codexgpt 1.0.0

package/dist/policy/approval.js

@@ -0,0 +1,306 @@
+import { createHash, randomBytes as nodeRandomBytes } from "node:crypto";
+import { credentialRevisionForCredentialRef, credentialRevisionForIdentity } from "../auth/policyIdentity.js";
+import { sessionGrantV1Schema } from "./schemas.js";
+const RISK_LIMITS = Object.freeze({
+    R1: Object.freeze({ maxTtlMs: 30 * 60_000, uses: null }),
+    R2: Object.freeze({ maxTtlMs: 5 * 60_000, uses: null }),
+    R3: Object.freeze({ maxTtlMs: 2 * 60_000, uses: 1 })
+});
+export function riskLimits(riskClass) {
+    if (riskClass === "R0" || riskClass === "R4") {
+        throw new Error(`${riskClass} is unapprovable.`);
+    }
+    return { ...RISK_LIMITS[riskClass] };
+}
+function operationFor(resource) {
+    return `${resource.kind}.${resource.operation}`;
+}
+function safeHash(prefix, value) {
+    const digest = createHash("sha256").update(JSON.stringify(value), "utf8").digest("hex").slice(0, 24);
+    return `${prefix}_${digest}`;
+}
+export function createApprovalRequest(input) {
+    const limits = riskLimits(input.riskClass);
+    const riskClass = input.riskClass;
+    const createdMs = Date.parse(input.createdAt);
+    if (!Number.isFinite(createdMs))
+        throw new Error("Approval creation time is invalid.");
+    const facts = {
+        credentialRef: input.context.identity.credentialRef,
+        credentialRevision: credentialRevisionForIdentity(input.context.identity),
+        transportSessionId: input.context.transportSessionId,
+        workspaceId: input.context.workspaceId,
+        policyRevision: input.context.policyRevision,
+        toolContractVersion: input.toolContractVersion,
+        operation: operationFor(input.resource),
+        resourceFingerprint: input.resource.resourceFingerprint,
+        inputDigest: input.inputDigest,
+        riskClass,
+        createdAt: new Date(createdMs).toISOString()
+    };
+    return Object.freeze({
+        schemaVersion: 1,
+        approvalId: safeHash("approval", facts),
+        ...facts,
+        expiresAt: new Date(createdMs + limits.maxTtlMs).toISOString(),
+        maxUses: limits.uses
+    });
+}
+export class SessionGrantStore {
+    #grants = new Map();
+    #reservations = new Map();
+    #reservedGrantIds = new Map();
+    #terminalReservations = new Map();
+    #randomBytes;
+    #revision = 0;
+    #sequence = 0;
+    constructor(options = {}) {
+        this.#randomBytes = options.randomBytes ?? nodeRandomBytes;
+    }
+    revision() {
+        return `grant-revision-${this.#revision}`;
+    }
+    size() {
+        return this.#grants.size;
+    }
+    reservationCount() {
+        return this.#reservations.size;
+    }
+    snapshot() {
+        return [...this.#grants.values()]
+            .filter((grant) => !this.#reservedGrantIds.has(grant.grantId))
+            .map((grant) => structuredClone(grant));
+    }
+    reservationSnapshot() {
+        return [...this.#reservations.values()].map((reservation) => structuredClone(reservation));
+    }
+    issue(input) {
+        const limits = riskLimits(input.riskClass);
+        const riskClass = input.riskClass;
+        const issuedMs = Date.parse(input.issuedAt);
+        const expiresMs = Date.parse(input.expiresAt);
+        if (!Number.isFinite(issuedMs) || !Number.isFinite(expiresMs) || expiresMs <= issuedMs || expiresMs - issuedMs > limits.maxTtlMs) {
+            throw new Error("Grant expiry exceeds the risk-class ceiling.");
+        }
+        const usesRemaining = input.usesRemaining === undefined ? limits.uses : input.usesRemaining;
+        if (riskClass === "R3" && usesRemaining !== 1) {
+            throw new Error("R3 grants are exactly one-use.");
+        }
+        if (usesRemaining !== null && (!Number.isInteger(usesRemaining) || usesRemaining < 1)) {
+            throw new Error("Grant uses must be a positive integer or null.");
+        }
+        this.#sequence += 1;
+        const binding = {
+            credentialRef: input.context.identity.credentialRef,
+            credentialRevision: credentialRevisionForIdentity(input.context.identity),
+            transportSessionId: input.context.transportSessionId,
+            workspaceId: input.context.workspaceId,
+            policyRevision: input.context.policyRevision,
+            toolContractVersion: input.toolContractVersion,
+            operation: input.operation,
+            resourceFingerprint: input.resourceFingerprint,
+            inputDigest: input.inputDigest,
+            riskClass,
+            issuedAt: new Date(issuedMs).toISOString(),
+            sequence: this.#sequence
+        };
+        const grant = sessionGrantV1Schema.parse({
+            schemaVersion: 1,
+            grantId: safeHash("grant", binding),
+            credentialRef: binding.credentialRef,
+            credentialRevision: binding.credentialRevision,
+            transportSessionId: binding.transportSessionId,
+            workspaceId: binding.workspaceId,
+            policyRevision: binding.policyRevision,
+            toolContractVersion: binding.toolContractVersion,
+            operation: binding.operation,
+            resourceFingerprint: binding.resourceFingerprint,
+            inputDigest: binding.inputDigest,
+            riskClass,
+            issuedAt: binding.issuedAt,
+            expiresAt: new Date(expiresMs).toISOString(),
+            usesRemaining
+        });
+        this.#grants.set(grant.grantId, grant);
+        this.#revision += 1;
+        return structuredClone(grant);
+    }
+    findMatching(input) {
+        const now = this.#validatedMatchTime(input);
+        this.#removeExpired(now);
+        for (const grant of this.#grants.values()) {
+            if (this.#reservedGrantIds.has(grant.grantId))
+                continue;
+            if (this.#matches(input, grant, now))
+                return structuredClone(grant);
+        }
+        return null;
+    }
+    reserveMatching(input) {
+        const now = this.#validatedMatchTime(input);
+        this.#removeExpired(now);
+        for (const grant of this.#grants.values()) {
+            if (this.#reservedGrantIds.has(grant.grantId) || !this.#matches(input, grant, now))
+                continue;
+            const random = this.#randomBytes(16);
+            if (!Buffer.isBuffer(random) || random.length !== 16)
+                throw new Error("Grant reservation random source returned an invalid value.");
+            const reservation = Object.freeze({
+                schemaVersion: 3,
+                contractVersion: 3,
+                reservationId: `reservation_${random.toString("hex")}`,
+                grantId: grant.grantId,
+                grant: structuredClone(grant),
+                reservedAt: new Date(now).toISOString(),
+                expiresAt: grant.expiresAt
+            });
+            if (this.#reservations.has(reservation.reservationId))
+                throw new Error("Grant reservation identity collision.");
+            this.#reservations.set(reservation.reservationId, reservation);
+            this.#reservedGrantIds.set(grant.grantId, reservation.reservationId);
+            this.#revision += 1;
+            return structuredClone(reservation);
+        }
+        return null;
+    }
+    commitConsume(reservationId) {
+        return this.#finalizeReservation(reservationId, "consumed");
+    }
+    burnReservation(reservationId) {
+        return this.#finalizeReservation(reservationId, "burned");
+    }
+    reservationResult(reservationId) {
+        if (this.#reservations.has(reservationId))
+            return "active";
+        return this.#terminalReservations.get(reservationId) ?? null;
+    }
+    consume(grantId) {
+        if (this.#reservedGrantIds.has(grantId))
+            return;
+        const grant = this.#grants.get(grantId);
+        if (!grant || grant.usesRemaining === null)
+            return;
+        this.#consumeGrant(grant);
+        this.#revision += 1;
+    }
+    revokeGrant(grantId) {
+        this.#deleteWhere((grant) => grant.grantId === grantId);
+    }
+    revokeTransportSession(transportSessionId) {
+        this.#deleteWhere((grant) => grant.transportSessionId === transportSessionId);
+    }
+    revokeForActivePolicyRevision(activePolicyRevision) {
+        this.#deleteWhere((grant) => grant.policyRevision !== activePolicyRevision);
+    }
+    clear() {
+        if (this.#grants.size === 0 && this.#reservations.size === 0)
+            return;
+        for (const reservationId of this.#reservations.keys())
+            this.#terminalReservations.set(reservationId, "burned");
+        this.#grants.clear();
+        this.#reservations.clear();
+        this.#reservedGrantIds.clear();
+        this.#revision += 1;
+    }
+    #validatedMatchTime(input) {
+        if (input.riskClass === "R0" || input.riskClass === "R4")
+            return Number.NaN;
+        const now = Date.parse(input.now);
+        if (!Number.isFinite(now))
+            throw new Error("Grant match time is invalid.");
+        return now;
+    }
+    #matches(input, grant, now) {
+        if (!Number.isFinite(now))
+            return false;
+        return grant.credentialRef === input.context.identity.credentialRef &&
+            (grant.credentialRevision ?? credentialRevisionForCredentialRef(grant.credentialRef)) === credentialRevisionForIdentity(input.context.identity) &&
+            grant.transportSessionId === input.context.transportSessionId &&
+            grant.workspaceId === input.context.workspaceId &&
+            grant.policyRevision === input.context.policyRevision &&
+            grant.toolContractVersion === input.toolContractVersion &&
+            grant.operation === input.operation &&
+            grant.resourceFingerprint === input.resourceFingerprint &&
+            grant.inputDigest === input.inputDigest &&
+            grant.riskClass === input.riskClass &&
+            Date.parse(grant.issuedAt) <= now &&
+            Date.parse(grant.expiresAt) > now &&
+            (grant.usesRemaining === null || grant.usesRemaining > 0);
+    }
+    #finalizeReservation(reservationId, outcome) {
+        const reservation = this.#reservations.get(reservationId);
+        if (!reservation)
+            return false;
+        const grant = this.#grants.get(reservation.grantId);
+        this.#reservations.delete(reservationId);
+        this.#reservedGrantIds.delete(reservation.grantId);
+        this.#terminalReservations.set(reservationId, outcome);
+        if (grant && grant.usesRemaining !== null)
+            this.#consumeGrant(grant);
+        this.#revision += 1;
+        return true;
+    }
+    #consumeGrant(grant) {
+        if (grant.usesRemaining === null)
+            return;
+        if (grant.usesRemaining <= 1)
+            this.#grants.delete(grant.grantId);
+        else
+            this.#grants.set(grant.grantId, { ...grant, usesRemaining: grant.usesRemaining - 1 });
+    }
+    #removeExpired(now) {
+        if (!Number.isFinite(now))
+            return;
+        this.#deleteWhere((grant) => Date.parse(grant.expiresAt) <= now);
+    }
+    #deleteWhere(predicate) {
+        let changed = false;
+        for (const [id, grant] of this.#grants) {
+            if (!predicate(grant))
+                continue;
+            const reservationId = this.#reservedGrantIds.get(id);
+            if (reservationId) {
+                this.#reservations.delete(reservationId);
+                this.#reservedGrantIds.delete(id);
+                this.#terminalReservations.set(reservationId, "burned");
+            }
+            this.#grants.delete(id);
+            changed = true;
+        }
+        if (changed)
+            this.#revision += 1;
+    }
+}
+export class ApprovalPolicyV1 {
+    classify(resource) {
+        switch (resource.kind) {
+            case "filesystem":
+                if (resource.operation === "read" || resource.operation === "list" || resource.operation === "search")
+                    return "R0";
+                if (resource.operation === "write")
+                    return "R2";
+                return "R3";
+            case "filesystem_batch":
+                return "R2";
+            case "git":
+                if (resource.operation === "read")
+                    return "R0";
+                if (resource.operation === "write")
+                    return "R2";
+                return "R3";
+            case "shell":
+                return resource.operation === "verify" && resource.commandKind === "verification" ? "R1" : "R3";
+            case "process":
+                return resource.operation === "inspect" && !resource.persistence ? "R1" : "R3";
+            case "network":
+                if (resource.addressClasses.some((value) => value === "multicast" || value === "unspecified" || value === "reserved"))
+                    return "R4";
+                if (resource.addressClasses.some((value) => value === "loopback" || value === "private" || value === "link_local"))
+                    return "R3";
+                return "R2";
+            case "audit":
+                return "R1";
+        }
+    }
+}
+//# sourceMappingURL=approval.js.map

package/dist/policy/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../src/policy/approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAapD,MAAM,WAAW,GAAyD,MAAM,CAAC,MAAM,CAAC;IACtF,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxD,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvD,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;CACrD,CAAC,CAAC;AAEH,MAAM,UAAU,UAAU,CAAC,SAAoB;IAC7C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,mBAAmB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;AACvC,CAAC;AA6BD,SAAS,YAAY,CAAC,QAA8B;IAClD,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,KAAc;IAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrG,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAiC;IACrE,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAA+B,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG;QACZ,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa;QACnD,kBAAkB,EAAE,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzE,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;QACpD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QACtC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;QAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvC,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAmB;QACvD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;KAC7C,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC;QACvC,GAAG,KAAK;QACR,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;QAC9D,OAAO,EAAE,MAAM,CAAC,IAAI;KACrB,CAAC,CAAC;AACL,CAAC;AAsCD,MAAM,OAAO,iBAAiB;IACnB,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,qBAAqB,GAAG,IAAI,GAAG,EAAiC,CAAC;IACjE,YAAY,CAA2B;IAChD,SAAS,GAAG,CAAC,CAAC;IACd,SAAS,GAAG,CAAC,CAAC;IAEd,YAAY,UAAoC,EAAE;QAChD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;IAC7D,CAAC;IAED,QAAQ;QACN,OAAO,kBAAkB,IAAI,CAAC,SAAS,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;aAC9B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,mBAAmB;QACjB,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,KAAsB;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAA+B,CAAC;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,QAAQ,IAAI,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACjI,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;QAC5F,IAAI,SAAS,KAAK,IAAI,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG;YACd,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa;YACnD,kBAAkB,EAAE,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YACzE,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;YACpD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;YACtC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;YAC5C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS;YACT,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YAC1C,QAAQ,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC;QACF,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC;YACvC,aAAa,EAAE,CAAC;YAChB,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;YACnC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAC5C,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACpB,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,YAAY,CAAC,KAAsB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,SAAS;YACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC;gBAAE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,eAAe,CAAC,KAAsB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC;gBAAE,SAAS;YAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YACpI,MAAM,WAAW,GAAuB,MAAM,CAAC,MAAM,CAAC;gBACpD,aAAa,EAAE,CAAC;gBAChB,eAAe,EAAE,CAAC;gBAClB,aAAa,EAAE,eAAe,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBACtD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;gBAC7B,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBACvC,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAChH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YAC/D,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;YACrE,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;YACpB,OAAO,eAAe,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,aAAqB;QACjC,OAAO,IAAI,CAAC,oBAAoB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED,eAAe,CAAC,aAAqB;QACnC,OAAO,IAAI,CAAC,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAED,iBAAiB,CAAC,aAAqB;QACrC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC3D,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;IAED,OAAO,CAAC,OAAe;QACrB,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO;QACnD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,sBAAsB,CAAC,kBAA0B;QAC/C,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,CAAC;IAChF,CAAC;IAED,6BAA6B,CAAC,oBAA4B;QACxD,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QACrE,KAAK,MAAM,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC/G,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,mBAAmB,CAAC,KAAsB;QACxC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC;IACb,CAAC;IAED,QAAQ,CAAC,KAAsB,EAAE,KAAqB,EAAE,GAAW;QACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa;YACjE,CAAC,KAAK,CAAC,kBAAkB,IAAI,kCAAkC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC/I,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,OAAO,CAAC,kBAAkB;YAC7D,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,WAAW;YAC/C,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc;YACrD,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;YACvD,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YACnC,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;YACvD,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YACvC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG;YACjC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG;YACjC,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,oBAAoB,CAAC,aAAqB,EAAE,OAA8B;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACzC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;YAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,KAAqB;QACjC,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO;QACzC,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;YAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,cAAc,CAAC,GAAW;QACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO;QAClC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,YAAY,CAAC,SAA6C;QACxD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,SAAS;YAChC,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrD,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBACzC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,OAAO;YAAE,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,gBAAgB;IAC3B,QAAQ,CAAC,QAA8B;QACrC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,YAAY;gBACf,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBACnH,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO;oBAAE,OAAO,IAAI,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,KAAK,kBAAkB;gBACrB,OAAO,IAAI,CAAC;YACd,KAAK,KAAK;gBACR,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC;gBAC/C,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO;oBAAE,OAAO,IAAI,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,KAAK,OAAO;gBACV,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAClG,KAAK,SAAS;gBACZ,OAAO,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACjF,KAAK,SAAS;gBACZ,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,UAAU,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACnI,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAChI,OAAO,IAAI,CAAC;YACd,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;CACF"}

package/dist/policy/audit.js

@@ -0,0 +1,88 @@
+import { auditEventV1Schema } from "./schemas.js";
+function safeOneLine(value, maxLength) {
+    return value.replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim().slice(0, maxLength);
+}
+function safeRelativePath(value) {
+    const normalized = value.replaceAll("\\", "/").normalize("NFC");
+    if (!normalized ||
+        normalized.startsWith("/") ||
+        /^[A-Za-z]:/.test(normalized) ||
+        normalized.split("/").some((segment) => segment === "..") ||
+        /[\u0000-\u001f\u007f]/.test(normalized))
+        return null;
+    return safeOneLine(normalized, 180);
+}
+export function safePolicySummary(resource) {
+    switch (resource.kind) {
+        case "filesystem": {
+            const relative = safeRelativePath(resource.relativePath);
+            return relative ? `filesystem:${resource.operation}:${relative}` : `filesystem:${resource.operation}:[resource omitted]`;
+        }
+        case "filesystem_batch": {
+            const summaries = resource.entries.slice(0, 4).map((entry) => {
+                const source = entry.sourceRelativePath ? safeRelativePath(entry.sourceRelativePath) : null;
+                const destination = entry.destinationRelativePath ? safeRelativePath(entry.destinationRelativePath) : null;
+                return source && destination ? `${source}->${destination}` : source ?? destination ?? "[resource omitted]";
+            });
+            const suffix = resource.entries.length > summaries.length ? ",..." : "";
+            return `filesystem_batch:${resource.operation}:${resource.entries.length}:${summaries.join(",")}${suffix}`;
+        }
+        case "git":
+            return `git:${resource.operation}:${safeOneLine(resource.repositoryKey, 80) || "[repository omitted]"}`;
+        case "shell":
+            return `shell:${resource.operation}:${resource.backend}`;
+        case "process":
+            return `process:${resource.operation}:${resource.persistence ? "persistent" : "transient"}`;
+        case "network":
+            return `network:${resource.operation}:${safeOneLine(resource.host, 120) || "[host omitted]"}:${resource.port}`;
+        case "audit":
+            return `audit:${resource.operation}:${resource.filterDigest.slice(0, 16)}`;
+        default: {
+            const v3 = resource;
+            if (v3.schemaVersion === 3 && typeof v3.kind === "string" && typeof v3.operation === "string") {
+                const backend = typeof v3.backendId === "string" ? `:${safeOneLine(v3.backendId, 80)}` : "";
+                return `${safeOneLine(v3.kind, 40)}:${safeOneLine(v3.operation, 80)}${backend}`;
+            }
+            return "policy:[resource omitted]";
+        }
+    }
+}
+export function createAuditEvent(input) {
+    if (input.decision.resourceFingerprint !== input.resource.resourceFingerprint) {
+        throw new Error("Audit decision and resource fingerprints do not match.");
+    }
+    if (input.decision.policyRevision !== input.context.policyRevision) {
+        throw new Error("Audit decision and request policy revisions do not match.");
+    }
+    const safeRuleIds = [...new Set(input.decision.provenance
+            .map((item) => item.safeRuleId)
+            .filter((value) => Boolean(value)))].slice(0, 16);
+    return auditEventV1Schema.parse({
+        schemaVersion: 1,
+        eventId: input.eventId,
+        timestamp: input.timestamp,
+        requestId: input.context.requestId,
+        decisionId: input.decision.decisionId,
+        credentialRef: input.context.identity.credentialRef,
+        transportSessionId: input.context.transportSessionId,
+        toolName: safeOneLine(input.toolName, 80),
+        canonicalAction: safeOneLine(input.canonicalAction, 80),
+        workspaceId: input.context.workspaceId,
+        relativeResourceSummary: safePolicySummary(input.resource),
+        resourceFingerprint: input.resource.resourceFingerprint,
+        policyRevision: input.context.policyRevision,
+        outcome: input.decision.outcome,
+        reasonCode: input.decision.reasonCode,
+        safeRuleIds,
+        approvalState: input.approvalState,
+        grantId: input.grantId,
+        sandboxBackend: input.capabilities.backendId,
+        durationMs: Math.max(0, input.durationMs),
+        resultCode: input.resultCode ? safeOneLine(input.resultCode, 160) : null,
+        exitCode: input.exitCode,
+        boundedByteCounts: Object.fromEntries(Object.entries(input.boundedByteCounts)
+            .slice(0, 16)
+            .map(([key, value]) => [safeOneLine(key, 80), Math.max(0, Math.trunc(value))]))
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/policy/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/policy/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AASlD,SAAS,WAAW,CAAC,KAAa,EAAE,SAAiB;IACnD,OAAO,KAAK,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChE,IACE,CAAC,UAAU;QACX,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1B,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;QAC7B,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC;QACzD,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,OAAO,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAA8B;IAC9D,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACzD,OAAO,QAAQ,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,SAAS,qBAAqB,CAAC;QAC3H,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5F,MAAM,WAAW,GAAG,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC3G,OAAO,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,WAAW,IAAI,oBAAoB,CAAC;YAC7G,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,OAAO,oBAAoB,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;QAC7G,CAAC;QACD,KAAK,KAAK;YACR,OAAO,OAAO,QAAQ,CAAC,SAAS,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,sBAAsB,EAAE,CAAC;QAC1G,KAAK,OAAO;YACV,OAAO,SAAS,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3D,KAAK,SAAS;YACZ,OAAO,WAAW,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9F,KAAK,SAAS;YACZ,OAAO,WAAW,QAAQ,CAAC,SAAS,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,gBAAgB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjH,KAAK,OAAO;YACV,OAAO,SAAS,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7E,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,EAAE,GAAG,QAA2G,CAAC;YACvH,IAAI,EAAE,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC9F,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5F,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC;YAClF,CAAC;YACD,OAAO,2BAA2B,CAAC;QACrC,CAAC;IACH,CAAC;AACH,CAAC;AAoBD,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,KAAK,KAAK,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAC7B,KAAK,CAAC,QAAQ,CAAC,UAAU;aACtB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;aAC9B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACtD,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,OAAO,kBAAkB,CAAC,KAAK,CAAC;QAC9B,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACrC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa;QACnD,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;QACpD,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;QACzC,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;QACvD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QACtC,uBAAuB,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1D,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAmB;QACvD,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;QAC5C,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/B,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACrC,WAAW;QACX,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;QAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;QACzC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QACxE,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,iBAAiB,EAAE,MAAM,CAAC,WAAW,CACnC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;aACpC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACZ,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACjF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/policy/authorizationFacts.js

@@ -0,0 +1,187 @@
+import { createHash } from "node:crypto";
+import { canonicalJson } from "../audit/canonicalJson.js";
+function canonical(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    const object = value;
+    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonical(object[key])}`).join(",")}}`;
+}
+function digest(value) {
+    return createHash("sha256").update(canonical(value), "utf8").digest("hex");
+}
+function requireSafeText(name, value, maximum = 240) {
+    if (!value || value.length > maximum || /[\u0000-\u001f\u007f]/.test(value)) {
+        throw new Error(`${name} is not a bounded one-line value.`);
+    }
+    return value;
+}
+function requireStrictSafeText(name, value, maximum = 240) {
+    const safe = requireSafeText(name, value, maximum);
+    if (/[\u0080-\u009f\u202a-\u202e\u2066-\u2069]/u.test(safe)) {
+        throw new Error(`${name} contains disallowed V4 control text.`);
+    }
+    return safe;
+}
+function requireFingerprint(name, value) {
+    if (!/^sha256:[a-f0-9]{64}$/.test(value))
+        throw new Error(`${name} must be a SHA-256 fingerprint.`);
+    return value;
+}
+function requireSafeId(name, value) {
+    if (value === null)
+        return null;
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/.test(value))
+        throw new Error(`${name} is invalid.`);
+    return value;
+}
+export function createAuthorizationFactsV3(input) {
+    if (!["3", "4", "5"].includes(input.toolContractVersion)) {
+        throw new Error("V3 authorization facts require inherited contract 3, 4, or 5.");
+    }
+    const normalized = {
+        serverId: requireSafeId("serverId", input.serverId),
+        credentialRef: requireSafeId("credentialRef", input.credentialRef),
+        credentialRevision: requireSafeId("credentialRevision", input.credentialRevision),
+        transportKind: requireSafeId("transportKind", input.transportKind),
+        transportSessionId: requireSafeId("transportSessionId", input.transportSessionId),
+        identityKind: requireSafeId("identityKind", input.identityKind),
+        identitySubject: requireSafeId("identitySubject", input.identitySubject),
+        workspaceId: requireSafeId("workspaceId", input.workspaceId),
+        leaseId: requireSafeId("leaseId", input.leaseId),
+        policyRevision: requireSafeId("policyRevision", input.policyRevision),
+        evidenceRevision: requireSafeId("evidenceRevision", input.evidenceRevision),
+        toolContractVersion: input.toolContractVersion,
+        toolName: requireSafeText("toolName", input.toolName, 160),
+        canonicalAction: requireSafeText("canonicalAction", input.canonicalAction),
+        operation: requireSafeText("operation", input.operation, 160),
+        resourceFingerprint: requireFingerprint("resourceFingerprint", input.resourceFingerprint),
+        inputDigest: requireFingerprint("inputDigest", input.inputDigest),
+        semanticFactsDigest: requireFingerprint("semanticFactsDigest", input.semanticFactsDigest),
+        riskClass: input.riskClass
+    };
+    const subject = {
+        credentialRef: normalized.credentialRef,
+        credentialRevision: normalized.credentialRevision,
+        transportKind: normalized.transportKind,
+        transportSessionId: normalized.transportSessionId,
+        identityKind: normalized.identityKind,
+        identitySubject: normalized.identitySubject
+    };
+    const context = {
+        serverId: normalized.serverId,
+        workspaceId: normalized.workspaceId,
+        leaseId: normalized.leaseId,
+        policyRevision: normalized.policyRevision,
+        evidenceRevision: normalized.evidenceRevision,
+        toolContractVersion: normalized.toolContractVersion,
+        // The public tool path is descriptive evidence, not authorization identity.
+        // Direct and supertool routes may share a grant only when they resolve to
+        // the same canonical action and every other binding fact remains exact.
+        canonicalAction: normalized.canonicalAction,
+        operation: normalized.operation,
+        resourceFingerprint: normalized.resourceFingerprint,
+        inputDigest: normalized.inputDigest,
+        semanticFactsDigest: normalized.semanticFactsDigest,
+        riskClass: normalized.riskClass
+    };
+    return Object.freeze({
+        schemaVersion: 3,
+        contractVersion: 3,
+        ...normalized,
+        subjectFingerprint: digest(subject),
+        contextFingerprint: digest(context),
+        bindingFingerprint: digest({ subject, context })
+    });
+}
+export function authorizationFactsMatch(left, right) {
+    return left.bindingFingerprint === right.bindingFingerprint;
+}
+export function createAuthorizationFactsV4(input) {
+    if (input.toolContractVersion !== "4")
+        throw new Error("V4 authorization facts require contract 4.");
+    if (!/^repo_[a-f0-9]{32}$/.test(input.repositoryId))
+        throw new Error("repositoryId is invalid.");
+    if (input.worktreeId !== null && !/^task_[a-f0-9]{32}$/.test(input.worktreeId))
+        throw new Error("worktreeId is invalid.");
+    if (!["R1", "R2", "R3"].includes(input.riskClass))
+        throw new Error("riskClass is invalid for V4 authorization facts.");
+    const issuedAtMs = Date.parse(input.issuedAt);
+    const expiresAtMs = Date.parse(input.expiresAt);
+    if (!Number.isFinite(issuedAtMs) || !Number.isFinite(expiresAtMs) || issuedAtMs > expiresAtMs) {
+        throw new Error("V4 authorization fact timestamps are invalid.");
+    }
+    const normalized = {
+        serverId: requireSafeId("serverId", input.serverId),
+        ownerId: requireSafeId("ownerId", input.ownerId),
+        credentialRef: requireSafeId("credentialRef", input.credentialRef),
+        credentialRevision: requireSafeId("credentialRevision", input.credentialRevision),
+        transportKind: requireSafeId("transportKind", input.transportKind),
+        transportSessionId: requireSafeId("transportSessionId", input.transportSessionId),
+        repositoryId: input.repositoryId,
+        worktreeId: input.worktreeId,
+        policyRevision: requireSafeId("policyRevision", input.policyRevision),
+        configurationRevision: requireSafeId("configurationRevision", input.configurationRevision),
+        capabilityRevision: requireSafeId("capabilityRevision", input.capabilityRevision),
+        pathPolicyRevision: requireSafeId("pathPolicyRevision", input.pathPolicyRevision),
+        secretPolicyRevision: requireSafeId("secretPolicyRevision", input.secretPolicyRevision),
+        toolContractVersion: "4",
+        toolName: requireStrictSafeText("toolName", input.toolName, 160),
+        canonicalAction: requireStrictSafeText("canonicalAction", input.canonicalAction),
+        operation: requireStrictSafeText("operation", input.operation, 160),
+        resourceFingerprint: requireFingerprint("resourceFingerprint", input.resourceFingerprint),
+        inputDigest: requireFingerprint("inputDigest", input.inputDigest),
+        semanticFactsDigest: requireFingerprint("semanticFactsDigest", input.semanticFactsDigest),
+        riskClass: input.riskClass,
+        issuedAt: new Date(issuedAtMs).toISOString(),
+        expiresAt: new Date(expiresAtMs).toISOString()
+    };
+    const subject = {
+        ownerId: normalized.ownerId,
+        credentialRef: normalized.credentialRef,
+        credentialRevision: normalized.credentialRevision,
+        transportKind: normalized.transportKind,
+        transportSessionId: normalized.transportSessionId
+    };
+    const context = {
+        serverId: normalized.serverId,
+        repositoryId: normalized.repositoryId,
+        worktreeId: normalized.worktreeId,
+        policyRevision: normalized.policyRevision,
+        configurationRevision: normalized.configurationRevision,
+        capabilityRevision: normalized.capabilityRevision,
+        pathPolicyRevision: normalized.pathPolicyRevision,
+        secretPolicyRevision: normalized.secretPolicyRevision,
+        toolContractVersion: normalized.toolContractVersion,
+        canonicalAction: normalized.canonicalAction,
+        operation: normalized.operation,
+        resourceFingerprint: normalized.resourceFingerprint,
+        inputDigest: normalized.inputDigest,
+        semanticFactsDigest: normalized.semanticFactsDigest,
+        riskClass: normalized.riskClass,
+        issuedAt: normalized.issuedAt,
+        expiresAt: normalized.expiresAt
+    };
+    return Object.freeze({
+        schemaVersion: 4,
+        contractVersion: 4,
+        ...normalized,
+        subjectFingerprint: digest(subject),
+        contextFingerprint: digest(context),
+        bindingFingerprint: digest({ subject, context })
+    });
+}
+export function authorizationFactsMatchV4(left, right) {
+    return left.bindingFingerprint === right.bindingFingerprint;
+}
+export function semanticDigest(value) {
+    return `sha256:${digest(value)}`;
+}
+export function semanticDigestV4(value) {
+    return `sha256:${createHash("sha256")
+        .update("authorization-semantic-v4\0", "utf8")
+        .update(canonicalJson(value), "utf8")
+        .digest("hex")}`;
+}
+//# sourceMappingURL=authorizationFacts.js.map

package/dist/policy/authorizationFacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizationFacts.js","sourceRoot":"","sources":["../../src/policy/authorizationFacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAoC1D,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACtH,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,OAAO,GAAG,GAAG;IACjE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,KAAa,EAAE,OAAO,GAAG,GAAG;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iCAAiC,CAAC,CAAC;IACpG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAoB;IACvD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAgC;IACzE,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,UAAU,GAA8B;QAC5C,QAAQ,EAAE,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAE;QACpD,aAAa,EAAE,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC;QAClE,kBAAkB,EAAE,aAAa,CAAC,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAE;QAClF,aAAa,EAAE,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAE;QACnE,kBAAkB,EAAE,aAAa,CAAC,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAE;QAClF,YAAY,EAAE,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAE;QAChE,eAAe,EAAE,aAAa,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC;QACxE,WAAW,EAAE,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC;QAC5D,OAAO,EAAE,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;QAChD,cAAc,EAAE,aAAa,CAAC,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAE;QACtE,gBAAgB,EAAE,aAAa,CAAC,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAE;QAC5E,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,QAAQ,EAAE,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC;QAC1D,eAAe,EAAE,eAAe,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC;QAC1E,SAAS,EAAE,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;QAC7D,mBAAmB,EAAE,kBAAkB,CAAC,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,CAAC;QACzF,WAAW,EAAE,kBAAkB,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC;QACjE,mBAAmB,EAAE,kBAAkB,CAAC,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,CAAC;QACzF,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,eAAe,EAAE,UAAU,CAAC,eAAe;KAC5C,CAAC;IACF,MAAM,OAAO,GAAG;QACd,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,GAAG,UAAU;QACb,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;QACnC,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;QACnC,kBAAkB,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;KACjD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAA0B,EAAE,KAA2B;IAC7F,OAAO,IAAI,CAAC,kBAAkB,KAAK,KAAK,CAAC,kBAAkB,CAAC;AAC9D,CAAC;AAoCD,MAAM,UAAU,0BAA0B,CAAC,KAAgC;IACzE,IAAI,KAAK,CAAC,mBAAmB,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACrG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACjG,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC1H,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACvH,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,UAAU,GAAG,WAAW,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,UAAU,GAA8B;QAC5C,QAAQ,EAAE,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAE;QACpD,OAAO,EAAE,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAE;QACjD,aAAa,EAAE,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC;QAClE,kBAAkB,EAAE,aAAa,CAAC,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAE;QAClF,aAAa,EAAE,aAAa,CAAC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAE;QACnE,kBAAkB,EAAE,aAAa,CAAC,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAE;QAClF,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,aAAa,CAAC,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAE;QACtE,qBAAqB,EAAE,aAAa,CAAC,uBAAuB,EAAE,KAAK,CAAC,qBAAqB,CAAE;QAC3F,kBAAkB,EAAE,aAAa,CAAC,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAE;QAClF,kBAAkB,EAAE,aAAa,CAAC,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAE;QAClF,oBAAoB,EAAE,aAAa,CAAC,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAE;QACxF,mBAAmB,EAAE,GAAG;QACxB,QAAQ,EAAE,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC;QAChE,eAAe,EAAE,qBAAqB,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC;QAChF,SAAS,EAAE,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;QACnE,mBAAmB,EAAE,kBAAkB,CAAC,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,CAAC;QACzF,WAAW,EAAE,kBAAkB,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC;QACjE,mBAAmB,EAAE,kBAAkB,CAAC,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,CAAC;QACzF,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;QAC5C,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;KAC/C,CAAC;IACF,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;KAClD,CAAC;IACF,MAAM,OAAO,GAAG;QACd,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;QACvD,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;QACrD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;QACnD,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,GAAG,UAAU;QACb,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;QACnC,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;QACnC,kBAAkB,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;KACjD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAA0B,EAAE,KAA2B;IAC/F,OAAO,IAAI,CAAC,kBAAkB,KAAK,KAAK,CAAC,kBAAkB,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC;SAClC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC;SAC7C,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;SACpC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrB,CAAC"}