@nifrajs/core 2.2.0 → 2.4.0

package/README.md

@@ -30,7 +30,7 @@ import { defineAssurancePolicy } from "@nifrajs/core/assurance"
 
 - **Inline or contract-first.** Write routes inline (types inferred from the
   builder), or `defineContract(...)` + `implement(...)` for a decoupled, versionable
-  surface — handlers lift over unchanged.
+  surface - handlers lift over unchanged.
 - **Validation at the boundary.** Per-route `body`/`query` is any
   [Standard Schema](https://standardschema.dev) (zod/valibot/arktype, or `@nifrajs/schema`'s
   `t`); invalid input is rejected with a structured `422` before the handler runs.
@@ -96,7 +96,7 @@ ESM-only; requires Bun at runtime. MIT.
 
 ## For AI agents
 
-Start with [`LLM.md`](./LLM.md) — this package's contract card (the exports you call + its footguns),
+Start with [`LLM.md`](./LLM.md) - this package's contract card (the exports you call + its footguns),
 one cheap read instead of the whole corpus. For the wider framework: the repo's
 [`AGENTS.md`](../../AGENTS.md) is the copy-paste quick reference, and
 [`llms-full.txt`](../../llms-full.txt) is the full machine-readable corpus. Run `nifra check` as the

package/dist/assurance.d.ts

@@ -2,7 +2,7 @@
  * Route assurance: reflection-time proof that every route is classified and carries the enforcement
  * evidence its policy requires. Evaluation is pure and never runs on the request hot path.
  */
-import { type CapabilityAssuranceReport, type CapabilityPolicy } from "./capabilities.js";
+import { type CapabilityAccess, type CapabilityAssuranceReport, type CapabilityDefinition, type CapabilityPolicy, type CapabilityZone } from "./capabilities.js";
 import type { AssuranceDeclaration, AssuranceEvidence, AssuranceScope } from "./internal/route-assurance.js";
 import { withRouteAssurance } from "./internal/route-assurance.js";
 import type { NifraManifestSigner } from "./manifest.js";
@@ -30,6 +30,44 @@ export interface AssuranceRouteSelector {
     readonly paths?: readonly string[];
     /** Restrict the rule to MCP tool routes (`true`) or non-tool routes (`false`). */
     readonly tools?: boolean;
+    /**
+     * Match routes declaring ANY of these capability tokens.
+     *
+     * Lets a policy be written about what a route DOES rather than where it lives: "anything that writes
+     * to the database must be authenticated" survives a route being moved or renamed, which a path glob
+     * does not. Reflection already carries the declared tokens, so this reads what the route said about
+     * itself.
+     *
+     * Naming exact tokens is precise but closed: a rule listing `db.write` does not cover `storage.write`,
+     * and a capability added next year escapes it in silence. Prefer `access`/`zone` for a rule that is
+     * meant to hold for a CLASS of effect.
+     */
+    readonly capabilities?: readonly string[];
+    /**
+     * Match routes declaring any capability whose definition has this access.
+     *
+     * This is the selector to reach for when the rule is "anything that writes must prove who asked":
+     * it is keyed on what the capability IS rather than what it is called, so a token introduced later
+     * is covered the day it is declared instead of the day someone remembers to widen the rule.
+     *
+     * Requires capability definitions. A policy using it without them is refused rather than quietly
+     * matching nothing - a selector that matches nothing lets the route fall through to a laxer rule.
+     */
+    readonly access?: CapabilityAccess;
+    /**
+     * Match routes declaring any capability in this zone. Combined with `access`, both must hold for the
+     * SAME capability, so `{ access: "write", zone: "domain" }` is "writes business state" and does not
+     * match a route that only writes an audit log.
+     */
+    readonly zone?: CapabilityZone;
+}
+/** Extra inputs an assurance evaluation needs beyond the routes themselves. */
+export interface AssuranceEvaluationOptions {
+    /**
+     * Capability definitions, required by any rule selecting on `access`/`zone`. Normally
+     * `config.capabilities.definitions`.
+     */
+    readonly definitions?: readonly CapabilityDefinition[];
 }
 export interface AssuranceRule {
     /** Stable human-readable classification included in diagnostics. */
@@ -100,8 +138,14 @@ export interface AssuranceConfig {
 export declare function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy;
 /** Identity helper for a `nifra.assurance.ts` default export. */
 export declare function defineAssuranceConfig(config: AssuranceConfig): AssuranceConfig;
-/** Shared selector semantics for policy rules and framework adapters. */
-export declare function matchesAssuranceSelector(route: Pick<ReflectedRoute, "method" | "path" | "tool">, selector: AssuranceRouteSelector): boolean;
+/**
+ * Shared selector semantics for policy rules and framework adapters.
+ *
+ * `definitions` is only consulted by the `access`/`zone` selectors; every other selector reads
+ * reflection alone. A caller that omits it while the selector needs it gets no match, so callers that
+ * accept user policy must reject that combination up front - `defineAssuranceConfig` does.
+ */
+export declare function matchesAssuranceSelector(route: Pick<ReflectedRoute, "method" | "path" | "tool" | "capabilities">, selector: AssuranceRouteSelector, definitions?: ReadonlyMap<string, CapabilityDefinition>): boolean;
 /** Evaluate reflected route evidence against the first matching policy rule. */
-export declare function evaluateRouteAssurance(source: unknown, policyInput: AssurancePolicy): AssuranceReport;
+export declare function evaluateRouteAssurance(source: unknown, policyInput: AssurancePolicy, options?: AssuranceEvaluationOptions): AssuranceReport;
 //# sourceMappingURL=assurance.d.ts.map

package/dist/assurance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assurance.d.ts","sourceRoot":"","sources":["../src/assurance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EAEtB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAKL,kBAAkB,EACnB,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,iBAAiB,CAAA;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAE7B,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAElF,6EAA6E;AAC7E,eAAO,MAAM,eAAe;;;;;;;;;EAAsB,CAAA;AAElD,MAAM,WAAW,sBAAsB;IACrC,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,yCAAyC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAA;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IACvC,iGAAiG;IACjG,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,OAAO,CAAA;CACjD;AAED,MAAM,MAAM,oBAAoB,GAC5B,WAAW,GACX,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,CAAA;AAE5B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAA;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAA;IACxC,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,qCAAqC;QACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;QACtB,+EAA+E;QAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;KACzF,CAAA;IACD,wFAAwF;IACxF,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;KACrC,CAAA;CACF;AAsBD,uDAAuD;AACvD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAkE9E;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CA4B9E;AAED,yEAAyE;AACzE,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,EACvD,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAOT;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,eAAe,GAC3B,eAAe,CAsFjB"}
+{"version":3,"file":"assurance.d.ts","sourceRoot":"","sources":["../src/assurance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAEpB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAKL,kBAAkB,EACnB,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,iBAAiB,CAAA;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAE7B,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAElF,6EAA6E;AAC7E,eAAO,MAAM,eAAe;;;;;;;;;EAAsB,CAAA;AAElD,MAAM,WAAW,sBAAsB;IACrC,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAClC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAA;CAC/B;AAED,+EAA+E;AAC/E,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAA;CACvD;AAmBD,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,yCAAyC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAA;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IACvC,iGAAiG;IACjG,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,OAAO,CAAA;CACjD;AAED,MAAM,MAAM,oBAAoB,GAC5B,WAAW,GACX,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,CAAA;AAE5B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAA;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAA;IACxC,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,qCAAqC;QACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;QACtB,+EAA+E;QAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;KACzF,CAAA;IACD,wFAAwF;IACxF,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;KACrC,CAAA;CACF;AAsBD,uDAAuD;AACvD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAoG9E;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CA2C9E;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,cAAc,CAAC,EACxE,QAAQ,EAAE,sBAAsB,EAChC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,GACtD,OAAO,CAsBT;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,eAAe,EAC5B,OAAO,CAAC,EAAE,0BAA0B,GACnC,eAAe,CAqGjB"}

package/dist/assurance.js

@@ -8,6 +8,16 @@ import { reflectRoutes } from "./reflection.js";
 export { withRouteAssurance };
 /** Canonical evidence ids emitted by Nifra's official middleware modules. */
 export const NIFRA_ASSURANCE = NIFRA_ASSURANCE_IDS;
+/** Selector keys that cannot be resolved from reflection alone. */
+const CLASS_SELECTOR_KEYS = ["access", "zone"];
+const usesClassSelector = (selector) => selector.access !== undefined || selector.zone !== undefined;
+/** The rules whose selector needs capability definitions to mean anything. */
+function rulesNeedingDefinitions(policy) {
+    return policy.rules.filter((rule) => usesClassSelector(rule.match)).map((rule) => rule.name);
+}
+function definitionMap(definitions) {
+    return new Map((definitions ?? []).map((definition) => [definition.id, definition]));
+}
 const nonEmpty = (value) => value.trim() !== "";
 function normalizeEvidenceIds(values, label) {
     const out = [];
@@ -46,6 +56,15 @@ export function defineAssurancePolicy(policy) {
         if (names.has(name))
             throw new Error(`route assurance: duplicate rule name ${JSON.stringify(name)}`);
         names.add(name);
+        // The selector is rebuilt from known keys below, so an unrecognised one would be dropped in
+        // silence - and a selector that loses its only constraint matches EVERY route, making the rule
+        // swallow everything after it. A misspelled key is a policy hole, so it is refused here.
+        const unknown = Object.keys(rule.match).filter((key) => !["methods", "paths", "tools", "capabilities", ...CLASS_SELECTOR_KEYS].includes(key));
+        if (unknown.length > 0) {
+            throw new Error(`route assurance: rule ${JSON.stringify(rule.name)} has unknown selector key(s) ${unknown
+                .map((key) => JSON.stringify(key))
+                .join(", ")} - a dropped selector would match every route`);
+        }
         if (rule.match.tools !== undefined && typeof rule.match.tools !== "boolean") {
             throw new Error(`route assurance: rule ${JSON.stringify(name)} tools selector must be boolean`);
         }
@@ -59,6 +78,18 @@ export function defineAssurancePolicy(policy) {
             routeGlob(path);
             return path;
         });
+        const capabilities = rule.match.capabilities;
+        if (capabilities !== undefined && (!Array.isArray(capabilities) || capabilities.length === 0)) {
+            throw new Error(`route assurance: rule ${JSON.stringify(name)} capabilities selector must be a non-empty array`);
+        }
+        const access = rule.match.access;
+        if (access !== undefined && access !== "read" && access !== "write") {
+            throw new Error(`route assurance: rule ${JSON.stringify(name)} access selector must be "read" or "write"`);
+        }
+        const zone = rule.match.zone;
+        if (zone !== undefined && zone !== "domain" && zone !== "operational") {
+            throw new Error(`route assurance: rule ${JSON.stringify(name)} zone selector must be "domain" or "operational"`);
+        }
         const required = normalizeEvidenceIds(rule.require, "required");
         const forbidden = normalizeEvidenceIds(rule.forbid, "forbidden");
         const overlap = required.find((id) => forbidden.includes(id));
@@ -71,6 +102,9 @@ export function defineAssurancePolicy(policy) {
                 ...(methods !== undefined ? { methods: Object.freeze(methods) } : {}),
                 ...(paths !== undefined ? { paths: Object.freeze(paths) } : {}),
                 ...(rule.match.tools !== undefined ? { tools: rule.match.tools } : {}),
+                ...(capabilities !== undefined ? { capabilities: Object.freeze([...capabilities]) } : {}),
+                ...(access !== undefined ? { access } : {}),
+                ...(zone !== undefined ? { zone } : {}),
             }),
             require: required,
             forbid: forbidden,
@@ -94,12 +128,22 @@ export function defineAssuranceConfig(config) {
     if (config.invariants !== undefined && typeof config.invariants.executor !== "function") {
         throw new Error("route assurance: invariant executor must be a function");
     }
+    const policy = defineAssurancePolicy(config.policy);
+    const capabilities = config.capabilities !== undefined ? defineCapabilityPolicy(config.capabilities) : undefined;
+    // An `access`/`zone` selector is resolved through the capability definitions. Without them it can
+    // only ever match nothing, and a rule that matches nothing does not fail - the route falls past it
+    // to whatever laxer rule comes next. Refuse the config here rather than ship a policy whose
+    // strictest rule is inert.
+    const needDefinitions = rulesNeedingDefinitions(policy);
+    if (needDefinitions.length > 0 && (capabilities?.definitions.length ?? 0) === 0) {
+        throw new Error(`route assurance: rule(s) ${needDefinitions
+            .map((name) => JSON.stringify(name))
+            .join(", ")} select on ${CLASS_SELECTOR_KEYS.join("/")}, which needs capability definitions - add a \`capabilities\` policy defining the tokens your routes declare`);
+    }
     return Object.freeze({
         source: config.source,
-        policy: defineAssurancePolicy(config.policy),
-        ...(config.capabilities !== undefined
-            ? { capabilities: defineCapabilityPolicy(config.capabilities) }
-            : {}),
+        policy,
+        ...(capabilities !== undefined ? { capabilities } : {}),
         ...(config.manifest !== undefined
             ? {
                 manifest: Object.freeze({
@@ -113,20 +157,54 @@ export function defineAssuranceConfig(config) {
             : {}),
     });
 }
-/** Shared selector semantics for policy rules and framework adapters. */
-export function matchesAssuranceSelector(route, selector) {
-    const { methods, paths, tools } = selector;
+/**
+ * Shared selector semantics for policy rules and framework adapters.
+ *
+ * `definitions` is only consulted by the `access`/`zone` selectors; every other selector reads
+ * reflection alone. A caller that omits it while the selector needs it gets no match, so callers that
+ * accept user policy must reject that combination up front - `defineAssuranceConfig` does.
+ */
+export function matchesAssuranceSelector(route, selector, definitions) {
+    const { methods, paths, tools, capabilities, access, zone } = selector;
     if (methods !== undefined && !methods.includes(route.method))
         return false;
     if (paths !== undefined && !paths.some((pattern) => routeGlob(pattern).test(route.path)))
         return false;
     if (tools !== undefined && (route.tool !== undefined) !== tools)
         return false;
+    const declared = route.capabilities ?? [];
+    if (capabilities !== undefined && !capabilities.some((token) => declared.includes(token)))
+        return false;
+    if (access !== undefined || zone !== undefined) {
+        // Both constraints must hold for the SAME capability: a route that reads the database and writes
+        // an audit log must not satisfy "writes business state" by combining halves of two tokens.
+        const matched = declared.some((token) => {
+            const definition = definitions?.get(token);
+            if (definition === undefined)
+                return false;
+            if (access !== undefined && definition.access !== access)
+                return false;
+            if (zone !== undefined && definition.zone !== zone)
+                return false;
+            return true;
+        });
+        if (!matched)
+            return false;
+    }
     return true;
 }
 /** Evaluate reflected route evidence against the first matching policy rule. */
-export function evaluateRouteAssurance(source, policyInput) {
+export function evaluateRouteAssurance(source, policyInput, options) {
     const policy = defineAssurancePolicy(policyInput);
+    const definitions = definitionMap(options?.definitions);
+    // Same reasoning as `defineAssuranceConfig`, repeated for callers that evaluate a bare policy: a
+    // class selector with nothing to resolve against is an inert rule, not a lenient one.
+    const needDefinitions = rulesNeedingDefinitions(policy);
+    if (needDefinitions.length > 0 && definitions.size === 0) {
+        throw new Error(`route assurance: rule(s) ${needDefinitions
+            .map((name) => JSON.stringify(name))
+            .join(", ")} select on ${CLASS_SELECTOR_KEYS.join("/")} but no capability definitions were supplied`);
+    }
     const findings = [];
     const routes = [];
     const reflected = reflectRoutes(source);
@@ -139,7 +217,7 @@ export function evaluateRouteAssurance(source, policyInput) {
         });
     }
     for (const route of reflected) {
-        const rule = policy.rules.find((candidate) => matchesAssuranceSelector(route, candidate.match));
+        const rule = policy.rules.find((candidate) => matchesAssuranceSelector(route, candidate.match, definitions));
         const evidence = route.assurance ?? [];
         const evidenceIds = new Set(evidence.map((item) => item.id));
         if (rule === undefined) {

package/dist/assurance.js.map

@@ -1 +1 @@
-{"version":3,"file":"assurance.js","sourceRoot":"","sources":["../src/assurance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,sBAAsB,GACvB,MAAM,mBAAmB,CAAA;AAM1B,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,WAAW,EACX,kBAAkB,GACnB,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAuB,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIpE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAK7B,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAwFlD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;AAEhE,SAAS,oBAAoB,CAC3B,MAAqC,EACrC,KAAa;IAEb,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACf,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,IACE,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,MAAM,CAAC,SAAS,KAAK,OAAO;QAC5B,MAAM,CAAC,SAAS,KAAK,QAAQ,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,IACE,MAAM,CAAC,6BAA6B,KAAK,SAAS;QAClD,OAAO,MAAM,CAAC,6BAA6B,KAAK,SAAS,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAiB,EAAE;QACrD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iCAAiC,CAC/E,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QACzE,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACvF,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3C,SAAS,CAAC,IAAI,CAAC,CAAA;YACf,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC/D,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CACrF,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE,CAAC;YACF,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,OAAO;QACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;QACtC,6BAA6B,EAAE,MAAM,CAAC,6BAA6B,IAAI,KAAK;KAC7E,CAAC,CAAA;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,YAAY,EAAE,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;YAC/D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;YAC/B,CAAC,CAAC;gBACE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;oBACtB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7E,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,EAAE;YACzE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CACtC,KAAuD,EACvD,QAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAA;IAC1C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAgB,CAAC;QAAE,OAAO,KAAK,CAAA;IACpF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtF,OAAO,KAAK,CAAA;IACd,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC7E,OAAO,IAAI,CAAA;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CACpC,MAAe,EACf,WAA4B;IAE5B,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IAEvC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,oFAAoF;SAC9F,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAA;QACtC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,yCAAyC;iBAChF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;YAC7F,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACzE,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACzE,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,gBAAgB,EAAE,EAAE;aACzE,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,uBAAuB,EAAE,EAAE;aAChF,CAAC,CAAA;QACJ,CAAC;QACD,oGAAoG;QACpG,uGAAuG;QACvG,4FAA4F;QAC5F,IACE,MAAM,CAAC,6BAA6B,KAAK,IAAI;YAC7C,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YACjC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,qDAAqD;aAC1G,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACpC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;KAClC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"assurance.js","sourceRoot":"","sources":["../src/assurance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAML,sBAAsB,GACvB,MAAM,mBAAmB,CAAA;AAM1B,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,WAAW,EACX,kBAAkB,GACnB,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAuB,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIpE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAK7B,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAkDlD,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAU,CAAA;AAEvD,MAAM,iBAAiB,GAAG,CAAC,QAAgC,EAAW,EAAE,CACtE,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAA;AAE9D,8EAA8E;AAC9E,SAAS,uBAAuB,CAAC,MAAuB;IACtD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC9F,CAAC;AAED,SAAS,aAAa,CACpB,WAAwD;IAExD,OAAO,IAAI,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC;AA+ED,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;AAEhE,SAAS,oBAAoB,CAC3B,MAAqC,EACrC,KAAa;IAEb,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACf,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,IACE,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,MAAM,CAAC,SAAS,KAAK,OAAO;QAC5B,MAAM,CAAC,SAAS,KAAK,QAAQ,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,IACE,MAAM,CAAC,6BAA6B,KAAK,SAAS;QAClD,OAAO,MAAM,CAAC,6BAA6B,KAAK,SAAS,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAiB,EAAE;QACrD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,4FAA4F;QAC5F,+FAA+F;QAC/F,yFAAyF;QACzF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAC5C,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,mBAAmB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC9F,CAAA;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,OAAO;iBACtF,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;iBACjC,IAAI,CAAC,IAAI,CAAC,+CAA+C,CAC7D,CAAA;QACH,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iCAAiC,CAC/E,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QACzE,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACvF,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3C,SAAS,CAAC,IAAI,CAAC,CAAA;YACf,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QACF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAA;QAC5C,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kDAAkD,CAChG,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA;QAChC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4CAA4C,CAC1F,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAA;QAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kDAAkD,CAChG,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC/D,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CACrF,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC;YACF,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,OAAO;QACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;QACtC,6BAA6B,EAAE,MAAM,CAAC,6BAA6B,IAAI,KAAK;KAC7E,CAAC,CAAA;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnD,MAAM,YAAY,GAChB,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7F,kGAAkG;IAClG,mGAAmG;IACnG,4FAA4F;IAC5F,2BAA2B;IAC3B,MAAM,eAAe,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;IACvD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CACb,4BAA4B,eAAe;aACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;aACnC,IAAI,CACH,IAAI,CACL,cAAc,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,8GAA8G,CAC7J,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM;QACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;YAC/B,CAAC,CAAC;gBACE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;oBACtB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7E,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,EAAE;YACzE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAwE,EACxE,QAAgC,EAChC,WAAuD;IAEvD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAA;IACtE,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAgB,CAAC;QAAE,OAAO,KAAK,CAAA;IACpF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtF,OAAO,KAAK,CAAA;IACd,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAA;IACzC,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvF,OAAO,KAAK,CAAA;IACd,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/C,iGAAiG;QACjG,2FAA2F;QAC3F,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACtC,MAAM,UAAU,GAAG,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;YAC1C,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAA;YACtE,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAA;YAChE,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;IAC5B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CACpC,MAAe,EACf,WAA4B,EAC5B,OAAoC;IAEpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACvD,iGAAiG;IACjG,sFAAsF;IACtF,MAAM,eAAe,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;IACvD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,4BAA4B,eAAe;aACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;aACnC,IAAI,CACH,IAAI,CACL,cAAc,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,8CAA8C,CAC7F,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IAEvC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,oFAAoF;SAC9F,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3C,wBAAwB,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAC9D,CAAA;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAA;QACtC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,yCAAyC;iBAChF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;YAC7F,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACzE,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACzE,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,gBAAgB,EAAE,EAAE;aACzE,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,uBAAuB,EAAE,EAAE;aAChF,CAAC,CAAA;QACJ,CAAC;QACD,oGAAoG;QACpG,uGAAuG;QACvG,4FAA4F;QAC5F,IACE,MAAM,CAAC,6BAA6B,KAAK,IAAI;YAC7C,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YACjC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,qDAAqD;aAC1G,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACpC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;KAClC,CAAC,CAAA;AACJ,CAAC"}

package/dist/binary.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `@nifrajs/core/binary` - a route that returns bytes, and says so in its type.
+ *
+ * A download route had no way to be part of the contract. Returning a raw `Response` is the only way
+ * to send bytes, and a raw `Response` is exactly what the typed client cannot describe - so the route
+ * needed a `// nifra-expect raw-response` pragma to quiet the advisory, and its caller got no type at
+ * all. One whole category of endpoint sat outside the thing the framework is otherwise strict about.
+ *
+ *     import { bytes } from "@nifrajs/core/binary"
+ *
+ *     app.get("/invoice.pdf", async (c) => bytes(await render(c.params.id), {
+ *       type: "application/pdf",
+ *       filename: "invoice.pdf",
+ *     }))
+ *
+ * The client types `data` as `Blob` for that route, and gets the bytes intact.
+ *
+ * The brand is a phantom: `bytes()` returns a real `Response` and nothing is added to it at runtime.
+ * It exists so the type carries a fact the value cannot - that these bytes are the payload rather than
+ * a serialization accident - which is what lets `Jsonify` answer `Blob` instead of trying to describe
+ * a `Response`'s properties.
+ */
+/**
+ * Marker on a binary response's TYPE. A unique symbol rather than a string key, so no ordinary object
+ * can satisfy it by accident, and declared required rather than optional - an optional brand is
+ * satisfied by every type that lacks it, which would make the check match `Response` itself.
+ */
+declare const NIFRA_BYTES: unique symbol;
+/** Runtime marker paired with the type-only brand so clients do not have to guess from media type. */
+export declare const NIFRA_BINARY_HEADER = "x-nifra-binary";
+/** A `Response` a route declared as binary. `Jsonify` maps this to `Blob`. */
+export type BinaryResponse = Response & {
+    readonly [NIFRA_BYTES]: true;
+};
+/** What can be sent as bytes without being re-encoded on the way out. */
+export type BinaryBody = ArrayBuffer | ArrayBufferView | Blob | ReadableStream<Uint8Array>;
+export interface BytesOptions {
+    /** Media type. Defaults to `application/octet-stream`, the honest answer for unlabelled bytes. */
+    readonly type?: string;
+    /**
+     * Offer the body as a download under this name.
+     *
+     * A filename derived from user data is the ordinary case - an upload's original name, a document
+     * title - so this has to survive anything a person can type. Two things follow, and both are tested:
+     * a `"` or a newline cannot end the value and write further parameters, and a non-Latin-1 name is
+     * encoded rather than thrown on.
+     */
+    readonly filename?: string;
+    readonly status?: number;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export declare function bytes(body: BinaryBody, options?: BytesOptions): BinaryResponse;
+export {};
+//# sourceMappingURL=binary.d.ts.map

package/dist/binary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../src/binary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;GAIG;AACH,OAAO,CAAC,MAAM,WAAW,EAAE,OAAO,MAAM,CAAA;AAExC,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AAEnD,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,CAAA;CAAE,CAAA;AAExE,yEAAyE;AACzE,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,eAAe,GAAG,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;AAE1F,MAAM,WAAW,YAAY;IAC3B,kGAAkG;IAClG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACpD;AAgDD,wBAAgB,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,GAAE,YAAiB,GAAG,cAAc,CA0BlF"}

package/dist/binary.js

@@ -0,0 +1,90 @@
+/**
+ * `@nifrajs/core/binary` - a route that returns bytes, and says so in its type.
+ *
+ * A download route had no way to be part of the contract. Returning a raw `Response` is the only way
+ * to send bytes, and a raw `Response` is exactly what the typed client cannot describe - so the route
+ * needed a `// nifra-expect raw-response` pragma to quiet the advisory, and its caller got no type at
+ * all. One whole category of endpoint sat outside the thing the framework is otherwise strict about.
+ *
+ *     import { bytes } from "@nifrajs/core/binary"
+ *
+ *     app.get("/invoice.pdf", async (c) => bytes(await render(c.params.id), {
+ *       type: "application/pdf",
+ *       filename: "invoice.pdf",
+ *     }))
+ *
+ * The client types `data` as `Blob` for that route, and gets the bytes intact.
+ *
+ * The brand is a phantom: `bytes()` returns a real `Response` and nothing is added to it at runtime.
+ * It exists so the type carries a fact the value cannot - that these bytes are the payload rather than
+ * a serialization accident - which is what lets `Jsonify` answer `Blob` instead of trying to describe
+ * a `Response`'s properties.
+ */
+/** Runtime marker paired with the type-only brand so clients do not have to guess from media type. */
+export const NIFRA_BINARY_HEADER = "x-nifra-binary";
+/**
+ * Everything a header value may not contain: quotes, backslashes, and the CR/LF that would split the
+ * header. Replaced rather than rejected - a filename is cosmetic, and failing a download because a
+ * document was titled `Q1 "final"` would be worse than sending it with the quotes dropped.
+ */
+const UNSAFE_FILENAME = /["\\\r\n]/g;
+/**
+ * Printable ASCII only.
+ *
+ * A header value is nominally Latin-1, but runtimes do not agree: Bun rejects `é` in a header outright,
+ * so "Latin-1 is fine" would have been a portability bug dressed as a standards reading. Printable
+ * ASCII is what every runtime and client accepts, and `filename*` carries everything else.
+ */
+const NON_ASCII = /[^\x20-\x7e]/g;
+/**
+ * `Content-Disposition` for a name that may be anything a user typed.
+ *
+ * Setting a header containing `报告.pdf` or an emoji THROWS - which on a download route is a 500 for
+ * the ordinary act of naming a file in a language ASCII does not cover, and the name usually came from
+ * the user in the first place. RFC 6266 exists for exactly this: an ASCII `filename` every client
+ * understands, plus `filename*` carrying the real name UTF-8 percent-encoded, which browsers prefer.
+ *
+ * The ASCII fallback keeps the characters it can rather than substituting a placeholder, so
+ * `report 报告.pdf` still arrives as `report .pdf` on a client that ignores `filename*`.
+ *
+ * `filename*` is built from the SANITIZED name, not the raw one. Percent-encoding would make a hostile
+ * name inert either way, but round-tripping `"; attachment; filename="evil.exe` into the header - even
+ * encoded - puts an attacker's string somewhere a future reader has to reason about, and the second
+ * parameter is only there to carry characters ASCII cannot.
+ */
+function contentDisposition(filename) {
+    const safe = filename.toWellFormed().replace(UNSAFE_FILENAME, "");
+    const ascii = safe.replace(NON_ASCII, "");
+    const disposition = `attachment; filename="${ascii}"`;
+    // Only when it adds something: a name ASCII already carries needs no second parameter.
+    if (ascii === safe)
+        return disposition;
+    // encodeURIComponent leaves `'()*` untouched, but RFC 5987's attr-char grammar does not.
+    const encoded = encodeURIComponent(safe).replace(/['()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+    return `${disposition}; filename*=UTF-8''${encoded}`;
+}
+export function bytes(body, options = {}) {
+    const headers = new Headers(options.headers);
+    headers.set("content-type", options.type ?? "application/octet-stream");
+    headers.set(NIFRA_BINARY_HEADER, "1");
+    // Response headers outside the CORS safelist are hidden from cross-origin clients unless exposed.
+    // Preserve an existing list and add the marker so the typed contract works cross-origin too.
+    const exposed = headers.get("access-control-expose-headers");
+    if (exposed !== "*") {
+        const names = exposed
+            ?.split(",")
+            .map((name) => name.trim())
+            .filter(Boolean);
+        if (!names?.some((name) => name.toLowerCase() === NIFRA_BINARY_HEADER)) {
+            headers.set("access-control-expose-headers", [...(names ?? []), NIFRA_BINARY_HEADER].join(", "));
+        }
+    }
+    if (options.filename !== undefined) {
+        headers.set("content-disposition", contentDisposition(options.filename));
+    }
+    return new Response(body, {
+        status: options.status ?? 200,
+        headers,
+    });
+}
+//# sourceMappingURL=binary.js.map

package/dist/binary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary.js","sourceRoot":"","sources":["../src/binary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAA;AAwBnD;;;;GAIG;AACH,MAAM,eAAe,GAAG,YAAY,CAAA;AAEpC;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,eAAe,CAAA;AAEjC;;;;;;;;;;;;;;;GAeG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,yBAAyB,KAAK,GAAG,CAAA;IACrD,uFAAuF;IACvF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,WAAW,CAAA;IACtC,yFAAyF;IACzF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAC9C,SAAS,EACT,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9D,CAAA;IACD,OAAO,GAAG,WAAW,sBAAsB,OAAO,EAAE,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAgB,EAAE,UAAwB,EAAE;IAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAA6C,CAAC,CAAA;IAClF,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,IAAI,0BAA0B,CAAC,CAAA;IACvE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAA;IACrC,kGAAkG;IAClG,6FAA6F;IAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAA;IAC5D,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,OAAO;YACnB,EAAE,KAAK,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CAAA;QAClB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,mBAAmB,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,GAAG,CACT,+BAA+B,EAC/B,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnD,CAAA;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAiD,EAAE;QACrE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG;QAC7B,OAAO;KACR,CAAmB,CAAA;AACtB,CAAC"}

package/dist/budget.d.ts

@@ -70,7 +70,7 @@ export declare class DeadlineExceededError extends Error {
 }
 /**
  * Create a budget from an admitted absolute deadline. Wall time is sampled once; every subsequent
- * `remaining()` call is monotonic. This function does not arm a timer—the owner of `signal` does.
+ * `remaining()` call is monotonic. This function does not arm a timer-the owner of `signal` does.
  */
 export declare function createRequestBudget(options: CreateRequestBudgetOptions): RequestBudget;
 /** Create a local no-deadline view. Outbound header propagation deliberately omits it. */

package/dist/budget.js

@@ -79,7 +79,7 @@ class UnboundedRequestBudget {
 }
 /**
  * Create a budget from an admitted absolute deadline. Wall time is sampled once; every subsequent
- * `remaining()` call is monotonic. This function does not arm a timer—the owner of `signal` does.
+ * `remaining()` call is monotonic. This function does not arm a timer-the owner of `signal` does.
  */
 export function createRequestBudget(options) {
     assertDeadline(options.deadline);

package/dist/capabilities.d.ts

@@ -7,6 +7,23 @@ import { type EffectLifecycleObserver } from "./effect-lifecycle.js";
 import { type AroundCapabilityOptions, type CapabilityApprovalGate, type CapabilityApprovalInput, type CapabilityExecutionIdentity, type CapabilityExecutionJournal, type CapabilityInterceptor, type CapabilityInterceptorEvent, type CapabilityInterceptorNext, type CapabilityUseEvent, validCapabilityId } from "./internal/capability-runtime.js";
 import { type EffectCost, type EffectPhase } from "./ledger.js";
 export type { AroundCapabilityOptions, CapabilityApprovalGate, CapabilityApprovalInput, CapabilityExecutionIdentity, CapabilityExecutionJournal, CapabilityInterceptor, CapabilityInterceptorEvent, CapabilityInterceptorNext, CapabilityUseEvent, EffectLifecycleObserver, };
+/**
+ * Framework wiring: put a journal on a request context so every `executeCapability` on that request is
+ * journaled without each call site threading it. Not for application code - install the
+ * `durableCommand()` adapter, which calls this and declares the assurance evidence that goes with it.
+ *
+ * Symbol-keyed, mirroring `attachEffectLedger`: it cannot collide with an application field and does
+ * not show up in a context spread or a log of it.
+ *
+ * Deliberately here rather than beside the journal TYPE in `internal/capability-runtime.ts`. That
+ * module is reachable from a bare server - it holds the route-capability guard - so a seam living
+ * there ships to every app, while here it arrives only with `executeCapability`, the one thing that
+ * reads it. Measured rather than assumed: in the internal module this cost every bundle row in the
+ * size matrix 10-18 bytes gzip, enough to put `nifra-mcp` over its ceiling.
+ */
+export declare function attachCapabilityJournal(context: object, journal: CapabilityExecutionJournal): void;
+/** The journal installed for this request, if any. */
+export declare function capabilityJournalOf(context: object): CapabilityExecutionJournal | undefined;
 export type CapabilityZone = "domain" | "operational";
 export type CapabilityAccess = "read" | "write";
 export type CapabilityIdempotency = "none" | "request" | "durable";
@@ -67,7 +84,7 @@ export interface RouteCapabilityEvidence {
 export interface CapabilityEvidenceSet {
     readonly routes: readonly RouteCapabilityEvidence[];
 }
-export type CapabilityFindingCode = "unknown-capability" | "provenance-uncovered" | "undeclared-capability-evidence" | "safe-method-domain-write" | "missing-request-idempotency" | "missing-durable-idempotency" | "forbidden-effect-import";
+export type CapabilityFindingCode = "unknown-capability" | "provenance-uncovered" | "undeclared-capability-evidence" | "safe-method-domain-write" | "unconfined-write-reach" | "missing-request-idempotency" | "missing-durable-idempotency" | "forbidden-effect-import" | "provenance-truncated";
 export interface CapabilityFinding {
     readonly code: CapabilityFindingCode;
     readonly method: string;
@@ -111,7 +128,7 @@ export declare function defineCapabilityPolicy(policy: CapabilityPolicy): Capabi
 export declare function evaluateCapabilityAssurance(source: unknown, policyInput: CapabilityPolicy, evidenceSet: CapabilityEvidenceSet): CapabilityAssuranceReport;
 /**
  * Optional effect-ledger fields for one `useCapability` beacon. Token-only by design: an adapter
- * names *what* it touched and *how much resource* it used — never the value it read or wrote.
+ * names *what* it touched and *how much resource* it used - never the value it read or wrote.
  */
 export interface UseCapabilityOptions {
     /** Adapter/resource token recorded on the ledger entry (`repo:orders`). */

package/dist/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,KAAK,uBAAuB,EAAuB,MAAM,uBAAuB,CAAA;AAEzF,OAAO,EACL,KAAK,uBAAuB,EAE5B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAE/B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAEvB,iBAAiB,EAClB,MAAM,kCAAkC,CAAA;AAGzC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,WAAW,EAGjB,MAAM,aAAa,CAAA;AAGpB,YAAY,EACV,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,GACxB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,aAAa,CAAA;AACrD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAA;AAC/C,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;AAElE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAA;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;IACvC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACjD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,yBAAyB,EAAE,CAAA;IAC/D,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAA;CACzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAA;IAC/C,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,SAAS,CAAA;AAEzD,oGAAoG;AACpG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACpD;AAED,MAAM,MAAM,qBAAqB,GAC7B,oBAAoB,GACpB,sBAAsB,GACtB,gCAAgC,GAChC,0BAA0B,GAC1B,6BAA6B,GAC7B,6BAA6B,GAC7B,yBAAyB,CAAA;AAE7B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAChD,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,iFAAiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAA;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,sBAAsB,EAAE,CAAA;IAClD,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,uGAAuG;IACvG,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAA;CAC7C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACpD;AAID,OAAO,EAAE,iBAAiB,EAAE,CAAA;AA8B5B,0DAA0D;AAC1D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CA4EjF;AAUD,8FAA8F;AAC9F,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,gBAAgB,EAC7B,WAAW,EAAE,qBAAqB,GACjC,yBAAyB,CA6H3B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC9C,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAED,sGAAsG;AACtG,MAAM,WAAW,0BAA2B,SAAQ,oBAAoB;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,uBAAuB,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAA;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,CAAA;CAC9C;AAED,8FAA8F;AAC9F,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAC7B;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;AAEjG,uEAAuE;AACvE,qBAAa,qBAAsB,SAAQ,KAAK;aAE5B,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;gBADhB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM;CAKnC;AAED,mEAAmE;AACnE,qBAAa,iCAAkC,SAAQ,KAAK;aAExC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,SAAS,EAAE,MAAM;gBAFjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM;CAKpC;AAED,wEAAwE;AACxE,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;gBADhB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM;CAKnC;AAED,+EAA+E;AAC/E,qBAAa,kCAAmC,SAAQ,KAAK;aAEzC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;gBADhB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM;CAKnC;AAED,gGAAgG;AAChG,qBAAa,gCAAiC,SAAQ,KAAK;aAEvC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,UAAU,EAAE,WAAW;gBAFvB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,WAAW;CAK1C;AA2GD;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,IAAI,CAQN;AAED,sGAAsG;AACtG,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,wBAAwB,GAChC,IAAI,CASN;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,EACnC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAoGZ;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAGvE;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,GAAG,kBAAkB,CAc1F"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,KAAK,uBAAuB,EAAuB,MAAM,uBAAuB,CAAA;AAEzF,OAAO,EACL,KAAK,uBAAuB,EAE5B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAE/B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAEvB,iBAAiB,EAClB,MAAM,kCAAkC,CAAA;AAGzC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,WAAW,EAGjB,MAAM,aAAa,CAAA;AAGpB,YAAY,EACV,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,GACxB,CAAA;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,0BAA0B,GAClC,IAAI,CAEN;AAED,sDAAsD;AACtD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS,CAI3F;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,aAAa,CAAA;AACrD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAA;AAC/C,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;AAElE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAA;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;IACvC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACjD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,yBAAyB,EAAE,CAAA;IAC/D,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAA;CACzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAA;IAC/C,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,SAAS,CAAA;AAEzD,oGAAoG;AACpG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACpD;AAED,MAAM,MAAM,qBAAqB,GAC7B,oBAAoB,GACpB,sBAAsB,GACtB,gCAAgC,GAChC,0BAA0B,GAC1B,wBAAwB,GACxB,6BAA6B,GAC7B,6BAA6B,GAC7B,yBAAyB,GACzB,sBAAsB,CAAA;AAE1B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAChD,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,iFAAiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAA;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,sBAAsB,EAAE,CAAA;IAClD,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,uGAAuG;IACvG,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAA;CAC7C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACpD;AAID,OAAO,EAAE,iBAAiB,EAAE,CAAA;AA8B5B,0DAA0D;AAC1D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CA4EjF;AAUD,8FAA8F;AAC9F,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,gBAAgB,EAC7B,WAAW,EAAE,qBAAqB,GACjC,yBAAyB,CAsJ3B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC9C,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAED,sGAAsG;AACtG,MAAM,WAAW,0BAA2B,SAAQ,oBAAoB;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,uBAAuB,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAA;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,CAAA;CAC9C;AAED,8FAA8F;AAC9F,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAC7B;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;AAEjG,uEAAuE;AACvE,qBAAa,qBAAsB,SAAQ,KAAK;aAE5B,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;gBADhB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM;CAKnC;AAED,mEAAmE;AACnE,qBAAa,iCAAkC,SAAQ,KAAK;aAExC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,SAAS,EAAE,MAAM;gBAFjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM;CAKpC;AAED,wEAAwE;AACxE,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;gBADhB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM;CAKnC;AAED,+EAA+E;AAC/E,qBAAa,kCAAmC,SAAQ,KAAK;aAEzC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;gBADhB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM;CAKnC;AAED,gGAAgG;AAChG,qBAAa,gCAAiC,SAAQ,KAAK;aAEvC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,UAAU,EAAE,WAAW;gBAFvB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,WAAW;CAK1C;AA2GD;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,IAAI,CAQN;AAED,sGAAsG;AACtG,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,wBAAwB,GAChC,IAAI,CASN;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,EACnC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAyGZ;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAGvE;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,GAAG,kBAAkB,CAc1F"}