@maiaos/node 0.1.0-canary.44938d4.manual.1

package/dist/runtime/process/resource/integration-authorization/permit-store.js

@@ -0,0 +1,486 @@
+import { randomUUID } from "node:crypto";
+import { makeNodeRuntimeError } from "../../../errors.js";
+import { activeAuthorization, countUnsettledPermits, readAuthorizationRevision, readPermit, } from "./database.js";
+import { compactTerminalPermits } from "./permit-compaction-store.js";
+import { MAX_UNSETTLED_PER_AUTHORIZATION, parseAuthorizationRevision, parseNodeClockRecordedAtMs, parseOwnerKindsJson, PERMIT_EXPIRY_MS, plusMilliseconds, requireBoundedIdentifier, requireBoundedRevision, requireMonotonicTimestamp, } from "./policy.js";
+import { projectPermit } from "./projection.js";
+import { withReplay } from "./replay-store.js";
+import { CODEX_INTEGRATION, CODEX_OWNER_KINDS, } from "./types.js";
+const UPDATE_PERMIT_TERMINAL_SQL = `UPDATE integration_authorization_permits
+  SET state = 'terminal',
+      terminal_reason = ?,
+      terminal_at = ?,
+      terminal_at_ms = ?
+  WHERE permit_id = ?`;
+const INSERT_ISSUED_PERMIT_SQL = `INSERT INTO integration_authorization_permits(
+    permit_id, integration, authorization_revision, owner_kind,
+    scope_command_id, scope_session_id, executable_sha256,
+    adapter_version, sandbox_policy_revision, vouch_policy_revision,
+    fence_id, state, issued_at, issued_at_ms, expires_at, expires_at_ms
+  ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'issued', ?, ?, ?, ?)`;
+const UPDATE_DISPATCHING_SQL = `UPDATE integration_authorization_permits
+  SET state = 'dispatching',
+      dispatching_at = ?,
+      dispatching_at_ms = ?
+  WHERE permit_id = ?`;
+const UPDATE_STARTED_SQL = `UPDATE integration_authorization_permits
+  SET state = 'started',
+      started_at = ?,
+      started_at_ms = ?,
+      process_tree_id = ?
+  WHERE permit_id = ?`;
+const UPDATE_AUTHORIZATION_CLEANUP_UNKNOWN_SQL = `UPDATE integration_authorization_revisions
+  SET state = 'cleanup_unknown',
+      revocation_started_at = COALESCE(revocation_started_at, ?),
+      cleanup_unknown_at = ?,
+      updated_at = ?
+  WHERE authorization_revision = ?
+    AND state IN ('active', 'revoking')`;
+const LIST_REVOKING_WORK_SQL = `SELECT
+  adapter_version AS adapterVersion,
+  authorization_revision AS authorizationRevision,
+  dispatching_at AS dispatchingAt,
+  dispatching_at_ms AS dispatchingAtMs,
+  executable_sha256 AS executableSha256,
+  expires_at AS expiresAt,
+  expires_at_ms AS expiresAtMs,
+  fence_id AS fenceId,
+  integration AS integration,
+  issued_at AS issuedAt,
+  issued_at_ms AS issuedAtMs,
+  owner_kind AS ownerKind,
+  permit_id AS permitId,
+  process_tree_id AS processTreeId,
+  sandbox_policy_revision AS sandboxPolicyRevision,
+  scope_command_id AS scopeCommandId,
+  scope_session_id AS scopeSessionId,
+  started_at AS startedAt,
+  started_at_ms AS startedAtMs,
+  state AS state,
+  terminal_at AS terminalAt,
+  terminal_at_ms AS terminalAtMs,
+  terminal_reason AS terminalReason,
+  vouch_policy_revision AS vouchPolicyRevision
+ FROM integration_authorization_permits
+ WHERE authorization_revision = ?
+   AND state IN ('dispatching', 'started')
+ ORDER BY sequence ASC`;
+const LIST_UNSETTLED_PERMITS_SQL = `SELECT
+  adapter_version AS adapterVersion,
+  authorization_revision AS authorizationRevision,
+  dispatching_at AS dispatchingAt,
+  dispatching_at_ms AS dispatchingAtMs,
+  executable_sha256 AS executableSha256,
+  expires_at AS expiresAt,
+  expires_at_ms AS expiresAtMs,
+  fence_id AS fenceId,
+  integration AS integration,
+  issued_at AS issuedAt,
+  issued_at_ms AS issuedAtMs,
+  owner_kind AS ownerKind,
+  permit_id AS permitId,
+  process_tree_id AS processTreeId,
+  sandbox_policy_revision AS sandboxPolicyRevision,
+  scope_command_id AS scopeCommandId,
+  scope_session_id AS scopeSessionId,
+  started_at AS startedAt,
+  started_at_ms AS startedAtMs,
+  state AS state,
+  terminal_at AS terminalAt,
+  terminal_at_ms AS terminalAtMs,
+  terminal_reason AS terminalReason,
+  vouch_policy_revision AS vouchPolicyRevision
+ FROM integration_authorization_permits
+ WHERE authorization_revision = ?
+   AND state IN ('issued', 'dispatching', 'started')
+ ORDER BY sequence ASC
+ LIMIT ?`;
+const nullValue = JSON.parse("null");
+const requirePolicyInput = (policy) => ({
+    adapterVersion: requireBoundedRevision(policy.adapterVersion, "The Codex adapter version"),
+    sandboxPolicyRevision: requireBoundedRevision(policy.sandboxPolicyRevision, "The Codex sandbox policy revision"),
+    vouchPolicyRevision: requireBoundedRevision(policy.vouchPolicyRevision, "The Codex vouch policy revision"),
+});
+const requirePermitForTransition = (database, permitId) => {
+    const validatedPermitId = requireBoundedIdentifier(permitId, "The integration permit identifier");
+    const permit = readPermit(database, validatedPermitId);
+    if (permit !== undefined) {
+        return permit;
+    }
+    throw makeNodeRuntimeError("resource_not_found", "The integration permit was not found.");
+};
+const readPermitOrCorrupt = (database, permitId) => {
+    const updated = readPermit(database, permitId);
+    if (updated !== undefined) {
+        return updated;
+    }
+    throw makeNodeRuntimeError("storage_corrupt", "The integration authorization permit disappeared during update.");
+};
+const terminalizePermit = (database, input) => {
+    database
+        .prepare(UPDATE_PERMIT_TERMINAL_SQL)
+        .run(input.reason, input.recordedAt, input.recordedAtMs, input.permit.permitId);
+    return readPermitOrCorrupt(database, input.permit.permitId);
+};
+const latestPermitLifecycleTimestampMs = (permit) => {
+    if (permit.state === "started" && permit.startedAtMs !== null) {
+        return permit.startedAtMs;
+    }
+    if (permit.state === "dispatching" && permit.dispatchingAtMs !== null) {
+        return permit.dispatchingAtMs;
+    }
+    return permit.issuedAtMs;
+};
+const readActiveAuthorizationForIssue = (database) => {
+    const active = activeAuthorization(database);
+    if (active !== undefined) {
+        return active;
+    }
+    throw makeNodeRuntimeError("resource_not_found", "No active Codex integration authorization exists.");
+};
+const assertOwnerKindIsKnown = (ownerKind) => {
+    if (CODEX_OWNER_KINDS.includes(ownerKind)) {
+        return;
+    }
+    throw makeNodeRuntimeError("storage_failed", "The requested permit owner kind is invalid.");
+};
+const assertIssuePolicyMatchesAuthorization = (policy, active) => {
+    if (policy.adapterVersion === active.adapterVersion &&
+        policy.sandboxPolicyRevision === active.sandboxPolicyRevision &&
+        policy.vouchPolicyRevision === active.vouchPolicyRevision) {
+        return;
+    }
+    throw makeNodeRuntimeError("storage_conflict", "The integration authorization policy revision is stale.", true);
+};
+const assertOwnerKindAllowlisted = (ownerKind, active) => {
+    const ownerKinds = parseOwnerKindsJson(active.ownerKindsJson);
+    if (ownerKinds.includes(ownerKind)) {
+        return;
+    }
+    throw makeNodeRuntimeError("storage_conflict", "The requested permit owner kind is not allowlisted by the active authorization.", true);
+};
+const assertPermitCapacity = (database, active) => {
+    const unsettled = countUnsettledPermits(database, active.authorizationRevision);
+    if (unsettled < MAX_UNSETTLED_PER_AUTHORIZATION) {
+        return;
+    }
+    throw makeNodeRuntimeError("saturated", "The integration authorization reached its maximum unsettled permits.", true);
+};
+const parseIssueInput = (input) => ({
+    fenceId: requireBoundedIdentifier(input.fenceId, "The permit fence identifier"),
+    policy: requirePolicyInput(input.policy),
+    recordedAtMs: parseNodeClockRecordedAtMs(input.recordedAt, "The permit issue timestamp"),
+    scopeCommandId: requireBoundedIdentifier(input.scopeCommandId, "The permit scope command identifier"),
+    scopeSessionId: input.scopeSessionId === undefined
+        ? undefined
+        : requireBoundedIdentifier(input.scopeSessionId, "The permit scope session identifier"),
+});
+const assertAuthorizationCreationPrecedesIssue = (recordedAtMs, active) => {
+    const authorizationCreatedAtMs = parseNodeClockRecordedAtMs(active.createdAt, "The authorization creation timestamp");
+    requireMonotonicTimestamp(recordedAtMs, authorizationCreatedAtMs, "The permit issue timestamp");
+};
+const toNullableSqliteText = (value) => value ?? nullValue;
+const buildIssuedPermitRecord = (input) => ({
+    expiresAt: plusMilliseconds(input.recordedAt, PERMIT_EXPIRY_MS),
+    permitId: `permit_${randomUUID().replaceAll("-", "")}`,
+    scopeSessionId: toNullableSqliteText(input.scopeSessionId),
+});
+const buildIssuedPermitInsertParameters = (input, record) => [
+    record.permitId,
+    CODEX_INTEGRATION,
+    input.active.authorizationRevision,
+    input.ownerKind,
+    input.scopeCommandId,
+    record.scopeSessionId,
+    input.active.executableSha256,
+    input.active.adapterVersion,
+    input.active.sandboxPolicyRevision,
+    input.active.vouchPolicyRevision,
+    input.fenceId,
+    input.recordedAt,
+    input.recordedAtMs,
+    record.expiresAt,
+    input.recordedAtMs + PERMIT_EXPIRY_MS,
+];
+const insertIssuedPermit = (database, input) => {
+    const record = buildIssuedPermitRecord(input);
+    const parameters = buildIssuedPermitInsertParameters(input, record);
+    database.prepare(INSERT_ISSUED_PERMIT_SQL).run(...parameters);
+    return record.permitId;
+};
+const runIssueCodexIntegrationPermit = (database, input) => {
+    assertOwnerKindIsKnown(input.ownerKind);
+    const parsed = parseIssueInput(input);
+    compactTerminalPermits(database, parsed.recordedAtMs);
+    const active = readActiveAuthorizationForIssue(database);
+    assertAuthorizationCreationPrecedesIssue(parsed.recordedAtMs, active);
+    assertIssuePolicyMatchesAuthorization(parsed.policy, active);
+    assertOwnerKindAllowlisted(input.ownerKind, active);
+    assertPermitCapacity(database, active);
+    const permitId = insertIssuedPermit(database, {
+        active,
+        fenceId: parsed.fenceId,
+        ownerKind: input.ownerKind,
+        recordedAt: input.recordedAt,
+        recordedAtMs: parsed.recordedAtMs,
+        scopeCommandId: parsed.scopeCommandId,
+        scopeSessionId: parsed.scopeSessionId,
+    });
+    return {
+        method: "integration.permit.issue",
+        permit: projectPermit(readPermitOrCorrupt(database, permitId)),
+    };
+};
+export const issueCodexIntegrationPermit = (database, input) => withReplay(database, { ...input, method: "integration.permit.issue" }, () => runIssueCodexIntegrationPermit(database, input));
+const maybeTerminalizeExpiredPermit = (input) => {
+    if (input.recordedAtMs < input.permit.expiresAtMs) {
+        return undefined;
+    }
+    return "expired";
+};
+const staleRevisionReason = (input) => {
+    if (input.permit.authorizationRevision === input.expectedRevision) {
+        return undefined;
+    }
+    return "stale_revision";
+};
+const staleActiveRevisionReason = (database, input) => {
+    const active = activeAuthorization(database);
+    if (active?.authorizationRevision === input.permit.authorizationRevision) {
+        return undefined;
+    }
+    return "stale_revision";
+};
+const stalePolicyReason = (input) => {
+    if (input.policy.adapterVersion === input.permit.adapterVersion &&
+        input.policy.sandboxPolicyRevision === input.permit.sandboxPolicyRevision &&
+        input.policy.vouchPolicyRevision === input.permit.vouchPolicyRevision) {
+        return undefined;
+    }
+    return "stale_policy";
+};
+const resolveTransitionGuardDenial = (database, input) => {
+    const expired = maybeTerminalizeExpiredPermit(input);
+    if (expired !== undefined)
+        return expired;
+    const staleRevision = staleRevisionReason(input);
+    if (staleRevision !== undefined)
+        return staleRevision;
+    const staleActive = staleActiveRevisionReason(database, input);
+    if (staleActive !== undefined)
+        return staleActive;
+    const stalePolicy = stalePolicyReason(input);
+    if (stalePolicy !== undefined)
+        return stalePolicy;
+    return undefined;
+};
+const maybeTerminalizeBeforeDispatch = (database, input) => {
+    const denial = resolveTransitionGuardDenial(database, input);
+    if (denial === undefined) {
+        return undefined;
+    }
+    return projectPermit(terminalizePermit(database, { ...input, reason: denial }));
+};
+const requirePermitState = (permit, expected, message) => {
+    if (permit.state === expected) {
+        return;
+    }
+    throw makeNodeRuntimeError("storage_conflict", message, true);
+};
+const parseDispatchInput = (input) => ({
+    expectedRevision: parseAuthorizationRevision(input.revision),
+    policy: requirePolicyInput(input.policy),
+    recordedAtMs: parseNodeClockRecordedAtMs(input.recordedAt, "The permit dispatch timestamp"),
+});
+const persistDispatchingPermit = (database, input) => {
+    database
+        .prepare(UPDATE_DISPATCHING_SQL)
+        .run(input.recordedAt, input.recordedAtMs, input.permitId);
+    return projectPermit(readPermitOrCorrupt(database, input.permitId));
+};
+const parseDispatchContext = (database, input) => {
+    const parsed = parseDispatchInput(input);
+    const permit = requirePermitForTransition(database, input.permitId);
+    requirePermitState(permit, "issued", "The integration permit is not in issued state.");
+    requireMonotonicTimestamp(parsed.recordedAtMs, permit.issuedAtMs, "The permit dispatch timestamp");
+    return { parsed, permit };
+};
+const runDispatchCodexIntegrationPermit = (database, input) => {
+    const context = parseDispatchContext(database, input);
+    const terminal = maybeTerminalizeBeforeDispatch(database, {
+        expectedRevision: context.parsed.expectedRevision,
+        permit: context.permit,
+        policy: context.parsed.policy,
+        recordedAt: input.recordedAt,
+        recordedAtMs: context.parsed.recordedAtMs,
+    });
+    if (terminal !== undefined) {
+        return { method: "integration.permit.dispatch", permit: terminal };
+    }
+    return {
+        method: "integration.permit.dispatch",
+        permit: persistDispatchingPermit(database, {
+            permitId: context.permit.permitId,
+            recordedAt: input.recordedAt,
+            recordedAtMs: context.parsed.recordedAtMs,
+        }),
+    };
+};
+export const dispatchCodexIntegrationPermit = (database, input) => withReplay(database, { ...input, method: "integration.permit.dispatch" }, () => runDispatchCodexIntegrationPermit(database, input));
+const parseStartInput = (input) => ({
+    expectedRevision: parseAuthorizationRevision(input.revision),
+    policy: requirePolicyInput(input.policy),
+    processTreeId: requireBoundedIdentifier(input.processTreeId, "The permit process-tree identifier"),
+    recordedAtMs: parseNodeClockRecordedAtMs(input.recordedAt, "The permit start timestamp"),
+});
+const requireDispatchingTimestamp = (permit) => {
+    if (permit.dispatchingAtMs !== null) {
+        return permit.dispatchingAtMs;
+    }
+    throw makeNodeRuntimeError("storage_corrupt", "The dispatching permit is missing dispatching_at_ms.");
+};
+const persistStartedPermit = (database, input) => {
+    database
+        .prepare(UPDATE_STARTED_SQL)
+        .run(input.recordedAt, input.recordedAtMs, input.processTreeId, input.permitId);
+    return projectPermit(readPermitOrCorrupt(database, input.permitId));
+};
+const parseStartContext = (database, input) => {
+    const parsed = parseStartInput(input);
+    const permit = requirePermitForTransition(database, input.permitId);
+    requirePermitState(permit, "dispatching", "The integration permit is not dispatching.");
+    requireMonotonicTimestamp(parsed.recordedAtMs, requireDispatchingTimestamp(permit), "The permit start timestamp");
+    return { parsed, permit };
+};
+const runStartCodexIntegrationPermit = (database, input) => {
+    const context = parseStartContext(database, input);
+    const denied = resolveTransitionGuardDenial(database, {
+        expectedRevision: context.parsed.expectedRevision,
+        permit: context.permit,
+        policy: context.parsed.policy,
+        recordedAt: input.recordedAt,
+        recordedAtMs: context.parsed.recordedAtMs,
+    });
+    if (denied !== undefined) {
+        return {
+            method: "integration.permit.start",
+            permit: projectPermit(context.permit),
+        };
+    }
+    return {
+        method: "integration.permit.start",
+        permit: persistStartedPermit(database, {
+            permitId: context.permit.permitId,
+            processTreeId: context.parsed.processTreeId,
+            recordedAt: input.recordedAt,
+            recordedAtMs: context.parsed.recordedAtMs,
+        }),
+    };
+};
+const readSettlePermit = (database, permitId) => {
+    const permit = requirePermitForTransition(database, permitId);
+    if (permit.state !== "terminal") {
+        return permit;
+    }
+    throw makeNodeRuntimeError("storage_conflict", "The integration permit is already terminal.", true);
+};
+export const startCodexIntegrationPermit = (database, input) => withReplay(database, { ...input, method: "integration.permit.start" }, () => runStartCodexIntegrationPermit(database, input));
+const runSettleCodexIntegrationPermit = (database, input) => {
+    const context = readSettleContext(database, input);
+    const updated = terminalizePermit(database, {
+        permit: context.permit,
+        reason: input.reason,
+        recordedAt: input.recordedAt,
+        recordedAtMs: context.recordedAtMs,
+    });
+    if (input.reason === "cleanup_unknown") {
+        fenceAuthorizationCleanupUnknown(database, {
+            authorizationRevision: context.permit.authorizationRevision,
+            recordedAt: input.recordedAt,
+            recordedAtMs: context.recordedAtMs,
+        });
+    }
+    compactTerminalPermits(database, context.recordedAtMs);
+    return {
+        method: "integration.permit.settle",
+        permit: projectPermit(updated),
+    };
+};
+const readSettleContext = (database, input) => {
+    const recordedAtMs = parseNodeClockRecordedAtMs(input.recordedAt, "The permit settlement timestamp");
+    const permit = readSettlePermit(database, input.permitId);
+    requireMonotonicTimestamp(recordedAtMs, latestPermitLifecycleTimestampMs(permit), "The permit settlement timestamp");
+    return { permit, recordedAtMs };
+};
+const requireRevocationStartedAtMs = (revocationStartedAt) => {
+    if (revocationStartedAt !== null) {
+        return parseNodeClockRecordedAtMs(revocationStartedAt, "The authorization revocation start timestamp");
+    }
+    throw makeNodeRuntimeError("storage_corrupt", "The revoking authorization is missing revocation_started_at.");
+};
+const readAuthorizationForCleanupUnknown = (database, authorizationRevision) => {
+    const authorization = readAuthorizationRevision(database, authorizationRevision);
+    if (authorization !== undefined) {
+        return authorization;
+    }
+    throw makeNodeRuntimeError("storage_corrupt", "The permit authorization revision no longer exists.");
+};
+const assertCleanupUnknownFromActiveMonotonic = (authorization, recordedAtMs) => {
+    requireMonotonicTimestamp(recordedAtMs, parseNodeClockRecordedAtMs(authorization.createdAt, "The authorization creation timestamp"), "The permit settlement timestamp");
+};
+const assertCleanupUnknownFromRevokingMonotonic = (authorization, recordedAtMs) => {
+    requireMonotonicTimestamp(recordedAtMs, requireRevocationStartedAtMs(authorization.revocationStartedAt), "The permit settlement timestamp");
+};
+const assertCleanupUnknownAuthorizationState = (authorization, recordedAtMs) => {
+    if (authorization.state === "cleanup_unknown") {
+        return false;
+    }
+    if (authorization.state === "active") {
+        assertCleanupUnknownFromActiveMonotonic(authorization, recordedAtMs);
+        return true;
+    }
+    if (authorization.state === "revoking") {
+        assertCleanupUnknownFromRevokingMonotonic(authorization, recordedAtMs);
+        return true;
+    }
+    throw makeNodeRuntimeError("storage_conflict", "The integration authorization revision is no longer valid for cleanup_unknown fencing.", true);
+};
+const persistCleanupUnknownAuthorization = (database, input) => {
+    const changes = Number(database
+        .prepare(UPDATE_AUTHORIZATION_CLEANUP_UNKNOWN_SQL)
+        .run(input.recordedAt, input.recordedAt, input.recordedAt, input.authorizationRevision).changes);
+    if (changes === 1) {
+        return;
+    }
+    throw makeNodeRuntimeError("storage_corrupt", "The integration authorization cleanup_unknown fence was not persisted.");
+};
+const fenceAuthorizationCleanupUnknown = (database, input) => {
+    const authorization = readAuthorizationForCleanupUnknown(database, input.authorizationRevision);
+    if (!assertCleanupUnknownAuthorizationState(authorization, input.recordedAtMs)) {
+        return;
+    }
+    persistCleanupUnknownAuthorization(database, {
+        authorizationRevision: input.authorizationRevision,
+        recordedAt: input.recordedAt,
+    });
+};
+export const settleCodexIntegrationPermit = (database, input) => withReplay(database, { ...input, method: "integration.permit.settle" }, () => runSettleCodexIntegrationPermit(database, input));
+export const listCodexRevokingPermitWork = (database, authorizationRevision) => {
+    const parsedRevision = parseAuthorizationRevision(authorizationRevision);
+    const rows = database
+        .prepare(LIST_REVOKING_WORK_SQL)
+        .all(parsedRevision);
+    return rows.map((row) => projectPermit(row));
+};
+export const listCodexUnsettledPermits = (database, authorizationRevision, limit = MAX_UNSETTLED_PER_AUTHORIZATION) => {
+    const parsedRevision = parseAuthorizationRevision(authorizationRevision);
+    if (!Number.isSafeInteger(limit) || limit <= 0) {
+        throw makeNodeRuntimeError("storage_failed", "The unsettled permit query limit is invalid.");
+    }
+    const boundedLimit = Math.min(limit, MAX_UNSETTLED_PER_AUTHORIZATION);
+    const rows = database
+        .prepare(LIST_UNSETTLED_PERMITS_SQL)
+        .all(parsedRevision, boundedLimit);
+    return rows.map((row) => projectPermit(row));
+};
+//# sourceMappingURL=permit-store.js.map

package/dist/runtime/process/resource/integration-authorization/permit-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permit-store.js","sourceRoot":"","sources":["../../../../../src/runtime/process/resource/integration-authorization/permit-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAQlB,MAAM,YAAY,CAAC;AAEpB,MAAM,0BAA0B,GAAG;;;;;sBAKb,CAAC;AAEvB,MAAM,wBAAwB,GAAG;;;;;mEAKkC,CAAC;AAEpE,MAAM,sBAAsB,GAAG;;;;sBAIT,CAAC;AAEvB,MAAM,kBAAkB,GAAG;;;;;sBAKL,CAAC;AAEvB,MAAM,wCAAwC,GAAG;;;;;;wCAMT,CAAC;AAEzC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBA4BR,CAAC;AAExB,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA6B1B,CAAC;AAEV,MAAM,SAAS,GAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAuE3C,MAAM,kBAAkB,GAAG,CACzB,MAAmC,EACN,EAAE,CAAC,CAAC;IACjC,cAAc,EAAE,sBAAsB,CACpC,MAAM,CAAC,cAAc,EACrB,2BAA2B,CAC5B;IACD,qBAAqB,EAAE,sBAAsB,CAC3C,MAAM,CAAC,qBAAqB,EAC5B,mCAAmC,CACpC;IACD,mBAAmB,EAAE,sBAAsB,CACzC,MAAM,CAAC,mBAAmB,EAC1B,iCAAiC,CAClC;CACF,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CACjC,QAAsB,EACtB,QAAgB,EACL,EAAE;IACb,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,QAAQ,EACR,mCAAmC,CACpC,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,oBAAoB,CACxB,oBAAoB,EACpB,uCAAuC,CACxC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,QAAsB,EACtB,QAAgB,EACL,EAAE;IACb,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,QAAsB,EACtB,KAAkE,EACvD,EAAE;IACb,QAAQ;SACL,OAAO,CAAC,0BAA0B,CAAC;SACnC,GAAG,CACF,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,MAAM,CAAC,QAAQ,CACtB,CAAC;IACJ,OAAO,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,gCAAgC,GAAG,CAAC,MAAiB,EAAU,EAAE;IACrE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACtE,OAAO,MAAM,CAAC,eAAe,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,QAAsB,EACD,EAAE;IACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,oBAAoB,CACxB,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,SAAyB,EAAQ,EAAE;IACjE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,6CAA6C,CAC9C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,qCAAqC,GAAG,CAC5C,MAAmC,EACnC,MAA2B,EACrB,EAAE;IACR,IACE,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAC/C,MAAM,CAAC,qBAAqB,KAAK,MAAM,CAAC,qBAAqB;QAC7D,MAAM,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,EACzD,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,yDAAyD,EACzD,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CACjC,SAAyB,EACzB,MAA2B,EACrB,EAAE;IACR,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,iFAAiF,EACjF,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,QAAsB,EACtB,MAA2B,EACrB,EAAE;IACR,MAAM,SAAS,GAAG,qBAAqB,CACrC,QAAQ,EACR,MAAM,CAAC,qBAAqB,CAC7B,CAAC;IACF,IAAI,SAAS,GAAG,+BAA+B,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CACxB,WAAW,EACX,sEAAsE,EACtE,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAuB,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,wBAAwB,CAC/B,KAAK,CAAC,OAAO,EACb,6BAA6B,CAC9B;IACD,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC;IACxC,YAAY,EAAE,0BAA0B,CACtC,KAAK,CAAC,UAAU,EAChB,4BAA4B,CAC7B;IACD,cAAc,EAAE,wBAAwB,CACtC,KAAK,CAAC,cAAc,EACpB,qCAAqC,CACtC;IACD,cAAc,EACZ,KAAK,CAAC,cAAc,KAAK,SAAS;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,wBAAwB,CACtB,KAAK,CAAC,cAAc,EACpB,qCAAqC,CACtC;CACR,CAAC,CAAC;AAEH,MAAM,wCAAwC,GAAG,CAC/C,YAAoB,EACpB,MAA2B,EACrB,EAAE;IACR,MAAM,wBAAwB,GAAG,0BAA0B,CACzD,MAAM,CAAC,SAAS,EAChB,sCAAsC,CACvC,CAAC;IACF,yBAAyB,CACvB,YAAY,EACZ,wBAAwB,EACxB,4BAA4B,CAC7B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAiB,EAAE,CAC7D,KAAK,IAAI,SAAS,CAAC;AAErB,MAAM,uBAAuB,GAAG,CAAC,KAQhC,EAIC,EAAE,CAAC,CAAC;IACJ,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAC/D,QAAQ,EAAE,UAAU,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;IACtD,cAAc,EAAE,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC;CAC3D,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,CACxC,KAA8B,EAC9B,MAIC,EACD,EAAE,CACF;IACE,MAAM,CAAC,QAAQ;IACf,iBAAiB;IACjB,KAAK,CAAC,MAAM,CAAC,qBAAqB;IAClC,KAAK,CAAC,SAAS;IACf,KAAK,CAAC,cAAc;IACpB,MAAM,CAAC,cAAc;IACrB,KAAK,CAAC,MAAM,CAAC,gBAAgB;IAC7B,KAAK,CAAC,MAAM,CAAC,cAAc;IAC3B,KAAK,CAAC,MAAM,CAAC,qBAAqB;IAClC,KAAK,CAAC,MAAM,CAAC,mBAAmB;IAChC,KAAK,CAAC,OAAO;IACb,KAAK,CAAC,UAAU;IAChB,KAAK,CAAC,YAAY;IAClB,MAAM,CAAC,SAAS;IAChB,KAAK,CAAC,YAAY,GAAG,gBAAgB;CAC7B,CAAC;AAEb,MAAM,kBAAkB,GAAG,CACzB,QAAsB,EACtB,KAA8B,EACtB,EAAE;IACV,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,iCAAiC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpE,QAAQ,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,8BAA8B,GAAG,CACrC,QAAsB,EACtB,KAAuB,EACJ,EAAE;IACrB,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACzD,wCAAwC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtE,qCAAqC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7D,0BAA0B,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACpD,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE;QAC5C,MAAM;QACN,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,0BAA0B;QAClC,MAAM,EAAE,aAAa,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;KAC/D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,QAAsB,EACtB,KAAuB,EAItB,EAAE,CACH,UAAU,CAAC,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAC1E,8BAA8B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAChD,CAAC;AAEJ,MAAM,6BAA6B,GAAG,CACpC,KAAsB,EACC,EAAE;IACzB,IAAI,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,KAA2B,EACG,EAAE;IAChC,IAAI,KAAK,CAAC,MAAM,CAAC,qBAAqB,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAChC,QAAsB,EACtB,KAA2B,EACG,EAAE;IAChC,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,EAAE,qBAAqB,KAAK,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,KAA2B,EACC,EAAE;IAC9B,IACE,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3D,KAAK,CAAC,MAAM,CAAC,qBAAqB,KAAK,KAAK,CAAC,MAAM,CAAC,qBAAqB;QACzE,KAAK,CAAC,MAAM,CAAC,mBAAmB,KAAK,KAAK,CAAC,MAAM,CAAC,mBAAmB,EACrE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAG,CACnC,QAAsB,EACtB,KAA2B,EACgC,EAAE;IAC7D,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,MAAM,WAAW,GAAG,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAClD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,8BAA8B,GAAG,CACrC,QAAsB,EACtB,KAA2B,EACG,EAAE;IAChC,MAAM,MAAM,GAAG,4BAA4B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,CAClB,iBAAiB,CAAC,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC1D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,MAAiB,EACjB,QAA4B,EAC5B,OAAe,EACT,EAAE;IACR,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CAAC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,KAA0B,EAAE,EAAE,CAAC,CAAC;IAC1D,gBAAgB,EAAE,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC5D,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC;IACxC,YAAY,EAAE,0BAA0B,CACtC,KAAK,CAAC,UAAU,EAChB,+BAA+B,CAChC;CACF,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAC/B,QAAsB,EACtB,KAIC,EACiB,EAAE;IACpB,QAAQ;SACL,OAAO,CAAC,sBAAsB,CAAC;SAC/B,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,aAAa,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,QAAsB,EACtB,KAA0B,EAI1B,EAAE;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,0BAA0B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpE,kBAAkB,CAChB,MAAM,EACN,QAAQ,EACR,gDAAgD,CACjD,CAAC;IACF,yBAAyB,CACvB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,UAAU,EACjB,+BAA+B,CAChC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,iCAAiC,GAAG,CACxC,QAAsB,EACtB,KAA0B,EACJ,EAAE;IACxB,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,8BAA8B,CAAC,QAAQ,EAAE;QACxD,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;QAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;KAC1C,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;YACzC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YACjC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;SAC1C,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,QAAsB,EACtB,KAA0B,EAIzB,EAAE,CACH,UAAU,CACR,QAAQ,EACR,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,EACnD,GAAG,EAAE,CAAC,iCAAiC,CAAC,QAAQ,EAAE,KAAK,CAAC,CACzD,CAAC;AAEJ,MAAM,eAAe,GAAG,CAAC,KAAuB,EAAE,EAAE,CAAC,CAAC;IACpD,gBAAgB,EAAE,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC5D,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC;IACxC,aAAa,EAAE,wBAAwB,CACrC,KAAK,CAAC,aAAa,EACnB,oCAAoC,CACrC;IACD,YAAY,EAAE,0BAA0B,CACtC,KAAK,CAAC,UAAU,EAChB,4BAA4B,CAC7B;CACF,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,CAAC,MAAiB,EAAU,EAAE;IAChE,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,eAAe,CAAC;IAChC,CAAC;IACD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,QAAsB,EACtB,KAKC,EACiB,EAAE;IACpB,QAAQ;SACL,OAAO,CAAC,kBAAkB,CAAC;SAC3B,GAAG,CACF,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,QAAQ,CACf,CAAC;IACJ,OAAO,aAAa,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,QAAsB,EACtB,KAAuB,EAIvB,EAAE;IACF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,0BAA0B,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpE,kBAAkB,CAChB,MAAM,EACN,aAAa,EACb,4CAA4C,CAC7C,CAAC;IACF,yBAAyB,CACvB,MAAM,CAAC,YAAY,EACnB,2BAA2B,CAAC,MAAM,CAAC,EACnC,4BAA4B,CAC7B,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,8BAA8B,GAAG,CACrC,QAAsB,EACtB,KAAuB,EACJ,EAAE;IACrB,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,4BAA4B,CAAC,QAAQ,EAAE;QACpD,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;QAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;KAC1C,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;SACtC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,0BAA0B;QAClC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE;YACrC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YACjC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa;YAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;SAC1C,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,QAAsB,EACtB,QAAgB,EACL,EAAE;IACb,MAAM,MAAM,GAAG,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,6CAA6C,EAC7C,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,QAAsB,EACtB,KAAuB,EAItB,EAAE,CACH,UAAU,CAAC,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAC1E,8BAA8B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAChD,CAAC;AAEJ,MAAM,+BAA+B,GAAG,CACtC,QAAsB,EACtB,KAAwB,EACJ,EAAE;IACtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACvC,gCAAgC,CAAC,QAAQ,EAAE;YACzC,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAC3D,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;IACL,CAAC;IACD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO;QACL,MAAM,EAAE,2BAA2B;QACnC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;KAC/B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,QAAsB,EACtB,KAAwB,EAIxB,EAAE;IACF,MAAM,YAAY,GAAG,0BAA0B,CAC7C,KAAK,CAAC,UAAU,EAChB,iCAAiC,CAClC,CAAC;IACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1D,yBAAyB,CACvB,YAAY,EACZ,gCAAgC,CAAC,MAAM,CAAC,EACxC,iCAAiC,CAClC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAG,CACnC,mBAAkC,EAC1B,EAAE;IACV,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,0BAA0B,CAC/B,mBAAmB,EACnB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kCAAkC,GAAG,CACzC,QAAsB,EACtB,qBAA6B,EAC7B,EAAE;IACF,MAAM,aAAa,GAAG,yBAAyB,CAC7C,QAAQ,EACR,qBAAqB,CACtB,CAAC;IACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,uCAAuC,GAAG,CAC9C,aAAoE,EACpE,YAAoB,EACd,EAAE;IACR,yBAAyB,CACvB,YAAY,EACZ,0BAA0B,CACxB,aAAa,CAAC,SAAS,EACvB,sCAAsC,CACvC,EACD,iCAAiC,CAClC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,yCAAyC,GAAG,CAChD,aAAoE,EACpE,YAAoB,EACd,EAAE;IACR,yBAAyB,CACvB,YAAY,EACZ,4BAA4B,CAAC,aAAa,CAAC,mBAAmB,CAAC,EAC/D,iCAAiC,CAClC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,sCAAsC,GAAG,CAC7C,aAAoE,EACpE,YAAoB,EACX,EAAE;IACX,IAAI,aAAa,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,uCAAuC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACvC,yCAAyC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,wFAAwF,EACxF,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kCAAkC,GAAG,CACzC,QAAsB,EACtB,KAGC,EACK,EAAE;IACR,MAAM,OAAO,GAAG,MAAM,CACpB,QAAQ;SACL,OAAO,CAAC,wCAAwC,CAAC;SACjD,GAAG,CACF,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,qBAAqB,CAC5B,CAAC,OAAO,CACZ,CAAC;IACF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,wEAAwE,CACzE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,gCAAgC,GAAG,CACvC,QAAsB,EACtB,KAIC,EACK,EAAE;IACR,MAAM,aAAa,GAAG,kCAAkC,CACtD,QAAQ,EACR,KAAK,CAAC,qBAAqB,CAC5B,CAAC;IACF,IACE,CAAC,sCAAsC,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,EAC1E,CAAC;QACD,OAAO;IACT,CAAC;IACD,kCAAkC,CAAC,QAAQ,EAAE;QAC3C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,QAAsB,EACtB,KAAwB,EAIvB,EAAE,CACH,UAAU,CAAC,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,GAAG,EAAE,CAC3E,+BAA+B,CAAC,QAAQ,EAAE,KAAK,CAAC,CACjD,CAAC;AAEJ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,QAAsB,EACtB,qBAA6B,EACA,EAAE;IAC/B,MAAM,cAAc,GAAG,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,QAAQ;SAClB,OAAO,CAAC,sBAAsB,CAAC;SAC/B,GAAG,CAAC,cAAc,CAAoC,CAAC;IAC1D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,QAAsB,EACtB,qBAA6B,EAC7B,QAAgB,+BAA+B,EAClB,EAAE;IAC/B,MAAM,cAAc,GAAG,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,QAAQ;SAClB,OAAO,CAAC,0BAA0B,CAAC;SACnC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAoC,CAAC;IACxE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC,CAAC"}

package/dist/runtime/process/resource/integration-authorization/plan-integrity.d.ts

@@ -0,0 +1,21 @@
+import { type CodexOwnerKind, type PlanRow } from "./types.js";
+export type CanonicalPayload = {
+    readonly integration: "codex";
+    readonly target: {
+        readonly adapter: "codex";
+        readonly adapterVersion: string;
+        readonly executableIdentity: {
+            readonly device: string;
+            readonly inode: string;
+            readonly sizeBytes: string;
+        };
+        readonly executablePath: string;
+        readonly executableSha256: string;
+        readonly ownerKinds: readonly CodexOwnerKind[];
+        readonly sandboxPolicyRevision: string;
+        readonly vouchPolicyRevision: string;
+    };
+};
+export declare const parsePersistedPlanPayload: (planJson: string) => CanonicalPayload;
+export declare const requirePlanRowIntegrity: (row: PlanRow) => PlanRow;
+//# sourceMappingURL=plan-integrity.d.ts.map

package/dist/runtime/process/resource/integration-authorization/plan-integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-integrity.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/process/resource/integration-authorization/plan-integrity.ts"],"names":[],"mappings":"AAeA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAgBpB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,kBAAkB,EAAE;YAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;YACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;SAC5B,CAAC;QACF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;QAC/C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;KACtC,CAAC;CACH,CAAC;AA6LF,eAAO,MAAM,yBAAyB,GACpC,UAAU,MAAM,KACf,gBAgBF,CAAC;AAmIF,eAAO,MAAM,uBAAuB,GAAI,KAAK,OAAO,KAAG,OAMtD,CAAC"}