approval-md 0.0.1 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +176 -0
- package/NOTICE +5 -0
- package/README.md +940 -4
- package/SPEC.md +476 -34
- package/cli.js +29 -3
- package/dist/src/adapters/agentmail.d.ts +426 -0
- package/dist/src/adapters/agentmail.js +1200 -0
- package/dist/src/adapters/agentmail.js.map +1 -0
- package/dist/src/adapters/conformance.d.ts +149 -0
- package/dist/src/adapters/conformance.js +461 -0
- package/dist/src/adapters/conformance.js.map +1 -0
- package/dist/src/adapters/contract.d.ts +628 -0
- package/dist/src/adapters/contract.js +1035 -0
- package/dist/src/adapters/contract.js.map +1 -0
- package/dist/src/adapters/email.d.ts +324 -0
- package/dist/src/adapters/email.js +749 -0
- package/dist/src/adapters/email.js.map +1 -0
- package/dist/src/adapters/env-passphrase.d.ts +93 -0
- package/dist/src/adapters/env-passphrase.js +132 -0
- package/dist/src/adapters/env-passphrase.js.map +1 -0
- package/dist/src/adapters/public.d.ts +11 -0
- package/dist/src/adapters/public.js +11 -0
- package/dist/src/adapters/public.js.map +1 -0
- package/dist/src/adapters/registry.d.ts +59 -0
- package/dist/src/adapters/registry.js +77 -0
- package/dist/src/adapters/registry.js.map +1 -0
- package/dist/src/adapters/smtp.d.ts +213 -0
- package/dist/src/adapters/smtp.js +499 -0
- package/dist/src/adapters/smtp.js.map +1 -0
- package/dist/src/adapters/vault-provider.d.ts +114 -0
- package/dist/src/adapters/vault-provider.js +161 -0
- package/dist/src/adapters/vault-provider.js.map +1 -0
- package/dist/src/adapters/zzz.d.ts +66 -0
- package/dist/src/adapters/zzz.js +299 -0
- package/dist/src/adapters/zzz.js.map +1 -0
- package/dist/src/channels/batch.d.ts +109 -0
- package/dist/src/channels/batch.js +121 -0
- package/dist/src/channels/batch.js.map +1 -0
- package/dist/src/channels/cli.d.ts +193 -0
- package/dist/src/channels/cli.js +468 -0
- package/dist/src/channels/cli.js.map +1 -0
- package/dist/src/channels/conformance.d.ts +92 -0
- package/dist/src/channels/conformance.js +445 -0
- package/dist/src/channels/conformance.js.map +1 -0
- package/dist/src/channels/contract.d.ts +623 -0
- package/dist/src/channels/contract.js +494 -0
- package/dist/src/channels/contract.js.map +1 -0
- package/dist/src/channels/payload-view.d.ts +35 -0
- package/dist/src/channels/payload-view.js +43 -0
- package/dist/src/channels/payload-view.js.map +1 -0
- package/dist/src/channels/render-queue.d.ts +149 -0
- package/dist/src/channels/render-queue.js +564 -0
- package/dist/src/channels/render-queue.js.map +1 -0
- package/dist/src/channels/tagging.d.ts +196 -0
- package/dist/src/channels/tagging.js +723 -0
- package/dist/src/channels/tagging.js.map +1 -0
- package/dist/src/channels/telegram.d.ts +1832 -0
- package/dist/src/channels/telegram.js +3190 -0
- package/dist/src/channels/telegram.js.map +1 -0
- package/dist/src/channels/web.d.ts +341 -0
- package/dist/src/channels/web.js +903 -0
- package/dist/src/channels/web.js.map +1 -0
- package/dist/src/cli/adapter.d.ts +90 -0
- package/dist/src/cli/adapter.js +288 -0
- package/dist/src/cli/adapter.js.map +1 -0
- package/dist/src/cli/amend.d.ts +59 -0
- package/dist/src/cli/amend.js +2171 -0
- package/dist/src/cli/amend.js.map +1 -0
- package/dist/src/cli/args.d.ts +43 -0
- package/dist/src/cli/args.js +86 -0
- package/dist/src/cli/args.js.map +1 -0
- package/dist/src/cli/attest.d.ts +41 -0
- package/dist/src/cli/attest.js +307 -0
- package/dist/src/cli/attest.js.map +1 -0
- package/dist/src/cli/audit-card.d.ts +62 -0
- package/dist/src/cli/audit-card.js +201 -0
- package/dist/src/cli/audit-card.js.map +1 -0
- package/dist/src/cli/audit.d.ts +59 -0
- package/dist/src/cli/audit.js +460 -0
- package/dist/src/cli/audit.js.map +1 -0
- package/dist/src/cli/channel-telegram.d.ts +806 -0
- package/dist/src/cli/channel-telegram.js +2063 -0
- package/dist/src/cli/channel-telegram.js.map +1 -0
- package/dist/src/cli/channel-web.d.ts +131 -0
- package/dist/src/cli/channel-web.js +357 -0
- package/dist/src/cli/channel-web.js.map +1 -0
- package/dist/src/cli/channel.d.ts +71 -0
- package/dist/src/cli/channel.js +438 -0
- package/dist/src/cli/channel.js.map +1 -0
- package/dist/src/cli/checkpoint-tap.d.ts +169 -0
- package/dist/src/cli/checkpoint-tap.js +238 -0
- package/dist/src/cli/checkpoint-tap.js.map +1 -0
- package/dist/src/cli/codex.d.ts +2 -0
- package/dist/src/cli/codex.js +172 -0
- package/dist/src/cli/codex.js.map +1 -0
- package/dist/src/cli/coverage.d.ts +61 -0
- package/dist/src/cli/coverage.js +343 -0
- package/dist/src/cli/coverage.js.map +1 -0
- package/dist/src/cli/daemon.d.ts +120 -0
- package/dist/src/cli/daemon.js +631 -0
- package/dist/src/cli/daemon.js.map +1 -0
- package/dist/src/cli/doctor.d.ts +129 -0
- package/dist/src/cli/doctor.js +2762 -0
- package/dist/src/cli/doctor.js.map +1 -0
- package/dist/src/cli/env.d.ts +65 -0
- package/dist/src/cli/env.js +302 -0
- package/dist/src/cli/env.js.map +1 -0
- package/dist/src/cli/execute.d.ts +202 -0
- package/dist/src/cli/execute.js +1682 -0
- package/dist/src/cli/execute.js.map +1 -0
- package/dist/src/cli/exit-codes.d.ts +73 -0
- package/dist/src/cli/exit-codes.js +82 -0
- package/dist/src/cli/exit-codes.js.map +1 -0
- package/dist/src/cli/feedback.d.ts +60 -0
- package/dist/src/cli/feedback.js +205 -0
- package/dist/src/cli/feedback.js.map +1 -0
- package/dist/src/cli/gate-window.d.ts +40 -0
- package/dist/src/cli/gate-window.js +294 -0
- package/dist/src/cli/gate-window.js.map +1 -0
- package/dist/src/cli/gate.d.ts +68 -0
- package/dist/src/cli/gate.js +557 -0
- package/dist/src/cli/gate.js.map +1 -0
- package/dist/src/cli/git-scope.d.ts +190 -0
- package/dist/src/cli/git-scope.js +295 -0
- package/dist/src/cli/git-scope.js.map +1 -0
- package/dist/src/cli/gloss-attach.d.ts +85 -0
- package/dist/src/cli/gloss-attach.js +107 -0
- package/dist/src/cli/gloss-attach.js.map +1 -0
- package/dist/src/cli/gloss-codex-child.d.ts +9 -0
- package/dist/src/cli/gloss-codex-child.js +149 -0
- package/dist/src/cli/gloss-codex-child.js.map +1 -0
- package/dist/src/cli/gloss-codex.d.ts +24 -0
- package/dist/src/cli/gloss-codex.js +255 -0
- package/dist/src/cli/gloss-codex.js.map +1 -0
- package/dist/src/cli/gloss-options.d.ts +42 -0
- package/dist/src/cli/gloss-options.js +79 -0
- package/dist/src/cli/gloss-options.js.map +1 -0
- package/dist/src/cli/gloss.d.ts +265 -0
- package/dist/src/cli/gloss.js +362 -0
- package/dist/src/cli/gloss.js.map +1 -0
- package/dist/src/cli/help.d.ts +103 -0
- package/dist/src/cli/help.js +2339 -0
- package/dist/src/cli/help.js.map +1 -0
- package/dist/src/cli/hook-codex.d.ts +78 -0
- package/dist/src/cli/hook-codex.js +167 -0
- package/dist/src/cli/hook-codex.js.map +1 -0
- package/dist/src/cli/hook.d.ts +331 -0
- package/dist/src/cli/hook.js +2849 -0
- package/dist/src/cli/hook.js.map +1 -0
- package/dist/src/cli/import.d.ts +35 -0
- package/dist/src/cli/import.js +175 -0
- package/dist/src/cli/import.js.map +1 -0
- package/dist/src/cli/init.d.ts +84 -0
- package/dist/src/cli/init.js +336 -0
- package/dist/src/cli/init.js.map +1 -0
- package/dist/src/cli/instructions.d.ts +23 -0
- package/dist/src/cli/instructions.js +262 -0
- package/dist/src/cli/instructions.js.map +1 -0
- package/dist/src/cli/journal.d.ts +41 -0
- package/dist/src/cli/journal.js +238 -0
- package/dist/src/cli/journal.js.map +1 -0
- package/dist/src/cli/log-advance.d.ts +287 -0
- package/dist/src/cli/log-advance.js +840 -0
- package/dist/src/cli/log-advance.js.map +1 -0
- package/dist/src/cli/log-anchor.d.ts +176 -0
- package/dist/src/cli/log-anchor.js +387 -0
- package/dist/src/cli/log-anchor.js.map +1 -0
- package/dist/src/cli/log-checkpoint.d.ts +22 -0
- package/dist/src/cli/log-checkpoint.js +128 -0
- package/dist/src/cli/log-checkpoint.js.map +1 -0
- package/dist/src/cli/log-sync.d.ts +243 -0
- package/dist/src/cli/log-sync.js +849 -0
- package/dist/src/cli/log-sync.js.map +1 -0
- package/dist/src/cli/log-verbs.d.ts +16 -0
- package/dist/src/cli/log-verbs.js +360 -0
- package/dist/src/cli/log-verbs.js.map +1 -0
- package/dist/src/cli/long-help.d.ts +70 -0
- package/dist/src/cli/long-help.js +148 -0
- package/dist/src/cli/long-help.js.map +1 -0
- package/dist/src/cli/main.d.ts +77 -0
- package/dist/src/cli/main.js +1206 -0
- package/dist/src/cli/main.js.map +1 -0
- package/dist/src/cli/mcp.d.ts +52 -0
- package/dist/src/cli/mcp.js +306 -0
- package/dist/src/cli/mcp.js.map +1 -0
- package/dist/src/cli/paths.d.ts +56 -0
- package/dist/src/cli/paths.js +79 -0
- package/dist/src/cli/paths.js.map +1 -0
- package/dist/src/cli/payload.d.ts +58 -0
- package/dist/src/cli/payload.js +253 -0
- package/dist/src/cli/payload.js.map +1 -0
- package/dist/src/cli/policy.d.ts +43 -0
- package/dist/src/cli/policy.js +229 -0
- package/dist/src/cli/policy.js.map +1 -0
- package/dist/src/cli/preflight.d.ts +363 -0
- package/dist/src/cli/preflight.js +1175 -0
- package/dist/src/cli/preflight.js.map +1 -0
- package/dist/src/cli/progress.d.ts +78 -0
- package/dist/src/cli/progress.js +112 -0
- package/dist/src/cli/progress.js.map +1 -0
- package/dist/src/cli/prompt.d.ts +209 -0
- package/dist/src/cli/prompt.js +312 -0
- package/dist/src/cli/prompt.js.map +1 -0
- package/dist/src/cli/quickstart.d.ts +46 -0
- package/dist/src/cli/quickstart.js +297 -0
- package/dist/src/cli/quickstart.js.map +1 -0
- package/dist/src/cli/records.d.ts +34 -0
- package/dist/src/cli/records.js +66 -0
- package/dist/src/cli/records.js.map +1 -0
- package/dist/src/cli/render.d.ts +22 -0
- package/dist/src/cli/render.js +132 -0
- package/dist/src/cli/render.js.map +1 -0
- package/dist/src/cli/sandbox.d.ts +51 -0
- package/dist/src/cli/sandbox.js +150 -0
- package/dist/src/cli/sandbox.js.map +1 -0
- package/dist/src/cli/scaffold.d.ts +79 -0
- package/dist/src/cli/scaffold.js +137 -0
- package/dist/src/cli/scaffold.js.map +1 -0
- package/dist/src/cli/setup-adapter.d.ts +137 -0
- package/dist/src/cli/setup-adapter.js +509 -0
- package/dist/src/cli/setup-adapter.js.map +1 -0
- package/dist/src/cli/setup-channel.d.ts +117 -0
- package/dist/src/cli/setup-channel.js +635 -0
- package/dist/src/cli/setup-channel.js.map +1 -0
- package/dist/src/cli/setup-checkpoint.d.ts +57 -0
- package/dist/src/cli/setup-checkpoint.js +196 -0
- package/dist/src/cli/setup-checkpoint.js.map +1 -0
- package/dist/src/cli/setup-common.d.ts +275 -0
- package/dist/src/cli/setup-common.js +376 -0
- package/dist/src/cli/setup-common.js.map +1 -0
- package/dist/src/cli/setup-flow.d.ts +287 -0
- package/dist/src/cli/setup-flow.js +476 -0
- package/dist/src/cli/setup-flow.js.map +1 -0
- package/dist/src/cli/setup-service.d.ts +96 -0
- package/dist/src/cli/setup-service.js +308 -0
- package/dist/src/cli/setup-service.js.map +1 -0
- package/dist/src/cli/setup.d.ts +202 -0
- package/dist/src/cli/setup.js +473 -0
- package/dist/src/cli/setup.js.map +1 -0
- package/dist/src/cli/style.d.ts +320 -0
- package/dist/src/cli/style.js +469 -0
- package/dist/src/cli/style.js.map +1 -0
- package/dist/src/cli/token.d.ts +39 -0
- package/dist/src/cli/token.js +274 -0
- package/dist/src/cli/token.js.map +1 -0
- package/dist/src/cli/up.d.ts +155 -0
- package/dist/src/cli/up.js +849 -0
- package/dist/src/cli/up.js.map +1 -0
- package/dist/src/cli/usage.d.ts +37 -0
- package/dist/src/cli/usage.js +91 -0
- package/dist/src/cli/usage.js.map +1 -0
- package/dist/src/cli/values.d.ts +40 -0
- package/dist/src/cli/values.js +189 -0
- package/dist/src/cli/values.js.map +1 -0
- package/dist/src/cli/vault.d.ts +59 -0
- package/dist/src/cli/vault.js +362 -0
- package/dist/src/cli/vault.js.map +1 -0
- package/dist/src/cli/verb-registry.d.ts +76 -0
- package/dist/src/cli/verb-registry.js +2341 -0
- package/dist/src/cli/verb-registry.js.map +1 -0
- package/dist/src/cli/wordmark.d.ts +31 -0
- package/dist/src/cli/wordmark.js +52 -0
- package/dist/src/cli/wordmark.js.map +1 -0
- package/dist/src/codex/doctor.d.ts +13 -0
- package/dist/src/codex/doctor.js +41 -0
- package/dist/src/codex/doctor.js.map +1 -0
- package/dist/src/codex/manifest.d.ts +49 -0
- package/dist/src/codex/manifest.js +103 -0
- package/dist/src/codex/manifest.js.map +1 -0
- package/dist/src/codex/templates.d.ts +41 -0
- package/dist/src/codex/templates.js +319 -0
- package/dist/src/codex/templates.js.map +1 -0
- package/dist/src/codex/trust.d.ts +19 -0
- package/dist/src/codex/trust.js +183 -0
- package/dist/src/codex/trust.js.map +1 -0
- package/dist/src/codex/workspace-plan.d.ts +131 -0
- package/dist/src/codex/workspace-plan.js +561 -0
- package/dist/src/codex/workspace-plan.js.map +1 -0
- package/dist/src/core/actor.d.ts +2 -0
- package/dist/src/core/actor.js +5 -0
- package/dist/src/core/actor.js.map +1 -0
- package/dist/src/core/advance-cycle.d.ts +170 -0
- package/dist/src/core/advance-cycle.js +200 -0
- package/dist/src/core/advance-cycle.js.map +1 -0
- package/dist/src/core/agents-md.d.ts +276 -0
- package/dist/src/core/agents-md.js +747 -0
- package/dist/src/core/agents-md.js.map +1 -0
- package/dist/src/core/apply-patch.d.ts +49 -0
- package/dist/src/core/apply-patch.js +266 -0
- package/dist/src/core/apply-patch.js.map +1 -0
- package/dist/src/core/attest.d.ts +420 -0
- package/dist/src/core/attest.js +589 -0
- package/dist/src/core/attest.js.map +1 -0
- package/dist/src/core/audit.d.ts +492 -0
- package/dist/src/core/audit.js +882 -0
- package/dist/src/core/audit.js.map +1 -0
- package/dist/src/core/budgets.d.ts +238 -0
- package/dist/src/core/budgets.js +449 -0
- package/dist/src/core/budgets.js.map +1 -0
- package/dist/src/core/checkpoint.d.ts +500 -0
- package/dist/src/core/checkpoint.js +738 -0
- package/dist/src/core/checkpoint.js.map +1 -0
- package/dist/src/core/child-env.d.ts +88 -0
- package/dist/src/core/child-env.js +86 -0
- package/dist/src/core/child-env.js.map +1 -0
- package/dist/src/core/clock.d.ts +52 -0
- package/dist/src/core/clock.js +43 -0
- package/dist/src/core/clock.js.map +1 -0
- package/dist/src/core/command-class.d.ts +543 -0
- package/dist/src/core/command-class.js +2356 -0
- package/dist/src/core/command-class.js.map +1 -0
- package/dist/src/core/coverage-sources/adapter.d.ts +40 -0
- package/dist/src/core/coverage-sources/adapter.js +71 -0
- package/dist/src/core/coverage-sources/adapter.js.map +1 -0
- package/dist/src/core/coverage-sources/gh.d.ts +48 -0
- package/dist/src/core/coverage-sources/gh.js +136 -0
- package/dist/src/core/coverage-sources/gh.js.map +1 -0
- package/dist/src/core/coverage-sources/git.d.ts +101 -0
- package/dist/src/core/coverage-sources/git.js +269 -0
- package/dist/src/core/coverage-sources/git.js.map +1 -0
- package/dist/src/core/coverage.d.ts +217 -0
- package/dist/src/core/coverage.js +337 -0
- package/dist/src/core/coverage.js.map +1 -0
- package/dist/src/core/credential-spec.d.ts +72 -0
- package/dist/src/core/credential-spec.js +23 -0
- package/dist/src/core/credential-spec.js.map +1 -0
- package/dist/src/core/dark-session.d.ts +331 -0
- package/dist/src/core/dark-session.js +714 -0
- package/dist/src/core/dark-session.js.map +1 -0
- package/dist/src/core/decision-refusal.d.ts +185 -0
- package/dist/src/core/decision-refusal.js +265 -0
- package/dist/src/core/decision-refusal.js.map +1 -0
- package/dist/src/core/env-file.d.ts +450 -0
- package/dist/src/core/env-file.js +837 -0
- package/dist/src/core/env-file.js.map +1 -0
- package/dist/src/core/execute.d.ts +858 -0
- package/dist/src/core/execute.js +1271 -0
- package/dist/src/core/execute.js.map +1 -0
- package/dist/src/core/frontmatter.d.ts +78 -0
- package/dist/src/core/frontmatter.js +100 -0
- package/dist/src/core/frontmatter.js.map +1 -0
- package/dist/src/core/gate-window.d.ts +312 -0
- package/dist/src/core/gate-window.js +506 -0
- package/dist/src/core/gate-window.js.map +1 -0
- package/dist/src/core/gate.d.ts +1364 -0
- package/dist/src/core/gate.js +3002 -0
- package/dist/src/core/gate.js.map +1 -0
- package/dist/src/core/git-run.d.ts +73 -0
- package/dist/src/core/git-run.js +93 -0
- package/dist/src/core/git-run.js.map +1 -0
- package/dist/src/core/harness-version.d.ts +157 -0
- package/dist/src/core/harness-version.js +211 -0
- package/dist/src/core/harness-version.js.map +1 -0
- package/dist/src/core/harness-wait.d.ts +55 -0
- package/dist/src/core/harness-wait.js +58 -0
- package/dist/src/core/harness-wait.js.map +1 -0
- package/dist/src/core/head-retry.d.ts +107 -0
- package/dist/src/core/head-retry.js +121 -0
- package/dist/src/core/head-retry.js.map +1 -0
- package/dist/src/core/instance.d.ts +253 -0
- package/dist/src/core/instance.js +319 -0
- package/dist/src/core/instance.js.map +1 -0
- package/dist/src/core/intake-limits.d.ts +247 -0
- package/dist/src/core/intake-limits.js +350 -0
- package/dist/src/core/intake-limits.js.map +1 -0
- package/dist/src/core/jcs.d.ts +52 -0
- package/dist/src/core/jcs.js +132 -0
- package/dist/src/core/jcs.js.map +1 -0
- package/dist/src/core/journal.d.ts +144 -0
- package/dist/src/core/journal.js +200 -0
- package/dist/src/core/journal.js.map +1 -0
- package/dist/src/core/live-draw.d.ts +436 -0
- package/dist/src/core/live-draw.js +703 -0
- package/dist/src/core/live-draw.js.map +1 -0
- package/dist/src/core/log-reconcile.d.ts +89 -0
- package/dist/src/core/log-reconcile.js +136 -0
- package/dist/src/core/log-reconcile.js.map +1 -0
- package/dist/src/core/log-subscribe.d.ts +36 -0
- package/dist/src/core/log-subscribe.js +162 -0
- package/dist/src/core/log-subscribe.js.map +1 -0
- package/dist/src/core/log.d.ts +278 -0
- package/dist/src/core/log.js +546 -0
- package/dist/src/core/log.js.map +1 -0
- package/dist/src/core/loop.d.ts +274 -0
- package/dist/src/core/loop.js +487 -0
- package/dist/src/core/loop.js.map +1 -0
- package/dist/src/core/md-fence.d.ts +41 -0
- package/dist/src/core/md-fence.js +74 -0
- package/dist/src/core/md-fence.js.map +1 -0
- package/dist/src/core/money.d.ts +147 -0
- package/dist/src/core/money.js +195 -0
- package/dist/src/core/money.js.map +1 -0
- package/dist/src/core/payload-census.d.ts +74 -0
- package/dist/src/core/payload-census.js +146 -0
- package/dist/src/core/payload-census.js.map +1 -0
- package/dist/src/core/payload-store.d.ts +175 -0
- package/dist/src/core/payload-store.js +340 -0
- package/dist/src/core/payload-store.js.map +1 -0
- package/dist/src/core/payload.d.ts +71 -0
- package/dist/src/core/payload.js +80 -0
- package/dist/src/core/payload.js.map +1 -0
- package/dist/src/core/policy-diff.d.ts +292 -0
- package/dist/src/core/policy-diff.js +588 -0
- package/dist/src/core/policy-diff.js.map +1 -0
- package/dist/src/core/policy-expectations.d.ts +199 -0
- package/dist/src/core/policy-expectations.js +394 -0
- package/dist/src/core/policy-expectations.js.map +1 -0
- package/dist/src/core/policy-explain.d.ts +150 -0
- package/dist/src/core/policy-explain.js +258 -0
- package/dist/src/core/policy-explain.js.map +1 -0
- package/dist/src/core/policy-load.d.ts +527 -0
- package/dist/src/core/policy-load.js +536 -0
- package/dist/src/core/policy-load.js.map +1 -0
- package/dist/src/core/policy-match.d.ts +281 -0
- package/dist/src/core/policy-match.js +478 -0
- package/dist/src/core/policy-match.js.map +1 -0
- package/dist/src/core/policy-proposal.d.ts +265 -0
- package/dist/src/core/policy-proposal.js +458 -0
- package/dist/src/core/policy-proposal.js.map +1 -0
- package/dist/src/core/prompt-layout.d.ts +221 -0
- package/dist/src/core/prompt-layout.js +422 -0
- package/dist/src/core/prompt-layout.js.map +1 -0
- package/dist/src/core/protected-path-guard.d.ts +453 -0
- package/dist/src/core/protected-path-guard.js +1566 -0
- package/dist/src/core/protected-path-guard.js.map +1 -0
- package/dist/src/core/registration.d.ts +25 -0
- package/dist/src/core/registration.js +39 -0
- package/dist/src/core/registration.js.map +1 -0
- package/dist/src/core/reindex.d.ts +99 -0
- package/dist/src/core/reindex.js +336 -0
- package/dist/src/core/reindex.js.map +1 -0
- package/dist/src/core/sampler.d.ts +313 -0
- package/dist/src/core/sampler.js +388 -0
- package/dist/src/core/sampler.js.map +1 -0
- package/dist/src/core/sandbox.d.ts +290 -0
- package/dist/src/core/sandbox.js +424 -0
- package/dist/src/core/sandbox.js.map +1 -0
- package/dist/src/core/seal.d.ts +165 -0
- package/dist/src/core/seal.js +290 -0
- package/dist/src/core/seal.js.map +1 -0
- package/dist/src/core/state.d.ts +505 -0
- package/dist/src/core/state.js +1009 -0
- package/dist/src/core/state.js.map +1 -0
- package/dist/src/core/task-file.d.ts +185 -0
- package/dist/src/core/task-file.js +464 -0
- package/dist/src/core/task-file.js.map +1 -0
- package/dist/src/core/telegram-config.d.ts +93 -0
- package/dist/src/core/telegram-config.js +114 -0
- package/dist/src/core/telegram-config.js.map +1 -0
- package/dist/src/core/token.d.ts +409 -0
- package/dist/src/core/token.js +561 -0
- package/dist/src/core/token.js.map +1 -0
- package/dist/src/core/validate.d.ts +138 -0
- package/dist/src/core/validate.js +0 -0
- package/dist/src/core/validate.js.map +1 -0
- package/dist/src/core/values.d.ts +137 -0
- package/dist/src/core/values.js +153 -0
- package/dist/src/core/values.js.map +1 -0
- package/dist/src/core/vault.d.ts +291 -0
- package/dist/src/core/vault.js +612 -0
- package/dist/src/core/vault.js.map +1 -0
- package/dist/src/core/verified-snapshot.d.ts +204 -0
- package/dist/src/core/verified-snapshot.js +506 -0
- package/dist/src/core/verified-snapshot.js.map +1 -0
- package/dist/src/core/verify.d.ts +336 -0
- package/dist/src/core/verify.js +549 -0
- package/dist/src/core/verify.js.map +1 -0
- package/dist/src/core/version.d.ts +8 -0
- package/dist/src/core/version.js +9 -0
- package/dist/src/core/version.js.map +1 -0
- package/dist/src/core/wysiwys.d.ts +370 -0
- package/dist/src/core/wysiwys.js +728 -0
- package/dist/src/core/wysiwys.js.map +1 -0
- package/dist/src/daemon/advance-child.d.ts +39 -0
- package/dist/src/daemon/advance-child.js +78 -0
- package/dist/src/daemon/advance-child.js.map +1 -0
- package/dist/src/daemon/advance.d.ts +466 -0
- package/dist/src/daemon/advance.js +849 -0
- package/dist/src/daemon/advance.js.map +1 -0
- package/dist/src/daemon/audit.d.ts +87 -0
- package/dist/src/daemon/audit.js +90 -0
- package/dist/src/daemon/audit.js.map +1 -0
- package/dist/src/daemon/daemon.d.ts +1180 -0
- package/dist/src/daemon/daemon.js +1988 -0
- package/dist/src/daemon/daemon.js.map +1 -0
- package/dist/src/daemon/dark-session.d.ts +64 -0
- package/dist/src/daemon/dark-session.js +119 -0
- package/dist/src/daemon/dark-session.js.map +1 -0
- package/dist/src/daemon/draw-child.d.ts +36 -0
- package/dist/src/daemon/draw-child.js +132 -0
- package/dist/src/daemon/draw-child.js.map +1 -0
- package/dist/src/daemon/draw.d.ts +154 -0
- package/dist/src/daemon/draw.js +458 -0
- package/dist/src/daemon/draw.js.map +1 -0
- package/dist/src/daemon/git-evidence.d.ts +173 -0
- package/dist/src/daemon/git-evidence.js +345 -0
- package/dist/src/daemon/git-evidence.js.map +1 -0
- package/dist/src/daemon/projection.d.ts +180 -0
- package/dist/src/daemon/projection.js +233 -0
- package/dist/src/daemon/projection.js.map +1 -0
- package/dist/src/daemon/prune.d.ts +207 -0
- package/dist/src/daemon/prune.js +376 -0
- package/dist/src/daemon/prune.js.map +1 -0
- package/dist/src/mcp/http.d.ts +113 -0
- package/dist/src/mcp/http.js +343 -0
- package/dist/src/mcp/http.js.map +1 -0
- package/dist/src/mcp/server.d.ts +265 -0
- package/dist/src/mcp/server.js +602 -0
- package/dist/src/mcp/server.js.map +1 -0
- package/docs/adapter-api.md +106 -0
- package/docs/cli-reference.md +5716 -0
- package/docs/codex-enforced-session.md +30 -0
- package/package.json +53 -4
- package/schema/.gitkeep +0 -0
- package/schema/LICENSE +117 -0
- package/schema/codex-instance.schema.json +82 -0
- package/schema/envelope.schema.json +137 -0
- package/schema/event.schema.json +1811 -0
- package/schema/fixtures/codex-instance/invalid/unpinned-codex-version.json +40 -0
- package/schema/fixtures/codex-instance/valid/canonical.json +40 -0
- package/schema/fixtures/envelope/invalid/action-missing-idempotency-key.json +15 -0
- package/schema/fixtures/envelope/invalid/action-unknown-class-format.json +14 -0
- package/schema/fixtures/envelope/invalid/confidence-out-of-range.json +11 -0
- package/schema/fixtures/envelope/invalid/est-cost-bare-number.json +14 -0
- package/schema/fixtures/envelope/invalid/est-cost-noncanonical-string.json +14 -0
- package/schema/fixtures/envelope/invalid/malformed-assignee.json +10 -0
- package/schema/fixtures/envelope/invalid/malformed-created-by.json +7 -0
- package/schema/fixtures/envelope/invalid/malformed-max-latency.json +11 -0
- package/schema/fixtures/envelope/invalid/malformed-payload-hash.json +14 -0
- package/schema/fixtures/envelope/invalid/max-cost-bare-number.json +11 -0
- package/schema/fixtures/envelope/invalid/missing-origin.json +3 -0
- package/schema/fixtures/envelope/invalid/negative-est-cost.json +14 -0
- package/schema/fixtures/envelope/invalid/unknown-state.json +7 -0
- package/schema/fixtures/envelope/invalid/unknown-top-level-field.json +8 -0
- package/schema/fixtures/envelope/valid/action-payload-hash.json +17 -0
- package/schema/fixtures/envelope/valid/actions-without-budget.json +18 -0
- package/schema/fixtures/envelope/valid/canonical.json +25 -0
- package/schema/fixtures/envelope/valid/minimal.json +7 -0
- package/schema/fixtures/envelope/valid/multi-action-executed.json +30 -0
- package/schema/fixtures/envelope/valid/record-write-stage.json +22 -0
- package/schema/fixtures/event/invalid/approval-granted-agent-actor.json +15 -0
- package/schema/fixtures/event/invalid/approval-granted-empty-batch-delivery-id.json +17 -0
- package/schema/fixtures/event/invalid/approval-granted-fifth-reaction.json +16 -0
- package/schema/fixtures/event/invalid/approval-granted-missing-actor.json +14 -0
- package/schema/fixtures/event/invalid/approval-requested-missing-action-key.json +14 -0
- package/schema/fixtures/event/invalid/approval-withdrawn-agent-policy-drift.json +15 -0
- package/schema/fixtures/event/invalid/approval-withdrawn-missing-reason.json +15 -0
- package/schema/fixtures/event/invalid/approval-withdrawn-system-actor.json +15 -0
- package/schema/fixtures/event/invalid/audit-decision-refused-human-actor.json +17 -0
- package/schema/fixtures/event/invalid/audit-decision-refused-missing-code.json +16 -0
- package/schema/fixtures/event/invalid/audit-reviewed-agent-actor.json +15 -0
- package/schema/fixtures/event/invalid/audit-reviewed-loved-no-note.json +16 -0
- package/schema/fixtures/event/invalid/audit-reviewed-system-actor.json +15 -0
- package/schema/fixtures/event/invalid/bad-actor-prefix.json +15 -0
- package/schema/fixtures/event/invalid/est-cost-bare-number.json +17 -0
- package/schema/fixtures/event/invalid/execution-completed-fabricated-exit-code.json +16 -0
- package/schema/fixtures/event/invalid/execution-completed-provider-ref-empty-id.json +18 -0
- package/schema/fixtures/event/invalid/execution-completed-provider-ref-extra-field.json +19 -0
- package/schema/fixtures/event/invalid/execution-completed-provider-ref-id-not-string.json +18 -0
- package/schema/fixtures/event/invalid/execution-completed-provider-ref-missing-adapter.json +17 -0
- package/schema/fixtures/event/invalid/execution-failed-open-reported-by.json +16 -0
- package/schema/fixtures/event/invalid/execution-indeterminate-open-reason.json +14 -0
- package/schema/fixtures/event/invalid/execution-reconciled-agent-actor.json +17 -0
- package/schema/fixtures/event/invalid/execution-started-negative-env-stripped.json +16 -0
- package/schema/fixtures/event/invalid/gate-bypassed-missing-opened-seq.json +15 -0
- package/schema/fixtures/event/invalid/gate-closed-non-integer-opened-seq.json +13 -0
- package/schema/fixtures/event/invalid/gate-opened-agent-actor.json +16 -0
- package/schema/fixtures/event/invalid/gate-organ-attested-absolute-path.json +14 -0
- package/schema/fixtures/event/invalid/gate-organ-attested-agent-actor.json +14 -0
- package/schema/fixtures/event/invalid/gate-organ-attested-missing-organ-path.json +13 -0
- package/schema/fixtures/event/invalid/harness-unknown-kind.json +18 -0
- package/schema/fixtures/event/invalid/harness-version-multiline.json +16 -0
- package/schema/fixtures/event/invalid/log-checkpoint-agent-actor.json +17 -0
- package/schema/fixtures/event/invalid/log-checkpoint-missing-signature.json +16 -0
- package/schema/fixtures/event/invalid/log-checkpoint-short-signed-hash.json +17 -0
- package/schema/fixtures/event/invalid/log-checkpoint-unknown-signature-alg.json +17 -0
- package/schema/fixtures/event/invalid/malformed-ts.json +15 -0
- package/schema/fixtures/event/invalid/missing-alg.json +14 -0
- package/schema/fixtures/event/invalid/missing-hash.json +14 -0
- package/schema/fixtures/event/invalid/non-integer-seq.json +15 -0
- package/schema/fixtures/event/invalid/payload-pruned-human-actor.json +14 -0
- package/schema/fixtures/event/invalid/payload-pruned-missing-hash.json +14 -0
- package/schema/fixtures/event/invalid/policy-declined-agent-actor.json +15 -0
- package/schema/fixtures/event/invalid/policy-proposed-missing-diff.json +19 -0
- package/schema/fixtures/event/invalid/policy-proposed-system-actor.json +26 -0
- package/schema/fixtures/event/invalid/short-hash.json +15 -0
- package/schema/fixtures/event/invalid/unknown-alg.json +15 -0
- package/schema/fixtures/event/invalid/unknown-event-type.json +15 -0
- package/schema/fixtures/event/invalid/unknown-top-level-field.json +16 -0
- package/schema/fixtures/event/valid/approval-expired.json +15 -0
- package/schema/fixtures/event/valid/approval-granted-batch.json +19 -0
- package/schema/fixtures/event/valid/approval-granted-reaction.json +16 -0
- package/schema/fixtures/event/valid/approval-granted.json +15 -0
- package/schema/fixtures/event/valid/approval-rejected.json +15 -0
- package/schema/fixtures/event/valid/approval-requested.json +19 -0
- package/schema/fixtures/event/valid/approval-revoked.json +15 -0
- package/schema/fixtures/event/valid/approval-withdrawn-policy-drift.json +17 -0
- package/schema/fixtures/event/valid/approval-withdrawn.json +16 -0
- package/schema/fixtures/event/valid/audit-decision-refused.json +20 -0
- package/schema/fixtures/event/valid/audit-reviewed-reaction.json +17 -0
- package/schema/fixtures/event/valid/audit-reviewed.json +15 -0
- package/schema/fixtures/event/valid/audit-sampled.json +14 -0
- package/schema/fixtures/event/valid/budget-exceeded.json +21 -0
- package/schema/fixtures/event/valid/envelope-drift.json +16 -0
- package/schema/fixtures/event/valid/execution-completed-harness-report.json +16 -0
- package/schema/fixtures/event/valid/execution-completed-provider-ref.json +18 -0
- package/schema/fixtures/event/valid/execution-completed.json +15 -0
- package/schema/fixtures/event/valid/execution-failed-harness-report.json +16 -0
- package/schema/fixtures/event/valid/execution-failed.json +15 -0
- package/schema/fixtures/event/valid/execution-indeterminate.json +15 -0
- package/schema/fixtures/event/valid/execution-reconciled.json +17 -0
- package/schema/fixtures/event/valid/execution-started-env-stripped.json +17 -0
- package/schema/fixtures/event/valid/execution-started.json +14 -0
- package/schema/fixtures/event/valid/gate-bypassed-harness-version.json +18 -0
- package/schema/fixtures/event/valid/gate-bypassed.json +19 -0
- package/schema/fixtures/event/valid/gate-closed.json +14 -0
- package/schema/fixtures/event/valid/gate-opened.json +16 -0
- package/schema/fixtures/event/valid/gate-organ-attested.json +14 -0
- package/schema/fixtures/event/valid/genesis-null-prev.json +14 -0
- package/schema/fixtures/event/valid/log-checkpoint.json +17 -0
- package/schema/fixtures/event/valid/payload-pruned-orphan.json +13 -0
- package/schema/fixtures/event/valid/payload-pruned.json +17 -0
- package/schema/fixtures/event/valid/policy-declined.json +16 -0
- package/schema/fixtures/event/valid/policy-proposed.json +35 -0
- package/schema/fixtures/event/valid/policy-updated.json +14 -0
- package/schema/fixtures/event/valid/reconciliation-required.json +18 -0
- package/schema/fixtures/event/valid/reconciliation-satisfied.json +17 -0
- package/schema/fixtures/event/valid/route-accepted.json +15 -0
- package/schema/fixtures/event/valid/route-proposed.json +16 -0
- package/schema/fixtures/event/valid/spec-example.json +15 -0
- package/schema/fixtures/event/valid/task-registered-harness-version.json +23 -0
- package/schema/fixtures/event/valid/task-registered.json +14 -0
- package/schema/fixtures/hash/known-answer-pre-121.json +74 -0
- package/schema/fixtures/hash/known-answer.json +74 -0
- package/schema/fixtures/policy/invalid/bad-approval-ttl.json +7 -0
- package/schema/fixtures/policy/invalid/bad-web-port.json +4 -0
- package/schema/fixtures/policy/invalid/checkpoint-key-not-base64.json +6 -0
- package/schema/fixtures/policy/invalid/class-rule-missing-autonomy.json +9 -0
- package/schema/fixtures/policy/invalid/empty-class-key.json +6 -0
- package/schema/fixtures/policy/invalid/live-rate-on-human-only.json +7 -0
- package/schema/fixtures/policy/invalid/malformed-class-key.json +6 -0
- package/schema/fixtures/policy/invalid/missing-version.json +8 -0
- package/schema/fixtures/policy/invalid/negative-limit.json +9 -0
- package/schema/fixtures/policy/invalid/non-numeric-limit.json +9 -0
- package/schema/fixtures/policy/invalid/non-positive-max-pending.json +9 -0
- package/schema/fixtures/policy/invalid/on-expiry-grant.json +8 -0
- package/schema/fixtures/policy/invalid/payload-retention-bare-number.json +4 -0
- package/schema/fixtures/policy/invalid/payload-retention-compound.json +4 -0
- package/schema/fixtures/policy/invalid/payload-retention-fractional.json +4 -0
- package/schema/fixtures/policy/invalid/payload-retention-zero.json +4 -0
- package/schema/fixtures/policy/invalid/protected-paths-escape.json +4 -0
- package/schema/fixtures/policy/invalid/protected-paths-glob.json +4 -0
- package/schema/fixtures/policy/invalid/retro-rate-on-human-only.json +7 -0
- package/schema/fixtures/policy/invalid/retro-rate-on-manual.json +7 -0
- package/schema/fixtures/policy/invalid/retro-rate-zero.json +7 -0
- package/schema/fixtures/policy/invalid/sample-rate-too-high.json +5 -0
- package/schema/fixtures/policy/invalid/sampling-secret-env-empty.json +7 -0
- package/schema/fixtures/policy/invalid/sampling-secret-env-not-string.json +6 -0
- package/schema/fixtures/policy/invalid/skew-tolerance-compound.json +6 -0
- package/schema/fixtures/policy/invalid/unknown-autonomy.json +7 -0
- package/schema/fixtures/policy/invalid/unknown-class-rule-key.json +6 -0
- package/schema/fixtures/policy/invalid/unknown-top-level-key.json +7 -0
- package/schema/fixtures/policy/invalid/vault-passphrase-env-empty.json +6 -0
- package/schema/fixtures/policy/invalid/vault-passphrase-literal.json +6 -0
- package/schema/fixtures/policy/invalid/version-not-string.json +4 -0
- package/schema/fixtures/policy/valid/canonical.json +47 -0
- package/schema/fixtures/policy/valid/checkpoint-keys.json +18 -0
- package/schema/fixtures/policy/valid/class-approvers-limits.json +25 -0
- package/schema/fixtures/policy/valid/class-retro-rate.json +17 -0
- package/schema/fixtures/policy/valid/global-budgets.json +19 -0
- package/schema/fixtures/policy/valid/human-only.json +9 -0
- package/schema/fixtures/policy/valid/minimal.json +6 -0
- package/schema/fixtures/policy/valid/protected-paths.json +10 -0
- package/schema/fixtures/policy/valid/record-namespace.json +13 -0
- package/schema/fixtures/policy/valid/request-volume-limits.json +26 -0
- package/schema/fixtures/policy/valid/retention-and-sampling-secret.json +16 -0
- package/schema/fixtures/policy/valid/skew-tolerance.json +15 -0
- package/schema/fixtures/policy/valid/vault-passphrase-env.json +14 -0
- package/schema/fixtures/policy/valid/wildcards.json +15 -0
- package/schema/fixtures/policy-md/invalid/alias-bomb.md +15 -0
- package/schema/fixtures/policy-md/invalid/no-fence.md +7 -0
- package/schema/fixtures/policy-md/invalid/protected-route-not-a-subclass.md +16 -0
- package/schema/fixtures/policy-md/invalid/schema-invalid-autonomy.md +16 -0
- package/schema/fixtures/policy-md/invalid/schema-invalid-read-proof.md +17 -0
- package/schema/fixtures/policy-md/invalid/two-fences.md +19 -0
- package/schema/fixtures/policy-md/invalid/unclosed-fence.md +11 -0
- package/schema/fixtures/policy-md/invalid/wrong-info-string.md +11 -0
- package/schema/fixtures/policy-md/invalid/yaml-syntax-error.md +13 -0
- package/schema/fixtures/policy-md/precedence/both/APPROVAL.md +7 -0
- package/schema/fixtures/policy-md/precedence/both/APPROVALS.md +7 -0
- package/schema/fixtures/policy-md/precedence/fallback-only/APPROVALS.md +7 -0
- package/schema/fixtures/policy-md/valid/canonical.md +50 -0
- package/schema/fixtures/policy-md/valid/daemon-read-proof.md +18 -0
- package/schema/fixtures/policy-md/valid/minimal.md +3 -0
- package/schema/fixtures/policy-md/valid/prose-lookalikes.md +54 -0
- package/schema/fixtures/policy-md/valid/routed-protected-paths.md +49 -0
- package/schema/fixtures/policy-md/valid/with-values.md +79 -0
- package/schema/fixtures/sample-record/invalid/bad-date-time.json +4 -0
- package/schema/fixtures/sample-record/invalid/missing-required-field.json +3 -0
- package/schema/fixtures/sample-record/invalid/unknown-top-level-field.json +5 -0
- package/schema/fixtures/sample-record/invalid/wrong-type.json +4 -0
- package/schema/fixtures/sample-record/valid/minimal.json +4 -0
- package/schema/fixtures/sample-record/valid/with-note.json +5 -0
- package/schema/fixtures/values/invalid/class-shaped.json +9 -0
- package/schema/fixtures/values/invalid/duplicate-entry.json +4 -0
- package/schema/fixtures/values/invalid/non-string-item.json +4 -0
- package/schema/fixtures/values/invalid/over-cap.json +26 -0
- package/schema/fixtures/values/invalid/unknown-key.json +5 -0
- package/schema/fixtures/values/invalid/version-string.json +1 -0
- package/schema/fixtures/values/valid/empty-lists.json +7 -0
- package/schema/fixtures/values/valid/full.json +20 -0
- package/schema/fixtures/values/valid/minimal.json +1 -0
- package/schema/fixtures/values-md/invalid/schema-invalid.md +62 -0
- package/schema/fixtures/values-md/invalid/two-blocks.md +69 -0
- package/schema/fixtures/values-md/invalid/unterminated.md +61 -0
- package/schema/fixtures/values-md/invalid/yaml-error.md +63 -0
- package/schema/fixtures/values-md/valid/absent.md +50 -0
- package/schema/fixtures/values-md/valid/with-values.md +79 -0
- package/schema/policy.schema.json +501 -0
- package/schema/sample-record.schema.json +26 -0
- package/schema/values.schema.json +55 -0
- package/templates/codex/README.md +9 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"web.js","sourceRoot":"","sources":["../../../src/channels/web.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0HG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAIjG,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAqB,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAqB,MAAM,YAAY,CAAC;AAa9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAE7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE7C,yDAAyD;AACzD,MAAM,CAAC,MAAM,YAAY,GACvB,oFAAoF;IACpF,kFAAkF;IAClF,sFAAsF;IACtF,8DAA8D,CAAC;AAEjE,oEAAoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAAG,wBAAwB,CAAC;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAC3B,qIAAqI,CAAC;AACxI,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAC9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AAEpE,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI;SACR,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;SACxB,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED,6EAA6E;AAC7E,SAAS,IAAI,CAAC,SAAiB,EAAE,KAAa;IAC5C,OAAO,IAAI,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,SAAS,cAAc,CAAC,EAAU;IAChC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,KAAK,OAAO,GAAG,EAAE,QAAQ,CAAC;IACxD,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,QAAQ,CAAC;IAC5D,OAAO,GAAG,OAAO,QAAQ,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,QAAyB;IAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACpD,OAAO,QAAQ;SACZ,GAAG,CACF,CAAC,OAAO,EAAE,EAAE,CACV,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,cAAc,OAAO,CAAC,QAAQ,eAAe,OAAO,CAAC,SAAS,eAAe,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,GAAG,CACzK;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,KAAc;IACvD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,KAAK,KAAK,kBAAkB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5F,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,KAAwB,CAAC,CAAC;IAChG,IAAI,KAAK,KAAK,aAAa,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzD,MAAM,MAAM,GAAI,KAAgE,CAAC,MAAM,CAAC;QACxF,MAAM,GAAG,GAAI,KAA2B,CAAC,GAAG,CAAC;QAC7C,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO,gCAAgC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QACjF,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,OAAO,4DAA4D,CAAC;QACtE,CAAC;QACD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/B,OAAO,iEAAiE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACxF,CAAC;QACD,OAAO,gBAAgB,MAAM,CAAE,KAA+B,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,KAA8D,CAAC;QAC7E,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;IACxG,CAAC;IACD,IAAI,KAAK,KAAK,cAAc,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,4DAA4D;AAC5D,SAAS,WAAW,CAAC,KAA2B;IAC9C,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;AACjE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,OAAuB,EAAE,MAAoB;IAClE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAA6C,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAa,MAAM,CAAC,KAAK,CAAC,MAAM,CAC3C,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CACtE,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAyBD,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAC9B,OAAuB,EACvB,MAAM,GAAiB,iBAAiB;IAExC,MAAM,OAAO,GAAG,OAAsE,CAAC;IACvF,MAAM,aAAa,GAAc,EAAE,CAAC;IACpC,MAAM,YAAY,GAAc,EAAE,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,0EAA0E;QAC1E,4EAA4E;QAC5E,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,sBAAsB;QACtB,IAAI,IAAI,KAAK,aAAa;YAAE,SAAS;QACrC,MAAM,IAAI,GAAY;YACpB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;YACpC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;SAC3B,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;YAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACnD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;IAC5C,MAAM,WAAW,GACf,SAAS,KAAK,IAAI;QAChB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,GAAG,aAAa,kBAAkB,SAAS,CAAC,IAAI,OAAO;YACvD,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;YACjD,WAAW;YACX,GAAG,CAAC,SAAS,CAAC,SAAS;gBACrB,CAAC,CAAC,CAAC,iEAAiE,CAAC;gBACrE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnB,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;QACnC,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,YAAY;QACrB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB;QAC5F,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAS,QAAQ,CAAC,SAAuB,EAAE,eAA4B;IACrE,MAAM,MAAM,GAAoB,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3F,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,UAAU,EAAE,SAAS,CAAC,SAAS;QAC/B,MAAM;QACN,eAAe,EAAE,SAAS,CAAC,WAAW;QACtC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6Bb,CAAC;AAEF,qFAAqF;AACrF,MAAM,iBAAiB,GAAG;;;;;;;;CAQzB,CAAC;AAEF,SAAS,QAAQ,CAAC,IAAa;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;IAC3E,OAAO,CACL,2CAA2C,UAAU,CAAC,MAAM,CAAC,UAAU;QACvE,sBAAsB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU;QACtD,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,SAAuB,EAAE,KAAa;IACzD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;IAChC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAa;QACtB,gBAAgB,UAAU,CAAC,EAAE,CAAC,IAAI;QAClC,aAAa,UAAU,CAAC,GAAG,CAAC,cAAc;QAC1C,sDAAsD,UAAU,CAAC,GAAG,CAAC,uDAAuD;QAC5H,OAAO,UAAU,CAAC,gBAAgB,CAAC,OAAO;QAC1C,yBAAyB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ;QAC1E,OAAO,UAAU,CAAC,GAAG,sBAAsB,IAAI,SAAS,CAAC,MAAM,MAAM,sBAAsB,EAAE,CAAC,OAAO;QACrG,wBAAwB,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ;KACzE,CAAC;IAEF,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,gFAAgF,EAChF,wBAAwB,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAClE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,iBAAiB,EACjB,uCAAuC,EACvC,iDAAiD,UAAU,CAAC,GAAG,CAAC,IAAI,EACpE,qDAAqD,EACrD,iEAAiE,EACjE,sCAAsC,EACtC,SAAS,EACT,uCAAuC,EACvC,iDAAiD,UAAU,CAAC,GAAG,CAAC,IAAI,EACpE,sDAAsD,EACtD,oFAAoF,EACpF,uCAAuC,EACvC,SAAS,EACT,YAAY,CACb,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,IAAY;IACvC,OAAO;QACL,iBAAiB;QACjB,8CAA8C;QAC9C,sEAAsE;QACtE,UAAU,UAAU,CAAC,KAAK,CAAC,UAAU;QACrC,UAAU,KAAK,UAAU;QACzB,eAAe;QACf,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO;QAC/B,uBAAuB,UAAU,CAAC,YAAY,CAAC,QAAQ;QACvD,IAAI;QACJ,WAAW,iBAAiB,WAAW;QACvC,gBAAgB;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAAC,UAAyB;IAC1C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,sDAAsD,UAAU,CAAC,UAAU,CAAC,2FAA2F,CAAC;AACjL,CAAC;AA4FD,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,OAAO,UAAU;IACZ,IAAI,CAAS;IAEL,cAAc,CAAS;IACvB,OAAO,CAAkC;IACzC,MAAM,CAA2B;IACjC,UAAU,CAAgB;IAC1B,QAAQ,CAA4B;IAE7C,OAAO,GAA4D,IAAI,CAAC;IACxE,YAAY,GAA2B,IAAI,CAAC;IAEpD,2EAA2E;IAC1D,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1D,6CAA6C;IACrC,OAAO,GAAqB,EAAE,CAAC;IAC/B,QAAQ,GAAsB,EAAE,CAAC;IAEjC,UAAU,GAAkB,IAAI,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC;IACH,QAAQ,GAAa,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1F,wFAAwF;IACvE,MAAM,CAAe;IAEtC,YAAY,OAAO,GAAsB,EAAE;QACzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QAC7C,IAAI,CAAC,QAAQ;YACX,OAAO,CAAC,GAAG;gBACX,CAAC,CAAC,OAAe,EAAE,EAAE;oBACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;gBACvC,CAAC,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAE5E;;;;;;;OAOG;IACH,MAAM,CAAC,MAAqC;QAC1C,MAAM,OAAO,GAAG,UAAU,IAAI,MAAM,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QAEjF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE;gBAC3C,UAAU;gBACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAClF,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,UAAU,CAAC,OAAuD;QAChE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,oFAAoF;IACpF,eAAe,CAAC,OAAwB;QACtC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;IAC9B,CAAC;IAED,MAAM;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;QACzF,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EACJ,uBAAuB,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,qBAAqB;gBAC3E,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,kBAAkB,IAAI,CAAC,QAAQ,CAAC,QAAQ,yBAAyB;gBACvF,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,kBAAkB;SACrF,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK;QACH,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,qEAAqE;IACrE,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC;QACnD,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,CAAC;IAED,kEAAkE;IAClE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC;IACrD,CAAC;IAED,yEAAyE;IACzE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM;QACR,OAAO,UAAU,iBAAiB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAE5E;;;;;OAKG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC3D,IAAI,CAAC,QAAQ,CACX,qDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;oBAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC,CAAC;gBACjF,CAAC;;oBAAM,QAAQ,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QAEzB,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAClD,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE;gBACrC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7B,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,GAAG,EAAE;gBACzD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/B,IAAI,OAAO,KAAK,IAAI;oBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;;oBACvE,OAAO,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,+CAA+C;IAC/C,KAAK;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAC/B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAEpE,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,QAAwB;QACrE,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,aAAa,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,eAAe,CAAC,EAAE,CAAC;YAClF,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC3B,IAAI,CAAC,QAAQ,CAAC,sDAAsD,MAAM,GAAG,CAAC,CAAC;gBAC/E,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CACF,uBAAuB,EACvB,sBAAsB,UAAU,CAC9B,gCAAgC,MAAM,qJAAqJ,CAC5L,QAAQ,CACV,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,uBAAuB,EAAE,sBAAsB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CACtF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;;gBACrD,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,kCAAkC,EAAE,qBAAqB,CAAC,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,yBAAyB,EAAE,6CAA6C,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED;;;;;;;;;OASG;IACK,WAAW,CAAC,OAAwB;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,SAAS,GACb,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,MAAM;YAClE,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBACjD,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,IAAI,CAAC;QACb,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEpC,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAC9E,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACnE,CAAC;IAEO,QAAQ,CACd,OAAwB;QAExB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,MAAmE,EAAQ,EAAE;gBAC3F,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACnC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;oBAC9B,MAAM,CAAC;wBACL,EAAE,EAAE,KAAK;wBACT,OAAO,EAAE,qBAAqB,kBAAkB,8BAA8B;qBAC/E,CAAC,CAAC;oBACH,OAAO,CAAC,OAAO,EAAE,CAAC;oBAClB,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5F,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,CACnC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAChF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,sEAAsE;IAC9D,eAAe;QACrB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;YACrC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACK,SAAS,CAAC,KAAc,EAAE,MAAe;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC,CAC/E,CAAC;QAEF,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,sBAAsB,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpF,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,uBAAuB,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAEtC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC,iCAAiC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,CACP,MAAM,UAAU,CAAC,MAAM,gEAAgE,UAAU,CAAC,eAAe,CAAC,gCAAgC,UAAU,CAAC,cAAc,CAAC,kEAAkE,CAC/O,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,CACP,yDAAyD,EACzD,yIAAyI,EACzI,mHAAmH,EACnH,6DAA6D,EAC7D,2EAA2E,EAC3E,8EAA8E,EAC9E,+EAA+E,EAC/E,SAAS,CACV,CAAC;QAEF,OAAO,IAAI,CAAC,iCAAiC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,4EAA4E;IAC5E,YAAY;IACZ,4EAA4E;IAEpE,KAAK,CAAC,MAAM,CAAC,IAAqB,EAAE,QAAwB;QAClE,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,SAAS,CACZ,8GAA8G,CAC/G,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,YAAY;QACZ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,SAAS,CACZ,gCAAgC,SAAS,+FAA+F,CACzI,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,SAAS,CACZ,GAAG,SAAS,gGAAgG,CAC7G,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,SAAS,CACZ,iJAAiJ,CAClJ,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAoB;YAChC,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,uEAAuE;YACvE,qEAAqE;YACrE,8CAA8C;YAC9C,GAAG,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;QAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAqB,EAAE,QAAwB;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE5F,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,gEAAgE,CAAC,CACjF,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,iFAAiF,CAAC,CAClG,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,SAAS,CACZ,8GAA8G,CAC/G,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;YACzE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,SAAS,CACZ,GAAG,GAAG,4GAA4G,CACnH,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAED,2EAA2E;QAC3E,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3B,MAAM,OAAO,GAAiB,SAAS,CAAC;YACxC,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,wBAAwB,CAAC,CAC5E,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,MAAM,eAAe,GAAG,aAAa,IAAI,CAAC,OAAO,EAAE,CAAC;QACpD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE;gBAC5C,UAAU,EAAE,eAAe;gBAC3B,eAAe;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAsB,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC9D,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;YACpC,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,eAAe;YAC3B,eAAe;YACf,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC,CAAC,CAAC;QAEJ,MAAM,OAAO,GACX,EAAE,CAAC;QAEL,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACrE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAC/E,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAClC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI,CACP,QAAQ,EACR,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,8EAA8E,CAAC,CAC/F,CAAC;gBACF,OAAO;YACT,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ;oBACR,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;iBAC7E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAClF,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CACjB,OAAuF,EACvF,eAA4B;QAE5B,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CACP,kBAAkB,UAAU,CAAC,eAAe,CAAC,aAAa,OAAO,CAAC,MAAM,qCAAqC,CAC9G,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;YACpC,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CACP,cAAc,UAAU,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,mBAAmB,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAC5M,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CACP,oCAAoC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CACjJ,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,CACP,0KAA0K,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAC/M,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,iCAAiC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAEO,IAAI,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAY;QACjE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;YACzB,cAAc,EAAE,0BAA0B;YAC1C,uEAAuE;YACvE,gDAAgD;YAChD,eAAe,EAAE,8CAA8C;YAC/D,iBAAiB,EAAE,aAAa;YAChC,wBAAwB,EAAE,SAAS;YACnC,yEAAyE;YACzE,wEAAwE;YACxE,yBAAyB,EACvB,gHAAgH;SACnH,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;CACF"}
|
|
@@ -0,0 +1,90 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* `approval adapter <name>` — execute an action through the adapter
|
|
3
|
+
* contract (SPEC.md §10.4; APRV-69, generalized in APRV-221).
|
|
4
|
+
*
|
|
5
|
+
* This is the CLI face of the adapters in {@link ADAPTER_CLIS} (`email` at
|
|
6
|
+
* v0.1), and it is deliberately the thinnest one in the repository. The name is
|
|
7
|
+
* a table lookup and the body below it is adapter-agnostic: a second adapter is
|
|
8
|
+
* an entry in the table and nothing else in this file.
|
|
9
|
+
*
|
|
10
|
+
* It resolves paths and identity, reads the
|
|
11
|
+
* payload bytes at the edge, builds the vault-backed credential provider, calls
|
|
12
|
+
* {@link executeThroughAdapter} once, and maps the result onto the frozen exit
|
|
13
|
+
* table. It does not verify a token, hash a payload, append an event, or open a
|
|
14
|
+
* socket: every one of those belongs to a layer that already owns it, and a verb
|
|
15
|
+
* that reimplemented any of them would be a second implementation of the rule.
|
|
16
|
+
*
|
|
17
|
+
* **Why the payload is a file (or stdin) and never a flag.** The bytes are the
|
|
18
|
+
* thing the grant or registered declaration bound, they routinely contain newlines, quotes and a
|
|
19
|
+
* £-sign, and a message body on a command line is a message body in the shell
|
|
20
|
+
* history and in `ps` output. `approval payload hash <file|->` and
|
|
21
|
+
* `approval request --payload <file>` take the same argument in the same form,
|
|
22
|
+
* so the same file travels from declaration to request to execution.
|
|
23
|
+
*
|
|
24
|
+
* **What `--json` prints is the contract's own result shape**, unmodified:
|
|
25
|
+
* `AdapterExecuteSuccess` on stdout for a completed send,
|
|
26
|
+
* `AdapterRefusal` on stderr for anything else. There is no CLI-flavoured
|
|
27
|
+
* summary, because a caller parsing this is a caller who wants to know
|
|
28
|
+
* `started_seq`, `outcome_seq` and `adapter_code` — and inventing a second
|
|
29
|
+
* vocabulary for them here would be a second thing to keep in step with
|
|
30
|
+
* `contract.ts`.
|
|
31
|
+
*
|
|
32
|
+
* ## Exit codes
|
|
33
|
+
*
|
|
34
|
+
* The `approval run` table, unchanged and shared with it through
|
|
35
|
+
* {@link executeRefusalExitCode}:
|
|
36
|
+
*
|
|
37
|
+
* | Situation | Code |
|
|
38
|
+
* |---|---|
|
|
39
|
+
* | the message was accepted by the far side | 0 |
|
|
40
|
+
* | usage: a missing required flag, a bad identity, an unparseable payload | 2 |
|
|
41
|
+
* | I/O: the payload file or the log could not be read | 4 |
|
|
42
|
+
* | `token-required` — no token was presented | 5 |
|
|
43
|
+
* | `log-torn-tail`, or an append that hit a torn tail | 3 |
|
|
44
|
+
* | anything else the runtime decided: `token-mismatch`, `token-consumed`, `payload-mismatch`, `adapter-class-mismatch`, `adapter-precheck-refused` (a drifted draft), `adapter-failed` (an SMTP refusal), `adapter-act-threw` | 1 |
|
|
45
|
+
*
|
|
46
|
+
* A refused SEND is exit 1 and not 5: the command was well-formed and the
|
|
47
|
+
* answer from the world was no. Exit 5 is the manual-path redirection to obtain
|
|
48
|
+
* a grant token, which is the distinction `run` already draws and the one an
|
|
49
|
+
* agent's retry logic keys on.
|
|
50
|
+
*/
|
|
51
|
+
import { type Adapter } from "../adapters/contract.js";
|
|
52
|
+
import type { Streams } from "./main.js";
|
|
53
|
+
/** One adapter, as `approval adapter <name>` needs to see it. */
|
|
54
|
+
export interface AdapterCliEntry {
|
|
55
|
+
/** The verb's own help: printed for --help, and beside every usage error. */
|
|
56
|
+
help: string;
|
|
57
|
+
/**
|
|
58
|
+
* The adapter instance to execute through, built per invocation because
|
|
59
|
+
* `--timeout` is per invocation. Nothing else about the adapter is this
|
|
60
|
+
* verb's business: the contract routes, hashes, spends and appends.
|
|
61
|
+
*/
|
|
62
|
+
build(options: {
|
|
63
|
+
timeoutMs?: number;
|
|
64
|
+
}): Adapter;
|
|
65
|
+
}
|
|
66
|
+
/**
|
|
67
|
+
* Every adapter this verb can execute, keyed by the `adapter <name>` name.
|
|
68
|
+
*
|
|
69
|
+
* The table IS the dispatch (APRV-221): a second adapter is a second entry
|
|
70
|
+
* here, and no line below this one names an adapter. `cli/setup-adapter.ts`
|
|
71
|
+
* holds the matching table for the credential side and `adapters/registry.ts`
|
|
72
|
+
* the roster the credential scrub reads. An adapter that ships is an entry in
|
|
73
|
+
* all three, which is three small tables rather than one import cycle between
|
|
74
|
+
* the CLI and the adapters.
|
|
75
|
+
*/
|
|
76
|
+
export declare const ADAPTER_CLIS: Record<string, AdapterCliEntry>;
|
|
77
|
+
/** The known names, sorted, for a usage error and for the help text. */
|
|
78
|
+
export declare function knownAdapterNames(): string[];
|
|
79
|
+
/**
|
|
80
|
+
* `approval adapter <name> <action-key> [--token <t>] --payload <file|->`.
|
|
81
|
+
*
|
|
82
|
+
* One implementation for every entry in {@link ADAPTER_CLIS}: the name and the
|
|
83
|
+
* entry are arguments, and everything this function does (the flags, the
|
|
84
|
+
* payload read, the identity check, the vault, the exit table) is the same
|
|
85
|
+
* whichever adapter is on the other end. What differs between adapters is the
|
|
86
|
+
* contract's business, and the contract is not here.
|
|
87
|
+
*/
|
|
88
|
+
export declare function commandAdapterExecute(name: string, entry: AdapterCliEntry, argv: string[], streams: Streams, cwd: string): Promise<number>;
|
|
89
|
+
/** `approval adapter <name>` — resolve the name through {@link ADAPTER_CLIS}. */
|
|
90
|
+
export declare function commandAdapter(argv: string[], streams: Streams, cwd: string): Promise<number>;
|
|
@@ -0,0 +1,288 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* `approval adapter <name>` — execute an action through the adapter
|
|
3
|
+
* contract (SPEC.md §10.4; APRV-69, generalized in APRV-221).
|
|
4
|
+
*
|
|
5
|
+
* This is the CLI face of the adapters in {@link ADAPTER_CLIS} (`email` at
|
|
6
|
+
* v0.1), and it is deliberately the thinnest one in the repository. The name is
|
|
7
|
+
* a table lookup and the body below it is adapter-agnostic: a second adapter is
|
|
8
|
+
* an entry in the table and nothing else in this file.
|
|
9
|
+
*
|
|
10
|
+
* It resolves paths and identity, reads the
|
|
11
|
+
* payload bytes at the edge, builds the vault-backed credential provider, calls
|
|
12
|
+
* {@link executeThroughAdapter} once, and maps the result onto the frozen exit
|
|
13
|
+
* table. It does not verify a token, hash a payload, append an event, or open a
|
|
14
|
+
* socket: every one of those belongs to a layer that already owns it, and a verb
|
|
15
|
+
* that reimplemented any of them would be a second implementation of the rule.
|
|
16
|
+
*
|
|
17
|
+
* **Why the payload is a file (or stdin) and never a flag.** The bytes are the
|
|
18
|
+
* thing the grant or registered declaration bound, they routinely contain newlines, quotes and a
|
|
19
|
+
* £-sign, and a message body on a command line is a message body in the shell
|
|
20
|
+
* history and in `ps` output. `approval payload hash <file|->` and
|
|
21
|
+
* `approval request --payload <file>` take the same argument in the same form,
|
|
22
|
+
* so the same file travels from declaration to request to execution.
|
|
23
|
+
*
|
|
24
|
+
* **What `--json` prints is the contract's own result shape**, unmodified:
|
|
25
|
+
* `AdapterExecuteSuccess` on stdout for a completed send,
|
|
26
|
+
* `AdapterRefusal` on stderr for anything else. There is no CLI-flavoured
|
|
27
|
+
* summary, because a caller parsing this is a caller who wants to know
|
|
28
|
+
* `started_seq`, `outcome_seq` and `adapter_code` — and inventing a second
|
|
29
|
+
* vocabulary for them here would be a second thing to keep in step with
|
|
30
|
+
* `contract.ts`.
|
|
31
|
+
*
|
|
32
|
+
* ## Exit codes
|
|
33
|
+
*
|
|
34
|
+
* The `approval run` table, unchanged and shared with it through
|
|
35
|
+
* {@link executeRefusalExitCode}:
|
|
36
|
+
*
|
|
37
|
+
* | Situation | Code |
|
|
38
|
+
* |---|---|
|
|
39
|
+
* | the message was accepted by the far side | 0 |
|
|
40
|
+
* | usage: a missing required flag, a bad identity, an unparseable payload | 2 |
|
|
41
|
+
* | I/O: the payload file or the log could not be read | 4 |
|
|
42
|
+
* | `token-required` — no token was presented | 5 |
|
|
43
|
+
* | `log-torn-tail`, or an append that hit a torn tail | 3 |
|
|
44
|
+
* | anything else the runtime decided: `token-mismatch`, `token-consumed`, `payload-mismatch`, `adapter-class-mismatch`, `adapter-precheck-refused` (a drifted draft), `adapter-failed` (an SMTP refusal), `adapter-act-threw` | 1 |
|
|
45
|
+
*
|
|
46
|
+
* A refused SEND is exit 1 and not 5: the command was well-formed and the
|
|
47
|
+
* answer from the world was no. Exit 5 is the manual-path redirection to obtain
|
|
48
|
+
* a grant token, which is the distinction `run` already draws and the one an
|
|
49
|
+
* agent's retry logic keys on.
|
|
50
|
+
*/
|
|
51
|
+
import { readFileSync } from "node:fs";
|
|
52
|
+
import { isAbsolute, resolve as resolvePathSegments } from "node:path";
|
|
53
|
+
import { agentmailAdapter } from "../adapters/agentmail.js";
|
|
54
|
+
import { emailAdapter } from "../adapters/email.js";
|
|
55
|
+
import { zzzAdapter } from "../adapters/zzz.js";
|
|
56
|
+
import { vaultCredentialProvider } from "../adapters/vault-provider.js";
|
|
57
|
+
import { executeThroughAdapter, } from "../adapters/contract.js";
|
|
58
|
+
import { HUMAN_ACTOR_ENV, resolveHumanActor } from "../core/attest.js";
|
|
59
|
+
import { loadPolicy } from "../core/policy-load.js";
|
|
60
|
+
import { envFilePathFor } from "../core/env-file.js";
|
|
61
|
+
import { passphraseEnvFor, vaultPathFor } from "../core/vault.js";
|
|
62
|
+
import { boolFlag, parseFlags, stringFlag } from "./args.js";
|
|
63
|
+
import { EXIT_INTEGRITY, EXIT_IO, EXIT_OK, EXIT_USAGE } from "./exit-codes.js";
|
|
64
|
+
import { executeRefusalExitCode } from "./execute.js";
|
|
65
|
+
import { ADAPTER_AGENTMAIL_HELP, ADAPTER_EMAIL_HELP, ADAPTER_HELP, ADAPTER_ZZZ_HELP } from "./help.js";
|
|
66
|
+
import { DEFAULT_LOG_PATH, resolvePath } from "./paths.js";
|
|
67
|
+
import { refusal as renderRefusal, style } from "./style.js";
|
|
68
|
+
import { usageErrorText } from "./usage.js";
|
|
69
|
+
/**
|
|
70
|
+
* Every adapter this verb can execute, keyed by the `adapter <name>` name.
|
|
71
|
+
*
|
|
72
|
+
* The table IS the dispatch (APRV-221): a second adapter is a second entry
|
|
73
|
+
* here, and no line below this one names an adapter. `cli/setup-adapter.ts`
|
|
74
|
+
* holds the matching table for the credential side and `adapters/registry.ts`
|
|
75
|
+
* the roster the credential scrub reads. An adapter that ships is an entry in
|
|
76
|
+
* all three, which is three small tables rather than one import cycle between
|
|
77
|
+
* the CLI and the adapters.
|
|
78
|
+
*/
|
|
79
|
+
export const ADAPTER_CLIS = {
|
|
80
|
+
email: {
|
|
81
|
+
help: ADAPTER_EMAIL_HELP,
|
|
82
|
+
build: (options) => emailAdapter(options),
|
|
83
|
+
},
|
|
84
|
+
agentmail: {
|
|
85
|
+
help: ADAPTER_AGENTMAIL_HELP,
|
|
86
|
+
build: (options) => agentmailAdapter(options),
|
|
87
|
+
},
|
|
88
|
+
zzz: {
|
|
89
|
+
help: ADAPTER_ZZZ_HELP,
|
|
90
|
+
build: (options) => zzzAdapter(options),
|
|
91
|
+
},
|
|
92
|
+
};
|
|
93
|
+
/** The known names, sorted, for a usage error and for the help text. */
|
|
94
|
+
export function knownAdapterNames() {
|
|
95
|
+
return Object.keys(ADAPTER_CLIS).sort();
|
|
96
|
+
}
|
|
97
|
+
/** Identity accepted here: a person or an agent, never the runtime. */
|
|
98
|
+
const PRINCIPAL_ACTOR = /^(human|agent):.+/u;
|
|
99
|
+
/**
|
|
100
|
+
* The flags every adapter verb takes. One set and not one per adapter: what the
|
|
101
|
+
* runtime needs in order to execute an action (the optional token, the bytes,
|
|
102
|
+
* the identity, the log, the vault) is the same question whoever answers it,
|
|
103
|
+
* and a per-adapter flag table would be a per-adapter way to drift from
|
|
104
|
+
* `approval run`. An adapter with a flag of its own adds it here, beside these.
|
|
105
|
+
*/
|
|
106
|
+
const ADAPTER_FLAGS = {
|
|
107
|
+
"--token": "string",
|
|
108
|
+
"--payload": "string",
|
|
109
|
+
"--as": "string",
|
|
110
|
+
"--vault": "string",
|
|
111
|
+
"--policy": "string",
|
|
112
|
+
"--dir": "string",
|
|
113
|
+
"--log": "string",
|
|
114
|
+
"--timeout": "string",
|
|
115
|
+
"--json": "boolean",
|
|
116
|
+
"--help": "boolean",
|
|
117
|
+
"-h": "boolean",
|
|
118
|
+
};
|
|
119
|
+
function absolute(value, cwd) {
|
|
120
|
+
return isAbsolute(value) ? value : resolvePathSegments(cwd, value);
|
|
121
|
+
}
|
|
122
|
+
function usageError(streams, json, message, helpText) {
|
|
123
|
+
if (json)
|
|
124
|
+
streams.err(`${JSON.stringify({ error: { code: "usage", message } })}\n`);
|
|
125
|
+
else
|
|
126
|
+
streams.err(usageErrorText(message, helpText));
|
|
127
|
+
return EXIT_USAGE;
|
|
128
|
+
}
|
|
129
|
+
function ioError(streams, json, message) {
|
|
130
|
+
if (json)
|
|
131
|
+
streams.err(`${JSON.stringify({ error: { code: "io", message } })}\n`);
|
|
132
|
+
else
|
|
133
|
+
streams.err(`approval: ${message}\n`);
|
|
134
|
+
return EXIT_IO;
|
|
135
|
+
}
|
|
136
|
+
function detail(cause) {
|
|
137
|
+
return cause instanceof Error ? cause.message : String(cause);
|
|
138
|
+
}
|
|
139
|
+
/**
|
|
140
|
+
* A refusal from the adapter path onto the exit table.
|
|
141
|
+
*
|
|
142
|
+
* Core refusals carry their own `execute` record and are mapped exactly as
|
|
143
|
+
* `approval run` maps them, through the shared function. The adapter path's own
|
|
144
|
+
* additions — a misroute, an unhashable payload, a failed or throwing `act` —
|
|
145
|
+
* are all exit 1: the command was well-formed and the answer is no.
|
|
146
|
+
*/
|
|
147
|
+
function refusalExit(result) {
|
|
148
|
+
return result.execute === undefined ? EXIT_INTEGRITY : executeRefusalExitCode(result.execute);
|
|
149
|
+
}
|
|
150
|
+
/**
|
|
151
|
+
* `approval adapter <name> <action-key> [--token <t>] --payload <file|->`.
|
|
152
|
+
*
|
|
153
|
+
* One implementation for every entry in {@link ADAPTER_CLIS}: the name and the
|
|
154
|
+
* entry are arguments, and everything this function does (the flags, the
|
|
155
|
+
* payload read, the identity check, the vault, the exit table) is the same
|
|
156
|
+
* whichever adapter is on the other end. What differs between adapters is the
|
|
157
|
+
* contract's business, and the contract is not here.
|
|
158
|
+
*/
|
|
159
|
+
export async function commandAdapterExecute(name, entry, argv, streams, cwd) {
|
|
160
|
+
const help = entry.help;
|
|
161
|
+
const json = argv.includes("--json");
|
|
162
|
+
const parsed = parseFlags(argv, ADAPTER_FLAGS);
|
|
163
|
+
if (!parsed.ok)
|
|
164
|
+
return usageError(streams, json, parsed.message, help);
|
|
165
|
+
if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
|
|
166
|
+
streams.out(`${help}\n`);
|
|
167
|
+
return EXIT_OK;
|
|
168
|
+
}
|
|
169
|
+
const { flags, positionals } = parsed;
|
|
170
|
+
const actionKey = positionals[0];
|
|
171
|
+
if (actionKey === undefined) {
|
|
172
|
+
return usageError(streams, json, "missing <action-key> argument", help);
|
|
173
|
+
}
|
|
174
|
+
const extra = positionals[1];
|
|
175
|
+
if (extra !== undefined) {
|
|
176
|
+
return usageError(streams, json, `unexpected argument ${JSON.stringify(extra)}`, help);
|
|
177
|
+
}
|
|
178
|
+
// Optional for the same reason it is optional on `approval run`: the core
|
|
179
|
+
// admits an explicitly policy-authorized supervised/autonomous execution
|
|
180
|
+
// without minting a grant. Manual and selected-live paths still reach
|
|
181
|
+
// `startExecution` and refuse `token-required`; this CLI never invents one.
|
|
182
|
+
const token = stringFlag(flags, "--token");
|
|
183
|
+
const payloadFlag = stringFlag(flags, "--payload");
|
|
184
|
+
if (payloadFlag === null) {
|
|
185
|
+
return usageError(streams, json, "missing --payload <file|->: the bytes the grant or registered declaration bound. There is no flag that takes the message inline — a body on a command line is a body in the shell history", help);
|
|
186
|
+
}
|
|
187
|
+
const asFlag = stringFlag(flags, "--as");
|
|
188
|
+
const actor = asFlag === null ? resolveHumanActor() : asFlag;
|
|
189
|
+
if (actor === null || !PRINCIPAL_ACTOR.test(actor)) {
|
|
190
|
+
return usageError(streams, json, asFlag === null
|
|
191
|
+
? `no identity: set ${HUMAN_ACTOR_ENV}=human:<id> or pass --as human:<id> | agent:<id>`
|
|
192
|
+
: `--as expects human:<id> or agent:<id>, got ${JSON.stringify(asFlag)}`, help);
|
|
193
|
+
}
|
|
194
|
+
const timeoutFlag = stringFlag(flags, "--timeout");
|
|
195
|
+
let timeoutMs = null;
|
|
196
|
+
if (timeoutFlag !== null) {
|
|
197
|
+
const parsedTimeout = Number(timeoutFlag);
|
|
198
|
+
if (!Number.isInteger(parsedTimeout) || parsedTimeout <= 0) {
|
|
199
|
+
return usageError(streams, json, `--timeout expects a whole number of milliseconds, got ${JSON.stringify(timeoutFlag)}`, help);
|
|
200
|
+
}
|
|
201
|
+
timeoutMs = parsedTimeout;
|
|
202
|
+
}
|
|
203
|
+
// The payload bytes. Read at the edge, parsed here, and handed to the
|
|
204
|
+
// contract as a value — the contract hashes it, and nobody states a hash.
|
|
205
|
+
const where = payloadFlag === "-" ? "stdin" : absolute(payloadFlag, cwd);
|
|
206
|
+
let raw;
|
|
207
|
+
try {
|
|
208
|
+
raw = readFileSync(payloadFlag === "-" ? 0 : where, "utf8");
|
|
209
|
+
}
|
|
210
|
+
catch (cause) {
|
|
211
|
+
return ioError(streams, json, `${where} could not be read: ${detail(cause)}`);
|
|
212
|
+
}
|
|
213
|
+
if (raw.trim().length === 0) {
|
|
214
|
+
return usageError(streams, json, `${where} is empty; there is no payload`, help);
|
|
215
|
+
}
|
|
216
|
+
let payload;
|
|
217
|
+
try {
|
|
218
|
+
payload = JSON.parse(raw);
|
|
219
|
+
}
|
|
220
|
+
catch (cause) {
|
|
221
|
+
return usageError(streams, json, `${where} is not valid JSON: ${detail(cause)}. payload_hash is defined over the RFC 8785 canonical serialization of the payload VALUE, so bytes that do not parse cannot be the bytes a grant bound to`, help);
|
|
222
|
+
}
|
|
223
|
+
const logPath = resolvePath(stringFlag(flags, "--log"), DEFAULT_LOG_PATH, cwd);
|
|
224
|
+
const policyFlag = stringFlag(flags, "--policy");
|
|
225
|
+
const dirFlag = stringFlag(flags, "--dir");
|
|
226
|
+
const policyLocation = policyFlag !== null
|
|
227
|
+
? { file: absolute(policyFlag, cwd) }
|
|
228
|
+
: { dir: dirFlag === null ? cwd : absolute(dirFlag, cwd) };
|
|
229
|
+
const vaultFlag = stringFlag(flags, "--vault");
|
|
230
|
+
const vaultPath = vaultFlag === null ? vaultPathFor(logPath) : absolute(vaultFlag, cwd);
|
|
231
|
+
const credentials = vaultCredentialProvider({ vaultPath }, {
|
|
232
|
+
passphraseEnv: passphraseEnvFor(loadPolicy(policyLocation)),
|
|
233
|
+
// APRV-168. This verb executes through the adapter contract, so its
|
|
234
|
+
// credential reads happen inside a window a human's grant opened. That is
|
|
235
|
+
// the one place the environment source map may answer for the vault
|
|
236
|
+
// passphrase when the process was launched without it; see
|
|
237
|
+
// `adapters/env-passphrase.ts`. The provider still prefers the ambient
|
|
238
|
+
// variable, and every other caller of `vaultCredentialProvider` omits
|
|
239
|
+
// this and keeps the old behaviour exactly.
|
|
240
|
+
envFilePath: envFilePathFor(logPath),
|
|
241
|
+
});
|
|
242
|
+
const result = await executeThroughAdapter(entry.build(timeoutMs === null ? {} : { timeoutMs }), { logPath, actionKey, payload, actor }, {
|
|
243
|
+
...(token === null ? {} : { token }),
|
|
244
|
+
policy: policyLocation,
|
|
245
|
+
credentials,
|
|
246
|
+
});
|
|
247
|
+
if (!result.ok) {
|
|
248
|
+
if (json)
|
|
249
|
+
streams.err(`${JSON.stringify(result)}\n`);
|
|
250
|
+
else {
|
|
251
|
+
streams.err(
|
|
252
|
+
// APRV-102: the one refusal shape. The adapter's own code, when it has
|
|
253
|
+
// one, rides in the machine-readable column beside the runtime's, since
|
|
254
|
+
// that pair is what an operator reports and an agent branches on.
|
|
255
|
+
`${renderRefusal(style({ json }), `${result.code}${result.adapter_code === undefined ? "" : ` (${result.adapter_code})`}`, result.message)}\n`);
|
|
256
|
+
}
|
|
257
|
+
return refusalExit(result);
|
|
258
|
+
}
|
|
259
|
+
if (json)
|
|
260
|
+
streams.out(`${JSON.stringify(result)}\n`);
|
|
261
|
+
else {
|
|
262
|
+
streams.out(`sent ${actionKey} through the ${name} adapter: execution.started at seq ${String(result.started_seq)}, execution.completed at seq ${String(result.outcome_seq)}\n`);
|
|
263
|
+
}
|
|
264
|
+
return EXIT_OK;
|
|
265
|
+
}
|
|
266
|
+
/** `approval adapter <name>` — resolve the name through {@link ADAPTER_CLIS}. */
|
|
267
|
+
export async function commandAdapter(argv, streams, cwd) {
|
|
268
|
+
const sub = argv[0];
|
|
269
|
+
const rest = argv.slice(1);
|
|
270
|
+
const json = argv.includes("--json");
|
|
271
|
+
if (sub === undefined) {
|
|
272
|
+
return usageError(streams, json, "missing adapter name for `approval adapter`", ADAPTER_HELP);
|
|
273
|
+
}
|
|
274
|
+
if (sub === "--help" || sub === "-h" || sub === "help") {
|
|
275
|
+
streams.out(`${ADAPTER_HELP}\n`);
|
|
276
|
+
return EXIT_OK;
|
|
277
|
+
}
|
|
278
|
+
// Own keys only (APRV-223). A plain object inherits `Object.prototype`, so
|
|
279
|
+
// `ADAPTER_CLIS["constructor"]` is a function and a truthiness check would
|
|
280
|
+
// dispatch `approval adapter constructor` as though an adapter by that name
|
|
281
|
+
// had been registered. The table is the dispatch, and the table is what this
|
|
282
|
+
// asks — an adapter nobody wrote is an unknown adapter.
|
|
283
|
+
const entry = Object.hasOwn(ADAPTER_CLIS, sub) ? ADAPTER_CLIS[sub] : undefined;
|
|
284
|
+
if (entry !== undefined)
|
|
285
|
+
return commandAdapterExecute(sub, entry, rest, streams, cwd);
|
|
286
|
+
return usageError(streams, json, `unknown adapter ${JSON.stringify(sub)} for \`approval adapter\`; known adapters: ${knownAdapterNames().join(", ")}`, ADAPTER_HELP);
|
|
287
|
+
}
|
|
288
|
+
//# sourceMappingURL=adapter.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../src/cli/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EACL,qBAAqB,GAItB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEvG,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkB5C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAoC;IAC3D,KAAK,EAAE;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC;KAC1C;IACD,SAAS,EAAE;QACT,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC;KAC9C;IACD,GAAG,EAAE;QACH,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;KACxC;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,uEAAuE;AACvE,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,aAAa,GAA6B;IAC9C,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,QAAQ;IACrB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ;IACjB,WAAW,EAAE,QAAQ;IACrB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe,EAAE,QAAgB;IACpF,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAC/D,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC5E,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,MAA4C;IAC/D,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,KAAsB,EACtB,IAAc,EACd,OAAgB,EAChB,GAAW;IAEX,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAEtC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAC9C,IAAI,CACL,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAE3C,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,2LAA2L,EAC3L,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,oBAAoB,eAAe,kDAAkD;YACvF,CAAC,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAC1E,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YAC3D,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,yDAAyD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EACtF,IAAI,CACL,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,aAAa,CAAC;IAC5B,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,gCAAgC,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAkB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,GAAG,KAAK,uBAAuB,MAAM,CAAC,KAAK,CAAC,2JAA2J,EACvM,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,cAAc,GAClB,UAAU,KAAK,IAAI;QACjB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE;QACrC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAE/D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,uBAAuB,CACzC,EAAE,SAAS,EAAE,EACb;QACE,aAAa,EAAE,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3D,oEAAoE;QACpE,0EAA0E;QAC1E,oEAAoE;QACpE,2DAA2D;QAC3D,uEAAuE;QACvE,sEAAsE;QACtE,4CAA4C;QAC5C,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC;KACrC,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EACpD,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,EACtC;QACE,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACpC,MAAM,EAAE,cAAc;QACtB,WAAW;KACZ,CACF,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAChD,CAAC;YACJ,OAAO,CAAC,GAAG;YACT,uEAAuE;YACvE,wEAAwE;YACxE,kEAAkE;YAClE,GAAG,aAAa,CACd,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,EACf,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,YAAY,GAAG,EAAE,EACvF,MAAM,CAAC,OAAO,CACf,IAAI,CACN,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SAChD,CAAC;QACJ,OAAO,CAAC,GAAG,CACT,QAAQ,SAAS,gBAAgB,IAAI,sCAAsC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,gCAAgC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CACpK,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAc,EACd,OAAgB,EAChB,GAAW;IAEX,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAErC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,6CAA6C,EAAE,YAAY,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,mBAAmB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,8CAA8C,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACpH,YAAY,CACb,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* `approval policy amend` (APRV-30) — the one verb that owns the whole
|
|
3
|
+
* amendment ceremony: diff, advise, confirm, attest, commit.
|
|
4
|
+
*
|
|
5
|
+
* ## The two incidents this verb exists to prevent
|
|
6
|
+
*
|
|
7
|
+
* **seq 2 of this repository's own log — the seven-minute amendment.** A
|
|
8
|
+
* policy edit was attested and superseded seven minutes later (seq 2 at
|
|
9
|
+
* 11:56:07Z, seq 3 at 12:03:35Z), because the
|
|
10
|
+
* edit broke a pinned dogfood assertion and nobody found out until the test
|
|
11
|
+
* suite ran. The operator attested bytes whose *consequences* had never been
|
|
12
|
+
* shown to them. `amend` shows the semantic diff and the load advisory BEFORE
|
|
13
|
+
* asking for the sign-off, so the failure that superseded seq 2 would have been
|
|
14
|
+
* on screen while the human was deciding — and with `--require-load` it would
|
|
15
|
+
* have refused to attest at all.
|
|
16
|
+
*
|
|
17
|
+
* **The unsigned interregnum — commit `f829e6c` and its attestation.** The
|
|
18
|
+
* policy-editing commit and the attestation that made the edit operative landed
|
|
19
|
+
* as two separate commits. In between, the repository carried an inoperative
|
|
20
|
+
* policy: `checkAttestation` said `hash-mismatch` and every gate operation
|
|
21
|
+
* refused. `amend` closes that window by making the attestation and the git
|
|
22
|
+
* commit one ceremony — it prints, or with `--commit` runs, the exact two-file
|
|
23
|
+
* `git add` + `git commit` that lands the policy edit and its attestation
|
|
24
|
+
* together, and it validates the `--commit` preconditions BEFORE it attests, so
|
|
25
|
+
* a refusal can never leave a half-finished amendment behind.
|
|
26
|
+
*
|
|
27
|
+
* ## The baseline problem, stated plainly (FLAGGED FOR HUMAN REVIEW)
|
|
28
|
+
*
|
|
29
|
+
* A semantic diff needs the previously-attested policy *text*. The log does not
|
|
30
|
+
* have it. An attestation records only the SHA-256 of the bytes — deliberately,
|
|
31
|
+
* since the log is meant to be exported and copied and a policy body in it
|
|
32
|
+
* would be a second source of truth. So the attested bytes are **not
|
|
33
|
+
* recoverable from the log**, and this verb does not pretend otherwise.
|
|
34
|
+
*
|
|
35
|
+
* What it does instead, at v0.1: when the policy file lives in a git
|
|
36
|
+
* repository, it recovers `HEAD:<path>` and hashes it. **Only if that blob's
|
|
37
|
+
* hash equals the attested hash** is it used as the diff baseline — the point
|
|
38
|
+
* being that we can then prove the text we are diffing against is exactly the
|
|
39
|
+
* text that was signed for. Anything else (not a git repo, no such blob, or a
|
|
40
|
+
* blob whose hash differs from the attestation) drops to **hash-only mode**: a
|
|
41
|
+
* loud notice that the semantic diff is unavailable, followed by the load
|
|
42
|
+
* advisory and the attestation, which still work. No `--baseline` flag is
|
|
43
|
+
* offered; a baseline the operator supplies by hand is a baseline nobody can
|
|
44
|
+
* verify, which is exactly the assurance this design refuses to fake.
|
|
45
|
+
*
|
|
46
|
+
* The limitation is real and worth a human's judgment: an amendment made
|
|
47
|
+
* outside git, or one made on top of an unattested working-tree edit, gets no
|
|
48
|
+
* semantic diff. Flagged rather than smoothed over.
|
|
49
|
+
*
|
|
50
|
+
* ## What this file does and does not decide
|
|
51
|
+
*
|
|
52
|
+
* As everywhere else in the CLI: the diff is `core/policy-diff.ts`, loading is
|
|
53
|
+
* `core/policy-load.ts`, matching is `core/policy-match.ts`, hashing and the
|
|
54
|
+
* append are `core/attest.ts`. This file resolves paths and identity, shells out
|
|
55
|
+
* to git, decides exit codes, and formats output.
|
|
56
|
+
*/
|
|
57
|
+
import type { Streams } from "./main.js";
|
|
58
|
+
/** `approval policy amend …` — the whole ceremony, in one verb. */
|
|
59
|
+
export declare function commandPolicyAmend(argv: string[], streams: Streams, cwd: string): number;
|