attenu-guard 0.3.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +62 -0
- package/README.md +8 -2
- package/dist/cjs/adapters/langgraph.d.ts +27 -3
- package/dist/cjs/adapters/langgraph.d.ts.map +1 -1
- package/dist/cjs/adapters/langgraph.js +290 -11
- package/dist/cjs/adapters/langgraph.js.map +1 -1
- package/dist/cjs/audit.d.ts +38 -1
- package/dist/cjs/audit.d.ts.map +1 -1
- package/dist/cjs/audit.js +69 -8
- package/dist/cjs/audit.js.map +1 -1
- package/dist/cjs/canonical.d.ts +19 -0
- package/dist/cjs/canonical.d.ts.map +1 -1
- package/dist/cjs/canonical.js +60 -2
- package/dist/cjs/canonical.js.map +1 -1
- package/dist/cjs/ceilings.d.ts.map +1 -1
- package/dist/cjs/ceilings.js +18 -0
- package/dist/cjs/ceilings.js.map +1 -1
- package/dist/cjs/chain.d.ts +32 -0
- package/dist/cjs/chain.d.ts.map +1 -1
- package/dist/cjs/chain.js +0 -0
- package/dist/cjs/chain.js.map +1 -1
- package/dist/cjs/cli.d.ts.map +1 -1
- package/dist/cjs/cli.js +4 -0
- package/dist/cjs/cli.js.map +1 -1
- package/dist/cjs/evidence.d.ts +41 -2
- package/dist/cjs/evidence.d.ts.map +1 -1
- package/dist/cjs/evidence.js +571 -13
- package/dist/cjs/evidence.js.map +1 -1
- package/dist/cjs/guard.d.ts +163 -9
- package/dist/cjs/guard.d.ts.map +1 -1
- package/dist/cjs/guard.js +426 -26
- package/dist/cjs/guard.js.map +1 -1
- package/dist/cjs/index.d.ts +12 -9
- package/dist/cjs/index.d.ts.map +1 -1
- package/dist/cjs/index.js +24 -5
- package/dist/cjs/index.js.map +1 -1
- package/dist/cjs/params.d.ts +52 -0
- package/dist/cjs/params.d.ts.map +1 -0
- package/dist/cjs/params.js +97 -0
- package/dist/cjs/params.js.map +1 -0
- package/dist/cjs/reasons.d.ts +89 -1
- package/dist/cjs/reasons.d.ts.map +1 -1
- package/dist/cjs/reasons.js +99 -3
- package/dist/cjs/reasons.js.map +1 -1
- package/dist/cjs/version.d.ts +10 -0
- package/dist/cjs/version.d.ts.map +1 -0
- package/dist/cjs/version.js +13 -0
- package/dist/cjs/version.js.map +1 -0
- package/dist/cjs/wire.d.ts.map +1 -1
- package/dist/cjs/wire.js +7 -0
- package/dist/cjs/wire.js.map +1 -1
- package/dist/esm/adapters/langgraph.d.ts +27 -3
- package/dist/esm/adapters/langgraph.d.ts.map +1 -1
- package/dist/esm/adapters/langgraph.js +290 -11
- package/dist/esm/adapters/langgraph.js.map +1 -1
- package/dist/esm/audit.d.ts +38 -1
- package/dist/esm/audit.d.ts.map +1 -1
- package/dist/esm/audit.js +68 -8
- package/dist/esm/audit.js.map +1 -1
- package/dist/esm/canonical.d.ts +19 -0
- package/dist/esm/canonical.d.ts.map +1 -1
- package/dist/esm/canonical.js +58 -1
- package/dist/esm/canonical.js.map +1 -1
- package/dist/esm/ceilings.d.ts.map +1 -1
- package/dist/esm/ceilings.js +19 -1
- package/dist/esm/ceilings.js.map +1 -1
- package/dist/esm/chain.d.ts +32 -0
- package/dist/esm/chain.d.ts.map +1 -1
- package/dist/esm/chain.js +0 -0
- package/dist/esm/chain.js.map +1 -1
- package/dist/esm/cli.d.ts.map +1 -1
- package/dist/esm/cli.js +4 -0
- package/dist/esm/cli.js.map +1 -1
- package/dist/esm/evidence.d.ts +41 -2
- package/dist/esm/evidence.d.ts.map +1 -1
- package/dist/esm/evidence.js +570 -12
- package/dist/esm/evidence.js.map +1 -1
- package/dist/esm/guard.d.ts +163 -9
- package/dist/esm/guard.d.ts.map +1 -1
- package/dist/esm/guard.js +393 -27
- package/dist/esm/guard.js.map +1 -1
- package/dist/esm/index.d.ts +12 -9
- package/dist/esm/index.d.ts.map +1 -1
- package/dist/esm/index.js +8 -6
- package/dist/esm/index.js.map +1 -1
- package/dist/esm/params.d.ts +52 -0
- package/dist/esm/params.d.ts.map +1 -0
- package/dist/esm/params.js +92 -0
- package/dist/esm/params.js.map +1 -0
- package/dist/esm/reasons.d.ts +89 -1
- package/dist/esm/reasons.d.ts.map +1 -1
- package/dist/esm/reasons.js +97 -2
- package/dist/esm/reasons.js.map +1 -1
- package/dist/esm/version.d.ts +10 -0
- package/dist/esm/version.d.ts.map +1 -0
- package/dist/esm/version.js +10 -0
- package/dist/esm/version.js.map +1 -0
- package/dist/esm/wire.d.ts.map +1 -1
- package/dist/esm/wire.js +8 -1
- package/dist/esm/wire.js.map +1 -1
- package/package.json +1 -1
|
@@ -35,6 +35,22 @@
|
|
|
35
35
|
* this adapter does not prescribe which. It guarantees only that the tool body
|
|
36
36
|
* never executes on a denial.
|
|
37
37
|
*
|
|
38
|
+
* ## Execution binding (0.9.0, reference wiring for this adapter)
|
|
39
|
+
*
|
|
40
|
+
* When `guard`'s chain was issued with `schemaVersion: 2` (see `Guard.issue`), `guardNode` also
|
|
41
|
+
* passes `capture`/`adapter`/`authorizedParams` to `check` and calls `guard.recordOutcome` once
|
|
42
|
+
* the wrapped callable finishes — `Capture.WRAPPER_ASYNC` when `fn` is a genuine `async function`
|
|
43
|
+
* (`fn.constructor.name === "AsyncFunction"`, the same test Python's `inspect.iscoroutinefunction`
|
|
44
|
+
* makes), `Capture.WRAPPER_SYNC` otherwise. `authorizedParams`/`invokedParams` are
|
|
45
|
+
* `{args: [...]}` built from exactly what the wrapped callable is called with — JavaScript has no
|
|
46
|
+
* separate `kwargs`, so unlike the Python adapter's `{args, kwargs}` this carries only `args`; a
|
|
47
|
+
* LangGraph.js node in any case receives one state object, not Python's `(*args, **kwargs)`. They
|
|
48
|
+
* are unchanged between the two observations here, since this decorator itself never mutates
|
|
49
|
+
* them; a framework that DOES mutate arguments between authorization and invocation is where a
|
|
50
|
+
* real substitution would become visible. On a `schemaVersion: 1` chain (the default), this
|
|
51
|
+
* adapter behaves exactly as it did before 0.9.0: no `capture`/`authorizedParams`, no
|
|
52
|
+
* `recordOutcome` call. Every other framework adapter is unchanged in this release.
|
|
53
|
+
*
|
|
38
54
|
* ## Delegation
|
|
39
55
|
*
|
|
40
56
|
* Handing work to a sub-agent is the delegation moment. `delegateTo` mints the
|
|
@@ -50,6 +66,71 @@
|
|
|
50
66
|
* const tools = guardTools(researcher, [crmQuery], { scopes: { crm_query: "crm.read" } });
|
|
51
67
|
*/
|
|
52
68
|
import { AuthorityDenied } from "../guard.js";
|
|
69
|
+
import { BodyState, Capture } from "../reasons.js";
|
|
70
|
+
import { VERSION } from "../version.js";
|
|
71
|
+
/**
|
|
72
|
+
* An IMMUTABLE snapshot of the call's arguments, taken BEFORE the wrapped callable runs and
|
|
73
|
+
* reused for BOTH `authorizedParams` (`check`) and `invokedParams` (`recordOutcome`) — so a
|
|
74
|
+
* callable that mutates its own inputs in place cannot make this adapter observe two different
|
|
75
|
+
* values for what was actually one call's arguments (see the module doc comment's "Execution
|
|
76
|
+
* binding" section; no `kwargs` — JavaScript has no separate keyword-argument bag).
|
|
77
|
+
*/
|
|
78
|
+
function snapshotParams(args) {
|
|
79
|
+
const raw = { args: [...args] };
|
|
80
|
+
try {
|
|
81
|
+
return structuredClone(raw);
|
|
82
|
+
}
|
|
83
|
+
catch {
|
|
84
|
+
// Best-effort: something in here isn't structured-cloneable (a live socket, a function, ...).
|
|
85
|
+
// Fall back to the shallow copy — a residual risk only if THAT specific object is later
|
|
86
|
+
// mutated in place, a rare edge case documented here rather than silently claimed away.
|
|
87
|
+
return raw;
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
/**
|
|
91
|
+
* `true` if `result` is a generator/async-generator/promise-like value whose consumption this
|
|
92
|
+
* wrapper does not itself observe — spec's `deferred`: "the record covers the call, not the
|
|
93
|
+
* eventual exhaustion." A promise counts too (the closest JavaScript analogue of Python's
|
|
94
|
+
* `asyncio.Future`/`concurrent.futures.Future`): the async branch here already `await`s `fn`
|
|
95
|
+
* itself, so a bare promise surfacing as `result` there means `fn` returned ANOTHER promise
|
|
96
|
+
* without awaiting it, which is exactly the same "not actually consumed" situation.
|
|
97
|
+
*/
|
|
98
|
+
function isDeferredResult(result) {
|
|
99
|
+
if (result === null || typeof result !== "object")
|
|
100
|
+
return false;
|
|
101
|
+
const r = result;
|
|
102
|
+
if (typeof r["next"] === "function" && typeof r[Symbol.iterator] === "function")
|
|
103
|
+
return true;
|
|
104
|
+
if (typeof r["next"] === "function" && typeof r[Symbol.asyncIterator] === "function")
|
|
105
|
+
return true;
|
|
106
|
+
if (typeof r["then"] === "function")
|
|
107
|
+
return true;
|
|
108
|
+
return false;
|
|
109
|
+
}
|
|
110
|
+
function bodyStateFor(result) {
|
|
111
|
+
return isDeferredResult(result) ? BodyState.DEFERRED : BodyState.RETURNED;
|
|
112
|
+
}
|
|
113
|
+
/**
|
|
114
|
+
* `true` for the JavaScript analogue of Python's `asyncio.CancelledError`: an `AbortController`/
|
|
115
|
+
* `AbortSignal`-driven abort, surfaced as a `DOMException`/`Error` named `"AbortError"` — the
|
|
116
|
+
* standard shape Node and the Fetch/Web platform both use. There is no single universal async
|
|
117
|
+
* cancellation exception type in JavaScript the way `asyncio.CancelledError` is in Python, so this
|
|
118
|
+
* is the best-grounded, most widely applicable translation rather than a exact 1:1 port.
|
|
119
|
+
*/
|
|
120
|
+
function isAbortError(exc) {
|
|
121
|
+
return exc instanceof Error && exc.name === "AbortError";
|
|
122
|
+
}
|
|
123
|
+
/** The class/constructor name of a thrown value — JavaScript's nearest analogue of Python's `type(exc).__name__`. */
|
|
124
|
+
function errorCodeOf(exc) {
|
|
125
|
+
if (exc instanceof Error)
|
|
126
|
+
return exc.constructor.name || "Error";
|
|
127
|
+
if (exc === null)
|
|
128
|
+
return "null";
|
|
129
|
+
return typeof exc === "object" ? "object" : typeof exc;
|
|
130
|
+
}
|
|
131
|
+
function elapsedMs(start) {
|
|
132
|
+
return Math.round(performance.now() - start);
|
|
133
|
+
}
|
|
53
134
|
/**
|
|
54
135
|
* Wrap a callable so every call is authorized through `guard` first.
|
|
55
136
|
*
|
|
@@ -57,7 +138,9 @@ import { AuthorityDenied } from "../guard.js";
|
|
|
57
138
|
* `guard.check(toolScope, {context, tool})`. On a denial this throws
|
|
58
139
|
* `AuthorityDenied` and the wrapped callable is NEVER invoked. Otherwise it
|
|
59
140
|
* calls through with the original arguments and returns the result unchanged —
|
|
60
|
-
* including a promise, which is passed along untouched.
|
|
141
|
+
* including a promise, which is passed along untouched. On a `schemaVersion: 2`
|
|
142
|
+
* guard, also binds the call's outcome via `guard.recordOutcome` — see the
|
|
143
|
+
* module doc comment's "Execution binding" section.
|
|
61
144
|
*
|
|
62
145
|
* Use the Guard for the SPECIFIC agent this callable belongs to, not the
|
|
63
146
|
* orchestrator's broader one, so a denial reflects that node's real, narrowed
|
|
@@ -65,18 +148,102 @@ import { AuthorityDenied } from "../guard.js";
|
|
|
65
148
|
*/
|
|
66
149
|
export function guardNode(guard, toolScope, fn, options = {}) {
|
|
67
150
|
const resolvedTool = options.tool !== undefined ? options.tool : (fn.name || null);
|
|
68
|
-
const
|
|
151
|
+
const isAsyncFn = fn.constructor.name === "AsyncFunction";
|
|
152
|
+
// guard.schemaVersion never changes for a guard's lifetime, so it is safe (and correct: a
|
|
153
|
+
// wrapper's sync-vs-async SHAPE must be fixed at definition time, not per-call) to decide it
|
|
154
|
+
// once, here, at decoration time.
|
|
155
|
+
const v2 = guard.schemaVersion === 2;
|
|
156
|
+
const capture = isAsyncFn ? Capture.WRAPPER_ASYNC : Capture.WRAPPER_SYNC;
|
|
157
|
+
const adapterInfo = {
|
|
158
|
+
module: "attenu-guard/adapters/langgraph",
|
|
159
|
+
version: VERSION,
|
|
160
|
+
hookPath: `guardNode:${fn.name || toolScope}`,
|
|
161
|
+
};
|
|
162
|
+
function authorize(args, snapshot) {
|
|
69
163
|
const context = options.contextFn ? options.contextFn(...args) : {};
|
|
164
|
+
const extra = v2 ? { capture, adapter: adapterInfo, authorizedParams: snapshot ?? undefined } : {};
|
|
70
165
|
const decision = guard.check(toolScope, {
|
|
71
166
|
context,
|
|
72
167
|
tool: resolvedTool,
|
|
73
168
|
disposition: options.disposition ?? null,
|
|
74
169
|
metered: options.metered ?? false,
|
|
170
|
+
...extra,
|
|
75
171
|
});
|
|
76
172
|
if (!decision.allowed)
|
|
77
173
|
throw new AuthorityDenied(decision);
|
|
78
|
-
return
|
|
79
|
-
}
|
|
174
|
+
return decision;
|
|
175
|
+
}
|
|
176
|
+
let wrapped;
|
|
177
|
+
if (isAsyncFn && v2) {
|
|
178
|
+
wrapped = (async function (...args) {
|
|
179
|
+
const snapshot = snapshotParams(args);
|
|
180
|
+
const decision = authorize(args, snapshot);
|
|
181
|
+
const start = performance.now();
|
|
182
|
+
try {
|
|
183
|
+
const result = await fn.apply(this, args);
|
|
184
|
+
guard.recordOutcome(decision.callId, bodyStateFor(result), {
|
|
185
|
+
invokedParams: snapshot,
|
|
186
|
+
durationMs: elapsedMs(start),
|
|
187
|
+
});
|
|
188
|
+
return result;
|
|
189
|
+
}
|
|
190
|
+
catch (exc) {
|
|
191
|
+
// The wrapper stopped observing while the body may still run — exactly spec's
|
|
192
|
+
// `abandoned`, not `raised`. Still re-thrown: cancellation must propagate normally.
|
|
193
|
+
if (isAbortError(exc)) {
|
|
194
|
+
guard.recordOutcome(decision.callId, BodyState.ABANDONED, {
|
|
195
|
+
invokedParams: snapshot,
|
|
196
|
+
durationMs: elapsedMs(start),
|
|
197
|
+
});
|
|
198
|
+
}
|
|
199
|
+
else {
|
|
200
|
+
guard.recordOutcome(decision.callId, BodyState.RAISED, {
|
|
201
|
+
errorCode: errorCodeOf(exc),
|
|
202
|
+
invokedParams: snapshot,
|
|
203
|
+
durationMs: elapsedMs(start),
|
|
204
|
+
});
|
|
205
|
+
}
|
|
206
|
+
throw exc;
|
|
207
|
+
}
|
|
208
|
+
});
|
|
209
|
+
}
|
|
210
|
+
else if (isAsyncFn) {
|
|
211
|
+
// v1 (schemaVersion: 1, the default): EXACTLY the pre-0.9.0 shape — a plain SYNC wrapper
|
|
212
|
+
// that authorizes, then returns fn(...args) UNAWAITED. The caller awaits the returned
|
|
213
|
+
// promise itself, as it always has; `wrapped` is never itself an async function on v1, even
|
|
214
|
+
// when `fn` is.
|
|
215
|
+
wrapped = (function (...args) {
|
|
216
|
+
authorize(args, null);
|
|
217
|
+
return fn.apply(this, args);
|
|
218
|
+
});
|
|
219
|
+
}
|
|
220
|
+
else {
|
|
221
|
+
wrapped = (function (...args) {
|
|
222
|
+
if (!v2) {
|
|
223
|
+
authorize(args, null);
|
|
224
|
+
return fn.apply(this, args);
|
|
225
|
+
}
|
|
226
|
+
const snapshot = snapshotParams(args);
|
|
227
|
+
const decision = authorize(args, snapshot);
|
|
228
|
+
const start = performance.now();
|
|
229
|
+
try {
|
|
230
|
+
const result = fn.apply(this, args);
|
|
231
|
+
guard.recordOutcome(decision.callId, bodyStateFor(result), {
|
|
232
|
+
invokedParams: snapshot,
|
|
233
|
+
durationMs: elapsedMs(start),
|
|
234
|
+
});
|
|
235
|
+
return result;
|
|
236
|
+
}
|
|
237
|
+
catch (exc) {
|
|
238
|
+
guard.recordOutcome(decision.callId, BodyState.RAISED, {
|
|
239
|
+
errorCode: errorCodeOf(exc),
|
|
240
|
+
invokedParams: snapshot,
|
|
241
|
+
durationMs: elapsedMs(start),
|
|
242
|
+
});
|
|
243
|
+
throw exc;
|
|
244
|
+
}
|
|
245
|
+
});
|
|
246
|
+
}
|
|
80
247
|
Object.defineProperties(wrapped, {
|
|
81
248
|
name: { value: fn.name, configurable: true },
|
|
82
249
|
guard: { value: guard, enumerable: true },
|
|
@@ -106,26 +273,138 @@ export function addGuardedNode(graph, name, guard, toolScope, fn, options = {})
|
|
|
106
273
|
* The context function receives the raw invoke arguments. `ToolNode` passes a
|
|
107
274
|
* tool call object, so the arguments the model proposed are at `input.args`;
|
|
108
275
|
* a direct `tool.invoke({...})` passes them at the top level. `toolArgs` below
|
|
109
|
-
* reads either shape
|
|
276
|
+
* reads either shape — and, on a `schemaVersion: 2` guard, feeds a single
|
|
277
|
+
* IMMUTABLE snapshot taken BEFORE `tool.invoke` runs, reused for both
|
|
278
|
+
* `authorizedParams` and `invokedParams`: this adapter's closest analogue of "the
|
|
279
|
+
* exact tool-call JSON object" the execution-binding spec names (see the module
|
|
280
|
+
* doc comment's "Execution binding" section; this is the one construct in this
|
|
281
|
+
* adapter that wraps a tool BODY, so it is the reference wiring for
|
|
282
|
+
* `recordOutcome`, mirroring `guardNode` above).
|
|
110
283
|
*/
|
|
111
284
|
export function guardTool(guard, tool, options = {}) {
|
|
112
285
|
const scope = options.scope ?? tool.name;
|
|
113
286
|
const label = options.tool !== undefined ? options.tool : tool.name;
|
|
114
|
-
const
|
|
287
|
+
const isAsyncInvoke = tool.invoke.constructor.name === "AsyncFunction";
|
|
288
|
+
// guard.schemaVersion never changes for a guard's lifetime — decided once, at wrap time, same
|
|
289
|
+
// as guardNode.
|
|
290
|
+
const v2 = guard.schemaVersion === 2;
|
|
291
|
+
const capture = isAsyncInvoke ? Capture.WRAPPER_ASYNC : Capture.WRAPPER_SYNC;
|
|
292
|
+
const adapterInfo = {
|
|
293
|
+
module: "attenu-guard/adapters/langgraph",
|
|
294
|
+
version: VERSION,
|
|
295
|
+
hookPath: `guardTool:${tool.name}`,
|
|
296
|
+
};
|
|
297
|
+
function snapshotToolParams(input) {
|
|
298
|
+
const raw = toolArgs(input);
|
|
299
|
+
try {
|
|
300
|
+
return structuredClone(raw);
|
|
301
|
+
}
|
|
302
|
+
catch {
|
|
303
|
+
return raw;
|
|
304
|
+
}
|
|
305
|
+
}
|
|
306
|
+
function authorize(input, config, snapshot) {
|
|
115
307
|
const context = options.contextFn ? options.contextFn(input, config) : {};
|
|
308
|
+
const extra = v2 ? { capture, adapter: adapterInfo, authorizedParams: snapshot ?? undefined } : {};
|
|
116
309
|
const decision = guard.check(scope, {
|
|
117
310
|
context,
|
|
118
311
|
tool: label,
|
|
119
312
|
disposition: options.disposition ?? null,
|
|
120
313
|
metered: options.metered ?? false,
|
|
314
|
+
...extra,
|
|
121
315
|
});
|
|
122
|
-
if (!decision.allowed)
|
|
123
|
-
if (options.onDenied)
|
|
124
|
-
return options.onDenied(decision, input);
|
|
316
|
+
if (!decision.allowed)
|
|
125
317
|
throw new AuthorityDenied(decision);
|
|
318
|
+
return decision;
|
|
319
|
+
}
|
|
320
|
+
/** `authorize`, but returns `{denied: ...}` instead of throwing when `onDenied` is set. */
|
|
321
|
+
function authorizeOrDenied(input, config, snapshot) {
|
|
322
|
+
try {
|
|
323
|
+
return { decision: authorize(input, config, snapshot) };
|
|
126
324
|
}
|
|
127
|
-
|
|
128
|
-
|
|
325
|
+
catch (exc) {
|
|
326
|
+
if (exc instanceof AuthorityDenied && options.onDenied) {
|
|
327
|
+
return { denied: options.onDenied(exc.decision, input) };
|
|
328
|
+
}
|
|
329
|
+
throw exc;
|
|
330
|
+
}
|
|
331
|
+
}
|
|
332
|
+
let guardedInvoke;
|
|
333
|
+
if (isAsyncInvoke && v2) {
|
|
334
|
+
guardedInvoke = async (input, config) => {
|
|
335
|
+
const snapshot = snapshotToolParams(input);
|
|
336
|
+
const outcome = authorizeOrDenied(input, config, snapshot);
|
|
337
|
+
if ("denied" in outcome)
|
|
338
|
+
return outcome.denied;
|
|
339
|
+
const start = performance.now();
|
|
340
|
+
try {
|
|
341
|
+
const result = await tool.invoke(input, config);
|
|
342
|
+
guard.recordOutcome(outcome.decision.callId, bodyStateFor(result), {
|
|
343
|
+
invokedParams: snapshot,
|
|
344
|
+
durationMs: elapsedMs(start),
|
|
345
|
+
});
|
|
346
|
+
return result;
|
|
347
|
+
}
|
|
348
|
+
catch (exc) {
|
|
349
|
+
if (isAbortError(exc)) {
|
|
350
|
+
guard.recordOutcome(outcome.decision.callId, BodyState.ABANDONED, {
|
|
351
|
+
invokedParams: snapshot,
|
|
352
|
+
durationMs: elapsedMs(start),
|
|
353
|
+
});
|
|
354
|
+
}
|
|
355
|
+
else {
|
|
356
|
+
guard.recordOutcome(outcome.decision.callId, BodyState.RAISED, {
|
|
357
|
+
errorCode: errorCodeOf(exc),
|
|
358
|
+
invokedParams: snapshot,
|
|
359
|
+
durationMs: elapsedMs(start),
|
|
360
|
+
});
|
|
361
|
+
}
|
|
362
|
+
throw exc;
|
|
363
|
+
}
|
|
364
|
+
};
|
|
365
|
+
}
|
|
366
|
+
else if (isAsyncInvoke) {
|
|
367
|
+
// v1: EXACTLY the pre-0.9.0 shape — a plain SYNC function that authorizes, then returns
|
|
368
|
+
// tool.invoke(...) UNAWAITED (the caller — typically ToolNode's own `await` — consumes the
|
|
369
|
+
// returned promise itself, as it always has).
|
|
370
|
+
guardedInvoke = (input, config) => {
|
|
371
|
+
const outcome = authorizeOrDenied(input, config, null);
|
|
372
|
+
if ("denied" in outcome)
|
|
373
|
+
return outcome.denied;
|
|
374
|
+
return tool.invoke(input, config);
|
|
375
|
+
};
|
|
376
|
+
}
|
|
377
|
+
else {
|
|
378
|
+
guardedInvoke = (input, config) => {
|
|
379
|
+
if (!v2) {
|
|
380
|
+
const outcome = authorizeOrDenied(input, config, null);
|
|
381
|
+
if ("denied" in outcome)
|
|
382
|
+
return outcome.denied;
|
|
383
|
+
return tool.invoke(input, config);
|
|
384
|
+
}
|
|
385
|
+
const snapshot = snapshotToolParams(input);
|
|
386
|
+
const outcome = authorizeOrDenied(input, config, snapshot);
|
|
387
|
+
if ("denied" in outcome)
|
|
388
|
+
return outcome.denied;
|
|
389
|
+
const start = performance.now();
|
|
390
|
+
try {
|
|
391
|
+
const result = tool.invoke(input, config);
|
|
392
|
+
guard.recordOutcome(outcome.decision.callId, bodyStateFor(result), {
|
|
393
|
+
invokedParams: snapshot,
|
|
394
|
+
durationMs: elapsedMs(start),
|
|
395
|
+
});
|
|
396
|
+
return result;
|
|
397
|
+
}
|
|
398
|
+
catch (exc) {
|
|
399
|
+
guard.recordOutcome(outcome.decision.callId, BodyState.RAISED, {
|
|
400
|
+
errorCode: errorCodeOf(exc),
|
|
401
|
+
invokedParams: snapshot,
|
|
402
|
+
durationMs: elapsedMs(start),
|
|
403
|
+
});
|
|
404
|
+
throw exc;
|
|
405
|
+
}
|
|
406
|
+
};
|
|
407
|
+
}
|
|
129
408
|
return new Proxy(tool, {
|
|
130
409
|
get(target, prop, receiver) {
|
|
131
410
|
if (prop === "invoke")
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"langgraph.js","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,eAAe,EAAc,MAAM,aAAa,CAAC;AA4B1D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CACvB,KAAY,EACZ,SAAiB,EACjB,EAAK,EACL,UAAwB,EAAE;IAE1B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IAEnF,MAAM,OAAO,GAAG,UAAyB,GAAG,IAAW;QACrD,MAAM,OAAO,GAAY,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE;YACtC,OAAO;YACP,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAmB,CAAC;IAEpB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE;QAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;QACzC,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE;QACjD,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;KAC3C,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAgB,EAChB,IAAY,EACZ,KAAY,EACZ,SAAiB,EACjB,EAAK,EACL,UAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACtD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAoBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CACvB,KAAY,EACZ,IAAO,EACP,UAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAEpE,MAAM,aAAa,GAAG,CAAC,KAAU,EAAE,MAAY,EAAE,EAAE;QACjD,MAAM,OAAO,GAAY,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;YAClC,OAAO;YACP,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,QAAQ;gBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE;QACrB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACxB,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,aAAa,CAAC;YAC5C,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO,KAAK,CAAC;YACxC,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO,KAAK,CAAC;YACxC,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC3D,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5F,CAAC;KACF,CAAM,CAAC;AACV,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAU5C;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,KAAY,EACZ,KAAmB,EACnB,UAA6B,EAAE;IAE/B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE;QAClB,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI;QACzC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,SAAS;QAC1D,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;QACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAU;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAA2B,CAAC;IACpF,CAAC;IACD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAwB,CAAC;AAC9C,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAa,EAAE,OAAwB;IAChE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,SAAS,GAAG,sBAAsB,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"langgraph.js","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAAE,eAAe,EAAgC,MAAM,aAAa,CAAC;AAI5E,OAAO,EAAE,SAAS,EAAE,OAAO,EAAiB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAyBxC;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,IAAwB;IAC9C,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,GAAG,CAAoB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,8FAA8F;QAC9F,wFAAwF;QACxF,wFAAwF;QACxF,OAAO,GAAsB,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,MAAe;IACvC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,CAAC,GAAG,MAAsC,CAAC;IACjD,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7F,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAClG,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,MAAe;IACnC,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;AAC3D,CAAC;AAED,qHAAqH;AACrH,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,OAAO,CAAC;IACjE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CACvB,KAAY,EACZ,SAAiB,EACjB,EAAK,EACL,UAAwB,EAAE;IAE1B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,eAAe,CAAC;IAC1D,0FAA0F;IAC1F,6FAA6F;IAC7F,kCAAkC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACzE,MAAM,WAAW,GAAgB;QAC/B,MAAM,EAAE,iCAAiC;QACzC,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,aAAa,EAAE,CAAC,IAAI,IAAI,SAAS,EAAE;KAC9C,CAAC;IAEF,SAAS,SAAS,CAAC,IAAe,EAAE,QAAqB;QACvD,MAAM,OAAO,GAAY,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE;YACtC,OAAO;YACP,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;YACjC,GAAG,KAAK;SACT,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAuB,CAAC;IAC5B,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,KAAK,WAA0B,GAAG,IAAW;YACtD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC1C,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAO,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE;oBAC1D,aAAa,EAAE,QAAQ;oBACvB,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;iBAC7B,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,8EAA8E;gBAC9E,oFAAoF;gBACpF,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAO,EAAE,SAAS,CAAC,SAAS,EAAE;wBACzD,aAAa,EAAE,QAAQ;wBACvB,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;qBAC7B,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAO,EAAE,SAAS,CAAC,MAAM,EAAE;wBACtD,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC;wBAC3B,aAAa,EAAE,QAAQ;wBACvB,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;qBAC7B,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAA8B,CAAC;IAClC,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,yFAAyF;QACzF,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB;QAChB,OAAO,GAAG,CAAC,UAAyB,GAAG,IAAW;YAChD,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtB,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC,CAA8B,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,CAAC,UAAyB,GAAG,IAAW;YAChD,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACtB,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACpC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAO,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE;oBAC1D,aAAa,EAAE,QAAQ;oBACvB,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;iBAC7B,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAO,EAAE,SAAS,CAAC,MAAM,EAAE;oBACtD,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC;oBAC3B,aAAa,EAAE,QAAQ;oBACvB,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;iBAC7B,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAA8B,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE;QAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;QAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;QACzC,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE;QACjD,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;KAC3C,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAgB,EAChB,IAAY,EACZ,KAAY,EACZ,SAAiB,EACjB,EAAK,EACL,UAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACtD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,SAAS,CACvB,KAAY,EACZ,IAAO,EACP,UAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,eAAe,CAAC;IACvE,8FAA8F;IAC9F,gBAAgB;IAChB,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7E,MAAM,WAAW,GAAgB;QAC/B,MAAM,EAAE,iCAAiC;QACzC,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,aAAa,IAAI,CAAC,IAAI,EAAE;KACnC,CAAC;IAEF,SAAS,kBAAkB,CAAC,KAAU;QACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,GAAG,CAAoB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAsB,CAAC;QAChC,CAAC;IACH,CAAC;IAED,SAAS,SAAS,CAAC,KAAU,EAAE,MAAW,EAAE,QAAqB;QAC/D,MAAM,OAAO,GAAY,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;YAClC,OAAO;YACP,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;YACjC,GAAG,KAAK;SACT,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,2FAA2F;IAC3F,SAAS,iBAAiB,CACxB,KAAU,EACV,MAAW,EACX,QAAqB;QAErB,IAAI,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACvD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3D,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,aAAgD,CAAC;IACrD,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;QACxB,aAAa,GAAG,KAAK,EAAE,KAAU,EAAE,MAAY,EAAE,EAAE;YACjD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,QAAQ,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC;YAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAChD,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAO,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE;oBAClE,aAAa,EAAE,QAAQ;oBACvB,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;iBAC7B,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAO,EAAE,SAAS,CAAC,SAAS,EAAE;wBACjE,aAAa,EAAE,QAAQ;wBACvB,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;qBAC7B,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAO,EAAE,SAAS,CAAC,MAAM,EAAE;wBAC9D,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC;wBAC3B,aAAa,EAAE,QAAQ;wBACvB,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;qBAC7B,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;SAAM,IAAI,aAAa,EAAE,CAAC;QACzB,wFAAwF;QACxF,2FAA2F;QAC3F,8CAA8C;QAC9C,aAAa,GAAG,CAAC,KAAU,EAAE,MAAY,EAAE,EAAE;YAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,QAAQ,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,CAAC,KAAU,EAAE,MAAY,EAAE,EAAE;YAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACvD,IAAI,QAAQ,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC,MAAM,CAAC;gBAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,QAAQ,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC;YAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC1C,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAO,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE;oBAClE,aAAa,EAAE,QAAQ;oBACvB,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;iBAC7B,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAO,EAAE,SAAS,CAAC,MAAM,EAAE;oBAC9D,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC;oBAC3B,aAAa,EAAE,QAAQ;oBACvB,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;iBAC7B,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE;QACrB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACxB,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,aAAa,CAAC;YAC5C,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO,KAAK,CAAC;YACxC,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO,KAAK,CAAC;YACxC,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC3D,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5F,CAAC;KACF,CAAM,CAAC;AACV,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAU5C;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,KAAY,EACZ,KAAmB,EACnB,UAA6B,EAAE;IAE/B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE;QAClB,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI;QACzC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,SAAS;QAC1D,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;QACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAU;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAA2B,CAAC;IACpF,CAAC;IACD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAwB,CAAC;AAC9C,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAa,EAAE,OAAwB;IAChE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,SAAS,GAAG,sBAAsB,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
|
package/dist/esm/audit.d.ts
CHANGED
|
@@ -11,6 +11,7 @@
|
|
|
11
11
|
* identical content — see `canonical.ts` for how that is guaranteed.
|
|
12
12
|
*/
|
|
13
13
|
import { type CJson } from "./canonical.js";
|
|
14
|
+
import type { Decision } from "./reasons.js";
|
|
14
15
|
import type { Signer } from "./wire.js";
|
|
15
16
|
export declare const SCHEMA_VERSION = 1;
|
|
16
17
|
export declare const GENESIS: string;
|
|
@@ -36,16 +37,52 @@ export interface Anchor {
|
|
|
36
37
|
}
|
|
37
38
|
/** `sha256(prev_hash || canonical(event-without-hash))`, as hex. */
|
|
38
39
|
export declare function hashEntry(prevHash: string, payload: LedgerEntry): string;
|
|
40
|
+
/**
|
|
41
|
+
* Thrown by `AuditLog.append` when the entry was committed to the in-memory chain but persisting
|
|
42
|
+
* it afterward (the audit-path file write, or a sink) threw.
|
|
43
|
+
*
|
|
44
|
+
* The entry IS committed — it is in `.entries`/`.head()` and every later `hash`/`prev_hash` is
|
|
45
|
+
* computed on top of it. Callers must not retry the operation that produced this entry merely
|
|
46
|
+
* because this was thrown: retrying would record it a second time. The original error is chained
|
|
47
|
+
* as `.cause` (the standard `Error` cause, same as Python's `__cause__`).
|
|
48
|
+
*/
|
|
49
|
+
export declare class CommittedAuditError extends Error {
|
|
50
|
+
readonly entry: LedgerEntry;
|
|
51
|
+
/**
|
|
52
|
+
* Set by `Guard.check`/`Guard.recordDenial` before this propagates out of them (0.9.0
|
|
53
|
+
* execution binding — spec section 1: "carries the committed entry and the decision"). Absent
|
|
54
|
+
* for a `CommittedAuditError` raised by an `AuditLog` used directly, without a `Guard`.
|
|
55
|
+
*/
|
|
56
|
+
decision?: Decision;
|
|
57
|
+
constructor(entry: LedgerEntry, cause: unknown);
|
|
58
|
+
}
|
|
39
59
|
export interface AuditLogInit {
|
|
40
60
|
/** Where to append the `.jsonl` ledger. Omit for an in-memory log. */
|
|
41
61
|
path?: string | null;
|
|
42
62
|
/** Local sinks; each gets every entry after the file write. */
|
|
43
63
|
sinks?: readonly Sink[];
|
|
64
|
+
/**
|
|
65
|
+
* 0.9.0: the schema version this WHOLE chain is created at (1, the default and unchanged
|
|
66
|
+
* behaviour, or 2 — execution binding). Stated once, on `v` of every entry (see
|
|
67
|
+
* `Guard.issue({schemaVersion})`); a chain never mixes schema versions.
|
|
68
|
+
*/
|
|
69
|
+
schemaVersion?: number;
|
|
70
|
+
/**
|
|
71
|
+
* Allow constructing over a `path` that already names a non-empty file, replacing it. Default
|
|
72
|
+
* `false`: refuse (`Error`) rather than silently truncate a pre-existing ledger.
|
|
73
|
+
*/
|
|
74
|
+
overwrite?: boolean;
|
|
44
75
|
}
|
|
45
76
|
/** Append-only, hash-chained decision log. */
|
|
46
77
|
export declare class AuditLog {
|
|
47
78
|
readonly path: string | null;
|
|
48
|
-
|
|
79
|
+
readonly schemaVersion: number;
|
|
80
|
+
/**
|
|
81
|
+
* Local sinks; each gets every entry after the file write. Public and mutable (not just
|
|
82
|
+
* constructor-supplied) so a caller — or a test simulating a post-commit persistence failure —
|
|
83
|
+
* can swap them in after construction.
|
|
84
|
+
*/
|
|
85
|
+
sinks: readonly Sink[];
|
|
49
86
|
private prev;
|
|
50
87
|
private seq;
|
|
51
88
|
private readonly _entries;
|
package/dist/esm/audit.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EAKL,KAAK,KAAK,EACX,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,eAAO,MAAM,cAAc,IAAI,CAAC;AAChC,eAAO,MAAM,OAAO,QAAiB,CAAC;AAEtC,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,WAAW,IAAI;IACnB,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CACjC;AAED,oDAAoD;AACpD,MAAM,WAAW,MAAM;IACrB,CAAC,EAAE,MAAM,CAAC;IACV,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;CAClC;AAED,oEAAoE;AACpE,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAKxE;AAeD,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EAKL,KAAK,KAAK,EACX,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,eAAO,MAAM,cAAc,IAAI,CAAC;AAChC,eAAO,MAAM,OAAO,QAAiB,CAAC;AAEtC,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,WAAW,IAAI;IACnB,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CACjC;AAED,oDAAoD;AACpD,MAAM,WAAW,MAAM;IACrB,CAAC,EAAE,MAAM,CAAC;IACV,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;CAClC;AAED,oEAAoE;AACpE,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAKxE;AAeD;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAS1C,QAAQ,CAAC,KAAK,EAAE,WAAW;IAR7B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;gBAGT,KAAK,EAAE,WAAW,EAC3B,KAAK,EAAE,OAAO;CASjB;AAED,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC;IACxB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,8CAA8C;AAC9C,qBAAa,QAAQ;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IACvB,OAAO,CAAC,IAAI,CAAW;IACvB,OAAO,CAAC,GAAG,CAAK;IAChB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C;;;;OAIG;gBACS,IAAI,GAAE,YAAY,GAAG,MAAM,GAAG,IAAS;IAoBnD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,GAAE,WAAgB,GAAG,WAAW;IAyBjF,IAAI,OAAO,IAAI,WAAW,EAAE,CAE3B;IAED,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC;IAM1C,kFAAkF;IAClF,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;IAMxB,OAAO,CAAC,WAAW;IAInB;;;;;OAKG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAE,MAAM,GAAG,MAAU,GAAG,MAAM;IAUvD,iEAAiE;IACjE,MAAM,CAAC,YAAY,CACjB,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,SAAS,EAChD,MAAM,EAAE,MAAM,GACb,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IA6B3B,2DAA2D;IAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAsBxE,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE;IAIxC,iEAAiE;IACjE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE;CAM/C;AAOD,4DAA4D;AAC5D,wBAAgB,SAAS,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAMjE"}
|
package/dist/esm/audit.js
CHANGED
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
* identical content — see `canonical.ts` for how that is guaranteed.
|
|
12
12
|
*/
|
|
13
13
|
import { createHash } from "node:crypto";
|
|
14
|
-
import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
|
|
14
|
+
import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
|
|
15
15
|
import { dirname } from "node:path";
|
|
16
16
|
import { canonicalBytes, canonicalJson, parseJson, toPlain, } from "./canonical.js";
|
|
17
17
|
export const SCHEMA_VERSION = 1;
|
|
@@ -35,9 +35,39 @@ function withoutHash(entry) {
|
|
|
35
35
|
}
|
|
36
36
|
return out;
|
|
37
37
|
}
|
|
38
|
+
/**
|
|
39
|
+
* Thrown by `AuditLog.append` when the entry was committed to the in-memory chain but persisting
|
|
40
|
+
* it afterward (the audit-path file write, or a sink) threw.
|
|
41
|
+
*
|
|
42
|
+
* The entry IS committed — it is in `.entries`/`.head()` and every later `hash`/`prev_hash` is
|
|
43
|
+
* computed on top of it. Callers must not retry the operation that produced this entry merely
|
|
44
|
+
* because this was thrown: retrying would record it a second time. The original error is chained
|
|
45
|
+
* as `.cause` (the standard `Error` cause, same as Python's `__cause__`).
|
|
46
|
+
*/
|
|
47
|
+
export class CommittedAuditError extends Error {
|
|
48
|
+
entry;
|
|
49
|
+
/**
|
|
50
|
+
* Set by `Guard.check`/`Guard.recordDenial` before this propagates out of them (0.9.0
|
|
51
|
+
* execution binding — spec section 1: "carries the committed entry and the decision"). Absent
|
|
52
|
+
* for a `CommittedAuditError` raised by an `AuditLog` used directly, without a `Guard`.
|
|
53
|
+
*/
|
|
54
|
+
decision;
|
|
55
|
+
constructor(entry, cause) {
|
|
56
|
+
super(`entry seq=${String(toPlain(entry["seq"]))} was committed to the audit log, but persisting ` +
|
|
57
|
+
`it failed: ${String(cause)}`, { cause });
|
|
58
|
+
this.entry = entry;
|
|
59
|
+
this.name = "CommittedAuditError";
|
|
60
|
+
}
|
|
61
|
+
}
|
|
38
62
|
/** Append-only, hash-chained decision log. */
|
|
39
63
|
export class AuditLog {
|
|
40
64
|
path;
|
|
65
|
+
schemaVersion;
|
|
66
|
+
/**
|
|
67
|
+
* Local sinks; each gets every entry after the file write. Public and mutable (not just
|
|
68
|
+
* constructor-supplied) so a caller — or a test simulating a post-commit persistence failure —
|
|
69
|
+
* can swap them in after construction.
|
|
70
|
+
*/
|
|
41
71
|
sinks;
|
|
42
72
|
prev = GENESIS;
|
|
43
73
|
seq = 0;
|
|
@@ -51,14 +81,22 @@ export class AuditLog {
|
|
|
51
81
|
const opts = typeof init === "string" || init === null ? { path: init } : init;
|
|
52
82
|
this.path = opts.path ?? null;
|
|
53
83
|
this.sinks = opts.sinks ?? [];
|
|
84
|
+
this.schemaVersion = opts.schemaVersion ?? SCHEMA_VERSION;
|
|
85
|
+
if (this.schemaVersion !== 1 && this.schemaVersion !== 2) {
|
|
86
|
+
throw new Error(`unsupported schemaVersion ${this.schemaVersion}; expected 1 or 2`);
|
|
87
|
+
}
|
|
54
88
|
if (this.path) {
|
|
55
89
|
mkdirSync(dirname(this.path), { recursive: true });
|
|
90
|
+
if (existsSync(this.path) && statSync(this.path).size > 0 && !opts.overwrite) {
|
|
91
|
+
throw new Error(`${this.path} already has a ledger; pass overwrite: true to replace it ` +
|
|
92
|
+
"(this permanently discards the existing entries)");
|
|
93
|
+
}
|
|
56
94
|
writeFileSync(this.path, ""); // fresh log
|
|
57
95
|
}
|
|
58
96
|
}
|
|
59
97
|
append(event, ts, fields = {}) {
|
|
60
98
|
const payload = {
|
|
61
|
-
v:
|
|
99
|
+
v: this.schemaVersion,
|
|
62
100
|
c14n: "JCS",
|
|
63
101
|
seq: this.seq,
|
|
64
102
|
ts,
|
|
@@ -69,12 +107,17 @@ export class AuditLog {
|
|
|
69
107
|
payload["hash"] = hashEntry(this.prev, payload);
|
|
70
108
|
this.prev = payload["hash"];
|
|
71
109
|
this.seq += 1;
|
|
72
|
-
this._entries.push(payload);
|
|
73
|
-
|
|
74
|
-
|
|
110
|
+
this._entries.push(payload); // committed: the entry now exists in the chain
|
|
111
|
+
try {
|
|
112
|
+
if (this.path) {
|
|
113
|
+
appendFileSync(this.path, canonicalJson(payload) + "\n");
|
|
114
|
+
}
|
|
115
|
+
for (const sink of this.sinks)
|
|
116
|
+
sink.write(payload); // local files only — never the network
|
|
117
|
+
}
|
|
118
|
+
catch (cause) {
|
|
119
|
+
throw new CommittedAuditError(payload, cause);
|
|
75
120
|
}
|
|
76
|
-
for (const sink of this.sinks)
|
|
77
|
-
sink.write(payload);
|
|
78
121
|
return payload;
|
|
79
122
|
}
|
|
80
123
|
get entries() {
|
|
@@ -105,7 +148,7 @@ export class AuditLog {
|
|
|
105
148
|
*/
|
|
106
149
|
anchor(signer, ts = 0) {
|
|
107
150
|
const [seq, head] = this.head();
|
|
108
|
-
const body = { v:
|
|
151
|
+
const body = { v: this.schemaVersion, c14n: "JCS", chain_id: this.chainIdHint(), seq, head, ts };
|
|
109
152
|
return {
|
|
110
153
|
...body,
|
|
111
154
|
kid: signer.kid ?? null,
|
|
@@ -136,6 +179,9 @@ export class AuditLog {
|
|
|
136
179
|
return [false, err];
|
|
137
180
|
if (entries.length === 0)
|
|
138
181
|
return [asNumber(a["seq"]) === -1, null];
|
|
182
|
+
if (toPlain(a["chain_id"]) !== firstChainId(entries)) {
|
|
183
|
+
return [false, "anchor chain_id does not match the ledger entries"];
|
|
184
|
+
}
|
|
139
185
|
const last = entries[entries.length - 1];
|
|
140
186
|
if (last["hash"] !== toPlain(a["head"]) || asNumber(last["seq"]) !== asNumber(a["seq"])) {
|
|
141
187
|
return [false, "anchor head does not match the ledger head (ledger rewritten?)"];
|
|
@@ -189,4 +235,18 @@ export function chainIdOf(entries) {
|
|
|
189
235
|
}
|
|
190
236
|
return "chain";
|
|
191
237
|
}
|
|
238
|
+
/**
|
|
239
|
+
* The first `chain_id` any entry carries, or `null` if none do. Unlike
|
|
240
|
+
* `chainIdOf` (which defaults to `"chain"` for display/anchoring purposes),
|
|
241
|
+
* `verifyAnchor` needs to know whether the entries genuinely assert a chain
|
|
242
|
+
* identity at all, so a missing one is `null`, not a fabricated default.
|
|
243
|
+
*/
|
|
244
|
+
function firstChainId(entries) {
|
|
245
|
+
for (const e of entries) {
|
|
246
|
+
const id = toPlain(e["chain_id"]);
|
|
247
|
+
if (typeof id === "string" && id)
|
|
248
|
+
return id;
|
|
249
|
+
}
|
|
250
|
+
return null;
|
|
251
|
+
}
|
|
192
252
|
//# sourceMappingURL=audit.js.map
|
package/dist/esm/audit.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,cAAc,EACd,aAAa,EACb,SAAS,EACT,OAAO,GAER,MAAM,gBAAgB,CAAC;AAIxB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAyBtC,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,OAAoB;IAC9D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAwB;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,MAAM;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IASjC;IARX;;;;OAIG;IACH,QAAQ,CAAY;IAEpB,YACW,KAAkB,EAC3B,KAAc;QAEd,KAAK,CACH,aAAa,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,kDAAkD;YAC1F,cAAc,MAAM,CAAC,KAAK,CAAC,EAAE,EAC/B,EAAE,KAAK,EAAE,CACV,CAAC;QAPO,UAAK,GAAL,KAAK,CAAa;QAQ3B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAoBD,8CAA8C;AAC9C,MAAM,OAAO,QAAQ;IACV,IAAI,CAAgB;IACpB,aAAa,CAAS;IAC/B;;;;OAIG;IACH,KAAK,CAAkB;IACf,IAAI,GAAG,OAAO,CAAC;IACf,GAAG,GAAG,CAAC,CAAC;IACC,QAAQ,GAAkB,EAAE,CAAC;IAE9C;;;;OAIG;IACH,YAAY,OAAqC,EAAE;QACjD,MAAM,IAAI,GAAiB,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC;QAC1D,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,aAAa,mBAAmB,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,4DAA4D;oBACtE,kDAAkD,CACrD,CAAC;YACJ,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,EAAmB,EAAE,SAAsB,EAAE;QACjE,MAAM,OAAO,GAAgB;YAC3B,CAAC,EAAE,IAAI,CAAC,aAAa;YACrB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,EAAE;YACF,KAAK;YACL,GAAG,MAAM;YACT,SAAS,EAAE,IAAI,CAAC,IAAI;SACrB,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAW,CAAC;QACtC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACd,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,+CAA+C;QAC5E,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3D,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC;QAC7F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,0EAA0E;IAE1E,kFAAkF;IAClF,IAAI;QACF,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QACtD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAE,EAAE,IAAI,CAAC,MAAM,CAAW,CAAC,CAAC;IAC1D,CAAC;IAEO,WAAW;QACjB,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAAc,EAAE,KAAsB,CAAC;QAC5C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,KAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC1G,OAAO;YACL,GAAG,IAAI;YACP,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI;YACvB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,MAAM,CAAC,YAAY,CACjB,OAA+B,EAC/B,MAAgD,EAChD,MAAc;QAEd,MAAM,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAA0B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC/E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,UAAU;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC9E,CAAC;QACD,MAAM,MAAM,GAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAY,IAAI,EAAE,CAAC;QACnD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAkB,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,KAAK,EAAE,mDAAmD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxF,OAAO,CAAC,KAAK,EAAE,gEAAgE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,MAAM,CAAC,OAA+B;QAC3C,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/B,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxB,OAAO,CAAC,KAAK,EAAE,cAAc,WAAW,SAAS,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,OAAO,CAAC,KAAK,EAAE,6BAA6B,WAAW,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,EAAE,wBAAwB,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,GAAG,MAAgB,CAAC;YACxB,WAAW,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,IAAY;QACtB,OAAO,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,iEAAiE;IACjE,MAAM,CAAC,UAAU,CAAC,IAAY;QAC5B,OAAO,IAAI;aACR,KAAK,CAAC,OAAO,CAAC;aACd,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;aACpC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAgB,CAAC,CAAC;IACnD,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAwB;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,SAAS,CAAC,OAA+B;IACvD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,OAA+B;IACnD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|