youmd 0.12.0 → 0.13.0

package/dist/lib/codex-readonly-job.js

@@ -0,0 +1,196 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runReadonlyCodexJob = exports.CODEX_READONLY_JOB_CONTEXT_DIGEST = exports.CODEX_READONLY_JOB_INSTRUCTION = exports.CODEX_READONLY_JOB_KILL_GRACE_MS = exports.CODEX_READONLY_JOB_TIMEOUT_MS = exports.CODEX_READONLY_JOB_MAX_TOTAL_OUTPUT_BYTES = exports.CODEX_READONLY_JOB_MAX_EVENT_BYTES = exports.CODEX_READONLY_JOB_MAX_PROMPT_BYTES = void 0;
+exports.validateApprovedReadonlyLocalCodexJob = validateApprovedReadonlyLocalCodexJob;
+exports.createDeclaredInputSnapshot = createDeclaredInputSnapshot;
+exports.buildReadonlyCodexJobRequest = buildReadonlyCodexJobRequest;
+exports.executeApprovedReadonlyLocalCodexJob = executeApprovedReadonlyLocalCodexJob;
+const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const codex_device_auth_1 = require("./codex-device-auth");
+/** Local-only M3.5 boundary. A receipt is evidence, never a runnable grant. */
+exports.CODEX_READONLY_JOB_MAX_PROMPT_BYTES = 32 * 1024;
+exports.CODEX_READONLY_JOB_MAX_EVENT_BYTES = 64 * 1024;
+exports.CODEX_READONLY_JOB_MAX_TOTAL_OUTPUT_BYTES = 512 * 1024;
+exports.CODEX_READONLY_JOB_TIMEOUT_MS = 10 * 60000;
+exports.CODEX_READONLY_JOB_KILL_GRACE_MS = 3000;
+exports.CODEX_READONLY_JOB_INSTRUCTION = "Audit the declared You.md owner context snapshot for internal inconsistencies, stale statements, missing provenance, and actionable next steps. Do not modify files. Do not use external tools or network tools. Return a concise findings summary.";
+exports.CODEX_READONLY_JOB_CONTEXT_DIGEST = "sha256:4f5580463381df28be0ae267baa874c39ee5abee03096998803996df8440cf85";
+const DISABLED_FEATURES = ["apps", "browser_use", "browser_use_external", "browser_use_full_cdp_access", "computer_use", "hooks", "plugins", "plugin_sharing", "remote_plugin", "enable_mcp_apps", "image_generation", "multi_agent", "multi_agent_v2", "code_mode_host", "skill_mcp_dependency_install", "skill_search", "workspace_dependencies", "standalone_web_search", "web_search_cached", "web_search_request"];
+const SHA256 = /^sha256:[a-f0-9]{64}$/;
+function sha256(buffer) { return `sha256:${(0, crypto_1.createHash)("sha256").update(buffer).digest("hex")}`; }
+function exactKeys(value, keys) { return Object.keys(value).length === keys.length && keys.every((key) => key in value); }
+function isSafeRelative(value) {
+    if (!/^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]{1,512}$/.test(value))
+        return false;
+    const parts = value.toLowerCase().split("/");
+    const sensitive = /^(\.env(?:\..*)?|\.codex|\.claude|\.cursor|\.ssh|\.gnupg|\.git|node_modules|auth\.json|.*(?:credential|secret|token|cookie).*|keychains|chrome|application support)$/;
+    return !parts.some((part) => sensitive.test(part));
+}
+/** Strictly proves this is a separately approved, no-write/local-Codex grant. */
+function validateApprovedReadonlyLocalCodexJob(job, now = Date.now()) {
+    if (!job || typeof job !== "object" || job.applicationId !== "app:youmd-local-codex-adapter" || !/^job:[a-z0-9][a-z0-9_-]{7,127}$/.test(job.jobId)
+        || !SHA256.test(job.jobDigest) || !SHA256.test(job.contextDigest) || !/^device:[A-Za-z0-9._-]{3,128}$/.test(job.deviceId) || job.audience !== "youmd:personal"
+        || job.tenantRef !== "personal" || job.projectRef !== "project:youmd-owner-context" || job.runtimeId !== "runtime:youmd-local-codex"
+        || job.target !== "openai_codex" || job.action !== "read_only_audit" || job.modelClass !== "codex")
+        throw new Error("invalid_approved_local_codex_job");
+    if (job.approvalState !== "approved" || typeof job.approvalRef !== "string" || !/^approval:[A-Za-z0-9_-]{3,128}$/.test(job.approvalRef)
+        || !/^dak_[A-Za-z0-9]{12,64}$/.test(job.keyId) || !Number.isInteger(job.keyGeneration) || job.keyGeneration < 1 || !Number.isInteger(job.applicationGeneration) || job.applicationGeneration < 1)
+        throw new Error("job_approval_required");
+    if (Date.parse(job.deadline) <= now || Date.parse(job.approvalExpiresAt) <= now)
+        throw new Error("job_grant_expired");
+    const profile = job.executionProfile;
+    if (!profile || profile.profile !== "bounded_local_codex_readonly/v1" || profile.runtimeTrust !== "trusted_local_private" || profile.runner !== "local_codex" || profile.inputPresentationMode !== "declared_snapshot" || profile.toolFilesystemMode !== "read_only" || profile.toolNetworkMode !== "none" || profile.toolWriteMode !== "none" || profile.providerInferenceTransport !== "first_party_client_managed/openai" || profile.outputMode !== "hash_only" || profile.lifecycleEventSchema !== "you-md/connected-agent-access/agent-job-lifecycle-event/v1")
+        throw new Error("job_execution_profile_rejected");
+    const network = job.networkPolicy;
+    const write = job.writePolicy;
+    if (!network || !exactKeys(network, ["mode", "allowedOrigins"]) || network.mode !== "none" || !Array.isArray(network.allowedOrigins) || network.allowedOrigins.length !== 0 || !write || !exactKeys(write, ["mode", "allowedPaths"]) || write.mode !== "none" || !Array.isArray(write.allowedPaths) || write.allowedPaths.length !== 0)
+        throw new Error("job_policy_rejected");
+    const evidence = job.authorizationEvidence;
+    if (!evidence || evidence.kind !== "owner_scoped_grant" || typeof evidence.reference !== "string" || evidence.reference.startsWith("receipt:"))
+        throw new Error("receipt_not_job_authority");
+    if (!Array.isArray(job.fileHashes) || job.fileHashes.length < 1 || job.fileHashes.length > 64 || job.fileHashes.some((file) => !file || !isSafeRelative(file.path) || !SHA256.test(file.digest)))
+        throw new Error("job_declared_inputs_invalid");
+}
+/** Copies only exact allowlisted, hash-verified file bytes into a private snapshot. */
+function createDeclaredInputSnapshot(sourceRoot, files, deps = {}) {
+    const initial = fs.lstatSync(sourceRoot);
+    if (initial.isSymbolicLink())
+        throw new Error("job_workspace_unsafe");
+    const root = fs.realpathSync.native(sourceRoot);
+    const rootStat = fs.lstatSync(root);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+        throw new Error("job_workspace_unsafe");
+    const snapshot = (deps.mkdtempSync ?? fs.mkdtempSync)(path.join(os.tmpdir(), "youmd-codex-readonly-"));
+    try {
+        for (const file of files) {
+            if (!isSafeRelative(file.path) || !SHA256.test(file.digest))
+                throw new Error("job_declared_inputs_invalid");
+            const requested = path.resolve(root, file.path);
+            const target = fs.realpathSync.native(requested);
+            if (!target.startsWith(`${root}${path.sep}`))
+                throw new Error("job_input_escape");
+            const entry = fs.lstatSync(target);
+            if (!entry.isFile() || entry.isSymbolicLink() || entry.size > exports.CODEX_READONLY_JOB_MAX_EVENT_BYTES)
+                throw new Error("job_input_unsafe");
+            const bytes = fs.readFileSync(target);
+            if (sha256(bytes) !== file.digest)
+                throw new Error("job_input_hash_mismatch");
+            const destination = path.join(snapshot, file.path);
+            fs.mkdirSync(path.dirname(destination), { recursive: true, mode: 0o700 });
+            fs.writeFileSync(destination, bytes, { mode: 0o400 });
+        }
+        return snapshot;
+    }
+    catch (error) {
+        fs.rmSync(snapshot, { recursive: true, force: true });
+        throw error;
+    }
+}
+function buildReadonlyCodexJobRequest(executable, snapshot, deadline) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0)
+        throw new Error("job_grant_expired");
+    const config = DISABLED_FEATURES.flatMap((feature) => ["--disable", feature]);
+    return { executable, argv: ["exec", "--sandbox", "read-only", "--ephemeral", "--ignore-user-config", "--ignore-rules", "--strict-config", "--json", "--skip-git-repo-check", ...config, "-C", snapshot, "-"], cwd: snapshot, shell: false, stdio: ["pipe", "pipe", "pipe"], stdin: Buffer.from(exports.CODEX_READONLY_JOB_INSTRUCTION, "utf8"), timeoutMs: Math.min(exports.CODEX_READONLY_JOB_TIMEOUT_MS, remaining), env: { HOME: process.env.HOME, PATH: "/usr/bin:/bin", TERM: process.env.TERM } };
+}
+const runReadonlyCodexJob = (request, onEvent) => new Promise((resolve) => {
+    const child = (0, child_process_1.spawn)(request.executable, [...request.argv], { cwd: request.cwd, shell: false, stdio: request.stdio, env: request.env, windowsHide: true });
+    let total = 0;
+    let settled = false;
+    let stopping = false;
+    let modelStarted = false;
+    let killTimer;
+    let pending;
+    let stdoutRemainder = "";
+    const eventHash = (0, crypto_1.createHash)("sha256");
+    const finish = (result) => { if (settled)
+        return; settled = true; clearTimeout(timer); if (killTimer)
+        clearTimeout(killTimer); request.signal?.removeEventListener("abort", cancel); resolve({ ...result, modelStarted, resultHash: `sha256:${eventHash.digest("hex")}` }); };
+    const stop = (result) => { if (stopping)
+        return; stopping = true; pending = result; child.kill("SIGTERM"); killTimer = setTimeout(() => { child.kill("SIGKILL"); }, exports.CODEX_READONLY_JOB_KILL_GRACE_MS); };
+    const cancel = () => stop({ exitCode: null, cancelled: true });
+    const timer = setTimeout(() => stop({ exitCode: null, timedOut: true }), request.timeoutMs);
+    const consume = (chunk) => { total += chunk.length; if (total > exports.CODEX_READONLY_JOB_MAX_TOTAL_OUTPUT_BYTES || chunk.length > exports.CODEX_READONLY_JOB_MAX_EVENT_BYTES)
+        return stop({ exitCode: null }); stdoutRemainder += chunk.toString("utf8"); const lines = stdoutRemainder.split("\n"); stdoutRemainder = lines.pop() ?? ""; for (const line of lines) {
+        try {
+            const value = JSON.parse(line);
+            const normalized = JSON.stringify({ type: typeof value.type === "string" ? value.type : "unknown" });
+            eventHash.update(normalized);
+            onEvent({ type: "event", jobId: "local", data: { event: typeof value.type === "string" ? value.type : "unknown" } });
+        }
+        catch {
+            eventHash.update('{"type":"unrecognized"}');
+            onEvent({ type: "event", jobId: "local", data: { event: "unrecognized" } });
+        }
+    } };
+    child.stdin?.end(request.stdin);
+    child.once("spawn", () => { modelStarted = true; });
+    child.once("error", () => finish({ exitCode: null }));
+    child.stdout?.on("data", consume);
+    child.stderr?.on("data", (chunk) => { total += chunk.length; if (total > exports.CODEX_READONLY_JOB_MAX_TOTAL_OUTPUT_BYTES || chunk.length > exports.CODEX_READONLY_JOB_MAX_EVENT_BYTES)
+        stop({ exitCode: null }); });
+    child.once("close", (exitCode) => finish(pending ?? { exitCode }));
+    if (request.signal)
+        request.signal.addEventListener("abort", cancel, { once: true });
+});
+exports.runReadonlyCodexJob = runReadonlyCodexJob;
+/** Fake-child friendly adapter. It never invokes the provider until an approved grant exists. */
+async function executeApprovedReadonlyLocalCodexJob(job, sourceRoot, onEvent, deps = {}, signal) {
+    validateApprovedReadonlyLocalCodexJob(job);
+    if (job.contextDigest !== exports.CODEX_READONLY_JOB_CONTEXT_DIGEST)
+        throw new Error("job_context_digest_mismatch");
+    const executable = (deps.resolveExecutable ?? codex_device_auth_1.resolveTrustedCodexExecutable)();
+    if (!executable)
+        throw new Error("trusted_codex_unavailable");
+    const snapshot = createDeclaredInputSnapshot(sourceRoot, job.fileHashes, deps);
+    const deadline = Math.min(Date.parse(job.deadline), Date.parse(job.approvalExpiresAt));
+    try {
+        onEvent({ type: "started", jobId: job.jobId });
+        const request = { ...buildReadonlyCodexJobRequest(executable, snapshot, deadline), signal };
+        const result = await (deps.run ?? exports.runReadonlyCodexJob)(request, (event) => onEvent({ ...event, jobId: job.jobId }));
+        const status = result.cancelled || result.timedOut ? "cancelled" : result.exitCode === 0 ? "completed" : "failed";
+        onEvent({ type: status, jobId: job.jobId });
+        return { status, contextLoaded: true, modelStarted: result.modelStarted === true, resultHash: result.resultHash ?? sha256(Buffer.from(`normalized:${status}`)) };
+    }
+    finally {
+        (deps.rmSync ?? fs.rmSync)(snapshot, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=codex-readonly-job.js.map

package/dist/lib/codex-readonly-job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-readonly-job.js","sourceRoot":"","sources":["../../src/lib/codex-readonly-job.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,sFAeC;AAGD,kEAgBC;AAED,oEAIC;AAeD,oFAKC;AApGD,mCAAoC;AACpC,iDAAyD;AACzD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,2DAAoE;AAEpE,+EAA+E;AAClE,QAAA,mCAAmC,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,QAAA,kCAAkC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,QAAA,yCAAyC,GAAG,GAAG,GAAG,IAAI,CAAC;AACvD,QAAA,6BAA6B,GAAG,EAAE,GAAG,KAAM,CAAC;AAC5C,QAAA,gCAAgC,GAAG,IAAK,CAAC;AACzC,QAAA,8BAA8B,GAAG,qPAAqP,CAAC;AACvR,QAAA,iCAAiC,GAAG,yEAAyE,CAAC;AAc3H,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,cAAc,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,oBAAoB,CAAU,CAAC;AACja,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAEvC,SAAS,MAAM,CAAC,MAAc,IAAY,OAAO,UAAU,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACjH,SAAS,SAAS,CAAC,KAA8B,EAAE,IAAc,IAAa,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AACtK,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,MAAM,SAAS,GAAG,sKAAsK,CAAC;IACvO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,iFAAiF;AACjF,SAAgB,qCAAqC,CAAC,GAA0B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAChG,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,+BAA+B,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;WAC7I,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB;WAC3J,GAAG,CAAC,SAAS,KAAK,UAAU,IAAI,GAAG,CAAC,UAAU,KAAK,6BAA6B,IAAI,GAAG,CAAC,SAAS,KAAK,2BAA2B;WACjI,GAAG,CAAC,MAAM,KAAK,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,iBAAiB,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC1J,IAAI,GAAG,CAAC,aAAa,KAAK,UAAU,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;WAClI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,GAAG,CAAC,qBAAqB,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7O,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACtH,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACrC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,iCAAiC,IAAI,OAAO,CAAC,YAAY,KAAK,uBAAuB,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,IAAI,OAAO,CAAC,qBAAqB,KAAK,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,KAAK,WAAW,IAAI,OAAO,CAAC,eAAe,KAAK,MAAM,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,IAAI,OAAO,CAAC,0BAA0B,KAAK,mCAAmC,IAAI,OAAO,CAAC,UAAU,KAAK,WAAW,IAAI,OAAO,CAAC,oBAAoB,KAAK,4DAA4D;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACvlB,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC;IAAC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/W,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC3C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC7L,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;AACnP,CAAC;AAED,uFAAuF;AACvF,SAAgB,2BAA2B,CAAC,UAAkB,EAAE,KAA+B,EAAE,OAA6C,EAAE;IAC9I,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAAC,IAAI,OAAO,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAChH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAAC,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClG,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACvG,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC5G,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAClF,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,0CAAkC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC1K,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACrH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACzF,CAAC;AAED,SAAgB,4BAA4B,CAAC,UAAkB,EAAE,QAAgB,EAAE,QAAgB;IACjG,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAAC,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,sCAA8B,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,qCAA6B,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;AAC1d,CAAC;AAEM,MAAM,mBAAmB,GAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IAC/F,MAAM,KAAK,GAAiB,IAAA,qBAAK,EAAC,OAAO,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACxK,IAAI,KAAK,GAAG,CAAC,CAAC;IAAC,IAAI,OAAO,GAAG,KAAK,CAAC;IAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAAC,IAAI,YAAY,GAAG,KAAK,CAAC;IAAC,IAAI,SAAqC,CAAC;IAAC,IAAI,OAAyF,CAAC;IAAC,IAAI,eAAe,GAAG,EAAE,CAAC;IACvP,MAAM,SAAS,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,MAA4E,EAAE,EAAE,GAAG,IAAI,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS;QAAE,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpV,MAAM,IAAI,GAAG,CAAC,MAA4E,EAAE,EAAE,GAAG,IAAI,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,wCAAgC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/Q,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,GAAG,iDAAyC,IAAI,KAAK,CAAC,MAAM,GAAG,0CAAkC;QAAE,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAAC,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IAC1wB,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,GAAG,iDAAyC,IAAI,KAAK,CAAC,MAAM,GAAG,0CAAkC;QAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAAC,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1hB,CAAC,CAAC,CAAC;AAVU,QAAA,mBAAmB,uBAU7B;AAEH,iGAAiG;AAC1F,KAAK,UAAU,oCAAoC,CAAC,GAA0B,EAAE,UAAkB,EAAE,OAA0C,EAAE,OAAwB,EAAE,EAAE,MAAoB;IACrM,qCAAqC,CAAC,GAAG,CAAC,CAAC;IAAC,IAAI,GAAG,CAAC,aAAa,KAAK,yCAAiC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAAC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,iDAA6B,CAAC,EAAE,CAAC;IAAC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACvS,MAAM,QAAQ,GAAG,2BAA2B,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACvK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,EAAE,GAAG,4BAA4B,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,2BAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;YACnkB,CAAC;QAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACrF,CAAC"}

package/dist/lib/connected-access-native.d.ts

@@ -0,0 +1,111 @@
+import * as fs from "fs";
+/** The native host enforces this same Chrome Native Messaging limit. */
+export declare const MAX_NATIVE_FRAME_BYTES: number;
+export type BrowserNativeHostConfig = {
+    extensionId: string;
+    bindingClass: "owner_registered_development" | "chrome_web_store_provisioned";
+};
+export type CliOnlyNativeHostConfig = {
+    /** No extension identity may be synthesized for this local-only binding. */
+    bindingClass: "cli_only";
+};
+export type NativeHostConfig = BrowserNativeHostConfig | CliOnlyNativeHostConfig;
+export type NativeHostPaths = {
+    root: string;
+    configPath: string;
+    executablePath: string;
+};
+/** The only privileged native-host surface available to this CLI. */
+export declare const NATIVE_HOST_CLI_CONTROL_ARGV: readonly ["--youmd-cli-control"];
+export type NativeHostRunner = (executablePath: string, argv: readonly string[], framedRequest: Buffer, timeoutMs: number) => Promise<Buffer>;
+export type NativeHostDeps = {
+    homedir?: () => string;
+    lstatSync?: typeof fs.lstatSync;
+    readFileSync?: typeof fs.readFileSync;
+    getuid?: () => number | undefined;
+    run?: NativeHostRunner;
+};
+export declare function nativeHostPaths(homedir?: string): NativeHostPaths;
+export declare function parseNativeHostConfig(raw: string): NativeHostConfig;
+export declare function requireBrowserNativeHostConfig(config: NativeHostConfig): BrowserNativeHostConfig;
+export declare function loadNativeHostConfig(deps?: NativeHostDeps): {
+    config: NativeHostConfig;
+    paths: NativeHostPaths;
+};
+export declare function assertNativeHostExecutable(paths: NativeHostPaths, deps?: NativeHostDeps): void;
+export declare function encodeNativeFrame(payload: Buffer): Buffer;
+/** Decode exactly one Native Messaging frame; trailing data is fail-closed. */
+export declare function decodeNativeFrame(frame: Buffer): Buffer;
+export declare function sha256Hex(value: Buffer): string;
+/** Executes a one-request native messaging host process without a shell. */
+export declare const spawnNativeHost: NativeHostRunner;
+export type NativeHostResponse = Record<string, unknown> & {
+    ok: boolean;
+    authorityGranted: false;
+    secretValuesExposed: false;
+};
+export declare function nativeHostCall(request: Record<string, unknown>, loaded?: {
+    config: NativeHostConfig;
+    paths: NativeHostPaths;
+}, deps?: NativeHostDeps): Promise<NativeHostResponse>;
+export declare function ensureNativeDevicePublicKey(loaded?: {
+    config: NativeHostConfig;
+    paths: NativeHostPaths;
+}, deps?: NativeHostDeps): Promise<{
+    publicJwk: string;
+    publicKey: string;
+    config: NativeHostConfig;
+    paths: NativeHostPaths;
+}>;
+export declare function readCachedNativeObservation(loaded?: {
+    config: NativeHostConfig;
+    paths: NativeHostPaths;
+}, deps?: NativeHostDeps): Promise<{
+    envelope: string;
+    signature: string;
+    publicKey: string;
+    observationHash: string;
+    expiresAt: number;
+    config: NativeHostConfig;
+    paths: NativeHostPaths;
+}>;
+export declare function signPreparedNativeProof(input: {
+    preparedCanonicalPayload: string;
+    observationHash: string;
+    expiresAt: number;
+    expectedPublicKey: string;
+}, loaded?: {
+    config: NativeHostConfig;
+    paths: NativeHostPaths;
+}, deps?: NativeHostDeps): Promise<{
+    signature: string;
+    payloadHash: string;
+}>;
+/**
+ * Signs only a server-canonical, separately approved job claim. This is not
+ * browser-observation proof and deliberately has no observation hash input.
+ */
+export declare function signApprovedLocalCodexJobClaim(input: {
+    approvedCanonicalClaim: string;
+    expiresAt: number;
+    expectedPublicKey: string;
+}, loaded?: {
+    config: NativeHostConfig;
+    paths: NativeHostPaths;
+}, deps?: NativeHostDeps): Promise<{
+    signature: string;
+    payloadHash: string;
+}>;
+/** CLI-control-only signature for one canonical start/event/complete payload. */
+export declare function signApprovedLocalCodexJobStep(input: {
+    approvedCanonicalStep: string;
+    expiresAt: number;
+    expectedPublicKey: string;
+}, loaded?: {
+    config: NativeHostConfig;
+    paths: NativeHostPaths;
+}, deps?: NativeHostDeps): Promise<{
+    signature: string;
+    payloadHash: string;
+}>;
+//# sourceMappingURL=connected-access-native.d.ts.map

package/dist/lib/connected-access-native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-access-native.d.ts","sourceRoot":"","sources":["../../src/lib/connected-access-native.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAKzB,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAiBhD,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,8BAA8B,GAAG,8BAA8B,CAAC;CAC/E,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG;IACpC,4EAA4E;IAC5E,YAAY,EAAE,UAAU,CAAC;CAC1B,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;AAEjF,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F,qEAAqE;AACrE,eAAO,MAAM,4BAA4B,kCAAmC,CAAC;AAC7E,MAAM,MAAM,gBAAgB,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9I,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC;IAChC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAClC,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB,CAAC;AAEF,wBAAgB,eAAe,CAAC,OAAO,SAAe,GAAG,eAAe,CAOvE;AAkBD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAYnE;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,gBAAgB,GAAG,uBAAuB,CAGhG;AAED,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,cAAmB,GAAG;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CASpH;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,GAAE,cAAmB,GAAG,IAAI,CAKlG;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMvD;AAeD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,4EAA4E;AAC5E,eAAO,MAAM,eAAe,EAAE,gBAkC5B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACzD,EAAE,EAAE,OAAO,CAAC;IACZ,gBAAgB,EAAE,KAAK,CAAC;IACxB,mBAAmB,EAAE,KAAK,CAAC;CAC5B,CAAC;AAEF,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,MAAM,CAAC,EAAE;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,EAC7D,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAmB7B;AAYD,wBAAsB,2BAA2B,CAAC,MAAM,CAAC,EAAE;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,EAAE,IAAI,GAAE,cAAmB;;;;;GAQzI;AAED,wBAAsB,2BAA2B,CAAC,MAAM,CAAC,EAAE;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,EAAE,IAAI,GAAE,cAAmB;;;;;;;;GAmBzI;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,wBAAwB,EAAE,MAAM,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,EAAE,MAAM,CAAC,EAAE;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,EAAE,IAAI,GAAE,cAAmB;;;GAmB1F;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,sBAAsB,EAAE,MAAM,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,EAAE,MAAM,CAAC,EAAE;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,EAAE,IAAI,GAAE,cAAmB;;;GAmC1F;AAOD,iFAAiF;AACjF,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IAAE,qBAAqB,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,CAAC,EAAE;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,EAAE,IAAI,GAAE,cAAmB;;;GAWnO"}