approval-md 0.0.1 → 0.2.0

package/dist/src/codex/templates.js

@@ -0,0 +1,319 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, lstatSync, readFileSync, realpathSync, readdirSync, writeFileSync, } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CODEX_INSTANCE_SCHEMA_VERSION, SUPPORTED_CODEX_PLATFORM, SUPPORTED_CODEX_VERSION, checkCodexInstance, } from "./manifest.js";
+export const CODEX_BUNDLE_VERSION = 1;
+export const CODEX_BUNDLE_FILES = [
+    "codex-instance.json",
+    "requirements.toml",
+    "managed_config.toml",
+    "approval-codex-mcp",
+    "approval-codex-start",
+    "com.approval.codex-broker.plist",
+    "com.approval.codex-runner.plist",
+    "INSTALL.md",
+];
+function quote(value) {
+    return JSON.stringify(value);
+}
+function xml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;");
+}
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+function packageVersion() {
+    const packageRoot = fileURLToPath(new URL("../../../", import.meta.url));
+    const value = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
+    if (typeof value.version !== "string")
+        throw new Error("installed package.json has no version");
+    return value.version;
+}
+export function manifestFor(input) {
+    const installRoot = resolve(input.installRoot);
+    const manifestPath = join(installRoot, "instances", `${input.instanceId}.json`);
+    const mcpExecutable = join(installRoot, "bin", "approval-codex-mcp");
+    return {
+        schema_version: CODEX_INSTANCE_SCHEMA_VERSION,
+        instance_id: input.instanceId,
+        platform: SUPPORTED_CODEX_PLATFORM,
+        codex_version: SUPPORTED_CODEX_VERSION,
+        node_version: process.versions.node,
+        package_version: packageVersion(),
+        paths: {
+            install_root: installRoot,
+            package_root: join(installRoot, "package"),
+            workspace: resolve(input.workspace),
+            primary: resolve(input.primary),
+            policy: join(resolve(input.primary), "APPROVAL.md"),
+            log: join(resolve(input.primary), ".approval", "log", "events.jsonl"),
+            manifest: manifestPath,
+            codex_executable: resolve(input.codexExecutable),
+            node_executable: resolve(input.nodeExecutable),
+            mcp_executable: mcpExecutable,
+            broker_executable: join(installRoot, "bin", "approval-codex-broker"),
+            runner_executable: join(installRoot, "bin", "approval-codex-runner"),
+        },
+        principals: {
+            codex: "_approval_codex",
+            broker: "_approval_broker",
+            runner: "_approval_runner",
+        },
+        invocation: {
+            command: mcpExecutable,
+            args: ["codex", "serve", "--manifest", manifestPath],
+        },
+        components: {
+            broker: "required-not-shipped",
+            runner: "required-not-shipped",
+        },
+    };
+}
+export function requirementsToml(manifest) {
+    const rules = manifest.invocation.args
+        .map((value) => `  { match = "exact", value = ${quote(value)} },`)
+        .join("\n");
+    return `# INERT REVIEW ARTIFACT. Installing this file is a human/MDM action.
+allowed_approval_policies = ["never"]
+allowed_web_search_modes = ["disabled"]
+default_permissions = "approval-codex-readonly"
+allow_managed_hooks_only = true
+allow_remote_control = false
+
+[allowed_permission_profiles]
+approval-codex-readonly = true
+
+[permissions.approval-codex-readonly.filesystem]
+":root" = "deny"
+":minimal" = "read"
+
+[permissions.approval-codex-readonly.filesystem.":workspace_roots"]
+"." = "read"
+
+[permissions.approval-codex-readonly.network]
+enabled = false
+
+[features]
+apps = false
+browser_use = false
+browser_use_external = false
+browser_use_full_cdp_access = false
+computer_use = false
+in_app_browser = false
+plugins = false
+web_search = false
+
+[mcp_servers.approval-codex.identity]
+command = { executable = ${quote(manifest.invocation.command)}, args = [
+${rules}
+] }
+`;
+}
+export function managedConfigToml(manifest) {
+    const args = manifest.invocation.args.map(quote).join(", ");
+    return `# INERT REVIEW ARTIFACT. This enables only the pinned strict MCP shim.
+[mcp_servers.approval-codex]
+command = ${quote(manifest.invocation.command)}
+args = [${args}]
+required = true
+`;
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\"'\"'")}'`;
+}
+function launcher(manifest, mode) {
+    const cli = join(manifest.paths.package_root, "cli.js");
+    const prefix = `exec /usr/bin/env -i PATH=/usr/bin:/bin HOME=/var/empty TMPDIR=/tmp ${shellQuote(manifest.paths.node_executable)} ${shellQuote(cli)}`;
+    const command = mode === "serve"
+        ? `if [ "$#" -ne 4 ] || [ "$1" != 'codex' ] || [ "$2" != 'serve' ] || [ "$3" != '--manifest' ] || [ "$4" != ${shellQuote(manifest.paths.manifest)} ]; then exit 2; fi
+${prefix} codex serve --manifest ${shellQuote(manifest.paths.manifest)}`
+        : `if [ "$#" -ne 0 ]; then exit 2; fi\n${prefix} codex start --manifest ${shellQuote(manifest.paths.manifest)}`;
+    return `#!/bin/sh
+# INERT until installed root-owned with the complete APRV-325 broker/runner.
+cd ${shellQuote(manifest.paths.package_root)} || exit 1
+${command}
+`;
+}
+function plist(manifest, component) {
+    const executable = component === "broker" ? manifest.paths.broker_executable : manifest.paths.runner_executable;
+    const principal = component === "broker" ? manifest.principals.broker : manifest.principals.runner;
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.approval.codex-${component}</string>
+  <key>ProgramArguments</key><array>
+    <string>${xml(executable)}</string>
+    <string>--manifest</string>
+    <string>${xml(manifest.paths.manifest)}</string>
+  </array>
+  <key>UserName</key><string>${principal}</string>
+  <key>RunAtLoad</key><false/>
+</dict></plist>
+`;
+}
+function installGuide(manifest) {
+    return `# Constrained Codex instance ${manifest.instance_id}
+
+This bundle is inert. It does not create users, install files, load launchd
+services, edit /etc/codex, authenticate Codex, start an executor, or change
+approval.md policy.
+
+The broker and runner are deliberately marked required-not-shipped. Do not
+install or start this bundle until APRV-325.2 and APRV-325.3 replace those
+placeholders and strict doctor reports ready.
+
+Target install root: ${manifest.paths.install_root}
+Canonical workspace: ${manifest.paths.workspace}
+Primary gate checkout: ${manifest.paths.primary}
+
+Review bundle-sha256.json, then run:
+  approval codex setup --check <this-directory>
+  approval codex doctor --manifest ${manifest.paths.manifest}
+
+A passing setup check proves only that this review bundle is internally
+consistent. It does not prove host custody or enforcement.
+`;
+}
+export function renderBundle(manifest) {
+    return {
+        "codex-instance.json": `${JSON.stringify(manifest, null, 2)}\n`,
+        "requirements.toml": requirementsToml(manifest),
+        "managed_config.toml": managedConfigToml(manifest),
+        "approval-codex-mcp": launcher(manifest, "serve"),
+        "approval-codex-start": launcher(manifest, "start"),
+        "com.approval.codex-broker.plist": plist(manifest, "broker"),
+        "com.approval.codex-runner.plist": plist(manifest, "runner"),
+        "INSTALL.md": installGuide(manifest),
+    };
+}
+export function prepareBundle(input) {
+    let manifest;
+    try {
+        manifest = manifestFor(input);
+    }
+    catch (cause) {
+        return { ok: false, code: "package-unreadable", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+    const checked = checkCodexInstance(manifest);
+    if (!checked.ok) {
+        return {
+            ok: false,
+            code: "manifest-invalid",
+            message: checked.errors.map((error) => `${error.path || "/"}: ${error.message}`).join("; "),
+        };
+    }
+    let output;
+    try {
+        const requestedOutput = resolve(input.output);
+        output = join(realpathSync(dirname(requestedOutput)), basename(requestedOutput));
+    }
+    catch (cause) {
+        return { ok: false, code: "prepare-failed", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+    const roots = [manifest.paths.workspace, manifest.paths.primary, manifest.paths.install_root];
+    if (roots.some((root) => output === root || output.startsWith(`${root}/`) || root.startsWith(`${output}/`))) {
+        return { ok: false, code: "output-overlap", message: "preparation output must be disjoint from workspace, primary and install roots" };
+    }
+    try {
+        mkdirSync(output);
+        const rendered = renderBundle(manifest);
+        for (const [name, content] of Object.entries(rendered)) {
+            writeFileSync(join(output, name), content, {
+                encoding: "utf8",
+                mode: name.startsWith("approval-codex-") ? 0o755 : 0o644,
+                flag: "wx",
+            });
+        }
+        const index = { version: CODEX_BUNDLE_VERSION, files: {} };
+        for (const name of CODEX_BUNDLE_FILES) {
+            index.files[name] = sha256(readFileSync(join(output, name)));
+        }
+        writeFileSync(join(output, "bundle-sha256.json"), `${JSON.stringify(index, null, 2)}\n`, {
+            encoding: "utf8",
+            mode: 0o644,
+            flag: "wx",
+        });
+        return { ok: true, output, manifest, files: [...CODEX_BUNDLE_FILES, "bundle-sha256.json"] };
+    }
+    catch (cause) {
+        return { ok: false, code: "prepare-failed", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+}
+export function checkBundle(directory) {
+    const root = resolve(directory);
+    try {
+        if (!lstatSync(root).isDirectory() || realpathSync(root) !== root) {
+            return { ok: false, code: "bundle-root-unsafe", message: "bundle root must be a canonical directory, not a symlink" };
+        }
+        if (!lstatSync(join(root, "bundle-sha256.json")).isFile()) {
+            return { ok: false, code: "bundle-index-unreadable", message: "bundle-sha256.json must be a regular file" };
+        }
+    }
+    catch (cause) {
+        return { ok: false, code: "bundle-index-unreadable", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+    let index;
+    try {
+        index = JSON.parse(readFileSync(join(root, "bundle-sha256.json"), "utf8"));
+    }
+    catch (cause) {
+        return { ok: false, code: "bundle-index-unreadable", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+    if (index.version !== CODEX_BUNDLE_VERSION ||
+        typeof index.files !== "object" ||
+        index.files === null ||
+        Array.isArray(index.files)) {
+        return { ok: false, code: "bundle-index-invalid", message: "bundle-sha256.json has an unsupported shape or version" };
+    }
+    const expected = [...CODEX_BUNDLE_FILES].sort();
+    const actual = Object.keys(index.files).sort();
+    if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+        return { ok: false, code: "bundle-file-set", message: "bundle index must name the exact required file set" };
+    }
+    try {
+        const disk = readdirSync(root).sort();
+        const allowed = [...expected, "bundle-sha256.json"].sort();
+        if (JSON.stringify(disk) !== JSON.stringify(allowed)) {
+            return { ok: false, code: "bundle-file-set", message: "bundle directory must contain only the indexed files and bundle-sha256.json" };
+        }
+        for (const name of expected) {
+            if (!lstatSync(join(root, name)).isFile()) {
+                return { ok: false, code: "bundle-file-type", message: `${name} must be a regular file, not a symlink or directory` };
+            }
+            if (index.files[name] !== sha256(readFileSync(join(root, name)))) {
+                return { ok: false, code: "bundle-hash-mismatch", message: `${name} does not match bundle-sha256.json` };
+            }
+        }
+    }
+    catch (cause) {
+        return { ok: false, code: "bundle-unreadable", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+    let manifestValue;
+    try {
+        manifestValue = JSON.parse(readFileSync(join(root, "codex-instance.json"), "utf8"));
+    }
+    catch (cause) {
+        return {
+            ok: false,
+            code: "manifest-invalid",
+            message: cause instanceof Error ? cause.message : String(cause),
+        };
+    }
+    const checked = checkCodexInstance(manifestValue);
+    if (!checked.ok) {
+        return { ok: false, code: "manifest-invalid", message: checked.errors.map((error) => error.message).join("; ") };
+    }
+    const expectedRendered = renderBundle(checked.manifest);
+    for (const [name, content] of Object.entries(expectedRendered)) {
+        if (readFileSync(join(root, name), "utf8") !== content) {
+            return { ok: false, code: "bundle-template-drift", message: `${name} does not match the manifest-derived template` };
+        }
+    }
+    return { ok: true, manifest: checked.manifest, files: [...expected, "bundle-sha256.json"] };
+}
+//# sourceMappingURL=templates.js.map

package/dist/src/codex/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../../src/codex/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,sBAAsB;IACtB,iCAAiC;IACjC,iCAAiC;IACjC,YAAY;CACJ,CAAC;AAqBX,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,MAAM,CAAC,KAAsB;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAE/E,CAAC;IACF,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAChG,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAmB;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,UAAU,OAAO,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACrE,OAAO;QACL,cAAc,EAAE,6BAA6B;QAC7C,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,QAAQ,EAAE,wBAAwB;QAClC,aAAa,EAAE,uBAAuB;QACtC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QACnC,eAAe,EAAE,cAAc,EAAE;QACjC,KAAK,EAAE;YACL,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;YAC1C,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YACnC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;YACnD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,CAAC;YACrE,QAAQ,EAAE,YAAY;YACtB,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;YAChD,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;YAC9C,cAAc,EAAE,aAAa;YAC7B,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,uBAAuB,CAAC;YACpE,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,uBAAuB,CAAC;SACrE;QACD,UAAU,EAAE;YACV,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,kBAAkB;SAC3B;QACD,UAAU,EAAE;YACV,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC;SACrD;QACD,UAAU,EAAE;YACV,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,sBAAsB;SAC/B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAA+B;IAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;SACjE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BA+BkB,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;EAC3D,KAAK;;CAEN,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAA+B;IAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO;;YAEG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;UACpC,IAAI;;CAEb,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC;AACjD,CAAC;AAED,SAAS,QAAQ,CAAC,QAA+B,EAAE,IAAuB;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,uEAAuE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACtJ,MAAM,OAAO,GACX,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,4GAA4G,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;EACrJ,MAAM,2BAA2B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;QAClE,CAAC,CAAC,uCAAuC,MAAM,2BAA2B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpH,OAAO;;KAEJ,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;EAC1C,OAAO;CACR,CAAC;AACF,CAAC;AAED,SAAS,KAAK,CAAC,QAA+B,EAAE,SAA8B;IAC5E,MAAM,UAAU,GACd,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC/F,MAAM,SAAS,GACb,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;IACnF,OAAO;;;+CAGsC,SAAS;;cAE1C,GAAG,CAAC,UAAU,CAAC;;cAEf,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;;+BAEX,SAAS;;;CAGvC,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,QAA+B;IACnD,OAAO,gCAAgC,QAAQ,CAAC,WAAW;;;;;;;;;;uBAUtC,QAAQ,CAAC,KAAK,CAAC,YAAY;uBAC3B,QAAQ,CAAC,KAAK,CAAC,SAAS;yBACtB,QAAQ,CAAC,KAAK,CAAC,OAAO;;;;qCAIV,QAAQ,CAAC,KAAK,CAAC,QAAQ;;;;CAI3D,CAAC;AACF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAA+B;IAC1D,OAAO;QACL,qBAAqB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC/D,mBAAmB,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QAC/C,qBAAqB,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QAClD,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QACjD,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QACnD,iCAAiC,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5D,iCAAiC,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5D,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,IAAI,QAA+B,CAAC;IACpC,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACpH,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC5F,CAAC;IACJ,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAChH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,+EAA+E,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE;gBACzC,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;gBACxD,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAgB,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACtC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACvF,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,kBAAkB,EAAE,oBAAoB,CAAC,EAAE,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAChH,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;QACxH,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;QAC9G,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,KAAkB,CAAC;IACvB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAAgB,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACzH,CAAC;IACD,IACE,KAAK,CAAC,OAAO,KAAK,oBAAoB;QACtC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,KAAK,CAAC,KAAK,KAAK,IAAI;QACpB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;IACxH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,EAAE,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,6EAA6E,EAAE,CAAC;QACxI,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,IAAI,qDAAqD,EAAE,CAAC;YACxH,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,GAAG,IAAI,oCAAoC,EAAE,CAAC;YAC3G,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,aAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACnH,CAAC;IACD,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,GAAG,IAAI,+CAA+C,EAAE,CAAC;QACvH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,oBAAoB,CAAC,EAAE,CAAC;AAC9F,CAAC"}

package/dist/src/codex/trust.d.ts

@@ -0,0 +1,19 @@
+import type { CodexInstanceManifest } from "./manifest.js";
+export interface DoctorFinding {
+    code: string;
+    path?: string;
+    message: string;
+}
+export interface DoctorReport {
+    ok: false;
+    ready: false;
+    findings: DoctorFinding[];
+}
+export interface TrustOptions {
+    platform?: NodeJS.Platform;
+    resolveUid?: (name: string) => number | null;
+    groupsFor?: (name: string) => number[] | null;
+}
+export declare function parseCodexVersionOutput(stdout: string, stderr: string): string | null;
+export declare function parseNodeVersionOutput(stdout: string, stderr: string): string | null;
+export declare function diagnoseCodexInstance(manifest: CodexInstanceManifest, options?: TrustOptions): DoctorReport;

package/dist/src/codex/trust.js

@@ -0,0 +1,183 @@
+import { lstatSync, realpathSync, statSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+function ancestors(path) {
+    const values = [];
+    let current = resolve(path);
+    for (;;) {
+        values.unshift(current);
+        const parent = dirname(current);
+        if (parent === current)
+            return values;
+        current = parent;
+    }
+}
+function systemUid(name) {
+    const result = spawnSync("/usr/bin/id", ["-u", name], {
+        encoding: "utf8", timeout: 2_000, maxBuffer: 16_384, env: { PATH: "/usr/bin:/bin" },
+    });
+    if (result.status !== 0)
+        return null;
+    const value = Number(result.stdout.trim());
+    return Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function systemGroups(name) {
+    const result = spawnSync("/usr/bin/id", ["-G", name], {
+        encoding: "utf8", timeout: 2_000, maxBuffer: 16_384, env: { PATH: "/usr/bin:/bin" },
+    });
+    if (result.status !== 0)
+        return null;
+    const groups = result.stdout.trim().split(/\s+/u).map(Number);
+    return groups.length > 0 && groups.every((value) => Number.isSafeInteger(value) && value >= 0)
+        ? groups
+        : null;
+}
+export function parseCodexVersionOutput(stdout, stderr) {
+    if (stderr.length !== 0)
+        return null;
+    return /^codex-cli (\d+\.\d+\.\d+)$/u.exec(stdout.trim())?.[1] ?? null;
+}
+export function parseNodeVersionOutput(stdout, stderr) {
+    if (stderr.length !== 0)
+        return null;
+    return /^v(\d+\.\d+\.\d+)$/u.exec(stdout.trim())?.[1] ?? null;
+}
+function add(findings, code, message, path) {
+    findings.push(path === undefined ? { code, message } : { code, path, message });
+}
+function inspectNoSymlinks(path, findings) {
+    let safe = true;
+    for (const candidate of ancestors(path)) {
+        try {
+            if (lstatSync(candidate).isSymbolicLink()) {
+                add(findings, "path-symlink", "path or ancestor is a symbolic link", candidate);
+                safe = false;
+            }
+        }
+        catch {
+            add(findings, "path-missing", "path or ancestor does not exist", candidate);
+            return false;
+        }
+    }
+    try {
+        if (realpathSync(path) !== resolve(path)) {
+            add(findings, "path-canonical", "real path differs from the manifest path", path);
+            safe = false;
+        }
+    }
+    catch {
+        return false;
+    }
+    return safe;
+}
+function inspectRootCustody(path, findings) {
+    let safe = true;
+    for (const candidate of ancestors(path)) {
+        let stat;
+        try {
+            stat = statSync(candidate);
+        }
+        catch {
+            return false;
+        }
+        if (stat.uid !== 0) {
+            add(findings, "owner-not-root", `trusted path ancestor is owned by uid ${String(stat.uid)}, expected 0`, candidate);
+            safe = false;
+        }
+        if ((stat.mode & 0o022) !== 0) {
+            add(findings, "trusted-path-writable", "trusted path ancestor is group- or world-writable", candidate);
+            safe = false;
+        }
+    }
+    return safe;
+}
+function inspectExecutable(path, findings) {
+    try {
+        const stat = statSync(path);
+        let safe = true;
+        if (!stat.isFile()) {
+            add(findings, "component-not-file", "component is not a regular file", path);
+            safe = false;
+        }
+        if ((stat.mode & 0o111) === 0) {
+            add(findings, "component-not-executable", "component has no execute bit", path);
+            safe = false;
+        }
+        return safe;
+    }
+    catch {
+        add(findings, "component-missing", "required enforcement component is missing", path);
+        return false;
+    }
+}
+export function diagnoseCodexInstance(manifest, options = {}) {
+    const findings = [];
+    const platform = options.platform ?? process.platform;
+    if (platform !== manifest.platform) {
+        add(findings, "unsupported-platform", `manifest requires ${manifest.platform}; this host is ${platform}`);
+    }
+    const resolveUid = options.resolveUid ?? systemUid;
+    const groupsFor = options.groupsFor ?? systemGroups;
+    const identities = Object.values(manifest.principals).map((name) => ({
+        name, uid: resolveUid(name), groups: groupsFor(name),
+    }));
+    for (const identity of identities) {
+        if (identity.uid === null || identity.groups === null) {
+            add(findings, "principal-missing", `principal ${identity.name} does not exist or cannot be resolved`);
+        }
+        else if (identity.uid === 0) {
+            add(findings, "principal-root", `service principal ${identity.name} must not be uid 0`);
+        }
+    }
+    const knownUids = identities.flatMap((identity) => identity.uid === null ? [] : [identity.uid]);
+    if (new Set(knownUids).size !== knownUids.length) {
+        add(findings, "principal-overlap", "Codex, broker and runner principals must have distinct non-root uids");
+    }
+    for (const path of Object.values(manifest.paths)) {
+        inspectNoSymlinks(path, findings);
+    }
+    const trusted = [
+        manifest.paths.install_root,
+        manifest.paths.package_root,
+        manifest.paths.manifest,
+        manifest.paths.codex_executable,
+        manifest.paths.node_executable,
+        manifest.paths.mcp_executable,
+        manifest.paths.broker_executable,
+        manifest.paths.runner_executable,
+    ];
+    for (const path of trusted)
+        inspectRootCustody(path, findings);
+    const executables = [
+        manifest.paths.codex_executable,
+        manifest.paths.node_executable,
+        manifest.paths.mcp_executable,
+        manifest.paths.broker_executable,
+        manifest.paths.runner_executable,
+    ];
+    for (const path of executables)
+        inspectExecutable(path, findings);
+    add(findings, "trusted-path-acl-unproven", "POSIX ownership and mode do not prove that trusted paths have no writable ACL; APRV-325.1 executes no manifest-selected binary");
+    add(findings, "codex-version-unchecked", "Codex version was not executed because ACL-aware executable custody is not implemented", manifest.paths.codex_executable);
+    add(findings, "node-version-unchecked", "Node version was not executed because ACL-aware executable custody is not implemented", manifest.paths.node_executable);
+    const codex = identities.find((entry) => entry.name === manifest.principals.codex);
+    if (codex !== undefined && codex.uid !== null && codex.groups !== null) {
+        try {
+            const stat = statSync(manifest.paths.workspace);
+            const ownerWritable = stat.uid === codex.uid && (stat.mode & 0o200) !== 0;
+            const groupWritable = codex.groups.includes(stat.gid) && (stat.mode & 0o020) !== 0;
+            const worldWritable = (stat.mode & 0o002) !== 0;
+            if (ownerWritable || groupWritable || worldWritable) {
+                add(findings, "workspace-writable-by-codex", "workspace root is writable by the Codex principal under POSIX ownership and mode", manifest.paths.workspace);
+            }
+        }
+        catch {
+            // Missing paths were already reported.
+        }
+    }
+    add(findings, "workspace-custody-unproven", "root mode inspection does not prove subtree and ACL non-write; APRV-325.3 must perform a principal-executed denial probe", manifest.paths.workspace);
+    add(findings, "broker-not-ready", "APRV-325.1 ships preparation only; the policy-bound broker is not implemented", manifest.paths.broker_executable);
+    add(findings, "runner-not-ready", "APRV-325.1 ships preparation only; the confined runner is not implemented", manifest.paths.runner_executable);
+    return { ok: false, ready: false, findings };
+}
+//# sourceMappingURL=trust.js.map

package/dist/src/codex/trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.js","sourceRoot":"","sources":["../../../src/codex/trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAsB/C,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,SAAS,CAAC;QACR,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC;QACtC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;QACpD,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;KACpF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;QACpD,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;KACpF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC5F,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,MAAc;IACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,MAAc;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAChE,CAAC;AAED,SAAS,GAAG,CAAC,QAAyB,EAAE,IAAY,EAAE,OAAe,EAAE,IAAa;IAClF,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAyB;IAChE,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1C,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,qCAAqC,EAAE,SAAS,CAAC,CAAC;gBAChF,IAAI,GAAG,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,iCAAiC,EAAE,SAAS,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,0CAA0C,EAAE,IAAI,CAAC,CAAC;YAClF,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAyB;IACjE,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,yCAAyC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YACpH,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,QAAQ,EAAE,uBAAuB,EAAE,mDAAmD,EAAE,SAAS,CAAC,CAAC;YACvG,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAyB;IAChE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;YAC7E,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,QAAQ,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,IAAI,CAAC,CAAC;YAChF,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,2CAA2C,EAAE,IAAI,CAAC,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAA+B,EAC/B,OAAO,GAAiB,EAAE;IAE1B,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,EAAE,qBAAqB,QAAQ,CAAC,QAAQ,kBAAkB,QAAQ,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;KACrD,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACtD,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,aAAa,QAAQ,CAAC,IAAI,uCAAuC,CAAC,CAAC;QACxG,CAAC;aAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,qBAAqB,QAAQ,CAAC,IAAI,oBAAoB,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAChG,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACjD,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,sEAAsE,CAAC,CAAC;IAC7G,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,OAAO,GAAG;QACd,QAAQ,CAAC,KAAK,CAAC,YAAY;QAC3B,QAAQ,CAAC,KAAK,CAAC,YAAY;QAC3B,QAAQ,CAAC,KAAK,CAAC,QAAQ;QACvB,QAAQ,CAAC,KAAK,CAAC,gBAAgB;QAC/B,QAAQ,CAAC,KAAK,CAAC,eAAe;QAC9B,QAAQ,CAAC,KAAK,CAAC,cAAc;QAC7B,QAAQ,CAAC,KAAK,CAAC,iBAAiB;QAChC,QAAQ,CAAC,KAAK,CAAC,iBAAiB;KACjC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO;QAAE,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE/D,MAAM,WAAW,GAAG;QAClB,QAAQ,CAAC,KAAK,CAAC,gBAAgB;QAC/B,QAAQ,CAAC,KAAK,CAAC,eAAe;QAC9B,QAAQ,CAAC,KAAK,CAAC,cAAc;QAC7B,QAAQ,CAAC,KAAK,CAAC,iBAAiB;QAChC,QAAQ,CAAC,KAAK,CAAC,iBAAiB;KACjC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,WAAW;QAAE,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAElE,GAAG,CAAC,QAAQ,EAAE,2BAA2B,EAAE,gIAAgI,CAAC,CAAC;IAC7K,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,wFAAwF,EAAE,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpK,GAAG,CAAC,QAAQ,EAAE,wBAAwB,EAAE,uFAAuF,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAEjK,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1E,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACnF,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,aAAa,IAAI,aAAa,IAAI,aAAa,EAAE,CAAC;gBACpD,GAAG,CAAC,QAAQ,EAAE,6BAA6B,EAAE,kFAAkF,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC7J,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IACD,GAAG,CAAC,QAAQ,EAAE,4BAA4B,EAAE,0HAA0H,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAElM,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,+EAA+E,EAAE,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrJ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,2EAA2E,EAAE,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAEjJ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC"}