codexgpt 1.0.0

package/dist/control/localApprovalServer.js

@@ -0,0 +1,466 @@
+import { AuthConfigurationError } from "../auth/errors.js";
+import { riskLimits } from "../policy/approval.js";
+import { ApprovalQueueError } from "../policy/pendingApprovals.js";
+import { localControlRequestV3Schema, localControlResponseV3Schema, localServerIdSchema } from "./schemas.js";
+function isOAuthAuditUnavailable(error) {
+    return error instanceof AuthConfigurationError && error.code === "OAUTH_AUDIT_FAILURE";
+}
+function delay(milliseconds) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, milliseconds);
+        timer.unref?.();
+    });
+}
+function safeApproval(record, display) {
+    return {
+        approvalId: record.approvalId,
+        state: record.state,
+        riskClass: record.facts.riskClass,
+        createdAt: record.createdAt,
+        expiresAt: record.expiresAt,
+        grantId: record.grantId,
+        reservationId: record.reservationId,
+        summary: {
+            ...structuredClone(display ?? record.summary),
+            revealArguments: [...((display ?? record.summary).revealArguments ?? [])]
+        }
+    };
+}
+function contextFor(record, grantRevision, receivedAt) {
+    const local = record.facts.transportKind === "stdio";
+    return {
+        schemaVersion: 1,
+        requestId: `request_${record.approvalId.slice("approval_".length)}`,
+        transportKind: local ? "stdio" : "streamable_http",
+        transportSessionId: record.facts.transportSessionId,
+        identity: {
+            schemaVersion: 1,
+            kind: local ? "local_process" : record.facts.identitySubject ? "oauth_subject" : "shared_secret_bearer",
+            authenticationMode: local ? "stdio" : record.facts.identitySubject ? "oauth2" : "bearer",
+            credentialRef: record.facts.credentialRef,
+            subject: record.facts.identitySubject,
+            scopes: [],
+            assuranceLevel: local ? "local" : record.facts.identitySubject ? "strong" : "shared_secret"
+        },
+        workspaceId: record.facts.workspaceId,
+        runtimeProfileId: "runtime-v3",
+        permissionProfileId: "approval-v3",
+        policyRevision: record.facts.policyRevision,
+        sessionGrantRevision: grantRevision,
+        receivedAt
+    };
+}
+export function escapeTerminalText(value, maximum = 160) {
+    let output = "";
+    for (const character of value.normalize("NFC")) {
+        const code = character.codePointAt(0);
+        const printableAscii = code >= 0x20 && code <= 0x7e;
+        const safe = printableAscii && character !== "\\";
+        const encoded = safe ? character : `\\u{${code.toString(16).toUpperCase().padStart(4, "0")}}`;
+        if (output.length + encoded.length > maximum) {
+            output += "...";
+            break;
+        }
+        output += encoded;
+    }
+    return output;
+}
+export function renderApprovalSummary(record) {
+    const lines = [
+        `Approval: ${escapeTerminalText(record.approvalId)}`,
+        `State: ${escapeTerminalText(record.state)}`,
+        `Backend: ${escapeTerminalText(record.summary.backend)}`,
+        `Action: ${escapeTerminalText(record.summary.actionKind)}`,
+        `Arguments: ${record.summary.argumentCount}`,
+        `Scope: ${escapeTerminalText(record.summary.logicalScope)}`,
+        `Identity: ${escapeTerminalText(record.summary.identityLabel)}`,
+        `Authority: ${escapeTerminalText(record.summary.authoritySummary)}`,
+        `Risk: ${record.facts.riskClass}`,
+        `Expires: ${record.expiresAt}`,
+        `Digest: ${record.summary.digestPrefix}`
+    ];
+    return lines.join("\n");
+}
+export function renderLocalApprovalEntry(record, options = {}) {
+    const lines = [
+        `Approval: ${escapeTerminalText(record.approvalId)}`,
+        `State: ${escapeTerminalText(record.state)}`,
+        `Backend: ${escapeTerminalText(record.summary.backend)}`,
+        `Action: ${escapeTerminalText(record.summary.actionKind)}`,
+        `Arguments: ${record.summary.argumentCount}`,
+        `Scope: ${escapeTerminalText(record.summary.logicalScope)}`,
+        `Identity: ${escapeTerminalText(record.summary.identityLabel)}`,
+        `Authority: ${escapeTerminalText(record.summary.authoritySummary)}`,
+        `Risk: ${record.riskClass}`,
+        `Expires: ${record.expiresAt}`,
+        `Digest: ${record.summary.digestPrefix}`
+    ];
+    if (options.reveal) {
+        for (let index = 0; index < record.summary.revealArguments.length; index += 1) {
+            lines.push(`Arg ${index + 1}: ${escapeTerminalText(record.summary.revealArguments[index], 240)}`);
+        }
+    }
+    return lines.join("\n");
+}
+export class LocalApprovalServer {
+    serverId;
+    #approvals;
+    #grants;
+    #processes;
+    #now;
+    #prepareApproval;
+    #displayApproval;
+    #oauthAdminBootstrap;
+    #oauthBackups;
+    #oauthSigningKeys;
+    #oauthAuthorizations;
+    #oauthClients;
+    #oauthGrants;
+    #mutationTail = Promise.resolve();
+    constructor(options) {
+        this.serverId = localServerIdSchema.parse(options.serverId);
+        this.#approvals = options.approvals;
+        this.#grants = options.grants;
+        this.#processes = options.processes;
+        this.#now = options.now ?? Date.now;
+        this.#prepareApproval = options.prepareApproval;
+        this.#displayApproval = options.displayApproval;
+        this.#oauthAdminBootstrap = options.oauthAdminBootstrap;
+        this.#oauthBackups = options.oauthBackups;
+        this.#oauthSigningKeys = options.oauthSigningKeys;
+        this.#oauthAuthorizations = options.oauthAuthorizations;
+        this.#oauthClients = options.oauthClients;
+        this.#oauthGrants = options.oauthGrants;
+    }
+    setApprovalPreparation(callback, display) {
+        this.#prepareApproval = callback;
+        this.#displayApproval = display;
+    }
+    setProcessControl(processes) {
+        this.#processes = processes;
+    }
+    setOAuthAdminBootstrapControl(control) {
+        this.#oauthAdminBootstrap = control;
+    }
+    setOAuthBackupControl(control) {
+        this.#oauthBackups = control;
+    }
+    setOAuthSigningKeyControl(control) {
+        this.#oauthSigningKeys = control;
+    }
+    setOAuthAuthorizationControl(control) {
+        this.#oauthAuthorizations = control;
+    }
+    setOAuthClientControl(control) {
+        this.#oauthClients = control;
+    }
+    setOAuthGrantControl(control) {
+        this.#oauthGrants = control;
+    }
+    async handle(raw) {
+        const request = localControlRequestV3Schema.parse(raw);
+        if (request.serverId !== this.serverId)
+            throw new Error("CONTROL_SERVER_MISMATCH");
+        switch (request.operation) {
+            case "approvals.list":
+                await this.#approvals.expire(new Date(this.#now()).toISOString());
+                await this.#preparePendingApprovals();
+                return this.#response("CONTROL_OK", true, false);
+            case "approvals.watch":
+                return this.#watch(request);
+            case "approvals.approve":
+                return this.#mutate(() => this.#approve(request.approvalId));
+            case "approvals.deny":
+                return this.#mutate(() => this.#deny(request.approvalId));
+            case "processes.list":
+                return this.#processResponse("CONTROL_OK", false, await this.#processes?.list() ?? []);
+            case "processes.terminate": {
+                const changed = await this.#processes?.terminate(request.processId) ?? false;
+                return this.#processResponse(changed ? "PROCESS_TERMINATED" : "PROCESS_NOT_FOUND", changed, await this.#processes?.list() ?? []);
+            }
+            case "oauth.admin.bootstrap": {
+                const oauthAdminBootstrapUrl = await this.#oauthAdminBootstrap?.issue();
+                if (!oauthAdminBootstrapUrl)
+                    return this.#oauthAdminBootstrapResponse("OAUTH_ADMIN_UNAVAILABLE", false, undefined);
+                return this.#oauthAdminBootstrapResponse("OAUTH_ADMIN_BOOTSTRAP_ISSUED", true, oauthAdminBootstrapUrl);
+            }
+            case "oauth.authorizations.list":
+                return this.#oauthAuthorizationResponse("CONTROL_OK", true, false);
+            case "oauth.authorizations.approve":
+                return this.#mutate(async () => {
+                    try {
+                        const changed = await this.#oauthAuthorizations?.approve(request.pendingId) ?? false;
+                        return this.#oauthAuthorizationResponse(changed ? "OAUTH_AUTHORIZATION_APPROVED" : "OAUTH_AUTHORIZATION_NOT_FOUND", changed, changed);
+                    }
+                    catch (error) {
+                        if (isOAuthAuditUnavailable(error))
+                            return this.#oauthAuthorizationResponse("OAUTH_AUDIT_UNAVAILABLE_RUN_CODEXGPT_DOCTOR", false, false);
+                        throw error;
+                    }
+                });
+            case "oauth.authorizations.deny":
+                return this.#mutate(async () => {
+                    try {
+                        const changed = await this.#oauthAuthorizations?.deny(request.pendingId) ?? false;
+                        return this.#oauthAuthorizationResponse(changed ? "OAUTH_AUTHORIZATION_DENIED" : "OAUTH_AUTHORIZATION_NOT_FOUND", changed, changed);
+                    }
+                    catch (error) {
+                        if (isOAuthAuditUnavailable(error))
+                            return this.#oauthAuthorizationResponse("OAUTH_AUDIT_UNAVAILABLE_RUN_CODEXGPT_DOCTOR", false, false);
+                        throw error;
+                    }
+                });
+            case "oauth.clients.list":
+                return this.#oauthClientResponse("CONTROL_OK", true, false);
+            case "oauth.clients.revoke":
+                return this.#mutate(async () => {
+                    try {
+                        await this.#oauthBackups?.create();
+                        const changed = await this.#oauthClients?.revoke(request.clientId) ?? false;
+                        return this.#oauthClientResponse(changed ? "OAUTH_CLIENT_REVOKED" : "OAUTH_CLIENT_NOT_FOUND", changed, changed);
+                    }
+                    catch (error) {
+                        if (isOAuthAuditUnavailable(error))
+                            return this.#oauthClientResponse("OAUTH_AUDIT_UNAVAILABLE_RUN_CODEXGPT_DOCTOR", false, false);
+                        throw error;
+                    }
+                });
+            case "oauth.clients.prune_unapproved":
+                return this.#mutate(async () => {
+                    try {
+                        await this.#oauthBackups?.create();
+                        const count = await this.#oauthClients?.pruneUnapproved() ?? 0;
+                        return this.#oauthClientResponse(count > 0 ? "OAUTH_UNAPPROVED_CLIENTS_PRUNED" : "OAUTH_CLIENT_NOT_FOUND", true, count > 0);
+                    }
+                    catch (error) {
+                        if (isOAuthAuditUnavailable(error))
+                            return this.#oauthClientResponse("OAUTH_AUDIT_UNAVAILABLE_RUN_CODEXGPT_DOCTOR", false, false);
+                        throw error;
+                    }
+                });
+            case "oauth.signing.rotate":
+                return this.#mutate(async () => {
+                    try {
+                        if (!this.#oauthSigningKeys)
+                            return this.#oauthGrantResponse("OAUTH_SIGNING_CONTROL_UNAVAILABLE", false, false);
+                        await this.#oauthBackups?.create();
+                        if (request.revokeAll)
+                            await this.#oauthGrants?.revokeOwner();
+                        await this.#oauthSigningKeys.rotate({ revokeAll: request.revokeAll });
+                        return this.#oauthGrantResponse(request.revokeAll ? "OAUTH_SIGNING_KEY_ROTATED_AND_GRANTS_REVOKED" : "OAUTH_SIGNING_KEY_ROTATED", true, true);
+                    }
+                    catch (error) {
+                        if (isOAuthAuditUnavailable(error))
+                            return this.#oauthGrantResponse("OAUTH_AUDIT_UNAVAILABLE_RUN_CODEXGPT_DOCTOR", false, false);
+                        throw error;
+                    }
+                });
+            case "oauth.grants.list":
+                return this.#oauthGrantResponse("CONTROL_OK", true, false);
+            case "oauth.grants.revoke":
+                return this.#mutate(async () => {
+                    try {
+                        await this.#oauthBackups?.create();
+                        const changed = await this.#oauthGrants?.revoke(request.grantId) ?? false;
+                        return this.#oauthGrantResponse(changed ? "OAUTH_GRANT_REVOKED" : "OAUTH_GRANT_NOT_FOUND", changed, changed);
+                    }
+                    catch (error) {
+                        if (isOAuthAuditUnavailable(error))
+                            return this.#oauthGrantResponse("OAUTH_AUDIT_UNAVAILABLE_RUN_CODEXGPT_DOCTOR", false, false);
+                        throw error;
+                    }
+                });
+            case "oauth.grants.revoke_owner":
+                return this.#mutate(async () => {
+                    try {
+                        await this.#oauthBackups?.create();
+                        const count = await this.#oauthGrants?.revokeOwner() ?? 0;
+                        return this.#oauthGrantResponse(count > 0 ? "OAUTH_OWNER_GRANTS_REVOKED" : "OAUTH_GRANT_NOT_FOUND", true, count > 0);
+                    }
+                    catch (error) {
+                        if (isOAuthAuditUnavailable(error))
+                            return this.#oauthGrantResponse("OAUTH_AUDIT_UNAVAILABLE_RUN_CODEXGPT_DOCTOR", false, false);
+                        throw error;
+                    }
+                });
+        }
+    }
+    async #watch(request) {
+        const deadline = this.#now() + request.timeoutMs;
+        while (this.#sequence() <= request.afterSequence && this.#now() < deadline) {
+            await delay(Math.min(25, Math.max(1, deadline - this.#now())));
+            await this.#approvals.expire(new Date(this.#now()).toISOString());
+        }
+        const changed = this.#sequence() > request.afterSequence;
+        await this.#preparePendingApprovals();
+        return this.#response(changed ? "CONTROL_CHANGED" : "CONTROL_TIMEOUT", true, changed);
+    }
+    async #preparePendingApprovals() {
+        if (!this.#prepareApproval)
+            return;
+        for (const record of this.#approvals.snapshot()) {
+            if (record.facts.serverId !== this.serverId || record.state !== "pending")
+                continue;
+            await this.#prepareApproval(record);
+        }
+    }
+    async #approve(approvalId) {
+        await this.#approvals.expire(new Date(this.#now()).toISOString());
+        const current = this.#requiredApproval(approvalId);
+        if (current.grantId)
+            return this.#response("APPROVAL_GRANTED", true, false, current.grantId);
+        if (current.state === "denied" || current.state === "expired" || current.state === "consumed" || current.state === "burned") {
+            return this.#response("APPROVAL_STATE_CONFLICT", false, false);
+        }
+        const nowMs = this.#now();
+        await this.#prepareApproval?.(current);
+        await this.#approvals.prepare(approvalId, new Date(nowMs).toISOString());
+        const expiresMs = Math.min(Date.parse(current.expiresAt), nowMs + riskLimits(current.facts.riskClass).maxTtlMs);
+        if (!Number.isFinite(expiresMs) || expiresMs <= nowMs)
+            return this.#response("APPROVAL_EXPIRED", false, false);
+        const grant = this.#grants.issue({
+            context: contextFor(current, this.#grants.revision(), new Date(nowMs).toISOString()),
+            operation: current.facts.operation,
+            resourceFingerprint: current.facts.resourceFingerprint,
+            inputDigest: current.facts.inputDigest,
+            riskClass: current.facts.riskClass,
+            toolContractVersion: current.facts.toolContractVersion,
+            issuedAt: new Date(nowMs).toISOString(),
+            expiresAt: new Date(expiresMs).toISOString(),
+            usesRemaining: riskLimits(current.facts.riskClass).uses
+        });
+        try {
+            await this.#approvals.approve(approvalId, grant.grantId, new Date(nowMs).toISOString());
+        }
+        catch (error) {
+            this.#grants.revokeGrant(grant.grantId);
+            throw error;
+        }
+        return this.#response("APPROVAL_GRANTED", true, true, grant.grantId);
+    }
+    async #deny(approvalId) {
+        await this.#approvals.expire(new Date(this.#now()).toISOString());
+        const current = this.#requiredApproval(approvalId);
+        if (current.state === "denied")
+            return this.#response("APPROVAL_DENIED", true, false);
+        try {
+            await this.#approvals.deny(approvalId, new Date(this.#now()).toISOString());
+            return this.#response("APPROVAL_DENIED", true, true);
+        }
+        catch (error) {
+            if (error instanceof ApprovalQueueError && error.code === "APPROVAL_STATE_CONFLICT") {
+                return this.#response(error.code, false, false);
+            }
+            throw error;
+        }
+    }
+    #requiredApproval(approvalId) {
+        const record = this.#approvals.get(approvalId);
+        if (!record || record.facts.serverId !== this.serverId)
+            throw new ApprovalQueueError("APPROVAL_NOT_FOUND", "Approval was not found on this server.");
+        return record;
+    }
+    #sequence() {
+        return this.#approvals.snapshot().reduce((maximum, record) => Math.max(maximum, record.transitionSequence), 0);
+    }
+    #response(code, ok, changed, grantId = null) {
+        const approvals = this.#approvals.snapshot()
+            .filter((record) => record.facts.serverId === this.serverId)
+            .map((record) => safeApproval(record, this.#displayApproval?.(record)));
+        return localControlResponseV3Schema.parse({
+            schemaVersion: 3,
+            contractVersion: 3,
+            serverId: this.serverId,
+            ok,
+            code,
+            sequence: this.#sequence(),
+            approvals,
+            processes: [],
+            grantId,
+            changed
+        });
+    }
+    #processResponse(code, changed, processes) {
+        return localControlResponseV3Schema.parse({
+            schemaVersion: 3,
+            contractVersion: 3,
+            serverId: this.serverId,
+            ok: code !== "PROCESS_NOT_FOUND",
+            code,
+            sequence: this.#sequence(),
+            approvals: [],
+            processes,
+            grantId: null,
+            changed
+        });
+    }
+    #oauthAdminBootstrapResponse(code, ok, oauthAdminBootstrapUrl) {
+        return localControlResponseV3Schema.parse({
+            schemaVersion: 3,
+            contractVersion: 3,
+            serverId: this.serverId,
+            ok,
+            code,
+            sequence: this.#sequence(),
+            approvals: [],
+            processes: [],
+            ...(oauthAdminBootstrapUrl ? { oauthAdminBootstrapUrl } : {}),
+            grantId: null,
+            changed: false
+        });
+    }
+    async #oauthAuthorizationResponse(code, ok, changed) {
+        const oauthAuthorizations = await this.#oauthAuthorizations?.list() ?? [];
+        return localControlResponseV3Schema.parse({
+            schemaVersion: 3,
+            contractVersion: 3,
+            serverId: this.serverId,
+            ok,
+            code,
+            sequence: this.#sequence(),
+            approvals: [],
+            processes: [],
+            oauthAuthorizations,
+            grantId: null,
+            changed
+        });
+    }
+    async #oauthClientResponse(code, ok, changed) {
+        const oauthClients = await this.#oauthClients?.list() ?? [];
+        return localControlResponseV3Schema.parse({
+            schemaVersion: 3,
+            contractVersion: 3,
+            serverId: this.serverId,
+            ok,
+            code,
+            sequence: this.#sequence(),
+            approvals: [],
+            processes: [],
+            oauthClients,
+            grantId: null,
+            changed
+        });
+    }
+    async #oauthGrantResponse(code, ok, changed) {
+        const oauthGrants = await this.#oauthGrants?.list() ?? [];
+        return localControlResponseV3Schema.parse({
+            schemaVersion: 3,
+            contractVersion: 3,
+            serverId: this.serverId,
+            ok,
+            code,
+            sequence: this.#sequence(),
+            approvals: [],
+            processes: [],
+            oauthGrants,
+            grantId: null,
+            changed
+        });
+    }
+    #mutate(action) {
+        const result = this.#mutationTail.then(action, action);
+        this.#mutationTail = result.then(() => undefined, () => undefined);
+        return result;
+    }
+}
+//# sourceMappingURL=localApprovalServer.js.map

package/dist/control/localApprovalServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localApprovalServer.js","sourceRoot":"","sources":["../../src/control/localApprovalServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAM3D,OAAO,EAAE,UAAU,EAAqB,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EACL,kBAAkB,EAInB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,mBAAmB,EAGpB,MAAM,cAAc,CAAC;AAyCtB,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,KAAK,YAAY,sBAAsB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,CAAC;AACzF,CAAC;AAED,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,MAAyB,EAAE,OAAyC;IACxF,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,OAAO,EAAE;YACP,GAAG,eAAe,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;YAC7C,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;SAC1E;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAyB,EAAE,aAAqB,EAAE,UAAkB;IACtF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC;IACrD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,WAAW,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE;QACnE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB;QAClD,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB;QACnD,QAAQ,EAAE;YACR,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,sBAAsB;YACvG,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACxF,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;YACzC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe;YACrC,MAAM,EAAE,EAAE;YACV,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe;SAC5F;QACD,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;QACrC,gBAAgB,EAAE,YAAY;QAC9B,mBAAmB,EAAE,aAAa;QAClC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;QAC3C,oBAAoB,EAAE,aAAa;QACnC,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,OAAO,GAAG,GAAG;IAC7D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QACvC,MAAM,cAAc,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;QACpD,MAAM,IAAI,GAAG,cAAc,IAAI,SAAS,KAAK,IAAI,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;QAC9F,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC;YAChB,MAAM;QACR,CAAC;QACD,MAAM,IAAI,OAAO,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAyB;IAC7D,MAAM,KAAK,GAAG;QACZ,aAAa,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;QACpD,UAAU,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QAC5C,YAAY,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACxD,WAAW,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC1D,cAAc,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE;QAC5C,UAAU,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;QAC3D,aAAa,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;QAC/D,cAAc,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE;QACnE,SAAS,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;QACjC,YAAY,MAAM,CAAC,SAAS,EAAE;QAC9B,WAAW,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;KACzC,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAmD,EACnD,UAAgC,EAAE;IAElC,MAAM,KAAK,GAAG;QACZ,aAAa,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;QACpD,UAAU,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QAC5C,YAAY,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACxD,WAAW,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC1D,cAAc,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE;QAC5C,UAAU,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;QAC3D,aAAa,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;QAC/D,cAAc,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE;QACnE,SAAS,MAAM,CAAC,SAAS,EAAE;QAC3B,YAAY,MAAM,CAAC,SAAS,EAAE;QAC9B,WAAW,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;KACzC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9E,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,KAAK,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,mBAAmB;IACrB,QAAQ,CAAS;IACjB,UAAU,CAAuB;IACjC,OAAO,CAAoB;IACpC,UAAU,CAAyB;IAC1B,IAAI,CAAe;IAC5B,gBAAgB,CAAuD;IACvE,gBAAgB,CAAkE;IAClF,oBAAoB,CAAgC;IACpD,aAAa,CAAwB;IACrC,iBAAiB,CAA4B;IAC7C,oBAAoB,CAA6B;IACjD,aAAa,CAA2B;IACxC,YAAY,CAA0B;IACtC,aAAa,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEjD,YAAY,OAAmC;QAC7C,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;QAChD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;QAChD,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACxD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAClD,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACxD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;IAC1C,CAAC;IAED,sBAAsB,CACpB,QAA2E,EAC3E,OAAwE;QAExE,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAClC,CAAC;IAED,iBAAiB,CAAC,SAA4C;QAC5D,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,6BAA6B,CAAC,OAAiD;QAC7E,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC;IACtC,CAAC;IAED,qBAAqB,CAAC,OAAyC;QAC7D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;IAC/B,CAAC;IAED,yBAAyB,CAAC,OAA6C;QACrE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;IACnC,CAAC;IAED,4BAA4B,CAAC,OAA8C;QACzE,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC;IACtC,CAAC;IAED,qBAAqB,CAAC,OAA4C;QAChE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;IAC/B,CAAC;IAED,oBAAoB,CAAC,OAA2C;QAC9D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAY;QACvB,MAAM,OAAO,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACnF,QAAQ,OAAO,CAAC,SAAS,EAAE,CAAC;YAC1B,KAAK,gBAAgB;gBACnB,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAClE,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACnD,KAAK,iBAAiB;gBACpB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,KAAK,mBAAmB;gBACtB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/D,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5D,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzF,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;gBAC7E,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnI,CAAC;YACD,KAAK,uBAAuB,CAAC,CAAC,CAAC;gBAC7B,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC;gBACxE,IAAI,CAAC,sBAAsB;oBAAE,OAAO,IAAI,CAAC,4BAA4B,CAAC,yBAAyB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;gBACnH,OAAO,IAAI,CAAC,4BAA4B,CAAC,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAC;YACzG,CAAC;YACD,KAAK,2BAA2B;gBAC9B,OAAO,IAAI,CAAC,2BAA2B,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACrE,KAAK,8BAA8B;gBACjC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;oBAC7B,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;wBACrF,OAAO,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,+BAA+B,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;oBACxI,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,uBAAuB,CAAC,KAAK,CAAC;4BAAE,OAAO,IAAI,CAAC,2BAA2B,CAAC,6CAA6C,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;wBACzI,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,KAAK,2BAA2B;gBAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;oBAC7B,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;wBAClF,OAAO,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,+BAA+B,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;oBACtI,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,uBAAuB,CAAC,KAAK,CAAC;4BAAE,OAAO,IAAI,CAAC,2BAA2B,CAAC,6CAA6C,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;wBACzI,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,KAAK,oBAAoB;gBACvB,OAAO,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC9D,KAAK,sBAAsB;gBACzB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;oBAC7B,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;wBACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;wBAC5E,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,wBAAwB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;oBAClH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,uBAAuB,CAAC,KAAK,CAAC;4BAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,6CAA6C,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;wBAClI,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,KAAK,gCAAgC;gBACnC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;oBAC7B,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;wBACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;wBAC/D,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,wBAAwB,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC9H,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,uBAAuB,CAAC,KAAK,CAAC;4BAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,6CAA6C,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;wBAClI,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,KAAK,sBAAsB;gBACzB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;oBAC7B,IAAI,CAAC;wBACH,IAAI,CAAC,IAAI,CAAC,iBAAiB;4BAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,mCAAmC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;wBAChH,MAAM,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;wBACnC,IAAI,OAAO,CAAC,SAAS;4BAAE,MAAM,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC;wBAC9D,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;wBACtE,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;oBAChJ,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,uBAAuB,CAAC,KAAK,CAAC;4BAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,6CAA6C,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;wBACjI,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,KAAK,mBAAmB;gBACtB,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7D,KAAK,qBAAqB;gBACxB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;oBAC7B,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;wBACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;wBAC1E,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,uBAAuB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC/G,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,uBAAuB,CAAC,KAAK,CAAC;4BAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,6CAA6C,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;wBACjI,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,KAAK,2BAA2B;gBAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;oBAC7B,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;wBACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,uBAAuB,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;oBACvH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,uBAAuB,CAAC,KAAK,CAAC;4BAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,6CAA6C,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;wBACjI,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAyE;QACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QACjD,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC3E,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;QACzD,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,wBAAwB;QAC5B,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACpF,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAkB;QAC/B,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7F,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5H,OAAO,IAAI,CAAC,SAAS,CAAC,yBAAyB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAC/B,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACpF,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;YAClC,mBAAmB,EAAE,OAAO,CAAC,KAAK,CAAC,mBAAmB;YACtD,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;YACtC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;YAClC,mBAAmB,EAAE,OAAO,CAAC,KAAK,CAAC,mBAAmB;YACtD,QAAQ,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YACvC,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAC5C,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI;SACxD,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB;QAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBACpF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,UAAkB;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,wCAAwC,CAAC,CAAC;QACrJ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;IACjH,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,EAAW,EAAE,OAAgB,EAAE,UAAyB,IAAI;QAClF,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE;aACzC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC;aAC3D,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,4BAA4B,CAAC,KAAK,CAAC;YACxC,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,EAAE;YACF,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;YAC1B,SAAS;YACT,SAAS,EAAE,EAAE;YACb,OAAO;YACP,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,IAAY,EAAE,OAAgB,EAAE,SAAkC;QACjF,OAAO,4BAA4B,CAAC,KAAK,CAAC;YACxC,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,EAAE,EAAE,IAAI,KAAK,mBAAmB;YAChC,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;YAC1B,SAAS,EAAE,EAAE;YACb,SAAS;YACT,OAAO,EAAE,IAAI;YACb,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B,CAAC,IAAY,EAAE,EAAW,EAAE,sBAA0C;QAChG,OAAO,4BAA4B,CAAC,KAAK,CAAC;YACxC,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,EAAE;YACF,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;YAC1B,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,IAAY,EAAE,EAAW,EAAE,OAAgB;QAC3E,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1E,OAAO,4BAA4B,CAAC,KAAK,CAAC;YACxC,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,EAAE;YACF,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;YAC1B,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,mBAAmB;YACnB,OAAO,EAAE,IAAI;YACb,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,IAAY,EAAE,EAAW,EAAE,OAAgB;QACpE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5D,OAAO,4BAA4B,CAAC,KAAK,CAAC;YACxC,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,EAAE;YACF,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;YAC1B,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,YAAY;YACZ,OAAO,EAAE,IAAI;YACb,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,IAAY,EAAE,EAAW,EAAE,OAAgB;QACnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1D,OAAO,4BAA4B,CAAC,KAAK,CAAC;YACxC,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,EAAE;YACF,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;YAC1B,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,WAAW;YACX,OAAO,EAAE,IAAI;YACb,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAI,MAAwB;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnE,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/control/runtime.js

@@ -0,0 +1,178 @@
+import { createApprovalLifecycleSinkV3 } from "../audit/lifecycleV3.js";
+import { SessionGrantStore } from "../policy/approval.js";
+import { PendingApprovalStore } from "../policy/pendingApprovals.js";
+import { LocalApprovalServer } from "./localApprovalServer.js";
+import { WindowsLocalControlRuntime, localControlServerId } from "./windowsLocalControl.js";
+export class LocalApprovalRuntimeV3 {
+    serverId;
+    approvals;
+    grants;
+    server;
+    #nativeControl = null;
+    #closed = false;
+    constructor(input) {
+        this.serverId = input.serverId;
+        this.approvals = input.approvals;
+        this.grants = input.grants;
+        this.server = input.server;
+    }
+    static async start(options) {
+        const runtime = LocalApprovalRuntimeV3.create({
+            ...options,
+            startNativeControl: false
+        });
+        if (options.startNativeControl !== false) {
+            await runtime.activateNativeControl(options.stateBaseRoot);
+        }
+        return runtime;
+    }
+    static create(options) {
+        const serverId = localControlServerId();
+        const approvals = new PendingApprovalStore({
+            ...options.pendingStoreOptions,
+            now: options.now,
+            lifecycleSink: createApprovalLifecycleSinkV3(options.auditStore)
+        });
+        const grants = new SessionGrantStore();
+        const server = new LocalApprovalServer({
+            serverId,
+            approvals,
+            grants,
+            processes: options.processes,
+            now: options.now
+        });
+        const runtime = new LocalApprovalRuntimeV3({ serverId, approvals, grants, server });
+        return runtime;
+    }
+    async activateNativeControl(stateBaseRoot) {
+        this.#assertOpen();
+        if (this.#nativeControl)
+            return;
+        this.#nativeControl = await WindowsLocalControlRuntime.start({
+            server: this.server,
+            stateBaseRoot
+        });
+    }
+    nativeControl() {
+        return this.#nativeControl;
+    }
+    setApprovalPreparation(callback, display) {
+        this.#assertOpen();
+        this.server.setApprovalPreparation(callback, display);
+    }
+    setProcessControl(processes) {
+        this.#assertOpen();
+        this.server.setProcessControl(processes);
+    }
+    setOAuthAdminBootstrapControl(control) {
+        this.#assertOpen();
+        this.server.setOAuthAdminBootstrapControl(control);
+    }
+    setOAuthBackupControl(control) {
+        this.#assertOpen();
+        this.server.setOAuthBackupControl(control);
+    }
+    setOAuthSigningKeyControl(control) {
+        this.#assertOpen();
+        this.server.setOAuthSigningKeyControl(control);
+    }
+    setOAuthAuthorizationControl(control) {
+        this.#assertOpen();
+        this.server.setOAuthAuthorizationControl(control);
+    }
+    setOAuthClientControl(control) {
+        this.#assertOpen();
+        this.server.setOAuthClientControl(control);
+    }
+    setOAuthGrantControl(control) {
+        this.#assertOpen();
+        this.server.setOAuthGrantControl(control);
+    }
+    async request(input) {
+        this.#assertOpen();
+        if (input.facts.serverId !== this.serverId)
+            throw new Error("CONTROL_SERVER_MISMATCH");
+        return await this.approvals.request(input);
+    }
+    async reserveMatching(input) {
+        this.#assertOpen();
+        const reservation = this.grants.reserveMatching(input);
+        if (!reservation)
+            return null;
+        try {
+            const existing = this.approvals.getByGrantId(reservation.grantId);
+            if (existing?.state === "consumed" && existing.facts.riskClass !== "R3") {
+                return { reservation, approval: existing };
+            }
+            const approval = await this.approvals.markReserved(reservation.grantId, reservation.reservationId, input.now);
+            if (!approval)
+                throw new Error("APPROVAL_GRANT_STATE_MISSING");
+            return { reservation, approval };
+        }
+        catch (error) {
+            this.grants.burnReservation(reservation.reservationId);
+            throw error;
+        }
+    }
+    async commitConsume(input, at) {
+        this.#assertOpen();
+        if (input.approval.state === "consumed" && input.approval.facts.riskClass !== "R3") {
+            if (!this.grants.commitConsume(input.reservation.reservationId)) {
+                throw new Error("APPROVAL_CONSUME_STATE_MISMATCH");
+            }
+            return;
+        }
+        try {
+            const approval = await this.approvals.markConsumed(input.reservation.grantId, input.reservation.reservationId, at);
+            if (!approval || !this.grants.commitConsume(input.reservation.reservationId)) {
+                throw new Error("APPROVAL_CONSUME_STATE_MISMATCH");
+            }
+        }
+        catch (error) {
+            this.grants.burnReservation(input.reservation.reservationId);
+            this.grants.revokeGrant(input.reservation.grantId);
+            try {
+                await this.approvals.markBurned(input.reservation.grantId, input.reservation.reservationId, at, "CONSUME_FAILED");
+            }
+            catch {
+                // Preserve the original required-audit/consume failure.
+            }
+            throw error;
+        }
+    }
+    async burn(input, resultCode, at) {
+        this.#assertOpen();
+        this.grants.burnReservation(input.reservation.reservationId);
+        if (input.approval.state === "consumed" && input.approval.facts.riskClass !== "R3")
+            return;
+        this.grants.revokeGrant(input.reservation.grantId);
+        await this.approvals.markBurned(input.reservation.grantId, input.reservation.reservationId, at, resultCode);
+    }
+    async close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        let failure;
+        try {
+            await this.approvals.closeServer(this.serverId);
+        }
+        catch (error) {
+            failure = error;
+        }
+        this.grants.clear();
+        try {
+            await this.#nativeControl?.close();
+        }
+        catch (error) {
+            failure ??= error;
+        }
+        this.#nativeControl = null;
+        if (failure)
+            throw failure;
+    }
+    #assertOpen() {
+        if (this.#closed)
+            throw new Error("CONTROL_SERVER_CLOSED");
+    }
+}
+//# sourceMappingURL=runtime.js.map