@yiaany/ghostapi 0.1.6 → 0.1.8

package/dist/egress/run.js

@@ -0,0 +1,305 @@
+import { randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { mkdir, readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { basename, join } from "node:path";
+import { getDataDir } from "../config/dataPaths.js";
+import { sanitizeSecretString } from "../security/secrets.js";
+import { atomicWriteJson } from "../storage/fileStore.js";
+import { evaluatePolicy, formatPolicyDecision, loadPolicyFile } from "../policy/index.js";
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "::1", "localhost"]);
+const STREAM_SECRET_PREFIXES = ["sk_live_", "sk_test_", "rk_live_", "ghp_", "github_pat_", "xoxb-", "sg."];
+export class EgressRunError extends Error {
+    hint;
+    constructor(message, hint) {
+        super(message);
+        this.name = "EgressRunError";
+        this.hint = hint;
+    }
+}
+export async function runEgressCommand(options) {
+    const loadedPolicy = await loadPolicyFile(options.policyPath, process.cwd(), options.policyPath !== undefined);
+    validateOptions(options, loadedPolicy?.policy);
+    if (process.platform !== "linux") {
+        throw new EgressRunError(`ghostapi run enforcement is unavailable on ${process.platform}.`, "Use a Linux host with unshare-enabled user and network namespaces. Proxy guidance is not an enforcement fallback.");
+    }
+    const runId = randomUUID();
+    const port = options.port ?? 8080;
+    const runDirectory = join(getDataDir(), "runs", runId);
+    const evidencePath = join(runDirectory, "run.json");
+    const runtimeDataDir = join(runDirectory, "runtime");
+    const allowedHosts = uniqueHosts(["127.0.0.1", "localhost", ...options.allowHosts]);
+    const evidence = {
+        schemaVersion: 1,
+        runId,
+        backend: "linux-network-namespace",
+        status: "preparing",
+        command: { executable: sanitizeSecretString(basename(options.command[0])), argumentCount: options.command.length - 1 },
+        policy: { default: "deny", allowedHosts, ghostApiOrigin: `http://127.0.0.1:${port}`, policyHash: loadedPolicy?.hash, requiredScenarios: loadedPolicy?.policy.requiredScenarios ?? [] },
+        networkAttemptAttribution: "allowed GhostAPI requests appear in the GhostAPI event log; denied kernel socket attempts are not attributable by this backend",
+        events: [{ type: "run-created", timestamp: new Date().toISOString() }]
+    };
+    await mkdir(runtimeDataDir, { recursive: true, mode: 0o700 });
+    await atomicWriteJson(evidencePath, evidence);
+    try {
+        await preflightLinuxNamespaces();
+        evidence.events.push({ type: "namespace-preflight-passed", timestamp: new Date().toISOString() });
+        await atomicWriteJson(evidencePath, evidence);
+        const result = await launchLinuxNamespace(options.command, { runId, port, runDirectory, runtimeDataDir, evidencePath, allowedHosts, timeoutMs: options.timeoutMs, maxOutputBytes: options.maxOutputBytes });
+        const finishedEvidence = JSON.parse(await readFile(evidencePath, "utf8"));
+        finishedEvidence.output = { bytesObserved: result.outputBytes, secretMatches: result.outputSecretMatches, limitExceeded: result.outputLimitExceeded, timedOut: result.timedOut };
+        if (result.timedOut)
+            finishedEvidence.events.push({ type: "run-timeout", timestamp: new Date().toISOString() });
+        if (result.outputLimitExceeded)
+            finishedEvidence.events.push({ type: "run-output-limit-exceeded", timestamp: new Date().toISOString() });
+        if (result.interruptedBy !== undefined) {
+            finishedEvidence.events.push({ type: "run-interrupted", timestamp: new Date().toISOString(), detail: result.interruptedBy, exitCode: signalExitCode(result.interruptedBy) });
+            if (finishedEvidence.status === "preparing" || finishedEvidence.status === "running")
+                finishedEvidence.status = "finished";
+        }
+        await atomicWriteJson(evidencePath, finishedEvidence);
+        return { exitCode: result.interruptedBy === undefined ? result.exitCode : signalExitCode(result.interruptedBy), runId, evidencePath };
+    }
+    catch (error) {
+        evidence.status = "failed-to-start";
+        evidence.events.push({ type: "run-failed-to-start", timestamp: new Date().toISOString(), detail: safeErrorMessage(error) });
+        await atomicWriteJson(evidencePath, evidence);
+        throw error;
+    }
+}
+function validateOptions(options, policy) {
+    if (options.command.length === 0 || options.command[0] === undefined || options.command[0].trim() === "") {
+        throw new EgressRunError("ghostapi run requires a command.", "Use: ghostapi run -- <command> [args...]");
+    }
+    if (options.timeoutMs !== undefined && (!Number.isInteger(options.timeoutMs) || options.timeoutMs < 100 || options.timeoutMs > 300_000)) {
+        throw new EgressRunError("Run timeout must be an integer between 100 and 300000 ms.", "Set timeoutMs only through a validated eval spec or public API call.");
+    }
+    if (options.maxOutputBytes !== undefined && (!Number.isInteger(options.maxOutputBytes) || options.maxOutputBytes < 0 || options.maxOutputBytes > 10 * 1024 * 1024)) {
+        throw new EgressRunError("Run output limit must be an integer between 0 and 10485760 bytes.", "Set maxOutputBytes only through a validated eval spec or public API call.");
+    }
+    for (const host of options.allowHosts) {
+        if (!LOOPBACK_HOSTS.has(host.toLowerCase())) {
+            throw new EgressRunError(`The Linux namespace backend cannot allow external host ${host}.`, "This backend deliberately has no routed external egress. Use only localhost, 127.0.0.1, or ::1; do not rely on proxy fallback.");
+        }
+    }
+    if (policy === undefined)
+        return;
+    assertPolicyAllows(policy, { type: "enforcement", mode: "linux-network-namespace" });
+    for (const host of ["127.0.0.1", "localhost", ...options.allowHosts]) {
+        assertPolicyAllows(policy, { type: "network", host, provider: "ghostapi" });
+    }
+    for (const value of options.command)
+        assertPolicyAllows(policy, { type: "credential", value });
+}
+function assertPolicyAllows(policy, event) {
+    const decision = evaluatePolicy(policy, event);
+    if (!decision.allowed) {
+        throw new EgressRunError(`Policy denied ${event.type} before launching the target.`, formatPolicyDecision(decision));
+    }
+}
+async function preflightLinuxNamespaces() {
+    const tools = [
+        { executable: "unshare", args: ["--version"] },
+        { executable: "ip", args: ["link", "show", "lo"] },
+        { executable: "unshare", args: ["--user", "--map-root-user", "--net", "--mount", "--pid", "--fork", "--kill-child=SIGTERM", "--mount-proc", "--propagation", "private", "--", "true"] }
+    ];
+    for (const tool of tools) {
+        const result = await runProcess(tool.executable, tool.args);
+        if (result.exitCode !== 0) {
+            throw new EgressRunError("Linux user, mount, and network namespace preflight failed; target command was not started.", `Install util-linux/iproute2 and allow unprivileged namespaces on this host. Detail: ${result.stderr || result.stdout || "command failed"}`);
+        }
+    }
+}
+function launchLinuxNamespace(command, config) {
+    const compiledBootstrapPath = fileURLToPath(new URL("./linuxBootstrap.js", import.meta.url));
+    const sourceBootstrapPath = fileURLToPath(new URL("./linuxBootstrap.ts", import.meta.url));
+    const bootstrapArgs = existsSync(compiledBootstrapPath)
+        ? [compiledBootstrapPath]
+        : ["--import", "tsx", sourceBootstrapPath];
+    const bootstrapConfig = JSON.stringify({ ...config, command });
+    const child = spawn("unshare", [
+        "--user",
+        "--map-root-user",
+        "--net",
+        "--mount",
+        "--pid",
+        "--fork",
+        "--kill-child=SIGTERM",
+        "--mount-proc",
+        "--propagation",
+        "private",
+        "--",
+        process.execPath,
+        ...bootstrapArgs
+    ], {
+        env: { ...process.env, GHOSTAPI_RUN_BOOTSTRAP_CONFIG: bootstrapConfig },
+        // Forward target output only after streaming redaction; evidence never stores output text.
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: true
+    });
+    return new Promise((resolve, reject) => {
+        const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+        const handlers = new Map();
+        let timedOut = false;
+        let outputLimitExceeded = false;
+        let interruptedBy;
+        let escalation;
+        const terminate = (reason, signal = "SIGTERM") => {
+            if (reason === "timeout")
+                timedOut = true;
+            if (reason === "output")
+                outputLimitExceeded = true;
+            if (reason === "interrupt")
+                interruptedBy = signal;
+            signalNamespaceProcessGroup(child, signal);
+            escalation = setTimeout(() => signalNamespaceProcessGroup(child, "SIGKILL"), 5_000);
+        };
+        const timeout = config.timeoutMs === undefined ? undefined : setTimeout(() => terminate("timeout"), config.timeoutMs);
+        const outputLimit = config.maxOutputBytes;
+        let outputBytes = 0;
+        let outputSecretMatches = 0;
+        let outputTail = "";
+        const flushOutput = new Set();
+        const observeOutput = (stream, target) => {
+            if (stream === null)
+                return;
+            const redactor = createStreamingSecretRedactor((text) => target.write(text));
+            let forwarding = true;
+            flushOutput.add(() => redactor.flush());
+            stream.on("data", (chunk) => {
+                const text = String(chunk);
+                outputBytes += Buffer.byteLength(chunk);
+                const inspectable = `${outputTail}${text}`;
+                if (sanitizeSecretString(inspectable) !== inspectable)
+                    outputSecretMatches += 1;
+                outputTail = inspectable.slice(-512);
+                if (forwarding) {
+                    if (outputLimit === undefined || outputBytes <= outputLimit)
+                        redactor.write(text);
+                    else {
+                        forwarding = false;
+                    }
+                }
+                if (outputLimit !== undefined && outputBytes > outputLimit && !outputLimitExceeded)
+                    terminate("output");
+            });
+        };
+        observeOutput(child.stdout, process.stdout);
+        observeOutput(child.stderr, process.stderr);
+        for (const signal of signals) {
+            const handler = () => terminate("interrupt", signal);
+            handlers.set(signal, handler);
+            process.once(signal, handler);
+        }
+        const cleanup = () => {
+            if (timeout !== undefined)
+                clearTimeout(timeout);
+            if (escalation !== undefined)
+                clearTimeout(escalation);
+            for (const [signal, handler] of handlers)
+                process.removeListener(signal, handler);
+        };
+        child.once("error", (error) => {
+            cleanup();
+            reject(new EgressRunError(`Failed to start Linux namespace backend: ${error.message}`, "Verify that unshare is installed and executable."));
+        });
+        // `close` waits for the stdout/stderr pipes, so a secret prefix cannot be
+        // flushed before its remaining bytes are delivered.
+        child.once("close", (code, signal) => {
+            cleanup();
+            for (const flush of flushOutput)
+                flush();
+            resolve({ exitCode: code ?? signalExitCode(signal), timedOut, outputLimitExceeded, outputBytes, outputSecretMatches, ...(interruptedBy === undefined ? {} : { interruptedBy }) });
+        });
+    });
+}
+function runProcess(executable, args) {
+    return new Promise((resolve) => {
+        const child = spawn(executable, args, { stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => { stdout += String(chunk); });
+        child.stderr.on("data", (chunk) => { stderr += String(chunk); });
+        child.once("error", (error) => resolve({ exitCode: -1, stdout, stderr: error.message }));
+        child.once("exit", (exitCode) => resolve({ exitCode, stdout, stderr }));
+    });
+}
+function uniqueHosts(hosts) {
+    return [...new Set(hosts.map((host) => host.toLowerCase()))];
+}
+function safeErrorMessage(error) {
+    return error instanceof Error ? sanitizeSecretString(error.message).replace(/(?:Bearer\s+)?\S*(?:token|secret|key)\S*/gi, "***") : "Unknown error";
+}
+function isErrorCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+function signalExitCode(signal) {
+    if (signal === null)
+        return 1;
+    const signals = { SIGINT: 2, SIGTERM: 15, SIGHUP: 1, SIGBREAK: 21, SIGQUIT: 3, SIGILL: 4, SIGTRAP: 5, SIGABRT: 6, SIGBUS: 7, SIGFPE: 8, SIGKILL: 9, SIGUSR1: 10, SIGSEGV: 11, SIGUSR2: 12, SIGPIPE: 13, SIGALRM: 14, SIGCHLD: 17, SIGCONT: 18, SIGSTOP: 19, SIGTSTP: 20, SIGTTIN: 21, SIGTTOU: 22, SIGURG: 23, SIGXCPU: 24, SIGXFSZ: 25, SIGVTALRM: 26, SIGPROF: 27, SIGWINCH: 28, SIGIO: 29, SIGPOLL: 29, SIGPWR: 30, SIGSYS: 31 };
+    return 128 + (signals[signal] ?? 1);
+}
+function signalNamespaceProcessGroup(child, signal) {
+    if (child.pid === undefined)
+        return;
+    try {
+        process.kill(-child.pid, signal);
+    }
+    catch (error) {
+        if (!isErrorCode(error, "ESRCH"))
+            child.kill(signal);
+    }
+}
+function createStreamingSecretRedactor(write) {
+    let pending = "";
+    let redacting;
+    const consume = (text) => {
+        for (const character of text) {
+            if (redacting !== undefined) {
+                if (redacting.test(character))
+                    continue;
+                redacting = undefined;
+            }
+            pending += character;
+            const normalized = pending.toLowerCase();
+            const matchedPrefix = STREAM_SECRET_PREFIXES.find((prefix) => normalized.endsWith(prefix));
+            if (matchedPrefix !== undefined) {
+                write(`${pending.slice(0, -matchedPrefix.length)}***`);
+                pending = "";
+                redacting = /[A-Za-z0-9_.-]/;
+                continue;
+            }
+            if (normalized.endsWith("bearer ")) {
+                write(`${pending.slice(0, -"bearer ".length)}Bearer ***`);
+                pending = "";
+                redacting = /\S/;
+                continue;
+            }
+            flushSafePrefix();
+        }
+    };
+    const flushSafePrefix = () => {
+        const normalized = pending.toLowerCase();
+        const suffixLength = Math.max(0, ...[...STREAM_SECRET_PREFIXES, "bearer "].map((prefix) => {
+            for (let length = Math.min(prefix.length - 1, normalized.length); length > 0; length -= 1) {
+                if (prefix.startsWith(normalized.slice(-length)))
+                    return length;
+            }
+            return 0;
+        }));
+        if (pending.length > suffixLength) {
+            write(pending.slice(0, pending.length - suffixLength));
+            pending = pending.slice(pending.length - suffixLength);
+        }
+    };
+    return {
+        write: consume,
+        flush() {
+            if (redacting === undefined)
+                write(pending);
+            pending = "";
+        }
+    };
+}
+//# sourceMappingURL=run.js.map

package/dist/egress/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/egress/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAuB,MAAM,oBAAoB,CAAC;AA6B/G,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAClE,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAE3G,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAS;IAEtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAyB;IAC9D,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;IAC/G,eAAe,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,cAAc,CACtB,8CAA8C,OAAO,CAAC,QAAQ,GAAG,EACjE,mHAAmH,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IAClC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAgB;QAC5B,aAAa,EAAE,CAAC;QAChB,KAAK;QACL,OAAO,EAAE,yBAAyB;QAClC,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,EAAE,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;QACvH,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE,EAAE;QACtL,yBAAyB,EAAE,gIAAgI;QAC3J,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;KACvE,CAAC;IAEF,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,wBAAwB,EAAE,CAAC;QACjC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClG,MAAM,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5M,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAgB,CAAC;QACzF,gBAAgB,CAAC,MAAM,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,mBAAmB,EAAE,aAAa,EAAE,MAAM,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjL,IAAI,MAAM,CAAC,QAAQ;YAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChH,IAAI,MAAM,CAAC,mBAAmB;YAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACzI,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACvC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC7K,IAAI,gBAAgB,CAAC,MAAM,KAAK,WAAW,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS;gBAAE,gBAAgB,CAAC,MAAM,GAAG,UAAU,CAAC;QAC7H,CAAC;QACD,MAAM,eAAe,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACxI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,MAAM,GAAG,iBAAiB,CAAC;QACpC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5H,MAAM,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAyB,EAAE,MAAkC;IACpF,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzG,MAAM,IAAI,cAAc,CAAC,kCAAkC,EAAE,0CAA0C,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,IAAI,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;QACxI,MAAM,IAAI,cAAc,CAAC,2DAA2D,EAAE,sEAAsE,CAAC,CAAC;IAChK,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACnK,MAAM,IAAI,cAAc,CAAC,mEAAmE,EAAE,2EAA2E,CAAC,CAAC;IAC7K,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,cAAc,CACtB,0DAA0D,IAAI,GAAG,EACjE,gIAAgI,CACjI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,kBAAkB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACrF,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,kBAAkB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO;QAAE,kBAAkB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAsB,EAAE,KAA2C;IAC7F,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,cAAc,CAAC,iBAAiB,KAAK,CAAC,IAAI,+BAA+B,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB;IACrC,MAAM,KAAK,GAAG;QACZ,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE;QAC9C,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAClD,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;KACxL,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,cAAc,CACtB,4FAA4F,EAC5F,uFAAuF,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAC5I,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAiB,EAAE,MAShD;IACC,MAAM,qBAAqB,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,MAAM,mBAAmB,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,MAAM,aAAa,GAAG,UAAU,CAAC,qBAAqB,CAAC;QACrD,CAAC,CAAC,CAAC,qBAAqB,CAAC;QACzB,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE;QAC7B,QAAQ;QACR,iBAAiB;QACjB,OAAO;QACP,SAAS;QACT,OAAO;QACP,QAAQ;QACR,sBAAsB;QACtB,cAAc;QACd,eAAe;QACf,SAAS;QACT,IAAI;QACJ,OAAO,CAAC,QAAQ;QAChB,GAAG,aAAa;KACjB,EAAE;QACD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,6BAA6B,EAAE,eAAe,EAAE;QACvE,2FAA2F;QAC3F,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAqB,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;QACvD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAChC,IAAI,aAAyC,CAAC;QAC9C,IAAI,UAAsC,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,MAA0C,EAAE,SAAyB,SAAS,EAAE,EAAE;YACnG,IAAI,MAAM,KAAK,SAAS;gBAAE,QAAQ,GAAG,IAAI,CAAC;YAC1C,IAAI,MAAM,KAAK,QAAQ;gBAAE,mBAAmB,GAAG,IAAI,CAAC;YACpD,IAAI,MAAM,KAAK,WAAW;gBAAE,aAAa,GAAG,MAAM,CAAC;YACnD,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3C,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QACtF,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACtH,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC;QAC1C,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAC5B,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAc,CAAC;QAC1C,MAAM,aAAa,GAAG,CAAC,MAAoC,EAAE,MAA6B,EAAE,EAAE;YAC5F,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO;YAC5B,MAAM,QAAQ,GAAG,6BAA6B,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7E,IAAI,UAAU,GAAG,IAAI,CAAC;YACtB,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACxC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;gBAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3B,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;gBAC3C,IAAI,oBAAoB,CAAC,WAAW,CAAC,KAAK,WAAW;oBAAE,mBAAmB,IAAI,CAAC,CAAC;gBAChF,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,IAAI,WAAW;wBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;yBAC7E,CAAC;wBACJ,UAAU,GAAG,KAAK,CAAC;oBACrB,CAAC;gBACH,CAAC;gBACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,WAAW,IAAI,CAAC,mBAAmB;oBAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC1G,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACrD,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,OAAO,KAAK,SAAS;gBAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,UAAU,KAAK,SAAS;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YACvD,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,QAAQ;gBAAE,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC,CAAC;QAEF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,cAAc,CAAC,4CAA4C,KAAK,CAAC,OAAO,EAAE,EAAE,kDAAkD,CAAC,CAAC,CAAC;QAC9I,CAAC,CAAC,CAAC;QACH,0EAA0E;QAC1E,oDAAoD;QACpD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC,OAAO,EAAE,CAAC;YACV,KAAK,MAAM,KAAK,IAAI,WAAW;gBAAE,KAAK,EAAE,CAAC;YACzC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;QACpL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,UAAkB,EAAE,IAAc;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AACrJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC/C,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,MAA6B;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,OAAO,GAA4C,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7c,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,2BAA2B,CAAC,KAA+B,EAAE,MAAsB;IAC1F,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO;IACpC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,KAA6B;IAClE,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,SAA6B,CAAC;IAElC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE;QAC/B,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;oBAAE,SAAS;gBACxC,SAAS,GAAG,SAAS,CAAC;YACxB,CAAC;YACD,OAAO,IAAI,SAAS,CAAC;YACrB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3F,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvD,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,gBAAgB,CAAC;gBAC7B,SAAS;YACX,CAAC;YACD,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC1D,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,IAAI,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,eAAe,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAC3B,CAAC,EACD,GAAG,CAAC,GAAG,sBAAsB,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACvD,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC1F,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;oBAAE,OAAO,MAAM,CAAC;YAClE,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CACH,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;YAClC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC;YACvD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,OAAO;QACd,KAAK;YACH,IAAI,SAAS,KAAK,SAAS;gBAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/errors/errorEngine.d.ts

@@ -1,3 +1,3 @@
 import type { NormalizedRequest } from "../proxy/requestNormalizer.js";
-import type { ProviderName, ProviderErrorDetails } from "../providers/types.js";
-export declare function validateRequest(request: NormalizedRequest, provider: ProviderName): ProviderErrorDetails | null;
+import type { ProviderName, ProviderErrorDetails, ProviderPackExecution } from "../providers/types.js";
+export declare function validateRequest(request: NormalizedRequest, provider: ProviderName, execution?: ProviderPackExecution): ProviderErrorDetails | null;

package/dist/errors/errorEngine.js

@@ -1,31 +1,11 @@
 import { isJsonObject } from "../utils/json.js";
-export function validateRequest(request, provider) {
-    if (provider === "stripe") {
-        return validateStripe(request);
+export function validateRequest(request, provider, execution) {
+    if (execution !== undefined) {
+        return execution.pack.validate(execution.parsedRequest, request);
     }
     if (provider === "twilio") {
         return validateTwilio(request);
     }
-    if (provider === "resend") {
-        return validateResend(request);
-    }
-    return null;
-}
-function validateStripe(request) {
-    if (request.method !== "POST")
-        return null;
-    const body = isJsonObject(request.body) ? request.body : Object.fromEntries(new URLSearchParams(String(request.body)));
-    if (request.path.includes("/charges") || request.path.includes("/payment_intents")) {
-        if (!body["amount"]) {
-            return { status: 400, message: "Missing required param: amount.", type: "invalid_request_error", code: "parameter_missing", param: "amount" };
-        }
-        if (!body["currency"]) {
-            return { status: 400, message: "Missing required param: currency.", type: "invalid_request_error", code: "parameter_missing", param: "currency" };
-        }
-    }
-    if (request.path.includes("/customers") && Object.keys(body).length === 0) {
-        return { status: 400, message: "Missing required param: email or description.", type: "invalid_request_error", code: "parameter_missing", param: "email" };
-    }
     return null;
 }
 function validateTwilio(request) {
@@ -45,21 +25,4 @@ function validateTwilio(request) {
     }
     return null;
 }
-function validateResend(request) {
-    if (request.method !== "POST")
-        return null;
-    const body = isJsonObject(request.body) ? request.body : {};
-    if (request.path === "/emails" || request.path.startsWith("/emails/")) {
-        if (!body["from"]) {
-            return { status: 400, message: "Missing required field: from", type: "validation_error" };
-        }
-        if (!body["to"]) {
-            return { status: 400, message: "Missing required field: to", type: "validation_error" };
-        }
-        if (!body["subject"]) {
-            return { status: 400, message: "Missing required field: subject", type: "validation_error" };
-        }
-    }
-    return null;
-}
 //# sourceMappingURL=errorEngine.js.map

package/dist/errors/errorEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"errorEngine.js","sourceRoot":"","sources":["../../src/errors/errorEngine.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,UAAU,eAAe,CAAC,OAA0B,EAAE,QAAsB;IAChF,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAA0B;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEvH,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,iCAAiC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAChJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACpJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC7J,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAA0B;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE1J,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,kCAAkC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAA0B;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,4BAA4B,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,iCAAiC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"errorEngine.js","sourceRoot":"","sources":["../../src/errors/errorEngine.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,UAAU,eAAe,CAAC,OAA0B,EAAE,QAAsB,EAAE,SAAiC;IACnH,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAA0B;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE1J,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,kCAAkC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/evals/evals.d.ts

@@ -0,0 +1,126 @@
+import { type EvidenceReport } from "../evidence/index.js";
+import type { WorldScenarioReference } from "../worlds/index.js";
+export type EvalTemplateName = "retry-after" | "duplicate-payment" | "webhook-signature" | "no-secret-logs" | "timeout-recovery" | "no-production-bypass";
+export type EvalExpectationType = "run-finished" | "run-exit-code" | "scenario-completed" | "provider-covered" | "retry-observed" | "no-provider-failures" | "no-secrets" | "no-production-egress" | "evidence-passed";
+export type EvalForbiddenType = "production-egress" | "secret-leak" | "provider-failure" | "missing-scenario";
+export type EvalExpectation = {
+    id: string;
+    type: EvalExpectationType;
+    value?: string | number;
+    points?: number;
+};
+export type EvalForbiddenAction = {
+    id: string;
+    type: EvalForbiddenType;
+    value?: string | number;
+};
+export type EvalSpec = {
+    schemaVersion: 1;
+    kind: "ghostapi.eval";
+    id: string;
+    title: string;
+    syntheticWorld: {
+        providers: string[];
+        scenarios: string[];
+        world?: WorldScenarioReference;
+    };
+    task: {
+        description: string;
+        command: string[];
+    };
+    injectedFailures: Array<{
+        id: string;
+        type: string;
+        provider?: string;
+        statusCode?: number;
+        retryAfterMs?: number;
+    }>;
+    expectations: EvalExpectation[];
+    forbidden: EvalForbiddenAction[];
+    limits: {
+        timeoutMs: number;
+        maxOutputBytes: number;
+    };
+    rubric: {
+        maxScore: number;
+        components: Array<{
+            id: string;
+            expectationId: string;
+            points: number;
+            reason: string;
+        }>;
+    };
+    judge?: {
+        llmAsJudge: false | {
+            enabled: false;
+            note?: string;
+        };
+    };
+};
+export type EvalScoreComponent = {
+    id: string;
+    expectationId: string;
+    passed: boolean;
+    points: number;
+    maxPoints: number;
+    reason: string;
+};
+export type EvalReport = {
+    schemaVersion: 1;
+    artifact: {
+        generatedAt: string;
+        logicalHash: string;
+        canonicalization: "json-stable-sorted-keys-v1";
+    };
+    eval: {
+        id: string;
+        title: string;
+        specHash: string;
+    };
+    evidence: {
+        path?: string;
+        logicalHash: string;
+        runId: string;
+        links: string[];
+    };
+    score: {
+        core: number;
+        max: number;
+        passed: boolean;
+        forbiddenTriggered: string[];
+        components: EvalScoreComponent[];
+    };
+    repeatability: {
+        deterministicInputs: true;
+        evidenceLogicalHash: string;
+        evalLogicalHash: string;
+        notes: string[];
+    };
+    judge: {
+        used: false;
+        reason: string;
+    };
+    warnings: string[];
+};
+export type EvalRunOptions = {
+    specPath?: string;
+    template?: EvalTemplateName;
+    evidencePath?: string;
+    outPath?: string;
+    ci?: boolean;
+    generatedAt?: string;
+};
+export declare class EvalError extends Error {
+    constructor(message: string);
+}
+export declare const builtinEvalTemplates: Record<EvalTemplateName, EvalSpec>;
+export declare function loadEvalSpec(path: string, projectRoot?: string): Promise<EvalSpec>;
+export declare function runEval(options?: EvalRunOptions): Promise<{
+    report: EvalReport;
+    path: string;
+}>;
+export declare function scoreEval(spec: EvalSpec, evidence: EvidenceReport, options?: {
+    evidencePath?: string;
+    generatedAt?: string;
+}): EvalReport;
+export declare function formatEvalReport(report: EvalReport): string;