taskflow-core 0.2.10 → 0.3.0-beta.1

package/dist/effects/validate.js

@@ -0,0 +1,543 @@
+/**
+ * Static EffectIR validation: kinds, refs, labels, mutating-path overlap.
+ * Pure — no I/O.
+ */
+import { normalizePortableRelativePath } from "../resources/schema.js";
+import { Value } from "typebox/value";
+import { EffectDeclSchema } from "./schema.js";
+import { CONFIDENTIALITY_LABELS, CONFIDENTIALITY_RANK, EFFECT_KINDS, INTEGRITY_LABELS, INTEGRITY_RANK, } from "./types.js";
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isConf(v) {
+    return typeof v === "string" && CONFIDENTIALITY_LABELS.includes(v);
+}
+function isInteg(v) {
+    return typeof v === "string" && INTEGRITY_LABELS.includes(v);
+}
+function isEffectKind(v) {
+    return typeof v === "string" && EFFECT_KINDS.includes(v);
+}
+const SOURCE_KINDS = new Set(["fs.read", "secret.read"]);
+const SINK_KINDS = new Set(["fs.write", "service.call"]);
+function confidentialityOf(item) {
+    return isConf(item.confidentiality) ? item.confidentiality : item.kind === "secret.read" ? "secret" : "internal";
+}
+function integrityOf(item) {
+    return isInteg(item.integrity) ? item.integrity : "project";
+}
+function labelFlowIssues(source, sink, sourceLabel = source.id, sinkLabel = sink.id) {
+    const issues = [];
+    // Two unresolved composition boundaries carry taint but do not create a
+    // concrete source→sink edge by themselves. Keep the taint flowing until it
+    // meets a declared effect; otherwise ordinary dynamic composition would
+    // reject solely because two unknown summaries are sequenced.
+    if (source.__unknownBoundary === true && sink.__unknownBoundary === true)
+        return issues;
+    // An unresolved saved `flow{use}` boundary seen by a static gate without a
+    // flow loader is advisory (the saved child may be perfectly benign); the
+    // runtime loader stays the authoritative admission gate. Dynamic inline
+    // `def` boundaries never carry this flag and stay hard-tainted.
+    const advisory = source.__unresolvedUseAdvisory === true || sink.__unresolvedUseAdvisory === true;
+    const code = (base) => (advisory ? "unresolved-flow-use-taint" : base);
+    const suffix = advisory ? " — unresolved flow{use} boundary; advisory only (runtime admission is authoritative)" : "";
+    const sourceConf = confidentialityOf(source);
+    const sinkConf = confidentialityOf(sink);
+    const sourceIntegrity = integrityOf(source);
+    const sinkIntegrity = integrityOf(sink);
+    if (CONFIDENTIALITY_RANK[sourceConf] > CONFIDENTIALITY_RANK[sinkConf]) {
+        issues.push({
+            severity: advisory ? "warning" : "error",
+            code: code("confidentiality-flow-violation"),
+            message: `source effect '${sourceLabel}' (${sourceConf}) cannot flow to sink '${sinkLabel}' (${sinkConf})${suffix}`,
+            effectId: sinkLabel,
+        });
+    }
+    if (INTEGRITY_RANK[sourceIntegrity] < INTEGRITY_RANK[sinkIntegrity]) {
+        issues.push({
+            severity: advisory ? "warning" : "error",
+            code: code("integrity-flow-violation"),
+            message: `source effect '${sourceLabel}' (${sourceIntegrity}) cannot satisfy sink '${sinkLabel}' integrity (${sinkIntegrity})${suffix}`,
+            effectId: sinkLabel,
+        });
+    }
+    return issues;
+}
+/** Extract portable relative path string from a PathRef for overlap checks. */
+export function pathRefRelativeKey(pathRef) {
+    const sub = pathRef.subpath;
+    if (!sub)
+        return "";
+    if ("literalPath" in sub && typeof sub.literalPath === "string") {
+        const n = normalizePortableRelativePath(sub.literalPath);
+        return n.ok ? n.value : undefined;
+    }
+    // Dynamic arg/segments paths cannot be fully resolved statically.
+    return undefined;
+}
+/**
+ * True if path A is the same as, a parent of, or a child of path B
+ * (portable `/` paths, no `..`).
+ */
+export function pathsOverlap(a, b) {
+    if (a === b)
+        return true;
+    if (a === "" || b === "")
+        return true; // whole workspace
+    const ap = a.endsWith("/") ? a.slice(0, -1) : a;
+    const bp = b.endsWith("/") ? b.slice(0, -1) : b;
+    return ap.startsWith(bp + "/") || bp.startsWith(ap + "/");
+}
+function validateSecretRef(s, effectId, issues) {
+    if (!isObject(s) || typeof s.secretId !== "string" || !s.secretId.trim()) {
+        issues.push({
+            severity: "error",
+            code: "invalid-secret-ref",
+            message: `effect '${effectId}': secret target requires non-empty secretId`,
+            effectId,
+        });
+        return;
+    }
+    if ("value" in s || "material" in s || "token" in s) {
+        issues.push({
+            severity: "error",
+            code: "secret-material-forbidden",
+            message: `effect '${effectId}': SecretRef must not carry secret material fields`,
+            effectId,
+        });
+    }
+}
+function validateServiceRef(s, effectId, issues) {
+    if (!isObject(s) || typeof s.serviceId !== "string" || !s.serviceId.trim()) {
+        issues.push({
+            severity: "error",
+            code: "invalid-service-ref",
+            message: `effect '${effectId}': service target requires non-empty serviceId`,
+            effectId,
+        });
+    }
+}
+function validatePathTarget(pathRef, effectId, issues) {
+    if (!isObject(pathRef)) {
+        issues.push({
+            severity: "error",
+            code: "invalid-path-ref",
+            message: `effect '${effectId}': path target must be a PathRef object`,
+            effectId,
+        });
+        return undefined;
+    }
+    const hasWorkspace = typeof pathRef.workspace === "string" && pathRef.workspace.length > 0;
+    const hasHandle = isObject(pathRef.handle);
+    if (hasWorkspace === hasHandle) {
+        issues.push({
+            severity: "error",
+            code: "invalid-path-ref",
+            message: `effect '${effectId}': PathRef needs exactly one of workspace or handle`,
+            effectId,
+        });
+        return undefined;
+    }
+    if (!pathRef.intent || typeof pathRef.intent !== "string") {
+        issues.push({
+            severity: "error",
+            code: "invalid-path-ref",
+            message: `effect '${effectId}': PathRef.intent is required`,
+            effectId,
+        });
+        return undefined;
+    }
+    return pathRef;
+}
+const MUTATING_KINDS = new Set(["fs.write", "fs.delete"]);
+/**
+ * Validate an EffectIR bag: shape, labels, target/kind consistency, overlap.
+ */
+export function validateEffectIR(ir) {
+    const issues = [];
+    const raw = ir?.effects;
+    if (raw === undefined)
+        return { ok: true, issues: [] };
+    if (!Array.isArray(raw)) {
+        return {
+            ok: false,
+            issues: [{ severity: "error", code: "effects-not-array", message: "effects must be an array" }],
+        };
+    }
+    const seenIds = new Set();
+    const mutating = [];
+    for (const item of raw) {
+        if (!isObject(item)) {
+            issues.push({ severity: "error", code: "effect-not-object", message: "each effect must be an object" });
+            continue;
+        }
+        if (!Value.Check(EffectDeclSchema, item)) {
+            issues.push({
+                severity: "error",
+                code: "invalid-effect-shape",
+                message: `effect '${typeof item.id === "string" ? item.id : "<unknown>"}': declaration is outside the closed EffectIR schema`,
+                effectId: typeof item.id === "string" ? item.id : undefined,
+            });
+        }
+        const id = item.id;
+        if (typeof id !== "string" || !id.trim()) {
+            issues.push({ severity: "error", code: "effect-id-required", message: "effect.id is required" });
+            continue;
+        }
+        if (seenIds.has(id)) {
+            issues.push({
+                severity: "error",
+                code: "duplicate-effect-id",
+                message: `duplicate effect id '${id}'`,
+                effectId: id,
+            });
+        }
+        seenIds.add(id);
+        if (!isEffectKind(item.kind)) {
+            issues.push({
+                severity: "error",
+                code: "unknown-effect-kind",
+                message: `effect '${id}': unknown kind ${String(item.kind)}`,
+                effectId: id,
+            });
+            continue;
+        }
+        const kind = item.kind;
+        if (item.confidentiality !== undefined && !isConf(item.confidentiality)) {
+            issues.push({
+                severity: "error",
+                code: "invalid-confidentiality",
+                message: `effect '${id}': invalid confidentiality label`,
+                effectId: id,
+            });
+        }
+        if (item.integrity !== undefined && !isInteg(item.integrity)) {
+            issues.push({
+                severity: "error",
+                code: "invalid-integrity",
+                message: `effect '${id}': invalid integrity label`,
+                effectId: id,
+            });
+        }
+        const target = item.target;
+        if (!isObject(target) || typeof target.kind !== "string") {
+            issues.push({
+                severity: "error",
+                code: "invalid-target",
+                message: `effect '${id}': target.kind is required`,
+                effectId: id,
+            });
+            continue;
+        }
+        if (kind.startsWith("fs.")) {
+            if (target.kind !== "path") {
+                issues.push({
+                    severity: "error",
+                    code: "target-kind-mismatch",
+                    message: `effect '${id}': fs.* requires target.kind === "path"`,
+                    effectId: id,
+                });
+            }
+            else {
+                const pref = validatePathTarget(target.path, id, issues);
+                if (pref && MUTATING_KINDS.has(kind)) {
+                    const key = pathRefRelativeKey(pref);
+                    if (key === undefined) {
+                        issues.push({
+                            severity: "warning",
+                            code: "dynamic-path-overlap-unknown",
+                            message: `effect '${id}': mutating path is dynamic; overlap cannot be proven statically`,
+                            effectId: id,
+                        });
+                    }
+                    else {
+                        mutating.push({ effectId: id, pathKey: key });
+                    }
+                }
+            }
+        }
+        else if (kind === "secret.read") {
+            if (target.kind !== "secret") {
+                issues.push({
+                    severity: "error",
+                    code: "target-kind-mismatch",
+                    message: `effect '${id}': secret.read requires target.kind === "secret"`,
+                    effectId: id,
+                });
+            }
+            else {
+                validateSecretRef(target.secret, id, issues);
+            }
+        }
+        else if (kind === "service.call") {
+            if (target.kind !== "service") {
+                issues.push({
+                    severity: "error",
+                    code: "target-kind-mismatch",
+                    message: `effect '${id}': service.call requires target.kind === "service"`,
+                    effectId: id,
+                });
+            }
+            else {
+                validateServiceRef(target.service, id, issues);
+            }
+        }
+    }
+    // Mutating path overlap (static)
+    for (let i = 0; i < mutating.length; i++) {
+        for (let j = i + 1; j < mutating.length; j++) {
+            const a = mutating[i];
+            const b = mutating[j];
+            if (pathsOverlap(a.pathKey, b.pathKey)) {
+                issues.push({
+                    severity: "error",
+                    code: "mutating-path-overlap",
+                    message: `mutating effects '${a.effectId}' and '${b.effectId}' overlap on path ` +
+                        `('${a.pathKey || "<workspace>"}' vs '${b.pathKey || "<workspace>"}')`,
+                    effectId: a.effectId,
+                    pathA: a.pathKey,
+                    pathB: b.pathKey,
+                });
+            }
+        }
+    }
+    // Conservative information-flow check. Read declarations are sources;
+    // writes/calls are sinks. Without an explicit data-flow subgraph, every
+    // declared source may influence every declared sink in the same phase.
+    // Confidentiality may only flow upward (sink clearance >= source label),
+    // while integrity may only flow downward (source trust >= sink requirement).
+    const valid = raw.filter((item) => isObject(item) && typeof item.id === "string" && isEffectKind(item.kind));
+    const sources = valid.filter((item) => SOURCE_KINDS.has(item.kind));
+    const sinks = valid.filter((item) => SINK_KINDS.has(item.kind));
+    for (const source of sources) {
+        for (const sink of sinks) {
+            issues.push(...labelFlowIssues(source, sink));
+        }
+    }
+    const ok = !issues.some((i) => i.severity === "error");
+    return { ok, issues };
+}
+function directPhaseSummary(phase, phaseLabel) {
+    const sources = [];
+    const sinks = [];
+    for (const raw of Array.isArray(phase.effects) ? phase.effects : []) {
+        if (!isObject(raw) || typeof raw.id !== "string" || !isEffectKind(raw.kind))
+            continue;
+        const effect = raw;
+        const labeled = { label: `${phaseLabel}/${effect.id}`, effect };
+        if (SOURCE_KINDS.has(effect.kind))
+            sources.push(labeled);
+        if (SINK_KINDS.has(effect.kind))
+            sinks.push(labeled);
+    }
+    return { sources, sinks };
+}
+function unknownBoundarySummary(phaseLabel, advisory = false) {
+    const advisoryFlag = advisory ? { __unresolvedUseAdvisory: true } : {};
+    return {
+        sources: [{
+                label: `${phaseLabel}/<dynamic-source>`,
+                effect: {
+                    id: "<dynamic-source>",
+                    kind: "secret.read",
+                    confidentiality: "secret",
+                    integrity: "untrusted",
+                    __unknownBoundary: true,
+                    ...advisoryFlag,
+                    target: { kind: "secret", secret: { secretId: "<dynamic>" } },
+                },
+            }],
+        sinks: [{
+                label: `${phaseLabel}/<dynamic-sink>`,
+                effect: {
+                    id: "<dynamic-sink>",
+                    kind: "service.call",
+                    confidentiality: "public",
+                    integrity: "verified",
+                    __unknownBoundary: true,
+                    ...advisoryFlag,
+                    target: { kind: "service", service: { serviceId: "<dynamic>" } },
+                },
+            }],
+    };
+}
+function parseInlineFlow(raw) {
+    let value = raw;
+    if (typeof value === "string") {
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (Array.isArray(value))
+        return { phases: value };
+    if (!isObject(value) || !Array.isArray(value.phases))
+        return undefined;
+    return { name: value.name, phases: value.phases };
+}
+/**
+ * Conservative DAG-wide label flow. Every source reachable through a phase's
+ * dependencies may influence that phase's sinks, including through unlabeled
+ * intermediate phases. This is a pure static check; conditional branches are
+ * intentionally not used to declassify data.
+ */
+export function validateEffectFlow(phases, dependencyIds = (phase) => [
+    ...(Array.isArray(phase.dependsOn) ? phase.dependsOn.filter((id) => typeof id === "string") : []),
+    ...(Array.isArray(phase.from) ? phase.from.filter((id) => typeof id === "string") : []),
+], phaseSummaries) {
+    const issues = [];
+    const byId = new Map();
+    const ownSources = new Map();
+    const sinks = new Map();
+    for (const phase of phases) {
+        if (typeof phase.id !== "string" || !phase.id)
+            continue;
+        byId.set(phase.id, phase);
+        const summary = phaseSummaries?.get(phase.id) ?? directPhaseSummary(phase, phase.id);
+        ownSources.set(phase.id, new Map(summary.sources.map(({ label, effect }) => [label, effect])));
+        sinks.set(phase.id, summary.sinks);
+    }
+    const reachable = new Map([...ownSources].map(([id, sources]) => [id, new Map(sources)]));
+    for (let pass = 0; pass < byId.size; pass++) {
+        let changed = false;
+        for (const [phaseId, phase] of byId) {
+            const target = reachable.get(phaseId);
+            for (const depId of dependencyIds(phase)) {
+                for (const [sourceId, source] of reachable.get(depId) ?? []) {
+                    if (!target.has(sourceId)) {
+                        target.set(sourceId, source);
+                        changed = true;
+                    }
+                }
+            }
+        }
+        if (!changed)
+            break;
+    }
+    for (const phaseId of byId.keys()) {
+        const ownSourceIds = new Set(ownSources.get(phaseId)?.keys() ?? []);
+        const upstreamSources = [...(reachable.get(phaseId) ?? [])]
+            .filter(([sourceId]) => !ownSourceIds.has(sourceId));
+        if (upstreamSources.length === 0)
+            continue;
+        for (const { label: sinkLabel, effect: sink } of sinks.get(phaseId) ?? []) {
+            for (const [sourceId, source] of upstreamSources) {
+                issues.push(...labelFlowIssues(source, sink, sourceId, sinkLabel));
+            }
+        }
+    }
+    return { ok: !issues.some((issue) => issue.severity === "error"), issues };
+}
+function summarizeComposedEffectFlow(flow, options, prefix, seenUses) {
+    const phases = Array.isArray(flow.phases) ? flow.phases : [];
+    const issues = [];
+    const summaries = new Map();
+    // Static gates (no flow loader) downgrade unresolved `flow{use}` boundaries
+    // to advisory warnings; the runtime (with a loader) stays fail-closed.
+    const downgradeUse = options.downgradeUnresolvedUse === true;
+    for (const phase of phases) {
+        if (typeof phase.id !== "string" || !phase.id)
+            continue;
+        const phaseLabel = `${prefix}${phase.id}`;
+        if (prefix && phase.effects !== undefined) {
+            issues.push(...validateEffectIR({ effects: phase.effects }).issues.map((issue) => ({
+                ...issue,
+                effectId: issue.effectId ? `${phaseLabel}/${issue.effectId}` : phaseLabel,
+                message: issue.effectId
+                    ? issue.message.replace(`'${issue.effectId}'`, `'${phaseLabel}/${issue.effectId}'`)
+                    : `${phaseLabel}: ${issue.message}`,
+            })));
+        }
+        const summary = directPhaseSummary(phase, phaseLabel);
+        const type = phase.type ?? "agent";
+        if (type === "flow" || type === "expand") {
+            let child;
+            let childSeen = seenUses;
+            // Only a named saved `flow{use}` is a resolver-resolvable boundary;
+            // dynamic inline `def` strings (LLM-authored, unparseable) stay
+            // hard-tainted by design and never downgrade.
+            let unresolvedUse;
+            if (phase.def !== undefined) {
+                child = parseInlineFlow(phase.def);
+            }
+            else if (type === "flow" && typeof phase.use === "string" && phase.use) {
+                if (!seenUses.has(phase.use)) {
+                    try {
+                        child = options.resolveFlow?.(phase.use);
+                    }
+                    catch {
+                        child = undefined;
+                    }
+                    childSeen = new Set([...seenUses, phase.use]);
+                }
+                unresolvedUse = child === undefined ? phase.use : undefined;
+            }
+            const advisory = unresolvedUse !== undefined && downgradeUse;
+            const childResult = child
+                ? summarizeComposedEffectFlow(child, options, `${phaseLabel}/`, childSeen)
+                : { ok: true, issues: [], summary: unknownBoundarySummary(phaseLabel, advisory) };
+            if (advisory) {
+                issues.push({
+                    severity: "warning",
+                    code: "unresolved-flow-use",
+                    message: `phase '${phaseLabel}' uses saved flow '${unresolvedUse}' which cannot be resolved ` +
+                        `statically; child effects are unknown and treated as an unknown boundary ` +
+                        `(advisory). Runtime admission with the flow store is authoritative.`,
+                    effectId: phaseLabel,
+                });
+            }
+            issues.push(...childResult.issues);
+            summary.sources.push(...childResult.summary.sources);
+            summary.sinks.push(...childResult.summary.sinks);
+        }
+        summaries.set(phase.id, summary);
+    }
+    const flowResult = validateEffectFlow(phases, undefined, summaries);
+    issues.push(...flowResult.issues);
+    return {
+        ok: !issues.some((issue) => issue.severity === "error"),
+        issues,
+        summary: {
+            sources: [...summaries.values()].flatMap((summary) => summary.sources),
+            sinks: [...summaries.values()].flatMap((summary) => summary.sinks),
+        },
+    };
+}
+/**
+ * Validate label flow across nested flow/expand boundaries. Child sources are
+ * summarized onto the parent node and child sinks receive the parent's
+ * dependency-reachable sources. Unresolved saved/dynamic children expose a
+ * maximally confidential source and public sink until runtime resolution.
+ * With {@link ComposedEffectFlowOptions.downgradeUnresolvedUse} set (static
+ * gates without a flow loader), unresolvable `flow{use}` boundaries report as
+ * advisory warnings instead of errors; runtime admission stays authoritative.
+ */
+export function validateComposedEffectFlow(flow, options = {}) {
+    const result = summarizeComposedEffectFlow(flow, options, "", new Set());
+    return { ok: result.ok, issues: result.issues };
+}
+/** Type guard for a well-formed SecretRef (no material). */
+export function isSecretRef(v) {
+    return isObject(v) && typeof v.secretId === "string" && v.secretId.length > 0 && !("value" in v) && !("material" in v);
+}
+/** Type guard for ServiceRef. */
+export function isServiceRef(v) {
+    return isObject(v) && typeof v.serviceId === "string" && v.serviceId.length > 0;
+}
+/** Collect mutating path keys from effects (static literals only). */
+export function collectMutatingPathKeys(effects) {
+    const out = [];
+    for (const e of effects) {
+        if (!MUTATING_KINDS.has(e.kind))
+            continue;
+        if (e.target.kind !== "path")
+            continue;
+        const key = pathRefRelativeKey(e.target.path);
+        if (key !== undefined)
+            out.push({ effectId: e.id, pathKey: key });
+    }
+    return out;
+}
+//# sourceMappingURL=validate.js.map

package/dist/effects/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/effects/validate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,6BAA6B,EAAgB,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,cAAc,GAQd,MAAM,YAAY,CAAC;AAgBpB,SAAS,QAAQ,CAAC,CAAU;IAC3B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,sBAA4C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAID,MAAM,YAAY,GAA4B,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;AAClF,MAAM,UAAU,GAA4B,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAElF,SAAS,iBAAiB,CAAC,IAAuB;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;AAClH,CAAC;AAED,SAAS,WAAW,CAAC,IAAuB;IAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,eAAe,CACvB,MAAyB,EACzB,IAAuB,EACvB,WAAW,GAAG,MAAM,CAAC,EAAE,EACvB,SAAS,GAAG,IAAI,CAAC,EAAE;IAEnB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,6DAA6D;IAC7D,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACxF,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,uBAAuB,KAAK,IAAI,IAAI,IAAI,CAAC,uBAAuB,KAAK,IAAI,CAAC;IAClG,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,sFAAsF,CAAC,CAAC,CAAC,EAAE,CAAC;IACtH,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,oBAAoB,CAAC,UAAU,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;YACxC,IAAI,EAAE,IAAI,CAAC,gCAAgC,CAAC;YAC5C,OAAO,EAAE,kBAAkB,WAAW,MAAM,UAAU,0BAA0B,SAAS,MAAM,QAAQ,IAAI,MAAM,EAAE;YACnH,QAAQ,EAAE,SAAS;SACnB,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,CAAC,eAAe,CAAC,GAAG,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;YACxC,IAAI,EAAE,IAAI,CAAC,0BAA0B,CAAC;YACtC,OAAO,EAAE,kBAAkB,WAAW,MAAM,eAAe,0BAA0B,SAAS,gBAAgB,aAAa,IAAI,MAAM,EAAE;YACvI,QAAQ,EAAE,SAAS;SACnB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,aAAa,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,CAAC,GAAG,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACnC,CAAC;IACD,kEAAkE;IAClE,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAChD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IACzD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU,EAAE,QAAgB,EAAE,MAA+B;IACvF,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,WAAW,QAAQ,8CAA8C;YAC1E,QAAQ;SACR,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,WAAW,QAAQ,oDAAoD;YAChF,QAAQ;SACR,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU,EAAE,QAAgB,EAAE,MAA+B;IACxF,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,WAAW,QAAQ,gDAAgD;YAC5E,QAAQ;SACR,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB,EAAE,QAAgB,EAAE,MAA+B;IAC9F,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,WAAW,QAAQ,yCAAyC;YACrE,QAAQ;SACR,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,WAAW,QAAQ,qDAAqD;YACjF,QAAQ;SACR,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,WAAW,QAAQ,+BAA+B;YAC3D,QAAQ;SACR,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,OAA6B,CAAC;AACtC,CAAC;AAED,MAAM,cAAc,GAA4B,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAEnF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAoC;IACpE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,EAAE,EAAE,OAAO,CAAC;IACxB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;SAC/F,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,QAAQ,GAAiD,EAAE,CAAC;IAElE,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACxG,SAAS;QACV,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,WAAW,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,sDAAsD;gBAC7H,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACjG,SAAS;QACV,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,wBAAwB,EAAE,GAAG;gBACtC,QAAQ,EAAE,EAAE;aACZ,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,WAAW,EAAE,mBAAmB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC5D,QAAQ,EAAE,EAAE;aACZ,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACzE,MAAM,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,WAAW,EAAE,kCAAkC;gBACxD,QAAQ,EAAE,EAAE;aACZ,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,WAAW,EAAE,4BAA4B;gBAClD,QAAQ,EAAE,EAAE;aACZ,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,WAAW,EAAE,4BAA4B;gBAClD,QAAQ,EAAE,EAAE;aACZ,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,WAAW,EAAE,yCAAyC;oBAC/D,QAAQ,EAAE,EAAE;iBACZ,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACzD,IAAI,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;oBACrC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;wBACvB,MAAM,CAAC,IAAI,CAAC;4BACX,QAAQ,EAAE,SAAS;4BACnB,IAAI,EAAE,8BAA8B;4BACpC,OAAO,EAAE,WAAW,EAAE,kEAAkE;4BACxF,QAAQ,EAAE,EAAE;yBACZ,CAAC,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACP,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC/C,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;aAAM,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,WAAW,EAAE,kDAAkD;oBACxE,QAAQ,EAAE,EAAE;iBACZ,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;QACF,CAAC;aAAM,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,WAAW,EAAE,oDAAoD;oBAC1E,QAAQ,EAAE,EAAE;iBACZ,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAChD,CAAC;QACF,CAAC;IACF,CAAC;IAED,iCAAiC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YACvB,IAAI,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EACN,qBAAqB,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,QAAQ,oBAAoB;wBACvE,KAAK,CAAC,CAAC,OAAO,IAAI,aAAa,SAAS,CAAC,CAAC,OAAO,IAAI,aAAa,IAAI;oBACvE,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,KAAK,EAAE,CAAC,CAAC,OAAO;oBAChB,KAAK,EAAE,CAAC,CAAC,OAAO;iBAChB,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAA6B,EAAE,CAC5D,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IAED,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IACvD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACvB,CAAC;AA+CD,SAAS,kBAAkB,CAAC,KAA0B,EAAE,UAAkB;IACzE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtF,MAAM,MAAM,GAAG,GAAwB,CAAC;QACxC,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,GAAG,UAAU,IAAI,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAChE,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAkB,EAAE,QAAQ,GAAG,KAAK;IACnE,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO;QACN,OAAO,EAAE,CAAC;gBACT,KAAK,EAAE,GAAG,UAAU,mBAAmB;gBACvC,MAAM,EAAE;oBACP,EAAE,EAAE,kBAAkB;oBACtB,IAAI,EAAE,aAAa;oBACnB,eAAe,EAAE,QAAQ;oBACzB,SAAS,EAAE,WAAW;oBACtB,iBAAiB,EAAE,IAAI;oBACvB,GAAG,YAAY;oBACf,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;iBAC7D;aACD,CAAC;QACF,KAAK,EAAE,CAAC;gBACP,KAAK,EAAE,GAAG,UAAU,iBAAiB;gBACrC,MAAM,EAAE;oBACP,EAAE,EAAE,gBAAgB;oBACpB,IAAI,EAAE,cAAc;oBACpB,eAAe,EAAE,QAAQ;oBACzB,SAAS,EAAE,UAAU;oBACrB,iBAAiB,EAAE,IAAI;oBACvB,GAAG,YAAY;oBACf,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE;iBAChE;aACD,CAAC;KACF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACpC,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAA8B,EAAE,CAAC;IAC5E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAA+B,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,MAAsC,EACtC,aAAa,GAAsD,CAAC,KAAK,EAAE,EAAE,CAAC;IAC7E,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/G,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACrG,EACD,cAAwD;IAExD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+B,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0C,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,SAAS;QACxD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACrF,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC7D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC3B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;wBAC7B,OAAO,GAAG,IAAI,CAAC;oBAChB,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,MAAM;IACrB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;aACzD,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3C,KAAK,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3E,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YACpE,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;AAC5E,CAAC;AAMD,SAAS,2BAA2B,CACnC,IAA4B,EAC5B,OAAkC,EAClC,MAAc,EACd,QAA6B;IAE7B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,sBAAsB,KAAK,IAAI,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,SAAS;QACxD,MAAM,UAAU,GAAG,GAAG,MAAM,GAAG,KAAK,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAClF,GAAG,KAAK;gBACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU;gBACzE,OAAO,EAAE,KAAK,CAAC,QAAQ;oBACtB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,EAAE,IAAI,UAAU,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC;oBACnF,CAAC,CAAC,GAAG,UAAU,KAAK,KAAK,CAAC,OAAO,EAAE;aACpC,CAAC,CAAC,CAAC,CAAC;QACN,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC;QACnC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,KAAyC,CAAC;YAC9C,IAAI,SAAS,GAAG,QAAQ,CAAC;YACzB,oEAAoE;YACpE,gEAAgE;YAChE,8CAA8C;YAC9C,IAAI,aAAiC,CAAC;YACtC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC7B,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;iBAAM,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACJ,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACR,KAAK,GAAG,SAAS,CAAC;oBACnB,CAAC;oBACD,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/C,CAAC;gBACD,aAAa,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,CAAC;YACD,MAAM,QAAQ,GAAG,aAAa,KAAK,SAAS,IAAI,YAAY,CAAC;YAC7D,MAAM,WAAW,GAAG,KAAK;gBACxB,CAAC,CAAC,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,GAAG,EAAE,SAAS,CAAC;gBAC1E,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,sBAAsB,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnF,IAAI,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EACN,UAAU,UAAU,sBAAsB,aAAa,6BAA6B;wBACpF,2EAA2E;wBAC3E,qEAAqE;oBACtE,QAAQ,EAAE,UAAU;iBACpB,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO;QACN,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,MAAM;QACN,OAAO,EAAE;YACR,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YACtE,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SAClE;KACD,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACzC,IAA4B,EAC5B,OAAO,GAA8B,EAAE;IAEvC,MAAM,MAAM,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACzE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,WAAW,CAAC,CAAU;IACrC,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;AACxH,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,YAAY,CAAC,CAAU;IACtC,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;AACjF,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,uBAAuB,CAAC,OAAqB;IAC5D,MAAM,GAAG,GAAiD,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACvC,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/effects/why.d.ts

@@ -0,0 +1,94 @@
+/**
+ * why-authorized / why-context / why-effect — pure explainers over effect + auth records.
+ */
+import type { ConfidentialityLabel, EffectDecl, IntegrityLabel, WhyAuthorized, WhyContext, WhyEffect } from "./types.ts";
+import { type WriteIntentRecord } from "../resources/journal.ts";
+export interface WhyInput {
+    effect: EffectDecl;
+    runId: string;
+    phaseId?: string;
+    principalId?: string;
+    /** Capability binding ids that covered this effect (if any). */
+    capabilityBindingIds?: string[];
+    /** Whether static/admit validation allowed the effect. */
+    allowed: boolean;
+    allowReasons: string[];
+    denyReasons?: string[];
+    intentId?: string;
+    journalStatus?: string;
+    status: WhyEffect["status"];
+    workspaceRoot?: string;
+    defaultConfidentiality?: ConfidentialityLabel;
+    defaultIntegrity?: IntegrityLabel;
+}
+export declare function whyAuthorized(input: WhyInput): WhyAuthorized;
+export declare function whyContext(input: WhyInput): WhyContext;
+export declare function whyEffect(input: WhyInput): WhyEffect;
+/** Minimal flow shape for effect lookup (Taskflow / FlowIR phases). */
+export interface WhyEffectFlowLike {
+    phases?: ReadonlyArray<{
+        id?: string;
+        effects?: unknown;
+        dependsOn?: unknown;
+        from?: unknown;
+    } | null | undefined>;
+}
+export interface WhyEffectFromFlowInput {
+    /** Flow definition that declares effects (typically RunState.def). */
+    flow: WhyEffectFlowLike;
+    runId: string;
+    /** Effect id as declared, or `phaseId/effectId` composite. */
+    effectId: string;
+    /** Disambiguate when the same effect id appears on multiple phases. */
+    phaseId?: string;
+    workspaceRoot?: string;
+    /** Runtime lifecycle status; MCP defaults to `declared` (read-only explain). */
+    status?: WhyEffect["status"];
+    intentId?: string;
+    principalId?: string;
+    capabilityBindingIds?: string[];
+}
+export type WhyEffectFromFlowResult = {
+    ok: true;
+    why: WhyEffect;
+    phaseId?: string;
+} | {
+    ok: false;
+    error: string;
+};
+interface LocatedEffect {
+    effect: EffectDecl;
+    phaseId?: string;
+    /** Id used for bag validation (phase-prefixed when from a phase). */
+    bagId: string;
+}
+/** Collect declared effects from each phase (original ids preserved). */
+export declare function collectDeclaredEffects(flow: WhyEffectFlowLike): LocatedEffect[];
+/**
+ * Pure: resolve a declared effect from a flow and explain authorization + context.
+ *
+ * Fail-closed: if static validation reports any error for this effect (or the
+ * bag cannot be validated), `authorized.allowed` is false with deny reasons.
+ * Missing effect → `{ ok: false }` (MCP returns isError).
+ *
+ * Zero tokens / no I/O. Runtime commit status is optional (`status` defaults
+ * to `"declared"`). Use `whyEffectFromLedger` for authorization claims.
+ */
+export declare function whyEffectFromFlow(input: WhyEffectFromFlowInput): WhyEffectFromFlowResult;
+export interface WhyEffectFromLedgerInput extends Omit<WhyEffectFromFlowInput, "status" | "intentId" | "principalId" | "capabilityBindingIds"> {
+    intents: readonly WriteIntentRecord[];
+    ledgerError?: string;
+}
+/**
+ * Explain authority from the durable resource ledger, not from declaration
+ * alone. A statically valid effect without a matching write intent remains
+ * unauthorized because no mutation permit was durably admitted for it.
+ */
+export declare function whyEffectFromLedger(input: WhyEffectFromLedgerInput): WhyEffectFromFlowResult;
+export declare function whyEffectFromDurableJournal(input: Omit<WhyEffectFromLedgerInput, "intents" | "ledgerError"> & {
+    controlDirectory?: string;
+}): Promise<WhyEffectFromFlowResult>;
+/** Plain-text render for MCP / CLI (no markdown fences). */
+export declare function formatWhyEffect(why: WhyEffect): string;
+export {};
+//# sourceMappingURL=why.d.ts.map