@mondaydotcomorg/atp-provenance 0.17.14

package/dist/registry.js

@@ -0,0 +1,445 @@
+import { nanoid } from 'nanoid';
+import { computeDigest } from './tokens.js';
+const PROVENANCE_KEY = '__provenance__';
+const PROVENANCE_ID_KEY = '__prov_id__';
+const provenanceStore = new WeakMap();
+const provenanceRegistry = new Map();
+const executionProvenanceIds = new Map();
+let currentExecutionId = null;
+const primitiveProvenanceMap = new Map();
+const executionTaintedPrimitives = new Map();
+/**
+ * Mark a primitive value as tainted (derived from tool data)
+ * Used by AST mode to track derived values
+ */
+export function markPrimitiveTainted(value, sourceMetadata) {
+    if (typeof value !== 'string' && typeof value !== 'number') {
+        return;
+    }
+    if (currentExecutionId) {
+        const tainted = executionTaintedPrimitives.get(currentExecutionId);
+        if (tainted) {
+            tainted.add(value);
+        }
+    }
+    const key = `tainted:${String(value)}`;
+    primitiveProvenanceMap.set(key, sourceMetadata);
+}
+/**
+ * Check if a primitive is tainted (derived from tool data)
+ */
+export function isPrimitiveTainted(value) {
+    if (typeof value !== 'string' && typeof value !== 'number') {
+        return false;
+    }
+    if (currentExecutionId) {
+        const tainted = executionTaintedPrimitives.get(currentExecutionId);
+        if (tainted && tainted.has(value)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Set the current execution ID for provenance tracking
+ * MUST be called at start of each execution to prevent memory leaks
+ */
+export function setProvenanceExecutionId(executionId) {
+    currentExecutionId = executionId;
+    if (!executionProvenanceIds.has(executionId)) {
+        executionProvenanceIds.set(executionId, new Set());
+    }
+    if (!executionTaintedPrimitives.has(executionId)) {
+        executionTaintedPrimitives.set(executionId, new Set());
+    }
+}
+/**
+ * Clear the current execution ID
+ */
+export function clearProvenanceExecutionId() {
+    currentExecutionId = null;
+}
+/**
+ * Register provenance metadata directly (for AST tracking in isolated-vm)
+ */
+export function registerProvenanceMetadata(id, metadata, executionId) {
+    if (id.startsWith('tainted:') || id.includes(':')) {
+        primitiveProvenanceMap.set(id, metadata);
+        if (id.startsWith('tainted:')) {
+            const value = id.slice('tainted:'.length);
+            if (executionId) {
+                let tainted = executionTaintedPrimitives.get(executionId);
+                if (!tainted) {
+                    tainted = new Set();
+                    executionTaintedPrimitives.set(executionId, tainted);
+                }
+                tainted.add(value);
+            }
+        }
+    }
+    else {
+        provenanceRegistry.set(id, metadata);
+    }
+    if (executionId) {
+        let ids = executionProvenanceIds.get(executionId);
+        if (!ids) {
+            ids = new Set();
+            executionProvenanceIds.set(executionId, ids);
+        }
+        ids.add(id);
+    }
+}
+/**
+ * Cleanup provenance for a specific execution to prevent memory leaks
+ * MUST be called after execution completes or fails
+ */
+export function cleanupProvenanceForExecution(executionId) {
+    const ids = executionProvenanceIds.get(executionId);
+    if (ids) {
+        for (const id of ids) {
+            provenanceRegistry.delete(id);
+            const keysToDelete = [];
+            for (const key of primitiveProvenanceMap.keys()) {
+                if (key.startsWith(`${id}:`) || key.startsWith('tainted:')) {
+                    keysToDelete.push(key);
+                }
+            }
+            for (const key of keysToDelete) {
+                primitiveProvenanceMap.delete(key);
+            }
+        }
+        executionProvenanceIds.delete(executionId);
+    }
+    executionTaintedPrimitives.delete(executionId);
+}
+/**
+ * Check if a primitive value was extracted from a provenance-tracked object
+ * This catches: const ssn = user.ssn; await send({ body: ssn })
+ * Also checks if value is marked as tainted (AST mode)
+ */
+export function getProvenanceForPrimitive(value) {
+    if (typeof value !== 'string' && typeof value !== 'number') {
+        return null;
+    }
+    const valueStr = String(value);
+    if (isPrimitiveTainted(value)) {
+        const taintedKey = `tainted:${valueStr}`;
+        const metadata = primitiveProvenanceMap.get(taintedKey);
+        if (metadata) {
+            return metadata;
+        }
+    }
+    const taintedKey = `tainted:${valueStr}`;
+    const taintedMetadata = primitiveProvenanceMap.get(taintedKey);
+    if (taintedMetadata) {
+        return taintedMetadata;
+    }
+    for (const [key, metadata] of primitiveProvenanceMap.entries()) {
+        const parts = key.split(':');
+        if (parts.length >= 3 && !key.startsWith('tainted:')) {
+            const primitiveValue = parts.slice(2).join(':');
+            if (primitiveValue === valueStr) {
+                return metadata;
+            }
+        }
+    }
+    const digest = computeDigest(value);
+    if (digest) {
+        const digestMetadata = provenanceRegistry.get(digest);
+        if (digestMetadata) {
+            return digestMetadata;
+        }
+    }
+    return null;
+}
+/**
+ * Capture provenance state for pause/resume
+ */
+export function captureProvenanceState(executionId) {
+    const state = new Map();
+    const ids = executionProvenanceIds.get(executionId);
+    if (ids) {
+        for (const id of ids) {
+            const metadata = provenanceRegistry.get(id);
+            if (metadata) {
+                state.set(id, metadata);
+            }
+        }
+    }
+    return state;
+}
+/**
+ * Capture provenance snapshot including primitive taints for multi-step token persistence
+ */
+export function captureProvenanceSnapshot(executionId) {
+    const registryMap = captureProvenanceState(executionId);
+    const registry = Array.from(registryMap.entries());
+    const primitives = [];
+    const ids = executionProvenanceIds.get(executionId) || new Set();
+    const tainted = executionTaintedPrimitives.get(executionId);
+    if (tainted) {
+        for (const value of tainted) {
+            const key = `tainted:${String(value)}`;
+            const meta = primitiveProvenanceMap.get(key);
+            if (meta) {
+                primitives.push([key, meta]);
+            }
+        }
+    }
+    for (const [key, meta] of primitiveProvenanceMap.entries()) {
+        if (key.startsWith('tainted:')) {
+            continue;
+        }
+        const [first] = key.split(':');
+        if (first && ids.has(first)) {
+            primitives.push([key, meta]);
+        }
+    }
+    return { registry, primitives };
+}
+/**
+ * Restore provenance state after resume
+ */
+export function restoreProvenanceState(executionId, state) {
+    setProvenanceExecutionId(executionId);
+    const ids = executionProvenanceIds.get(executionId);
+    for (const [id, metadata] of state) {
+        provenanceRegistry.set(id, metadata);
+        ids.add(id);
+    }
+}
+/**
+ * Restore provenance snapshot including primitive taints for multi-step token persistence
+ */
+export function restoreProvenanceSnapshot(executionId, snapshot) {
+    const registryMap = new Map(snapshot.registry);
+    restoreProvenanceState(executionId, registryMap);
+    for (const [key, meta] of snapshot.primitives) {
+        primitiveProvenanceMap.set(key, meta);
+        if (key.startsWith('tainted:')) {
+            const value = key.slice('tainted:'.length);
+            let set = executionTaintedPrimitives.get(executionId);
+            if (!set) {
+                set = new Set();
+                executionTaintedPrimitives.set(executionId, set);
+            }
+            set.add(value);
+        }
+    }
+}
+/**
+ * Create a provenance-tracked value
+ * SOLUTION: Store metadata in global registry, attach only ID to object
+ * The ID (simple string) SURVIVES isolated-vm cloning
+ *
+ * For objects, also wraps in Proxy to track primitive extractions
+ */
+export function createProvenanceProxy(value, source, readers = { type: 'public' }, dependencies = []) {
+    if (value === null || value === undefined) {
+        return value;
+    }
+    if (typeof value !== 'object' && typeof value !== 'function') {
+        return value;
+    }
+    const id = nanoid();
+    const metadata = {
+        id,
+        source,
+        readers,
+        dependencies,
+        context: {},
+    };
+    provenanceRegistry.set(id, metadata);
+    if (currentExecutionId) {
+        const ids = executionProvenanceIds.get(currentExecutionId);
+        if (ids) {
+            ids.add(id);
+        }
+    }
+    try {
+        Object.defineProperty(value, PROVENANCE_ID_KEY, {
+            value: id,
+            writable: false,
+            enumerable: true,
+            configurable: true,
+        });
+    }
+    catch (e) {
+        provenanceStore.set(value, metadata);
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            if (typeof item === 'object' && item !== null && !hasProvenance(item)) {
+                createProvenanceProxy(item, source, readers, [id, ...dependencies]);
+            }
+        }
+    }
+    else if (typeof value === 'object') {
+        for (const key in value) {
+            if (Object.prototype.hasOwnProperty.call(value, key) && key !== PROVENANCE_ID_KEY) {
+                const nestedValue = value[key];
+                if (typeof nestedValue === 'object' &&
+                    nestedValue !== null &&
+                    !hasProvenance(nestedValue)) {
+                    createProvenanceProxy(nestedValue, source, readers, [id, ...dependencies]);
+                }
+                else if (typeof nestedValue === 'string' || typeof nestedValue === 'number') {
+                    const primitiveKey = `${id}:${key}:${String(nestedValue)}`;
+                    primitiveProvenanceMap.set(primitiveKey, metadata);
+                }
+            }
+        }
+    }
+    return value;
+}
+/**
+ * Get provenance metadata from a value
+ * Looks up by ID from global registry (survives isolated-vm cloning)
+ */
+export function getProvenance(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    if (typeof value === 'string' || typeof value === 'number') {
+        const primitiveProvenance = getProvenanceForPrimitive(value);
+        if (primitiveProvenance) {
+            return primitiveProvenance;
+        }
+    }
+    if (typeof value === 'object') {
+        const id = value[PROVENANCE_ID_KEY];
+        if (id && typeof id === 'string') {
+            const metadata = provenanceRegistry.get(id);
+            if (metadata) {
+                return metadata;
+            }
+        }
+        if (PROVENANCE_KEY in value) {
+            return value[PROVENANCE_KEY];
+        }
+        const stored = provenanceStore.get(value);
+        if (stored) {
+            return stored;
+        }
+    }
+    return null;
+}
+/**
+ * Check if a value has provenance tracking
+ */
+export function hasProvenance(value) {
+    return getProvenance(value) !== null;
+}
+/**
+ * Get all provenance metadata in an object recursively
+ */
+export function getAllProvenance(value, visited = new Set()) {
+    if (value === null || value === undefined || typeof value !== 'object') {
+        return [];
+    }
+    if (visited.has(value)) {
+        return [];
+    }
+    visited.add(value);
+    const results = [];
+    const metadata = getProvenance(value);
+    if (metadata) {
+        results.push(metadata);
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            results.push(...getAllProvenance(item, visited));
+        }
+    }
+    else if (typeof value === 'object') {
+        for (const key in value) {
+            if (key !== PROVENANCE_KEY &&
+                key !== PROVENANCE_ID_KEY &&
+                Object.prototype.hasOwnProperty.call(value, key)) {
+                results.push(...getAllProvenance(value[key], visited));
+            }
+        }
+    }
+    return results;
+}
+/**
+ * Merge reader permissions (intersection for security)
+ */
+export function mergeReaders(readers1, readers2) {
+    if (readers1.type === 'public') {
+        return readers2;
+    }
+    if (readers2.type === 'public') {
+        return readers1;
+    }
+    const intersection = readers1.readers.filter((r) => readers2.readers.includes(r));
+    return { type: 'restricted', readers: intersection };
+}
+/**
+ * Check if a reader can access data with given permissions
+ */
+export function canRead(reader, permissions) {
+    if (permissions.type === 'public') {
+        return true;
+    }
+    return permissions.readers.includes(reader);
+}
+/**
+ * Extract provenance for serialization (pause/resume)
+ */
+export function extractProvenanceMap(sandbox) {
+    const provenanceMap = new Map();
+    const visited = new Set();
+    function traverse(value, path = '') {
+        if (value === null || value === undefined || typeof value !== 'object') {
+            return;
+        }
+        if (visited.has(value)) {
+            return;
+        }
+        visited.add(value);
+        const metadata = getProvenance(value);
+        if (metadata) {
+            provenanceMap.set(path || metadata.id, metadata);
+        }
+        if (Array.isArray(value)) {
+            value.forEach((item, index) => {
+                traverse(item, `${path}[${index}]`);
+            });
+        }
+        else if (typeof value === 'object') {
+            for (const key in value) {
+                if (Object.prototype.hasOwnProperty.call(value, key)) {
+                    traverse(value[key], path ? `${path}.${key}` : key);
+                }
+            }
+        }
+    }
+    for (const [key, value] of Object.entries(sandbox)) {
+        traverse(value, key);
+    }
+    return provenanceMap;
+}
+/**
+ * Restore provenance from serialized state
+ */
+export function restoreProvenanceMap(provenanceMap, sandbox) {
+    for (const [path, metadata] of provenanceMap.entries()) {
+        const value = resolvePath(sandbox, path);
+        if (value !== undefined && typeof value === 'object') {
+            provenanceStore.set(value, metadata);
+        }
+    }
+}
+function resolvePath(obj, path) {
+    const parts = path.split(/[\.\[]/).map((p) => p.replace(/\]$/, ''));
+    let current = obj;
+    for (const part of parts) {
+        if (current === null || current === undefined) {
+            return undefined;
+        }
+        current = current[part];
+    }
+    return current;
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAOhC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AACxC,MAAM,eAAe,GAAG,IAAI,OAAO,EAA8B,CAAC;AAElE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA8B,CAAC;AAEjE,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAuB,CAAC;AAE9D,IAAI,kBAAkB,GAAkB,IAAI,CAAC;AAE7C,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA8B,CAAC;AAErE,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,cAAkC;IACtF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO;IACR,CAAC;IAED,IAAI,kBAAkB,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnE,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACvC,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,kBAAkB,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnE,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB;IAC3D,kBAAkB,GAAG,WAAW,CAAC;IACjC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,0BAA0B,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B;IACzC,kBAAkB,GAAG,IAAI,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACzC,EAAU,EACV,QAA4B,EAC5B,WAAoB;IAEpB,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,sBAAsB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAEzC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,WAAW,EAAE,CAAC;gBACjB,IAAI,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;oBACd,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;oBACpB,0BAA0B,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACF,CAAC;IACF,CAAC;SAAM,CAAC;QACP,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,WAAmB;IAChE,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,GAAG,EAAE,CAAC;QACT,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACtB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5D,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;YACF,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAChC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;QACF,CAAC;QACD,sBAAsB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/B,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,WAAW,QAAQ,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,QAAQ,EAAE,CAAC;IACzC,MAAM,eAAe,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,eAAe,EAAE,CAAC;QACrB,OAAO,eAAe,CAAC;IACxB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC;YACjB,CAAC;QACF,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,cAAc,EAAE,CAAC;YACpB,OAAO,cAAc,CAAC;QACvB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,GAAG,EAAE,CAAC;QACT,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,CAAC;gBACd,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACzB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAI5D,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAEnD,MAAM,UAAU,GAAwC,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;IAEzE,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,OAAO,EAAE,CAAC;QACb,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,WAAW,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,IAAI,EAAE,CAAC;gBACV,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9B,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5D,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,SAAS;QACV,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACrC,WAAmB,EACnB,KAAsC;IAEtC,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;IAErD,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;QACpC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACxC,WAAmB,EACnB,QAGC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,sBAAsB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAEjD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC/C,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAEtC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,GAAG,GAAG,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACV,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;gBAChB,0BAA0B,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACpC,KAAQ,EACR,MAAsB,EACtB,UAA6B,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC/C,eAAyB,EAAE;IAE3B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,QAAQ,GAAuB;QACpC,EAAE;QACF,MAAM;QACN,OAAO;QACP,YAAY;QACZ,OAAO,EAAE,EAAE;KACX,CAAC;IAEF,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAErC,IAAI,kBAAkB,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC3D,IAAI,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;IACF,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE;YAC/C,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;SAClB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,eAAe,CAAC,GAAG,CAAC,KAAe,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvE,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;YACrE,CAAC;QACF,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,KAAgC,EAAE,CAAC;YACpD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;gBACnF,MAAM,WAAW,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;gBAC5D,IACC,OAAO,WAAW,KAAK,QAAQ;oBAC/B,WAAW,KAAK,IAAI;oBACpB,CAAC,aAAa,CAAC,WAAW,CAAC,EAC1B,CAAC;oBACF,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;gBAC5E,CAAC;qBAAM,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;oBAC/E,MAAM,YAAY,GAAG,GAAG,EAAE,IAAI,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC3D,sBAAsB,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;gBACpD,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,mBAAmB,EAAE,CAAC;YACzB,OAAO,mBAAmB,CAAC;QAC5B,CAAC;IACF,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAI,KAAa,CAAC,iBAAiB,CAAC,CAAC;QAC7C,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO,QAAQ,CAAC;YACjB,CAAC;QACF,CAAC;QAED,IAAI,cAAc,IAAK,KAAa,EAAE,CAAC;YACtC,OAAQ,KAAa,CAAC,cAAc,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,CAAC;YACZ,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,UAAU,IAAI,GAAG,EAAO;IACxE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC;IACX,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAEtC,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACzB,IACC,GAAG,KAAK,cAAc;gBACtB,GAAG,KAAK,iBAAiB;gBACzB,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAC/C,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAE,KAAa,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACjE,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC3B,QAA2B,EAC3B,QAA2B;IAE3B,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,WAA8B;IACrE,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAgC;IAEhC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAO,CAAC;IAE/B,SAAS,QAAQ,CAAC,KAAc,EAAE,OAAe,EAAE;QAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxE,OAAO;QACR,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACR,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEnB,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACd,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC7B,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;oBACtD,QAAQ,CAAE,KAAa,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC9D,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CACnC,aAA8C,EAC9C,OAAgC;IAEhC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtD,eAAe,CAAC,GAAG,CAAC,KAAe,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B,EAAE,IAAY;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,GAAQ,GAAG,CAAC;IAEvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/tokens.d.ts

@@ -0,0 +1,49 @@
+import type { ProvenanceMetadata } from './types.js';
+interface CacheProvider {
+    name: string;
+    get(key: string): Promise<unknown>;
+    set(key: string, value: unknown, ttl?: number): Promise<void>;
+    delete(key: string): Promise<void>;
+    has?(key: string): Promise<boolean>;
+    disconnect?(): Promise<void>;
+}
+/**
+ * Token payload structure
+ */
+export interface TokenPayload {
+    v: 1;
+    clientId: string;
+    executionId: string;
+    createdAt: number;
+    expiresAt: number;
+    valueDigest: string;
+    metaId: string;
+}
+/**
+ * Deterministic JSON stringification with sorted keys
+ */
+export declare function stableStringify(value: unknown): string | null;
+/**
+ * Compute SHA-256 digest of value
+ */
+export declare function computeDigest(value: unknown): string | null;
+/**
+ * Get client secret (Phase 1: single secret from env)
+ */
+export declare function getClientSecret(clientId: string): string;
+/**
+ * Issue a provenance token for a value
+ */
+export declare function issueProvenanceToken(metadata: ProvenanceMetadata, value: unknown, clientId: string, executionId: string, cacheProvider: CacheProvider, ttl?: number): Promise<string | null>;
+/**
+ * Verify and extract provenance from a token
+ */
+export declare function verifyProvenanceToken(token: string, value: unknown, clientId: string, executionId: string, cacheProvider: CacheProvider): Promise<ProvenanceMetadata | null>;
+/**
+ * Verify multiple hints and build a digest → metadata map
+ * Returns map for O(1) lookup during re-attachment
+ * ALSO returns a value → metadata map for substring matching
+ */
+export declare function verifyProvenanceHints(hints: string[], clientId: string, executionId: string, cacheProvider: CacheProvider, maxHints?: number): Promise<Map<string, ProvenanceMetadata>>;
+export {};
+//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGrD,UAAU,aAAa;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CACf;AAID;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CA4C7D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAM3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAkBxD;AASD;;GAEG;AACH,wBAAsB,oBAAoB,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,aAAa,EAC5B,GAAG,GAAE,MAAa,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqCxB;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAC1C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,aAAa,GAC1B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAwEpC;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAC1C,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,aAAa,EAC5B,QAAQ,GAAE,MAAa,GACrB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAyD1C"}