@weave_protocol/ward 0.1.0

package/dist/enforcer/index.js

@@ -0,0 +1,225 @@
+/**
+ * Runtime policy checks.
+ *
+ * The enforcer doesn't execute anything itself — it answers questions like
+ * "is this proposed file write allowed?" given a parsed WardPolicy. Hosts
+ * (Mund, Hundredmen, custom harnesses) plug this in at the right points in
+ * their agent loop.
+ *
+ * Decisions are explicit: ALLOW, DENY, REQUIRE_APPROVAL. Hosts decide what
+ * to do with a REQUIRE_APPROVAL result (human-in-the-loop, etc.).
+ */
+// ─────────────────────────────────────────────────────────
+// Filesystem
+// ─────────────────────────────────────────────────────────
+export function checkFilesystem(policy, op, path) {
+    const fs = policy.filesystem;
+    if (!fs)
+        return { decision: "allow", reason: "No filesystem policy declared (default allow)." };
+    // Deny rules take precedence
+    for (const rule of fs.deny || []) {
+        if (rule.op === op && matchGlob(path, rule.path)) {
+            return {
+                decision: "deny",
+                reason: `Denied by filesystem rule: ${rule.op} ${rule.path}`,
+                matchedRule: `${rule.op}: ${rule.path}`,
+                severity: "high",
+            };
+        }
+    }
+    // Allow rules
+    for (const rule of fs.allow || []) {
+        if (rule.op === op && matchGlob(path, rule.path)) {
+            return {
+                decision: "allow",
+                reason: `Allowed by filesystem rule: ${rule.op} ${rule.path}`,
+                matchedRule: `${rule.op}: ${rule.path}`,
+            };
+        }
+    }
+    const def = fs.default ?? "deny";
+    return {
+        decision: def,
+        reason: `No matching rule; default action is ${def}.`,
+        severity: def === "deny" ? "medium" : undefined,
+    };
+}
+// ─────────────────────────────────────────────────────────
+// Network
+// ─────────────────────────────────────────────────────────
+export function checkNetwork(policy, url, method = "GET") {
+    const net = policy.network;
+    if (!net)
+        return { decision: "allow", reason: "No network policy declared (default allow)." };
+    const matchesRule = (rule) => {
+        if (!matchGlob(url, rule.url))
+            return false;
+        if (rule.methods && rule.methods.length > 0 && !rule.methods.includes(method))
+            return false;
+        return true;
+    };
+    for (const rule of net.deny || []) {
+        if (matchesRule(rule)) {
+            return {
+                decision: "deny",
+                reason: `Denied by network rule: ${rule.url}`,
+                matchedRule: rule.url,
+                severity: "high",
+            };
+        }
+    }
+    for (const rule of net.allow || []) {
+        if (matchesRule(rule)) {
+            return {
+                decision: "allow",
+                reason: `Allowed by network rule: ${rule.url}`,
+                matchedRule: rule.url,
+            };
+        }
+    }
+    const def = net.default ?? "deny";
+    return {
+        decision: def,
+        reason: `No matching network rule; default action is ${def}.`,
+        severity: def === "deny" ? "medium" : undefined,
+    };
+}
+// ─────────────────────────────────────────────────────────
+// Capabilities (tools)
+// ─────────────────────────────────────────────────────────
+export function checkCapability(policy, toolName) {
+    const caps = policy.capabilities;
+    if (!caps)
+        return { decision: "allow", reason: "No capabilities policy declared (default allow)." };
+    if (caps.deny?.some((t) => t === toolName || matchGlob(toolName, t))) {
+        return {
+            decision: "deny",
+            reason: `Tool '${toolName}' is in the deny list.`,
+            matchedRule: toolName,
+            severity: "high",
+        };
+    }
+    if (caps.requireApproval?.some((t) => t === toolName || matchGlob(toolName, t))) {
+        return {
+            decision: "require_approval",
+            reason: `Tool '${toolName}' requires human approval before execution.`,
+            matchedRule: toolName,
+            severity: "medium",
+        };
+    }
+    if (caps.allow && caps.allow.length > 0) {
+        if (caps.allow.some((t) => t === toolName || matchGlob(toolName, t))) {
+            return {
+                decision: "allow",
+                reason: `Tool '${toolName}' is in the allow list.`,
+            };
+        }
+        const def = caps.default ?? "deny";
+        return {
+            decision: def,
+            reason: `Tool '${toolName}' is not in the allow list; default is ${def}.`,
+            severity: def === "deny" ? "medium" : undefined,
+        };
+    }
+    return { decision: caps.default ?? "allow", reason: "No allow/deny list; default action applied." };
+}
+// ─────────────────────────────────────────────────────────
+// Data egress
+// ─────────────────────────────────────────────────────────
+export function checkDataEgress(policy, classification) {
+    const db = policy.dataBoundaries;
+    if (!db)
+        return { decision: "allow", reason: "No data boundary policy declared." };
+    if (db.egressDeny?.includes(classification)) {
+        return {
+            decision: "deny",
+            reason: `Data classification '${classification}' is denied egress.`,
+            matchedRule: classification,
+            severity: classification === "credentials" || classification === "secret" ? "critical" : "high",
+        };
+    }
+    if (db.egressAllow && db.egressAllow.length > 0) {
+        if (db.egressAllow.includes(classification)) {
+            return { decision: "allow", reason: `Egress allowed for '${classification}'.` };
+        }
+        return {
+            decision: "deny",
+            reason: `Data classification '${classification}' is not in the egress allow list.`,
+            matchedRule: classification,
+            severity: "medium",
+        };
+    }
+    return { decision: "allow", reason: "No egress rules matched (default allow)." };
+}
+export function checkBehavioral(policy, state) {
+    const b = policy.behavioral;
+    if (!b)
+        return { decision: "allow", reason: "No behavioral limits declared." };
+    if (b.maxIterations !== undefined && state.iterations >= b.maxIterations) {
+        return {
+            decision: "deny",
+            reason: `Max iterations exceeded (${state.iterations} >= ${b.maxIterations}).`,
+            severity: "high",
+        };
+    }
+    if (b.maxRuntimeSeconds !== undefined && state.runtimeSeconds >= b.maxRuntimeSeconds) {
+        return {
+            decision: "deny",
+            reason: `Max runtime exceeded (${state.runtimeSeconds}s >= ${b.maxRuntimeSeconds}s).`,
+            severity: "high",
+        };
+    }
+    if (b.maxCostUSD !== undefined && state.costUSD >= b.maxCostUSD) {
+        return {
+            decision: "deny",
+            reason: `Max cost exceeded ($${state.costUSD.toFixed(2)} >= $${b.maxCostUSD.toFixed(2)}).`,
+            severity: "critical",
+        };
+    }
+    if (b.maxTokens !== undefined && state.tokens >= b.maxTokens) {
+        return {
+            decision: "deny",
+            reason: `Max tokens exceeded (${state.tokens} >= ${b.maxTokens}).`,
+            severity: "medium",
+        };
+    }
+    if (b.maxToolCalls !== undefined && state.toolCalls >= b.maxToolCalls) {
+        return {
+            decision: "deny",
+            reason: `Max tool calls exceeded (${state.toolCalls} >= ${b.maxToolCalls}).`,
+            severity: "medium",
+        };
+    }
+    if (b.maxExternalServices !== undefined &&
+        state.externalServices.size >= b.maxExternalServices) {
+        return {
+            decision: "deny",
+            reason: `Max external services exceeded (${state.externalServices.size} >= ${b.maxExternalServices}).`,
+            severity: "high",
+        };
+    }
+    return { decision: "allow", reason: "Within all behavioral limits." };
+}
+// ─────────────────────────────────────────────────────────
+// Glob matcher (minimal, no deps)
+// ─────────────────────────────────────────────────────────
+/**
+ * Match a string against a glob pattern.
+ *   *   matches anything except "/"
+ *   **  matches anything including "/"
+ *   ?   matches a single char
+ *   any other char matches literally
+ */
+export function matchGlob(input, pattern) {
+    // Escape regex special chars except our glob ones
+    const regexSource = "^" +
+        pattern
+            .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+            .replace(/\*\*/g, "::DOUBLESTAR::")
+            .replace(/\*/g, "[^/]*")
+            .replace(/::DOUBLESTAR::/g, ".*")
+            .replace(/\?/g, ".") +
+        "$";
+    return new RegExp(regexSource).test(input);
+}
+//# sourceMappingURL=index.js.map

package/dist/enforcer/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/enforcer/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAqBH,4DAA4D;AAC5D,aAAa;AACb,4DAA4D;AAE5D,MAAM,UAAU,eAAe,CAC7B,MAAkB,EAClB,EAAgB,EAChB,IAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;IAC7B,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;IAEhG,6BAA6B;IAC7B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,OAAO;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,8BAA8B,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE;gBAC5D,WAAW,EAAE,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE;gBACvC,QAAQ,EAAE,MAAM;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,cAAc;IACd,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,+BAA+B,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE;gBAC7D,WAAW,EAAE,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE;aACxC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,IAAI,MAAM,CAAC;IACjC,OAAO;QACL,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,uCAAuC,GAAG,GAAG;QACrD,QAAQ,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAChD,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,UAAU;AACV,4DAA4D;AAE5D,MAAM,UAAU,YAAY,CAC1B,MAAkB,EAClB,GAAW,EACX,SAAqB,KAAK;IAE1B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IAE9F,MAAM,WAAW,GAAG,CAAC,IAAiB,EAAE,EAAE;QACxC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5F,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,2BAA2B,IAAI,CAAC,GAAG,EAAE;gBAC7C,WAAW,EAAE,IAAI,CAAC,GAAG;gBACrB,QAAQ,EAAE,MAAM;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,4BAA4B,IAAI,CAAC,GAAG,EAAE;gBAC9C,WAAW,EAAE,IAAI,CAAC,GAAG;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC;IAClC,OAAO;QACL,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,+CAA+C,GAAG,GAAG;QAC7D,QAAQ,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAChD,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,uBAAuB;AACvB,4DAA4D;AAE5D,MAAM,UAAU,eAAe,CAAC,MAAkB,EAAE,QAAgB;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IAEpG,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,SAAS,QAAQ,wBAAwB;YACjD,WAAW,EAAE,QAAQ;YACrB,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO;YACL,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,SAAS,QAAQ,6CAA6C;YACtE,WAAW,EAAE,QAAQ;YACrB,QAAQ,EAAE,QAAQ;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,SAAS,QAAQ,yBAAyB;aACnD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;QACnC,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,SAAS,QAAQ,0CAA0C,GAAG,GAAG;YACzE,QAAQ,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SAChD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;AACtG,CAAC;AAED,4DAA4D;AAC5D,cAAc;AACd,4DAA4D;AAE5D,MAAM,UAAU,eAAe,CAC7B,MAAkB,EAClB,cAAkC;IAElC,MAAM,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC;IACjC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAEnF,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,wBAAwB,cAAc,qBAAqB;YACnE,WAAW,EAAE,cAAc;YAC3B,QAAQ,EAAE,cAAc,KAAK,aAAa,IAAI,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;SAChG,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,uBAAuB,cAAc,IAAI,EAAE,CAAC;QAClF,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,wBAAwB,cAAc,oCAAoC;YAClF,WAAW,EAAE,cAAc;YAC3B,QAAQ,EAAE,QAAQ;SACnB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;AACnF,CAAC;AAeD,MAAM,UAAU,eAAe,CAAC,MAAkB,EAAE,KAAmB;IACrE,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAE/E,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;QACzE,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,4BAA4B,KAAK,CAAC,UAAU,OAAO,CAAC,CAAC,aAAa,IAAI;YAC9E,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,iBAAiB,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACrF,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,yBAAyB,KAAK,CAAC,cAAc,QAAQ,CAAC,CAAC,iBAAiB,KAAK;YACrF,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAChE,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,uBAAuB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YAC1F,QAAQ,EAAE,UAAU;SACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7D,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,wBAAwB,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC,SAAS,IAAI;YAClE,QAAQ,EAAE,QAAQ;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QACtE,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,4BAA4B,KAAK,CAAC,SAAS,OAAO,CAAC,CAAC,YAAY,IAAI;YAC5E,QAAQ,EAAE,QAAQ;SACnB,CAAC;IACJ,CAAC;IACD,IACE,CAAC,CAAC,mBAAmB,KAAK,SAAS;QACnC,KAAK,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC,mBAAmB,EACpD,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,mCAAmC,KAAK,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,CAAC,mBAAmB,IAAI;YACtG,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;AACxE,CAAC;AAED,4DAA4D;AAC5D,kCAAkC;AAClC,4DAA4D;AAE5D;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,OAAe;IACtD,kDAAkD;IAClD,MAAM,WAAW,GACf,GAAG;QACH,OAAO;aACJ,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;aACpC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC;aAClC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;aACvB,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC;aAChC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QACtB,GAAG,CAAC;IACN,OAAO,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @weave_protocol/ward - Public API
+ *
+ * WARD.md is an infrastructure-as-code standard for declaring AI agent
+ * security policies. It pairs with AGENTS.md (Google's agent definition
+ * format) and SKILL.md (Anthropic's skill format) to give every agent in
+ * a repo a version-controlled, machine-readable set of guardrails.
+ *
+ * @example
+ * ```ts
+ * import { parseWard, checkFilesystem } from '@weave_protocol/ward';
+ * import { readFileSync } from 'node:fs';
+ *
+ * const policy = parseWard(readFileSync('./WARD.md', 'utf8'));
+ * const result = checkFilesystem(policy, 'read', '/workspace/secrets/keys.txt');
+ * if (result.decision === 'deny') {
+ *   throw new Error(result.reason);
+ * }
+ * ```
+ */
+export type * from "./types.js";
+export { parseWard, parseAndValidate } from "./parser/index.js";
+export { splitFrontmatter, parseYAML } from "./parser/yaml.js";
+export { splitSections, normalizeKey } from "./parser/markdown.js";
+export { checkFilesystem, checkNetwork, checkCapability, checkDataEgress, checkBehavioral, matchGlob, } from "./enforcer/index.js";
+export type { Decision, CheckResult, RuntimeState } from "./enforcer/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,mBAAmB,YAAY,CAAC;AAGhC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,EACL,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,EACf,SAAS,GACV,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,27 @@
+/**
+ * @weave_protocol/ward - Public API
+ *
+ * WARD.md is an infrastructure-as-code standard for declaring AI agent
+ * security policies. It pairs with AGENTS.md (Google's agent definition
+ * format) and SKILL.md (Anthropic's skill format) to give every agent in
+ * a repo a version-controlled, machine-readable set of guardrails.
+ *
+ * @example
+ * ```ts
+ * import { parseWard, checkFilesystem } from '@weave_protocol/ward';
+ * import { readFileSync } from 'node:fs';
+ *
+ * const policy = parseWard(readFileSync('./WARD.md', 'utf8'));
+ * const result = checkFilesystem(policy, 'read', '/workspace/secrets/keys.txt');
+ * if (result.decision === 'deny') {
+ *   throw new Error(result.reason);
+ * }
+ * ```
+ */
+// Parser
+export { parseWard, parseAndValidate } from "./parser/index.js";
+export { splitFrontmatter, parseYAML } from "./parser/yaml.js";
+export { splitSections, normalizeKey } from "./parser/markdown.js";
+// Enforcer
+export { checkFilesystem, checkNetwork, checkCapability, checkDataEgress, checkBehavioral, matchGlob, } from "./enforcer/index.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,SAAS;AACT,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEnE,WAAW;AACX,OAAO,EACL,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,EACf,SAAS,GACV,MAAM,qBAAqB,CAAC"}

package/dist/parser/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Main WARD.md parser.
+ *
+ * Reads a WARD.md file (frontmatter + sections), interprets each known
+ * section into the typed sub-policy, and returns a fully-typed WardPolicy.
+ */
+import type { WardPolicy, ValidationResult } from "../types.js";
+/**
+ * Parse a WARD.md source string into a typed policy object.
+ * Throws if the document is fundamentally malformed (not just invalid policy).
+ */
+export declare function parseWard(source: string): WardPolicy;
+/**
+ * Parse + validate. Returns a structured result with errors and warnings.
+ */
+export declare function parseAndValidate(source: string): ValidationResult;
+//# sourceMappingURL=index.d.ts.map

package/dist/parser/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EACV,UAAU,EAaV,gBAAgB,EAEjB,MAAM,aAAa,CAAC;AAMrB;;;GAGG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAkBpD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAoEjE"}

package/dist/parser/index.js

@@ -0,0 +1,326 @@
+/**
+ * Main WARD.md parser.
+ *
+ * Reads a WARD.md file (frontmatter + sections), interprets each known
+ * section into the typed sub-policy, and returns a fully-typed WardPolicy.
+ */
+import { splitFrontmatter, parseYAML } from "./yaml.js";
+import { splitSections, extractStructuredBlock } from "./markdown.js";
+// ─────────────────────────────────────────────────────────
+// Public API
+// ─────────────────────────────────────────────────────────
+/**
+ * Parse a WARD.md source string into a typed policy object.
+ * Throws if the document is fundamentally malformed (not just invalid policy).
+ */
+export function parseWard(source) {
+    const { frontmatter, body } = splitFrontmatter(source);
+    const fm = frontmatter ? parseYAML(frontmatter) : {};
+    const sections = splitSections(body);
+    const policy = {
+        version: fm.ward || "1.0",
+        agent: fm.agent,
+        name: fm.name,
+        description: fm.description,
+        raw: {},
+    };
+    for (const section of sections) {
+        applySection(policy, section);
+    }
+    return policy;
+}
+/**
+ * Parse + validate. Returns a structured result with errors and warnings.
+ */
+export function parseAndValidate(source) {
+    const errors = [];
+    const warnings = [];
+    let policy;
+    try {
+        policy = parseWard(source);
+    }
+    catch (err) {
+        return {
+            valid: false,
+            errors: [
+                {
+                    level: "error",
+                    message: `Failed to parse WARD.md: ${err instanceof Error ? err.message : String(err)}`,
+                },
+            ],
+            warnings: [],
+        };
+    }
+    // Validation rules
+    if (policy.version !== "1.0") {
+        errors.push({
+            level: "error",
+            section: "frontmatter",
+            message: `Unsupported WARD version: ${policy.version}`,
+            suggestion: "Use 'ward: 1.0' in the frontmatter.",
+        });
+    }
+    if (!policy.filesystem && !policy.network && !policy.capabilities) {
+        warnings.push({
+            level: "warning",
+            message: "Policy declares no filesystem, network, or capability constraints — this agent will be unrestricted on those dimensions.",
+            suggestion: "Add at least one of `## Filesystem`, `## Network`, or `## Capabilities` to define what the agent is allowed to do.",
+        });
+    }
+    if (policy.verification?.required &&
+        !policy.verification.backend &&
+        !policy.verification.blockchain) {
+        warnings.push({
+            level: "warning",
+            section: "verification",
+            message: "Verification is required but no backend or blockchain is specified.",
+            suggestion: "Set `backend: domere` and `blockchain: solana` (or similar).",
+        });
+    }
+    if (policy.behavioral?.maxCostUSD === undefined && policy.behavioral?.maxRuntimeSeconds === undefined) {
+        warnings.push({
+            level: "warning",
+            section: "behavioral",
+            message: "No cost or runtime limits — runaway agents can incur unbounded charges.",
+            suggestion: "Set `maxCostUSD` or `maxRuntimeSeconds` in the Behavioral Limits section.",
+        });
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+        warnings,
+        policy,
+    };
+}
+// ─────────────────────────────────────────────────────────
+// Section dispatch
+// ─────────────────────────────────────────────────────────
+function applySection(policy, section) {
+    const yaml = parseYAML(extractStructuredBlock(section.body));
+    switch (section.key) {
+        case "filesystem":
+            policy.filesystem = parseFilesystem(yaml);
+            break;
+        case "network":
+            policy.network = parseNetwork(yaml);
+            break;
+        case "capabilities":
+        case "tools":
+            policy.capabilities = parseCapabilities(yaml);
+            break;
+        case "databoundaries":
+        case "egress":
+            policy.dataBoundaries = parseDataBoundaries(yaml);
+            break;
+        case "behavioral":
+        case "behaviorallimits":
+        case "limits":
+            policy.behavioral = parseBehavioral(yaml);
+            break;
+        case "multiagent":
+            policy.multiAgent = parseMultiAgent(yaml);
+            break;
+        case "compliance":
+            policy.compliance = parseCompliance(yaml);
+            break;
+        case "verification":
+        case "attestation":
+            policy.verification = parseVerification(yaml);
+            break;
+        case "threatmodel":
+            policy.threatModel = parseThreatModel(yaml);
+            break;
+        case "incidentresponse":
+        case "onviolation":
+            policy.incidentResponse = parseIncidentResponse(yaml);
+            break;
+        default:
+            // Preserve unknown sections so callers don't lose data
+            if (policy.raw)
+                policy.raw[section.key] = section.body;
+    }
+}
+// ─────────────────────────────────────────────────────────
+// Section parsers
+// ─────────────────────────────────────────────────────────
+function parseFilesystem(y) {
+    return {
+        allow: parseFilesystemRules(y.allow),
+        deny: parseFilesystemRules(y.deny),
+        default: y.default,
+    };
+}
+function parseFilesystemRules(raw) {
+    if (!Array.isArray(raw))
+        return undefined;
+    const rules = [];
+    for (const entry of raw) {
+        // Supports both "read: /path/**" string form and {op, path} object form
+        if (typeof entry === "string") {
+            const colon = entry.indexOf(":");
+            if (colon === -1)
+                continue;
+            const op = entry.slice(0, colon).trim().toLowerCase();
+            const path = entry.slice(colon + 1).trim();
+            if (isFilesystemOp(op))
+                rules.push({ op, path });
+        }
+        else if (entry && typeof entry === "object") {
+            const obj = entry;
+            if (isFilesystemOp(obj.op)) {
+                rules.push({ op: obj.op, path: String(obj.path || "") });
+            }
+        }
+    }
+    return rules.length > 0 ? rules : undefined;
+}
+function isFilesystemOp(op) {
+    return ["read", "write", "execute", "delete", "list"].includes(op);
+}
+function parseNetwork(y) {
+    const toRules = (raw) => {
+        if (!Array.isArray(raw))
+            return undefined;
+        return raw
+            .map((entry) => {
+            if (typeof entry === "string") {
+                // Handle "url: https://..." form (string with leading url: key)
+                if (entry.startsWith("url:") || entry.startsWith("url ")) {
+                    const colon = entry.indexOf(":");
+                    const url = entry.slice(colon + 1).trim().replace(/^["']|["']$/g, "");
+                    return { url };
+                }
+                // Plain URL string
+                return { url: entry };
+            }
+            if (entry && typeof entry === "object") {
+                const obj = entry;
+                return { url: String(obj.url || ""), methods: obj.methods };
+            }
+            return null;
+        })
+            .filter((r) => r !== null && !!r.url);
+    };
+    return {
+        allow: toRules(y.allow),
+        deny: toRules(y.deny),
+        default: y.default,
+    };
+}
+function parseCapabilities(y) {
+    const toStringList = (raw) => {
+        if (!Array.isArray(raw))
+            return undefined;
+        return raw.map(String).filter(Boolean);
+    };
+    return {
+        allow: toStringList(y.allow),
+        deny: toStringList(y.deny),
+        requireApproval: toStringList(y.requireApproval ?? y.require_approval),
+        default: y.default,
+    };
+}
+function parseDataBoundaries(y) {
+    const toClassList = (raw) => {
+        if (!Array.isArray(raw))
+            return undefined;
+        return raw.map((v) => String(v).toLowerCase());
+    };
+    return {
+        egressAllow: toClassList(y.egressAllow ?? y.egress_allow ?? y.allow),
+        egressDeny: toClassList(y.egressDeny ?? y.egress_deny ?? y.deny),
+        redact: Array.isArray(y.redact)
+            ? y.redact.map((r) => typeof r === "string"
+                ? { type: r }
+                : { type: String(r.type), replacement: String(r.replacement || "[REDACTED]") })
+            : undefined,
+    };
+}
+function parseBehavioral(y) {
+    const num = (k, alt) => {
+        const v = y[k] ?? (alt ? y[alt] : undefined);
+        return typeof v === "number" ? v : undefined;
+    };
+    return {
+        maxIterations: num("maxIterations", "max_iterations"),
+        maxRuntimeSeconds: num("maxRuntimeSeconds", "max_runtime_seconds"),
+        maxCostUSD: num("maxCostUSD", "max_cost_usd"),
+        maxTokens: num("maxTokens", "max_tokens"),
+        maxToolCalls: num("maxToolCalls", "max_tool_calls"),
+        maxExternalServices: num("maxExternalServices", "max_external_services"),
+    };
+}
+function parseMultiAgent(y) {
+    const tc = y.trustChain ?? y.trust_chain;
+    const trustChain = tc && typeof tc === "object"
+        ? {
+            upstream: Array.isArray(tc.upstream)
+                ? tc.upstream
+                : undefined,
+            downstream: Array.isArray(tc.downstream)
+                ? tc.downstream
+                : undefined,
+        }
+        : undefined;
+    return {
+        trustChain,
+        isolation: y.isolation,
+        maxSemanticDrift: typeof y.maxSemanticDrift === "number" ? y.maxSemanticDrift : undefined,
+    };
+}
+function parseCompliance(y) {
+    return {
+        frameworks: Array.isArray(y.frameworks)
+            ? y.frameworks.map((f) => String(f).toLowerCase())
+            : undefined,
+        backend: y.backend,
+    };
+}
+function parseVerification(y) {
+    return {
+        required: y.required === true,
+        backend: y.backend,
+        blockchain: y.blockchain,
+        frequency: y.frequency?.replace(/-/g, "_"),
+        attestor: y.attestor,
+    };
+}
+function parseThreatModel(y) {
+    return {
+        inScope: Array.isArray(y.inScope ?? y.in_scope)
+            ? (y.inScope ?? y.in_scope)
+            : undefined,
+        outOfScope: Array.isArray(y.outOfScope ?? y.out_of_scope)
+            ? (y.outOfScope ?? y.out_of_scope)
+            : undefined,
+    };
+}
+function parseIncidentResponse(y) {
+    const onViolation = y.onViolation ?? y.on_violation;
+    let actions;
+    if (Array.isArray(onViolation)) {
+        const collected = [];
+        for (const a of onViolation) {
+            if (typeof a === "string") {
+                collected.push({ type: a });
+            }
+            else if (a && typeof a === "object") {
+                const obj = a;
+                if (obj.type) {
+                    collected.push({
+                        type: obj.type,
+                        minSeverity: obj.minSeverity,
+                        target: obj.target,
+                    });
+                }
+            }
+        }
+        if (collected.length > 0)
+            actions = collected;
+    }
+    return {
+        onViolation: actions,
+        severityThreshold: y.severityThreshold,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/parser/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAwB,MAAM,eAAe,CAAC;AAmB5F,4DAA4D;AAC5D,aAAa;AACb,4DAA4D;AAE5D;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,MAAM,GAAe;QACzB,OAAO,EAAG,EAAE,CAAC,IAAc,IAAI,KAAK;QACpC,KAAK,EAAE,EAAE,CAAC,KAA2B;QACrC,IAAI,EAAE,EAAE,CAAC,IAA0B;QACnC,WAAW,EAAE,EAAE,CAAC,WAAiC;QACjD,GAAG,EAAE,EAAE;KACR,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACxF;aACF;YACD,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,6BAA6B,MAAM,CAAC,OAAO,EAAE;YACtD,UAAU,EAAE,qCAAqC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,SAAS;YAChB,OAAO,EACL,0HAA0H;YAC5H,UAAU,EACR,oHAAoH;SACvH,CAAC,CAAC;IACL,CAAC;IAED,IACE,MAAM,CAAC,YAAY,EAAE,QAAQ;QAC7B,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO;QAC5B,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,EAC/B,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,qEAAqE;YAC9E,UAAU,EAAE,8DAA8D;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACtG,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,YAAY;YACrB,OAAO,EAAE,yEAAyE;YAClF,UAAU,EAAE,2EAA2E;SACxF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,mBAAmB;AACnB,4DAA4D;AAE5D,SAAS,YAAY,CAAC,MAAkB,EAAE,OAAwB;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACpB,KAAK,YAAY;YACf,MAAM,CAAC,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM;QACR,KAAK,SAAS;YACZ,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM;QACR,KAAK,cAAc,CAAC;QACpB,KAAK,OAAO;YACV,MAAM,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM;QACR,KAAK,gBAAgB,CAAC;QACtB,KAAK,QAAQ;YACX,MAAM,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM;QACR,KAAK,YAAY,CAAC;QAClB,KAAK,kBAAkB,CAAC;QACxB,KAAK,QAAQ;YACX,MAAM,CAAC,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM;QACR,KAAK,YAAY;YACf,MAAM,CAAC,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM;QACR,KAAK,YAAY;YACf,MAAM,CAAC,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM;QACR,KAAK,cAAc,CAAC;QACpB,KAAK,aAAa;YAChB,MAAM,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM;QACR,KAAK,aAAa;YAChB,MAAM,CAAC,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM;QACR,KAAK,kBAAkB,CAAC;QACxB,KAAK,aAAa;YAChB,MAAM,CAAC,gBAAgB,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM;QACR;YACE,uDAAuD;YACvD,IAAI,MAAM,CAAC,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,kBAAkB;AAClB,4DAA4D;AAE5D,SAAS,eAAe,CAAC,CAA0B;IACjD,OAAO;QACL,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC;QACpC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC;QAClC,OAAO,EAAE,CAAC,CAAC,OAAuC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,wEAAwE;QACxE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,cAAc,CAAC,EAAE,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,KAAgC,CAAC;YAC7C,IAAI,cAAc,CAAC,GAAG,CAAC,EAAY,CAAC,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAW,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,EAAU;IAChC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,CAA0B;IAC9C,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,EAAE;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1C,OAAO,GAAG;aACP,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,gEAAgE;gBAChE,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;oBACtE,OAAO,EAAE,GAAG,EAAE,CAAC;gBACjB,CAAC;gBACD,mBAAmB;gBACnB,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;YACxB,CAAC;YACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvC,MAAM,GAAG,GAAG,KAAgC,CAAC;gBAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAgB,EAAE,CAAC;YACvE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACvB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACrB,OAAO,EAAE,CAAC,CAAC,OAAuC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAA0B;IACnD,MAAM,YAAY,GAAG,CAAC,GAAY,EAAwB,EAAE;QAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1C,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5B,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1B,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,gBAAgB,CAAC;QACtE,OAAO,EAAE,CAAC,CAAC,OAAuC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,CAA0B;IACrD,MAAM,WAAW,GAAG,CAAC,GAAY,EAAE,EAAE;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1C,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAU,CAAC;IAC1D,CAAC,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC;QACpE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC;QAChE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,OAAO,CAAC,KAAK,QAAQ;gBACnB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE;gBACb,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAE,CAA6B,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,CAAE,CAA6B,CAAC,WAAW,IAAI,YAAY,CAAC,EAAE,CAC3I;YACH,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,CAA0B;IACjD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,GAAY,EAAE,EAAE;QACtC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC,CAAC;IACF,OAAO;QACL,aAAa,EAAE,GAAG,CAAC,eAAe,EAAE,gBAAgB,CAAC;QACrD,iBAAiB,EAAE,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QAClE,UAAU,EAAE,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC;QAC7C,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC;QACzC,YAAY,EAAE,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC;QACnD,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,CAA0B;IACjD,MAAM,EAAE,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC;IACzC,MAAM,UAAU,GACd,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAC1B,CAAC,CAAC;YACE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAE,EAA8B,CAAC,QAAQ,CAAC;gBAC/D,CAAC,CAAG,EAA8B,CAAC,QAAqB;gBACxD,CAAC,CAAC,SAAS;YACb,UAAU,EAAE,KAAK,CAAC,OAAO,CAAE,EAA8B,CAAC,UAAU,CAAC;gBACnE,CAAC,CAAG,EAA8B,CAAC,UAAuB;gBAC1D,CAAC,CAAC,SAAS;SACd;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,UAAU;QACV,SAAS,EAAE,CAAC,CAAC,SAAkB;QAC/B,gBAAgB,EAAE,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,gBAA2B,CAAC,CAAC,CAAC,SAAS;KACtG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,CAA0B;IACjD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;YACrC,CAAC,CAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAW;YAC7D,CAAC,CAAC,SAAS;QACb,OAAO,EAAE,CAAC,CAAC,OAAgB;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAA0B;IACnD,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI;QAC7B,OAAO,EAAE,CAAC,CAAC,OAAgB;QAC3B,UAAU,EAAE,CAAC,CAAC,UAAmB;QACjC,SAAS,EAAG,CAAC,CAAC,SAAoB,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAU;QAC/D,QAAQ,EAAE,CAAC,CAAC,QAA8B;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,CAA0B;IAClD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;YAC7C,CAAC,CAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAc;YACzC,CAAC,CAAC,SAAS;QACb,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,YAAY,CAAC;YACvD,CAAC,CAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,YAAY,CAAc;YAChD,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,CAA0B;IACvD,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,YAAY,CAAC;IACpD,IAAI,OAAsC,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAsB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAA4B,EAAE,CAAC,CAAC;YACzD,CAAC;iBAAM,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,GAAG,GAAG,CAA4B,CAAC;gBACzC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBACb,SAAS,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,GAAG,CAAC,IAA+B;wBACzC,WAAW,EAAE,GAAG,CAAC,WAA6C;wBAC9D,MAAM,EAAE,GAAG,CAAC,MAA4B;qBACzC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,SAAS,CAAC;IAChD,CAAC;IAED,OAAO;QACL,WAAW,EAAE,OAAO;QACpB,iBAAiB,EAAE,CAAC,CAAC,iBAA0B;KAChD,CAAC;AACJ,CAAC"}