codexgpt 1.0.0

package/dist/policy/compat.js

@@ -0,0 +1,104 @@
+import { permissionProfileDocumentV1Schema, permissionProfileDocumentV3Schema } from "./schemas.js";
+const HARD_GLOB_PATTERNS = [
+    /^\.git(?:\/\*\*)?$/i,
+    /^\*\*\/\.git(?:\/\*\*)?$/i,
+    /^\.env(?:\.\*|\/\*\*)?$/i,
+    /^\*\*\/\.env(?:\.\*|\/\*\*|\.\*\/\*\*)?$/i,
+    /^\*\*\/\*\.(?:pem|key)$/i,
+    /^\*\*\/(?:id_rsa|id_ed25519)(?:\.\*)?$/i,
+    /^\*\*\/\.ssh\/\*\*$/i
+];
+function isHardPolicyGlob(pattern) {
+    return HARD_GLOB_PATTERNS.some((candidate) => candidate.test(pattern));
+}
+function safeRuleId(index) {
+    return `compat.blocked.${String(index + 1).padStart(4, "0")}`;
+}
+function compatibilityDenyRules(blockedGlobs) {
+    const seen = new Set();
+    const rules = [];
+    for (const pattern of blockedGlobs) {
+        const normalized = pattern.trim().replaceAll("\\", "/");
+        if (!normalized || seen.has(normalized) || isHardPolicyGlob(normalized))
+            continue;
+        seen.add(normalized);
+        rules.push({
+            id: safeRuleId(rules.length),
+            selector: { kind: "deny_glob", pattern: normalized },
+            access: "deny"
+        });
+    }
+    return rules;
+}
+export function compileCompatibilityProfile(config) {
+    const rules = compatibilityDenyRules(config.blockedGlobs);
+    if (config.writeMode === "handoff") {
+        rules.push({
+            id: "compat.write.handoff",
+            selector: { kind: "subtree", path: config.contextDir },
+            access: "write"
+        });
+    }
+    else if (config.writeMode === "workspace") {
+        rules.push({
+            id: "compat.write.workspace",
+            selector: { kind: "subtree", path: "." },
+            access: "write"
+        });
+    }
+    return permissionProfileDocumentV1Schema.parse({
+        schemaVersion: 1,
+        id: "compat-v1",
+        description: "Generated conservative compatibility profile for the current runtime modes.",
+        workspaceRoots: [config.defaultRoot],
+        filesystem: {
+            default: "read",
+            rules
+        },
+        git: {
+            read: true,
+            write: config.writeMode === "workspace",
+            remoteWrite: false
+        },
+        shell: {
+            mode: config.bashMode === "off" ? "disabled" : config.bashMode === "safe" ? "verify" : "execute",
+            requireSandbox: true
+        },
+        process: {
+            manage: false,
+            persistent: false,
+            requireSandbox: true
+        },
+        network: {
+            enabled: false,
+            rules: [],
+            allowLoopback: false,
+            allowPrivate: false,
+            allowLinkLocal: false,
+            requireEnforcement: true
+        }
+    });
+}
+export function compileCompatibilityProfileV3(config) {
+    const v1 = compileCompatibilityProfile(config);
+    const { schemaVersion: _schemaVersion, ...base } = v1;
+    return permissionProfileDocumentV3Schema.parse({
+        ...base,
+        schemaVersion: 3,
+        id: "compat-v3",
+        description: "Generated conservative V3 profile. Ambient full access is not eligible without an explicit profile.",
+        fullAccess: {
+            ambientFilesystem: false,
+            ambientCredentials: false,
+            ambientRegistry: false,
+            unrestrictedNetwork: false,
+            requireBlockedPathEnforcement: true,
+            requireCredentialIsolation: true,
+            requireRegistryIsolation: true,
+            requireDeviceIsolation: true,
+            requireNetworkEnforcement: true,
+            requireSandbox: true
+        }
+    });
+}
+//# sourceMappingURL=compat.js.map

package/dist/policy/compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat.js","sourceRoot":"","sources":["../../src/policy/compat.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,cAAc,CAAC;AAGpG,MAAM,kBAAkB,GAAG;IACzB,qBAAqB;IACrB,2BAA2B;IAC3B,0BAA0B;IAC1B,2CAA2C;IAC3C,0BAA0B;IAC1B,yCAAyC;IACzC,sBAAsB;CACvB,CAAC;AAEF,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,kBAAkB,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,sBAAsB,CAAC,YAA+B;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC;YAAE,SAAS;QAClF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;YAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;YACpD,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAsB;IAChE,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE;YACtD,MAAM,EAAE,OAAO;SAChB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,wBAAwB;YAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE;YACxC,MAAM,EAAE,OAAO;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,iCAAiC,CAAC,KAAK,CAAC;QAC7C,aAAa,EAAE,CAAC;QAChB,EAAE,EAAE,WAAW;QACf,WAAW,EAAE,6EAA6E;QAC1F,cAAc,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;QACpC,UAAU,EAAE;YACV,OAAO,EAAE,MAAM;YACf,KAAK;SACN;QACD,GAAG,EAAE;YACH,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,MAAM,CAAC,SAAS,KAAK,WAAW;YACvC,WAAW,EAAE,KAAK;SACnB;QACD,KAAK,EAAE;YACL,IAAI,EAAE,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAChG,cAAc,EAAE,IAAI;SACrB;QACD,OAAO,EAAE;YACP,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;SACrB;QACD,OAAO,EAAE;YACP,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE;YACT,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,KAAK;YACnB,cAAc,EAAE,KAAK;YACrB,kBAAkB,EAAE,IAAI;SACzB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAsB;IAClE,MAAM,EAAE,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;IACtD,OAAO,iCAAiC,CAAC,KAAK,CAAC;QAC7C,GAAG,IAAI;QACP,aAAa,EAAE,CAAC;QAChB,EAAE,EAAE,WAAW;QACf,WAAW,EAAE,qGAAqG;QAClH,UAAU,EAAE;YACV,iBAAiB,EAAE,KAAK;YACxB,kBAAkB,EAAE,KAAK;YACzB,eAAe,EAAE,KAAK;YACtB,mBAAmB,EAAE,KAAK;YAC1B,6BAA6B,EAAE,IAAI;YACnC,0BAA0B,EAAE,IAAI;YAChC,wBAAwB,EAAE,IAAI;YAC9B,sBAAsB,EAAE,IAAI;YAC5B,yBAAyB,EAAE,IAAI;YAC/B,cAAc,EAAE,IAAI;SACrB;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/policy/context.js

@@ -0,0 +1,31 @@
+import { requestContextV1Schema } from "./schemas.js";
+import { currentPolicyIdentity } from "./identity.js";
+function deepFreeze(value) {
+    if (!value || typeof value !== "object" || Object.isFrozen(value))
+        return value;
+    Object.freeze(value);
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return value;
+}
+export function createRequestContext(source, state) {
+    const transportSessionId = source.transportSessionId().trim();
+    if (!transportSessionId || transportSessionId === "pending") {
+        throw new Error("Policy transport session is not established.");
+    }
+    const context = requestContextV1Schema.parse({
+        schemaVersion: 1,
+        requestId: state.requestId,
+        transportKind: source.transportKind,
+        transportSessionId,
+        identity: structuredClone(currentPolicyIdentity(source)),
+        workspaceId: state.workspaceId,
+        runtimeProfileId: state.runtimeProfileId,
+        permissionProfileId: state.permissionProfileId,
+        policyRevision: state.policyRevision,
+        sessionGrantRevision: state.sessionGrantRevision,
+        receivedAt: state.receivedAt
+    });
+    return deepFreeze(context);
+}
+//# sourceMappingURL=context.js.map

package/dist/policy/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/policy/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAmC,MAAM,eAAe,CAAC;AAavF,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;QAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAkC,EAClC,KAAyB;IAEzB,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC;QAC3C,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,kBAAkB;QAClB,QAAQ,EAAE,eAAe,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACxD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC"}

package/dist/policy/enforcement.js

@@ -0,0 +1,46 @@
+import { sandboxCapabilityReportV1Schema } from "./schemas.js";
+const LEVEL_RANKS = Object.freeze({
+    filesystemReadBoundary: Object.freeze(["none", "brokered", "kernel_enforced"]),
+    filesystemWriteBoundary: Object.freeze(["none", "brokered", "kernel_enforced"]),
+    processTreeControl: Object.freeze(["none", "best_effort", "job_object", "strong"]),
+    networkEgressControl: Object.freeze(["none", "proxy_only", "platform_enforced"]),
+    environmentIsolation: Object.freeze(["none", "filtered", "isolated"]),
+    credentialIsolation: Object.freeze(["none", "partial", "isolated"]),
+    registryIsolation: Object.freeze(["none", "partial", "isolated"])
+});
+export function baselineNodeCapabilityReport(platform = process.platform) {
+    return Object.freeze(sandboxCapabilityReportV1Schema.parse({
+        schemaVersion: 1,
+        backendId: "codexgpt-node-broker",
+        backendVersion: "1",
+        platform,
+        filesystemReadBoundary: "brokered",
+        filesystemWriteBoundary: "brokered",
+        processTreeControl: "none",
+        networkEgressControl: "none",
+        environmentIsolation: "filtered",
+        credentialIsolation: "none",
+        registryIsolation: "none",
+        supportsPeerAddressVerification: false,
+        supportsRedirectReauthorization: false,
+        supportsRevocation: false,
+        evidenceRevision: "node-broker-v1"
+    }));
+}
+export function capabilitySatisfies(report, requirement) {
+    const actual = report[requirement.name];
+    if (typeof requirement.minimum === "boolean")
+        return actual === requirement.minimum;
+    if (typeof actual !== "string")
+        return false;
+    const ranking = LEVEL_RANKS[requirement.name];
+    if (!ranking)
+        return actual === requirement.minimum;
+    const minimumIndex = ranking.indexOf(requirement.minimum);
+    const actualIndex = ranking.indexOf(actual);
+    return minimumIndex >= 0 && actualIndex >= minimumIndex;
+}
+export function missingCapabilities(required, report) {
+    return required.filter((requirement) => !capabilitySatisfies(report, requirement));
+}
+//# sourceMappingURL=enforcement.js.map

package/dist/policy/enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.js","sourceRoot":"","sources":["../../src/policy/enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,cAAc,CAAC;AAG/D,MAAM,WAAW,GAAgD,MAAM,CAAC,MAAM,CAAC;IAC7E,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAC9E,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAC/E,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAClF,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;IAChF,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACrE,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACnE,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;CAClE,CAAC,CAAC;AAEH,MAAM,UAAU,4BAA4B,CAC1C,WAA4B,OAAO,CAAC,QAAQ;IAE5C,OAAO,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,KAAK,CAAC;QACzD,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,sBAAsB;QACjC,cAAc,EAAE,GAAG;QACnB,QAAQ;QACR,sBAAsB,EAAE,UAAU;QAClC,uBAAuB,EAAE,UAAU;QACnC,kBAAkB,EAAE,MAAM;QAC1B,oBAAoB,EAAE,MAAM;QAC5B,oBAAoB,EAAE,UAAU;QAChC,mBAAmB,EAAE,MAAM;QAC3B,iBAAiB,EAAE,MAAM;QACzB,+BAA+B,EAAE,KAAK;QACtC,+BAA+B,EAAE,KAAK;QACtC,kBAAkB,EAAE,KAAK;QACzB,gBAAgB,EAAE,gBAAgB;KACnC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAiC,EACjC,WAAiC;IAEjC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,MAAM,KAAK,WAAW,CAAC,OAAO,CAAC;IACpF,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,KAAK,WAAW,CAAC,OAAO,CAAC;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,YAAY,IAAI,CAAC,IAAI,WAAW,IAAI,YAAY,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAyC,EACzC,MAAiC;IAEjC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AACrF,CAAC"}

package/dist/policy/evaluator.js

@@ -0,0 +1,338 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { minimatch } from "minimatch";
+import { credentialRevisionForCredentialRef, credentialRevisionForIdentity } from "../auth/policyIdentity.js";
+import { evaluateHardPolicy } from "./hardPolicy.js";
+import { policyDecisionV1Schema } from "./schemas.js";
+const ACCESS_TIE_PRIORITY = {
+    write: 0,
+    read: 1,
+    deny: 2
+};
+const LEVEL_RANKS = {
+    filesystemReadBoundary: ["none", "brokered", "kernel_enforced"],
+    filesystemWriteBoundary: ["none", "brokered", "kernel_enforced"],
+    processTreeControl: ["none", "best_effort", "job_object", "strong"],
+    networkEgressControl: ["none", "proxy_only", "platform_enforced"],
+    environmentIsolation: ["none", "filtered", "isolated"],
+    credentialIsolation: ["none", "partial", "isolated"],
+    registryIsolation: ["none", "partial", "isolated"]
+};
+export function compareSpecificity(left, right) {
+    const length = Math.max(left.length, right.length);
+    for (let index = 0; index < length; index += 1) {
+        const delta = (left[index] ?? 0) - (right[index] ?? 0);
+        if (delta !== 0)
+            return delta;
+    }
+    return 0;
+}
+function normalizePolicyPath(value, platform) {
+    const normalized = path.posix.normalize(value.replaceAll("\\", "/")).normalize("NFC");
+    return platform === "win32" ? normalized.toLocaleLowerCase("en-US") : normalized;
+}
+function selectorSpecificity(kind, value) {
+    if (kind === "exact")
+        return [3, value.split("/").length, value.length];
+    if (kind === "subtree")
+        return [2, value === "." ? 0 : value.split("/").length, value.length];
+    const literalCharacters = value.replace(/[*?{}[\]!]/g, "").length;
+    const wildcardCount = (value.match(/[*?]/g) ?? []).length;
+    const literalSegments = value.split("/").filter((segment) => !/[*?{}[\]!]/.test(segment)).length;
+    return [1, literalSegments, literalCharacters, -wildcardCount];
+}
+function filesystemProfileEvaluation(profile, resource, platform) {
+    const target = resource.comparisonKey;
+    const matches = profile.filesystem.rules.flatMap((rule) => {
+        if (rule.selector.kind === "deny_glob") {
+            const pattern = platform === "win32"
+                ? rule.selector.pattern.toLocaleLowerCase("en-US")
+                : rule.selector.pattern;
+            if (!minimatch(target, pattern, { dot: true, nocase: platform === "win32", matchBase: false }))
+                return [];
+            return [{ rule, specificity: selectorSpecificity("deny_glob", pattern) }];
+        }
+        const selectorPath = normalizePolicyPath(rule.selector.path, platform);
+        const matchesSelector = rule.selector.kind === "exact"
+            ? target === selectorPath
+            : selectorPath === "." || target === selectorPath || target.startsWith(`${selectorPath}/`);
+        return matchesSelector ? [{ rule, specificity: selectorSpecificity(rule.selector.kind, selectorPath) }] : [];
+    });
+    let selected;
+    for (const candidate of matches) {
+        if (!selected) {
+            selected = candidate;
+            continue;
+        }
+        const specificity = compareSpecificity(candidate.specificity, selected.specificity);
+        if (specificity > 0 || (specificity === 0 && ACCESS_TIE_PRIORITY[candidate.rule.access] > ACCESS_TIE_PRIORITY[selected.rule.access])) {
+            selected = candidate;
+        }
+    }
+    const access = selected?.rule.access ?? profile.filesystem.default;
+    const required = resource.operation === "read" || resource.operation === "list" || resource.operation === "search"
+        ? "read"
+        : "write";
+    const allowed = required === "write"
+        ? access === "write"
+        : access === "read" || (access === "write" && profile.filesystem.default === "read");
+    return {
+        allowed,
+        safeRuleId: selected?.rule.id ?? `profile.fs.default.${profile.filesystem.default}`,
+        specificity: selected?.specificity ?? [0, 0, 0]
+    };
+}
+function filesystemBatchProfileEvaluation(profile, resource, platform) {
+    const paths = resource.entries.flatMap((entry) => [
+        entry.sourceComparisonKey,
+        entry.destinationComparisonKey
+    ].filter((value) => value !== null));
+    const evaluations = paths.map((comparisonKey) => filesystemProfileEvaluation(profile, {
+        schemaVersion: 1,
+        kind: "filesystem",
+        operation: "write",
+        workspaceId: resource.workspaceId,
+        relativePath: comparisonKey,
+        comparisonKey,
+        targetExists: false,
+        containment: "inside",
+        existingParentIdentity: "parent_batch_policy",
+        unresolvedSuffix: [],
+        resourceFingerprint: resource.resourceFingerprint
+    }, platform));
+    const denied = evaluations.find((evaluation) => !evaluation.allowed);
+    if (denied)
+        return denied;
+    return evaluations.reduce((selected, evaluation) => compareSpecificity(evaluation.specificity, selected.specificity) > 0 ? evaluation : selected);
+}
+function hostRuleMatches(ruleHost, targetHost) {
+    if (ruleHost.startsWith("**.")) {
+        const suffix = ruleHost.slice(3);
+        return targetHost === suffix || targetHost.endsWith(`.${suffix}`);
+    }
+    if (ruleHost.startsWith("*.")) {
+        const suffix = ruleHost.slice(2);
+        return targetHost !== suffix && targetHost.endsWith(`.${suffix}`);
+    }
+    return targetHost === ruleHost;
+}
+function portRuleMatches(ports, port) {
+    if (ports.length === 0)
+        return false;
+    const first = ports[0];
+    if (typeof first === "number")
+        return ports.includes(port);
+    return ports.some((range) => port >= range.from && port <= range.to);
+}
+function portWidth(ports) {
+    const first = ports[0];
+    if (typeof first === "number")
+        return Math.max(1, ports.length);
+    return Math.max(1, ports.reduce((total, range) => total + range.to - range.from + 1, 0));
+}
+function networkProfileEvaluation(profile, resource) {
+    if (!profile.network.enabled)
+        return { allowed: false, safeRuleId: "profile.network.disabled", specificity: [0] };
+    if (resource.addressClasses.includes("loopback") && !profile.network.allowLoopback) {
+        return { allowed: false, safeRuleId: "profile.network.loopback-denied", specificity: [4] };
+    }
+    if (resource.addressClasses.includes("private") && !profile.network.allowPrivate) {
+        return { allowed: false, safeRuleId: "profile.network.private-denied", specificity: [4] };
+    }
+    if (resource.addressClasses.includes("link_local") && !profile.network.allowLinkLocal) {
+        return { allowed: false, safeRuleId: "profile.network.link-local-denied", specificity: [4] };
+    }
+    if (resource.addressClasses.some((value) => value === "multicast" || value === "unspecified" || value === "reserved")) {
+        return { allowed: false, safeRuleId: "profile.network.special-address-denied", specificity: [4] };
+    }
+    const matches = profile.network.rules.flatMap((rule) => {
+        const normalizedRuleHost = rule.host.toLocaleLowerCase("en-US").replace(/\.$/, "");
+        if (!hostRuleMatches(normalizedRuleHost, resource.host) || !portRuleMatches(rule.ports, resource.port))
+            return [];
+        const hostClass = normalizedRuleHost.startsWith("**.") ? 1 : normalizedRuleHost.startsWith("*.") ? 2 : 3;
+        const literal = normalizedRuleHost.replace(/^\*\*?\./, "");
+        return [{
+                rule,
+                specificity: [hostClass, literal.split(".").length, literal.length, -portWidth(rule.ports)]
+            }];
+    });
+    let selected;
+    for (const candidate of matches) {
+        if (!selected) {
+            selected = candidate;
+            continue;
+        }
+        const specificity = compareSpecificity(candidate.specificity, selected.specificity);
+        if (specificity > 0 || (specificity === 0 && candidate.rule.access === "deny" && selected.rule.access === "allow")) {
+            selected = candidate;
+        }
+    }
+    return selected
+        ? { allowed: selected.rule.access === "allow", safeRuleId: selected.rule.id, specificity: selected.specificity }
+        : { allowed: false, safeRuleId: "profile.network.default-deny", specificity: [0] };
+}
+export function evaluateProfile(profile, resource, platform = process.platform) {
+    switch (resource.kind) {
+        case "filesystem":
+            return filesystemProfileEvaluation(profile, resource, platform);
+        case "filesystem_batch":
+            return filesystemBatchProfileEvaluation(profile, resource, platform);
+        case "git": {
+            const allowed = resource.operation === "read"
+                ? profile.git.read
+                : resource.operation === "remote_write"
+                    ? profile.git.remoteWrite
+                    : profile.git.write;
+            return { allowed, safeRuleId: `profile.git.${resource.operation}`, specificity: [1] };
+        }
+        case "shell": {
+            const allowed = resource.operation === "verify"
+                ? profile.shell.mode === "verify" || profile.shell.mode === "execute"
+                : profile.shell.mode === "execute";
+            return { allowed, safeRuleId: `profile.shell.${profile.shell.mode}`, specificity: [1] };
+        }
+        case "process":
+            return {
+                allowed: profile.process.manage && (!resource.persistence || profile.process.persistent),
+                safeRuleId: resource.persistence ? "profile.process.persistent" : "profile.process.manage",
+                specificity: [1]
+            };
+        case "network":
+            return networkProfileEvaluation(profile, resource);
+        case "audit":
+            return { allowed: true, safeRuleId: "profile.audit.query", specificity: [1] };
+    }
+}
+function scopeForResource(resource) {
+    switch (resource.kind) {
+        case "filesystem":
+            return resource.operation === "read" || resource.operation === "list" || resource.operation === "search"
+                ? "filesystem:read"
+                : "filesystem:write";
+        case "filesystem_batch":
+            return "filesystem:write";
+        case "git":
+            return resource.operation === "read" ? "git:read" : resource.operation === "remote_write" ? "git:remote-write" : "git:write";
+        case "shell":
+            return resource.operation === "verify" ? "shell:verify" : "shell:execute";
+        case "process":
+            return "process:manage";
+        case "network":
+            return "network:connect";
+        case "audit":
+            return "audit:read";
+    }
+}
+function capabilitySatisfies(report, requirement) {
+    const actual = report[requirement.name];
+    if (typeof requirement.minimum === "boolean")
+        return actual === requirement.minimum;
+    if (typeof actual !== "string")
+        return false;
+    const ranking = LEVEL_RANKS[requirement.name];
+    if (!ranking)
+        return actual === requirement.minimum;
+    return ranking.indexOf(actual) >= ranking.indexOf(requirement.minimum) && ranking.indexOf(requirement.minimum) >= 0;
+}
+export function missingCapabilities(required, report) {
+    return required.filter((requirement) => !capabilitySatisfies(report, requirement));
+}
+function grantMatches(input, grant) {
+    const now = Date.parse(input.now);
+    return grant.credentialRef === input.context.identity.credentialRef &&
+        (grant.credentialRevision ?? credentialRevisionForCredentialRef(grant.credentialRef)) === credentialRevisionForIdentity(input.context.identity) &&
+        grant.transportSessionId === input.context.transportSessionId &&
+        grant.workspaceId === input.context.workspaceId &&
+        grant.policyRevision === input.context.policyRevision &&
+        grant.toolContractVersion === input.toolContractVersion &&
+        grant.operation === `${input.resource.kind}.${input.resource.operation}` &&
+        grant.resourceFingerprint === input.resource.resourceFingerprint &&
+        grant.inputDigest === input.inputDigest &&
+        grant.riskClass === input.riskClass &&
+        Date.parse(grant.issuedAt) <= now &&
+        Date.parse(grant.expiresAt) > now &&
+        (grant.usesRemaining === null || grant.usesRemaining > 0);
+}
+function provenance(sourceKind, safeRuleId, specificity = [], overrides = {}) {
+    return {
+        sourceKind,
+        safeRuleId,
+        specificity,
+        grantId: null,
+        approvalId: null,
+        enforcementBackend: null,
+        ...overrides
+    };
+}
+function deterministicDecisionId(input) {
+    const digest = createHash("sha256").update(JSON.stringify(input), "utf8").digest("hex").slice(0, 24);
+    return `decision_${digest}`;
+}
+function decision(input, outcome, reasonCode, decisionProvenance, requiredApproval = null, requiredEnforcement = []) {
+    const facts = {
+        outcome,
+        reasonCode,
+        policyRevision: input.activePolicyRevision,
+        resourceFingerprint: input.resource.resourceFingerprint,
+        requiredApproval,
+        requiredEnforcement,
+        provenance: decisionProvenance
+    };
+    return policyDecisionV1Schema.parse({
+        schemaVersion: 1,
+        decisionId: deterministicDecisionId(facts),
+        ...facts
+    });
+}
+function enforcementReason(resource) {
+    if (resource.kind === "shell")
+        return "SHELL_SANDBOX_UNAVAILABLE";
+    if (resource.kind === "process")
+        return "PROCESS_SANDBOX_UNAVAILABLE";
+    if (resource.kind === "network")
+        return "NETWORK_ENFORCEMENT_UNAVAILABLE";
+    return "POLICY_CONFIG_INVALID";
+}
+function approvalRequirement(riskClass) {
+    return {
+        riskClass,
+        maxTtlMs: riskClass === "R1" ? 30 * 60_000 : riskClass === "R2" ? 5 * 60_000 : 2 * 60_000,
+        uses: riskClass === "R3" ? 1 : null
+    };
+}
+export function evaluatePolicy(input) {
+    if (input.context.policyRevision !== input.activePolicyRevision) {
+        return decision(input, "deny", "POLICY_CONTEXT_STALE", [provenance("deployment", "policy.context.stale")]);
+    }
+    const hardMatches = evaluateHardPolicy(input.resource, { capabilityDisabled: input.deploymentDisabled });
+    if (hardMatches.length > 0) {
+        return decision(input, "deny", "POLICY_DENIED", [provenance("hard_policy", hardMatches[0].id)]);
+    }
+    const requiredScope = scopeForResource(input.resource);
+    if (!input.context.identity.scopes.includes(requiredScope)) {
+        return decision(input, "deny", "POLICY_DENIED", [provenance("identity_scope", `scope.${requiredScope}`)]);
+    }
+    const profileResult = evaluateProfile(input.profile, input.resource, input.platform);
+    if (!profileResult.allowed) {
+        return decision(input, "deny", "POLICY_DENIED", [provenance("permission_profile", profileResult.safeRuleId, profileResult.specificity)]);
+    }
+    const missing = missingCapabilities(input.requiredCapabilities, input.capabilities);
+    if (missing.length > 0) {
+        return decision(input, "enforcement_unavailable", enforcementReason(input.resource), [provenance("enforcement", "enforcement.capability.missing", [], { enforcementBackend: input.capabilities.backendId })], null, missing);
+    }
+    if (input.riskClass === "R4") {
+        return decision(input, "deny", "POLICY_DENIED", [provenance("approval_policy", "approval.r4.unapprovable")]);
+    }
+    if (input.riskClass === "R0") {
+        return decision(input, "allow", null, [provenance("permission_profile", profileResult.safeRuleId, profileResult.specificity)]);
+    }
+    const matchingGrant = input.grants.find((grant) => grantMatches(input, grant));
+    if (matchingGrant) {
+        return decision(input, "allow", null, [
+            provenance("permission_profile", profileResult.safeRuleId, profileResult.specificity),
+            provenance("session_grant", "grant.exact", [], { grantId: matchingGrant.grantId })
+        ]);
+    }
+    return decision(input, "approval_required", "APPROVAL_REQUIRED", [provenance("approval_policy", `approval.${input.riskClass.toLocaleLowerCase("en-US")}`)], approvalRequirement(input.riskClass));
+}
+//# sourceMappingURL=evaluator.js.map

package/dist/policy/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../src/policy/evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAyCtD,MAAM,mBAAmB,GAAqC;IAC5D,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,WAAW,GAAsC;IACrD,sBAAsB,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,iBAAiB,CAAC;IAC/D,uBAAuB,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,iBAAiB,CAAC;IAChE,kBAAkB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC;IACnE,oBAAoB,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,mBAAmB,CAAC;IACjE,oBAAoB,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC;IACtD,mBAAmB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC;IACpD,iBAAiB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC;CACnD,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAuB,EAAE,KAAwB;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,QAAyB;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtF,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;AACnF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAuC,EAAE,KAAa;IACjF,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC,EAAE,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9F,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IAClE,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACjG,OAAO,CAAC,CAAC,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC,aAAa,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAoC,EACpC,QAA8B,EAC9B,QAAyB;IAEzB,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,QAAQ,KAAK,OAAO;gBAClC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;gBAClD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,KAAK,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC1G,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;YACpD,CAAC,CAAC,MAAM,KAAK,YAAY;YACzB,CAAC,CAAC,YAAY,KAAK,GAAG,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC;QAC7F,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/G,CAAC,CAAC,CAAC;IAEH,IAAI,QAA4C,CAAC;IACjD,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,SAAS,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpF,IAAI,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,IAAI,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACrI,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACnE,MAAM,QAAQ,GAAqB,QAAQ,CAAC,SAAS,KAAK,MAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ;QAClI,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,OAAO,GAAG,QAAQ,KAAK,OAAO;QAClC,CAAC,CAAC,MAAM,KAAK,OAAO;QACpB,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;IACvF,OAAO;QACL,OAAO;QACP,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,sBAAsB,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE;QACnF,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,OAAoC,EACpC,QAAmC,EACnC,QAAyB;IAEzB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAChD,KAAK,CAAC,mBAAmB;QACzB,KAAK,CAAC,wBAAwB;KAC/B,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE;QACpF,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,OAAO;QAClB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,YAAY,EAAE,aAAa;QAC3B,aAAa;QACb,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,QAAQ;QACrB,sBAAsB,EAAE,qBAAqB;QAC7C,gBAAgB,EAAE,EAAE;QACpB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;KAClD,EAAE,QAAQ,CAAC,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,CACjD,kBAAkB,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,UAAkB;IAC3D,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,OAAO,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,OAAO,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,UAAU,KAAK,QAAQ,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,KAAuE,EAAE,IAAY;IAC5G,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAQ,KAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzE,OAAQ,KAA6C,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;AAChH,CAAC;AAED,SAAS,SAAS,CAAC,KAAuE;IACxF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAG,KAAkB,CAAC,MAAM,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAG,KAA6C,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACpI,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAoC,EAAE,QAA2B;IACjG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACnF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,iCAAiC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,gCAAgC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACtF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,mCAAmC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,UAAU,CAAC,EAAE,CAAC;QACtH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,wCAAwC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACrD,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,eAAe,CAAC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAClH,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC;gBACN,IAAI;gBACJ,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC5F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,QAA4C,CAAC;IACjD,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,SAAS,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpF,IAAI,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;YACnH,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE;QAChH,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,8BAA8B,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAoC,EACpC,QAA8B,EAC9B,WAA4B,OAAO,CAAC,QAAQ;IAE5C,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,YAAY;YACf,OAAO,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClE,KAAK,kBAAkB;YACrB,OAAO,gCAAgC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvE,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,KAAK,MAAM;gBAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI;gBAClB,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,cAAc;oBACrC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW;oBACzB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,QAAQ,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,KAAK,QAAQ;gBAC7C,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBACrE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,CAAC;QACD,KAAK,SAAS;YACZ,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;gBACxF,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,wBAAwB;gBAC1F,WAAW,EAAE,CAAC,CAAC,CAAC;aACjB,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrD,KAAK,OAAO;YACV,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA8B;IACtD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC,SAAS,KAAK,MAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ;gBACtG,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,kBAAkB,CAAC;QACzB,KAAK,kBAAkB;YACrB,OAAO,kBAAkB,CAAC;QAC5B,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/H,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC;QAC5E,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC;QAC3B,KAAK,OAAO;YACV,OAAO,YAAY,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAiC,EAAE,WAAiC;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,MAAM,KAAK,WAAW,CAAC,OAAO,CAAC;IACpF,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,KAAK,WAAW,CAAC,OAAO,CAAC;IACpD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAyC,EACzC,MAAiC;IAEjC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,YAAY,CAAC,KAA0B,EAAE,KAAqB;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa;QACjE,CAAC,KAAK,CAAC,kBAAkB,IAAI,kCAAkC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC/I,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,OAAO,CAAC,kBAAkB;QAC7D,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,WAAW;QAC/C,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,cAAc;QACrD,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;QACvD,KAAK,CAAC,SAAS,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE;QACxE,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,QAAQ,CAAC,mBAAmB;QAChE,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACvC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG;QACjC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG;QACjC,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CACjB,UAAoD,EACpD,UAAyB,EACzB,cAAwB,EAAE,EAC1B,YAAiD,EAAE;IAEnD,OAAO;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,kBAAkB,EAAE,IAAI;QACxB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAA6D;IAC5F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrG,OAAO,YAAY,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ,CACf,KAA0B,EAC1B,OAAoC,EACpC,UAAmC,EACnC,kBAAgD,EAChD,mBAAyD,IAAI,EAC7D,sBAA8C,EAAE;IAEhD,MAAM,KAAK,GAAG;QACZ,OAAO;QACP,UAAU;QACV,cAAc,EAAE,KAAK,CAAC,oBAAoB;QAC1C,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAmB;QACvD,gBAAgB;QAChB,mBAAmB;QACnB,UAAU,EAAE,kBAAkB;KAC/B,CAAC;IACF,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,uBAAuB,CAAC,KAAK,CAAC;QAC1C,GAAG,KAAK;KACT,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA8B;IACvD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,2BAA2B,CAAC;IAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,6BAA6B,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,iCAAiC,CAAC;IAC1E,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA0C;IACrE,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM;QACzF,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAChE,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzG,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3D,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,SAAS,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,UAAU,CAAC,oBAAoB,EAAE,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC3I,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,QAAQ,CACb,KAAK,EACL,yBAAyB,EACzB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACjC,CAAC,UAAU,CAAC,aAAa,EAAE,gCAAgC,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,EACvH,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,oBAAoB,EAAE,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACjI,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;YACpC,UAAU,CAAC,oBAAoB,EAAE,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,WAAW,CAAC;YACrF,UAAU,CAAC,eAAe,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC;SACnF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CACb,KAAK,EACL,mBAAmB,EACnB,mBAAmB,EACnB,CAAC,UAAU,CAAC,iBAAiB,EAAE,YAAY,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EACzF,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CACrC,CAAC;AACJ,CAAC"}

package/dist/policy/executionCapabilities.js

@@ -0,0 +1,80 @@
+import { assertFullAccessProfileEligibleV3 } from "./fullAccessResources.js";
+function safeIdentifier(value, name) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/.test(value))
+        throw new Error(`${name} is invalid.`);
+    return value;
+}
+export function fullAccessCapabilityReportV3(input) {
+    return Object.freeze({
+        schemaVersion: 3,
+        backendId: safeIdentifier(input.backendId, "backendId"),
+        backendVersion: safeIdentifier(input.backendVersion, "backendVersion"),
+        evidenceRevision: safeIdentifier(input.evidenceRevision, "evidenceRevision"),
+        authorityMode: "full_access",
+        filesystemBoundary: "none",
+        credentialIsolation: "none",
+        registryIsolation: "none",
+        networkPosture: "unrestricted_host",
+        networkEgressControl: "none",
+        processTreeControl: "job_object_members_only",
+        brokerEscapeResistance: "none"
+    });
+}
+export function requiredExecutionCapabilitiesV3(input) {
+    if (input.mode === "full_access") {
+        assertFullAccessProfileEligibleV3(input.profile);
+        return Object.freeze(["job_object_members_only", "unrestricted_host"]);
+    }
+    if (input.requestedNetworkDestinations.length > 0)
+        throw new Error("NETWORK_ENFORCEMENT_UNAVAILABLE");
+    return Object.freeze([
+        "snapshot_private",
+        "isolated_credentials",
+        "protected_registry",
+        "deny_all_network",
+        "sandbox_job",
+        "sandbox_proved"
+    ]);
+}
+export class CapabilityEvidenceStoreV3 {
+    #report;
+    #callbacks;
+    #seen = new Set();
+    #updating = false;
+    constructor(input) {
+        this.#report = Object.freeze(structuredClone(input.report));
+        this.#callbacks = input.callbacks ?? {};
+        this.#seen.add(this.#report.evidenceRevision);
+    }
+    snapshot() {
+        if (this.#updating)
+            throw new Error("Capability evidence update is active; new requests fail closed.");
+        return this.#report;
+    }
+    async replace(next) {
+        if (this.#updating)
+            throw new Error("Capability evidence update is already active.");
+        if (next.evidenceRevision === this.#report.evidenceRevision) {
+            if (JSON.stringify(next) !== JSON.stringify(this.#report)) {
+                throw new Error("Capability evidence revision cannot change meaning.");
+            }
+            return;
+        }
+        if (this.#seen.has(next.evidenceRevision))
+            throw new Error("Capability evidence revision rollback is stale.");
+        this.#updating = true;
+        try {
+            await this.#callbacks.revokePendingAndGrants?.();
+            await this.#callbacks.quarantineProcessInput?.();
+            await this.#callbacks.terminateProcesses?.();
+            await this.#callbacks.revokeWorkspaces?.();
+            await this.#callbacks.cleanupAuthenticatedState?.();
+            this.#report = Object.freeze(structuredClone(next));
+            this.#seen.add(next.evidenceRevision);
+        }
+        finally {
+            this.#updating = false;
+        }
+    }
+}
+//# sourceMappingURL=executionCapabilities.js.map