taskflow-core 0.2.0 → 0.2.1

package/dist/resources/baseline.js

@@ -0,0 +1,447 @@
+/**
+ * Exact host/OS evidence gating for workspace sandbox claims.
+ *
+ * A host version string or a static feature flag is not evidence.  Sandboxed
+ * execution is enabled only when every field of the running target matches an
+ * approved, checked-in probe result.  Missing and stale cells fail closed.
+ */
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const HOST_PROBE_HOSTS = ["pi", "codex", "claude", "opencode", "grok"];
+export const HOST_PROBE_OSES = ["macos", "linux", "windows"];
+export const HOST_PROBE_VERSION = "tfws-probe:v1";
+export const PROCESS_SANDBOX_EVIDENCE_CHECKS = [
+    "exactCwd",
+    "readInsideReadOnly",
+    "writeInsideReadOnlyDenied",
+    "readInsideReadWrite",
+    "writeInsideReadWrite",
+    "siblingScopeDenied",
+    "outsideScopeDenied",
+    "symlinkEscapeDenied",
+    "ambientUserDataDenied",
+    "privateTempEnforced",
+    "descendantEnforcement",
+    "abortDescendantCleanup",
+    "networkPolicyEnforced",
+    "credentialIsolationEnforced",
+    "baselineRuntimeUsable",
+    "resolverOpenPathSwapDenied",
+    "exactMetadataNoFollow",
+    "unsupportedPolicyFailsClosed",
+];
+export const FILE_BROKER_EVIDENCE_CHECKS = [
+    "readInsideReadOnly",
+    "writeInsideReadOnlyDenied",
+    "readInsideReadWrite",
+    "writeInsideReadWrite",
+    "siblingScopeDenied",
+    "outsideScopeDenied",
+    "symlinkEscapeDenied",
+    "brokeredReadNoFollow",
+    "brokeredWriteNoFollow",
+    "fingerprintNoFollow",
+    "resolverOpenPathSwapDenied",
+    "abortCleanup",
+    "exactMetadataNoFollow",
+    "unsupportedPolicyFailsClosed",
+];
+const SHA256_RE = /^[0-9a-f]{64}$/;
+const verifiedBaselines = new WeakSet();
+const verifiedSandboxApprovals = new WeakSet();
+const TARGET_KEYS = [
+    "host",
+    "hostVersion",
+    "hostBinarySha256",
+    "os",
+    "osVersion",
+    "osBuild",
+    "arch",
+    "sandboxMechanismVersion",
+    "backendId",
+    "backendCapabilityVersion",
+    "backendCapabilitiesSha256",
+    "baselinePolicyId",
+];
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function targetKey(target) {
+    return JSON.stringify([
+        target.host,
+        target.hostVersion,
+        target.hostBinarySha256,
+        target.os,
+        target.osVersion,
+        target.osBuild,
+        target.arch,
+        target.sandboxMechanismVersion,
+        target.backendId,
+        target.backendCapabilityVersion,
+        target.backendCapabilitiesSha256,
+        target.baselinePolicyId,
+    ]);
+}
+export function hostProbeTargetsEqual(left, right) {
+    return targetKey(left) === targetKey(right);
+}
+function isWithin(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+function deepFreeze(value) {
+    if (typeof value !== "object" || value === null || Object.isFrozen(value))
+        return value;
+    Object.freeze(value);
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return value;
+}
+function resolveTrustedRegularFile(repositoryRoot, relativePath) {
+    if (!relativePath || path.isAbsolute(relativePath))
+        throw new Error("evidence path must be repository-relative");
+    const segments = relativePath.split(/[\\/]+/);
+    if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
+        throw new Error("evidence path contains an unsafe segment");
+    }
+    let current = repositoryRoot;
+    for (const segment of segments) {
+        current = path.join(current, segment);
+        const stat = fs.lstatSync(current);
+        if (stat.isSymbolicLink())
+            throw new Error(`trusted baseline path must not contain symlinks: ${relativePath}`);
+    }
+    const canonical = fs.realpathSync(current);
+    if (!isWithin(repositoryRoot, canonical))
+        throw new Error("trusted baseline path escapes the repository root");
+    if (!fs.lstatSync(canonical).isFile())
+        throw new Error(`trusted baseline path is not a regular file: ${relativePath}`);
+    return canonical;
+}
+function sameFileSnapshot(left, right) {
+    return left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.size === right.size &&
+        left.mtimeNs === right.mtimeNs &&
+        left.ctimeNs === right.ctimeNs;
+}
+/** Resolve, open without following the final component, and consume exactly one
+ * immutable byte snapshot. Hashing and JSON parsing both use these same bytes. */
+function readTrustedJson(repositoryRoot, relativePath, maxBytes) {
+    const canonical = resolveTrustedRegularFile(repositoryRoot, relativePath);
+    const noFollow = typeof fs.constants.O_NOFOLLOW === "number" ? fs.constants.O_NOFOLLOW : 0;
+    const fd = fs.openSync(canonical, fs.constants.O_RDONLY | noFollow);
+    try {
+        const before = fs.fstatSync(fd, { bigint: true });
+        if (!before.isFile())
+            throw new Error(`trusted baseline path is not a regular file: ${relativePath}`);
+        if (before.size > BigInt(maxBytes))
+            throw new Error(`trusted baseline evidence exceeds ${maxBytes} bytes`);
+        const bytes = fs.readFileSync(fd);
+        if (bytes.byteLength > maxBytes)
+            throw new Error(`trusted baseline evidence exceeds ${maxBytes} bytes`);
+        const after = fs.fstatSync(fd, { bigint: true });
+        if (!sameFileSnapshot(before, after))
+            throw new Error(`trusted baseline file changed while reading: ${relativePath}`);
+        // Re-resolve every path component after the read. A parent-directory swap
+        // cannot authorize the opened bytes unless the live path still identifies
+        // this exact inode and immutable snapshot.
+        const liveCanonical = resolveTrustedRegularFile(repositoryRoot, relativePath);
+        const live = fs.lstatSync(liveCanonical, { bigint: true });
+        if (!sameFileSnapshot(after, live))
+            throw new Error(`trusted baseline path changed while reading: ${relativePath}`);
+        return { bytes, value: JSON.parse(bytes.toString("utf8")) };
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function sha256Bytes(bytes) {
+    return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+function assertExactKeys(value, expected, name) {
+    const actual = Object.keys(value).sort();
+    const required = [...expected].sort();
+    if (actual.length !== required.length || actual.some((key, index) => key !== required[index])) {
+        throw new Error(`${name} must contain exactly: ${required.join(", ")}`);
+    }
+}
+function verifyTarget(value, name) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${name} must be an object`);
+    const target = value;
+    assertExactKeys(target, TARGET_KEYS, name);
+    if (!HOST_PROBE_HOSTS.includes(target.host))
+        throw new Error(`${name}.host is invalid`);
+    if (!HOST_PROBE_OSES.includes(target.os))
+        throw new Error(`${name}.os is invalid`);
+    if (target.arch !== "arm64" && target.arch !== "x64")
+        throw new Error(`${name}.arch is invalid`);
+    for (const field of [
+        "hostVersion",
+        "osVersion",
+        "osBuild",
+        "sandboxMechanismVersion",
+        "backendId",
+        "backendCapabilityVersion",
+        "baselinePolicyId",
+    ]) {
+        if (!isNonEmptyString(target[field]) || /[\u0000-\u001f\u007f]/.test(target[field])) {
+            throw new Error(`${name}.${field} must be non-empty and contain no control characters`);
+        }
+    }
+    if (typeof target.hostBinarySha256 !== "string" || !SHA256_RE.test(target.hostBinarySha256)) {
+        throw new Error(`${name}.hostBinarySha256 must be lowercase sha256`);
+    }
+    if (typeof target.backendCapabilitiesSha256 !== "string" || !SHA256_RE.test(target.backendCapabilitiesSha256)) {
+        throw new Error(`${name}.backendCapabilitiesSha256 must be lowercase sha256`);
+    }
+    return target;
+}
+export function isExactHostProbeTarget(value) {
+    try {
+        verifyTarget(value, "host probe target");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function verifySuiteEvidence(value, requiredChecks, name) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${name} must be an object`);
+    const suite = value;
+    assertExactKeys(suite, ["pass", "checks"], name);
+    if (typeof suite.pass !== "boolean")
+        throw new Error(`${name}.pass must be boolean`);
+    if (!suite.checks || typeof suite.checks !== "object" || Array.isArray(suite.checks)) {
+        throw new Error(`${name}.checks must be an object`);
+    }
+    const checks = suite.checks;
+    assertExactKeys(checks, requiredChecks, `${name}.checks`);
+    if (Object.values(checks).some((check) => typeof check !== "boolean")) {
+        throw new Error(`${name}.checks must contain only booleans`);
+    }
+    const derivedPass = requiredChecks.every((check) => checks[check] === true);
+    if (suite.pass !== derivedPass)
+        throw new Error(`${name}.pass does not match its required checks`);
+    return { pass: suite.pass };
+}
+function verifyEvidenceBundle(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("evidence bundle must be an object");
+    const document = value;
+    assertExactKeys(document, ["schemaVersion", "probeVersion", "results"], "evidence bundle");
+    if (document.schemaVersion !== 1)
+        throw new Error("evidence bundle schemaVersion must be 1");
+    if (document.probeVersion !== HOST_PROBE_VERSION) {
+        throw new Error(`evidence bundle probeVersion must be ${HOST_PROBE_VERSION}`);
+    }
+    if (!Array.isArray(document.results) || document.results.length === 0) {
+        throw new Error("evidence bundle results must be a non-empty array");
+    }
+    const seen = new Set();
+    for (const [index, value] of document.results.entries()) {
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            throw new Error(`evidence bundle results[${index}] must be an object`);
+        }
+        const result = value;
+        assertExactKeys(result, ["target", "classification", "agent", "script", "fileBroker"], `evidence bundle results[${index}]`);
+        const target = verifyTarget(result.target, `evidence bundle results[${index}].target`);
+        const key = targetKey(target);
+        if (seen.has(key))
+            throw new Error("evidence bundle contains duplicate exact targets");
+        seen.add(key);
+        if (!["sandboxed-single-root", "sandboxed-multi-root", "resolve-only", "unsupported"].includes(result.classification)) {
+            throw new Error(`evidence bundle results[${index}].classification is invalid`);
+        }
+        verifySuiteEvidence(result.agent, PROCESS_SANDBOX_EVIDENCE_CHECKS, `evidence bundle results[${index}].agent`);
+        verifySuiteEvidence(result.script, PROCESS_SANDBOX_EVIDENCE_CHECKS, `evidence bundle results[${index}].script`);
+        verifySuiteEvidence(result.fileBroker, FILE_BROKER_EVIDENCE_CHECKS, `evidence bundle results[${index}].fileBroker`);
+    }
+    return document;
+}
+function verifyEvidenceDocument(value, cell, kind, requirePass) {
+    const document = verifyEvidenceBundle(value);
+    const result = document.results.find((candidate) => targetKey(candidate.target) === targetKey(cell.target));
+    if (!result) {
+        throw new Error(`${kind} evidence target does not exactly match its baseline cell`);
+    }
+    if (result.classification !== cell.classification) {
+        throw new Error(`${kind} evidence classification does not exactly match its baseline cell`);
+    }
+    if (requirePass && result[kind].pass !== true) {
+        throw new Error(`${kind} evidence did not pass`);
+    }
+}
+/** Validate trusted baseline data before it can authorize a sandbox claim. */
+export function validateHostSupportBaseline(value) {
+    const errors = [];
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return ["baseline must be an object"];
+    const rootKeys = Object.keys(value).filter((key) => !["schemaVersion", "baselineId", "cells"].includes(key));
+    if (rootKeys.length > 0)
+        errors.push(`baseline has unsupported fields: ${rootKeys.join(", ")}`);
+    const baseline = value;
+    if (baseline.schemaVersion !== 1)
+        errors.push("schemaVersion must be 1");
+    if (!isNonEmptyString(baseline.baselineId))
+        errors.push("baselineId must be a non-empty string");
+    if (!Array.isArray(baseline.cells))
+        return [...errors, "cells must be an array"];
+    const seen = new Set();
+    baseline.cells.forEach((raw, index) => {
+        const prefix = `cells[${index}]`;
+        if (!raw || typeof raw !== "object") {
+            errors.push(`${prefix} must be an object`);
+            return;
+        }
+        const cell = raw;
+        const cellKeys = Object.keys(cell).filter((key) => !["target", "classification", "agent", "script", "fileBroker", "decision"].includes(key));
+        if (cellKeys.length > 0)
+            errors.push(`${prefix} has unsupported fields: ${cellKeys.join(", ")}`);
+        const target = cell.target;
+        if (!target || typeof target !== "object") {
+            errors.push(`${prefix}.target must be an object`);
+            return;
+        }
+        const targetKeys = Object.keys(target).filter((key) => !TARGET_KEYS.includes(key));
+        if (targetKeys.length > 0)
+            errors.push(`${prefix}.target has unsupported fields: ${targetKeys.join(", ")}`);
+        if (!HOST_PROBE_HOSTS.includes(target.host))
+            errors.push(`${prefix}.target.host is invalid`);
+        if (!HOST_PROBE_OSES.includes(target.os))
+            errors.push(`${prefix}.target.os is invalid`);
+        if (target.arch !== "arm64" && target.arch !== "x64")
+            errors.push(`${prefix}.target.arch is invalid`);
+        for (const field of [
+            "hostVersion",
+            "osVersion",
+            "osBuild",
+            "sandboxMechanismVersion",
+            "backendId",
+            "backendCapabilityVersion",
+            "baselinePolicyId",
+        ]) {
+            if (!isNonEmptyString(target[field]) || /[\u0000-\u001f\u007f]/.test(target[field])) {
+                errors.push(`${prefix}.target.${field} must be non-empty and contain no control characters`);
+            }
+        }
+        if (!SHA256_RE.test(target.hostBinarySha256))
+            errors.push(`${prefix}.target.hostBinarySha256 must be lowercase sha256`);
+        if (!SHA256_RE.test(target.backendCapabilitiesSha256)) {
+            errors.push(`${prefix}.target.backendCapabilitiesSha256 must be lowercase sha256`);
+        }
+        const key = targetKey(target);
+        if (seen.has(key))
+            errors.push(`${prefix} duplicates an exact target cell`);
+        seen.add(key);
+        if (!["sandboxed-single-root", "sandboxed-multi-root", "resolve-only", "unsupported"].includes(cell.classification)) {
+            errors.push(`${prefix}.classification is invalid`);
+        }
+        for (const field of ["agent", "script", "fileBroker"]) {
+            const evidence = cell[field];
+            if (!evidence || typeof evidence !== "object") {
+                errors.push(`${prefix}.${field} must be an evidence object`);
+                continue;
+            }
+            const evidenceKeys = Object.keys(evidence).filter((key) => !["path", "sha256"].includes(key));
+            if (evidenceKeys.length > 0)
+                errors.push(`${prefix}.${field} has unsupported fields: ${evidenceKeys.join(", ")}`);
+            if (!isNonEmptyString(evidence.path) || evidence.path.startsWith("/") || evidence.path.includes("..")) {
+                errors.push(`${prefix}.${field}.path must be a safe repository-relative path`);
+            }
+            if (!SHA256_RE.test(evidence.sha256))
+                errors.push(`${prefix}.${field}.sha256 must be lowercase sha256`);
+        }
+        if (!cell.decision || typeof cell.decision !== "object") {
+            errors.push(`${prefix}.decision must be an object`);
+        }
+        else {
+            const decisionKeys = Object.keys(cell.decision).filter((key) => !["owner", "status", "reason"].includes(key));
+            if (decisionKeys.length > 0)
+                errors.push(`${prefix}.decision has unsupported fields: ${decisionKeys.join(", ")}`);
+            if (!isNonEmptyString(cell.decision.owner))
+                errors.push(`${prefix}.decision.owner must be non-empty`);
+            if (!isNonEmptyString(cell.decision.reason))
+                errors.push(`${prefix}.decision.reason must be non-empty`);
+            if (cell.decision.status !== "approved" && cell.decision.status !== "rejected") {
+                errors.push(`${prefix}.decision.status is invalid`);
+            }
+        }
+    });
+    return errors;
+}
+/** Load and verify the checked-in finite allowlist plus every evidence body it
+ * relies on. Matcher authorization accepts only the process-local branded
+ * snapshot returned here; shape-correct caller data is never authority. */
+export function loadVerifiedHostSupportBaseline(options) {
+    const repositoryRoot = fs.realpathSync(options.repositoryRoot);
+    if (!fs.statSync(repositoryRoot).isDirectory())
+        throw new Error("repositoryRoot must be a directory");
+    const maxBytes = options.maxEvidenceBytes ?? 5 * 1024 * 1024;
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1)
+        throw new Error("maxEvidenceBytes must be a positive safe integer");
+    const baselinePath = options.baselinePath ?? "conformance/workspace/host-support-baseline.json";
+    const raw = readTrustedJson(repositoryRoot, baselinePath, maxBytes).value;
+    const errors = validateHostSupportBaseline(raw);
+    if (errors.length > 0)
+        throw new Error(`invalid host support baseline: ${errors.join("; ")}`);
+    const snapshot = structuredClone(raw);
+    const evidenceCache = new Map();
+    for (const cell of snapshot.cells) {
+        const requirePass = cell.decision.status === "approved" &&
+            (cell.classification === "sandboxed-single-root" || cell.classification === "sandboxed-multi-root");
+        for (const kind of ["agent", "script", "fileBroker"]) {
+            const evidence = cell[kind];
+            let trusted = evidenceCache.get(evidence.path);
+            if (!trusted) {
+                trusted = readTrustedJson(repositoryRoot, evidence.path, maxBytes);
+                evidenceCache.set(evidence.path, trusted);
+            }
+            if (sha256Bytes(trusted.bytes) !== evidence.sha256) {
+                throw new Error(`${kind} evidence sha256 mismatch for ${evidence.path}`);
+            }
+            verifyEvidenceDocument(trusted.value, cell, kind, requirePass);
+        }
+    }
+    const verified = deepFreeze(snapshot);
+    verifiedBaselines.add(verified);
+    return verified;
+}
+/**
+ * Match a live target against the finite approved evidence set.
+ *
+ * Only a sandboxed classification with an approved owner decision is a match.
+ * Resolve-only/unsupported cells remain useful audit evidence but never enable
+ * a sandboxed bridge.
+ */
+export function matchSandboxedHostTarget(baseline, target) {
+    if (!verifiedBaselines.has(baseline)) {
+        return { ok: false, reason: "host support baseline was not loaded and evidence-verified by the trusted loader" };
+    }
+    const errors = validateHostSupportBaseline(baseline);
+    if (errors.length)
+        return { ok: false, reason: `invalid host support baseline: ${errors.join("; ")}` };
+    const cell = baseline.cells.find((candidate) => targetKey(candidate.target) === targetKey(target));
+    if (!cell)
+        return { ok: false, reason: "no exact host/OS/architecture/binary evidence cell" };
+    if (cell.decision.status !== "approved")
+        return { ok: false, reason: `evidence cell is ${cell.decision.status}` };
+    if (cell.classification !== "sandboxed-single-root" && cell.classification !== "sandboxed-multi-root") {
+        return { ok: false, reason: `evidence cell is classified ${cell.classification}` };
+    }
+    const approval = deepFreeze({
+        baselineId: baseline.baselineId,
+        target: structuredClone(cell.target),
+        classification: cell.classification,
+    });
+    verifiedSandboxApprovals.add(approval);
+    return { ok: true, cell, approval };
+}
+/** Shape-correct, cloned, or deserialized approval objects are not authority. */
+export function isVerifiedSandboxHostApproval(value) {
+    return typeof value === "object" && value !== null && verifiedSandboxApprovals.has(value);
+}
+//# sourceMappingURL=baseline.js.map

package/dist/resources/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../../src/resources/baseline.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAU,CAAC;AAGvF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAEtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAkDlD,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC9C,UAAU;IACV,oBAAoB;IACpB,2BAA2B;IAC3B,qBAAqB;IACrB,sBAAsB;IACtB,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,uBAAuB;IACvB,qBAAqB;IACrB,uBAAuB;IACvB,wBAAwB;IACxB,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,4BAA4B;IAC5B,uBAAuB;IACvB,8BAA8B;CACrB,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG;IAC1C,oBAAoB;IACpB,2BAA2B;IAC3B,qBAAqB;IACrB,sBAAsB;IACtB,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,uBAAuB;IACvB,qBAAqB;IACrB,4BAA4B;IAC5B,cAAc;IACd,uBAAuB;IACvB,8BAA8B;CACrB,CAAC;AAkDX,MAAM,SAAS,GAAG,gBAAgB,CAAC;AACnC,MAAM,iBAAiB,GAAG,IAAI,OAAO,EAAU,CAAC;AAChD,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;AAEvD,MAAM,WAAW,GAAG;IACnB,MAAM;IACN,aAAa;IACb,kBAAkB;IAClB,IAAI;IACJ,WAAW;IACX,SAAS;IACT,MAAM;IACN,yBAAyB;IACzB,WAAW;IACX,0BAA0B;IAC1B,2BAA2B;IAC3B,kBAAkB;CACT,CAAC;AAEX,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,MAAuB;IACzC,OAAO,IAAI,CAAC,SAAS,CAAC;QACrB,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,gBAAgB;QACvB,MAAM,CAAC,EAAE;QACT,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,uBAAuB;QAC9B,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,wBAAwB;QAC/B,MAAM,CAAC,yBAAyB;QAChC,MAAM,CAAC,gBAAgB;KACvB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAqB,EAAE,KAAsB;IAClF,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,UAAU,CAAI,KAAQ;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;QAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,cAAsB,EAAE,YAAoB;IAC9E,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjH,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,GAAG,cAAc,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,YAAY,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC/G,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,YAAY,EAAE,CAAC,CAAC;IACvH,OAAO,SAAS,CAAC;AAClB,CAAC;AAOD,SAAS,gBAAgB,CAAC,IAAoB,EAAE,KAAqB;IACpE,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QAC5B,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QACtB,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;AACjC,CAAC;AAED;kFACkF;AAClF,SAAS,eAAe,CACvB,cAAsB,EACtB,YAAoB,EACpB,QAAgB;IAEhB,MAAM,SAAS,GAAG,yBAAyB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,YAAY,EAAE,CAAC,CAAC;QACtG,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,QAAQ,CAAC,CAAC;QAC3G,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,QAAQ,CAAC,CAAC;QACxG,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,YAAY,EAAE,CAAC,CAAC;QAEtH,0EAA0E;QAC1E,0EAA0E;QAC1E,2CAA2C;QAC3C,MAAM,aAAa,GAAG,yBAAyB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,YAAY,EAAE,CAAC,CAAC;QACpH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,EAAE,CAAC;IACxE,CAAC;YAAS,CAAC;QACV,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,KAA8B,EAAE,QAA2B,EAAE,IAAY;IACjG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAqB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAC;IACzG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAiB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAC;IACjG,KAAK,MAAM,KAAK,IAAI;QACnB,aAAa;QACb,WAAW;QACX,SAAS;QACT,yBAAyB;QACzB,WAAW;QACX,0BAA0B;QAC1B,kBAAkB;KACT,EAAE,CAAC;QACZ,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,KAAK,sDAAsD,CAAC,CAAC;QACzF,CAAC;IACF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,yBAAyB,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC/G,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qDAAqD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAoC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACpD,IAAI,CAAC;QACJ,YAAY,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAC3B,KAAc,EACd,cAAiC,EACjC,IAAY;IAEZ,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,eAAe,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAiC,CAAC;IACvD,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oCAAoC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0CAA0C,CAAC,CAAC;IACnG,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACtH,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,eAAe,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7F,IAAI,QAAQ,CAAC,YAAY,KAAK,kBAAkB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,kBAAkB,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,qBAAqB,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,eAAe,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,2BAA2B,KAAK,GAAG,CAAC,CAAC;QAC5H,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,KAAK,UAAU,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACvF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAwB,CAAC,EAAE,CAAC;YACjI,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,6BAA6B,CAAC,CAAC;QAChF,CAAC;QACD,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,+BAA+B,EAAE,2BAA2B,KAAK,SAAS,CAAC,CAAC;QAC9G,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,+BAA+B,EAAE,2BAA2B,KAAK,UAAU,CAAC,CAAC;QAChH,mBAAmB,CAAC,MAAM,CAAC,UAAU,EAAE,2BAA2B,EAAE,2BAA2B,KAAK,cAAc,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,QAA8C,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAC9B,KAAc,EACd,IAAqB,EACrB,IAAuC,EACvC,WAAoB;IAEpB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2DAA2D,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mEAAmE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;IAClD,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7G,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,oCAAoC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,KAAqC,CAAC;IACvD,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAEjF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,SAAS,KAAK,GAAG,CAAC;QACjC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC;YAC3C,OAAO;QACR,CAAC;QACD,MAAM,IAAI,GAAG,GAAsB,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,4BAA4B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,2BAA2B,CAAC,CAAC;YAClD,OAAO;QACR,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAmC,CAAC,CAAC,CAAC;QACnH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,mCAAmC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,yBAAyB,CAAC,CAAC;QAC7F,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,uBAAuB,CAAC,CAAC;QACxF,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,yBAAyB,CAAC,CAAC;QACtG,KAAK,MAAM,KAAK,IAAI;YACnB,aAAa;YACb,WAAW;YACX,SAAS;YACT,yBAAyB;YACzB,WAAW;YACX,0BAA0B;YAC1B,kBAAkB;SACT,EAAE,CAAC;YACZ,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,KAAK,sDAAsD,CAAC,CAAC;YAC9F,CAAC;QACF,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,mDAAmD,CAAC,CAAC;QACxH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,4DAA4D,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,kCAAkC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,IAAI,CAAC,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACrH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,4BAA4B,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAU,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,KAAK,6BAA6B,CAAC,CAAC;gBAC7D,SAAS;YACV,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,KAAK,4BAA4B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClH,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,KAAK,+CAA+C,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,KAAK,kCAAkC,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,6BAA6B,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9G,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,qCAAqC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClH,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC;YACtG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,oCAAoC,CAAC,CAAC;YACxG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAChF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,6BAA6B,CAAC,CAAC;YACrD,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,+BAA+B,CAC9C,OAAuC;IAEvC,MAAM,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACzH,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,kDAAkD,CAAC;IAChG,MAAM,GAAG,GAAG,eAAe,CAAC,cAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC;IAC1E,MAAM,MAAM,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAwB,CAAC;IAE7D,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU;YACtD,CAAC,IAAI,CAAC,cAAc,KAAK,uBAAuB,IAAI,IAAI,CAAC,cAAc,KAAK,sBAAsB,CAAC,CAAC;QACrG,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAU,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,GAAG,eAAe,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACnE,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iCAAiC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAChE,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAgC,CAAC;IACrE,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACvC,QAA6B,EAC7B,MAAuB;IAEvB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kFAAkF,EAAE,CAAC;IAClH,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACvG,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACnG,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IAC9F,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAClH,IAAI,IAAI,CAAC,cAAc,KAAK,uBAAuB,IAAI,IAAI,CAAC,cAAc,KAAK,sBAAsB,EAAE,CAAC;QACvG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;QACpC,cAAc,EAAE,IAAI,CAAC,cAAc;KACnC,CAAgC,CAAC;IAClC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC3D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC"}

package/dist/resources/canonical-json.d.ts

@@ -0,0 +1,7 @@
+/**
+ * RFC 8785 / JSON Canonicalization Scheme serializer for JSON-domain values.
+ * It intentionally rejects values which JSON would silently coerce or discard.
+ */
+export declare function canonicalJson(value: unknown): string;
+export declare function sha256Canonical(value: unknown): string;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/resources/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../../src/resources/canonical-json.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgDpD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}

package/dist/resources/canonical-json.js

@@ -0,0 +1,75 @@
+import { createHash } from "node:crypto";
+/**
+ * RFC 8785 / JSON Canonicalization Scheme serializer for JSON-domain values.
+ * It intentionally rejects values which JSON would silently coerce or discard.
+ */
+export function canonicalJson(value) {
+    const ancestors = new Set();
+    function encode(current) {
+        if (current === null)
+            return "null";
+        if (typeof current === "boolean")
+            return current ? "true" : "false";
+        if (typeof current === "string") {
+            assertUnicodeScalarString(current);
+            return JSON.stringify(current);
+        }
+        if (typeof current === "number") {
+            if (!Number.isFinite(current))
+                throw new TypeError("canonical JSON requires finite numbers");
+            return JSON.stringify(current);
+        }
+        if (typeof current !== "object") {
+            throw new TypeError(`canonical JSON cannot encode ${typeof current}`);
+        }
+        if (ancestors.has(current))
+            throw new TypeError("canonical JSON cannot encode cycles");
+        ancestors.add(current);
+        try {
+            if (Array.isArray(current)) {
+                const items = [];
+                for (let index = 0; index < current.length; index++) {
+                    if (!Object.hasOwn(current, index)) {
+                        throw new TypeError("canonical JSON cannot encode sparse arrays");
+                    }
+                    items.push(encode(current[index]));
+                }
+                return `[${items.join(",")}]`;
+            }
+            const prototype = Object.getPrototypeOf(current);
+            if (prototype !== Object.prototype && prototype !== null) {
+                throw new TypeError("canonical JSON requires plain objects");
+            }
+            const record = current;
+            const keys = Object.keys(record).sort();
+            const fields = keys.map((key) => {
+                assertUnicodeScalarString(key);
+                return `${JSON.stringify(key)}:${encode(record[key])}`;
+            });
+            return `{${fields.join(",")}}`;
+        }
+        finally {
+            ancestors.delete(current);
+        }
+    }
+    return encode(value);
+}
+export function sha256Canonical(value) {
+    return createHash("sha256").update(canonicalJson(value), "utf8").digest("hex");
+}
+function assertUnicodeScalarString(value) {
+    for (let index = 0; index < value.length; index++) {
+        const unit = value.charCodeAt(index);
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (!(next >= 0xdc00 && next <= 0xdfff)) {
+                throw new TypeError("canonical JSON rejects lone UTF-16 surrogates");
+            }
+            index++;
+        }
+        else if (unit >= 0xdc00 && unit <= 0xdfff) {
+            throw new TypeError("canonical JSON rejects lone UTF-16 surrogates");
+        }
+    }
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/resources/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../src/resources/canonical-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,SAAS,MAAM,CAAC,OAAgB;QAC/B,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACpE,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjC,yBAAyB,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CAAC,gCAAgC,OAAO,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;QACvF,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC;YACJ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;wBACpC,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;oBACnE,CAAC;oBACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpC,CAAC;gBACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAC/B,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,OAAkC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC/B,yBAAyB,CAAC,GAAG,CAAC,CAAC;gBAC/B,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxD,CAAC,CAAC,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC/C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;YACtE,CAAC;YACD,KAAK,EAAE,CAAC;QACT,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;QACtE,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/resources/errors.d.ts

@@ -0,0 +1,23 @@
+/** Stable, redaction-safe failures emitted by the workspace capability plane. */
+export declare const WORKSPACE_ERROR_CODES: readonly ["TFWS_UNAUTHORIZED_GRANT", "TFWS_UNKNOWN_WORKSPACE", "TFWS_INVALID_PATH", "TFWS_PATH_ESCAPE", "TFWS_ACCESS_ESCALATION", "TFWS_CREDENTIAL_DENIED", "TFWS_PROVIDER_DENIED", "TFWS_PROVIDER_ACQUIRE_FAILED", "TFWS_PROVIDER_RELEASE_FAILED", "TFWS_UNSUPPORTED_SANDBOX_POLICY", "TFWS_LEASE_TIMEOUT", "TFWS_WRITE_INTENT_FAILED", "TFWS_RESOURCE_DIRTY", "TFWS_VERSION_COMMIT_UNAVAILABLE", "TFWS_CACHE_RESTORE_RACE", "TFWS_STATE_RESTORE_FAILED", "TFWS_IDENTITY_MISMATCH", "TFWS_HANDLE_INVALID", "TFWS_SELECTOR_INVALID"];
+export type WorkspaceErrorCode = (typeof WORKSPACE_ERROR_CODES)[number];
+export type WorkspaceErrorScope = "phase" | "run";
+export type WorkspaceRetryScope = "none" | "same-attempt" | "new-attempt" | "after-reconcile" | "new-run";
+export type WorkspaceRecovery = "none" | "cleanup" | "reconcile" | "rebind";
+export interface WorkspacePolicyError {
+    code: WorkspaceErrorCode;
+    scope: WorkspaceErrorScope;
+    retryable: boolean;
+    terminal: boolean;
+    retryScope: WorkspaceRetryScope;
+    affectedResourceDomainIds?: string[];
+    recoveryRequired?: WorkspaceRecovery;
+    phaseId?: string;
+    logicalWorkspaceId?: string;
+    /** Must never contain a physical root. */
+    redactedMessage: string;
+}
+export type WorkspacePolicyErrorOverrides = Partial<Omit<WorkspacePolicyError, "code" | "redactedMessage">>;
+export declare function workspacePolicyError(code: WorkspaceErrorCode, redactedMessage: string, overrides?: WorkspacePolicyErrorOverrides): WorkspacePolicyError;
+export declare function isWorkspacePolicyError(value: unknown): value is WorkspacePolicyError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/resources/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/resources/errors.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,eAAO,MAAM,qBAAqB,YACjC,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,iCAAiC,EACjC,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,CACd,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,KAAK,CAAC;AAClD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,cAAc,GAAG,aAAa,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAC1G,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE5E,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,mBAAmB,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;IACrC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,0CAA0C;IAC1C,eAAe,EAAE,MAAM,CAAC;CACxB;AA8DD,MAAM,MAAM,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC;AAE5G,wBAAgB,oBAAoB,CACnC,IAAI,EAAE,kBAAkB,EACxB,eAAe,EAAE,MAAM,EACvB,SAAS,GAAE,6BAAkC,GAC3C,oBAAoB,CAEtB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAYpF"}