@synoikia/core 0.1.0

package/dist/gate/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../src/gate/pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAExH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAkDvD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAqB,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,WAAW,CAAC;AAE5G,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,mBAAmB;IACnB,gBAAgB;IAChB,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,GAAG,YAAY,YAAY;QAAE,OAAO,GAAG,CAAC;IAC5C,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;QAChF,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,GAAG,YAAY,sBAAsB;QACvC,OAAO,IAAI,YAAY,CAAC,oBAAoB,EAAE,8CAA8C,CAAC,CAAC;IAChG,IAAI,GAAG,YAAY,kBAAkB;QAAE,OAAO,IAAI,YAAY,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAChG,IAAI,GAAG,YAAY,mBAAmB;QACpC,OAAO,IAAI,YAAY,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;IACrF,OAAO,IAAI,YAAY,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,iBAAiB,GAA2B;IAChD,aAAa,EAAE,mCAAmC;IAClD,UAAU,EAAE,kDAAkD;IAC9D,SAAS,EAAE,2DAA2D;IACtE,eAAe,EAAE,8DAA8D;IAC/E,mBAAmB,EAAE,iEAAiE;IACtF,iBAAiB,EAAE,+BAA+B;CACnD,CAAC;AAEF,2DAA2D;AAC3D,MAAM,SAAS,GAAG,CAAC,OAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAEhH,MAAM,eAAe,GAA2B;IAC9C,gBAAgB,EAAE,kEAAkE;IACpF,qBAAqB,EACnB,0HAA0H;IAC5H,QAAQ,EAAE,4BAA4B;IACtC,aAAa,EAAE,mEAAmE;IAClF,qBAAqB,EAAE,oCAAoC;IAC3D,gBAAgB,EAAE,sFAAsF;CACzG,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAc,EACd,EAAmB,EACnB,MAAqB,EACrB,SAAsB,IAAI,eAAe,EAAE,CAAC,MAAM;IAElD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IACjC,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;QACpC,KAAK,MAAM,EAAE,IAAI,aAAa;YAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GACd,CAAC,EAAU,EAAW,EAAE,CACxB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEJ,KAAK,UAAU,SAAS,CAAC,EAAU,EAAE,IAAe,EAAE,MAAqB;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAqD;YAC9D,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,SAAS,EAAE,YAAY;YACvB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;YACzB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;SAC5B,CAAC;QACF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,QAAqE,EAAE,EAAE,EAAE;YAC3G,OAAO,GAAG,IAAI,CAAC;YACf,UAAU,CACR,IAAI,CAAC,EAAE,EACP;gBACE,GAAG,KAAK;gBACR,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;gBACxC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE;aAC7C,EACD,GAAG,EAAE,CACN,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,GAAiB,EAAS,EAAE;YAC5D,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,GAAG,EAAE;YACzB,IAAI,MAAM,CAAC,OAAO;gBAChB,MAAM,CACJ,0BAA0B,EAC1B,IAAI,YAAY,CAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAC1F,CAAC;QACN,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,aAAa,EAAE,CAAC;YAEhB,gGAAgG;YAChG,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE;iBACf,MAAM,EAAE;iBACR,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;iBACtF,GAAG,EAA8B,CAAC;YACrC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAE1C,2EAA2E;YAC3E,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,mBAAmB,EAAE,CAAC;gBAC9C,MAAM,SAAS,GAAI,QAAQ,CAAC,MAAiD,EAAE,iBAAiB,CAAC;gBACjG,IACE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE;oBAClD,UAAU,EAAE,EAAE,CAAC,UAAU;oBACzB,WAAW,EAAE,EAAE,CAAC,EAAE;oBAClB,KAAK,EAAE,EAAE,CAAC,GAAG;oBACb,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,SAAS;iBACV,CAAC,EACF,CAAC;oBACD,MAAM,CACJ,+BAA+B,EAC/B,IAAI,YAAY,CACd,sBAAsB,EACtB,yBAAyB,EAAE,CAAC,GAAG,6CAA6C,CAC7E,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,gGAAgG;YAChG,8BAA8B;YAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrF,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtE,MAAM,CACJ,YAAY,MAAM,EAAE,EACpB,MAAM,CAAC,MAAM,CACX,IAAI,YAAY,CACd,oBAAoB,EACpB,GAAG,QAAQ,CAAC,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,kBAAkB,EAAE,CACrE,EACD,EAAE,MAAM,EAAE,CACX,CACF,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,EAAG,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YACpD,MAAM,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC;YAC/B,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC;YAE9E,8FAA8F;YAC9F,IAAI,OAAO,GAAqB,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBACrC,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpG,KAAK,CAAC,eAAe,GAAG,OAAO,CAAC;YAClC,CAAC;YAED,iFAAiF;YACjF,IAAI,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC7B,IAAI,IAAa,CAAC;YAClB,IAAI,YAAgC,CAAC;YACrC,IAAI,OAAO,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxF,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACzB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACrB,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;YACvC,CAAC;YAED,8BAA8B;YAC9B,IAAI,QAAQ,GAAG,eAAe,CAAC;YAC/B,IAAI,QAA8B,CAAC;YACnC,+FAA+F;YAC/F,oEAAoE;YACpE,MAAM,WAAW,GAAG,SAAS,EAAE,CAAC,UAAU,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,MAAM,eAAe,GAAG,GAAG,EAAE,CAC3B,MAAM,CAAC,uBAAuB,EAAE,IAAI,YAAY,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC,CAAC;YACvG,IAAI,OAAO,EAAE,CAAC;gBACZ,wFAAwF;gBACxF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;oBAAE,eAAe,EAAE,CAAC;gBAE9F,kGAAkG;gBAClG,oFAAoF;gBACpF,IAAI,WAAW,GAAG,KAAK,CAAC;gBACxB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACpB,WAAW,GAAG,IAAI,CAAC;oBACnB,QAAQ,GAAG,qBAAqB,CAAC;gBACnC,CAAC;qBAAM,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;oBAC3E,MAAM,OAAO,GAAG,mBAAmB,CACjC,IAAI,CAAC,EAAE,EACP,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EACzE,GAAG,EAAE,CACN,CAAC;oBACF,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;wBACrC,WAAW,GAAG,IAAI,CAAC;wBACnB,QAAQ,GAAG,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC;oBACpD,CAAC;yBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;wBAC3C,KAAK,CAAC,MAAM,CAAC,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;oBAClD,CAAC;gBACH,CAAC;gBAED,iEAAiE;gBACjE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,2FAA2F;oBAC3F,8DAA8D;oBAC9D,MAAM,OAAO,GAAG,MAAM,EAAE;yBACrB,MAAM,EAAE;yBACR,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;oBACjF,IAAI,SAAS,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;wBAC3D,MAAM,CACJ,uCAAuC,EACvC,IAAI,YAAY,CAAC,cAAc,EAAE,uDAAuD,SAAS,CAAC,GAAG,EAAE,CAAC,CACzG,CAAC;oBACJ,CAAC;oBACD,aAAa,EAAE,CAAC;oBAChB,MAAM,UAAU,GAAG,SAAS,CAC1B,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC,CAC3F,CAAC;oBACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;wBACrC,UAAU,EAAE,EAAE,CAAC,UAAU;wBACzB,WAAW,EAAE,SAAS,CAAC,EAAE;wBACzB,YAAY,EAAE,SAAS,CAAC,GAAG;wBAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;wBACpC,aAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;wBAChC,UAAU;wBACV,eAAe,EAAE,OAAO;wBACxB,OAAO,EAAE,OAAO,CAAC,IAAI;wBACrB,cAAc,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;wBAChF,IAAI;wBACJ,YAAY;wBACZ,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,iBAAiB;wBACxC,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,aAAa,EACX,EAAE,CAAC,QAAQ,CAAC,wBAAwB,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB;qBACzG,CAAC,CAAC;oBACH,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC;oBACrC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC9B,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;oBACpC,CAAC;4BAAS,CAAC;wBACT,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBACjC,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,CAAC;oBACD,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;oBACrC,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC;oBAChC,IAAI,QAAQ,CAAC,OAAO,KAAK,WAAW,IAAI,MAAM,CAAC,OAAO;wBAAE,aAAa,EAAE,CAAC;oBACxE,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;wBACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;wBACxE,MAAM,CACJ,KAAK,EACL,IAAI,YAAY,CACd,mBAAmB,EACnB,QAAQ,CAAC,OAAO,KAAK,WAAW;4BAC9B,CAAC,CAAC,gBAAgB,SAAS,CAAC,GAAG,2BAA2B;4BAC1D,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,aAAa,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CACjJ,CACF,CAAC;oBACJ,CAAC;oBACD,oGAAoG;oBACpG,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBACrF,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;wBAC7C,MAAM,CACJ,yBAAyB,EACzB,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,SAAS,CAAC,GAAG,0CAA0C,CAAC,CACnG,CAAC;oBACJ,CAAC;oBACD,QAAQ,GAAG,gBAAgB,CAAC;gBAC9B,CAAC;YACH,CAAC;YAED,mGAAmG;YACnG,kGAAkG;YAClG,aAAa,EAAE,CAAC;YAChB,IAAI,QAAQ,KAAK,gBAAgB,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBACtE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrF,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1C,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;oBAC9B,MAAM,CACJ,0BAA0B,EAC1B,IAAI,YAAY,CACd,iBAAiB,EACjB,QAAQ,SAAS,CAAC,GAAG,2FAA2F,CACjH,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uEAAuE;YACvE,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;gBAAE,eAAe,EAAE,CAAC;YACvG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CACnC,QAAQ,EACR;gBACE,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,MAAM;gBACN,OAAO,EAAE;oBACP,MAAM,EAAE,UAAU,EAAE;oBACpB,YAAY;oBACZ,UAAU,EAAE,SAAS;oBACrB,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD;aACF,EACD,SAAS,CACV,CAAC;YAEF,mCAAmC;YACnC,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAChC,8FAA8F;YAC9F,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAG,GAA2B,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,kGAAkG;YAClG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzG,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,MAAM,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO;QACL,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,WAAW,CACjD,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAChE;KACF,CAAC;AACJ,CAAC"}

package/dist/gate/preapproval.d.ts

@@ -0,0 +1,24 @@
+import type { ResolvedTarget } from '@synoikia/plugin-sdk';
+import type { Db } from '../db/index.js';
+export type PreApprovalOutcome = {
+    kind: 'auto_approved';
+    ruleId: string;
+}
+/** Rules matched but all were at their rate limit: the call falls back to a human (TN §3.5). */
+ | {
+    kind: 'rate_limited';
+    ruleIds: string[];
+} | {
+    kind: 'no_match';
+};
+/**
+ * Finds an enabled, unexpired rule for the operation whose match holds and which has rate budget left,
+ * and records the hit, all in one transaction so concurrent calls can't overshoot a limit. Callers
+ * must never pass a locked operation (design §5.2 step 6); rules on locked ops are also disabled at sync.
+ */
+export declare function evaluatePreApproval(db: Db, input: {
+    instanceId: string;
+    operationId: string;
+    params: unknown;
+    targets: readonly ResolvedTarget[];
+}, now?: Date): PreApprovalOutcome;

package/dist/gate/preapproval.js

@@ -0,0 +1,48 @@
+import { and, asc, count, eq, gt } from 'drizzle-orm';
+import { preApprovalHits, preApprovalRules } from '../db/schema.js';
+import { conditionsHold, coversAllParams, MatchSchema } from './match.js';
+/**
+ * Finds an enabled, unexpired rule for the operation whose match holds and which has rate budget left,
+ * and records the hit, all in one transaction so concurrent calls can't overshoot a limit. Callers
+ * must never pass a locked operation (design §5.2 step 6); rules on locked ops are also disabled at sync.
+ */
+export function evaluatePreApproval(db, input, now = new Date()) {
+    return db.transaction((tx) => {
+        const rules = tx
+            .select()
+            .from(preApprovalRules)
+            .where(and(eq(preApprovalRules.instanceId, input.instanceId), eq(preApprovalRules.operationId, input.operationId), eq(preApprovalRules.enabled, true)))
+            .orderBy(asc(preApprovalRules.createdAt))
+            .all();
+        const limited = [];
+        for (const rule of rules) {
+            if (rule.expiresAt && rule.expiresAt.getTime() <= now.getTime())
+                continue;
+            const match = MatchSchema.safeParse(rule.match);
+            if (!match.success || !conditionsHold(match.data, { params: input.params, targets: input.targets }))
+                continue;
+            if (!coversAllParams(match.data, input.params)) {
+                // It would have matched before strict matching: remember it so the rule list can say why.
+                tx.update(preApprovalRules).set({ strictMissAt: now }).where(eq(preApprovalRules.id, rule.id)).run();
+                continue;
+            }
+            if (rule.rateLimit != null) {
+                const windowMs = (rule.windowSeconds ?? 3600) * 1000;
+                const used = tx
+                    .select({ n: count() })
+                    .from(preApprovalHits)
+                    .where(and(eq(preApprovalHits.ruleId, rule.id), gt(preApprovalHits.occurredAt, new Date(now.getTime() - windowMs))))
+                    .get()?.n ?? 0;
+                if (used >= rule.rateLimit) {
+                    limited.push(rule.id);
+                    continue;
+                }
+            }
+            tx.insert(preApprovalHits).values({ ruleId: rule.id, occurredAt: now }).run();
+            tx.update(preApprovalRules).set({ lastTriggeredAt: now }).where(eq(preApprovalRules.id, rule.id)).run();
+            return { kind: 'auto_approved', ruleId: rule.id };
+        }
+        return limited.length > 0 ? { kind: 'rate_limited', ruleIds: limited } : { kind: 'no_match' };
+    });
+}
+//# sourceMappingURL=preapproval.js.map

package/dist/gate/preapproval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preapproval.js","sourceRoot":"","sources":["../../src/gate/preapproval.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQ1E;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAM,EACN,KAAuG,EACvG,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,EAAE;aACb,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EACjD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EACnD,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CACnC,CACF;aACA,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;aACxC,GAAG,EAAE,CAAC;QAET,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAE,SAAS;YAC9G,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,0FAA0F;gBAC1F,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACrG,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;gBACrD,MAAM,IAAI,GACR,EAAE;qBACC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;qBACtB,IAAI,CAAC,eAAe,CAAC;qBACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,EACnC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CACnE,CACF;qBACA,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACtB,SAAS;gBACX,CAAC;YACH,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9E,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACxG,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/gate/rate-limit.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Sliding windows of hit timestamps per key, bounded in memory: keys whose window has passed are
+ * dropped, and past `maxKeys` the keys with the fewest hits go first. Callers keyed by anything a client
+ * chooses (usernames, IPs, principals) can't grow it without limit.
+ */
+export declare class HitWindows {
+    private readonly now;
+    private readonly maxKeys;
+    private readonly map;
+    constructor(now?: () => number, maxKeys?: number);
+    get size(): number;
+    /** Hits for `key` within the window (oldest first). */
+    recent(key: string, windowMs: number): number[];
+    add(key: string, windowMs: number): number[];
+    delete(key: string): void;
+    /**
+     * Drops keys whose window has passed, then the keys with the fewest hits (oldest first among equals),
+     * down to 90% of the cap. A flood of one-off keys therefore can't push out a key that is close to or
+     * at its limit, such as a username that is locked out.
+     */
+    private prune;
+}
+/**
+ * In-memory sliding-window limiter for per-instance execute/write caps (design §5.2). Separate from
+ * pre-approval rule limits, which are persisted in `pre_approval_hits`.
+ */
+export declare class SlidingWindowLimiter {
+    private readonly hits;
+    constructor(now?: () => number, maxKeys?: number);
+    get size(): number;
+    /** Whether one more hit would fit, without recording it. */
+    allows(key: string, limit: number, windowMs: number): boolean;
+    /** Records a hit and returns true if it fits within `limit` per `windowMs`; otherwise records nothing. */
+    take(key: string, limit: number, windowMs: number): boolean;
+}

package/dist/gate/rate-limit.js

@@ -0,0 +1,82 @@
+/**
+ * Sliding windows of hit timestamps per key, bounded in memory: keys whose window has passed are
+ * dropped, and past `maxKeys` the keys with the fewest hits go first. Callers keyed by anything a client
+ * chooses (usernames, IPs, principals) can't grow it without limit.
+ */
+export class HitWindows {
+    now;
+    maxKeys;
+    map = new Map();
+    constructor(now = Date.now, maxKeys = 10_000) {
+        this.now = now;
+        this.maxKeys = maxKeys;
+    }
+    get size() {
+        return this.map.size;
+    }
+    /** Hits for `key` within the window (oldest first). */
+    recent(key, windowMs) {
+        const entry = this.map.get(key);
+        if (!entry)
+            return [];
+        const t = this.now();
+        const hits = entry.hits.filter((h) => h > t - windowMs);
+        this.map.delete(key);
+        if (hits.length)
+            this.map.set(key, { hits, windowMs }); // re-insert: most recently used last
+        return hits;
+    }
+    add(key, windowMs) {
+        const hits = [...this.recent(key, windowMs), this.now()];
+        this.map.set(key, { hits, windowMs });
+        if (this.map.size > this.maxKeys)
+            this.prune();
+        return hits;
+    }
+    delete(key) {
+        this.map.delete(key);
+    }
+    /**
+     * Drops keys whose window has passed, then the keys with the fewest hits (oldest first among equals),
+     * down to 90% of the cap. A flood of one-off keys therefore can't push out a key that is close to or
+     * at its limit, such as a username that is locked out.
+     */
+    prune() {
+        const t = this.now();
+        for (const [k, e] of this.map)
+            if (e.hits.at(-1) <= t - e.windowMs)
+                this.map.delete(k);
+        const target = Math.floor(this.maxKeys * 0.9);
+        if (this.map.size <= target)
+            return;
+        const byHits = [...this.map].map(([k, e], order) => ({ k, n: e.hits.length, order }));
+        byHits.sort((a, b) => a.n - b.n || a.order - b.order);
+        for (const { k } of byHits.slice(0, this.map.size - target))
+            this.map.delete(k);
+    }
+}
+/**
+ * In-memory sliding-window limiter for per-instance execute/write caps (design §5.2). Separate from
+ * pre-approval rule limits, which are persisted in `pre_approval_hits`.
+ */
+export class SlidingWindowLimiter {
+    hits;
+    constructor(now = Date.now, maxKeys) {
+        this.hits = new HitWindows(now, maxKeys);
+    }
+    get size() {
+        return this.hits.size;
+    }
+    /** Whether one more hit would fit, without recording it. */
+    allows(key, limit, windowMs) {
+        return this.hits.recent(key, windowMs).length < limit;
+    }
+    /** Records a hit and returns true if it fits within `limit` per `windowMs`; otherwise records nothing. */
+    take(key, limit, windowMs) {
+        if (this.hits.recent(key, windowMs).length >= limit)
+            return false;
+        this.hits.add(key, windowMs);
+        return true;
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/gate/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/gate/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,UAAU;IAIF;IACA;IAJF,GAAG,GAAG,IAAI,GAAG,EAAgD,CAAC;IAE/E,YACmB,MAAoB,IAAI,CAAC,GAAG,EAC5B,UAAU,MAAM;QADhB,QAAG,GAAH,GAAG,CAAyB;QAC5B,YAAO,GAAP,OAAO,CAAS;IAChC,CAAC;IAEJ,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,uDAAuD;IACvD,MAAM,CAAC,GAAW,EAAE,QAAgB;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,qCAAqC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,QAAgB;QAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACK,KAAK;QACX,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM;YAAE,OAAO;QACpC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IACd,IAAI,CAAa;IAElC,YAAY,MAAoB,IAAI,CAAC,GAAG,EAAE,OAAgB;QACxD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,4DAA4D;IAC5D,MAAM,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC;IACxD,CAAC;IAED,0GAA0G;IAC1G,IAAI,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;QAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,MAAM,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/gate/redact.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Redaction (design §5.5): replaces values under sensitive keys before anything reaches the model,
+ * the audit log, pending approvals or the portal. Keys match case-insensitively, ignoring `_`/`-`,
+ * so `apiKey`, `api_key` and `API-KEY` are one rule.
+ *
+ * A key matches a rule exactly, or by containing it (`db_password`, `X-Api-Key`, `ssh_private_key`);
+ * rules shorter than five characters (`pass`, `pwd`) only match as the key's last word (`smtp_pass`,
+ * `authPass`), so words like `bypass` or `passive` stay visible. Under a contained match, booleans and numbers stay visible
+ * (`password_set: true`, `max_tokens: 4096`); under an exact match every non-empty value is hidden.
+ */
+export declare const REDACTED = "[REDACTED]";
+export declare const GLOBAL_SENSITIVE_KEYS: string[];
+export type Redactor = <T>(value: T) => T;
+export declare function createRedactor(...keyLists: (readonly string[] | undefined)[]): Redactor;
+/**
+ * The redactor for one instance: values under sensitive keys, plus the instance's actual secret values
+ * wherever they appear inside a string (log lines, previews, error messages, notification text), since
+ * text has no keys to go by.
+ */
+export declare function createInstanceRedactor(opts: {
+    keyLists: (readonly string[] | undefined)[];
+    secretValues?: readonly string[];
+}): Redactor;

package/dist/gate/redact.js

@@ -0,0 +1,87 @@
+/**
+ * Redaction (design §5.5): replaces values under sensitive keys before anything reaches the model,
+ * the audit log, pending approvals or the portal. Keys match case-insensitively, ignoring `_`/`-`,
+ * so `apiKey`, `api_key` and `API-KEY` are one rule.
+ *
+ * A key matches a rule exactly, or by containing it (`db_password`, `X-Api-Key`, `ssh_private_key`);
+ * rules shorter than five characters (`pass`, `pwd`) only match as the key's last word (`smtp_pass`,
+ * `authPass`), so words like `bypass` or `passive` stay visible. Under a contained match, booleans and numbers stay visible
+ * (`password_set: true`, `max_tokens: 4096`); under an exact match every non-empty value is hidden.
+ */
+export const REDACTED = '[REDACTED]';
+export const GLOBAL_SENSITIVE_KEYS = [
+    'password',
+    'passphrase',
+    'secret',
+    'token',
+    'apiKey',
+    'privateKey',
+    'bindpw',
+    'authPass',
+    'accessToken',
+    'refreshToken',
+    'clientSecret',
+    'authorization',
+    'credential',
+    'cookie',
+    'passwd',
+    'pass',
+    'pwd',
+];
+const normalize = (key) => key.toLowerCase().replace(/[_-]/g, '');
+/** Secret values shorter than this are not scrubbed from text: too likely to match ordinary words. */
+const MIN_SCRUB_LENGTH = 6;
+export function createRedactor(...keyLists) {
+    return createInstanceRedactor({ keyLists });
+}
+/**
+ * The redactor for one instance: values under sensitive keys, plus the instance's actual secret values
+ * wherever they appear inside a string (log lines, previews, error messages, notification text), since
+ * text has no keys to go by.
+ */
+export function createInstanceRedactor(opts) {
+    const keys = new Set(opts.keyLists.flatMap((l) => l ?? []).map(normalize));
+    const rules = [...keys].filter((k) => k !== '');
+    /** 'exact' hides any value; 'contains' hides strings, objects and arrays only. */
+    const sensitivity = (key) => {
+        const k = normalize(key);
+        if (keys.has(k))
+            return 'exact';
+        const last = key
+            .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+            .toLowerCase()
+            .split(/[\s_.-]+/)
+            .at(-1);
+        return rules.some((r) => (r.length >= 5 ? k.includes(r) : last === r)) ? 'contains' : null;
+    };
+    const hide = (key, v) => {
+        if (v === null || v === undefined || v === '')
+            return false;
+        const how = sensitivity(key);
+        return how === 'exact' || (how === 'contains' && typeof v !== 'boolean' && typeof v !== 'number');
+    };
+    const needles = [
+        ...new Set((opts.secretValues ?? [])
+            .filter((v) => typeof v === 'string' && v.length >= MIN_SCRUB_LENGTH)
+            .flatMap((v) => [v, encodeURIComponent(v), JSON.stringify(v).slice(1, -1)])),
+    ].sort((a, b) => b.length - a.length);
+    const scrub = (text) => (needles.length ? needles.reduce((t, n) => t.split(n).join(REDACTED), text) : text);
+    const walk = (value, seen) => {
+        if (typeof value === 'string')
+            return scrub(value);
+        if (value === null || typeof value !== 'object')
+            return value;
+        if (seen.has(value))
+            return '[Circular]';
+        seen.add(value);
+        if (Array.isArray(value))
+            return value.map((v) => walk(v, seen));
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[scrub(k)] = hide(k, v) ? REDACTED : walk(v, seen);
+        }
+        return out;
+    };
+    return (value) => walk(value, new WeakSet());
+}
+//# sourceMappingURL=redact.js.map

package/dist/gate/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/gate/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,UAAU;IACV,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,KAAK;CACN,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAI1E,sGAAsG;AACtG,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,MAAM,UAAU,cAAc,CAAC,GAAG,QAA2C;IAC3E,OAAO,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAGtC;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChD,kFAAkF;IAClF,MAAM,WAAW,GAAG,CAAC,GAAW,EAA+B,EAAE;QAC/D,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QAChC,MAAM,IAAI,GAAG,GAAG;aACb,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;aACtC,WAAW,EAAE;aACb,KAAK,CAAC,UAAU,CAAC;aACjB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,CAAU,EAAE,EAAE;QACvC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5D,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpG,CAAC,CAAC;IACF,MAAM,OAAO,GAAG;QACd,GAAG,IAAI,GAAG,CACR,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;aACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,gBAAgB,CAAC;aACpE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAC9E;KACF,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,IAAqB,EAAW,EAAE;QAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO,CAAI,KAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,OAAO,EAAE,CAAM,CAAC;AAC1D,CAAC"}

package/dist/http/admin/auth.d.ts

@@ -0,0 +1,33 @@
+import type { Hono, MiddlewareHandler } from 'hono';
+import type { AppContext } from '../../app.js';
+import type { SessionLimits } from '../../auth/sessions.js';
+import type { UserRow } from '../../auth/users.js';
+/**
+ * Admin portal authentication over HTTP (design §6.1): session cookie, double-submit CSRF token plus
+ * Origin check on every state-changing request, login with an optional TOTP step, OIDC sign-in.
+ */
+export type AdminEnv = {
+    Variables: {
+        user: UserRow;
+        sessionRaw: string;
+    };
+};
+export declare const CSRF_COOKIE = "syn_csrf";
+export declare const CSRF_HEADER = "x-csrf-token";
+export declare function sessionLimits(ctx: AppContext): SessionLimits;
+export declare function localLoginEnabled(ctx: AppContext): boolean;
+/**
+ * While local login is off (setting, not the env override), single sign-on is the only way in: refuse
+ * any change that would leave it off or with no enabled user linked to it (design §6.1).
+ */
+export declare function assertSsoRemains(ctx: AppContext, change: {
+    oidcOff?: boolean;
+    losingUser?: string;
+}): void;
+/** Local-password users must have TOTP when the admin requires it (OIDC-only users rely on the IdP). */
+export declare function mustEnrollTotp(ctx: AppContext, user: UserRow): boolean;
+/** CSRF: double-submit token + Origin check for every state-changing request under /api and /auth. */
+export declare function csrfGuard(ctx: AppContext): MiddlewareHandler;
+export declare function requireUser(ctx: AppContext): MiddlewareHandler<AdminEnv>;
+export declare function registerAuthRoutes(app: Hono<AdminEnv>, ctx: AppContext): void;
+export declare function registerProfileRoutes(app: Hono<AdminEnv>, ctx: AppContext): void;