@sema-agent/server 1.185.0

package/dist/runtime-governance.js

@@ -0,0 +1,103 @@
+import { canonicalToolName, combinePolicies, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
+export function isDelegationToolName(name) {
+    const c = canonicalToolName(name);
+    return c === DEFAULT_SUBAGENT_TOOL_NAME;
+}
+export function stripDelegationTools(tools) {
+    const kept = tools.filter((t) => !isDelegationToolName(t.name));
+    return kept.length === tools.length ? tools : kept;
+}
+const COARSE_SHELL_TOOLS = ["Bash"];
+function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
+    const askSet = new Set(askCommands);
+    const shellTools = new Set(tools);
+    const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
+    return {
+        check(req) {
+            if (!shellTools.has(canonicalToolName(req.toolName)))
+                return { action: "allow" };
+            const command = req.args?.command;
+            if (typeof command !== "string")
+                return ask(`tool "${req.toolName}" call has no parseable command string`);
+            const parsed = parseLeadingCommandName(command);
+            if ("reject" in parsed)
+                return ask(`command is not a single simple command (${parsed.reject})`);
+            return askSet.has(parsed.name) ? ask(`command "${parsed.name}" requires approval by policy`) : { action: "allow" };
+        },
+    };
+}
+const VALID_COMMAND_NAME = /^[A-Za-z0-9._+-]+$/;
+const VALID_DECISIONS = new Set(["allow", "ask", "deny"]);
+export function validateCommandRules(rules) {
+    const errors = [];
+    if (!Array.isArray(rules))
+        return ["commandPolicy must be an array of {command, decision} rules"];
+    for (const r of rules) {
+        if (r === null || typeof r !== "object") {
+            errors.push("commandPolicy rule must be an object {command, decision}");
+            continue;
+        }
+        const { command, decision } = r;
+        if (typeof command !== "string" || !VALID_COMMAND_NAME.test(command)) {
+            errors.push(`commandPolicy command "${String(command)}" is not a bare argv[0] name — core matches the EXACT command name (no glob/path/operators). ` +
+                `Use e.g. "git" not "git*"; to gate sub-commands or pipes, deny the interpreter ("sh"/"bash") + rely on the sandbox.`);
+        }
+        if (typeof decision !== "string" || !VALID_DECISIONS.has(decision)) {
+            errors.push(`commandPolicy command "${String(command)}" has invalid decision "${String(decision)}" — must be one of allow | ask | deny`);
+        }
+    }
+    return errors;
+}
+export function compileCommandPolicy(rules) {
+    if (!rules || rules.length === 0)
+        return undefined;
+    const RANK = { deny: 3, ask: 2, allow: 1 };
+    const strictest = new Map();
+    for (const r of rules) {
+        const prev = strictest.get(r.command);
+        if (prev === undefined || RANK[r.decision] > RANK[prev])
+            strictest.set(r.command, r.decision);
+    }
+    const deny = [];
+    const allow = [];
+    const ask = [];
+    for (const [command, decision] of strictest) {
+        (decision === "deny" ? deny : decision === "allow" ? allow : ask).push(command);
+    }
+    const policies = [];
+    if (allow.length > 0) {
+        policies.push(createCoarseCommandNamePolicy({ allow, deny, defaultAction: "ask" }));
+    }
+    else {
+        if (deny.length > 0)
+            policies.push(createCoarseCommandNamePolicy({ deny }));
+        if (ask.length > 0)
+            policies.push(createCommandAskListPolicy(ask));
+    }
+    if (policies.length === 0)
+        return undefined;
+    return policies.length === 1 ? policies[0] : combinePolicies(...policies);
+}
+export function autonomyOverrides(autonomy) {
+    switch (autonomy) {
+        case "read-only":
+        case "plan":
+            return { handsReadOnly: true };
+        case "ask":
+            return { shellGate: "always" };
+        case "auto":
+        case undefined:
+            return {};
+    }
+}
+export function applyRuntimeGovernance(base, governance) {
+    const overrides = { ...autonomyOverrides(governance.autonomy) };
+    const coarse = compileCommandPolicy(governance.commandPolicy);
+    if (coarse)
+        overrides.toolPolicy = coarse;
+    if (overrides.toolPolicy === undefined && overrides.handsReadOnly === undefined && overrides.shellGate === undefined) {
+        return base;
+    }
+    return tightenTaskSpec(base, overrides);
+}
+//# sourceMappingURL=runtime-governance.js.map

package/dist/runtime-governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-governance.js","sourceRoot":"","sources":["../src/runtime-governance.ts"],"names":[],"mappings":"AAyBA,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,6BAA6B,EAC7B,0BAA0B,EAC1B,uBAAuB,EACvB,eAAe,GAKhB,MAAM,kBAAkB,CAAC;AAY1B,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,0BAA0B,CAAC;AAC1C,CAAC;AAOD,MAAM,UAAU,oBAAoB,CAA6B,KAAmB;IAClF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,KAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAUD,MAAM,kBAAkB,GAAG,CAAC,MAAM,CAAU,CAAC;AAW7C,SAAS,0BAA0B,CAAC,WAAqB,EAAE,QAA2B,kBAAkB;IACtG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAoB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IACxG,OAAO;QACL,KAAK,CAAC,GAAoB;YAIxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACjF,MAAM,OAAO,GAAI,GAAG,CAAC,IAA0C,EAAE,OAAO,CAAC;YACzE,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC,SAAS,GAAG,CAAC,QAAQ,wCAAwC,CAAC,CAAC;YAC3G,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAEhD,IAAI,QAAQ,IAAI,MAAM;gBAAE,OAAO,GAAG,CAAC,2CAA2C,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YAChG,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,+BAA+B,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACrH,CAAC;KACF,CAAC;AACJ,CAAC;AAYD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAGhD,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAQ/E,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,6DAA6D,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAA8C,CAAC;QAC7E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CACT,0BAA0B,MAAM,CAAC,OAAO,CAAC,+FAA+F;gBACtI,qHAAqH,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,OAAO,CAAC,2BAA2B,MAAM,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;QAC3I,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAuBD,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,IAAI,GAA4C,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;QAC5C,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAErB,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;SAAM,CAAC;QAIN,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAWD,MAAM,UAAU,iBAAiB,CAAC,QAA8B;IAC9D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QACjC,KAAK,KAAK;YACR,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,sBAAsB,CACpC,IAAc,EACd,UAAkE;IAElE,MAAM,SAAS,GAAsB,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,MAAM;QAAE,SAAS,CAAC,UAAU,GAAG,MAAM,CAAC;IAC1C,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC"}

package/dist/sandbox-pkg-source.d.ts

@@ -0,0 +1,11 @@
+export interface CustomPkgSource {
+    aptMirror?: string;
+    pipIndex?: string;
+    uvIndex?: string;
+    uvPyMirror?: string;
+    npmRegistry?: string;
+    nodeMirror?: string;
+}
+export declare function derivePkgSourceEnv(profile: string | undefined, custom?: CustomPkgSource): Record<string, string>;
+export declare function customPkgSourceFromEnv(env?: NodeJS.ProcessEnv): CustomPkgSource;
+//# sourceMappingURL=sandbox-pkg-source.d.ts.map

package/dist/sandbox-pkg-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-pkg-source.d.ts","sourceRoot":"","sources":["../src/sandbox-pkg-source.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAgCD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiChH;AAGD,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CAS5F"}

package/dist/sandbox-pkg-source.js

@@ -0,0 +1,56 @@
+const GLOBAL_ENV = {
+    PIP_INDEX_URL: "https://pypi.org/simple",
+    UV_DEFAULT_INDEX: "https://pypi.org/simple",
+    UV_INDEX_URL: "https://pypi.org/simple",
+    NPM_CONFIG_REGISTRY: "https://registry.npmjs.org",
+    COREPACK_NPM_REGISTRY: "https://registry.npmjs.org",
+    GOPROXY: "https://proxy.golang.org,direct",
+    GOSUMDB: "sum.golang.org",
+    RUSTUP_DIST_SERVER: "https://static.rust-lang.org",
+    RUSTUP_UPDATE_ROOT: "https://static.rust-lang.org/rustup",
+    FLUTTER_STORAGE_BASE_URL: "https://storage.googleapis.com",
+    PUB_HOSTED_URL: "https://pub.dev",
+    PLAYWRIGHT_DOWNLOAD_HOST: "",
+    NUGET_FEED: "https://api.nuget.org/v3/index.json",
+};
+export function derivePkgSourceEnv(profile, custom) {
+    if (!profile)
+        return {};
+    switch (profile) {
+        case "cn":
+            return { SEMA_PKG_SOURCE: "cn" };
+        case "global":
+            return { SEMA_PKG_SOURCE: "global", ...GLOBAL_ENV };
+        case "custom": {
+            const c = custom ?? {};
+            const uvIndex = c.uvIndex ?? c.pipIndex;
+            return {
+                SEMA_PKG_SOURCE: "custom",
+                ...(c.aptMirror ? { SEMA_APT_MIRROR: c.aptMirror } : {}),
+                ...(c.pipIndex ? { SEMA_PIP_INDEX: c.pipIndex } : {}),
+                ...(uvIndex ? { SEMA_UV_INDEX: uvIndex } : {}),
+                ...(c.uvPyMirror ? { SEMA_UV_PY_MIRROR: c.uvPyMirror } : {}),
+                ...(c.npmRegistry ? { SEMA_NPM_REGISTRY: c.npmRegistry } : {}),
+                ...(c.nodeMirror ? { SEMA_NODE_MIRROR: c.nodeMirror } : {}),
+                ...(c.pipIndex ? { PIP_INDEX_URL: c.pipIndex } : {}),
+                ...(uvIndex ? { UV_DEFAULT_INDEX: uvIndex, UV_INDEX_URL: uvIndex } : {}),
+                ...(c.uvPyMirror ? { UV_PYTHON_INSTALL_MIRROR: c.uvPyMirror } : {}),
+                ...(c.npmRegistry ? { NPM_CONFIG_REGISTRY: c.npmRegistry, COREPACK_NPM_REGISTRY: c.npmRegistry } : {}),
+                ...(c.nodeMirror ? { NVM_NODEJS_ORG_MIRROR: c.nodeMirror, NODE_MIRROR: c.nodeMirror } : {}),
+            };
+        }
+        default:
+            return { SEMA_PKG_SOURCE: profile };
+    }
+}
+export function customPkgSourceFromEnv(env = process.env) {
+    return {
+        ...(env.SEMA_APT_MIRROR ? { aptMirror: env.SEMA_APT_MIRROR } : {}),
+        ...(env.SEMA_PIP_INDEX ? { pipIndex: env.SEMA_PIP_INDEX } : {}),
+        ...(env.SEMA_UV_INDEX ? { uvIndex: env.SEMA_UV_INDEX } : {}),
+        ...(env.SEMA_UV_PY_MIRROR ? { uvPyMirror: env.SEMA_UV_PY_MIRROR } : {}),
+        ...(env.SEMA_NPM_REGISTRY ? { npmRegistry: env.SEMA_NPM_REGISTRY } : {}),
+        ...(env.SEMA_NODE_MIRROR ? { nodeMirror: env.SEMA_NODE_MIRROR } : {}),
+    };
+}
+//# sourceMappingURL=sandbox-pkg-source.js.map

package/dist/sandbox-pkg-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-pkg-source.js","sourceRoot":"","sources":["../src/sandbox-pkg-source.ts"],"names":[],"mappings":"AA6BA,MAAM,UAAU,GAA2B;IAGzC,aAAa,EAAE,yBAAyB;IACxC,gBAAgB,EAAE,yBAAyB;IAC3C,YAAY,EAAE,yBAAyB;IAEvC,mBAAmB,EAAE,4BAA4B;IACjD,qBAAqB,EAAE,4BAA4B;IAEnD,OAAO,EAAE,iCAAiC;IAC1C,OAAO,EAAE,gBAAgB;IAEzB,kBAAkB,EAAE,8BAA8B;IAClD,kBAAkB,EAAE,qCAAqC;IAEzD,wBAAwB,EAAE,gCAAgC;IAC1D,cAAc,EAAE,iBAAiB;IAGjC,wBAAwB,EAAE,EAAE;IAE5B,UAAU,EAAE,qCAAqC;CAClD,CAAC;AAMF,MAAM,UAAU,kBAAkB,CAAC,OAA2B,EAAE,MAAwB;IACtF,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,IAAI;YAEP,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QACnC,KAAK,QAAQ;YACX,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,UAAU,EAAE,CAAC;QACtD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;YACxC,OAAO;gBACL,eAAe,EAAE,QAAQ;gBAEzB,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAE3D,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5F,CAAC;QACJ,CAAC;QACD;YAGE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC"}

package/dist/sealed-key.d.ts

@@ -0,0 +1,29 @@
+import type { Logger } from "./observability/logger.js";
+export declare const SEALED_KEY_ALG = "libsodium-sealedbox-x25519";
+export interface SealedKeyOpener {
+    has(publicKeyId: string): boolean;
+    ids(): string[];
+    open(ciphertextB64: string, publicKeyId: string): string;
+}
+export interface SealedKeyStore extends SealedKeyOpener {
+    latest: {
+        publicKeyId: string;
+        publicKey: string;
+        createdAt: string;
+    };
+}
+export declare function deriveKeyId(publicKeyRaw: Uint8Array): string;
+export declare function ensureSealedKeyStore(dir: string, logger?: Logger): Promise<SealedKeyStore>;
+export declare function reportExecutionPublicKey(opts: {
+    baseUrl?: string;
+    adminToken?: string;
+    key: {
+        publicKeyId: string;
+        publicKey: string;
+        createdAt: string;
+    };
+    notes?: string;
+    logger?: Logger;
+    fetchImpl?: typeof fetch;
+}): Promise<void>;
+//# sourceMappingURL=sealed-key.d.ts.map

package/dist/sealed-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-key.d.ts","sourceRoot":"","sources":["../src/sealed-key.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAIxD,eAAO,MAAM,cAAc,+BAA+B,CAAC;AAQ3D,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAElC,GAAG,IAAI,MAAM,EAAE,CAAC;IAKhB,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1D;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IAIrD,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAgBD,wBAAgB,WAAW,CAAC,YAAY,EAAE,UAAU,GAAG,MAAM,CAE5D;AAcD,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAoEhG;AAYD,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IAEnD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0ChB"}

package/dist/sealed-key.js

@@ -0,0 +1,122 @@
+import { createHash } from "node:crypto";
+import { chmod, mkdir, readdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import _sodium from "libsodium-wrappers";
+export const SEALED_KEY_ALG = "libsodium-sealedbox-x25519";
+const SEAL_OVERHEAD_BYTES = 48;
+const BASE64_STRICT = /^[A-Za-z0-9+/]+={0,2}$/;
+export function deriveKeyId(publicKeyRaw) {
+    return `exec-${createHash("sha256").update(publicKeyRaw).digest("hex").slice(0, 12)}`;
+}
+function b64ToBytes(b64, what) {
+    if (!BASE64_STRICT.test(b64) || b64.length % 4 !== 0)
+        throw new Error(`${what}: not valid base64`);
+    return new Uint8Array(Buffer.from(b64, "base64"));
+}
+export async function ensureSealedKeyStore(dir, logger) {
+    await _sodium.ready;
+    const sodium = _sodium;
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await chmod(dir, 0o700);
+    const keys = new Map();
+    for (const name of (await readdir(dir)).filter((n) => n.endsWith(".json")).sort()) {
+        const path = join(dir, name);
+        try {
+            const raw = JSON.parse(await readFile(path, "utf8"));
+            if (raw.alg !== SEALED_KEY_ALG || typeof raw.publicKey !== "string" || typeof raw.privateKey !== "string" || typeof raw.publicKeyId !== "string") {
+                throw new Error("missing/unsupported fields");
+            }
+            const publicKey = b64ToBytes(raw.publicKey, "publicKey");
+            const privateKey = b64ToBytes(raw.privateKey, "privateKey");
+            if (publicKey.length !== sodium.crypto_box_PUBLICKEYBYTES || privateKey.length !== sodium.crypto_box_SECRETKEYBYTES)
+                throw new Error("bad key length");
+            if (name !== `${raw.publicKeyId}.json`)
+                logger?.warn("sealed_key_filename_drift", { file: name, publicKeyId: raw.publicKeyId, note: "content publicKeyId wins; rename the file to silence this" });
+            if (keys.has(raw.publicKeyId)) {
+                logger?.warn("sealed_key_duplicate_id", { file: name, publicKeyId: raw.publicKeyId, note: "duplicate publicKeyId — keeping the first, skipping this file" });
+                continue;
+            }
+            keys.set(raw.publicKeyId, { publicKey, privateKey, publicKeyB64: raw.publicKey, createdAt: typeof raw.createdAt === "string" ? raw.createdAt : "" });
+        }
+        catch (err) {
+            logger?.warn("sealed_key_file_unreadable", { file: path, errKind: err instanceof Error ? err.name : "unknown", note: "skipped (NOT deleted) — ciphertexts sealed for this key will fail loud per-model" });
+        }
+    }
+    if (keys.size === 0) {
+        const kp = sodium.crypto_box_keypair();
+        const publicKeyB64 = Buffer.from(kp.publicKey).toString("base64");
+        const record = {
+            v: 1,
+            alg: SEALED_KEY_ALG,
+            publicKeyId: deriveKeyId(kp.publicKey),
+            publicKey: publicKeyB64,
+            privateKey: Buffer.from(kp.privateKey).toString("base64"),
+            createdAt: new Date().toISOString(),
+        };
+        const path = join(dir, `${record.publicKeyId}.json`);
+        await writeFile(path, JSON.stringify(record, null, 2) + "\n", { mode: 0o600 });
+        await chmod(path, 0o600);
+        keys.set(record.publicKeyId, { publicKey: kp.publicKey, privateKey: kp.privateKey, publicKeyB64, createdAt: record.createdAt });
+        logger?.info("sealed_key_generated", { publicKeyId: record.publicKeyId, publicKey: publicKeyB64, dir, note: "new X25519 sealed-box keypair — register the PUBLIC key with the registry (see sealed_key_public_key)" });
+    }
+    const latestEntry = [...keys.entries()].sort((a, b) => (a[1].createdAt < b[1].createdAt ? 1 : a[1].createdAt > b[1].createdAt ? -1 : a[0] < b[0] ? -1 : 1))[0];
+    return {
+        latest: { publicKeyId: latestEntry[0], publicKey: latestEntry[1].publicKeyB64, createdAt: latestEntry[1].createdAt },
+        has: (id) => keys.has(id),
+        ids: () => [...keys.keys()],
+        open: (ciphertextB64, publicKeyId) => {
+            const key = keys.get(publicKeyId);
+            if (!key)
+                throw new Error(`no private key for publicKeyId "${publicKeyId}" (held: ${[...keys.keys()].join(", ") || "none"})`);
+            const ciphertext = b64ToBytes(ciphertextB64, "ciphertext");
+            if (ciphertext.length < SEAL_OVERHEAD_BYTES)
+                throw new Error(`ciphertext too short (${ciphertext.length}B < sealed-box ${SEAL_OVERHEAD_BYTES}B overhead)`);
+            return sodium.to_string(sodium.crypto_box_seal_open(ciphertext, key.publicKey, key.privateKey));
+        },
+    };
+}
+export async function reportExecutionPublicKey(opts) {
+    const { baseUrl, adminToken, key, notes, logger } = opts;
+    const manual = (why) => {
+        logger?.warn("sealed_key_public_key", {
+            publicKeyId: key.publicKeyId,
+            publicKey: key.publicKey,
+            alg: SEALED_KEY_ALG,
+            createdAt: key.createdAt,
+            why,
+            register: `POST ${baseUrl ?? "<registry>"}/api/config/execution-keys (admin token) body {"publicKey":"${key.publicKey}","publicKeyId":"${key.publicKeyId}"}`,
+            note: "until an admin registers this public key, web-pasted (sealed) api keys cannot target this host",
+        });
+    };
+    if (!baseUrl || !adminToken) {
+        manual(!baseUrl ? "no registry configured (SEMA_REGISTRY_URL unset)" : "no admin token (SEMA_REGISTRY_ADMIN_TOKEN unset; the worker's pull token cannot write execution keys)");
+        return;
+    }
+    try {
+        const doFetch = opts.fetchImpl ?? fetch;
+        const res = await doFetch(`${baseUrl.replace(/\/$/, "")}/api/config/execution-keys`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${adminToken}`, "content-type": "application/json" },
+            body: JSON.stringify({ publicKey: key.publicKey, publicKeyId: key.publicKeyId, ...(notes ? { notes } : {}) }),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (res.ok) {
+            let idempotent = false;
+            try {
+                idempotent = (await res.json())?.idempotent === true;
+            }
+            catch { }
+            logger?.info(idempotent ? "sealed_key_already_registered" : "sealed_key_reported", { publicKeyId: key.publicKeyId, status: res.status });
+        }
+        else if (res.status === 409) {
+            manual("registry returned 409 (concurrent write; will re-report on next boot)");
+        }
+        else {
+            manual(`registry rejected the report (HTTP ${res.status})`);
+        }
+    }
+    catch (err) {
+        manual(`registry unreachable: ${String(err)}`);
+    }
+}
+//# sourceMappingURL=sealed-key.js.map

package/dist/sealed-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-key.js","sourceRoot":"","sources":["../src/sealed-key.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,OAAO,MAAM,oBAAoB,CAAC;AAKzC,MAAM,CAAC,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAE3D,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAG/B,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAmC/C,MAAM,UAAU,WAAW,CAAC,YAAwB;IAClD,OAAO,QAAQ,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY;IAC3C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACnG,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAW,EAAE,MAAe;IACrE,MAAM,OAAO,CAAC,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,OAAO,CAAC;IACvB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAExB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsG,CAAC;IAC3H,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAyB,CAAC;YAC7E,IAAI,GAAG,CAAC,GAAG,KAAK,cAAc,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACjJ,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAC5D,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,yBAAyB,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,yBAAyB;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAGvJ,IAAI,IAAI,KAAK,GAAG,GAAG,CAAC,WAAW,OAAO;gBAAE,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,2DAA2D,EAAE,CAAC,CAAC;YACnM,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9B,MAAM,EAAE,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,+DAA+D,EAAE,CAAC,CAAC;gBAC7J,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAKb,MAAM,EAAE,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,kFAAkF,EAAE,CAAC,CAAC;QAC7M,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClE,MAAM,MAAM,GAAgB;YAC1B,CAAC,EAAE,CAAC;YACJ,GAAG,EAAE,cAAc;YACnB,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,SAAS,CAAC;YACtC,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,OAAO,CAAC,CAAC;QACrD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAChI,MAAM,EAAE,IAAI,CAAC,sBAAsB,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,uGAAuG,EAAE,CAAC,CAAC;IACzN,CAAC;IAGD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IAEhK,OAAO;QACL,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE;QACpH,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,WAAW,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;YAC9H,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,MAAM,GAAG,mBAAmB;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,CAAC,MAAM,kBAAkB,mBAAmB,aAAa,CAAC,CAAC;YAE3J,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,oBAAoB,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAClG,CAAC;KACF,CAAC;AACJ,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAU9C;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAQ,EAAE;QAEnC,MAAM,EAAE,IAAI,CAAC,uBAAuB,EAAE;YACpC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,GAAG,EAAE,cAAc;YACnB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,GAAG;YACH,QAAQ,EAAE,QAAQ,OAAO,IAAI,YAAY,+DAA+D,GAAG,CAAC,SAAS,oBAAoB,GAAG,CAAC,WAAW,IAAI;YAC5J,IAAI,EAAE,gGAAgG;SACvG,CAAC,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,uGAAuG,CAAC,CAAC;QAChL,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,4BAA4B,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACtF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7G,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YAEX,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC;gBAAC,UAAU,GAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,EAAE,UAAU,KAAK,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAA+B,CAAC;YACnI,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,qBAAqB,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3I,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAG9B,MAAM,CAAC,uEAAuE,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YAEN,MAAM,CAAC,sCAAsC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,yBAAyB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/security.d.ts

@@ -0,0 +1,153 @@
+import type { IncomingMessage } from "node:http";
+import { FileMemoryEngineBackend, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
+import type { ServiceConfig } from "./config.js";
+import type { TaskRequestBody } from "./http/server.js";
+import type { StagingHandle } from "./session-sync.js";
+export interface SessionListItem {
+    sessionId: string;
+    owner: string | null;
+    lastActivityAt: string;
+    firstActivityAt: string;
+    runCount: number;
+    objectivePreview: string | null;
+    lastStatus: string;
+    lastRunId: string | null;
+    title: string | null;
+}
+export type OwnerAwareSessionStore = SessionStore & {
+    ownerOf?: (sessionId: string) => Promise<string | null | undefined>;
+    register?: (sessionId: string, owner: string | null) => Promise<void>;
+    listSessions?: (opts: {
+        owner?: string;
+        cursor?: {
+            lastActivityAt: string;
+            sessionId: string;
+        };
+        limit: number;
+        q?: string;
+    }) => Promise<SessionListItem[]>;
+    fork?: (sourceId: string, owner: string | null) => Promise<string | null>;
+    getLeafId?: (sessionId: string) => Promise<string | null>;
+    deleteSession?: (sessionId: string, owner: string | null) => Promise<boolean>;
+    exportEntries?: (sessionId: string) => Promise<SessionTreeEntry[] | null>;
+    listEntryIds?: (sessionId: string) => Promise<string[] | null>;
+    exportEntriesStream?: (sessionId: string, opts?: {
+        afterSeq?: number;
+        batchSize?: number;
+    }) => Promise<AsyncIterable<SessionTreeEntry> | null>;
+    importEntries?: (sessionId: string, owner: string | null, entries: SessionTreeEntry[]) => Promise<void>;
+    replaceEntries?: (sessionId: string, owner: string | null, entries: SessionTreeEntry[]) => Promise<void>;
+    beginImportStaging?: (realSessionId: string, token: string) => StagingHandle;
+    readStagedEntries?: (stagingId: string) => Promise<SessionTreeEntry[]>;
+    sweepStagingSessions?: () => Promise<number>;
+};
+export declare function isUuidV7(s: string): boolean;
+export declare function isUuidShape(s: string): boolean;
+export declare class HttpError extends Error {
+    readonly status: number;
+    readonly code?: string;
+    readonly extra?: Record<string, unknown>;
+    constructor(status: number, message: string, opts?: {
+        code?: string;
+        extra?: Record<string, unknown>;
+    });
+}
+export interface AuthContext {
+    principal?: string;
+    sessionId: string;
+    memoryScope?: string;
+    resolvedProjectId?: string;
+}
+export declare function createAuthorizer(config: ServiceConfig, sessionStore: OwnerAwareSessionStore): (ctx: {
+    req: IncomingMessage;
+    body: TaskRequestBody;
+}) => Promise<AuthContext>;
+export declare function principalFrom(req: IncomingMessage, config: ServiceConfig): string | undefined;
+export declare const PRINCIPAL_TOKEN_HEADER = "x-approval-principal-token";
+export declare function setSsoPrincipal(req: IncomingMessage, principal: string): void;
+export declare function ssoVerifiedPrincipal(req: IncomingMessage): string | undefined;
+export declare function setSsoScope(req: IncomingMessage, scope: string): void;
+export declare function ssoVerifiedScope(req: IncomingMessage): string | undefined;
+export declare function verifiedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
+export declare function memoryScopeFor(config: ServiceConfig, principal?: string, projectId?: string): string | undefined;
+export declare function memoryEngineRemoteLanePosture(config: ServiceConfig): {
+    lane: string;
+    posture: "dark" | "forced";
+} | undefined;
+export declare function memoryEngineBackendFor(config: ServiceConfig, fallbackRoot?: string): {
+    backend: FileMemoryEngineBackend;
+    root: string;
+} | undefined;
+export declare function memorySpecForRequest(scope: string | undefined, memoryWrite: boolean | undefined, defaultScopes?: string[]): {
+    scope: string;
+    scopes?: string[];
+    writeScope?: string | null;
+    scopeContract?: "v2";
+} | undefined;
+export interface ApprovalHmacKey {
+    kid: string;
+    key: string;
+    status?: "active" | "retiring";
+}
+export declare function parseApprovalHmacKeys(raw: string | undefined): ApprovalHmacKey[];
+export declare function approvalHmacMessage(env: {
+    sessionId: string;
+    boundCallId?: string | null;
+    boundInputHash?: string | null;
+    decision: string;
+}): string;
+export declare function verifyApprovalHmac(env: {
+    sessionId: string;
+    boundCallId?: string | null;
+    boundInputHash?: string | null;
+    decision: string;
+}, mac: string, kid: string | undefined, keys: ApprovalHmacKey[]): boolean;
+export interface PrincipalJwtKey {
+    kid: string;
+    alg: "EdDSA" | "RS256" | "ES256";
+    key: string;
+    status?: "active" | "retiring";
+}
+export declare function parsePrincipalJwks(raw: string | undefined): PrincipalJwtKey[];
+export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[], expect: {
+    iss: string;
+    aud: string;
+    nowSec?: number;
+    skewSec?: number;
+    maxTtlSec?: number;
+}): {
+    sub: string;
+    bnd?: string;
+} | null;
+export declare function approvalBnd(env: {
+    sessionId: string;
+    boundCallId?: string | null;
+    boundInputHash?: string | null;
+}): string;
+export declare function verifyDirectDoorProof(proof: {
+    jwt?: string;
+    mac?: string;
+    kid?: string;
+}, envelope: {
+    sessionId: string;
+    boundCallId?: string | null;
+    boundInputHash?: string | null;
+    decision: string;
+}, config: {
+    principalJwtPubkeys: PrincipalJwtKey[];
+    principalJwtIss?: string;
+    principalJwtAud?: string;
+    principalJwtMaxTtlSec?: number;
+    approvalHmacKeys: ApprovalHmacKey[];
+}, opts?: {
+    actionBinding?: boolean;
+}): {
+    ok: true;
+    principal: string;
+} | {
+    ok: false;
+    status: number;
+    errorCode: string;
+    error: string;
+};
+//# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGjD,OAAO,EAAU,uBAAuB,EAAoF,KAAK,YAAY,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/L,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAKD,MAAM,MAAM,sBAAsB,GAAG,YAAY,GAAG;IAClD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACpE,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,cAAc,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE3J,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG1E,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAK1D,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAG9E,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,EAAE,GAAG,IAAI,CAAC,CAAC;IAK1E,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAS/D,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC;IAI/I,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAIxG,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKzG,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,aAAa,CAAC;IAM7E,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAIvE,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C,CAAC;AAkBF,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAE3C;AAQD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAE9C;AAMD,qBAAa,SAAU,SAAQ,KAAK;IAIhC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAHzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAE9B,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE;CAO5D;AAMD,MAAM,WAAW,WAAW;IAE1B,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAiBD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,sBAAsB,GACnC,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAuFhF;AAGD,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAI7F;AAID,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AAYnE,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAE7E;AACD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAG7E;AAMD,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAErE;AACD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAGzE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAajG;AAaD,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAsBhH;AAcD,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,aAAa,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAA;CAAE,GAAG,SAAS,CAI1D;AAoBD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB;IAAE,OAAO,EAAE,uBAAuB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAYhE;AAUD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,WAAW,EAAE,OAAO,GAAG,SAAS,EAChC,aAAa,CAAC,EAAE,MAAM,EAAE,GACvB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAkBpG;AAeD,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CAChC;AAID,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,eAAe,EAAE,CAShF;AAOD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAErJ;AAQD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACzG,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,eAAe,EAAE,GACtB,OAAO,CAgBT;AAYD,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CAChC;AAID,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,eAAe,EAAE,CAa7E;AAyBD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,eAAe,EAAE,EACvB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1F;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA6CtC;AAKD,wBAAgB,WAAW,CAAC,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,MAAM,CAE3H;AAiBD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACnD,QAAQ,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC9G,MAAM,EAAE;IAAE,mBAAmB,EAAE,eAAe,EAAE,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,eAAe,EAAE,CAAA;CAAE,EAC3K,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAkBnG"}