specky-sdd 3.4.0 → 3.6.0

package/dist/config.js

@@ -5,6 +5,15 @@
  * Parsing uses the `yaml` library (safe by default — no code execution) and a
  * Zod schema for validation, replacing a hand-rolled line parser that could not
  * handle nested lists/quoting and did no validation.
+ *
+ * Profiles: `standard` (default) keeps every enterprise control opt-in and
+ * off. `enterprise` flips the *defaults* of audit_enabled, rbac.enabled,
+ * rate_limit.enabled, and audit.fail_closed to true — an explicit value in
+ * config.yml always wins over the profile default, so an enterprise deployment
+ * can still switch an individual control off. The profile itself can come from
+ * config.yml (`profile: enterprise`), the `SPECKY_PROFILE` env var, the
+ * `SPECKY_ENTERPRISE=1` shorthand, or the server's `--profile=enterprise` flag
+ * (flag > env > config file).
  */
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -19,6 +28,7 @@ const safeRelativePath = z.string().refine((p) => p === "" ||
         !p.includes("\0")), { message: "templates_path must be a workspace-relative path (no absolute paths, no '..')." });
 const configSchema = z
     .object({
+    profile: z.enum(["standard", "enterprise"]).default("standard"),
     templates_path: safeRelativePath.default(""),
     default_framework: z.string().default("vitest"),
     compliance_frameworks: z.array(z.string()).default(["general"]),
@@ -34,30 +44,101 @@ const configSchema = z
         .object({
         export_format: z.enum(["jsonl", "syslog", "otlp"]).default("jsonl"),
         max_file_size_mb: z.number().positive().default(10),
+        fail_closed: z.boolean().default(false),
     })
-        .default({ export_format: "jsonl", max_file_size_mb: 10 }),
+        .default({ export_format: "jsonl", max_file_size_mb: 10, fail_closed: false }),
     rbac: z
         .object({
         enabled: z.boolean().default(false),
         default_role: z.enum(["viewer", "contributor", "admin"]).default("contributor"),
     })
         .default({ enabled: false, default_role: "contributor" }),
+    pipeline: z
+        .object({
+        // Server-side LGTM enforcement: when true, sdd_advance_phase refuses to
+        // complete the specify/design/tasks quality gates unless the caller
+        // passes lgtm: true. Off by default (zero behavior change) and NOT
+        // flipped by the enterprise profile — human-review gating is a workflow
+        // choice, not a security control.
+        require_lgtm: z.boolean().default(false),
+    })
+        .default({ require_lgtm: false }),
 })
     .strip();
 const DEFAULT_CONFIG = configSchema.parse({});
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Resolve the active profile. Precedence: `--profile=` flag > `SPECKY_PROFILE`
+ * env > `SPECKY_ENTERPRISE=1` shorthand > config.yml `profile:` > standard.
+ * Unknown values are ignored with a stderr warning (never crash the server).
+ */
+export function resolveProfile(configProfile, overrides = {}) {
+    const argv = overrides.argv ?? process.argv;
+    const env = overrides.env ?? process.env;
+    const flagValue = argv
+        .filter((a) => a.startsWith("--profile="))
+        .at(-1)
+        ?.slice("--profile=".length);
+    const candidates = [
+        flagValue,
+        env["SPECKY_PROFILE"],
+        env["SPECKY_ENTERPRISE"] === "1" ? "enterprise" : undefined,
+    ];
+    for (const candidate of candidates) {
+        if (candidate === undefined)
+            continue;
+        if (candidate === "standard" || candidate === "enterprise")
+            return candidate;
+        console.error(`[specky] Ignoring unknown profile "${candidate}" (valid: standard, enterprise).`);
+    }
+    return configProfile;
+}
+/**
+ * Enterprise profile flips the *defaults* of the security controls to ON.
+ * A value explicitly present in config.yml always wins, so `rawConfig` (the
+ * parsed YAML before Zod defaults) is consulted to tell "user said false"
+ * apart from "user said nothing".
+ */
+function applyEnterpriseDefaults(config, rawConfig) {
+    const raw = isRecord(rawConfig) ? rawConfig : {};
+    const rawRbac = isRecord(raw["rbac"]) ? raw["rbac"] : {};
+    const rawRateLimit = isRecord(raw["rate_limit"]) ? raw["rate_limit"] : {};
+    const rawAudit = isRecord(raw["audit"]) ? raw["audit"] : {};
+    return {
+        ...config,
+        audit_enabled: "audit_enabled" in raw ? config.audit_enabled : true,
+        rbac: {
+            ...config.rbac,
+            enabled: "enabled" in rawRbac ? config.rbac.enabled : true,
+        },
+        rate_limit: {
+            ...config.rate_limit,
+            enabled: "enabled" in rawRateLimit ? config.rate_limit.enabled : true,
+        },
+        audit: {
+            ...config.audit,
+            fail_closed: "fail_closed" in rawAudit ? config.audit.fail_closed : true,
+        },
+    };
+}
 /**
  * Load `.specky/config.yml` from workspace root. Returns defaults if the file
  * is absent, unparseable, or fails validation (a bad value never crashes the
  * server — it falls back to the safe defaults, with a stderr warning).
+ *
+ * `overrides` lets the server entry point (and tests) inject argv/env for
+ * profile resolution instead of reading globals.
  */
-export function loadConfig(workspaceRoot) {
+export function loadConfig(workspaceRoot, overrides = {}) {
     const configPath = join(workspaceRoot, ".specky", "config.yml");
     let raw;
     try {
         raw = readFileSync(configPath, "utf-8");
     }
     catch {
-        return { ...DEFAULT_CONFIG };
+        return finalizeConfig({ ...DEFAULT_CONFIG }, {}, overrides);
     }
     let parsed;
     try {
@@ -65,13 +146,18 @@ export function loadConfig(workspaceRoot) {
     }
     catch (err) {
         console.error(`[specky] Ignoring malformed .specky/config.yml: ${err.message}`);
-        return { ...DEFAULT_CONFIG };
+        return finalizeConfig({ ...DEFAULT_CONFIG }, {}, overrides);
     }
     const result = configSchema.safeParse(parsed);
     if (!result.success) {
         console.error(`[specky] Ignoring invalid .specky/config.yml: ${result.error.issues.map((i) => i.message).join("; ")}`);
-        return { ...DEFAULT_CONFIG };
+        return finalizeConfig({ ...DEFAULT_CONFIG }, {}, overrides);
     }
-    return result.data;
+    return finalizeConfig(result.data, parsed, overrides);
+}
+function finalizeConfig(config, rawConfig, overrides) {
+    const profile = resolveProfile(config.profile, overrides);
+    const resolved = { ...config, profile };
+    return profile === "enterprise" ? applyEnterpriseDefaults(resolved, rawConfig) : resolved;
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,EAAE;IACR,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QACnB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EACtB,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAC9F,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/C,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/D,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KAC/C,CAAC;SACD,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACtE,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KACpD,CAAC;SACD,OAAO,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;IAC5D,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;KAChF,CAAC;SACD,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;CAC5D,CAAC;KACD,KAAK,EAAE,CAAC;AAIX,MAAM,cAAc,GAAiB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,aAAqB;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,mDAAoD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iDAAiD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;QACF,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,EAAE;IACR,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QACjB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QACnB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EACtB,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAC9F,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/D,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/C,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/D,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KAC/C,CAAC;SACD,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACtE,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACxC,CAAC;SACD,OAAO,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChF,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;KAChF,CAAC;SACD,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;IAC3D,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,wEAAwE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,wEAAwE;QACxE,kCAAkC;QAClC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACzC,CAAC;SACD,OAAO,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;CACpC,CAAC;KACD,KAAK,EAAE,CAAC;AAKX,MAAM,cAAc,GAAiB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAQ5D,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,aAA4B,EAC5B,YAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEzC,MAAM,SAAS,GAAG,IAAI;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;SACzC,EAAE,CAAC,CAAC,CAAC,CAAC;QACP,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,UAAU,GAA8B;QAC5C,SAAS;QACT,GAAG,CAAC,gBAAgB,CAAC;QACrB,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KAC5D,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,IAAI,SAAS,KAAK,UAAU,IAAI,SAAS,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QAC7E,OAAO,CAAC,KAAK,CACX,sCAAsC,SAAS,kCAAkC,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,MAAoB,EAAE,SAAkB;IACvE,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5D,OAAO;QACL,GAAG,MAAM;QACT,aAAa,EAAE,eAAe,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;QACnE,IAAI,EAAE;YACJ,GAAG,MAAM,CAAC,IAAI;YACd,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SAC3D;QACD,UAAU,EAAE;YACV,GAAG,MAAM,CAAC,UAAU;YACpB,OAAO,EAAE,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SACtE;QACD,KAAK,EAAE;YACL,GAAG,MAAM,CAAC,KAAK;YACf,WAAW,EAAE,aAAa,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;SACzE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,aAAqB,EAAE,YAA8B,EAAE;IAChF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC,EAAE,GAAG,cAAc,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,mDAAoD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO,cAAc,CAAC,EAAE,GAAG,cAAc,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iDAAiD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;QACF,OAAO,cAAc,CAAC,EAAE,GAAG,cAAc,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CACrB,MAAoB,EACpB,SAAkB,EAClB,SAA2B;IAE3B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;IACxC,OAAO,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC5F,CAAC"}

package/dist/index.js

@@ -9,7 +9,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { randomUUID } from "node:crypto";
-import { isBearerAuthorized } from "./utils/http-auth.js";
 import { VERSION, SERVER_NAME, DEFAULT_HTTP_PORT } from "./constants.js";
 import { FileManager } from "./services/file-manager.js";
 import { StateMachine } from "./services/state-machine.js";
@@ -45,7 +44,8 @@ import { registerTurnkeyTools } from "./tools/turnkey.js";
 import { PbtGenerator } from "./services/pbt-generator.js";
 import { registerPbtTools } from "./tools/pbt.js";
 import { loadConfig } from "./config.js";
-import { AuditLogger } from "./services/audit-logger.js";
+import { AuditLogger, resolveAuditHmacKey } from "./services/audit-logger.js";
+import { loadTokenTable, resolveBearerIdentity, sha256Hex } from "./utils/token-table.js";
 import { MetricsGenerator } from "./services/metrics-generator.js";
 import { registerMetricsTools } from "./tools/metrics.js";
 import { ModelRoutingEngine } from "./services/model-routing-engine.js";
@@ -64,12 +64,26 @@ import { registerAuditTools } from "./tools/audit.js";
 // Resolve workspace root
 const workspaceRoot = process.env["SDD_WORKSPACE"] || process.cwd();
 console.error(`[specky] Workspace root: ${workspaceRoot}`);
-// Load optional project config (.specky/config.yml)
+// Load optional project config (.specky/config.yml). The profile may be
+// forced from outside the workspace: --profile=enterprise flag, SPECKY_PROFILE
+// env, or SPECKY_ENTERPRISE=1 shorthand.
 const config = loadConfig(workspaceRoot);
+const auditHmacKey = resolveAuditHmacKey();
 if (config.templates_path)
     console.error(`[specky] Custom templates: ${config.templates_path}`);
-if (config.audit_enabled)
-    console.error(`[specky] Audit trail: enabled`);
+if (config.profile === "enterprise") {
+    console.error(`[specky] Profile: enterprise — audit=${config.audit_enabled ? "on" : "off"}` +
+        ` (fail_closed=${config.audit.fail_closed ? "on" : "off"}, hmac=${auditHmacKey ? "on" : "off"})` +
+        `, rbac=${config.rbac.enabled ? "on" : "off"} (default_role=${config.rbac.default_role})` +
+        `, rate_limit=${config.rate_limit.enabled ? "on" : "off"}`);
+    if (config.audit_enabled && !auditHmacKey) {
+        console.error("[specky] WARNING: enterprise audit is hash-chained but NOT tamper-evident — " +
+            "set SDD_AUDIT_HMAC_KEY or SDD_AUDIT_HMAC_KEY_FILE (key stored outside the workspace) to sign entries.");
+    }
+}
+else if (config.audit_enabled) {
+    console.error(`[specky] Audit trail: enabled${auditHmacKey ? " (HMAC-signed)" : ""}`);
+}
 // Initialize MCP server
 const server = new McpServer({
     name: SERVER_NAME,
@@ -109,7 +123,12 @@ const docGenerator = new DocGenerator(fileManager, stateMachine);
 const gitManager = new GitManager(fileManager);
 const testGenerator = new TestGenerator(fileManager);
 const pbtGenerator = new PbtGenerator(fileManager);
-const auditLogger = new AuditLogger(workspaceRoot, config.audit_enabled, config.audit.export_format, config.audit.max_file_size_mb);
+const auditLogger = new AuditLogger(workspaceRoot, config.audit_enabled, {
+    exportFormat: config.audit.export_format,
+    maxFileSizeMb: config.audit.max_file_size_mb,
+    hmacKey: auditHmacKey,
+    failClosed: config.audit.fail_closed,
+});
 const rbacEngine = new RbacEngine(config.rbac.enabled ?? false, config.rbac.default_role ?? "contributor");
 const metricsGenerator = new MetricsGenerator(fileManager);
 const modelRoutingEngine = new ModelRoutingEngine();
@@ -174,18 +193,36 @@ async function main() {
         const hostArg = args.find((a) => a.startsWith("--host="))?.slice("--host=".length);
         const host = hostArg || process.env["SDD_HTTP_HOST"] || "127.0.0.1";
         const isLoopback = host === "127.0.0.1" || host === "::1" || host === "localhost";
-        // Optional bearer-token auth. When SDD_HTTP_TOKEN is set, every /mcp request
-        // must present `Authorization: Bearer <token>`. Compared in constant time.
+        // Optional bearer-token auth, two flavors:
+        //   - SDD_HTTP_TOKEN: one shared token (no identity — RBAC falls back to
+        //     SDD_ROLE / default_role).
+        //   - SDD_HTTP_TOKENS_FILE: named tokens mapping to principal + role
+        //     (identity-based RBAC). Fail-closed: a broken tokens file aborts startup.
         const authToken = process.env["SDD_HTTP_TOKEN"] || "";
-        const requireAuth = authToken.length > 0;
-        if (requireAuth) {
-            console.error("[specky] HTTP bearer-token authentication enabled.");
+        const tokensFile = process.env["SDD_HTTP_TOKENS_FILE"] || "";
+        let tokenTable = [];
+        if (tokensFile) {
+            try {
+                tokenTable = loadTokenTable(tokensFile);
+                console.error(`[specky] HTTP token table loaded: ${tokenTable.length} principal(s) from ${tokensFile}`);
+            }
+            catch (err) {
+                console.error(`[specky] FATAL: ${err.message}`);
+                process.exit(1);
+            }
+        }
+        else if (authToken) {
+            console.error("[specky] HTTP bearer-token authentication enabled (shared token).");
         }
+        const requireAuth = tokenTable.length > 0 || authToken.length > 0;
         if (!isLoopback && !requireAuth) {
             console.error(`[specky] WARNING: HTTP transport bound to non-loopback host "${host}" WITHOUT authentication. ` +
-                "Set SDD_HTTP_TOKEN and put it behind a TLS-terminating reverse proxy, or bind to 127.0.0.1.");
+                "Set SDD_HTTP_TOKEN or SDD_HTTP_TOKENS_FILE and put it behind a TLS-terminating reverse proxy, or bind to 127.0.0.1.");
+        }
+        if (config.profile === "enterprise" && config.rbac.enabled && tokenTable.length === 0) {
+            console.error("[specky] NOTE: RBAC is on but no SDD_HTTP_TOKENS_FILE is configured — roles come from " +
+                "SDD_ROLE/default_role (self-asserted). Configure a token table for identity-based roles.");
         }
-        const isAuthorized = (header) => isBearerAuthorized(header, authToken);
         const { StreamableHTTPServerTransport } = await import("@modelcontextprotocol/sdk/server/streamableHttp.js");
         const http = await import("node:http");
         const transport = new StreamableHTTPServerTransport({
@@ -206,7 +243,8 @@ async function main() {
         const httpServer = http.createServer(async (req, res) => {
             if (req.url === "/mcp") {
                 // Authenticate before doing any work.
-                if (!isAuthorized(req.headers["authorization"])) {
+                const identity = resolveBearerIdentity(req.headers["authorization"], tokenTable, authToken);
+                if (!identity.authorized) {
                     res.writeHead(401, {
                         "Content-Type": "application/json",
                         "WWW-Authenticate": "Bearer",
@@ -214,6 +252,17 @@ async function main() {
                     res.end(JSON.stringify({ error: "Unauthorized" }));
                     return;
                 }
+                // Attach the authenticated identity so the transport propagates it to
+                // tool handlers as extra.authInfo (consumed by the RBAC enforcement
+                // wrapper). `token` carries a fingerprint, never the secret itself.
+                if (identity.principal) {
+                    req.auth = {
+                        token: sha256Hex(req.headers["authorization"] ?? ""),
+                        clientId: identity.principal,
+                        scopes: identity.role ? [`role:${identity.role}`] : [],
+                        extra: { principal: identity.principal, role: identity.role },
+                    };
+                }
                 // Apply rate limiting before forwarding to MCP handler
                 if (rateLimiter) {
                     const clientId = req.socket.remoteAddress ?? "unknown";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,8BAA8B;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,iCAAiC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,yBAAyB;AACzB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACpE,OAAO,CAAC,KAAK,CAAC,4BAA4B,aAAa,EAAE,CAAC,CAAC;AAE3D,oDAAoD;AACpD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;AACzC,IAAI,MAAM,CAAC,cAAc;IAAE,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;AAChG,IAAI,MAAM,CAAC,aAAa;IAAE,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAEzE,wBAAwB;AACxB,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;IACE,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,8IAA8I;IAC3J,UAAU,EAAE,sBAAsB;IAClC,KAAK,EAAE;QACL;YACE,GAAG,EAAE,0FAA0F;YAC/F,QAAQ,EAAE,eAAe;SAC1B;QACD;YACE,GAAG,EAAE,wFAAwF;YAC7F,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB;KACF;CACF,EACD;IACE,YAAY,EAAE,2SAA2S;CAC1T,CACF,CAAC;AAEF,2BAA2B;AAC3B,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAClE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS,CAAC,CAAC;AAC3F,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;AAC1C,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;AACzD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAE3D,2BAA2B;AAC3B,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAC7D,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AACnD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACrD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAChD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACjE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;AAC/C,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACrD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AACnD,MAAM,WAAW,GAAG,IAAI,WAAW,CACjC,aAAa,EACb,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,KAAK,CAAC,aAAa,EAC1B,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAC9B,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,EAC5B,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,aAAa,CAC1C,CAAC;AACF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;AACpD,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,EAAE,CAAC;AACxD,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,EAAE,CAAC;AACtD,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAClD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAChD,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,EAAE,CAAC;AAE5D,sBAAsB,CAAC,MAAM,EAAE;IAC7B,WAAW;IACX,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,gCAAgC;AAChC,WAAW;AACX,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AACxF,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAC5F,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC;AAC5G,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAE5G,YAAY;AACZ,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;AACzE,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AACxH,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;AAChF,2BAA2B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAC7E,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;AAC3F,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;AAC1G,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAC5E,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;AACjH,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;AAC3D,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AACvF,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAClE,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;AAClH,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACjD,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;AAC9E,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACtC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAExC,oBAAoB;AACpB,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,cAAc;QAAE,OAAO;IAC3B,cAAc,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,KAAK,CAAC,qBAAqB,MAAM,+BAA+B,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACxB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;AAEvD,eAAe;AACf,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAExC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;QAE5E,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,WAAW,CAAC;QACpE,MAAM,UAAU,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;QAElF,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QACzC,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CACX,gEAAgE,IAAI,4BAA4B;gBAChG,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,MAA0B,EAAW,EAAE,CAC3D,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAExC,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CACpD,oDAAoD,CACrD,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,0EAA0E;YAC1E,oEAAoE;YACpE,4BAA4B,EAAE,IAAI;YAClC,YAAY,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,CAAC;SAC5E,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,iEAAiE;QACjE,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO;YAC3C,CAAC,CAAC,IAAI,WAAW,CACb,MAAM,CAAC,UAAU,CAAC,uBAAuB,IAAI,EAAE,EAC/C,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAC9B;YACH,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CACX,mCAAmC,MAAM,CAAC,UAAU,CAAC,uBAAuB,eAAe,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CACrH,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtD,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBACvB,sCAAsC;gBACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;oBAChD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;wBACjB,cAAc,EAAE,kBAAkB;wBAClC,kBAAkB,EAAE,QAAQ;qBAC7B,CAAC,CAAC;oBACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;gBACD,uDAAuD;gBACvD,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;oBACvD,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;oBACnD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;wBACnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;wBACvE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;4BACjB,cAAc,EAAE,kBAAkB;4BAClC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;yBACrC,CAAC,CAAC;wBACH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;4BACb,KAAK,EAAE,mBAAmB;4BAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;yBACrC,CAAC,CACH,CAAC;wBACF,OAAO;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;iBAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACjC,OAAO,CAAC,KAAK,CAAC,qCAAqC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,sCAAsC,OAAO,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,8BAA8B;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,iCAAiC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,SAAS,EAAwB,MAAM,wBAAwB,CAAC;AAChH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,yBAAyB;AACzB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACpE,OAAO,CAAC,KAAK,CAAC,4BAA4B,aAAa,EAAE,CAAC,CAAC;AAE3D,wEAAwE;AACxE,+EAA+E;AAC/E,yCAAyC;AACzC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;AACzC,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;AAC3C,IAAI,MAAM,CAAC,cAAc;IAAE,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;AAChG,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;IACpC,OAAO,CAAC,KAAK,CACX,wCAAwC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE;QAC7E,iBAAiB,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;QAChG,UAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,kBAAkB,MAAM,CAAC,IAAI,CAAC,YAAY,GAAG;QACzF,gBAAgB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAC3D,CAAC;IACF,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CACX,8EAA8E;YAC9E,uGAAuG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;KAAM,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,gCAAgC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,wBAAwB;AACxB,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;IACE,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,8IAA8I;IAC3J,UAAU,EAAE,sBAAsB;IAClC,KAAK,EAAE;QACL;YACE,GAAG,EAAE,0FAA0F;YAC/F,QAAQ,EAAE,eAAe;SAC1B;QACD;YACE,GAAG,EAAE,wFAAwF;YAC7F,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB;KACF;CACF,EACD;IACE,YAAY,EAAE,2SAA2S;CAC1T,CACF,CAAC;AAEF,2BAA2B;AAC3B,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAClE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS,CAAC,CAAC;AAC3F,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;AAC1C,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;AACzD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAE3D,2BAA2B;AAC3B,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAC7D,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AACnD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACrD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAChD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACjE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;AAC/C,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACrD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AACnD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;IACvE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;IACxC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB;IAC5C,OAAO,EAAE,YAAY;IACrB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;CACrC,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,EAC5B,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,aAAa,CAC1C,CAAC;AACF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;AACpD,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,EAAE,CAAC;AACxD,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,EAAE,CAAC;AACtD,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAClD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAChD,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,EAAE,CAAC;AAE5D,sBAAsB,CAAC,MAAM,EAAE;IAC7B,WAAW;IACX,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,gCAAgC;AAChC,WAAW;AACX,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AACxF,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAC5F,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC;AAC5G,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAE5G,YAAY;AACZ,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;AACzE,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AACxH,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;AAChF,2BAA2B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAC7E,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;AAC3F,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;AAC1G,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAC5E,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;AACjH,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;AAC3D,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AACvF,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAClE,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;AAClH,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACjD,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;AAC9E,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACtC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAExC,oBAAoB;AACpB,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,cAAc;QAAE,OAAO;IAC3B,cAAc,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,KAAK,CAAC,qBAAqB,MAAM,+BAA+B,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACxB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;AAEvD,eAAe;AACf,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAExC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;QAE5E,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,WAAW,CAAC;QACpE,MAAM,UAAU,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;QAElF,2CAA2C;QAC3C,yEAAyE;QACzE,gCAAgC;QAChC,qEAAqE;QACrE,+EAA+E;QAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,UAAU,GAAsB,EAAE,CAAC;QACvC,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;gBACxC,OAAO,CAAC,KAAK,CACX,qCAAqC,UAAU,CAAC,MAAM,sBAAsB,UAAU,EAAE,CACzF,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CACX,gEAAgE,IAAI,4BAA4B;gBAChG,qHAAqH,CACtH,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtF,OAAO,CAAC,KAAK,CACX,wFAAwF;gBACxF,0FAA0F,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CACpD,oDAAoD,CACrD,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,0EAA0E;YAC1E,oEAAoE;YACpE,4BAA4B,EAAE,IAAI;YAClC,YAAY,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,CAAC;SAC5E,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,iEAAiE;QACjE,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO;YAC3C,CAAC,CAAC,IAAI,WAAW,CACb,MAAM,CAAC,UAAU,CAAC,uBAAuB,IAAI,EAAE,EAC/C,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAC9B;YACH,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CACX,mCAAmC,MAAM,CAAC,UAAU,CAAC,uBAAuB,eAAe,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CACrH,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtD,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBACvB,sCAAsC;gBACtC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAC5B,UAAU,EACV,SAAS,CACV,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;wBACjB,cAAc,EAAE,kBAAkB;wBAClC,kBAAkB,EAAE,QAAQ;qBAC7B,CAAC,CAAC;oBACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;gBACD,sEAAsE;gBACtE,oEAAoE;gBACpE,oEAAoE;gBACpE,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;oBACtB,GAAuC,CAAC,IAAI,GAAG;wBAC9C,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;wBACpD,QAAQ,EAAE,QAAQ,CAAC,SAAS;wBAC5B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;wBACtD,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;qBAC9D,CAAC;gBACJ,CAAC;gBACD,uDAAuD;gBACvD,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;oBACvD,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;oBACnD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;wBACnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;wBACvE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;4BACjB,cAAc,EAAE,kBAAkB;4BAClC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;yBACrC,CAAC,CAAC;wBACH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;4BACb,KAAK,EAAE,mBAAmB;4BAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;yBACrC,CAAC,CACH,CAAC;wBACF,OAAO;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;iBAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACjC,OAAO,CAAC,KAAK,CAAC,qCAAqC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,sCAAsC,OAAO,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/services/audit-logger.d.ts

@@ -6,6 +6,17 @@
  *   - Hash-chaining: each entry includes SHA-256 hash of the previous entry line
  *   - Log rotation: when file exceeds max_file_size_mb, rotates to .audit.jsonl.1
  *   - Export formats: jsonl (default), syslog (RFC 5424), otlp (stub)
+ *
+ * v3.5.0 enterprise enhancements (all opt-in):
+ *   - Tamper evidence: when an HMAC key is provided (SDD_AUDIT_HMAC_KEY or
+ *     SDD_AUDIT_HMAC_KEY_FILE — held OUTSIDE the workspace), every entry is
+ *     signed with HMAC-SHA256 over its serialized form (which includes
+ *     previous_hash, chaining the signatures). A workspace-writing attacker
+ *     can recompute the plain hash chain but cannot forge HMACs without the
+ *     key. Truncation of the log tail is NOT detectable by the chain alone —
+ *     anchor `current_hash` externally (e.g. in CI logs) to close that gap.
+ *   - Fail-closed: when enabled, a failed audit write throws instead of being
+ *     swallowed, so the enforcement layer can refuse to run unaudited tools.
  */
 export interface AuditEntry {
     timestamp: string;
@@ -14,11 +25,15 @@ export interface AuditEntry {
     feature_number?: string;
     phase?: string;
     role?: string;
+    /** Authenticated identity (HTTP token principal) or local fallback. */
+    principal?: string;
     result: "success" | "error";
     summary?: string;
     input_hash?: string;
     output_hash?: string;
     previous_hash: string;
+    /** HMAC-SHA256 signature — present only when an HMAC key is configured. */
+    hmac?: string;
 }
 export interface AuditVerificationResult {
     valid: boolean;
@@ -26,17 +41,44 @@ export interface AuditVerificationResult {
     total_entries: number;
     current_hash: string;
     errors: string[];
+    /** True when an HMAC key was available and used for verification. */
+    hmac_checked: boolean;
+    /** Entries carrying an hmac field (signed entries). */
+    signed_entries: number;
+}
+export interface AuditLoggerOptions {
+    exportFormat?: "jsonl" | "syslog" | "otlp";
+    maxFileSizeMb?: number;
+    /** Secret for HMAC-SHA256 tamper evidence. Empty string disables signing. */
+    hmacKey?: string;
+    /** When true, a failed audit write throws (enforcement then denies the call). */
+    failClosed?: boolean;
 }
+/**
+ * Resolve the audit HMAC key from the environment: SDD_AUDIT_HMAC_KEY wins,
+ * else SDD_AUDIT_HMAC_KEY_FILE is read (trimmed). Returns "" when unset so the
+ * feature stays off. The key file should live OUTSIDE the workspace with 0600
+ * permissions — a key readable/writable from the workspace defeats the purpose.
+ */
+export declare function resolveAuditHmacKey(env?: Record<string, string | undefined>): string;
 export declare class AuditLogger {
     private workspaceRoot;
     private enabled;
-    private exportFormat;
-    private maxFileSizeMb;
     private lastHash;
-    constructor(workspaceRoot: string, enabled: boolean, exportFormat?: "jsonl" | "syslog" | "otlp", maxFileSizeMb?: number);
+    private readonly exportFormat;
+    private readonly maxFileSizeMb;
+    private readonly hmacKey;
+    private readonly failClosed;
+    constructor(workspaceRoot: string, enabled: boolean, exportFormatOrOptions?: AuditLoggerOptions | "jsonl" | "syslog" | "otlp", maxFileSizeMb?: number);
+    /** True when entries are signed (an HMAC key is configured). */
+    get isTamperEvident(): boolean;
+    /** True when audit-write failures propagate instead of being swallowed. */
+    get isFailClosed(): boolean;
     /**
      * Log a tool call to the audit file.
-     * No-ops when disabled. Never throws — audit failures must not break tool calls.
+     * No-ops when disabled. By default never throws — audit failures must not
+     * break tool calls. In fail-closed mode the error propagates so the
+     * enforcement wrapper can refuse to execute unaudited work.
      */
     log(entry: AuditEntry): Promise<void>;
     /** Convenience: log a successful tool call */
@@ -47,8 +89,15 @@ export declare class AuditLogger {
     get currentHash(): string;
     /** Reset chain hash (for testing) */
     resetChain(): void;
-    /** Verify hash-chain integrity for an audit file. */
+    /**
+     * Verify audit integrity for an audit file: always checks the previous_hash
+     * chain; additionally verifies HMAC signatures when a key is configured.
+     * With the key, a rewritten/reordered log is detected even if the attacker
+     * recomputed the plain hash chain.
+     */
     verifyChain(specDir: string): Promise<AuditVerificationResult>;
+    /** Check one line's HMAC. Returns an error string or null when valid. */
+    private verifyLineHmac;
     private resolveAuditFile;
     /** Read the hash of the current last audit entry from disk. */
     private readCurrentChainHash;

package/dist/services/audit-logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/services/audit-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,iBAAiB,EAAE,OAAO,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAQD,qBAAa,WAAW;IAIpB,OAAO,CAAC,aAAa;IACrB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,aAAa;IANvB,OAAO,CAAC,QAAQ,CAAsB;gBAG5B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,OAAO,EAChB,YAAY,GAAE,OAAO,GAAG,QAAQ,GAAG,MAAgB,EACnD,aAAa,GAAE,MAAW;IAGpC;;;OAGG;IACG,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B3C,8CAA8C;IACxC,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAahB,0CAA0C;IACpC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAYhB,wEAAwE;IACxE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,qCAAqC;IACrC,UAAU,IAAI,IAAI;IAIlB,qDAAqD;IAC/C,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA8CpE,OAAO,CAAC,gBAAgB;IAIxB,+DAA+D;YACjD,oBAAoB;IAelC,mDAAmD;YACrC,cAAc;IA2B5B,oEAAoE;YACtD,YAAY;CAsB3B"}
+{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/services/audit-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,iBAAiB,EAAE,OAAO,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,YAAY,EAAE,OAAO,CAAC;IACtB,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAQD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAiBR;AAaD,qBAAa,WAAW;IAQpB,OAAO,CAAC,aAAa;IACrB,OAAO,CAAC,OAAO;IARjB,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA8B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;gBAG3B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,OAAO,EACxB,qBAAqB,GAAE,kBAAkB,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAW,EAC5E,aAAa,GAAE,MAAW;IAa5B,gEAAgE;IAChE,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,2EAA2E;IAC3E,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED;;;;;OAKG;IACG,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0C3C,8CAA8C;IACxC,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAahB,0CAA0C;IACpC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAYhB,wEAAwE;IACxE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,qCAAqC;IACrC,UAAU,IAAI,IAAI;IAIlB;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA2DpE,yEAAyE;IACzE,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,gBAAgB;IAIxB,+DAA+D;YACjD,oBAAoB;IAelC,mDAAmD;YACrC,cAAc;IA2B5B,oEAAoE;YACtD,YAAY;CAsB3B"}