV,WAAW,CAAgC;IAC3C,MAAM,CAAmB;IACzB,IAAI,CAAmC;IACvC,WAAW,CAAqC;IAEjE,YACE,mBAAgE,EAChE,UAAmC,EAAE;QAErC,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CACxB,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CACzE,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAED,SAAS,CAAC,GAAsB;QAC9B,+EAA+E;QAC/E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,YAAY,CAAC,OAAO;gBAAE,OAAO,YAAY,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAEO,QAAQ,CAAC,GAAsB;QACrC,4FAA4F;QAC5F,8FAA8F;QAC9F,MAAM,KAAK,GAAe,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QAExC,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACxC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,WAAW,IAAA,oBAAY,EAAC,GAAG,CAAC,sCAAsC;aAC3E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACK,IAAI,CACV,QAAsC,EACtC,GAAsB,EACtB,KAAiB;QAEjB,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,MAAM,IAAI,GAAuB;YAC/B,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,WAAW,IAAA,oBAAY,EAAC,GAAG,CAAC,oBAAoB;SACzD,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,+CAA+C;YAC/C,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,+DAA+D;YAC/D,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;gBACzB,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;oBAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YAC5D,CAAC;YACD,oEAAoE;YACpE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACd,IAAI,KAAK;wBAAE,OAAO,IAAI,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;oBACzB,IAAI,KAAK;wBAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAhFD,4CAgFC"}