@cat-factory/orchestration 0.264.0 → 0.265.0

package/dist/modules/merge/RiskPolicyService.d.ts

@@ -1,9 +1,21 @@
-import type { Clock, CreateRiskPolicyInput, GroupCacheHandle, IdGenerator, RiskPolicyRepository, RiskPolicy, RiskPolicyCacheValue, UpdateRiskPolicyInput, WorkspaceRepository } from '@cat-factory/kernel';
+import type { Clock, CloneRiskPolicyInput, CreateRiskPolicyInput, GroupCacheHandle, IdGenerator, RiskPolicyRepository, RiskPolicyCacheValue, RiskPolicyLibraryEntry, RiskPolicySuppression, RiskPolicySuppressionRepository, UpdateRiskPolicyInput, WorkspaceRepository } from '@cat-factory/kernel';
+import type { WorkspaceRiskPolicyLibrary } from './WorkspaceRiskPolicyLibrary.js';
 export interface RiskPolicyServiceDependencies {
     riskPolicyRepository: RiskPolicyRepository;
     workspaceRepository: WorkspaceRepository;
     idGenerator: IdGenerator;
     clock: Clock;
+    /**
+     * The board's merged library (ADR 0055): its own rows plus the account policies it inherits.
+     * Every READ below answers from it, so the editor lists exactly what the engine will resolve.
+     * Absent ⇒ the workspace tier alone, which is what a facade with no account tier wired sees.
+     */
+    library?: WorkspaceRiskPolicyLibrary;
+    /**
+     * Which inherited policies the board hides. Absent ⇒ suppression is unavailable, and the routes
+     * that need it refuse rather than reporting a hide that was never stored.
+     */
+    riskPolicySuppressionRepository?: RiskPolicySuppressionRepository;
     /**
      * Optional: the {@link AppCaches.riskPolicy} slice the engine reads a task's resolved preset
      * through. Every write below invalidates the workspace group so a preset edit is visible on the
@@ -15,7 +27,7 @@ export interface RiskPolicyServiceDependencies {
  * CRUD for a workspace's merge threshold presets (the library a task picks its auto-merge policy
  * from). Maintains the invariant that a workspace always has at least one preset, exactly one of
  * which is the default: the built-in catalog ({@link seedRiskPolicies}) is written when the board
- * is CREATED, `ensureSeeded` repairs a board that predates that, and the default cannot be
+ * is CREATED, {@link seedOwnTier} repairs a board that predates that, and the default cannot be
  * deleted. The single-default promotion is enforced in the repository. {@link reseed} restores a
  * built-in to the current catalog (adopting an update, repairing drift, or materialising a NEW
  * built-in that appeared after the workspace was created).
@@ -26,6 +38,8 @@ export declare class RiskPolicyService {
     private readonly idGenerator;
     private readonly clock;
     private readonly cache?;
+    private readonly library?;
+    private readonly suppressions?;
     constructor(deps: RiskPolicyServiceDependencies);
     /**
      * Drop the workspace's cached preset library after a write commits. Coarse (one group == one
@@ -33,12 +47,86 @@ export declare class RiskPolicyService {
      * radius is the whole library — over-invalidation is always safe (CLAUDE.md caching rule).
      */
     private invalidate;
-    /** List a workspace's presets, repairing an empty library first (see `ensureSeeded`). */
-    list(workspaceId: string): Promise<RiskPolicy[]>;
+    /**
+     * The board's visible library, repairing an empty own-tier on the way (see {@link seedOwnTier}):
+     * its own policies plus the account policies it inherits, each tagged with the tier that owns it.
+     *
+     * The MERGED view rather than the board's rows, because this list feeds the settings editor, the
+     * snapshot and therefore every picker — and the engine resolves a pin through the same merge. A
+     * read that showed only local rows would hide postures a task can legitimately be filed against.
+     *
+     * The seeding CHECK is read out of the merged list rather than made as its own query: an entry
+     * tagged `workspace` is a row the board owns, so its presence answers "has this tier been
+     * materialised" exactly. Asking separately made this — the board SNAPSHOT's read, the hottest in
+     * the app — pay a full own-tier list before the merge that lists the same rows again.
+     */
+    list(workspaceId: string): Promise<RiskPolicyLibraryEntry[]>;
+    /**
+     * Copy an inherited ACCOUNT policy into this board's own tier, under a FRESH id.
+     *
+     * The fresh id is the whole design (see `cloneRiskPolicySchema`): an override sharing the account
+     * id would re-point every task already filed against the account's posture the moment the board
+     * edited its copy. The copy claims neither default — promoting it is a separate, deliberate act,
+     * and a clone that silently became the board's default would change how every unpinned task lands.
+     *
+     * Refuses an id the board already owns (`risk_policy_not_inherited`): that is a duplicate, not a
+     * clone, and the two need different copy.
+     */
+    clone(workspaceId: string, presetId: string, input: CloneRiskPolicyInput): Promise<RiskPolicyLibraryEntry>;
+    /**
+     * HIDE an inherited account policy from this board: it leaves the merged library, so no task here
+     * can pin it and no picker offers it.
+     *
+     * A task that ALREADY pinned it falls back to the board's default for its scope, which is exactly
+     * what a deleted local policy does (`resolveRiskPolicy` documents the dangling pin). The two acts
+     * are deliberately alike: hiding is the opt-out a board has for a row it cannot delete.
+     *
+     * Refuses an id the board owns (`risk_policy_not_inherited`) — delete that instead — and an id
+     * nothing inherits, which would otherwise write a suppression that shadows nothing today and
+     * silently swallows whatever the account defines under it tomorrow.
+     */
+    suppress(workspaceId: string, presetId: string): Promise<void>;
+    /**
+     * Stop hiding an inherited policy, so the board offers it again.
+     *
+     * Deliberately permissive about what it lifts: a suppression whose account policy has since been
+     * withdrawn hides nothing, and clearing it is still the right answer (it is listed, so it has to
+     * be dismissable). The refusal that matters is the one above, at the moment the row is written.
+     */
+    restoreInherited(workspaceId: string, presetId: string): Promise<void>;
+    /**
+     * What this board is hiding, and whether each suppression still shadows anything.
+     *
+     * Gated on the same store the WRITES are, so an unwired facade REFUSES here rather than answering
+     * an empty list: "this board hides nothing" and "this deployment cannot say what it hides" are
+     * different facts, and only the refusal states the second one (CLAUDE.md's absent-≠-zero rule).
+     * Answering `[]` positively claimed the first while the very next `suppress` returned a 503.
+     */
+    listSuppressions(workspaceId: string): Promise<RiskPolicySuppression[]>;
+    /**
+     * The account policy this board INHERITS under an id, or a 404.
+     *
+     * Suppression-aware (see `WorkspaceRiskPolicyLibrary.inheritedPolicy`), so the three states that
+     * are not "the board may clone this" collapse into one refusal: nothing defines the id, the
+     * account withdrew it, or this board hid it. Cloning is the only caller, and none of the three
+     * leaves it anything to copy — a board that opted out of a posture asking for a copy of it is a
+     * stale screen, not a request to honour.
+     */
+    private requireInherited;
+    /**
+     * Everything hiding takes: the suppression store AND the merged library that names what it holds,
+     * or a 503 naming what is not wired.
+     *
+     * A total accessor rather than a silent no-op: reporting success for a hide that was never stored
+     * would leave the operator looking at a policy they had just been told was hidden. Both halves are
+     * checked together, and the reads gate on it as well as the writes, so no caller can end up
+     * answering from one of the two while the other is missing.
+     */
+    private requireSuppressionSupport;
     /** Create a new preset. The first one (or one flagged default) becomes the default. */
-    create(workspaceId: string, input: CreateRiskPolicyInput): Promise<RiskPolicy>;
+    create(workspaceId: string, input: CreateRiskPolicyInput): Promise<RiskPolicyLibraryEntry>;
     /** Patch a preset. Demoting the only default is rejected (one must remain). */
-    update(workspaceId: string, id: string, patch: UpdateRiskPolicyInput): Promise<RiskPolicy>;
+    update(workspaceId: string, id: string, patch: UpdateRiskPolicyInput): Promise<RiskPolicyLibraryEntry>;
     /** Remove a preset. Neither scope's default preset can be removed. */
     remove(workspaceId: string, id: string): Promise<void>;
     /**
@@ -53,9 +141,25 @@ export declare class RiskPolicyService {
      * `mp_balanced`) can never steal the default away from the user's chosen preset.
      * Rejects an id not in the catalog (a custom preset — delete it instead).
      */
-    reseed(workspaceId: string, id: string): Promise<RiskPolicy>;
+    reseed(workspaceId: string, id: string): Promise<RiskPolicyLibraryEntry>;
+    /**
+     * Refuse a write aimed at a policy the ACCOUNT owns, naming the remedy (`risk_policy_inherited`).
+     *
+     * Checked BEFORE the board's own row is read, because the two failures need different copy and the
+     * bare 404 the read would produce is the misleading one: an inherited policy is visible in the
+     * board's editor and in every picker, so "no such policy" reads as a bug in the app rather than as
+     * "this one is not yours to change". The clone action is what leaves the board a row it can edit.
+     *
+     * Silent when no account tier is wired: there is nothing to inherit, so the caller's own 404 is
+     * then the honest answer.
+     *
+     * Takes the board's own row rather than re-reading it. The caller needs that row anyway (to patch,
+     * or to check the default flags before deleting), and the guard needs only to know whether it
+     * exists, so reading it here made every policy edit and delete pay two identical point queries.
+     */
+    private assertNotInherited;
     /**
-     * REPAIR a workspace whose preset library is empty, by writing the built-in catalog.
+     * REPAIR a workspace whose own preset tier is empty, by writing the built-in catalog.
      *
      * Creating a board is what normally seeds the library ({@link WorkspaceService.create}), and
      * that is where the invariant belongs: the engine resolves a task's governing preset without
@@ -66,8 +170,10 @@ export declare class RiskPolicyService {
      * made before creation seeded presets, and one whose facade wired the preset repository only
      * later. Both currently resolve `FALLBACK_RISK_POLICY`, which auto-merges nothing, so the
      * repair can only move a workspace from refusing everything to its configured default.
-     * Idempotent, and a no-op on every board created since.
+     *
+     * The emptiness TEST belongs to the caller, which has just read the library and therefore already
+     * knows the answer; this only writes.
      */
-    private ensureSeeded;
+    private seedOwnTier;
 }
 //# sourceMappingURL=RiskPolicyService.d.ts.map

package/dist/modules/merge/RiskPolicyService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RiskPolicyService.d.ts","sourceRoot":"","sources":["../../../src/modules/merge/RiskPolicyService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAW5B,MAAM,WAAW,6BAA6B;IAC5C,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ;;;;OAIG;IACH,eAAe,CAAC,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;CACzD;AAED;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAO;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAwC;IAE/D,YAAY,IAAI,EAAE,6BAA6B,EAM9C;IAED;;;;OAIG;YACW,UAAU;IAIxB,yFAAyF;IACnF,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAIrD;IAED,uFAAuF;IACjF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAqCnF;IAED,+EAA+E;IACzE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkE/F;IAED,sEAAsE;IAChE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa3D;IAED;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA8BjE;IAED;;;;;;;;;;;;;OAaG;YACW,YAAY;CAU3B"}
+{"version":3,"file":"RiskPolicyService.d.ts","sourceRoot":"","sources":["../../../src/modules/merge/RiskPolicyService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,oBAAoB,EAEpB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,+BAA+B,EAC/B,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAY5B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAEjF,MAAM,WAAW,6BAA6B;IAC5C,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ;;;;OAIG;IACH,OAAO,CAAC,EAAE,0BAA0B,CAAA;IACpC;;;OAGG;IACH,+BAA+B,CAAC,EAAE,+BAA+B,CAAA;IACjE;;;;OAIG;IACH,eAAe,CAAC,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;CACzD;AAED;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAO;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAiC;IAE/D,YAAY,IAAI,EAAE,6BAA6B,EAQ9C;IAED;;;;OAIG;YACW,UAAU;IAIxB;;;;;;;;;;;;OAYG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAcjE;IAED;;;;;;;;;;OAUG;IACG,KAAK,CACT,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,sBAAsB,CAAC,CAkCjC;IAED;;;;;;;;;;;OAWG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnE;IAED;;;;;;OAMG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3E;IAED;;;;;;;OAOG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAI5E;IAED;;;;;;;;OAQG;YACW,gBAAgB;IAM9B;;;;;;;;OAQG;IACH,OAAO,CAAC,yBAAyB;IAgBjC,uFAAuF;IACjF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqC/F;IAED,+EAA+E;IACzE,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAoEjC;IAED,sEAAsE;IAChE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3D;IAED;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA8B7E;IAED;;;;;;;;;;;;;;OAcG;YACW,kBAAkB;IAehC;;;;;;;;;;;;;;;OAeG;YACW,WAAW;CAQ1B"}

package/dist/modules/merge/RiskPolicyService.js

@@ -1,9 +1,9 @@
-import { assertFound, ConflictError, requireWorkspace, riskPolicyFromSeed, riskPolicySeedRows, seedRiskPolicies, ValidationError, } from '@cat-factory/kernel';
+import { assertFound, ConflictError, NotFoundError, requireWorkspace, riskPolicyFromSeed, riskPolicySeedRows, seedRiskPolicies, UnavailableError, ValidationError, } from '@cat-factory/kernel';
 /**
  * CRUD for a workspace's merge threshold presets (the library a task picks its auto-merge policy
  * from). Maintains the invariant that a workspace always has at least one preset, exactly one of
  * which is the default: the built-in catalog ({@link seedRiskPolicies}) is written when the board
- * is CREATED, `ensureSeeded` repairs a board that predates that, and the default cannot be
+ * is CREATED, {@link seedOwnTier} repairs a board that predates that, and the default cannot be
  * deleted. The single-default promotion is enforced in the repository. {@link reseed} restores a
  * built-in to the current catalog (adopting an update, repairing drift, or materialising a NEW
  * built-in that appeared after the workspace was created).
@@ -14,12 +14,16 @@ export class RiskPolicyService {
     idGenerator;
     clock;
     cache;
+    library;
+    suppressions;
     constructor(deps) {
         this.presets = deps.riskPolicyRepository;
         this.workspaceRepository = deps.workspaceRepository;
         this.idGenerator = deps.idGenerator;
         this.clock = deps.clock;
         this.cache = deps.riskPolicyCache;
+        this.library = deps.library;
+        this.suppressions = deps.riskPolicySuppressionRepository;
     }
     /**
      * Drop the workspace's cached preset library after a write commits. Coarse (one group == one
@@ -29,11 +33,164 @@ export class RiskPolicyService {
     async invalidate(workspaceId) {
         await this.cache?.invalidateGroup(workspaceId);
     }
-    /** List a workspace's presets, repairing an empty library first (see `ensureSeeded`). */
+    /**
+     * The board's visible library, repairing an empty own-tier on the way (see {@link seedOwnTier}):
+     * its own policies plus the account policies it inherits, each tagged with the tier that owns it.
+     *
+     * The MERGED view rather than the board's rows, because this list feeds the settings editor, the
+     * snapshot and therefore every picker — and the engine resolves a pin through the same merge. A
+     * read that showed only local rows would hide postures a task can legitimately be filed against.
+     *
+     * The seeding CHECK is read out of the merged list rather than made as its own query: an entry
+     * tagged `workspace` is a row the board owns, so its presence answers "has this tier been
+     * materialised" exactly. Asking separately made this — the board SNAPSHOT's read, the hottest in
+     * the app — pay a full own-tier list before the merge that lists the same rows again.
+     */
     async list(workspaceId) {
         await requireWorkspace(this.workspaceRepository, workspaceId);
-        await this.ensureSeeded(workspaceId);
-        return this.presets.list(workspaceId);
+        if (!this.library) {
+            const own = await this.presets.list(workspaceId);
+            if (own.length > 0)
+                return own.map(ownEntry);
+            await this.seedOwnTier(workspaceId);
+            return (await this.presets.list(workspaceId)).map(ownEntry);
+        }
+        const merged = await this.library.list(workspaceId);
+        if (merged.some((entry) => entry.tier === 'workspace'))
+            return merged;
+        // Only ever the two states creation cannot reach backwards into, so the re-read costs nothing
+        // on any board made since.
+        await this.seedOwnTier(workspaceId);
+        return this.library.list(workspaceId);
+    }
+    /**
+     * Copy an inherited ACCOUNT policy into this board's own tier, under a FRESH id.
+     *
+     * The fresh id is the whole design (see `cloneRiskPolicySchema`): an override sharing the account
+     * id would re-point every task already filed against the account's posture the moment the board
+     * edited its copy. The copy claims neither default — promoting it is a separate, deliberate act,
+     * and a clone that silently became the board's default would change how every unpinned task lands.
+     *
+     * Refuses an id the board already owns (`risk_policy_not_inherited`): that is a duplicate, not a
+     * clone, and the two need different copy.
+     */
+    async clone(workspaceId, presetId, input) {
+        await requireWorkspace(this.workspaceRepository, workspaceId);
+        // The whole own tier in ONE read, because both questions below are about it: whether this id is
+        // already the board's, and whether the board holds anything at all.
+        const existing = await this.presets.list(workspaceId);
+        if (existing.some((policy) => policy.id === presetId)) {
+            throw new ConflictError(`Risk policy '${presetId}' already belongs to this board, so there is nothing to clone in.`, 'risk_policy_not_inherited', { presetId });
+        }
+        const source = await this.requireInherited(workspaceId, presetId);
+        // The FIRST own policy must claim both defaults, exactly as in `create` and for the same reason:
+        // a scope with no default resolves `FALLBACK_RISK_POLICY`, which merges nothing. A board whose
+        // own tier was never materialised (the population {@link seedOwnTier} repairs) can reach this as
+        // its first own row, and hard-coding false there left it holding a library it could land nothing
+        // through, with no badge on screen and nothing explaining why.
+        const isFirstOwnPolicy = existing.length === 0;
+        const preset = {
+            ...source,
+            id: this.idGenerator.next('mp'),
+            name: input.name ?? source.name,
+            // A CLONE is a new policy, never a reseedable built-in: dropping the catalog version is what
+            // stops the copy of an account policy that happens to carry a built-in id being offered a
+            // reseed that would overwrite it with catalog values it never came from.
+            version: undefined,
+            isDefault: isFirstOwnPolicy,
+            isUnattendedDefault: isFirstOwnPolicy,
+            createdAt: this.clock.now(),
+        };
+        await this.presets.upsert(workspaceId, preset);
+        await this.invalidate(workspaceId);
+        return ownEntry(preset);
+    }
+    /**
+     * HIDE an inherited account policy from this board: it leaves the merged library, so no task here
+     * can pin it and no picker offers it.
+     *
+     * A task that ALREADY pinned it falls back to the board's default for its scope, which is exactly
+     * what a deleted local policy does (`resolveRiskPolicy` documents the dangling pin). The two acts
+     * are deliberately alike: hiding is the opt-out a board has for a row it cannot delete.
+     *
+     * Refuses an id the board owns (`risk_policy_not_inherited`) — delete that instead — and an id
+     * nothing inherits, which would otherwise write a suppression that shadows nothing today and
+     * silently swallows whatever the account defines under it tomorrow.
+     */
+    async suppress(workspaceId, presetId) {
+        await requireWorkspace(this.workspaceRepository, workspaceId);
+        const { suppressions, library } = this.requireSuppressionSupport();
+        const own = await this.presets.get(workspaceId, presetId);
+        if (own) {
+            throw new ConflictError(`Risk policy '${presetId}' belongs to this board, so hiding it would only be an obscure way to delete it.`, 'risk_policy_not_inherited', { presetId });
+        }
+        // What the ACCOUNT defines, not what this board currently inherits: hiding is idempotent, and
+        // asking the suppression-aware question would 404 the second click on the grounds that the first
+        // one worked.
+        if (!(await library.accountPolicy(workspaceId, presetId))) {
+            throw new NotFoundError('RiskPolicy', presetId);
+        }
+        await suppressions.add(workspaceId, presetId, this.clock.now());
+        await this.invalidate(workspaceId);
+    }
+    /**
+     * Stop hiding an inherited policy, so the board offers it again.
+     *
+     * Deliberately permissive about what it lifts: a suppression whose account policy has since been
+     * withdrawn hides nothing, and clearing it is still the right answer (it is listed, so it has to
+     * be dismissable). The refusal that matters is the one above, at the moment the row is written.
+     */
+    async restoreInherited(workspaceId, presetId) {
+        await requireWorkspace(this.workspaceRepository, workspaceId);
+        const { suppressions } = this.requireSuppressionSupport();
+        await suppressions.remove(workspaceId, presetId);
+        await this.invalidate(workspaceId);
+    }
+    /**
+     * What this board is hiding, and whether each suppression still shadows anything.
+     *
+     * Gated on the same store the WRITES are, so an unwired facade REFUSES here rather than answering
+     * an empty list: "this board hides nothing" and "this deployment cannot say what it hides" are
+     * different facts, and only the refusal states the second one (CLAUDE.md's absent-≠-zero rule).
+     * Answering `[]` positively claimed the first while the very next `suppress` returned a 503.
+     */
+    async listSuppressions(workspaceId) {
+        await requireWorkspace(this.workspaceRepository, workspaceId);
+        const { library } = this.requireSuppressionSupport();
+        return library.listSuppressions(workspaceId);
+    }
+    /**
+     * The account policy this board INHERITS under an id, or a 404.
+     *
+     * Suppression-aware (see `WorkspaceRiskPolicyLibrary.inheritedPolicy`), so the three states that
+     * are not "the board may clone this" collapse into one refusal: nothing defines the id, the
+     * account withdrew it, or this board hid it. Cloning is the only caller, and none of the three
+     * leaves it anything to copy — a board that opted out of a posture asking for a copy of it is a
+     * stale screen, not a request to honour.
+     */
+    async requireInherited(workspaceId, presetId) {
+        const inherited = await this.library?.inheritedPolicy(workspaceId, presetId);
+        if (!inherited)
+            throw new NotFoundError('RiskPolicy', presetId);
+        return inherited;
+    }
+    /**
+     * Everything hiding takes: the suppression store AND the merged library that names what it holds,
+     * or a 503 naming what is not wired.
+     *
+     * A total accessor rather than a silent no-op: reporting success for a hide that was never stored
+     * would leave the operator looking at a policy they had just been told was hidden. Both halves are
+     * checked together, and the reads gate on it as well as the writes, so no caller can end up
+     * answering from one of the two while the other is missing.
+     */
+    requireSuppressionSupport() {
+        if (!this.suppressions || !this.library) {
+            // Its OWN reason rather than the `risk_policies_unwired` the pin guard raises: the policies
+            // ARE configured here, and sending an operator to wire a library they can already see would
+            // be the misattribution that reason exists to avoid.
+            throw new UnavailableError('Hiding an inherited risk policy is not configured', 'risk_policy_suppressions_unwired');
+        }
+        return { suppressions: this.suppressions, library: this.library };
     }
     /** Create a new preset. The first one (or one flagged default) becomes the default. */
     async create(workspaceId, input) {
@@ -72,12 +229,14 @@ export class RiskPolicyService {
         };
         await this.presets.upsert(workspaceId, preset);
         await this.invalidate(workspaceId);
-        return preset;
+        return ownEntry(preset);
     }
     /** Patch a preset. Demoting the only default is rejected (one must remain). */
     async update(workspaceId, id, patch) {
         await requireWorkspace(this.workspaceRepository, workspaceId);
-        const existing = assertFound(await this.presets.get(workspaceId, id), 'RiskPolicy', id);
+        const own = await this.presets.get(workspaceId, id);
+        await this.assertNotInherited(workspaceId, id, own);
+        const existing = assertFound(own, 'RiskPolicy', id);
         if (existing.isDefault && patch.isDefault === false) {
             throw new ConflictError('Cannot unset the default preset; promote another preset instead.');
         }
@@ -138,12 +297,13 @@ export class RiskPolicyService {
         };
         await this.presets.upsert(workspaceId, updated);
         await this.invalidate(workspaceId);
-        return updated;
+        return ownEntry(updated);
     }
     /** Remove a preset. Neither scope's default preset can be removed. */
     async remove(workspaceId, id) {
         await requireWorkspace(this.workspaceRepository, workspaceId);
         const existing = await this.presets.get(workspaceId, id);
+        await this.assertNotInherited(workspaceId, id, existing);
         if (existing?.isDefault) {
             throw new ConflictError('Cannot delete the default preset; promote another preset first.');
         }
@@ -192,10 +352,33 @@ export class RiskPolicyService {
         };
         await this.presets.upsert(workspaceId, preset);
         await this.invalidate(workspaceId);
-        return preset;
+        return ownEntry(preset);
     }
     /**
-     * REPAIR a workspace whose preset library is empty, by writing the built-in catalog.
+     * Refuse a write aimed at a policy the ACCOUNT owns, naming the remedy (`risk_policy_inherited`).
+     *
+     * Checked BEFORE the board's own row is read, because the two failures need different copy and the
+     * bare 404 the read would produce is the misleading one: an inherited policy is visible in the
+     * board's editor and in every picker, so "no such policy" reads as a bug in the app rather than as
+     * "this one is not yours to change". The clone action is what leaves the board a row it can edit.
+     *
+     * Silent when no account tier is wired: there is nothing to inherit, so the caller's own 404 is
+     * then the honest answer.
+     *
+     * Takes the board's own row rather than re-reading it. The caller needs that row anyway (to patch,
+     * or to check the default flags before deleting), and the guard needs only to know whether it
+     * exists, so reading it here made every policy edit and delete pay two identical point queries.
+     */
+    async assertNotInherited(workspaceId, id, own) {
+        if (own)
+            return;
+        const inherited = await this.library?.inheritedPolicy(workspaceId, id);
+        if (!inherited)
+            return;
+        throw new ConflictError(`Risk policy '${id}' is defined by the account, so this board cannot change it. Clone it to edit a copy here.`, 'risk_policy_inherited', { presetId: id });
+    }
+    /**
+     * REPAIR a workspace whose own preset tier is empty, by writing the built-in catalog.
      *
      * Creating a board is what normally seeds the library ({@link WorkspaceService.create}), and
      * that is where the invariant belongs: the engine resolves a task's governing preset without
@@ -206,12 +389,11 @@ export class RiskPolicyService {
      * made before creation seeded presets, and one whose facade wired the preset repository only
      * later. Both currently resolve `FALLBACK_RISK_POLICY`, which auto-merges nothing, so the
      * repair can only move a workspace from refusing everything to its configured default.
-     * Idempotent, and a no-op on every board created since.
+     *
+     * The emptiness TEST belongs to the caller, which has just read the library and therefore already
+     * knows the answer; this only writes.
      */
-    async ensureSeeded(workspaceId) {
-        const current = await this.presets.list(workspaceId);
-        if (current.length > 0)
-            return;
+    async seedOwnTier(workspaceId) {
         for (const preset of riskPolicySeedRows(this.clock.now())) {
             await this.presets.upsert(workspaceId, preset);
         }
@@ -220,4 +402,15 @@ export class RiskPolicyService {
         await this.invalidate(workspaceId);
     }
 }
+/**
+ * A row this board OWNS → the library entry the wire carries.
+ *
+ * Every write on this service lands in the workspace tier by construction, so the tier is stated
+ * here rather than re-derived: a response that echoed a just-written policy without it would leave
+ * the SPA upserting an untagged row into a tier-tagged list, and the editor would render the board's
+ * own new policy with the inherited tier's read-only affordances until the next full reload.
+ */
+function ownEntry(preset) {
+    return { ...preset, tier: 'workspace' };
+}
 //# sourceMappingURL=RiskPolicyService.js.map

package/dist/modules/merge/RiskPolicyService.js.map

@@ -1 +1 @@
-{"version":3,"file":"RiskPolicyService.js","sourceRoot":"","sources":["../../../src/modules/merge/RiskPolicyService.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAChB,MAAM,qBAAqB,CAAA;AAe5B;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IACX,OAAO,CAAsB;IAC7B,mBAAmB,CAAqB;IACxC,WAAW,CAAa;IACxB,KAAK,CAAO;IACZ,KAAK,CAAyC;IAE/D,YAAY,IAAmC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAA;QACxC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACnD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,CAAA;IACnC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,UAAU,CAAC,WAAmB;QAC1C,MAAM,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,WAAW,CAAC,CAAA;IAChD,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAA;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,KAA4B;QAC5D,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACrD,MAAM,MAAM,GAAe;YACzB,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;YAChE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YACxC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,yFAAyF;YACzF,2FAA2F;YAC3F,2FAA2F;YAC3F,wFAAwF;YACxF,SAAS,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;YACzD,mBAAmB,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB;YAC7E,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC5B,CAAA;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU,EAAE,KAA4B;QACxE,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;QACvF,IAAI,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YACpD,MAAM,IAAI,aAAa,CAAC,kEAAkE,CAAC,CAAA;QAC7F,CAAC;QACD,6FAA6F;QAC7F,yFAAyF;QACzF,6FAA6F;QAC7F,IAAI,QAAQ,CAAC,mBAAmB,IAAI,KAAK,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YACxE,MAAM,IAAI,aAAa,CACrB,6EAA6E,CAC9E,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAe;YAC1B,GAAG,QAAQ;YACX,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,wBAAwB,KAAK,SAAS;gBAC9C,CAAC,CAAC,EAAE,wBAAwB,EAAE,KAAK,CAAC,wBAAwB,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,4BAA4B,KAAK,SAAS;gBAClD,CAAC,CAAC,EAAE,4BAA4B,EAAE,KAAK,CAAC,4BAA4B,EAAE;gBACtE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,0BAA0B,KAAK,SAAS;gBAChD,CAAC,CAAC,EAAE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B,EAAE;gBAClE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,yBAAyB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,yBAAyB,EAAE,KAAK,CAAC,yBAAyB,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,yFAAyF;YACzF,wFAAwF;YACxF,wFAAwF;YACxF,0FAA0F;YAC1F,mFAAmF;YACnF,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC/C,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,aAAa,CAAC,iEAAiE,CAAC,CAAA;QAC5F,CAAC;QACD,IAAI,QAAQ,EAAE,mBAAmB,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CACrB,4EAA4E,CAC7E,CAAA;QACH,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC1C,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAAE,oGAAoG,CACvH,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACxD,oFAAoF;QACpF,qFAAqF;QACrF,oFAAoF;QACpF,MAAM,SAAS,GAAG,QAAQ;YACxB,CAAC,CAAC,QAAQ,CAAC,SAAS;YACpB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,KAAK,IAAI,CAAA;QAC1F,2FAA2F;QAC3F,mFAAmF;QACnF,yFAAyF;QACzF,MAAM,mBAAmB,GAAG,QAAQ;YAClC,CAAC,CAAC,QAAQ,CAAC,mBAAmB;YAC9B,CAAC,CAAC,IAAI,CAAC,mBAAmB;gBACxB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,KAAK,IAAI,CAAA;QACvE,MAAM,MAAM,GAAe;YACzB,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACpE,SAAS;YACT,mBAAmB;SACpB,CAAA;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK,CAAC,YAAY,CAAC,WAAmB;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAM;QAC9B,KAAK,MAAM,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAChD,CAAC;QACD,iFAAiF;QACjF,0FAA0F;QAC1F,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,CAAC;CACF"}
+{"version":3,"file":"RiskPolicyService.js","sourceRoot":"","sources":["../../../src/modules/merge/RiskPolicyService.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,WAAW,EACX,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,qBAAqB,CAAA;AA2B5B;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IACX,OAAO,CAAsB;IAC7B,mBAAmB,CAAqB;IACxC,WAAW,CAAa;IACxB,KAAK,CAAO;IACZ,KAAK,CAAyC;IAC9C,OAAO,CAA6B;IACpC,YAAY,CAAkC;IAE/D,YAAY,IAAmC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAA;QACxC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACnD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,CAAA;QACjC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,+BAA+B,CAAA;IAC1D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,UAAU,CAAC,WAAmB;QAC1C,MAAM,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,WAAW,CAAC,CAAA;IAChD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YAChD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;YACnC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC;YAAE,OAAO,MAAM,CAAA;QACrE,8FAA8F;QAC9F,2BAA2B;QAC3B,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,CACT,WAAmB,EACnB,QAAgB,EAChB,KAA2B;QAE3B,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,gGAAgG;QAChG,oEAAoE;QACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,aAAa,CACrB,gBAAgB,QAAQ,mEAAmE,EAC3F,2BAA2B,EAC3B,EAAE,QAAQ,EAAE,CACb,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QACjE,iGAAiG;QACjG,+FAA+F;QAC/F,iGAAiG;QACjG,iGAAiG;QACjG,+DAA+D;QAC/D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAe;YACzB,GAAG,MAAM;YACT,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI;YAC/B,6FAA6F;YAC7F,0FAA0F;YAC1F,yEAAyE;YACzE,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,gBAAgB;YAC3B,mBAAmB,EAAE,gBAAgB;YACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC5B,CAAA;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,QAAgB;QAClD,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAA;QAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QACzD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAI,aAAa,CACrB,gBAAgB,QAAQ,kFAAkF,EAC1G,2BAA2B,EAC3B,EAAE,QAAQ,EAAE,CACb,CAAA;QACH,CAAC;QACD,8FAA8F;QAC9F,iGAAiG;QACjG,cAAc;QACd,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QACjD,CAAC;QACD,MAAM,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;QAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,QAAgB;QAC1D,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAA;QACzD,MAAM,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QAChD,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAA;QACpD,OAAO,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,QAAgB;QAClE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QAC5E,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAC/D,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;;;;OAQG;IACK,yBAAyB;QAI/B,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,4FAA4F;YAC5F,4FAA4F;YAC5F,qDAAqD;YACrD,MAAM,IAAI,gBAAgB,CACxB,mDAAmD,EACnD,kCAAkC,CACnC,CAAA;QACH,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IACnE,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,KAA4B;QAC5D,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACrD,MAAM,MAAM,GAAe;YACzB,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;YAChE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;YAC5D,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YACxC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,yFAAyF;YACzF,2FAA2F;YAC3F,2FAA2F;YAC3F,wFAAwF;YACxF,SAAS,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;YACzD,mBAAmB,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB;YAC7E,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC5B,CAAA;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzB,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,EAAU,EACV,KAA4B;QAE5B,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACnD,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;QACnD,IAAI,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YACpD,MAAM,IAAI,aAAa,CAAC,kEAAkE,CAAC,CAAA;QAC7F,CAAC;QACD,6FAA6F;QAC7F,yFAAyF;QACzF,6FAA6F;QAC7F,IAAI,QAAQ,CAAC,mBAAmB,IAAI,KAAK,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YACxE,MAAM,IAAI,aAAa,CACrB,6EAA6E,CAC9E,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAe;YAC1B,GAAG,QAAQ;YACX,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,wBAAwB,KAAK,SAAS;gBAC9C,CAAC,CAAC,EAAE,wBAAwB,EAAE,KAAK,CAAC,wBAAwB,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,4BAA4B,KAAK,SAAS;gBAClD,CAAC,CAAC,EAAE,4BAA4B,EAAE,KAAK,CAAC,4BAA4B,EAAE;gBACtE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,0BAA0B,KAAK,SAAS;gBAChD,CAAC,CAAC,EAAE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B,EAAE;gBAClE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,yBAAyB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,yBAAyB,EAAE,KAAK,CAAC,yBAAyB,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,yFAAyF;YACzF,wFAAwF;YACxF,wFAAwF;YACxF,0FAA0F;YAC1F,mFAAmF;YACnF,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC/C,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACxD,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;QACxD,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,aAAa,CAAC,iEAAiE,CAAC,CAAA;QAC5F,CAAC;QACD,IAAI,QAAQ,EAAE,mBAAmB,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CACrB,4EAA4E,CAC7E,CAAA;QACH,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC1C,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAC7D,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAAE,oGAAoG,CACvH,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACxD,oFAAoF;QACpF,qFAAqF;QACrF,oFAAoF;QACpF,MAAM,SAAS,GAAG,QAAQ;YACxB,CAAC,CAAC,QAAQ,CAAC,SAAS;YACpB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,KAAK,IAAI,CAAA;QAC1F,2FAA2F;QAC3F,mFAAmF;QACnF,yFAAyF;QACzF,MAAM,mBAAmB,GAAG,QAAQ;YAClC,CAAC,CAAC,QAAQ,CAAC,mBAAmB;YAC9B,CAAC,CAAC,IAAI,CAAC,mBAAmB;gBACxB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,KAAK,IAAI,CAAA;QACvE,MAAM,MAAM,GAAe;YACzB,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACpE,SAAS;YACT,mBAAmB;SACpB,CAAA;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,kBAAkB,CAC9B,WAAmB,EACnB,EAAU,EACV,GAAsB;QAEtB,IAAI,GAAG;YAAE,OAAM;QACf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACtE,IAAI,CAAC,SAAS;YAAE,OAAM;QACtB,MAAM,IAAI,aAAa,CACrB,gBAAgB,EAAE,4FAA4F,EAC9G,uBAAuB,EACvB,EAAE,QAAQ,EAAE,EAAE,EAAE,CACjB,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,WAAW,CAAC,WAAmB;QAC3C,KAAK,MAAM,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAChD,CAAC;QACD,iFAAiF;QACjF,0FAA0F;QAC1F,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,MAAkB;IAClC,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;AACzC,CAAC"}

package/dist/modules/merge/WorkspaceRiskPolicyLibrary.d.ts

@@ -0,0 +1,100 @@
+import type { AccountRiskPolicy, AccountRiskPolicyRepository, RiskPolicy, RiskPolicyLibraryEntry, RiskPolicyRepository, RiskPolicySuppression, RiskPolicySuppressionRepository, RunDefaultScope, WorkspaceRepository, WorkspaceRiskPolicyReader } from '@cat-factory/kernel';
+export interface WorkspaceRiskPolicyLibraryDeps {
+    /** The board's own policies: the built-in catalog copied in at creation, plus whatever it authored. */
+    riskPolicyRepository: RiskPolicyRepository;
+    /**
+     * The account tier. Optional, and its absence is a PASS-THROUGH rather than a hole to guard: with
+     * no account tier wired every read below answers exactly what the workspace repository answers,
+     * which is byte-for-byte the behaviour before ADR 0055.
+     */
+    accountRiskPolicyRepository?: AccountRiskPolicyRepository;
+    /**
+     * What the board hides from the account tier. Optional for the same reason, and absent it hides
+     * nothing — the direction that OFFERS a posture rather than silently withdrawing one, so a facade
+     * mid-migration can only ever show too much, never resolve a policy the editor called hidden.
+     */
+    riskPolicySuppressionRepository?: RiskPolicySuppressionRepository;
+    /** Resolves the board's account, which is what makes an inherited tier addressable. */
+    workspaceRepository: WorkspaceRepository;
+}
+/**
+ * A board's risk-policy library: its OWN policies merged with the account policies it inherits
+ * (ADR 0055), behind the same three reads every consumer already made of the workspace tier.
+ *
+ * It is the {@link WorkspaceRiskPolicyReader} the engine's `resolveRiskPolicy`, the board's two
+ * selection guards, the settings editor and the snapshot all hold, and that is the point: a
+ * resolution that admitted an id the editor calls hidden — or refused one a picker offered — would
+ * decide how much oversight a task's merge takes by a rule nobody can see. The PRECEDENCE itself
+ * lives in kernel (`mergeRiskPolicyTiers` / `resolveRiskPolicyTier`), so this class is only the I/O
+ * around it and the two cannot drift.
+ */
+/**
+ * Build the library from a container's dependency bag, or `undefined` when no board tier is wired.
+ *
+ * Every consumer composes it through THIS factory rather than reaching for the repositories itself:
+ * the board guards, the engine's wiring and the risk-policy module each need the same three-store
+ * composition, and the one that assembled it by hand would be the one that forgot the suppression
+ * store and quietly resolved a policy the editor calls hidden. Instances hold no state, so building
+ * one per consumer costs nothing.
+ */
+export declare function createWorkspaceRiskPolicyLibrary(deps: {
+    riskPolicyRepository?: RiskPolicyRepository;
+    accountRiskPolicyRepository?: AccountRiskPolicyRepository;
+    riskPolicySuppressionRepository?: RiskPolicySuppressionRepository;
+    workspaceRepository: WorkspaceRepository;
+}): WorkspaceRiskPolicyLibrary | undefined;
+export declare class WorkspaceRiskPolicyLibrary implements WorkspaceRiskPolicyReader {
+    private readonly deps;
+    constructor(deps: WorkspaceRiskPolicyLibraryDeps);
+    /** The merged library, account tier first, each entry tagged with the tier that owns it. */
+    list(workspaceId: string): Promise<RiskPolicyLibraryEntry[]>;
+    /**
+     * One policy by id, under the same precedence {@link list} applies.
+     *
+     * The board's own tier is read FIRST and answers alone when it hits, which is both the correct
+     * precedence and the common case: a task usually pins a policy its own board holds, and paying
+     * for the account reads only on a miss keeps the engine's per-gate resolution at one query where
+     * it already was.
+     */
+    get(workspaceId: string, id: string): Promise<RiskPolicyLibraryEntry | null>;
+    /**
+     * The board's default for one scope — the WORKSPACE tier's own answer, unchanged by inheritance.
+     *
+     * A delegate rather than a merge, and deliberately so: an account row carries no default claim
+     * (see `AccountRiskPolicy`), because which policy governs a task that pinned nothing is a
+     * per-board question that no single account row could answer correctly for every board under it.
+     * A board that wants an inherited posture as its default clones it and promotes the copy.
+     */
+    getDefault(workspaceId: string, scope: RunDefaultScope): Promise<RiskPolicy | null>;
+    /**
+     * What this board hides, joined against the account tier for identity — including the entries
+     * that now hide nothing because the account withdrew the policy (see
+     * `describeRiskPolicySuppressions`).
+     */
+    listSuppressions(workspaceId: string): Promise<RiskPolicySuppression[]>;
+    /**
+     * The account policy this board actually INHERITS under `id`, or null.
+     *
+     * Suppression-aware, under exactly the precedence {@link list} and {@link get} apply, because that
+     * is what makes this the merged reader rather than a second opinion: a hidden id is absent from the
+     * library, so a guard answering off the raw account row would let a board CLONE a posture it had
+     * just opted out of, and would tell an operator editing that id that the account governs their
+     * board when the board has withdrawn it.
+     */
+    inheritedPolicy(workspaceId: string, id: string): Promise<AccountRiskPolicy | null>;
+    /**
+     * What the ACCOUNT defines under `id`, whether or not this board hides it.
+     *
+     * Deliberately suppression-BLIND, and its own method rather than a flag on the one above, for the
+     * single caller that needs it: hiding is idempotent, so hiding an already-hidden policy has to
+     * settle as the state it already is. Asked through {@link inheritedPolicy} that request would 404
+     * on the second click, which is a refusal reporting a failure for a board that is in exactly the
+     * state the request asked for.
+     */
+    accountPolicy(workspaceId: string, id: string): Promise<AccountRiskPolicy | null>;
+    /** The account tier as the merge wants it: its policies plus this board's suppressions. */
+    private inheritedTier;
+    private suppressedIds;
+    private accountOf;
+}
+//# sourceMappingURL=WorkspaceRiskPolicyLibrary.d.ts.map

package/dist/modules/merge/WorkspaceRiskPolicyLibrary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceRiskPolicyLibrary.d.ts","sourceRoot":"","sources":["../../../src/modules/merge/WorkspaceRiskPolicyLibrary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,2BAA2B,EAC3B,UAAU,EACV,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,+BAA+B,EAC/B,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAA;AAO5B,MAAM,WAAW,8BAA8B;IAC7C,uGAAuG;IACvG,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,2BAA2B,CAAA;IACzD;;;;OAIG;IACH,+BAA+B,CAAC,EAAE,+BAA+B,CAAA;IACjE,uFAAuF;IACvF,mBAAmB,EAAE,mBAAmB,CAAA;CACzC;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C,2BAA2B,CAAC,EAAE,2BAA2B,CAAA;IACzD,+BAA+B,CAAC,EAAE,+BAA+B,CAAA;IACjE,mBAAmB,EAAE,mBAAmB,CAAA;CACzC,GAAG,0BAA0B,GAAG,SAAS,CAQzC;AAED,qBAAa,0BAA2B,YAAW,yBAAyB;IAC9D,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,8BAA8B,EAAI;IAErE,4FAA4F;IACtF,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAMjE;IAED;;;;;;;OAOG;IACG,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAejF;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAElF;IAED;;;;OAIG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAY5E;IAED;;;;;;;;OAQG;IACG,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAMxF;IAED;;;;;;;;OAQG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAItF;IAED,2FAA2F;YAC7E,aAAa;IAa3B,OAAO,CAAC,aAAa;YAIP,SAAS;CASxB"}