@yadsh/dsh-qa-surface 0.7.2 → 0.7.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/lib/access/service.js +3 -0
  2. package/lib/access/service.js.map +1 -1
  3. package/lib/client/components/QaChangelog.js +24 -0
  4. package/lib/client/components/QaChangelog.js.map +1 -1
  5. package/lib/client.js +18 -2
  6. package/lib/client.js.map +1 -1
  7. package/lib/enforcement/tool-grants.js +21 -17
  8. package/lib/enforcement/tool-grants.js.map +1 -1
  9. package/lib/enforcement/tool-mask.js +52 -0
  10. package/lib/enforcement/tool-mask.js.map +1 -0
  11. package/lib/secure-session.js +49 -15
  12. package/lib/secure-session.js.map +1 -1
  13. package/lib/types/enforcement/tool-grants.d.ts +11 -7
  14. package/lib/types/enforcement/tool-mask.d.ts +38 -0
  15. package/lib/types/secure-session.d.ts +12 -0
  16. package/package.json +3 -3
package/lib/enforcement/tool-grants.js CHANGED
@@ -1,3 +1,4 @@
1
+ import { installInheritableMask } from "./tool-mask.js";
1
2
  function describe(tools) {
2
3
  return tools.map((tool) => `"${tool}"`).join(", ");
3
4
  }
@@ -14,7 +15,8 @@ function describe(tools) {
14
15
  * attaches its tools to the agent itself, and such a registration is visible to
15
16
  * the model without ever being nameable in a restriction: handing one to
16
17
  * `restrict()` makes the registry refuse the whole call. Every restriction this
17
- * class installs is therefore filtered to the inheritable names, and a grant is
18
+ * class installs is therefore installed through the mask helper, which admits
19
+ * the inherited names and leaves the self-registered ones out, and a grant is
18
20
  * verified against the same view — a name no layer holds is dropped from the
19
21
  * grant instead of breaking the session.
20
22
  */
@@ -33,19 +35,17 @@ export class QaAgentToolGrants {
33
35
  return this.tools;
34
36
  }
35
37
  /**
36
- * Whether the scoped registry can admit this name under a restriction.
38
+ * Whether the tool is callable for the agent at all, masks aside.
37
39
  *
38
- * `restrict()` accepts the names a scope inherits — the global and ancestor
39
- * layers — and nothing else. A tool the agent registered for itself is
40
- * deliberately absent here even though it is visible.
40
+ * The global view ignores restrictions and the agent's own view covers what
41
+ * the agent registered for itself, so a tool some layer holds stays grantable
42
+ * even while the current mask hides it.
41
43
  */
42
- restrictable(tool) {
43
- return this.options.agent.ctx.tools.get(tool) !== undefined;
44
- }
45
- /** Whether any layer makes this tool callable for the agent at all. */
46
44
  mounted(tool) {
45
+ if (this.options.agentLocalTools.has(tool))
46
+ return true;
47
47
  const tools = this.options.agent.ctx.tools;
48
- return (this.restrictable(tool) ||
48
+ return (tools.get(tool) !== undefined ||
49
49
  tools.get(tool, this.options.agent) !== undefined);
50
50
  }
51
51
  /** Grants currently held, newest last; one entry per activated skill. */
@@ -148,14 +148,18 @@ export class QaAgentToolGrants {
148
148
  * unrestricted, and a rejected name would then leave it that way.
149
149
  */
150
150
  applyRestriction(allow) {
151
- // Only inheritable names may reach the registry: a base set that carries an
152
- // agent-local tool (the QA activation diagnostic is one) would otherwise
153
- // make `restrict()` refuse the call and fail the whole attestation.
154
- const next = this.options.agent.ctx.tools.restrict({
155
- allow: allow.filter((tool) => this.restrictable(tool)),
156
- });
151
+ // Only names the scope INHERITS may reach the registry: a base set that
152
+ // carries an agent-local tool (the QA activation diagnostic is one) would
153
+ // otherwise make `restrict()` refuse the call and fail the whole
154
+ // attestation, and a name no layer holds would do the same.
155
+ const mask = installInheritableMask(this.options.agent.ctx.tools, allow, this.options.agentLocalTools);
156
+ if (mask.refused.length > 0) {
157
+ this.options.logger.warn("skill.tool-mask-incomplete", {
158
+ dropped: mask.refused,
159
+ });
160
+ }
157
161
  const previous = this.disposeRestriction;
158
- this.disposeRestriction = next;
162
+ this.disposeRestriction = mask.dispose;
159
163
  previous?.();
160
164
  }
161
165
  restore(before) {
package/lib/enforcement/tool-grants.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"tool-grants.js","sourceRoot":"","sources":["../../src/enforcement/tool-grants.ts"],"names":[],"mappings":"AAwCA,SAAS,QAAQ,CAAC,KAAwB;IACxC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,iBAAiB;IAKC,OAAO;IAJnB,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzC,KAAK,CAAc;IAC5B,kBAAkB,CAA2B;IAErD,YAA6B,OAAiC;uBAAjC,OAAO;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,uDAAuD;IACvD,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IAC9D,CAAC;IAED,uEAAuE;IAC/D,OAAO,CAAC,IAAY;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAC3C,OAAO,CACL,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,CAClD,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CACN,SAAiB,EACjB,MAA+B;QAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC3C,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,yEAAyE;YACzE,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;gBACpE,iDAAiD;YACnD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpE,IAAI,UAAU,EAAE,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,UAAU,SAAS,+CAA+C,QAAQ,CACvF,MAAM,CACP,uCAAuC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,KAAK,GAAiB,MAAM,CAAC,MAAM,CAAC;YACxC,SAAS;YACT,MAAM;YACN,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACxC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACrC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;YAChD,KAAK,EAAE,SAAS;YAChB,MAAM;YACN,OAAO,EAAE,QAAQ;YACjB,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,CAAC;YACjB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,yCAAyC;gBACzC,EAAE;gBACF,6BAA6B;gBAC7B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;aACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,KAAK;YACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,IAAI,CACF,SAAiB,EACjB,MAA+B,EAC/B,MAAc;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CACT,SAAS,EACT,MAAM,EACN,QAAQ,EACR,UAAU,EAAE,aAAa,IAAI,EAAE,EAC/B,EAAE,EACF,UAAU,EAAE,aAAa,IAAI,EAAE,EAC/B,MAAM,CACP,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,KAAwB;QAC/C,4EAA4E;QAC5E,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YACjD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACzC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,QAAQ,EAAE,EAAE,CAAC;IACf,CAAC;IAEO,OAAO,CAAC,MAAyB;QACvC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,MAAM,CACZ,SAAiB,EACjB,MAA+B,EAC/B,OAA2C,EAC3C,SAA4B,EAC5B,OAA0B,EAC1B,MAAyB,EACzB,MAAe;QAEf,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CACnB,MAAM,CAAC,MAAM,CAAC;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS;YACT,MAAM;YACN,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YAC7C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;YACzC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YACvC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;CACF"}
1
+ {"version":3,"file":"tool-grants.js","sourceRoot":"","sources":["../../src/enforcement/tool-grants.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AA4CxD,SAAS,QAAQ,CAAC,KAAwB;IACxC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,iBAAiB;IAKC,OAAO;IAJnB,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzC,KAAK,CAAc;IAC5B,kBAAkB,CAA2B;IAErD,YAA6B,OAAiC;uBAAjC,OAAO;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,uDAAuD;IACvD,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACK,OAAO,CAAC,IAAY;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAC3C,OAAO,CACL,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YAC7B,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,CAClD,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CACN,SAAiB,EACjB,MAA+B;QAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC3C,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,yEAAyE;YACzE,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;gBACpE,iDAAiD;YACnD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpE,IAAI,UAAU,EAAE,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,UAAU,SAAS,+CAA+C,QAAQ,CACvF,MAAM,CACP,uCAAuC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,KAAK,GAAiB,MAAM,CAAC,MAAM,CAAC;YACxC,SAAS;YACT,MAAM;YACN,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACxC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACrC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;YAChD,KAAK,EAAE,SAAS;YAChB,MAAM;YACN,OAAO,EAAE,QAAQ;YACjB,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,CAAC;YACjB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,yCAAyC;gBACzC,EAAE;gBACF,6BAA6B;gBAC7B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;aACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,KAAK;YACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,IAAI,CACF,SAAiB,EACjB,MAA+B,EAC/B,MAAc;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CACT,SAAS,EACT,MAAM,EACN,QAAQ,EACR,UAAU,EAAE,aAAa,IAAI,EAAE,EAC/B,EAAE,EACF,UAAU,EAAE,aAAa,IAAI,EAAE,EAC/B,MAAM,CACP,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,KAAwB;QAC/C,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,IAAI,GAAG,sBAAsB,CACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAC5B,KAAK,EACL,IAAI,CAAC,OAAO,CAAC,eAAe,CAC7B,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACzC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,EAAE,CAAC;IACf,CAAC;IAEO,OAAO,CAAC,MAAyB;QACvC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,MAAM,CACZ,SAAiB,EACjB,MAA+B,EAC/B,OAA2C,EAC3C,SAA4B,EAC5B,OAA0B,EAC1B,MAAyB,EACzB,MAAe;QAEf,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CACnB,MAAM,CAAC,MAAM,CAAC;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS;YACT,MAAM;YACN,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YAC7C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;YACzC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YACvC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;CACF"}
package/lib/enforcement/tool-mask.js ADDED
@@ -0,0 +1,52 @@
1
+ /** Quoted names in the registry's refusal of unnameable restriction entries. */
2
+ const QUOTED_NAME = /"([^"]+)"/gu;
3
+ function messageOf(error) {
4
+ if (error instanceof Error)
5
+ return error.message;
6
+ return String(error);
7
+ }
8
+ /**
9
+ * Install a scoped restriction over the names a QA session may see.
10
+ *
11
+ * `restrict()` filters what a scope INHERITS — the global layer and the
12
+ * ancestor layers, a preset's own tool rows among them. It refuses, with one
13
+ * error, three different things: a name no layer holds, a name the scope
14
+ * registers for itself, and an empty list. The QA tool catalog attaches its
15
+ * tools to the agent itself, so `qa_tools_selfcheck` is exactly the second
16
+ * case, and a single such entry used to make the registry refuse the whole
17
+ * call and fail every chat's attestation.
18
+ *
19
+ * This function therefore filters the self-registered names out first, and
20
+ * then gives up whatever the registry still refuses, one round at a time: an
21
+ * entry the mask cannot name costs that entry, never the session. The caller's
22
+ * execution guard is unaffected — it keeps enforcing the full policy — so an
23
+ * entry that never reaches the mask stays callable and denied, not allowed.
24
+ * @param tools - the agent's scoped registry.
25
+ * @param allow - names the mask should admit, in policy order.
26
+ * @param agentLocal - names the QA catalog registers on the agent itself.
27
+ * @returns the installed mask, plus the names that did not make it in.
28
+ */
29
+ export function installInheritableMask(tools, allow, agentLocal) {
30
+ const refused = [];
31
+ let names = [...new Set(allow)].filter((name) => !agentLocal.has(name));
32
+ while (names.length > 0) {
33
+ try {
34
+ return { dispose: tools.restrict({ allow: names }), refused };
35
+ }
36
+ catch (error) {
37
+ const rejected = new Set([...messageOf(error).matchAll(QUOTED_NAME)].map((match) => match[1]));
38
+ const next = names.filter((name) => !rejected.has(name));
39
+ if (next.length === names.length) {
40
+ // The refusal named nothing this mask carries — an empty list and an
41
+ // unrecognized failure both land here. Stop instead of looping.
42
+ refused.push(...names);
43
+ return { dispose: () => undefined, refused };
44
+ }
45
+ refused.push(...names.filter((name) => rejected.has(name)));
46
+ names = next;
47
+ }
48
+ }
49
+ // Every name was self-registered: the model surface needs no mask.
50
+ return { dispose: () => undefined, refused };
51
+ }
52
+ //# sourceMappingURL=tool-mask.js.map
package/lib/enforcement/tool-mask.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"tool-mask.js","sourceRoot":"","sources":["../../src/enforcement/tool-mask.ts"],"names":[],"mappings":"AAkBA,gFAAgF;AAChF,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAuB,EACvB,KAAwB,EACxB,UAA+B;IAE/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACrE,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjC,qEAAqE;gBACrE,gEAAgE;gBAChE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5D,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}
package/lib/secure-session.js CHANGED
@@ -6,6 +6,7 @@ import { QaAccountsError } from "./accounts/store.js";
6
6
  import { QaAttestationError } from "./attestation.js";
7
7
  import { qaToolDenial, qaToolPolicyPlan } from "./lockdown-policy.js";
8
8
  import { installQaSkillPolicy } from "./enforcement/skill-policy.js";
9
+ import { installInheritableMask } from "./enforcement/tool-mask.js";
9
10
  import { QA_REPORT_SOURCES_TOOL } from "./provenance/host-store.js";
10
11
  import { qaUserWorkspaceDenial } from "./user-workspace.js";
11
12
  /** Grace period in which a fresh session may still be pinned to the QA preset. */
@@ -267,8 +268,28 @@ export class QaPolicyAdmission {
267
268
  // asking to attest it.
268
269
  const capability = await this.capabilityPolicy?.(token, sessionId, agent);
269
270
  const basePolicyAllow = capability?.policy.tools ?? lockdown.toolPolicy.allow;
271
+ // One mount test for the whole policy: a name that is neither visible to
272
+ // this agent nor declared by the QA catalog is refused below, so nothing
273
+ // may be added to the list without passing it.
274
+ const isMounted = (toolName) => this.ctx.tools.get(toolName, agent) !== undefined ||
275
+ this.knownDynamicToolNames().includes(toolName);
276
+ // The provenance reporter is this plugin's own tool, mounted only while the
277
+ // deployment runs the sources fallback. Naming it in a deployment that does
278
+ // not mount it would refuse every chat instead of degrading that fallback,
279
+ // so the append is gated on the mount test like every configured name.
280
+ const reportToolMissing = config.sources.enabled &&
281
+ config.sources.subagents.enableReportToolFallback &&
282
+ !basePolicyAllow.includes(QA_REPORT_SOURCES_TOOL) &&
283
+ !isMounted(QA_REPORT_SOURCES_TOOL);
284
+ if (reportToolMissing) {
285
+ this.logger.warn("sources.report-tool-unmounted", {
286
+ sessionId,
287
+ tool: QA_REPORT_SOURCES_TOOL,
288
+ });
289
+ }
270
290
  const configuredPolicyAllow = config.sources.enabled &&
271
291
  config.sources.subagents.enableReportToolFallback &&
292
+ !reportToolMissing &&
272
293
  !basePolicyAllow.includes(QA_REPORT_SOURCES_TOOL)
273
294
  ? [...basePolicyAllow, QA_REPORT_SOURCES_TOOL]
274
295
  : basePolicyAllow;
@@ -282,8 +303,7 @@ export class QaPolicyAdmission {
282
303
  ...(capability === undefined ? this.principalScopedTools : []),
283
304
  ]),
284
305
  ];
285
- const policy = qaToolPolicyPlan(policyAllow, (toolName) => this.ctx.tools.get(toolName, agent) !== undefined ||
286
- this.knownDynamicToolNames().includes(toolName));
306
+ const policy = qaToolPolicyPlan(policyAllow, isMounted);
287
307
  if (policy.unknown.length > 0) {
288
308
  throw new QaAttestationError("unknown-tools", `unknown QA tool(s): ${policy.unknown.join(", ")}`);
289
309
  }
@@ -295,15 +315,6 @@ export class QaPolicyAdmission {
295
315
  const prior = this.appliedPolicies.get(agent);
296
316
  if (prior?.fingerprint !== fingerprint) {
297
317
  const allowed = new Set(policy.allow);
298
- // `restrict()` accepts only names the agent INHERITS, and the QA tool
299
- // catalog attaches its tools to the agent itself. The activation
300
- // diagnostic therefore passes the `unknown-tools` check above — the
301
- // catalog declares it — and would still make `restrict()` refuse the
302
- // whole call and fail every chat's attestation. It keeps its place in the
303
- // policy and in the guard below; only the mask skips it, which is also
304
- // what makes a name the registry does not hold globally a loud refusal
305
- // above rather than a silent omission here.
306
- const restrictable = policy.allow.filter((name) => this.ctx.tools.get(name) !== undefined);
307
318
  // A capability policy owns the scoped restriction, because activating a
308
319
  // skill has to widen it later. The account-free path keeps the static
309
320
  // mask it has always used.
@@ -314,7 +325,7 @@ export class QaPolicyAdmission {
314
325
  try {
315
326
  disposeTools =
316
327
  grants === undefined
317
- ? agent.ctx.tools.restrict({ allow: restrictable })
328
+ ? this.maskAgentTools(agent, policy.allow, sessionId)
318
329
  : () => grants.dispose();
319
330
  disposeGuard = agent.ctx.tools.guard((execution) => {
320
331
  const subject = execution.agent;
@@ -394,11 +405,34 @@ export class QaPolicyAdmission {
394
405
  approvalIsNever,
395
406
  permissionPreset: lockdown.permissionPreset,
396
407
  toolPolicyLoaded: true,
397
- // The fallback reporter is an internal read-only provenance capability,
398
- // not an operator-configured QA tool grant.
399
- toolAllowList: capability?.policy.tools ?? lockdown.toolPolicy.allow,
408
+ // The deployment's pinned list, not this session's effective one: the
409
+ // browser answers this proof against the lockdown config it holds, and a
410
+ // subrole narrows that list — or the plugin adds its own internals to it —
411
+ // without changing the config either side treats as the contract.
412
+ toolAllowList: lockdown.toolPolicy.allow,
400
413
  };
401
414
  }
415
+ /**
416
+ * Mask one agent down to the policy's tool names, for the account-free path
417
+ * (a capability policy installs its own mask through its grants).
418
+ *
419
+ * The mask admits what the scope inherits — the global layer and the ancestor
420
+ * layers, which is where a preset's own tool rows live — and skips the names
421
+ * the QA catalog registers on the agent, since a restriction cannot name
422
+ * those. A name that is neither, or that the registry refuses for any other
423
+ * reason, is left out of the mask and reported instead of failing the chat:
424
+ * the guard below still denies it, so the effective set is unchanged.
425
+ */
426
+ maskAgentTools(agent, allow, sessionId) {
427
+ const mask = installInheritableMask(agent.ctx.tools, allow, new Set(this.knownDynamicToolNames()));
428
+ if (mask.refused.length > 0) {
429
+ this.logger.warn("lockdown.tool-mask-incomplete", {
430
+ sessionId,
431
+ dropped: mask.refused,
432
+ });
433
+ }
434
+ return mask.dispose;
435
+ }
402
436
  /** Resolve the deployment facts shared by creation and full attestation. */
403
437
  deploymentPins(config) {
404
438
  if (!config.lockdown.enabled)
package/lib/secure-session.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"secure-session.js","sourceRoot":"","sources":["../src/secure-session.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAiC5D,kFAAkF;AAClF,MAAM,iCAAiC,GAAG,OAAO,CAAC;AAElD;;;;GAIG;AACH,SAAS,UAAU,CAAC,SAA6B,EAAE,MAAc;IAC/D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAcT,GAAG;IACH,MAAM;IACN,MAAM;IACN,QAAQ;IAMR,gBAAgB;IAIhB,gBAAgB;IAMhB,qBAAqB;IAhCvB,eAAe,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnE,gFAAgF;IAC/D,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1D;;;;OAIG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzD,qBAAqB,CAAa;IAEnD,YACmB,GAAY,EACZ,MAAqC,EACrC,MAAoB,EACpB,QAAyB;IAC1C;;;;OAIG;IACc,gBAAgB,GAER,GAAG,EAAE,CAAC,EAAE;IACjC,8EAA8E;IAC7D,gBAIgC;IACjD,0EAA0E;IACzD,qBAAqB,GAA4B,GAAG,EAAE,CAAC,EAAE;mBAnBzD,GAAG;sBACH,MAAM;sBACN,MAAM;wBACN,QAAQ;gCAMR,gBAAgB;gCAIhB,gBAAgB;qCAMhB,qBAAqB;QAEtC,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;YACzD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;YACzC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,OAAO,sEAAsE,CAAC;YAChF,CAAC;YACD,OAAO,qBAAqB,CAC1B,SAAS,EACT,MAAM,CAAC,IAAI,EACX,IAAI,CAAC,cAAc,EAAE,EACrB,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YACrC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,4BAA4B,CAAC,KAAwB;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,GAAG,EAAE;YACV,KAAK,MAAM,IAAI,IAAI,UAAU;gBAAE,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QACjB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,cAAc;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CACC,CAAC;QAC1C,OAAO,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,SAAS,CAAC,SAAiB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAC5D,SAAS,CAAC,SAAS,CAAC,CACrB,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,YAAiD,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,kBAAkB,CAC1B,KAAK,CAAC,MAAM,KAAK,yBAAyB;wBACxC,CAAC,CAAC,yBAAyB;wBAC3B,CAAC,CAAC,eAAe,EACnB,KAAK,CAAC,OAAO,CACd,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO;gBACL,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;gBACtB,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,KAAK;gBACzB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,KAAK;gBACvB,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7C,IAAI,gBAAoC,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACrC,IAAI,YAAY,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,4CAA4C,CAC7C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAC7C,YAAY,CAAC,EAAE,EACf,eAAe,CAAC,IAAI,CACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,MAAM,kBAAkB,GACtB,CAAC,QAAQ,CAAC,uBAAuB;YACjC,cAAc,KAAK,IAAI;YACvB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC;QAErE,MAAM,gBAAgB,GACpB,CAAC,QAAQ,CAAC,qBAAqB;YAC/B,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YAC3D,CAAC,gBAAgB,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB;gBAChC,eAAe,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC,iBAAiB,KAAK,IAAI;gBACzB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;gBAC3B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAErB,CAAC;QACF,MAAM,YAAY,GAChB,CAAC,QAAQ,CAAC,iBAAiB;YAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI;YAChC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ;gBAC3C,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK;gBACtC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;oBACtC,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,EACtB,+BAA+B,kBAAkB,cAAc,gBAAgB,UAAU,YAAY,EAAE,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAW,CAAC;QAEpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5E,oEAAoE;QACpE,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,cAAc,CAC7D,CAAC;QACF,IACE,iBAAiB,KAAK,QAAQ,CAAC,gBAAgB;YAC/C,CAAC,cAAc;gBACb,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;oBACzC,iCAAiC,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,iEAAiE;QACjE,0EAA0E;QAC1E,uBAAuB;QACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAE1E,MAAM,eAAe,GACnB,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QACxD,MAAM,qBAAqB,GACzB,MAAM,CAAC,OAAO,CAAC,OAAO;YACtB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;YACjD,CAAC,eAAe,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC/C,CAAC,CAAC,CAAC,GAAG,eAAe,EAAE,sBAAsB,CAAC;YAC9C,CAAC,CAAC,eAAe,CAAC;QACtB,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,WAAW,GAAG;YAClB,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,qBAAqB;gBACxB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;SACH,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,WAAW,EACX,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,SAAS;YACjD,IAAI,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAClD,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,uBAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,MAAM,CAAC,KAAK;YACZ,UAAU,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC/B,UAAU,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,sEAAsE;YACtE,iEAAiE;YACjE,oEAAoE;YACpE,qEAAqE;YACrE,0EAA0E;YAC1E,uEAAuE;YACvE,uEAAuE;YACvE,4CAA4C;YAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,CACjD,CAAC;YACF,wEAAwE;YACxE,sEAAsE;YACtE,2BAA2B;YAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,YAAY,EAAE,CAAC;YAC1C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,kBAAkB,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YACrD,IAAI,CAAC;gBACH,YAAY;oBACV,MAAM,KAAK,SAAS;wBAClB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;wBACnD,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;oBACjD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;oBAChC,OAAO,YAAY,CACjB,MAAM,EAAE,cAAc,EAAE,IAAI,OAAO,EACnC,SAAS,CAAC,IAAI,EACd,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;wBAC/C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;wBAChC,CAAC,CAAC,EAAE,CACP,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,uEAAuE;gBACvE,gEAAgE;gBAChE,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBAC5B,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACrD,kBAAkB,GAAG,oBAAoB,CAAC;wBACxC,KAAK;wBACL,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,UAAU,EAAE,UAAU,CAAC,MAAM;wBAC7B,MAAM;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,OAAO,EAAE,UAAU,CAAC,YAAY;qBACjC,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE;oBAC9B,WAAW;oBACX,YAAY;oBACZ,YAAY;oBACZ,kBAAkB;iBACnB,CAAC,CAAC;gBACH,KAAK,EAAE,YAAY,EAAE,CAAC;gBACtB,KAAK,EAAE,YAAY,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,kBAAkB,EAAE,CAAC;gBACrB,YAAY,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC5D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW,CAAC;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC;QACxD,IACE,mBAAmB,KAAK,QAAQ,CAAC,gBAAgB;YACjD,CAAC,kBAAkB;YACnB,CAAC,eAAe,EAChB,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE;oBAClC,IAAI,EAAE,gBAAgB;oBACtB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;iBAClD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,gDAAgD;gBAChD,aAAa,CAAC,IAAI,GAAG,gBAAgB,CAAC;gBACtC,aAAa,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACrC,SAAS;YACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,aAAa,EAAE,MAAM,CAAC,KAAK;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,SAAS;YACT,OAAO,EAAE,IAAI;YACb,kBAAkB;YAClB,gBAAgB;YAChB,YAAY;YACZ,kBAAkB;YAClB,eAAe;YACf,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,gBAAgB,EAAE,IAAI;YACtB,wEAAwE;YACxE,4CAA4C;YAC5C,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK;SACrE,CAAC;IACJ,CAAC;IAED,4EAA4E;IACpE,cAAc,CAAC,MAA+B;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAExC,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GACnB,iBAAiB,KAAK,IAAI;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACrE,IAAI,iBAAiB,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,aAAa,iBAAiB,oBAAoB,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,UAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC7C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClI,CAAC;QACJ,CAAC;QACD,IACE,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW;YAClD,UAAU,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,cAAc,EACtD,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,wBAAwB,MAAM,CAAC,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAC7I,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE,UAAU,EAAE;YAChB,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;CACF"}
1
+ {"version":3,"file":"secure-session.js","sourceRoot":"","sources":["../src/secure-session.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAiC5D,kFAAkF;AAClF,MAAM,iCAAiC,GAAG,OAAO,CAAC;AAElD;;;;GAIG;AACH,SAAS,UAAU,CAAC,SAA6B,EAAE,MAAc;IAC/D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAcT,GAAG;IACH,MAAM;IACN,MAAM;IACN,QAAQ;IAMR,gBAAgB;IAIhB,gBAAgB;IAMhB,qBAAqB;IAhCvB,eAAe,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnE,gFAAgF;IAC/D,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1D;;;;OAIG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzD,qBAAqB,CAAa;IAEnD,YACmB,GAAY,EACZ,MAAqC,EACrC,MAAoB,EACpB,QAAyB;IAC1C;;;;OAIG;IACc,gBAAgB,GAER,GAAG,EAAE,CAAC,EAAE;IACjC,8EAA8E;IAC7D,gBAIgC;IACjD,0EAA0E;IACzD,qBAAqB,GAA4B,GAAG,EAAE,CAAC,EAAE;mBAnBzD,GAAG;sBACH,MAAM;sBACN,MAAM;wBACN,QAAQ;gCAMR,gBAAgB;gCAIhB,gBAAgB;qCAMhB,qBAAqB;QAEtC,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;YACzD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;YACzC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,OAAO,sEAAsE,CAAC;YAChF,CAAC;YACD,OAAO,qBAAqB,CAC1B,SAAS,EACT,MAAM,CAAC,IAAI,EACX,IAAI,CAAC,cAAc,EAAE,EACrB,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YACrC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,4BAA4B,CAAC,KAAwB;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,GAAG,EAAE;YACV,KAAK,MAAM,IAAI,IAAI,UAAU;gBAAE,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QACjB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,cAAc;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CACC,CAAC;QAC1C,OAAO,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,SAAS,CAAC,SAAiB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAC5D,SAAS,CAAC,SAAS,CAAC,CACrB,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,YAAiD,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,kBAAkB,CAC1B,KAAK,CAAC,MAAM,KAAK,yBAAyB;wBACxC,CAAC,CAAC,yBAAyB;wBAC3B,CAAC,CAAC,eAAe,EACnB,KAAK,CAAC,OAAO,CACd,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO;gBACL,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;gBACtB,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,KAAK;gBACzB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,KAAK;gBACvB,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7C,IAAI,gBAAoC,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACrC,IAAI,YAAY,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,4CAA4C,CAC7C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAC7C,YAAY,CAAC,EAAE,EACf,eAAe,CAAC,IAAI,CACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,MAAM,kBAAkB,GACtB,CAAC,QAAQ,CAAC,uBAAuB;YACjC,cAAc,KAAK,IAAI;YACvB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC;QAErE,MAAM,gBAAgB,GACpB,CAAC,QAAQ,CAAC,qBAAqB;YAC/B,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YAC3D,CAAC,gBAAgB,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB;gBAChC,eAAe,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC,iBAAiB,KAAK,IAAI;gBACzB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;gBAC3B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAErB,CAAC;QACF,MAAM,YAAY,GAChB,CAAC,QAAQ,CAAC,iBAAiB;YAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI;YAChC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ;gBAC3C,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK;gBACtC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;oBACtC,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,EACtB,+BAA+B,kBAAkB,cAAc,gBAAgB,UAAU,YAAY,EAAE,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAW,CAAC;QAEpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5E,oEAAoE;QACpE,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,cAAc,CAC7D,CAAC;QACF,IACE,iBAAiB,KAAK,QAAQ,CAAC,gBAAgB;YAC/C,CAAC,cAAc;gBACb,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;oBACzC,iCAAiC,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,iEAAiE;QACjE,0EAA0E;QAC1E,uBAAuB;QACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAE1E,MAAM,eAAe,GACnB,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QACxD,yEAAyE;QACzE,yEAAyE;QACzE,+CAA+C;QAC/C,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,SAAS;YACjD,IAAI,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClD,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,iBAAiB,GACrB,MAAM,CAAC,OAAO,CAAC,OAAO;YACtB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;YACjD,CAAC,eAAe,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACjD,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACrC,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAChD,SAAS;gBACT,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,qBAAqB,GACzB,MAAM,CAAC,OAAO,CAAC,OAAO;YACtB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;YACjD,CAAC,iBAAiB;YAClB,CAAC,eAAe,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC/C,CAAC,CAAC,CAAC,GAAG,eAAe,EAAE,sBAAsB,CAAC;YAC9C,CAAC,CAAC,eAAe,CAAC;QACtB,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,WAAW,GAAG;YAClB,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,qBAAqB;gBACxB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;SACH,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,uBAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,MAAM,CAAC,KAAK;YACZ,UAAU,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC/B,UAAU,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,wEAAwE;YACxE,sEAAsE;YACtE,2BAA2B;YAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,YAAY,EAAE,CAAC;YAC1C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,kBAAkB,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YACrD,IAAI,CAAC;gBACH,YAAY;oBACV,MAAM,KAAK,SAAS;wBAClB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC;wBACrD,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;oBACjD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;oBAChC,OAAO,YAAY,CACjB,MAAM,EAAE,cAAc,EAAE,IAAI,OAAO,EACnC,SAAS,CAAC,IAAI,EACd,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;wBAC/C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;wBAChC,CAAC,CAAC,EAAE,CACP,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,uEAAuE;gBACvE,gEAAgE;gBAChE,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBAC5B,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACrD,kBAAkB,GAAG,oBAAoB,CAAC;wBACxC,KAAK;wBACL,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,UAAU,EAAE,UAAU,CAAC,MAAM;wBAC7B,MAAM;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,OAAO,EAAE,UAAU,CAAC,YAAY;qBACjC,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE;oBAC9B,WAAW;oBACX,YAAY;oBACZ,YAAY;oBACZ,kBAAkB;iBACnB,CAAC,CAAC;gBACH,KAAK,EAAE,YAAY,EAAE,CAAC;gBACtB,KAAK,EAAE,YAAY,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,kBAAkB,EAAE,CAAC;gBACrB,YAAY,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC5D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW,CAAC;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC;QACxD,IACE,mBAAmB,KAAK,QAAQ,CAAC,gBAAgB;YACjD,CAAC,kBAAkB;YACnB,CAAC,eAAe,EAChB,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE;oBAClC,IAAI,EAAE,gBAAgB;oBACtB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;iBAClD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,gDAAgD;gBAChD,aAAa,CAAC,IAAI,GAAG,gBAAgB,CAAC;gBACtC,aAAa,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACrC,SAAS;YACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,aAAa,EAAE,MAAM,CAAC,KAAK;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,SAAS;YACT,OAAO,EAAE,IAAI;YACb,kBAAkB;YAClB,gBAAgB;YAChB,YAAY;YACZ,kBAAkB;YAClB,eAAe;YACf,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,gBAAgB,EAAE,IAAI;YACtB,sEAAsE;YACtE,yEAAyE;YACzE,2EAA2E;YAC3E,kEAAkE;YAClE,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,cAAc,CACpB,KAAY,EACZ,KAAwB,EACxB,SAAiB;QAEjB,MAAM,IAAI,GAAG,sBAAsB,CACjC,KAAK,CAAC,GAAG,CAAC,KAAK,EACf,KAAK,EACL,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CACtC,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAChD,SAAS;gBACT,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,4EAA4E;IACpE,cAAc,CAAC,MAA+B;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAExC,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GACnB,iBAAiB,KAAK,IAAI;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACrE,IAAI,iBAAiB,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,aAAa,iBAAiB,oBAAoB,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,UAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC7C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClI,CAAC;QACJ,CAAC;QACD,IACE,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW;YAClD,UAAU,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,cAAc,EACtD,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,wBAAwB,MAAM,CAAC,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAC7I,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE,UAAU,EAAE;YAChB,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;CACF"}
package/lib/types/enforcement/tool-grants.d.ts CHANGED
@@ -25,6 +25,11 @@ export interface QaAgentToolGrantsOptions {
25
25
  readonly baseTools: readonly string[];
26
26
  /** Ceiling for grants, already narrowed to tools that exist right now. */
27
27
  readonly grantableTools: readonly string[];
28
+ /**
29
+ * Names the QA tool catalog registers on the agent itself. A restriction
30
+ * cannot name one, so the mask leaves them out; the guard covers them.
31
+ */
32
+ readonly agentLocalTools: ReadonlySet<string>;
28
33
  /** Normalized `metadata.qa-surface` of every discovered skill. */
29
34
  readonly descriptors: ReadonlyMap<string, QaSkillDescriptor>;
30
35
  readonly logger: PluginLogger;
@@ -44,7 +49,8 @@ export interface QaAgentToolGrantsOptions {
44
49
  * attaches its tools to the agent itself, and such a registration is visible to
45
50
  * the model without ever being nameable in a restriction: handing one to
46
51
  * `restrict()` makes the registry refuse the whole call. Every restriction this
47
- * class installs is therefore filtered to the inheritable names, and a grant is
52
+ * class installs is therefore installed through the mask helper, which admits
53
+ * the inherited names and leaves the self-registered ones out, and a grant is
48
54
  * verified against the same view — a name no layer holds is dropped from the
49
55
  * grant instead of breaking the session.
50
56
  */
@@ -57,14 +63,12 @@ export declare class QaAgentToolGrants {
57
63
  /** Whether the model would see this tool right now. */
58
64
  effectiveTools(): ReadonlySet<string>;
59
65
  /**
60
- * Whether the scoped registry can admit this name under a restriction.
66
+ * Whether the tool is callable for the agent at all, masks aside.
61
67
  *
62
- * `restrict()` accepts the names a scope inherits — the global and ancestor
63
- * layers — and nothing else. A tool the agent registered for itself is
64
- * deliberately absent here even though it is visible.
68
+ * The global view ignores restrictions and the agent's own view covers what
69
+ * the agent registered for itself, so a tool some layer holds stays grantable
70
+ * even while the current mask hides it.
65
71
  */
66
- private restrictable;
67
- /** Whether any layer makes this tool callable for the agent at all. */
68
72
  private mounted;
69
73
  /** Grants currently held, newest last; one entry per activated skill. */
70
74
  activeGrants(): readonly QaSkillGrant[];
package/lib/types/enforcement/tool-mask.d.ts ADDED
@@ -0,0 +1,38 @@
1
+ import type { Context } from "@deepseek-ai/cordis";
2
+ /** The registry surface one mask needs: a single scoped restriction call. */
3
+ export type QaToolMaskTarget = Pick<Context["tools"], "restrict">;
4
+ /** One installed mask: how to lift it, and what it could not name. */
5
+ export interface QaToolMask {
6
+ /** Lift the mask. A no-op when the registry took no mask at all. */
7
+ readonly dispose: () => void;
8
+ /**
9
+ * Names left out of the mask, in the order they were given up: a name the
10
+ * agent registers for itself never enters a mask, and a name no layer holds
11
+ * is dropped by the registry. Reported so an operator learns that the
12
+ * deployment's allow-list names something this session cannot restrict.
13
+ */
14
+ readonly refused: readonly string[];
15
+ }
16
+ /**
17
+ * Install a scoped restriction over the names a QA session may see.
18
+ *
19
+ * `restrict()` filters what a scope INHERITS — the global layer and the
20
+ * ancestor layers, a preset's own tool rows among them. It refuses, with one
21
+ * error, three different things: a name no layer holds, a name the scope
22
+ * registers for itself, and an empty list. The QA tool catalog attaches its
23
+ * tools to the agent itself, so `qa_tools_selfcheck` is exactly the second
24
+ * case, and a single such entry used to make the registry refuse the whole
25
+ * call and fail every chat's attestation.
26
+ *
27
+ * This function therefore filters the self-registered names out first, and
28
+ * then gives up whatever the registry still refuses, one round at a time: an
29
+ * entry the mask cannot name costs that entry, never the session. The caller's
30
+ * execution guard is unaffected — it keeps enforcing the full policy — so an
31
+ * entry that never reaches the mask stays callable and denied, not allowed.
32
+ * @param tools - the agent's scoped registry.
33
+ * @param allow - names the mask should admit, in policy order.
34
+ * @param agentLocal - names the QA catalog registers on the agent itself.
35
+ * @returns the installed mask, plus the names that did not make it in.
36
+ */
37
+ export declare function installInheritableMask(tools: QaToolMaskTarget, allow: readonly string[], agentLocal: ReadonlySet<string>): QaToolMask;
38
+ //# sourceMappingURL=tool-mask.d.ts.map
package/lib/types/secure-session.d.ts CHANGED
@@ -101,6 +101,18 @@ export declare class QaPolicyAdmission {
101
101
  */
102
102
  private liveAgent;
103
103
  secureSession(token: string, sessionId: string): Promise<QaLockdownProof>;
104
+ /**
105
+ * Mask one agent down to the policy's tool names, for the account-free path
106
+ * (a capability policy installs its own mask through its grants).
107
+ *
108
+ * The mask admits what the scope inherits — the global layer and the ancestor
109
+ * layers, which is where a preset's own tool rows live — and skips the names
110
+ * the QA catalog registers on the agent, since a restriction cannot name
111
+ * those. A name that is neither, or that the registry refuses for any other
112
+ * reason, is left out of the mask and reported instead of failing the chat:
113
+ * the guard below still denies it, so the effective set is unchanged.
114
+ */
115
+ private maskAgentTools;
104
116
  /** Resolve the deployment facts shared by creation and full attestation. */
105
117
  private deploymentPins;
106
118
  /**
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@yadsh/dsh-qa-surface",
3
- "version": "0.7.2",
3
+ "version": "0.7.4",
4
4
  "description": "A focused end-user QA surface backed by native DeepSeek Harness sessions",
5
5
  "repository": {
6
6
  "type": "git",
@@ -174,9 +174,9 @@
174
174
  "tsdown": "^0.22.14",
175
175
  "typescript": "^7.0.2",
176
176
  "vitest": "^4.1.11",
177
- "@yadsh/dsh-plugin-kit": "^0.1.0",
177
+ "@yadsh/dsh-config": "^0.0.0",
178
178
  "@yadsh/dsh-plugin-scripts": "^0.0.0",
179
- "@yadsh/dsh-config": "^0.0.0"
179
+ "@yadsh/dsh-plugin-kit": "^0.1.0"
180
180
  },
181
181
  "publishConfig": {
182
182
  "access": "public",