@yadsh/dsh-qa-surface 0.1.1 → 0.3.0

package/lib/index.js

@@ -1,83 +1,365 @@
-import { Service } from "@deepseek-ai/cordis";
-import { installSettingsSection, settingsNamespace, } from "@deepseek-ai/dsh-settings";
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { createHostLoggerSink, getPluginLogger, } from "@yadsh/dsh-plugin-log";
 import { ConfigSchema, resolveConfig } from "./config.js";
+import { QaAccounts, QaAccountsError, defaultAccountsFilePath, } from "./accounts/store.js";
+import { QaAttestationError } from "./attestation.js";
+import { entryRedirectRow } from "./entry-redirect.js";
 import { registerQaNavigationRoute } from "./host-route.js";
+import { makeLaunchTokenSource } from "./launch-token.js";
+import { QaPolicyAdmission } from "./secure-session.js";
+import { QaProvenanceHost } from "./provenance/host-store.js";
+import { readSourceFilePreview } from "./provenance/file-preview.js";
 export const name = "qa-surface";
-export const inject = [];
-export const QA_SURFACE_SETTINGS_NAMESPACE = settingsNamespace("qa-surface");
+export const inject = [
+    "agents",
+    "sessions",
+    "agentPresets",
+    "permissionPresets",
+    "tools",
+    "systemPrompt",
+    "workspaceRegistry",
+];
+export const QA_SURFACE_SETTINGS_NAMESPACE = "qa-surface";
 export const Config = ConfigSchema;
-/** Small Host companion: validates config and exposes it through DSH settings. */
-export class QaSurface extends Service {
-    static inject = inject;
-    static Config = ConfigSchema;
-    source;
-    logger;
-    webServer;
-    disposeRoute;
-    routeKey;
-    constructor(ctx, entry = {}) {
-        super(ctx, "qaSurface");
-        const resolvedEntry = resolveConfig(entry);
-        this.source = () => resolvedEntry;
-        this.logger = getPluginLogger({
-            pluginId: "dsh-qa-surface",
-            consoleSink: createHostLoggerSink(ctx.logger),
-        });
-        ctx.effect(() => async () => this.logger.close(), "dsh-qa-surface.logger");
-        installSettingsSection(ctx, QA_SURFACE_SETTINGS_NAMESPACE, ConfigSchema, entry, {
-            setSource: (source) => {
-                this.source = source;
-            },
-            onChange: () => {
-                const config = this.getConfig();
+const CONFIGURATION_ERROR = "Assistant configuration is unavailable.";
+const ACCOUNTS_DISABLED_ERROR = "QA accounts are not enabled on this deployment.";
+/** The `(reason: <code>)` marker contract shared with the attestation path. */
+const ACCOUNTS_REASON_MARKER = /\(reason: ([a-z-]+)\)/u;
+/** Host companion: validates config, owns the admission boundary and the route. */
+let QaSurface = (() => {
+    let _classSuper = TypertRemoteService;
+    let _instanceExtraInitializers = [];
+    let _accountsRegister_decorators;
+    let _accountsLogin_decorators;
+    let _accountsWhoami_decorators;
+    let _accountsClaimSessions_decorators;
+    let _accountsOwnedSessions_decorators;
+    let _accountsListOwnership_decorators;
+    let _describe_decorators;
+    let _secureSession_decorators;
+    let _sources_decorators;
+    let _readSourceFile_decorators;
+    return class QaSurface extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _accountsRegister_decorators = [Remote("accountsRegister")];
+            _accountsLogin_decorators = [Remote("accountsLogin")];
+            _accountsWhoami_decorators = [Remote("accountsWhoami")];
+            _accountsClaimSessions_decorators = [Remote("accountsClaimSessions")];
+            _accountsOwnedSessions_decorators = [Remote("accountsOwnedSessions")];
+            _accountsListOwnership_decorators = [Remote("accountsListOwnership")];
+            _describe_decorators = [Remote("describe")];
+            _secureSession_decorators = [Remote("secureSession")];
+            _sources_decorators = [Remote("sources")];
+            _readSourceFile_decorators = [Remote("readSourceFile")];
+            __esDecorate(this, null, _accountsRegister_decorators, { kind: "method", name: "accountsRegister", static: false, private: false, access: { has: obj => "accountsRegister" in obj, get: obj => obj.accountsRegister }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _accountsLogin_decorators, { kind: "method", name: "accountsLogin", static: false, private: false, access: { has: obj => "accountsLogin" in obj, get: obj => obj.accountsLogin }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _accountsWhoami_decorators, { kind: "method", name: "accountsWhoami", static: false, private: false, access: { has: obj => "accountsWhoami" in obj, get: obj => obj.accountsWhoami }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _accountsClaimSessions_decorators, { kind: "method", name: "accountsClaimSessions", static: false, private: false, access: { has: obj => "accountsClaimSessions" in obj, get: obj => obj.accountsClaimSessions }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _accountsOwnedSessions_decorators, { kind: "method", name: "accountsOwnedSessions", static: false, private: false, access: { has: obj => "accountsOwnedSessions" in obj, get: obj => obj.accountsOwnedSessions }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _accountsListOwnership_decorators, { kind: "method", name: "accountsListOwnership", static: false, private: false, access: { has: obj => "accountsListOwnership" in obj, get: obj => obj.accountsListOwnership }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _describe_decorators, { kind: "method", name: "describe", static: false, private: false, access: { has: obj => "describe" in obj, get: obj => obj.describe }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _secureSession_decorators, { kind: "method", name: "secureSession", static: false, private: false, access: { has: obj => "secureSession" in obj, get: obj => obj.secureSession }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _sources_decorators, { kind: "method", name: "sources", static: false, private: false, access: { has: obj => "sources" in obj, get: obj => obj.sources }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _readSourceFile_decorators, { kind: "method", name: "readSourceFile", static: false, private: false, access: { has: obj => "readSourceFile" in obj, get: obj => obj.readSourceFile }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        static inject = inject;
+        static Config = ConfigSchema;
+        source = __runInitializers(this, _instanceExtraInitializers);
+        logger;
+        admission;
+        provenance;
+        accounts;
+        accountsOptions;
+        launchToken;
+        webServer;
+        disposeRoute;
+        routeKey;
+        constructor(ctx, entry = {}) {
+            super(ctx, "qaSurface", { namespace: "qaSurface" });
+            const resolvedEntry = resolveConfig(entry);
+            this.source = () => resolvedEntry;
+            this.logger = getPluginLogger({
+                pluginId: "dsh-qa-surface",
+                consoleSink: createHostLoggerSink(ctx.logger),
+            });
+            this.admission = new QaPolicyAdmission(ctx, () => this.getConfig(), this.logger, 
+            // Identity half of admission; no-ops while accounts stay disabled.
+            {
+                enforceSessionAccess: (token, sessionId) => {
+                    this.accountsFor(this.getConfig())?.ensureSessionAccess(token, sessionId);
+                },
+            });
+            this.provenance = new QaProvenanceHost(ctx, () => this.getConfig());
+            // The /qa route hands cookie-less browsers to the one-time host token
+            // exchange; the proxy in the deploy kit does the same and either alone
+            // suffices. Resolved lazily and once per process; unavailable bridges
+            // warn once and leave the old marker hand-off in place.
+            this.launchToken = makeLaunchTokenSource(() => ctx.get("connection"), (message) => this.logger.warn("entry.token-bridge", { message }));
+            ctx.effect(() => async () => this.logger.close(), "dsh-qa-surface.logger");
+            ctx.effect(() => () => this.admission.dispose(), "dsh-qa-surface.lockdown-policies");
+            ctx.effect(() => () => this.provenance.dispose(), "dsh-qa-surface.provenance");
+            // The root index gains one head script: non-loopback hostnames continue
+            // into /qa, the loopback operator keeps the full harness UI.
+            ctx.on("webserver/index-inject", (table) => {
+                const row = entryRedirectRow(this.getConfig());
+                if (row !== undefined)
+                    table.push(row);
+            });
+            ctx.inject(["settings"], (settingsCtx) => {
+                settingsCtx.settings.installSection(ctx, QA_SURFACE_SETTINGS_NAMESPACE, ConfigSchema, entry, {
+                    setSource: (source) => {
+                        this.source = source;
+                    },
+                    onChange: () => {
+                        const config = this.getConfig();
+                        this.refreshRoute();
+                        this.logger.info("config.updated", {
+                            enabled: config.enabled,
+                            route: config.route.path,
+                            sessionPolicy: config.session.policy,
+                        });
+                    },
+                    validate: (value) => {
+                        resolveConfig(value);
+                    },
+                });
+            });
+            ctx.inject(["webServer"], (webContext) => {
+                this.webServer = webContext.webServer;
                 this.refreshRoute();
-                this.logger.info("config.updated", {
-                    enabled: config.enabled,
-                    route: config.route.path,
-                    sessionPolicy: config.session.policy,
+                webContext.effect(() => () => {
+                    this.disposeRoute?.();
+                    this.disposeRoute = undefined;
+                    this.routeKey = undefined;
+                    this.webServer = undefined;
+                }, "dsh-qa-surface.navigation-route");
+            });
+            this.logger.info("plugin.ready", {
+                enabled: resolvedEntry.enabled,
+                route: resolvedEntry.route.path,
+                sessionPolicy: resolvedEntry.session.policy,
+            });
+        }
+        getConfig() {
+            return resolveConfig(this.source());
+        }
+        /**
+         * The accounts store behind the runtime toggle. Rebuilt only when the
+         * account-affecting options change; the file is shared across rebuilds.
+         */
+        accountsFor(config) {
+            if (!config.accounts.enabled)
+                return undefined;
+            const options = JSON.stringify([
+                config.accounts.sessionTtlDays,
+                config.accounts.allowRegistration,
+            ]);
+            if (this.accounts === undefined || this.accountsOptions !== options) {
+                this.accounts = new QaAccounts(defaultAccountsFilePath(), {
+                    sessionTtlDays: config.accounts.sessionTtlDays,
+                    allowRegistration: config.accounts.allowRegistration,
                 });
-            },
-            validate: (value) => {
-                resolveConfig(value);
-            },
-        });
-        ctx.inject(["webServer"], (webContext) => {
-            this.webServer = webContext.webServer;
-            this.refreshRoute();
-            webContext.effect(() => () => {
-                this.disposeRoute?.();
-                this.disposeRoute = undefined;
-                this.routeKey = undefined;
-                this.webServer = undefined;
-            }, "dsh-qa-surface.navigation-route");
-        });
-        this.logger.info("plugin.ready", {
-            enabled: resolvedEntry.enabled,
-            route: resolvedEntry.route.path,
-            sessionPolicy: resolvedEntry.session.policy,
-        });
-    }
-    getConfig() {
-        return resolveConfig(this.source());
-    }
-    refreshRoute() {
-        const config = this.getConfig();
-        const key = config.enabled
-            ? `${config.route.path}:${config.route.matchChildren}`
-            : undefined;
-        if (key === this.routeKey)
-            return;
-        this.disposeRoute?.();
-        this.disposeRoute = undefined;
-        this.routeKey = undefined;
-        if (key === undefined || this.webServer === undefined)
-            return;
-        this.disposeRoute = registerQaNavigationRoute(this.webServer, config);
-        this.routeKey = key;
-    }
-}
+                this.accountsOptions = options;
+            }
+            return this.accounts;
+        }
+        /** The accounts store, or the disabled refusal the browser maps to copy. */
+        requireAccounts() {
+            const accounts = this.accountsFor(this.getConfig());
+            if (accounts === undefined) {
+                throw new Error(ACCOUNTS_DISABLED_ERROR);
+            }
+            return accounts;
+        }
+        /** Account failures ride the shared `(reason: <code>)` wire marker. */
+        accountsRemote(operation, sessionIdForLog) {
+            try {
+                return operation();
+            }
+            catch (error) {
+                if (error instanceof QaAccountsError) {
+                    this.logger.warn("accounts.rejected", {
+                        reason: error.reason,
+                        sessionId: sessionIdForLog,
+                    });
+                    throw new Error(`QA accounts refused the request (reason: ${error.reason})`, {
+                        cause: error,
+                    });
+                }
+                throw error;
+            }
+        }
+        /**
+         * Self-service signup; the first account ever created becomes admin. The
+         * display name derives from the email: the generated client enforces exact
+         * wire arity, so an optional name parameter would still be required.
+         */
+        accountsRegister(email, password) {
+            const accounts = this.requireAccounts();
+            return this.accountsRemote(() => accounts.register(email, password));
+        }
+        accountsLogin(email, password) {
+            const accounts = this.requireAccounts();
+            return this.accountsRemote(() => accounts.login(email, password));
+        }
+        /** Identity probe; safe to call with an empty or expired token. */
+        accountsWhoami(token) {
+            if (!this.getConfig().accounts.enabled)
+                return { authenticated: false };
+            const accounts = this.requireAccounts();
+            return this.accountsRemote(() => accounts.whoami(token));
+        }
+        /** Migrate a browser's local chat index into server-side ownership. */
+        accountsClaimSessions(token, sessionIds) {
+            const accounts = this.requireAccounts();
+            return this.accountsRemote(() => accounts.claimSessions(token, sessionIds));
+        }
+        /** The token user's owned session ids; the sidebar list authority. */
+        accountsOwnedSessions(token) {
+            if (!this.getConfig().accounts.enabled)
+                return { ids: [] };
+            const accounts = this.requireAccounts();
+            return this.accountsRemote(() => ({
+                ids: accounts.ownedSessionIds(token),
+            }));
+        }
+        /**
+         * Every chat-ownership entry with owner display names; the cross-user view
+         * admin browsers group the sidebar by. Ordinary accounts are refused with
+         * the dedicated reason, anonymous ones with auth-required.
+         */
+        accountsListOwnership(token) {
+            if (!this.getConfig().accounts.enabled)
+                return { entries: [] };
+            const accounts = this.requireAccounts();
+            return this.accountsRemote(() => ({
+                entries: accounts.listOwnership(token),
+            }));
+        }
+        /**
+         * Serve the effective QA configuration to the browser. The DSH gateway pins
+         * settings RPCs to loopback, so a browser served over the LAN always sees
+         * the settings namespace as unavailable; this method is the config channel
+         * such a browser falls back to. It is read-only projection — the admission
+         * boundary stays in {@link secureSession}.
+         */
+        describe() {
+            return this.getConfig();
+        }
+        /** Pin and attest the effective policy. The browser supplies identity only. */
+        secureSession(token, sessionId) {
+            try {
+                return this.admission.secureSession(token, sessionId);
+            }
+            catch (error) {
+                // The carrier empties error.details, so the coarse reason rides the
+                // wire message for the browser console; the specific mismatch facts
+                // stay in this log only.
+                const reason = error instanceof QaAttestationError
+                    ? error.reason
+                    : (ACCOUNTS_REASON_MARKER.exec(error instanceof Error ? error.message : "")?.at(1) ?? "attestation-failed");
+                this.logger.error("lockdown.rejected", {
+                    sessionId,
+                    reason,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                throw new Error(`${CONFIGURATION_ERROR} (reason: ${reason})`, {
+                    cause: error,
+                });
+            }
+        }
+        /** Return canonical Host snapshots; replay is rebuilt from qa/sources events. */
+        sources(token, sessionId) {
+            this.admission.secureSession(token, sessionId);
+            return this.provenance.bundles(sessionId);
+        }
+        /** Narrow read-only preview capability for files already present as sources. */
+        async readSourceFile(token, sessionId, sourcePath) {
+            this.admission.secureSession(token, sessionId);
+            const config = this.getConfig().sources.filePreview;
+            if (!config.enabled ||
+                !this.provenance.sourceAllowed(sessionId, sourcePath)) {
+                throw new Error("Source preview is unavailable.");
+            }
+            const agent = this.ctx.agents.get((await import("@deepseek-ai/dsh-session/types")).SessionId(sessionId));
+            const root = agent?.session.header.cwd;
+            if (root === undefined)
+                throw new Error("Source preview is unavailable.");
+            try {
+                return await readSourceFilePreview({
+                    root,
+                    sourcePath,
+                    maxBytes: config.maxBytes,
+                    maxMarkdownRenderBytes: config.maxMarkdownRenderBytes,
+                });
+            }
+            catch {
+                throw new Error("Source preview is unavailable.");
+            }
+        }
+        refreshRoute() {
+            const config = this.getConfig();
+            const key = config.enabled
+                ? `${config.route.path}:${config.route.matchChildren}`
+                : undefined;
+            if (key === this.routeKey)
+                return;
+            this.disposeRoute?.();
+            this.disposeRoute = undefined;
+            this.routeKey = undefined;
+            if (key === undefined || this.webServer === undefined)
+                return;
+            this.disposeRoute = registerQaNavigationRoute(this.webServer, config, {
+                launchToken: this.launchToken,
+            });
+            this.routeKey = key;
+        }
+    };
+})();
+export { QaSurface };
 export { ConfigSchema, DEFAULT_QA_SURFACE_CONFIG, normalizeRoutePath, resolveConfig, } from "./config.js";
+export { QaAttestationError } from "./attestation.js";
+export { QaAccounts, QaAccountsError } from "./accounts/store.js";
+export { entryRedirectRow, entryRedirectScript } from "./entry-redirect.js";
 export { registerQaNavigationRoute } from "./host-route.js";
+export { qaToolDenial, qaToolPolicyPlan } from "./lockdown-policy.js";
+export { QaPolicyAdmission } from "./secure-session.js";
+export * from "./provenance/index.js";
 export default QaSurface;
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAgB,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,eAAe,GAEhB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAG5D,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,CAAC;AACjC,MAAM,CAAC,MAAM,MAAM,GAAsB,EAAE,CAAC;AAC5C,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,MAAM,GAAG,YAAY,CAAC;AAQnC,kFAAkF;AAClF,MAAM,OAAO,SAAU,SAAQ,OAAO;IACpC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC;IAErB,MAAM,CAAwB;IACrB,MAAM,CAAe;IAC9B,SAAS,CAC6C;IACtD,YAAY,CAA2B;IACvC,QAAQ,CAAqB;IAErC,YAAY,GAAY,EAAE,KAAK,GAAoB,EAAE;QACnD,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACxB,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC;YAC5B,QAAQ,EAAE,gBAAgB;YAC1B,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC3E,sBAAsB,CACpB,GAAG,EACH,6BAA6B,EAC7B,YAAY,EACZ,KAAK,EACL;YACE,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;gBACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,CAAC;YACD,QAAQ,EAAE,GAAG,EAAE;gBACb,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;oBACjC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;oBACxB,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClB,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;SACF,CACF,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE;YACvC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;YACtC,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,UAAU,CAAC,MAAM,CACf,GAAG,EAAE,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;gBAC9B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;gBAC1B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC7B,CAAC,EACD,iCAAiC,CAClC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;YAC/B,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI;YAC/B,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,SAAS;QACP,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,YAAY;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO;YACxB,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE;YACtD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,GAAG,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO;QAClC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO;QAC9D,IAAI,CAAC,YAAY,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;IACtB,CAAC;CACF;AAED,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,eAAe,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EACL,oBAAoB,EACpB,eAAe,GAEhB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,eAAe,EACf,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAarE,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,CAAC;AACjC,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ;IACR,UAAU;IACV,cAAc;IACd,mBAAmB;IACnB,OAAO;IACP,cAAc;IACd,mBAAmB;CACpB,CAAC;AACF,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CAAC;AAC1D,MAAM,CAAC,MAAM,MAAM,GAAG,YAAY,CAAC;AAQnC,MAAM,mBAAmB,GAAG,yCAAyC,CAAC;AACtE,MAAM,uBAAuB,GAC3B,iDAAiD,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAExD,mFAAmF;IACtE,SAAS;sBAAS,mBAAmB;;;;;;;;;;;;iBAArC,SAAU,SAAQ,WAAmB;;;4CAyK/C,MAAM,CAAC,kBAAkB,CAAC;yCAM1B,MAAM,CAAC,eAAe,CAAC;0CAOvB,MAAM,CAAC,gBAAgB,CAAC;iDAQxB,MAAM,CAAC,uBAAuB,CAAC;iDAU/B,MAAM,CAAC,uBAAuB,CAAC;iDAc/B,MAAM,CAAC,uBAAuB,CAAC;oCAkB/B,MAAM,CAAC,UAAU,CAAC;yCAMlB,MAAM,CAAC,eAAe,CAAC;mCA0BvB,MAAM,CAAC,SAAS,CAAC;0CAOjB,MAAM,CAAC,gBAAgB,CAAC;YArGzB,mMAAA,gBAAgB,6DAGf;YAGD,0LAAA,aAAa,6DAGZ;YAID,6LAAA,cAAc,6DAIb;YAID,kNAAA,qBAAqB,6DAMpB;YAID,kNAAA,qBAAqB,6DAMpB;YAQD,kNAAA,qBAAqB,6DAQpB;YAUD,2KAAA,QAAQ,6DAEP;YAID,0LAAA,aAAa,6DAsBZ;YAID,wKAAA,OAAO,6DAGN;YAID,6LAAM,cAAc,6DA4BnB;;;QA3SD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC;QAErB,MAAM,GAJH,mDAAS,CAIkB;QACrB,MAAM,CAAe;QACrB,SAAS,CAAoB;QAC7B,UAAU,CAAmB;QACtC,QAAQ,CAAyB;QACjC,eAAe,CAAqB;QAC3B,WAAW,CAA2C;QAC/D,SAAS,CAC6C;QACtD,YAAY,CAA2B;QACvC,QAAQ,CAAqB;QAErC,YAAY,GAAY,EAAE,KAAK,GAAoB,EAAE;YACnD,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC;YAClC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC;gBAC5B,QAAQ,EAAE,gBAAgB;gBAC1B,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,CACpC,GAAG,EACH,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EACtB,IAAI,CAAC,MAAM;YACX,mEAAmE;YACnE;gBACE,oBAAoB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;oBACzC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,mBAAmB,CACrD,KAAK,EACL,SAAS,CACV,CAAC;gBACJ,CAAC;aACF,CACF,CAAC;YACF,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACpE,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,wDAAwD;YACxD,IAAI,CAAC,WAAW,GAAG,qBAAqB,CACtC,GAAG,EAAE,CACF,GAAoD,CAAC,GAAG,CACvD,YAAY,CACiD,EACjE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,CAAC,CACjE,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;YAC3E,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EACpC,kCAAkC,CACnC,CAAC;YACF,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EACrC,2BAA2B,CAC5B,CAAC;YACF,wEAAwE;YACxE,6DAA6D;YAC7D,GAAG,CAAC,EAAE,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE;gBACzC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC/C,IAAI,GAAG,KAAK,SAAS;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE;gBACvC,WAAW,CAAC,QAAQ,CAAC,cAAc,CACjC,GAAG,EACH,6BAA6B,EAC7B,YAAY,EACZ,KAAK,EACL;oBACE,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;wBACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACvB,CAAC;oBACD,QAAQ,EAAE,GAAG,EAAE;wBACb,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;wBAChC,IAAI,CAAC,YAAY,EAAE,CAAC;wBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;4BACjC,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;4BACxB,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;yBACrC,CAAC,CAAC;oBACL,CAAC;oBACD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;wBAClB,aAAa,CAAC,KAAK,CAAC,CAAC;oBACvB,CAAC;iBACF,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE;gBACvC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;gBACtC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,UAAU,CAAC,MAAM,CACf,GAAG,EAAE,CAAC,GAAG,EAAE;oBACT,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;oBACtB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;oBAC9B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;oBAC1B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;gBAC7B,CAAC,EACD,iCAAiC,CAClC,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;gBAC/B,OAAO,EAAE,aAAa,CAAC,OAAO;gBAC9B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI;gBAC/B,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,SAAS;YACP,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC;QAED;;;WAGG;QACK,WAAW,CAAC,MAA+B;YACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,MAAM,CAAC,QAAQ,CAAC,cAAc;gBAC9B,MAAM,CAAC,QAAQ,CAAC,iBAAiB;aAClC,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,OAAO,EAAE,CAAC;gBACpE,IAAI,CAAC,QAAQ,GAAG,IAAI,UAAU,CAAC,uBAAuB,EAAE,EAAE;oBACxD,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc;oBAC9C,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB;iBACrD,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;YACjC,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QAED,4EAA4E;QACpE,eAAe;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACpD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,uEAAuE;QAC/D,cAAc,CAAI,SAAkB,EAAE,eAAwB;YACpE,IAAI,CAAC;gBACH,OAAO,SAAS,EAAE,CAAC;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;wBACpC,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,SAAS,EAAE,eAAe;qBAC3B,CAAC,CAAC;oBACH,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,MAAM,GAAG,EAC3D;wBACE,KAAK,EAAE,KAAK;qBACb,CACF,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED;;;;WAIG;QAEH,gBAAgB,CAAC,KAAa,EAAE,QAAgB;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvE,CAAC;QAGD,aAAa,CAAC,KAAa,EAAE,QAAgB;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,mEAAmE;QAEnE,cAAc,CAAC,KAAa;YAC1B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,OAAO;gBAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,uEAAuE;QAEvE,qBAAqB,CACnB,KAAa,EACb,UAA6B;YAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9E,CAAC;QAED,sEAAsE;QAEtE,qBAAqB,CAAC,KAAa;YACjC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,OAAO;gBAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;YAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC;gBAChC,GAAG,EAAE,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC;aACrC,CAAC,CAAC,CAAC;QACN,CAAC;QAED;;;;WAIG;QAEH,qBAAqB,CAAC,KAAa;YAGjC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC;gBAChC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC;aACvC,CAAC,CAAC,CAAC;QACN,CAAC;QAED;;;;;;WAMG;QAEH,QAAQ;YACN,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,CAAC;QAED,+EAA+E;QAE/E,aAAa,CAAC,KAAa,EAAE,SAAiB;YAC5C,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oEAAoE;gBACpE,oEAAoE;gBACpE,yBAAyB;gBACzB,MAAM,MAAM,GACV,KAAK,YAAY,kBAAkB;oBACjC,CAAC,CAAC,KAAK,CAAC,MAAM;oBACd,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAC5C,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;oBACrC,SAAS;oBACT,MAAM;oBACN,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,MAAM,IAAI,KAAK,CAAC,GAAG,mBAAmB,aAAa,MAAM,GAAG,EAAE;oBAC5D,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,iFAAiF;QAEjF,OAAO,CAAC,KAAa,EAAE,SAAiB;YACtC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QAED,gFAAgF;QAEhF,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,SAAiB,EACjB,UAAkB;YAElB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;YACpD,IACE,CAAC,MAAM,CAAC,OAAO;gBACf,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,EACrD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAC/B,CAAC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CACtE,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;YACvC,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC1E,IAAI,CAAC;gBACH,OAAO,MAAM,qBAAqB,CAAC;oBACjC,IAAI;oBACJ,UAAU;oBACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;iBACtD,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAEO,YAAY;YAClB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO;gBACxB,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE;gBACtD,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,GAAG,KAAK,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAClC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;YAC9B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,OAAO;YAC9D,IAAI,CAAC,YAAY,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE;gBACpE,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;QACtB,CAAC;;;SA5TU,SAAS;AA+TtB,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,cAAc,uBAAuB,CAAC;AAEtC,eAAe,SAAS,CAAC"}

package/lib/launch-token.js

@@ -0,0 +1,42 @@
+/**
+ * Resolve the launch token once per process (it is stable for the process
+ * lifetime); a missing connection service or an unusable answer warns once
+ * and permanently disables the bridge instead of retrying per request.
+ */
+export function makeLaunchTokenSource(getConnection, warn) {
+    let cached = null;
+    let warned = false;
+    const warnOnce = (message) => {
+        if (warned)
+            return;
+        warned = true;
+        warn(message);
+    };
+    return () => {
+        if (cached !== null)
+            return cached;
+        try {
+            const connection = getConnection();
+            if (connection === undefined ||
+                typeof connection.authenticatedUrl !== "function") {
+                warnOnce("launch-token bridge inactive: no connection.authenticatedUrl on the host");
+                cached = undefined;
+                return cached;
+            }
+            // The loopback base only feeds the URL parsing; host/scheme are dropped.
+            const token = new URL(connection.authenticatedUrl("http://127.0.0.1")).searchParams.get("token");
+            if (token === null || token === "") {
+                warnOnce("launch-token bridge inactive: authenticatedUrl carries no token");
+                cached = undefined;
+                return cached;
+            }
+            cached = token;
+        }
+        catch (error) {
+            warnOnce(`launch-token bridge failed: ${error instanceof Error ? error.message : String(error)}`);
+            cached = undefined;
+        }
+        return cached;
+    };
+}
+//# sourceMappingURL=launch-token.js.map

package/lib/launch-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-token.js","sourceRoot":"","sources":["../src/launch-token.ts"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAqD,EACrD,IAA+B;IAE/B,IAAI,MAAM,GAA8B,IAAI,CAAC;IAC7C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAQ,EAAE;QACzC,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,OAAO,CAAC,CAAC;IAChB,CAAC,CAAC;IACF,OAAO,GAAG,EAAE;QACV,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;YACnC,IACE,UAAU,KAAK,SAAS;gBACxB,OAAO,UAAU,CAAC,gBAAgB,KAAK,UAAU,EACjD,CAAC;gBACD,QAAQ,CACN,0EAA0E,CAC3E,CAAC;gBACF,MAAM,GAAG,SAAS,CAAC;gBACnB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,yEAAyE;YACzE,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAChD,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACnC,QAAQ,CACN,iEAAiE,CAClE,CAAC;gBACF,MAAM,GAAG,SAAS,CAAC;gBACnB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CACN,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxF,CAAC;YACF,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/lib/lockdown-policy.js

@@ -0,0 +1,20 @@
+const TOOL_DENIAL = "This tool is not available in the QA execution profile.";
+/**
+ * Validate an allow-list against the complete agent-scoped view.
+ *
+ * Preset tools live on an ancestor scope, not necessarily in the global tool
+ * layer. The restriction must therefore retain the configured names verbatim;
+ * deriving it from the global view would hide every preset-owned tool after a
+ * successful first attestation and make the next attestation fail.
+ */
+export function qaToolPolicyPlan(allow, isMounted) {
+    return {
+        allow: [...allow],
+        unknown: allow.filter((toolName) => !isMounted(toolName)),
+    };
+}
+/** Monotonic execution decision shared by inherited, scoped and transport tools. */
+export function qaToolDenial(allowed, toolName) {
+    return allowed.has(toolName) ? undefined : TOOL_DENIAL;
+}
+//# sourceMappingURL=lockdown-policy.js.map

package/lib/lockdown-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockdown-policy.js","sourceRoot":"","sources":["../src/lockdown-policy.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,yDAAyD,CAAC;AAS9E;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAwB,EACxB,SAAwC;IAExC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;QACjB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAC1B,OAA4B,EAC5B,QAAgB;IAEhB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;AACzD,CAAC"}

package/lib/provenance/collector.js

@@ -0,0 +1,40 @@
+import { dedupeAndRankSources } from "./dedupe.js";
+/** Mutable turn-local accumulator; snapshots are immutable plain data. */
+export class QaSourceCollector {
+    options;
+    collected = [];
+    incompleteOrigins = [];
+    threshold;
+    constructor(options) {
+        this.options = options;
+        this.threshold = options.displayScoreThreshold ?? 50;
+    }
+    observe(context) {
+        this.collected.push(...this.options.registry.extract(context));
+    }
+    add(sources) {
+        this.collected.push(...sources);
+    }
+    markIncomplete(origin) {
+        this.incompleteOrigins.push({ ...origin });
+    }
+    snapshot() {
+        const ranked = dedupeAndRankSources(this.collected, this.options.mergeFileRanges === undefined
+            ? {}
+            : { mergeFileRanges: this.options.mergeFileRanges });
+        const sources = ranked.filter((source) => source.evidence !== "discovered" && source.score >= this.threshold);
+        const discovered = ranked.filter((source) => !sources.includes(source));
+        return {
+            version: 1,
+            sessionId: this.options.sessionId,
+            turn: this.options.turn,
+            sources,
+            ...(discovered.length === 0 ? {} : { discovered }),
+            complete: this.incompleteOrigins.length === 0,
+            ...(this.incompleteOrigins.length === 0
+                ? {}
+                : { incompleteOrigins: [...this.incompleteOrigins] }),
+        };
+    }
+}
+//# sourceMappingURL=collector.js.map

package/lib/provenance/collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector.js","sourceRoot":"","sources":["../../src/provenance/collector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAgBnD,0EAA0E;AAC1E,MAAM,OAAO,iBAAiB;IASC,OAAO;IARnB,SAAS,GAAwB,EAAE,CAAC;IACpC,iBAAiB,GAI5B,EAAE,CAAC;IACQ,SAAS,CAAS;IAEnC,YAA6B,OAAiC;uBAAjC,OAAO;QAClC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,CAAC,OAA+B;QACrC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,GAAG,CAAC,OAAqC;QACvC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,cAAc,CAAC,MAId;QACC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,QAAQ;QACN,MAAM,MAAM,GAAG,oBAAoB,CACjC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CACtD,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CACrE,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,OAAO;YACL,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YACvB,OAAO;YACP,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;YAClD,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;SACxD,CAAC;IACJ,CAAC;CACF"}