agentic-engineering-harness 0.8.3 → 0.8.4

package/dist/certification/core.js

@@ -0,0 +1,300 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { mergeUsageMetrics } from "../metrics/usage.js";
+import { createCertificationOracleResult, oracleCanAccept } from "./oracle.js";
+import { validateCertificationPolicy } from "./policy.js";
+export class CertificationCore {
+    oracle;
+    provider;
+    constructor(oracle, provider) {
+        this.oracle = oracle;
+        this.provider = provider;
+    }
+    async certify(input) {
+        const startedAt = new Date().toISOString();
+        const policy = validateCertificationPolicy(input.policy);
+        assertCertificationEntryAllowed(policy);
+        const candidate = await normalizeCandidate(input.candidate);
+        const certificationId = `cert-${candidate.id}-${crypto.randomUUID()}`;
+        const attempts = [];
+        const providerResults = [];
+        let usage = {};
+        let durationMs = 0;
+        let usageKnown = true;
+        let oracleResult = emptyOracle(this.oracle.id);
+        let reviewer;
+        const networkPolicy = directNetworkPolicy(policy);
+        await this.oracle.prepare?.({ candidate, policy, attempt: 0 });
+        const invoke = async (request) => {
+            if (!this.provider)
+                return undefined;
+            assertProviderRequest(request, candidate, policy);
+            const budgetFailure = budgetFailureReason(policy, attempts, durationMs, usage, usageKnown);
+            if (budgetFailure)
+                return undefined;
+            const prepared = withCertificationEnvironment(request);
+            const began = Date.now();
+            let result;
+            if (!prepared.allowNetwork && this.provider.networkIsolation !== "enforced") {
+                result = failedProviderResult(prepared, "Certification provider cannot prove network isolation for a denied-network request.", 0);
+            }
+            else {
+                try {
+                    result = await this.provider.execute(prepared);
+                }
+                catch (error) {
+                    result = failedProviderResult(prepared, String(error), Date.now() - began);
+                }
+            }
+            attempts.push({ attempt: attempts.length + 1, role: result.role, status: result.status, startedAt: new Date(began).toISOString(), finishedAt: nowIso(), durationMs: result.durationMs, usage: result.usage, message: result.stderr || undefined });
+            providerResults.push(result);
+            usage = mergeUsageMetrics(usage, result.usage);
+            durationMs += result.durationMs;
+            usageKnown = usageKnown && result.usageKnown;
+            return result;
+        };
+        const evaluateOracle = async (attempt) => {
+            const remaining = policy.budget.maxDurationMs - durationMs;
+            if (remaining <= 0)
+                throw new Error("Certification duration budget exhausted before oracle evaluation.");
+            const controller = new AbortController();
+            const began = Date.now();
+            const startedAt = new Date(began).toISOString();
+            let timer;
+            try {
+                const result = await Promise.race([
+                    this.oracle.evaluate({ candidate, policy, attempt, signal: controller.signal, actor: actorResult }),
+                    new Promise((_, reject) => { timer = setTimeout(() => { controller.abort(); reject(new Error("Certification oracle timed out.")); }, remaining); })
+                ]);
+                const finishedAt = nowIso();
+                attempts.push({ attempt: attempts.length + 1, role: "oracle", status: result.status, startedAt, finishedAt, durationMs: Date.now() - began, message: result.failures.length ? result.failures.map((failure) => failure.message).join("; ") : undefined });
+                return result;
+            }
+            catch (error) {
+                const finishedAt = nowIso();
+                attempts.push({ attempt: attempts.length + 1, role: "oracle", status: "FAILED", startedAt, finishedAt, durationMs: Date.now() - began, message: String(error) });
+                throw error;
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+                durationMs += Date.now() - began;
+            }
+        };
+        const actorResult = input.actor ? await invoke(input.actor) : undefined;
+        try {
+            oracleResult = await evaluateOracle(0);
+            assertOracleResult(oracleResult, policy, this.oracle);
+        }
+        catch (error) {
+            oracleResult = emptyOracle(this.oracle.id, [{ id: "oracle.crash", category: "oracle", message: String(error) }]);
+        }
+        let state;
+        let failureReason;
+        let failures = oracleResult.failures;
+        const budgetEvidenceMissing = providerResults.length ? budgetEvidenceUnavailable(policy, usage, usageKnown) : undefined;
+        const modelE2E = modelE2ELane(actorResult, oracleResult, input.requireModelEvidence === true);
+        const modelRequired = input.requireModelE2E === true;
+        if (policy.security.requireNetworkIsolation && !networkPolicy.enforced) {
+            state = "BLOCKED";
+            failureReason = "SAFETY_FAILURE";
+            failures = [{ id: "security.network-isolation", category: "security", message: "Certification requires network isolation, but the direct provider transport cannot enforce it." }];
+        }
+        else if (actorResult && (actorResult.status !== "COMPLETED" || actorResult.exitCode !== 0)) {
+            state = modelRequired ? "BLOCKED" : "HUMAN_REQUIRED";
+            failureReason = "PROVIDER_FAILURE";
+            failures = [{ id: "provider.actor", category: "provider", message: "The actor provider did not complete successfully." }];
+        }
+        else if (modelRequired && modelE2E.status !== "PASS") {
+            state = "BLOCKED";
+            failureReason = "PROVIDER_FAILURE";
+            failures = [{ id: "provider.model-e2e", category: "provider", message: "Required model-driven E2E execution was not proven by a started provider receipt." }];
+        }
+        else if (budgetEvidenceMissing) {
+            state = "HUMAN_REQUIRED";
+            failureReason = "BUDGET_EXHAUSTED";
+            failures = [{ id: "budget.usage", category: "budget", message: budgetEvidenceMissing }];
+        }
+        else if (oracleResult.status === "PASS" && oracleCanAccept(oracleResult, policy.assurance)) {
+            if (policy.review.enabled && input.reviewer && this.provider) {
+                reviewer = await invoke(input.reviewer.create(candidate, oracleResult));
+                const reviewOk = reviewer?.status === "COMPLETED" && reviewer.exitCode === 0;
+                const reviewBudgetMissing = budgetEvidenceUnavailable(policy, usage, usageKnown);
+                if (reviewBudgetMissing) {
+                    state = "HUMAN_REQUIRED";
+                    failureReason = "BUDGET_EXHAUSTED";
+                    failures = [{ id: "budget.usage", category: "budget", message: reviewBudgetMissing }];
+                }
+                else if (!reviewOk && policy.review.required) {
+                    state = "HUMAN_REQUIRED";
+                    failureReason = "REVIEW_FAILURE";
+                    failures = [{ id: "review.failed", category: "review", message: "Required external review did not complete successfully." }];
+                }
+                else
+                    state = "ACCEPTED";
+            }
+            else if (policy.review.required) {
+                state = "HUMAN_REQUIRED";
+                failureReason = "REVIEW_FAILURE";
+                failures = [{ id: "review.missing", category: "review", message: "A required external review was not provided." }];
+            }
+            else
+                state = "ACCEPTED";
+        }
+        else {
+            failureReason = oracleResult.status === "FAIL" ? "ORACLE_FAILURE" : "SAFETY_FAILURE";
+            while (policy.repair.enabled && input.repair && this.provider && failures.length && attempts.filter((item) => item.role === "repair").length < policy.repair.maxAttempts) {
+                const request = input.repair.create(attempts.filter((item) => item.role === "repair").length + 1, failures, candidate);
+                const result = await invoke(request);
+                if (!result)
+                    break;
+                if (result.status !== "COMPLETED" || result.exitCode !== 0) {
+                    failures = [{ id: "provider.repair", category: "provider", message: "The repair provider did not complete successfully." }];
+                    failureReason = "PROVIDER_FAILURE";
+                    break;
+                }
+                try {
+                    oracleResult = await evaluateOracle(attempts.filter((item) => item.role === "repair").length);
+                    assertOracleResult(oracleResult, policy, this.oracle);
+                }
+                catch (error) {
+                    oracleResult = emptyOracle(this.oracle.id, [{ id: "oracle.crash", category: "oracle", message: String(error) }]);
+                    failures = oracleResult.failures;
+                    failureReason = "SAFETY_FAILURE";
+                    break;
+                }
+                failures = oracleResult.failures;
+                if (!budgetEvidenceUnavailable(policy, usage, usageKnown) && oracleCanAccept(oracleResult, policy.assurance)) {
+                    state = "ACCEPTED";
+                    failureReason = undefined;
+                    break;
+                }
+            }
+            if (!state) {
+                const repairAttempts = attempts.filter((item) => item.role === "repair").length;
+                const budgetBlocked = Boolean(budgetFailureReason(policy, attempts, durationMs, usage, usageKnown));
+                state = budgetBlocked || (repairAttempts >= policy.repair.maxAttempts && policy.repair.humanOnExhaustion) ? "HUMAN_REQUIRED" : "REPAIR_REQUIRED";
+                if (budgetBlocked)
+                    failureReason = "BUDGET_EXHAUSTED";
+            }
+        }
+        const accepted = state === "ACCEPTED";
+        const packet = !accepted ? makeFailurePacket(certificationId, candidate, failureReason ?? "ORACLE_FAILURE", failures, attempts.filter((item) => item.role === "repair").length) : undefined;
+        const capability = input.capability ? buildCapabilityResult(input.capability, oracleResult, modelE2E, modelRequired) : undefined;
+        const report = {
+            version: 1,
+            certificationId,
+            candidate,
+            policyId: policy.id,
+            state,
+            lifecycle: "COMPLETED",
+            accepted,
+            assurance: accepted ? reviewer?.status === "COMPLETED" && reviewer.exitCode === 0 ? "DETERMINISTIC_WITH_EXTERNAL_REVIEW" : "DETERMINISTIC" : "INSUFFICIENT",
+            oracle: oracleResult,
+            reviewer,
+            providerResults,
+            attempts,
+            failurePacket: packet,
+            budget: budgetSnapshot(policy, attempts, durationMs, usage, usageKnown),
+            startedAt,
+            finishedAt: nowIso(),
+            capability,
+            networkPolicy
+        };
+        await this.oracle.dispose?.();
+        return report;
+    }
+}
+export function assertCertificationEntryAllowed(policy) {
+    const depth = Number(process.env.AEH_CERTIFICATION_DEPTH ?? "0");
+    if (!policy.security.allowRecursiveCertification && Number.isFinite(depth) && depth > 0)
+        throw new Error("Recursive certification is forbidden.");
+}
+export function assertProviderRequest(request, candidate, policy) {
+    if (request.allowNetwork && !policy.security.allowNetwork)
+        throw new Error("Provider request asks for network access that certification policy forbids.");
+    if (request.maxOutputBytes > policy.security.maxOutputBytes)
+        throw new Error("Provider output limit exceeds certification policy.");
+    if (!samePath(request.cwd, candidate.root))
+        throw new Error("Provider cwd must be the candidate root.");
+    if ((request.credentialEnvAllowlist ?? []).some((name) => !policy.security.credentialEnvAllowlist.includes(name)))
+        throw new Error("Provider requested a credential environment variable outside certification policy.");
+    if ((request.environmentAllowlist ?? []).some((name) => !policy.security.environmentAllowlist.includes(name)))
+        throw new Error("Provider requested an environment variable outside certification policy.");
+}
+function assertOracleResult(result, policy, oracle) {
+    if (policy.assurance.requireDeterministicOracle && result.deterministic !== true)
+        throw new Error("Certification oracle did not declare deterministic evidence.");
+    if (policy.assurance.requireIndependentOracle && oracle.independent !== true)
+        throw new Error("Certification policy requires an independent oracle.");
+}
+function budgetFailureReason(policy, attempts, durationMs, usage, usageKnown) {
+    if (attempts.filter((item) => item.role !== "oracle").length >= policy.budget.maxAttempts)
+        return "attempt budget exhausted";
+    if (durationMs >= policy.budget.maxDurationMs)
+        return "duration budget exhausted";
+    if (policy.budget.maxTotalTokens !== undefined && (!usageKnown && policy.budget.requireUsageForTokenBudget !== false))
+        return "token usage is unknown";
+    if (policy.budget.maxTotalTokens !== undefined && (usage.totalTokens ?? 0) > policy.budget.maxTotalTokens)
+        return "token budget exhausted";
+    if (policy.budget.maxCostUsd !== undefined && (usage.costUsd ?? 0) > policy.budget.maxCostUsd)
+        return "cost budget exhausted";
+    return undefined;
+}
+function budgetEvidenceUnavailable(policy, usage, usageKnown) {
+    if (policy.budget.maxTotalTokens !== undefined && (!usageKnown || usage.totalTokens === undefined))
+        return "Configured token budget cannot be proven because provider usage is incomplete.";
+    if (policy.budget.maxCostUsd !== undefined && usage.costUsd === undefined)
+        return "Configured cost budget cannot be proven because provider cost usage is unavailable.";
+    return undefined;
+}
+function budgetSnapshot(policy, attempts, durationMs, usage, usageKnown) {
+    return { attempts: attempts.filter((item) => item.role !== "oracle").length, durationMs, usage, remaining: { attempts: Math.max(0, policy.budget.maxAttempts - attempts.filter((item) => item.role !== "oracle").length), durationMs: Math.max(0, policy.budget.maxDurationMs - durationMs), costUsd: policy.budget.maxCostUsd === undefined || usage.costUsd === undefined ? undefined : Math.max(0, policy.budget.maxCostUsd - usage.costUsd), totalTokens: policy.budget.maxTotalTokens === undefined || usage.totalTokens === undefined ? undefined : Math.max(0, policy.budget.maxTotalTokens - usage.totalTokens) }, usageKnown };
+}
+function modelE2ELane(result, oracle, requireEvidence) {
+    if (!result)
+        return { status: "NOT_TESTED", evidence: { reason: "no model provider invocation" } };
+    if (result.executionEvidence?.started !== true)
+        return { status: "BLOCKED", evidence: { reason: "provider did not prove startup", providerStatus: result.status, stderr: result.stderr.slice(-2_000) } };
+    if (result.status === "COMPLETED" && result.exitCode === 0 && result.structuredOutput !== undefined && !result.outputTruncated) {
+        const evidenceCheck = oracle.checks.find((check) => check.id === "model.evidence");
+        if (requireEvidence && evidenceCheck?.status !== "PASS")
+            return { status: "INSUFFICIENT", evidence: { reason: "deterministic oracle did not verify model journey evidence", execution: result.executionEvidence } };
+        return { status: "PASS", evidence: { execution: result.executionEvidence, usage: result.usage, usageKnown: result.usageKnown } };
+    }
+    return { status: "FAIL", evidence: { execution: result.executionEvidence, providerStatus: result.status, exitCode: result.exitCode, stderr: result.stderr.slice(-2_000) } };
+}
+function buildCapabilityResult(capability, oracle, modelE2E, requiredModelE2E) {
+    const contract = { status: oracle.status === "PASS" ? "PASS" : "FAIL", evidence: { oracleId: oracle.oracleId, checks: oracle.checks } };
+    const overall = contract.status !== "PASS" ? "FAIL" : modelE2E.status === "PASS" ? "PASS" : "PARTIAL";
+    return { capability, contract, modelE2E, overall, requiredModelE2E };
+}
+function directNetworkPolicy(policy) {
+    if (policy.security.allowNetwork)
+        return { requested: "ALLOW", enforced: false, enforcement: "provider-allowed" };
+    return { requested: "DENY", enforced: false, enforcement: "unavailable" };
+}
+async function normalizeCandidate(input) {
+    if (!input.id || input.version !== 1)
+        throw new Error("Invalid CandidateRevision.");
+    const root = await fs.realpath(path.resolve(input.root));
+    const stat = await fs.stat(root);
+    if (!stat.isDirectory())
+        throw new Error("CandidateRevision.root must be a directory.");
+    if (input.artifactPath) {
+        const artifact = await fs.realpath(path.resolve(input.artifactPath));
+        if (!isWithin(root, artifact))
+            throw new Error("Candidate artifact escapes its certification workspace.");
+        return { ...input, root, artifactPath: artifact };
+    }
+    return { ...input, root };
+}
+function withCertificationEnvironment(request) { return { ...request, environment: { ...(request.environment ?? {}), AEH_CERTIFICATION_ACTIVE: "1", AEH_CERTIFICATION_DEPTH: "1" } }; }
+function samePath(a, b) { return path.resolve(a) === path.resolve(b); }
+function isWithin(parent, child) { const relative = path.relative(path.resolve(parent), path.resolve(child)); return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative)); }
+function nowIso() { return new Date().toISOString(); }
+function emptyOracle(oracleId, failures = []) { return createCertificationOracleResult({ oracleId, checks: failures.map((failure) => ({ id: failure.id, status: "FAIL", required: true, message: failure.message, evidence: failure.details })), evidence: { failure: true } }); }
+function makeFailurePacket(certificationId, candidate, reason, failures, repairAttempt) { return { version: 1, certificationId, candidateId: candidate.id, createdAt: nowIso(), reason, failures, repairAttempt, deterministic: true }; }
+function failedProviderResult(request, message, durationMs) { const event = { at: nowIso(), type: "error", data: message }; return { version: 1, provider: "unknown", requestId: request.requestId, role: request.role, status: "FAILED", exitCode: 1, stdout: "", stderr: message, events: [event], usage: {}, usageKnown: false, durationMs, outputTruncated: false }; }
+//# sourceMappingURL=core.js.map

package/dist/certification/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/certification/core.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,+BAA+B,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AA2B1D,MAAM,OAAO,iBAAiB;IACC;IAA8C;IAA3E,YAA6B,MAA2B,EAAmB,QAAwB;QAAtE,WAAM,GAAN,MAAM,CAAqB;QAAmB,aAAQ,GAAR,QAAQ,CAAgB;IAAG,CAAC;IAEvG,KAAK,CAAC,OAAO,CAAC,KAA2B;QACvC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzD,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,QAAQ,SAAS,CAAC,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QACtE,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,MAAM,eAAe,GAA0B,EAAE,CAAC;QAClD,IAAI,KAAK,GAAyC,EAAE,CAAC;QACrD,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,UAAU,GAAG,IAAI,CAAC;QACtB,IAAI,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,QAAyC,CAAC;QAC9C,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,KAAK,EAAE,OAA6B,EAA4C,EAAE;YAC/F,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACrC,qBAAqB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YAC3F,IAAI,aAAa;gBAAE,OAAO,SAAS,CAAC;YACpC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,MAA2B,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;gBAC5E,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,qFAAqF,EAAE,CAAC,CAAC,CAAC;YACpI,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;YACnP,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,KAAK,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/C,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;YAChC,UAAU,GAAG,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,MAAM,cAAc,GAAG,KAAK,EAAE,OAAe,EAAsC,EAAE;YACnF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,UAAU,CAAC;YAC3D,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACzG,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAChD,IAAI,KAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;oBAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;oBACnG,IAAI,OAAO,CAA4B,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC/K,CAAC,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC1P,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjK,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACnC,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;YACvC,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACnH,CAAC;QAED,IAAI,KAAqC,CAAC;QAC1C,IAAI,aAA+D,CAAC;QACpE,IAAI,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;QACrC,MAAM,qBAAqB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxH,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC;QAC9F,MAAM,aAAa,GAAG,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,uBAAuB,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YACvE,KAAK,GAAG,SAAS,CAAC;YAClB,aAAa,GAAG,gBAAgB,CAAC;YACjC,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,4BAA4B,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,gGAAgG,EAAE,CAAC,CAAC;QACrL,CAAC;aAAM,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,WAAW,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7F,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACrD,aAAa,GAAG,kBAAkB,CAAC;YACnC,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;QAC5H,CAAC;aAAM,IAAI,aAAa,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvD,KAAK,GAAG,SAAS,CAAC;YAClB,aAAa,GAAG,kBAAkB,CAAC;YACnC,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,mFAAmF,EAAE,CAAC,CAAC;QAChK,CAAC;aAAM,IAAI,qBAAqB,EAAE,CAAC;YACjC,KAAK,GAAG,gBAAgB,CAAC;YACzB,aAAa,GAAG,kBAAkB,CAAC;YACnC,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC1F,CAAC;aAAM,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7F,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7D,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;gBACxE,MAAM,QAAQ,GAAG,QAAQ,EAAE,MAAM,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,CAAC;gBAC7E,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;gBACjF,IAAI,mBAAmB,EAAE,CAAC;oBAAC,KAAK,GAAG,gBAAgB,CAAC;oBAAC,aAAa,GAAG,kBAAkB,CAAC;oBAAC,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAAC,CAAC;qBAC5K,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAAC,KAAK,GAAG,gBAAgB,CAAC;oBAAC,aAAa,GAAG,gBAAgB,CAAC;oBAAC,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;gBAAC,CAAC;;oBACtO,KAAK,GAAG,UAAU,CAAC;YAC1B,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClC,KAAK,GAAG,gBAAgB,CAAC;gBAAC,aAAa,GAAG,gBAAgB,CAAC;gBAAC,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;YACjL,CAAC;;gBAAM,KAAK,GAAG,UAAU,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,YAAY,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACrF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACzK,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACvH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM;oBAAE,MAAM;gBACnB,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBAC3D,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC;oBAC5H,aAAa,GAAG,kBAAkB,CAAC;oBACnC,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;oBAC9F,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACxD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;oBACjH,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;oBACjC,aAAa,GAAG,gBAAgB,CAAC;oBACjC,MAAM;gBACR,CAAC;gBACD,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;gBACjC,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;oBAAC,KAAK,GAAG,UAAU,CAAC;oBAAC,aAAa,GAAG,SAAS,CAAC;oBAAC,MAAM;gBAAC,CAAC;YACzK,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;gBAChF,MAAM,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;gBACpG,KAAK,GAAG,aAAa,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBACjJ,IAAI,aAAa;oBAAE,aAAa,GAAG,kBAAkB,CAAC;YACxD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,KAAK,UAAU,CAAC;QACtC,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,eAAe,EAAE,SAAS,EAAE,aAAa,IAAI,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5L,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjI,MAAM,MAAM,GAAwB;YAClC,OAAO,EAAE,CAAC;YACV,eAAe;YACf,SAAS;YACT,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,KAAK;YACL,SAAS,EAAE,WAAW;YACtB,QAAQ;YACR,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;YAC3J,MAAM,EAAE,YAAY;YACpB,QAAQ;YACR,eAAe;YACf,QAAQ;YACR,aAAa,EAAE,MAAM;YACrB,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC;YACvE,SAAS;YACT,UAAU,EAAE,MAAM,EAAE;YACpB,UAAU;YACV,aAAa;SACd,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,MAAM,UAAU,+BAA+B,CAAC,MAA6C;IAC3F,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;AACpJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA6B,EAAE,SAA4B,EAAE,MAA2B;IAC5H,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC1J,IAAI,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACpI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACxG,IAAI,CAAC,OAAO,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IACzN,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;AAC7M,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAiC,EAAE,MAA2B,EAAE,MAA2B;IACrH,IAAI,MAAM,CAAC,SAAS,CAAC,0BAA0B,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClK,IAAI,MAAM,CAAC,SAAS,CAAC,wBAAwB,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;AACxJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA2B,EAAE,QAAgC,EAAE,UAAkB,EAAE,KAA2C,EAAE,UAAmB;IAC9K,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,0BAA0B,CAAC;IAC7H,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,2BAA2B,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,0BAA0B,KAAK,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC;IACvJ,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc;QAAE,OAAO,wBAAwB,CAAC;IAC3I,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,uBAAuB,CAAC;IAC9H,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAA2B,EAAE,KAA2C,EAAE,UAAmB;IAC9H,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;QAAE,OAAO,gFAAgF,CAAC;IAC5L,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,qFAAqF,CAAC;IACxK,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,MAA2B,EAAE,QAAgC,EAAE,UAAkB,EAAE,KAA2C,EAAE,UAAmB;IACzK,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;AAC1mB,CAAC;AAED,SAAS,YAAY,CAAC,MAAuC,EAAE,MAAiC,EAAE,eAAwB;IACxH,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,EAAE,CAAC;IACnG,IAAI,MAAM,CAAC,iBAAiB,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACzM,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/H,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,gBAAgB,CAAC,CAAC;QACnF,IAAI,eAAe,IAAI,aAAa,EAAE,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,4DAA4D,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACpN,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IACnI,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;AAC9K,CAAC;AAED,SAAS,qBAAqB,CAAC,UAA2D,EAAE,MAAiC,EAAE,QAAyC,EAAE,gBAAyB;IACjM,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,MAAe,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1J,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,SAAkB,CAAC;IACjI,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA2B;IACtD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY;QAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAAwB;IACxD,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC1H,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAAC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAAC,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IAAC,CAAC;IAC/P,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,4BAA4B,CAAC,OAA6B,IAA0B,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,uBAAuB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AACnO,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS,IAAa,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,SAAS,QAAQ,CAAC,MAAc,EAAE,KAAa,IAAa,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9N,SAAS,MAAM,KAAa,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC9D,SAAS,WAAW,CAAC,QAAgB,EAAE,WAAmC,EAAE,IAA+B,OAAO,+BAA+B,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7U,SAAS,iBAAiB,CAAC,eAAuB,EAAE,SAA4B,EAAE,MAA4C,EAAE,QAAgC,EAAE,aAAqB,IAAgC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACtW,SAAS,oBAAoB,CAAC,OAA6B,EAAE,OAAe,EAAE,UAAkB,IAAyB,MAAM,KAAK,GAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC"}

package/dist/certification/index.d.ts

@@ -0,0 +1,9 @@
+export * from "./types.js";
+export * from "./policy.js";
+export * from "./oracle.js";
+export * from "./provider.js";
+export * from "./codex.js";
+export * from "./core.js";
+export * from "./bootstrap.js";
+export * from "./adapters.js";
+export * from "./artifacts.js";

package/dist/certification/index.js

@@ -0,0 +1,10 @@
+export * from "./types.js";
+export * from "./policy.js";
+export * from "./oracle.js";
+export * from "./provider.js";
+export * from "./codex.js";
+export * from "./core.js";
+export * from "./bootstrap.js";
+export * from "./adapters.js";
+export * from "./artifacts.js";
+//# sourceMappingURL=index.js.map

package/dist/certification/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/certification/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}

package/dist/certification/oracle.d.ts

@@ -0,0 +1,11 @@
+import type { CertificationCheck, CertificationOracleResult } from "./types.js";
+/** Construct oracle output and make the deterministic acceptance rule explicit. */
+export declare function createCertificationOracleResult(input: {
+    oracleId: string;
+    independent?: boolean;
+    checks: CertificationCheck[];
+    evidence?: Record<string, unknown>;
+}): CertificationOracleResult;
+export declare function oracleCanAccept(result: CertificationOracleResult, policy: {
+    allowRequiredSkippedChecks: boolean;
+}): boolean;

package/dist/certification/oracle.js

@@ -0,0 +1,29 @@
+/** Construct oracle output and make the deterministic acceptance rule explicit. */
+export function createCertificationOracleResult(input) {
+    const failures = [
+        ...(input.checks.length ? [] : [{ id: "oracle.empty", category: "oracle", message: "Certification oracle returned no checks.", details: {} }]),
+        ...input.checks
+            .filter((check) => check.status === "FAIL" || (check.status === "SKIP" && check.required))
+            .map((check) => ({ id: check.id, category: "oracle", message: check.message, details: { required: check.required, status: check.status, ...(check.evidence ?? {}) } }))
+    ];
+    return {
+        version: 1,
+        oracleId: input.oracleId,
+        deterministic: true,
+        status: failures.length ? "FAIL" : "PASS",
+        checks: input.checks,
+        failures,
+        evidence: input.evidence ?? {},
+        generatedAt: new Date().toISOString()
+    };
+}
+export function oracleCanAccept(result, policy) {
+    if (result.deterministic !== true || result.status !== "PASS")
+        return false;
+    if (result.failures.length > 0)
+        return false;
+    if (result.checks.some((check) => check.status === "FAIL" || (check.required && check.status === "WARN")))
+        return false;
+    return policy.allowRequiredSkippedChecks || !result.checks.some((check) => check.required && check.status === "SKIP");
+}
+//# sourceMappingURL=oracle.js.map

package/dist/certification/oracle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oracle.js","sourceRoot":"","sources":["../../src/certification/oracle.ts"],"names":[],"mappings":"AAEA,mFAAmF;AACnF,MAAM,UAAU,+BAA+B,CAAC,KAK/C;IACC,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,0CAA0C,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9I,GAAG,KAAK,CAAC,MAAM;aACZ,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;aACzF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;KAC1K,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAiC,EAAE,MAA+C;IAChH,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxH,OAAO,MAAM,CAAC,0BAA0B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AACxH,CAAC"}

package/dist/certification/policy.d.ts

@@ -0,0 +1,3 @@
+import type { CertificationPolicy } from "./types.js";
+export declare function defaultCertificationPolicy(overrides?: Partial<CertificationPolicy>): CertificationPolicy;
+export declare function validateCertificationPolicy(policy: CertificationPolicy): CertificationPolicy;

package/dist/certification/policy.js

@@ -0,0 +1,59 @@
+import { z } from "zod";
+const policySchema = z.object({
+    version: z.literal(1),
+    id: z.string().min(1),
+    assurance: z.object({
+        requireDeterministicOracle: z.boolean(),
+        requireIndependentOracle: z.boolean(),
+        allowRequiredSkippedChecks: z.boolean()
+    }),
+    budget: z.object({
+        maxAttempts: z.number().int().nonnegative(),
+        maxDurationMs: z.number().int().positive(),
+        maxCostUsd: z.number().nonnegative().optional(),
+        maxTotalTokens: z.number().int().nonnegative().optional(),
+        maxOutputBytes: z.number().int().positive().optional(),
+        requireUsageForTokenBudget: z.boolean().optional()
+    }),
+    repair: z.object({ enabled: z.boolean(), maxAttempts: z.number().int().nonnegative(), humanOnExhaustion: z.boolean() }),
+    review: z.object({ enabled: z.boolean(), required: z.boolean(), humanOnFailure: z.boolean() }),
+    security: z.object({
+        allowRecursiveCertification: z.boolean(),
+        allowNetwork: z.boolean(),
+        environmentAllowlist: z.array(z.string()),
+        credentialEnvAllowlist: z.array(z.string()),
+        maxOutputBytes: z.number().int().positive(),
+        requireNetworkIsolation: z.boolean().optional()
+    })
+});
+export function defaultCertificationPolicy(overrides = {}) {
+    return freezePolicy({
+        version: 1,
+        id: "aeh-default-certification",
+        assurance: { requireDeterministicOracle: true, requireIndependentOracle: true, allowRequiredSkippedChecks: false, ...overrides.assurance },
+        budget: { maxAttempts: 1, maxDurationMs: 30 * 60_000, maxOutputBytes: 4 * 1024 * 1024, requireUsageForTokenBudget: true, ...overrides.budget },
+        repair: { enabled: false, maxAttempts: 0, humanOnExhaustion: true, ...overrides.repair },
+        review: { enabled: false, required: false, humanOnFailure: true, ...overrides.review },
+        security: { allowRecursiveCertification: false, allowNetwork: false, environmentAllowlist: [], credentialEnvAllowlist: [], maxOutputBytes: 4 * 1024 * 1024, requireNetworkIsolation: false, ...overrides.security }
+    });
+}
+export function validateCertificationPolicy(policy) {
+    const parsed = policySchema.parse(policy);
+    if (parsed.repair.maxAttempts > parsed.budget.maxAttempts)
+        throw new Error("Certification repair maxAttempts cannot exceed the total budget maxAttempts.");
+    if (parsed.review.required && !parsed.review.enabled)
+        throw new Error("A required certification review must be enabled.");
+    if (parsed.security.credentialEnvAllowlist.some((name) => !parsed.security.environmentAllowlist.includes(name))) {
+        throw new Error("Credential environment variables must also be present in environmentAllowlist.");
+    }
+    return freezePolicy(parsed);
+}
+function freezePolicy(value) {
+    if (value && typeof value === "object") {
+        Object.freeze(value);
+        for (const item of Object.values(value))
+            freezePolicy(item);
+    }
+    return value;
+}
+//# sourceMappingURL=policy.js.map

package/dist/certification/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/certification/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE;QACvC,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE;QACrC,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE;KACxC,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QACzD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACtD,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACnD,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IACvH,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9F,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,2BAA2B,EAAE,CAAC,CAAC,OAAO,EAAE;QACxC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;QACzB,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACzC,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3C,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAChD,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,UAAU,0BAA0B,CAAC,YAA0C,EAAE;IACrF,OAAO,YAAY,CAAC;QAClB,OAAO,EAAE,CAAC;QACV,EAAE,EAAE,2BAA2B;QAC/B,SAAS,EAAE,EAAE,0BAA0B,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE;QAC1I,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE;QAC9I,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE;QACxF,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE;QACtF,QAAQ,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE;KACpN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAA2B;IACrE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAC3J,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC1H,IAAI,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,YAAY,CAAI,KAAQ;IAC/B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;YAAE,YAAY,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/certification/provider.d.ts

@@ -0,0 +1,27 @@
+import type { UsageMetrics } from "../core/types.js";
+import type { AgentProviderRequest, AgentProviderResult } from "./types.js";
+export interface ProcessExecutionOptions {
+    cwd: string;
+    env?: Record<string, string | undefined>;
+    timeoutMs: number;
+    maxOutputBytes: number;
+    allowNetwork?: boolean;
+}
+/** Execute an external actor without a shell and with a deliberately filtered environment. */
+export declare function executeArgv(command: string, args: readonly string[], options: ProcessExecutionOptions): Promise<{
+    status: "COMPLETED" | "FAILED" | "TIMED_OUT" | "OUTPUT_LIMIT";
+    exitCode: number;
+    signal?: string;
+    stdout: string;
+    stderr: string;
+    durationMs: number;
+    outputTruncated: boolean;
+}>;
+export declare class LocalAgentProvider {
+    readonly name: string;
+    readonly networkIsolation: "unavailable";
+    execute(request: AgentProviderRequest): Promise<AgentProviderResult>;
+}
+export declare function buildProviderEnvironment(request: Pick<AgentProviderRequest, "environment" | "environmentAllowlist" | "credentialEnvAllowlist">): Record<string, string>;
+export declare function parseJsonl(text: string): unknown[];
+export declare function usageForProviderResult(result: AgentProviderResult): UsageMetrics;