@caupulican/pi-adaptative 0.81.39 → 0.81.41

package/dist/core/orchestration/event-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-store.js","sourceRoot":"","sources":["../../../src/core/orchestration/event-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAEN,oBAAoB,EACpB,4BAA4B,GAE5B,MAAM,gBAAgB,CAAC;AAExB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAC9C,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AACjD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,8BAA8B,GAAG,GAAG,CAAC;AA4D3C,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACtD,YAAY,OAAe,EAAE;QAC5B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAAA,CAC3C;CACD;AAED,MAAM,OAAO,6BAA8B,SAAQ,4BAA4B;IAC9E,YAAY,QAAgB,EAAE,MAAc,EAAE;QAC7C,KAAK,CAAC,gDAAgD,QAAQ,YAAY,MAAM,GAAG,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAAA,CAC5C;CACD;AAED,MAAM,OAAO,kCAAmC,SAAQ,4BAA4B;IAC1E,cAAc,CAAS;IAEhC,YAAY,cAAsB,EAAE;QACnC,KAAK,CAAC,qDAAqD,cAAc,eAAe,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IAAA,CACrC;CACD;AAED,SAAS,wBAAwB,CAAC,SAAiB,EAAU;IAC5D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IAC9F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AAAA,CAC/B;AAED,SAAS,WAAW,CAAC,QAAgB,EAA2B;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACrF,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACzG,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACjH,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO;YACN,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,SAAS,SAAS,CAAC,KAAc,EAAU;IAC1C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;AAAA,CAChD;AAED,SAAS,aAAa,CAAC,OAAe,EAAU;IAC/C,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC;AAAA,CACnD;AAED,SAAS,cAAc,CAAC,OAAkC,EAAU;IACnE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CAC1E;AAED,SAAS,mBAAmB,CAAC,KAAyB,EAAE,QAAgB,EAAE,KAAa,EAAU;IAChG,MAAM,QAAQ,GAAG,KAAK,IAAI,QAAQ,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IAC1B,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,YAAY,CAAS;IACrB,YAAY,CAAS;IACb,GAAG,CAAe;IAClB,aAAa,CAAe;IAC5B,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,oBAAoB,CAAS;IAC7B,SAAS,GAAG,IAAI,GAAG,EAAuC,CAAC;IACpE,wBAAwB,CAAuC;IAEvE,YAAY,OAAuC,EAAE;QACpD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,EAAE,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,UAAU,CAAC;QACzD,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,aAAa,EAAE,uBAAuB,EAAE,eAAe,CAAC,CAAC;QAC1G,IAAI,CAAC,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,sBAAsB,EAAE,cAAc,CAAC,CAAC;QACtG,IAAI,CAAC,oBAAoB,GAAG,mBAAmB,CAC9C,OAAO,CAAC,oBAAoB,EAC5B,8BAA8B,EAC9B,sBAAsB,CACtB,CAAC;IAAA,CACF;IAED,MAAM,CAAC,KAAoC,EAAE,OAAO,GAAqC,EAAE,EAAsB;QAChH,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAqD,EAAE,CAAC;YAC3G,MAAM,MAAM,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;YAClC,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBACxE,IAAI,QAAQ;oBAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAC3D,CAAC;YACD,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;gBAC/C,IAAI,MAAM,KAAK,OAAO,CAAC,mBAAmB,EAAE,CAAC;oBAC5C,MAAM,IAAI,6BAA6B,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;gBAC9E,CAAC;YACF,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAuB;gBAChC,aAAa,EAAE,4BAA4B;gBAC3C,OAAO;gBACP,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE;gBAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;gBACtB,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;aACvC,CAAC;YACF,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YACxC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YACnF,IAAI,KAAK,CAAC,cAAc;gBAAE,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAC7F,mBAAmB,CAClB,IAAI,CAAC,UAAU,EACf,SAAS,CAAC;gBACT,OAAO,EAAE,CAAC;gBACV,WAAW,EAAE,OAAO;gBACpB,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;aAC1C,CAAC,CACxB,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAAA,CACvC,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS;gBAAE,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAAA,CACxC;IAED,OAAO,GAAyB;QAC/B,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAAA,CAC9B;IAED,SAAS,CAAC,OAAe,EAAwB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7C,IAAI,QAAQ,IAAI,OAAO,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;YACnD,MAAM,IAAI,kCAAkC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAyB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5C,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,eAAe,GAAG,OAAO,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,WAAW,IAAI,OAAO;gBAAE,SAAS;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW,IAAI,KAAK,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC;gBACvE,MAAM,IAAI,4BAA4B,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,MAAM,CAAC;IAAA,CACd;IAED,sBAAsB,GAAmE;QACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACvD,OAAO,QAAQ;YACd,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;YAC/F,CAAC,CAAC,SAAS,CAAC;IAAA,CACb;IAED,iGAAiG;IACjG,eAAe,CAAC,cAAsB,EAAE,UAA4B,EAAW;QAC9E,MAAM,kBAAkB,GAAG,IAAI,CAAC,oBAAoB,EAAE,EAAE,cAAc,IAAI,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,IACC,gBAAgB,EAAE,WAAW,KAAK,cAAc;YAChD,gBAAgB,CAAC,SAAS,KAAK,SAAS;YACxC,cAAc,GAAG,kBAAkB,GAAG,IAAI,CAAC,aAAa;YACxD,gBAAgB,CAAC,SAAS,GAAG,IAAI,CAAC,YAAY,EAC7C,CAAC;YACF,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,WAAW,KAAK,cAAc;gBAAE,OAAO,KAAK,CAAC;YACxD,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,EAAE,EAAE,cAAc,IAAI,CAAC,CAAC;YACzE,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC,MAAM,CACrD,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,eAAe,CAC3E,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAEhG,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;YAC5D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,8BAA8B,EAAE,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;gBACpF,IAAI,KAAK,CAAC,cAAc;oBAAE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YAC1E,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBAC/C,IAAI,KAAK,CAAC,OAAO,IAAI,cAAc,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;oBAC7D,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;gBAChD,CAAC;YACF,CAAC;YACD,MAAM,iBAAiB,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;iBACnD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;iBACnD,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;iBACjC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,MAAM,OAAO,GAA8B;gBAC1C,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,4BAA4B;gBAC3C,cAAc;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC;gBACzC,iBAAiB;aACjB,CAAC;YACF,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,YAAY,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;YACnD,mBAAmB,CAClB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EACrC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAA+B,CAAC,CAC9D,CAAC;YACF,mBAAmB,CAClB,IAAI,CAAC,YAAY,EACjB,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAA6B,CAAC,CAC1F,CAAC;YAEF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,4BAA4B,EAAE,EAAE,CAAC;gBACxD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;gBAClD,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChE,IAAI,OAAO,IAAI,cAAc;oBAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACnF,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,yBAAyB,EAAE,EAAE,CAAC;gBACrD,IAAI,IAAI,KAAK,YAAY;oBAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YAClF,CAAC;YACD,mBAAmB,CAClB,IAAI,CAAC,UAAU,EACf,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,EAAwB,CAAC,CAC1F,CAAC;YACF,OAAO,IAAI,CAAC;QAAA,CACZ,CAAC,CAAC;IAAA,CACH;IAED,SAAS,CAAC,QAA6C,EAAc;QACpE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAA,CAC7C;IAEO,eAAe,GAAyB;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAyB,EAAE,CAAC;QACxC,MAAM,eAAe,GAAG,IAAI,CAAC,8BAA8B,EAAE,EAAE,cAAc,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACxD,IAAI,eAAe,GAAG,eAAe,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,WAAW,IAAI,eAAe;gBAAE,SAAS;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,IAAI,MAAM,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC;gBACzE,MAAM,IAAI,4BAA4B,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,MAAM,CAAC;IAAA,CACd;IAEO,sBAAsB,GAAa;QAC1C,IAAI,CAAC;YACJ,OAAO,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;iBAChC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBACzD,IAAI,EAAE,CAAC;QACV,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAClE,MAAM,KAAK,CAAC;QACb,CAAC;IAAA,CACD;IAEO,4BAA4B,GAAa;QAChD,IAAI,CAAC;YACJ,OAAO,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;QACX,CAAC;IAAA,CACD;IAEO,yBAAyB,GAAa;QAC7C,IAAI,CAAC;YACJ,OAAO,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;iBACnC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBAC5D,IAAI,EAAE,CAAC;QACV,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;QACX,CAAC;IAAA,CACD;IAED,kFAAkF;IAC1E,oCAAoC,CAAC,KAAwB,EAAE,eAAuB,EAAQ;QACrG,IAAI,eAAe,GAAG,eAAe,GAAG,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,qGAAqG;YACrG,IAAI,OAAO,IAAI,eAAe;gBAAE,SAAS;YACzC,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;gBACjC,MAAM,IAAI,4BAA4B,CACrC,uCAAuC,eAAe,WAAW,IAAI,GAAG,CACxE,CAAC;YACH,CAAC;YACD,eAAe,EAAE,CAAC;QACnB,CAAC;IAAA,CACD;IAED,oGAAoG;IAC5F,0BAA0B,CAAC,KAAwB,EAAE,eAAuB,EAAQ;QAC3F,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAClE,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5G,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,uBAAuB,EAAE,CAAC;YAC5D,MAAM,IAAI,4BAA4B,CACrC,wBAAwB,MAAM,CAAC,WAAW,yCAAyC,uBAAuB,GAAG,CAC7G,CAAC;QACH,CAAC;IAAA,CACD;IAEO,oBAAoB,GAAiC;QAC5D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QACrD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,4BAA4B,CACrC,oDAAoD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5G,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,4BAA4B,CAAC,0CAA0C,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAiC,CAAC;QACnD,IACC,QAAQ,CAAC,OAAO,KAAK,CAAC;YACtB,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC;YACnC,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAC5B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACzC,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAClD,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EACtG,CAAC;YACF,MAAM,IAAI,4BAA4B,CAAC,0CAA0C,CAAC,CAAC;QACpF,CAAC;QACD,OAAO;YACN,OAAO,EAAE,CAAC;YACV,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC/C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,YAAY,EAAE,QAAQ,CAAC,YAAY;SACnC,CAAC;IAAA,CACF;IAEO,8BAA8B,GAAmC;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,4BAA4B,CACrC,sDAAsD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9G,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,4BAA4B,CAAC,4CAA4C,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAiC,CAAC;QACnD,IACC,QAAQ,CAAC,OAAO,KAAK,CAAC;YACtB,QAAQ,CAAC,aAAa,KAAK,4BAA4B;YACvD,QAAQ,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;YACnD,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ;YACtC,CAAC,QAAQ,CAAC,UAAU;YACpB,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;YACvC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;YAClC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAC1C,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,CAAC;YACvD,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAChC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,CACzF;YACD,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;gBAC5E,QAAQ,CAAC,iBAAiB,CAAC,MAAM;YAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAClC,CAAC;YACF,MAAM,IAAI,4BAA4B,CAAC,4CAA4C,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAA8B;YAC1C,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,4BAA4B;YAC3C,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAe;YAC9D,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;SACpF,CAAC;QACF,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,4BAA4B,CAAC,oDAAoD,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAAA,CAC/C;IAED;;;;OAIG;IACK,oCAAoC,GAAiC;QAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,IAAI,CAAC,wBAAwB,GAAG,SAAS,CAAC;YAC1C,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC;QAC7C,IACC,MAAM;YACN,MAAM,CAAC,QAAQ,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;YAC1D,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAC1C,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;YACtD,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;YACxC,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;YAC9C,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,EAC7C,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACtC,MAAM,iBAAiB,GAAG,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACvE,IACC,iBAAiB,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;YACzC,iBAAiB,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO;YAC/C,iBAAiB,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,EAC9C,CAAC;YACF,MAAM,IAAI,4BAA4B,CAAC,iEAAiE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,CAAC,wBAAwB,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACxD,OAAO,QAAQ,CAAC;IAAA,CAChB;IAEO,6BAA6B,CAAC,QAA0B,EAAyB;QACxF,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAClB,MAAM,IAAI,4BAA4B,CAAC,kDAAkD,CAAC,CAAC;YAC5F,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,4BAA4B;gBAAE,MAAM,KAAK,CAAC;YAC/D,MAAM,IAAI,4BAA4B,CACrC,sDAAsD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9G,CAAC;QACH,CAAC;IAAA,CACD;IAEO,iBAAiB,CAAC,QAAgB,EAAQ;QACjD,IAAI,CAAC;YACJ,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACrE,CAAC;IAAA,CACD;IAEO,qBAAqB,CAAC,IAAY,EAAsB;QAC/D,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,4BAA4B,CACrC,uCAAuC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,4BAA4B,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,MAAM,CAAC;IAAA,CACd;IAEO,eAAe,CAAC,GAAW,EAAU;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAA,CAC3F;IAEO,8BAA8B,CAAC,GAAW,EAAE,OAAe,EAAQ;QAC1E,mBAAmB,CAClB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EACzB,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAA8B,CAAC,CACnE,CAAC;IAAA,CACF;IAEO,2BAA2B,CAAC,GAAW,EAAkC;QAChF,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,8BAA8B,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,GAAG,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,4BAA4B,CACrC,qDAAqD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7G,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,4BAA4B,CAAC,2CAA2C,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,IACC,MAAM,CAAC,OAAO,KAAK,CAAC;YACpB,MAAM,CAAC,GAAG,KAAK,GAAG;YAClB,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EACzB,CAAC;YACF,MAAM,IAAI,4BAA4B,CAAC,2CAA2C,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,8BAA8B,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAC7E,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CACpE,CAAC;YACF,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAC/B,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,cAAc,KAAK,GAAG,EAAE,CAAC;YAC/D,MAAM,IAAI,4BAA4B,CAAC,4DAA4D,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,KAAK,CAAC;IAAA,CACb;IAED;;;OAGG;IACK,0BAA0B,GAAwB;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,oCAAoC,EAAE,EAAE,cAAc,IAAI,CAAC,CAAC;QACzF,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACxD,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5G,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,IACC,MAAM,EAAE,WAAW,KAAK,OAAO;YAC/B,MAAM,CAAC,SAAS,KAAK,SAAS;YAC9B,CAAC,OAAO,GAAG,eAAe,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,EACpD,CAAC;YACF,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,OAAO,EAAE,CAAC;YAC5C,MAAM,IAAI,4BAA4B,CACrC,wBAAwB,MAAM,CAAC,WAAW,yCAAyC,OAAO,GAAG,CAC7F,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAC3B,eAAe,GAAG,CAAC,EACnB,MAAM,IAAI,MAAM,CAAC,WAAW,IAAI,eAAe,IAAI,MAAM,CAAC,WAAW,IAAI,OAAO;YAC/E,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC;YACxB,CAAC,CAAC,eAAe,GAAG,CAAC,CACtB,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,IAAI,OAAO,GAAG,WAAW,IAAI,OAAO,IAAI,eAAe;gBAAE,SAAS;YAClE,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,4BAA4B,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,KAAK,CAAC,cAAc;gBAAE,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,IAAI,OAAO,IAAI,eAAe;gBAAE,OAAO,KAAK,CAAC;YAC7C,IAAI,CAAC;gBACJ,OAAO,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,KAAK,CAAC;YACd,CAAC;QAAA,CACD,EAAE,CAAC,CAAC,CAAC;QACN,mBAAmB,CAClB,IAAI,CAAC,UAAU,EACf,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAwB,CAAC,CAChF,CAAC;QACF,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAAA,CAC3C;CACD","sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { existsSync, readdirSync, readFileSync, statSync, unlinkSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { stateFile } from \"../agent-paths.ts\";\nimport type { JsonObject } from \"../autonomy/contracts.ts\";\nimport { withFileLockSync, writeFileAtomicSync } from \"../util/atomic-file.ts\";\nimport {\n\ttype AppendOrchestrationEventInput,\n\tisOrchestrationEvent,\n\tORCHESTRATION_SCHEMA_VERSION,\n\ttype OrchestrationEvent,\n} from \"./contracts.ts\";\n\nconst EVENT_FILE_PATTERN = /^(\\d{16})\\.json$/;\nconst SNAPSHOT_FILE_PATTERN = /^(\\d{16})\\.json$/;\nconst DEFAULT_MAX_TAIL_EVENTS = 256;\nconst DEFAULT_MAX_TAIL_BYTES = 4 * 1024 * 1024;\nconst DEFAULT_MAX_IDEMPOTENCY_EVENTS = 512;\n\ninterface EventCursor {\n\tversion: 1;\n\tlastOrdinal: number;\n\ttailBytes?: number;\n}\n\ninterface SynchronizedIndexes {\n\tlastOrdinal: number;\n\ttailBytes: number;\n}\n\ninterface IdempotencyMarker {\n\tversion: 1;\n\tkey: string;\n\tordinal: number;\n}\n\ninterface ProjectionSnapshotContent {\n\tversion: 1;\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tthroughOrdinal: number;\n\tcreatedAt: string;\n\tprojection: JsonObject;\n\tidempotencyEvents: OrchestrationEvent[];\n}\n\ninterface ProjectionSnapshot extends ProjectionSnapshotContent {\n\tdigest: string;\n}\n\ninterface SnapshotBaseline {\n\tversion: 1;\n\tthroughOrdinal: number;\n\tdigest: string;\n\tsnapshotFile: string;\n}\n\ninterface SnapshotFileSignature {\n\tsize: number;\n\tmtimeMs: number;\n\tctimeMs: number;\n}\n\ninterface VerifiedSnapshotBaseline {\n\tbaseline: SnapshotBaseline;\n\tsignature: SnapshotFileSignature;\n}\n\nexport interface OrchestrationEventStoreOptions {\n\tagentDir: string;\n\tsessionId: string;\n\tnow?: () => string;\n\tcreateEventId?: () => string;\n\tmaxTailEvents?: number;\n\tmaxTailBytes?: number;\n\tmaxIdempotencyEvents?: number;\n}\n\nexport class OrchestrationEventStoreError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"OrchestrationEventStoreError\";\n\t}\n}\n\nexport class OrchestrationConcurrencyError extends OrchestrationEventStoreError {\n\tconstructor(expected: number, actual: number) {\n\t\tsuper(`Orchestration event cursor changed: expected ${expected}, actual ${actual}.`);\n\t\tthis.name = \"OrchestrationConcurrencyError\";\n\t}\n}\n\nexport class OrchestrationSnapshotRequiredError extends OrchestrationEventStoreError {\n\treadonly throughOrdinal: number;\n\n\tconstructor(throughOrdinal: number) {\n\t\tsuper(`Orchestration projection snapshot through ordinal ${throughOrdinal} is required.`);\n\t\tthis.name = \"OrchestrationSnapshotRequiredError\";\n\t\tthis.throughOrdinal = throughOrdinal;\n\t}\n}\n\nfunction safeSessionDirectoryName(sessionId: string): string {\n\tconst readable = encodeURIComponent(sessionId).replaceAll(\"%\", \"_\").slice(0, 80) || \"session\";\n\tconst digest = createHash(\"sha256\").update(sessionId).digest(\"hex\").slice(0, 16);\n\treturn `${readable}-${digest}`;\n}\n\nfunction parseCursor(filePath: string): EventCursor | undefined {\n\tif (!existsSync(filePath)) return undefined;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(readFileSync(filePath, \"utf-8\"));\n\t\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return undefined;\n\t\tconst record = parsed as Record<string, unknown>;\n\t\tif (record.version !== 1 || !Number.isSafeInteger(record.lastOrdinal) || Number(record.lastOrdinal) < 0) {\n\t\t\treturn undefined;\n\t\t}\n\t\tif (record.tailBytes !== undefined && (!Number.isSafeInteger(record.tailBytes) || Number(record.tailBytes) < 0)) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn {\n\t\t\tversion: 1,\n\t\t\tlastOrdinal: Number(record.lastOrdinal),\n\t\t\t...(record.tailBytes !== undefined ? { tailBytes: Number(record.tailBytes) } : {}),\n\t\t};\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction serialize(value: unknown): string {\n\treturn `${JSON.stringify(value, null, \"\\t\")}\\n`;\n}\n\nfunction eventFileName(ordinal: number): string {\n\treturn `${String(ordinal).padStart(16, \"0\")}.json`;\n}\n\nfunction snapshotDigest(content: ProjectionSnapshotContent): string {\n\treturn createHash(\"sha256\").update(JSON.stringify(content)).digest(\"hex\");\n}\n\nfunction positiveSafeInteger(value: number | undefined, fallback: number, label: string): number {\n\tconst resolved = value ?? fallback;\n\tif (!Number.isSafeInteger(resolved) || resolved < 1) {\n\t\tthrow new OrchestrationEventStoreError(`${label} must be a positive safe integer.`);\n\t}\n\treturn resolved;\n}\n\n/**\n * Append-only event tail with a replaceable full-state projection snapshot. Atomic rename prevents\n * torn records. Snapshot publication is two-phase (payload, then small baseline pointer), after which\n * covered event/idempotency files are pruned. A crash at any point leaves either the old replay prefix\n * or the new verified snapshot authoritative; ordinals never reset.\n */\nexport class OrchestrationEventStore {\n\treadonly rootDir: string;\n\treadonly eventsDir: string;\n\treadonly idempotencyDir: string;\n\treadonly cursorPath: string;\n\treadonly snapshotsDir: string;\n\treadonly baselinePath: string;\n\tprivate readonly now: () => string;\n\tprivate readonly createEventId: () => string;\n\tprivate readonly maxTailEvents: number;\n\tprivate readonly maxTailBytes: number;\n\tprivate readonly maxIdempotencyEvents: number;\n\tprivate readonly listeners = new Set<(event: OrchestrationEvent) => void>();\n\tprivate verifiedSnapshotBaseline: VerifiedSnapshotBaseline | undefined;\n\n\tconstructor(options: OrchestrationEventStoreOptions) {\n\t\tthis.rootDir = stateFile(options.agentDir, \"orchestration\", safeSessionDirectoryName(options.sessionId));\n\t\tthis.eventsDir = join(this.rootDir, \"events\");\n\t\tthis.idempotencyDir = join(this.rootDir, \"idempotency\");\n\t\tthis.cursorPath = join(this.rootDir, \"cursor.json\");\n\t\tthis.snapshotsDir = join(this.rootDir, \"snapshots\");\n\t\tthis.baselinePath = join(this.rootDir, \"projection-baseline.json\");\n\t\tthis.now = options.now ?? (() => new Date().toISOString());\n\t\tthis.createEventId = options.createEventId ?? randomUUID;\n\t\tthis.maxTailEvents = positiveSafeInteger(options.maxTailEvents, DEFAULT_MAX_TAIL_EVENTS, \"maxTailEvents\");\n\t\tthis.maxTailBytes = positiveSafeInteger(options.maxTailBytes, DEFAULT_MAX_TAIL_BYTES, \"maxTailBytes\");\n\t\tthis.maxIdempotencyEvents = positiveSafeInteger(\n\t\t\toptions.maxIdempotencyEvents,\n\t\t\tDEFAULT_MAX_IDEMPOTENCY_EVENTS,\n\t\t\t\"maxIdempotencyEvents\",\n\t\t);\n\t}\n\n\tappend(input: AppendOrchestrationEventInput, options: { expectedLastOrdinal?: number } = {}): OrchestrationEvent {\n\t\tconst committed = withFileLockSync(this.cursorPath, (): { event: OrchestrationEvent; appended: boolean } => {\n\t\t\tconst cursor = this.synchronizeIndexesUnlocked();\n\t\t\tconst actual = cursor.lastOrdinal;\n\t\t\tif (input.idempotencyKey) {\n\t\t\t\tconst existing = this.readIdempotentEventUnlocked(input.idempotencyKey);\n\t\t\t\tif (existing) return { event: existing, appended: false };\n\t\t\t}\n\t\t\tif (options.expectedLastOrdinal !== undefined) {\n\t\t\t\tif (actual !== options.expectedLastOrdinal) {\n\t\t\t\t\tthrow new OrchestrationConcurrencyError(options.expectedLastOrdinal, actual);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst ordinal = actual + 1;\n\t\t\tconst next: OrchestrationEvent = {\n\t\t\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\t\t\tordinal,\n\t\t\t\teventId: this.createEventId(),\n\t\t\t\ttype: input.type,\n\t\t\t\taggregateId: input.aggregateId,\n\t\t\t\tactor: input.actor,\n\t\t\t\toccurredAt: this.now(),\n\t\t\t\t...(input.correlationId ? { correlationId: input.correlationId } : {}),\n\t\t\t\t...(input.causationId ? { causationId: input.causationId } : {}),\n\t\t\t\t...(input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {}),\n\t\t\t\tpayload: structuredClone(input.payload),\n\t\t\t};\n\t\t\tconst serializedEvent = serialize(next);\n\t\t\twriteFileAtomicSync(join(this.eventsDir, eventFileName(ordinal)), serializedEvent);\n\t\t\tif (input.idempotencyKey) this.writeIdempotencyMarkerUnlocked(input.idempotencyKey, ordinal);\n\t\t\twriteFileAtomicSync(\n\t\t\t\tthis.cursorPath,\n\t\t\t\tserialize({\n\t\t\t\t\tversion: 1,\n\t\t\t\t\tlastOrdinal: ordinal,\n\t\t\t\t\ttailBytes: cursor.tailBytes + Buffer.byteLength(serializedEvent),\n\t\t\t\t} satisfies EventCursor),\n\t\t\t);\n\t\t\treturn { event: next, appended: true };\n\t\t});\n\n\t\tif (committed.appended) {\n\t\t\tfor (const listener of this.listeners) listener(structuredClone(committed.event));\n\t\t}\n\t\treturn structuredClone(committed.event);\n\t}\n\n\treadAll(): OrchestrationEvent[] {\n\t\treturn this.readAllUnlocked();\n\t}\n\n\treadAfter(ordinal: number): OrchestrationEvent[] {\n\t\tconst baseline = this.readBaselineUnlocked();\n\t\tif (baseline && ordinal < baseline.throughOrdinal) {\n\t\t\tthrow new OrchestrationSnapshotRequiredError(baseline.throughOrdinal);\n\t\t}\n\t\tconst events: OrchestrationEvent[] = [];\n\t\tconst names = this.eventFileNamesUnlocked();\n\t\tthis.assertReadableTailUnlocked(names, baseline?.throughOrdinal ?? 0);\n\t\tlet previousOrdinal = ordinal;\n\t\tfor (const name of names) {\n\t\t\tconst match = EVENT_FILE_PATTERN.exec(name);\n\t\t\tif (!match) continue;\n\t\t\tconst fileOrdinal = Number(match[1]);\n\t\t\tif (fileOrdinal <= ordinal) continue;\n\t\t\tconst event = this.readEventFileUnlocked(name);\n\t\t\tif (event.ordinal !== fileOrdinal || event.ordinal <= previousOrdinal) {\n\t\t\t\tthrow new OrchestrationEventStoreError(`Non-monotonic orchestration event ordinal in ${name}`);\n\t\t\t}\n\t\t\tpreviousOrdinal = event.ordinal;\n\t\t\tevents.push(structuredClone(event));\n\t\t}\n\t\treturn events;\n\t}\n\n\treadProjectionSnapshot(): { throughOrdinal: number; projection: JsonObject } | undefined {\n\t\tconst snapshot = this.readProjectionSnapshotUnlocked();\n\t\treturn snapshot\n\t\t\t? { throughOrdinal: snapshot.throughOrdinal, projection: structuredClone(snapshot.projection) }\n\t\t\t: undefined;\n\t}\n\n\t/** Replace a large replay prefix with one verified current-state snapshot and a bounded tail. */\n\tcompactIfNeeded(throughOrdinal: number, projection: () => JsonObject): boolean {\n\t\tconst baselineBeforeLock = this.readBaselineUnlocked()?.throughOrdinal ?? 0;\n\t\tconst cursorBeforeLock = parseCursor(this.cursorPath);\n\t\tif (\n\t\t\tcursorBeforeLock?.lastOrdinal === throughOrdinal &&\n\t\t\tcursorBeforeLock.tailBytes !== undefined &&\n\t\t\tthroughOrdinal - baselineBeforeLock < this.maxTailEvents &&\n\t\t\tcursorBeforeLock.tailBytes < this.maxTailBytes\n\t\t) {\n\t\t\treturn false;\n\t\t}\n\t\treturn withFileLockSync(this.cursorPath, () => {\n\t\t\tconst cursor = this.synchronizeIndexesUnlocked();\n\t\t\tif (cursor.lastOrdinal !== throughOrdinal) return false;\n\t\t\tconst baselineOrdinal = this.readBaselineUnlocked()?.throughOrdinal ?? 0;\n\t\t\tconst tailNames = this.eventFileNamesUnlocked().filter(\n\t\t\t\t(name) => Number(EVENT_FILE_PATTERN.exec(name)?.[1] ?? 0) > baselineOrdinal,\n\t\t\t);\n\t\t\tif (tailNames.length < this.maxTailEvents && cursor.tailBytes < this.maxTailBytes) return false;\n\n\t\t\tconst retainedByKey = new Map<string, OrchestrationEvent>();\n\t\t\tfor (const event of this.readProjectionSnapshotUnlocked()?.idempotencyEvents ?? []) {\n\t\t\t\tif (event.idempotencyKey) retainedByKey.set(event.idempotencyKey, event);\n\t\t\t}\n\t\t\tfor (const name of tailNames) {\n\t\t\t\tconst event = this.readEventFileUnlocked(name);\n\t\t\t\tif (event.ordinal <= throughOrdinal && event.idempotencyKey) {\n\t\t\t\t\tretainedByKey.set(event.idempotencyKey, event);\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst idempotencyEvents = [...retainedByKey.values()]\n\t\t\t\t.sort((left, right) => left.ordinal - right.ordinal)\n\t\t\t\t.slice(-this.maxIdempotencyEvents)\n\t\t\t\t.map((event) => structuredClone(event));\n\t\t\tconst content: ProjectionSnapshotContent = {\n\t\t\t\tversion: 1,\n\t\t\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\t\t\tthroughOrdinal,\n\t\t\t\tcreatedAt: this.now(),\n\t\t\t\tprojection: structuredClone(projection()),\n\t\t\t\tidempotencyEvents,\n\t\t\t};\n\t\t\tconst digest = snapshotDigest(content);\n\t\t\tconst snapshotFile = eventFileName(throughOrdinal);\n\t\t\twriteFileAtomicSync(\n\t\t\t\tjoin(this.snapshotsDir, snapshotFile),\n\t\t\t\tserialize({ ...content, digest } satisfies ProjectionSnapshot),\n\t\t\t);\n\t\t\twriteFileAtomicSync(\n\t\t\t\tthis.baselinePath,\n\t\t\t\tserialize({ version: 1, throughOrdinal, digest, snapshotFile } satisfies SnapshotBaseline),\n\t\t\t);\n\n\t\t\tfor (const name of this.idempotencyFileNamesUnlocked()) {\n\t\t\t\tthis.unlinkManagedFile(join(this.idempotencyDir, name));\n\t\t\t}\n\t\t\tfor (const name of this.eventFileNamesUnlocked()) {\n\t\t\t\tconst ordinal = Number(EVENT_FILE_PATTERN.exec(name)?.[1] ?? 0);\n\t\t\t\tif (ordinal <= throughOrdinal) this.unlinkManagedFile(join(this.eventsDir, name));\n\t\t\t}\n\t\t\tfor (const name of this.snapshotFileNamesUnlocked()) {\n\t\t\t\tif (name !== snapshotFile) this.unlinkManagedFile(join(this.snapshotsDir, name));\n\t\t\t}\n\t\t\twriteFileAtomicSync(\n\t\t\t\tthis.cursorPath,\n\t\t\t\tserialize({ version: 1, lastOrdinal: throughOrdinal, tailBytes: 0 } satisfies EventCursor),\n\t\t\t);\n\t\t\treturn true;\n\t\t});\n\t}\n\n\tsubscribe(listener: (event: OrchestrationEvent) => void): () => void {\n\t\tthis.listeners.add(listener);\n\t\treturn () => this.listeners.delete(listener);\n\t}\n\n\tprivate readAllUnlocked(): OrchestrationEvent[] {\n\t\tconst names = this.eventFileNamesUnlocked();\n\t\tconst events: OrchestrationEvent[] = [];\n\t\tconst baselineOrdinal = this.readProjectionSnapshotUnlocked()?.throughOrdinal ?? 0;\n\t\tthis.assertReadableTailUnlocked(names, baselineOrdinal);\n\t\tlet previousOrdinal = baselineOrdinal;\n\t\tfor (const name of names) {\n\t\t\tconst match = EVENT_FILE_PATTERN.exec(name);\n\t\t\tif (!match) continue;\n\t\t\tconst fileOrdinal = Number(match[1]);\n\t\t\tif (fileOrdinal <= baselineOrdinal) continue;\n\t\t\tconst parsed = this.readEventFileUnlocked(name);\n\t\t\tif (parsed.ordinal !== fileOrdinal || parsed.ordinal <= previousOrdinal) {\n\t\t\t\tthrow new OrchestrationEventStoreError(`Non-monotonic orchestration event ordinal in ${name}`);\n\t\t\t}\n\t\t\tpreviousOrdinal = parsed.ordinal;\n\t\t\tevents.push(structuredClone(parsed));\n\t\t}\n\t\treturn events;\n\t}\n\n\tprivate eventFileNamesUnlocked(): string[] {\n\t\ttry {\n\t\t\treturn readdirSync(this.eventsDir)\n\t\t\t\t.filter((candidate) => EVENT_FILE_PATTERN.test(candidate))\n\t\t\t\t.sort();\n\t\t} catch (error) {\n\t\t\tif ((error as NodeJS.ErrnoException).code === \"ENOENT\") return [];\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprivate idempotencyFileNamesUnlocked(): string[] {\n\t\ttry {\n\t\t\treturn readdirSync(this.idempotencyDir).filter((candidate) => candidate.endsWith(\".json\"));\n\t\t} catch {\n\t\t\treturn [];\n\t\t}\n\t}\n\n\tprivate snapshotFileNamesUnlocked(): string[] {\n\t\ttry {\n\t\t\treturn readdirSync(this.snapshotsDir)\n\t\t\t\t.filter((candidate) => SNAPSHOT_FILE_PATTERN.test(candidate))\n\t\t\t\t.sort();\n\t\t} catch {\n\t\t\treturn [];\n\t\t}\n\t}\n\n\t/** Event files are a contiguous append-only tail after the published snapshot. */\n\tprivate assertContiguousTailOrdinalsUnlocked(names: readonly string[], baselineOrdinal: number): void {\n\t\tlet expectedOrdinal = baselineOrdinal + 1;\n\t\tfor (const name of names) {\n\t\t\tconst ordinal = Number(EVENT_FILE_PATTERN.exec(name)?.[1] ?? 0);\n\t\t\t// A crash after publishing the baseline but before pruning is safe: the snapshot covers these files.\n\t\t\tif (ordinal <= baselineOrdinal) continue;\n\t\t\tif (ordinal !== expectedOrdinal) {\n\t\t\t\tthrow new OrchestrationEventStoreError(\n\t\t\t\t\t`Missing orchestration event ordinal ${expectedOrdinal} before ${name}.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\texpectedOrdinal++;\n\t\t}\n\t}\n\n\t/** A valid cursor may lag a newly published snapshot, but it must never lead its committed tail. */\n\tprivate assertReadableTailUnlocked(names: readonly string[], baselineOrdinal: number): void {\n\t\tthis.assertContiguousTailOrdinalsUnlocked(names, baselineOrdinal);\n\t\tconst highestEventOrdinal = names.length > 0 ? Number(EVENT_FILE_PATTERN.exec(names.at(-1)!)?.[1] ?? 0) : 0;\n\t\tconst highestCommittedOrdinal = Math.max(baselineOrdinal, highestEventOrdinal);\n\t\tconst cursor = parseCursor(this.cursorPath);\n\t\tif (cursor && cursor.lastOrdinal > highestCommittedOrdinal) {\n\t\t\tthrow new OrchestrationEventStoreError(\n\t\t\t\t`Orchestration cursor ${cursor.lastOrdinal} is ahead of the last committed event ${highestCommittedOrdinal}.`,\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate readBaselineUnlocked(): SnapshotBaseline | undefined {\n\t\tif (!existsSync(this.baselinePath)) return undefined;\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(readFileSync(this.baselinePath, \"utf-8\"));\n\t\t} catch (error) {\n\t\t\tthrow new OrchestrationEventStoreError(\n\t\t\t\t`Failed to parse orchestration snapshot baseline: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t);\n\t\t}\n\t\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n\t\t\tthrow new OrchestrationEventStoreError(\"Invalid orchestration snapshot baseline.\");\n\t\t}\n\t\tconst baseline = parsed as Record<string, unknown>;\n\t\tif (\n\t\t\tbaseline.version !== 1 ||\n\t\t\t!Number.isSafeInteger(baseline.throughOrdinal) ||\n\t\t\tNumber(baseline.throughOrdinal) < 1 ||\n\t\t\ttypeof baseline.digest !== \"string\" ||\n\t\t\tbaseline.digest.length === 0 ||\n\t\t\ttypeof baseline.snapshotFile !== \"string\" ||\n\t\t\t!SNAPSHOT_FILE_PATTERN.test(baseline.snapshotFile) ||\n\t\t\tNumber(SNAPSHOT_FILE_PATTERN.exec(baseline.snapshotFile)?.[1] ?? 0) !== Number(baseline.throughOrdinal)\n\t\t) {\n\t\t\tthrow new OrchestrationEventStoreError(\"Invalid orchestration snapshot baseline.\");\n\t\t}\n\t\treturn {\n\t\t\tversion: 1,\n\t\t\tthroughOrdinal: Number(baseline.throughOrdinal),\n\t\t\tdigest: baseline.digest,\n\t\t\tsnapshotFile: baseline.snapshotFile,\n\t\t};\n\t}\n\n\tprivate readProjectionSnapshotUnlocked(): ProjectionSnapshot | undefined {\n\t\tconst baseline = this.readBaselineUnlocked();\n\t\tif (!baseline) return undefined;\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(readFileSync(join(this.snapshotsDir, baseline.snapshotFile), \"utf-8\"));\n\t\t} catch (error) {\n\t\t\tthrow new OrchestrationEventStoreError(\n\t\t\t\t`Failed to parse orchestration projection snapshot: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t);\n\t\t}\n\t\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n\t\t\tthrow new OrchestrationEventStoreError(\"Invalid orchestration projection snapshot.\");\n\t\t}\n\t\tconst snapshot = parsed as Record<string, unknown>;\n\t\tif (\n\t\t\tsnapshot.version !== 1 ||\n\t\t\tsnapshot.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION ||\n\t\t\tsnapshot.throughOrdinal !== baseline.throughOrdinal ||\n\t\t\ttypeof snapshot.createdAt !== \"string\" ||\n\t\t\t!snapshot.projection ||\n\t\t\ttypeof snapshot.projection !== \"object\" ||\n\t\t\tArray.isArray(snapshot.projection) ||\n\t\t\t!Array.isArray(snapshot.idempotencyEvents) ||\n\t\t\t!snapshot.idempotencyEvents.every(isOrchestrationEvent) ||\n\t\t\t!snapshot.idempotencyEvents.every(\n\t\t\t\t(event) => event.ordinal <= baseline.throughOrdinal && event.idempotencyKey !== undefined,\n\t\t\t) ||\n\t\t\tnew Set(snapshot.idempotencyEvents.map((event) => event.idempotencyKey)).size !==\n\t\t\t\tsnapshot.idempotencyEvents.length ||\n\t\t\ttypeof snapshot.digest !== \"string\" ||\n\t\t\tsnapshot.digest !== baseline.digest\n\t\t) {\n\t\t\tthrow new OrchestrationEventStoreError(\"Invalid orchestration projection snapshot.\");\n\t\t}\n\t\tconst content: ProjectionSnapshotContent = {\n\t\t\tversion: 1,\n\t\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\t\tthroughOrdinal: baseline.throughOrdinal,\n\t\t\tcreatedAt: snapshot.createdAt,\n\t\t\tprojection: structuredClone(snapshot.projection) as JsonObject,\n\t\t\tidempotencyEvents: snapshot.idempotencyEvents.map((event) => structuredClone(event)),\n\t\t};\n\t\tif (snapshotDigest(content) !== baseline.digest) {\n\t\t\tthrow new OrchestrationEventStoreError(\"Orchestration projection snapshot digest mismatch.\");\n\t\t}\n\t\treturn { ...content, digest: baseline.digest };\n\t}\n\n\t/**\n\t * Appends need a verified snapshot baseline but must not deserialize its projection on every event.\n\t * The baseline pointer remains small and is reread each time; an immutable snapshot is reparsed only\n\t * when its pointer or filesystem identity changes.\n\t */\n\tprivate readVerifiedSnapshotBaselineUnlocked(): SnapshotBaseline | undefined {\n\t\tconst baseline = this.readBaselineUnlocked();\n\t\tif (!baseline) {\n\t\t\tthis.verifiedSnapshotBaseline = undefined;\n\t\t\treturn undefined;\n\t\t}\n\t\tconst signature = this.snapshotFileSignatureUnlocked(baseline);\n\t\tconst cached = this.verifiedSnapshotBaseline;\n\t\tif (\n\t\t\tcached &&\n\t\t\tcached.baseline.throughOrdinal === baseline.throughOrdinal &&\n\t\t\tcached.baseline.digest === baseline.digest &&\n\t\t\tcached.baseline.snapshotFile === baseline.snapshotFile &&\n\t\t\tcached.signature.size === signature.size &&\n\t\t\tcached.signature.mtimeMs === signature.mtimeMs &&\n\t\t\tcached.signature.ctimeMs === signature.ctimeMs\n\t\t) {\n\t\t\treturn baseline;\n\t\t}\n\t\tthis.readProjectionSnapshotUnlocked();\n\t\tconst verifiedSignature = this.snapshotFileSignatureUnlocked(baseline);\n\t\tif (\n\t\t\tverifiedSignature.size !== signature.size ||\n\t\t\tverifiedSignature.mtimeMs !== signature.mtimeMs ||\n\t\t\tverifiedSignature.ctimeMs !== signature.ctimeMs\n\t\t) {\n\t\t\tthrow new OrchestrationEventStoreError(\"Orchestration projection snapshot changed while being verified.\");\n\t\t}\n\t\tthis.verifiedSnapshotBaseline = { baseline, signature };\n\t\treturn baseline;\n\t}\n\n\tprivate snapshotFileSignatureUnlocked(baseline: SnapshotBaseline): SnapshotFileSignature {\n\t\ttry {\n\t\t\tconst stats = statSync(join(this.snapshotsDir, baseline.snapshotFile));\n\t\t\tif (!stats.isFile())\n\t\t\t\tthrow new OrchestrationEventStoreError(\"Orchestration projection snapshot is not a file.\");\n\t\t\treturn { size: stats.size, mtimeMs: stats.mtimeMs, ctimeMs: stats.ctimeMs };\n\t\t} catch (error) {\n\t\t\tif (error instanceof OrchestrationEventStoreError) throw error;\n\t\t\tthrow new OrchestrationEventStoreError(\n\t\t\t\t`Failed to parse orchestration projection snapshot: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate unlinkManagedFile(filePath: string): void {\n\t\ttry {\n\t\t\tunlinkSync(filePath);\n\t\t} catch (error) {\n\t\t\tif ((error as NodeJS.ErrnoException).code !== \"ENOENT\") throw error;\n\t\t}\n\t}\n\n\tprivate readEventFileUnlocked(name: string): OrchestrationEvent {\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(readFileSync(join(this.eventsDir, name), \"utf-8\"));\n\t\t} catch (error) {\n\t\t\tthrow new OrchestrationEventStoreError(\n\t\t\t\t`Failed to parse orchestration event ${name}: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t);\n\t\t}\n\t\tif (!isOrchestrationEvent(parsed)) {\n\t\t\tthrow new OrchestrationEventStoreError(`Invalid orchestration event record: ${name}`);\n\t\t}\n\t\treturn parsed;\n\t}\n\n\tprivate idempotencyPath(key: string): string {\n\t\treturn join(this.idempotencyDir, `${createHash(\"sha256\").update(key).digest(\"hex\")}.json`);\n\t}\n\n\tprivate writeIdempotencyMarkerUnlocked(key: string, ordinal: number): void {\n\t\twriteFileAtomicSync(\n\t\t\tthis.idempotencyPath(key),\n\t\t\tserialize({ version: 1, key, ordinal } satisfies IdempotencyMarker),\n\t\t);\n\t}\n\n\tprivate readIdempotentEventUnlocked(key: string): OrchestrationEvent | undefined {\n\t\tconst markerPath = this.idempotencyPath(key);\n\t\tif (!existsSync(markerPath)) {\n\t\t\treturn this.readProjectionSnapshotUnlocked()?.idempotencyEvents.find((event) => event.idempotencyKey === key);\n\t\t}\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(readFileSync(markerPath, \"utf-8\"));\n\t\t} catch (error) {\n\t\t\tthrow new OrchestrationEventStoreError(\n\t\t\t\t`Failed to parse orchestration idempotency marker: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t);\n\t\t}\n\t\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n\t\t\tthrow new OrchestrationEventStoreError(\"Invalid orchestration idempotency marker.\");\n\t\t}\n\t\tconst marker = parsed as Record<string, unknown>;\n\t\tif (\n\t\t\tmarker.version !== 1 ||\n\t\t\tmarker.key !== key ||\n\t\t\t!Number.isSafeInteger(marker.ordinal) ||\n\t\t\tNumber(marker.ordinal) < 1\n\t\t) {\n\t\t\tthrow new OrchestrationEventStoreError(\"Invalid orchestration idempotency marker.\");\n\t\t}\n\t\tconst ordinal = Number(marker.ordinal);\n\t\tif (!existsSync(join(this.eventsDir, eventFileName(ordinal)))) {\n\t\t\tconst retained = this.readProjectionSnapshotUnlocked()?.idempotencyEvents.find(\n\t\t\t\t(event) => event.idempotencyKey === key && event.ordinal === ordinal,\n\t\t\t);\n\t\t\tif (retained) return retained;\n\t\t}\n\t\tconst event = this.readEventFileUnlocked(eventFileName(ordinal));\n\t\tif (event.ordinal !== ordinal || event.idempotencyKey !== key) {\n\t\t\tthrow new OrchestrationEventStoreError(\"Orchestration idempotency marker does not match its event.\");\n\t\t}\n\t\treturn event;\n\t}\n\n\t/**\n\t * Reconcile only the crash tail when an event rename committed before its marker/cursor. Normal\n\t * appends read directory metadata plus one marker, never the accumulated event payload prefix.\n\t */\n\tprivate synchronizeIndexesUnlocked(): SynchronizedIndexes {\n\t\tconst names = this.eventFileNamesUnlocked();\n\t\tconst baselineOrdinal = this.readVerifiedSnapshotBaselineUnlocked()?.throughOrdinal ?? 0;\n\t\tthis.assertReadableTailUnlocked(names, baselineOrdinal);\n\t\tconst highestEventOrdinal = names.length > 0 ? Number(EVENT_FILE_PATTERN.exec(names.at(-1)!)?.[1] ?? 0) : 0;\n\t\tconst highest = Math.max(baselineOrdinal, highestEventOrdinal);\n\t\tconst cursor = parseCursor(this.cursorPath);\n\t\tif (\n\t\t\tcursor?.lastOrdinal === highest &&\n\t\t\tcursor.tailBytes !== undefined &&\n\t\t\t(highest > baselineOrdinal || cursor.tailBytes === 0)\n\t\t) {\n\t\t\treturn { lastOrdinal: highest, tailBytes: cursor.tailBytes };\n\t\t}\n\t\tif (cursor && cursor.lastOrdinal > highest) {\n\t\t\tthrow new OrchestrationEventStoreError(\n\t\t\t\t`Orchestration cursor ${cursor.lastOrdinal} is ahead of the last committed event ${highest}.`,\n\t\t\t);\n\t\t}\n\t\tconst rebuildFrom = Math.max(\n\t\t\tbaselineOrdinal + 1,\n\t\t\tcursor && cursor.lastOrdinal >= baselineOrdinal && cursor.lastOrdinal <= highest\n\t\t\t\t? cursor.lastOrdinal + 1\n\t\t\t\t: baselineOrdinal + 1,\n\t\t);\n\t\tfor (const name of names) {\n\t\t\tconst ordinal = Number(EVENT_FILE_PATTERN.exec(name)?.[1] ?? 0);\n\t\t\tif (ordinal < rebuildFrom || ordinal <= baselineOrdinal) continue;\n\t\t\tconst event = this.readEventFileUnlocked(name);\n\t\t\tif (event.ordinal !== ordinal) {\n\t\t\t\tthrow new OrchestrationEventStoreError(`Event ordinal does not match file name: ${name}`);\n\t\t\t}\n\t\t\tif (event.idempotencyKey) this.writeIdempotencyMarkerUnlocked(event.idempotencyKey, ordinal);\n\t\t}\n\t\tconst tailBytes = names.reduce((total, name) => {\n\t\t\tconst ordinal = Number(EVENT_FILE_PATTERN.exec(name)?.[1] ?? 0);\n\t\t\tif (ordinal <= baselineOrdinal) return total;\n\t\t\ttry {\n\t\t\t\treturn total + statSync(join(this.eventsDir, name)).size;\n\t\t\t} catch {\n\t\t\t\treturn total;\n\t\t\t}\n\t\t}, 0);\n\t\twriteFileAtomicSync(\n\t\t\tthis.cursorPath,\n\t\t\tserialize({ version: 1, lastOrdinal: highest, tailBytes } satisfies EventCursor),\n\t\t);\n\t\treturn { lastOrdinal: highest, tailBytes };\n\t}\n}\n"]}

package/dist/core/orchestration/lane-tool-manifests.d.ts

@@ -0,0 +1,9 @@
+import type { OrchestrationProfile, ToolCapabilityManifest } from "./contracts.ts";
+export declare const CLASSIFIED_LANE_TOOL_NAMES: readonly ["read", "grep", "find", "ls", "write", "edit", "memory", "run_process"];
+export declare const ORCHESTRATION_PROFILE_TOOL_NAMES: readonly ["read", "grep", "find", "ls", "write", "edit", "memory", "run_process", "delegate", "delegate_status"];
+/**
+ * Manifest-only lane catalogue. It contains no tool factories, so policy compilation can omit
+ * denied tools before their executable implementations are constructed.
+ */
+export declare function buildLaneToolManifests(profile: OrchestrationProfile, enabledToolNames: readonly string[]): ToolCapabilityManifest[];
+//# sourceMappingURL=lane-tool-manifests.d.ts.map

package/dist/core/orchestration/lane-tool-manifests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lane-tool-manifests.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/lane-tool-manifests.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAEnF,eAAO,MAAM,0BAA0B,mFAS7B,CAAC;AACX,eAAO,MAAM,gCAAgC,kHAA0E,CAAC;AAExH;;;GAGG;AACH,wBAAgB,sBAAsB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,EAAE,SAAS,MAAM,EAAE,GACjC,sBAAsB,EAAE,CAkB1B","sourcesContent":["import { getToolCapabilityPolicy, resolveProfileToolCapability } from \"../tool-capability-policy.ts\";\nimport type { OrchestrationProfile, ToolCapabilityManifest } from \"./contracts.ts\";\n\nexport const CLASSIFIED_LANE_TOOL_NAMES = [\n\t\"read\",\n\t\"grep\",\n\t\"find\",\n\t\"ls\",\n\t\"write\",\n\t\"edit\",\n\t\"memory\",\n\t\"run_process\",\n] as const;\nexport const ORCHESTRATION_PROFILE_TOOL_NAMES = [...CLASSIFIED_LANE_TOOL_NAMES, \"delegate\", \"delegate_status\"] as const;\n\n/**\n * Manifest-only lane catalogue. It contains no tool factories, so policy compilation can omit\n * denied tools before their executable implementations are constructed.\n */\nexport function buildLaneToolManifests(\n\tprofile: OrchestrationProfile,\n\tenabledToolNames: readonly string[],\n): ToolCapabilityManifest[] {\n\tconst enabled = new Set(enabledToolNames);\n\tconst manifests: ToolCapabilityManifest[] = [];\n\n\tfor (const toolName of profile.toolNames) {\n\t\tif (!enabled.has(toolName)) continue;\n\t\tconst policy = getToolCapabilityPolicy(toolName);\n\t\tconst capability = resolveProfileToolCapability(profile, toolName);\n\t\tif (!capability || !policy) continue;\n\t\tmanifests.push({\n\t\t\ttoolName,\n\t\t\tmoduleSpecifier: `../tools/${toolName}.ts`,\n\t\t\tcapabilities: [capability],\n\t\t\troles: [profile.role],\n\t\t\tenforcements: [policy.enforcement],\n\t\t});\n\t}\n\treturn manifests;\n}\n"]}

package/dist/core/orchestration/lane-tool-manifests.js

@@ -0,0 +1,37 @@
+import { getToolCapabilityPolicy, resolveProfileToolCapability } from "../tool-capability-policy.js";
+export const CLASSIFIED_LANE_TOOL_NAMES = [
+    "read",
+    "grep",
+    "find",
+    "ls",
+    "write",
+    "edit",
+    "memory",
+    "run_process",
+];
+export const ORCHESTRATION_PROFILE_TOOL_NAMES = [...CLASSIFIED_LANE_TOOL_NAMES, "delegate", "delegate_status"];
+/**
+ * Manifest-only lane catalogue. It contains no tool factories, so policy compilation can omit
+ * denied tools before their executable implementations are constructed.
+ */
+export function buildLaneToolManifests(profile, enabledToolNames) {
+    const enabled = new Set(enabledToolNames);
+    const manifests = [];
+    for (const toolName of profile.toolNames) {
+        if (!enabled.has(toolName))
+            continue;
+        const policy = getToolCapabilityPolicy(toolName);
+        const capability = resolveProfileToolCapability(profile, toolName);
+        if (!capability || !policy)
+            continue;
+        manifests.push({
+            toolName,
+            moduleSpecifier: `../tools/${toolName}.ts`,
+            capabilities: [capability],
+            roles: [profile.role],
+            enforcements: [policy.enforcement],
+        });
+    }
+    return manifests;
+}
+//# sourceMappingURL=lane-tool-manifests.js.map

package/dist/core/orchestration/lane-tool-manifests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lane-tool-manifests.js","sourceRoot":"","sources":["../../../src/core/orchestration/lane-tool-manifests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAGrG,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACzC,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,QAAQ;IACR,aAAa;CACJ,CAAC;AACX,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,0BAA0B,EAAE,UAAU,EAAE,iBAAiB,CAAU,CAAC;AAExH;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACrC,OAA6B,EAC7B,gBAAmC,EACR;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,SAAS,GAA6B,EAAE,CAAC;IAE/C,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM;YAAE,SAAS;QACrC,SAAS,CAAC,IAAI,CAAC;YACd,QAAQ;YACR,eAAe,EAAE,YAAY,QAAQ,KAAK;YAC1C,YAAY,EAAE,CAAC,UAAU,CAAC;YAC1B,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YACrB,YAAY,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;SAClC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB","sourcesContent":["import { getToolCapabilityPolicy, resolveProfileToolCapability } from \"../tool-capability-policy.ts\";\nimport type { OrchestrationProfile, ToolCapabilityManifest } from \"./contracts.ts\";\n\nexport const CLASSIFIED_LANE_TOOL_NAMES = [\n\t\"read\",\n\t\"grep\",\n\t\"find\",\n\t\"ls\",\n\t\"write\",\n\t\"edit\",\n\t\"memory\",\n\t\"run_process\",\n] as const;\nexport const ORCHESTRATION_PROFILE_TOOL_NAMES = [...CLASSIFIED_LANE_TOOL_NAMES, \"delegate\", \"delegate_status\"] as const;\n\n/**\n * Manifest-only lane catalogue. It contains no tool factories, so policy compilation can omit\n * denied tools before their executable implementations are constructed.\n */\nexport function buildLaneToolManifests(\n\tprofile: OrchestrationProfile,\n\tenabledToolNames: readonly string[],\n): ToolCapabilityManifest[] {\n\tconst enabled = new Set(enabledToolNames);\n\tconst manifests: ToolCapabilityManifest[] = [];\n\n\tfor (const toolName of profile.toolNames) {\n\t\tif (!enabled.has(toolName)) continue;\n\t\tconst policy = getToolCapabilityPolicy(toolName);\n\t\tconst capability = resolveProfileToolCapability(profile, toolName);\n\t\tif (!capability || !policy) continue;\n\t\tmanifests.push({\n\t\t\ttoolName,\n\t\t\tmoduleSpecifier: `../tools/${toolName}.ts`,\n\t\t\tcapabilities: [capability],\n\t\t\troles: [profile.role],\n\t\t\tenforcements: [policy.enforcement],\n\t\t});\n\t}\n\treturn manifests;\n}\n"]}

package/dist/core/orchestration/model-binding.d.ts

@@ -0,0 +1,15 @@
+import { type Api, type Model } from "@caupulican/pi-ai";
+import type { ModelRegistry } from "../model-registry.ts";
+import type { OrchestrationModelBinding, OrchestrationProfile } from "./contracts.ts";
+export interface ResolvedOrchestrationModel {
+    model: Model<Api>;
+    binding: OrchestrationModelBinding;
+}
+export declare function resolvePinnedOrchestrationModel(binding: OrchestrationModelBinding, modelRegistry: ModelRegistry, isUnavailable?: (model: Model<Api>) => boolean): ResolvedOrchestrationModel | undefined;
+/**
+ * Resolve an owner-authored model policy without weakening it. Fixed policies never fall through;
+ * ordered policies use only their declared order, and every candidate must have configured auth
+ * plus exact support for its pinned thinking level.
+ */
+export declare function resolveConfiguredOrchestrationModel(profile: OrchestrationProfile, modelRegistry: ModelRegistry, isUnavailable?: (model: Model<Api>) => boolean): ResolvedOrchestrationModel | undefined;
+//# sourceMappingURL=model-binding.d.ts.map

package/dist/core/orchestration/model-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-binding.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/model-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,GAAG,EAA8B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtF,MAAM,WAAW,0BAA0B;IAC1C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClB,OAAO,EAAE,yBAAyB,CAAC;CACnC;AAED,wBAAgB,+BAA+B,CAC9C,OAAO,EAAE,yBAAyB,EAClC,aAAa,EAAE,aAAa,EAC5B,aAAa,GAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,OAAqB,GACzD,0BAA0B,GAAG,SAAS,CAWxC;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,CAClD,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,aAAa,EAC5B,aAAa,GAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,OAAqB,GACzD,0BAA0B,GAAG,SAAS,CAUxC","sourcesContent":["import { type Api, getSupportedThinkingLevels, type Model } from \"@caupulican/pi-ai\";\nimport type { ModelRegistry } from \"../model-registry.ts\";\nimport type { OrchestrationModelBinding, OrchestrationProfile } from \"./contracts.ts\";\n\nexport interface ResolvedOrchestrationModel {\n\tmodel: Model<Api>;\n\tbinding: OrchestrationModelBinding;\n}\n\nexport function resolvePinnedOrchestrationModel(\n\tbinding: OrchestrationModelBinding,\n\tmodelRegistry: ModelRegistry,\n\tisUnavailable: (model: Model<Api>) => boolean = () => false,\n): ResolvedOrchestrationModel | undefined {\n\tconst model = modelRegistry.find(binding.provider, binding.modelId);\n\tif (\n\t\t!model ||\n\t\t!modelRegistry.hasConfiguredAuth(model) ||\n\t\tisUnavailable(model) ||\n\t\t!getSupportedThinkingLevels(model).includes(binding.thinkingLevel)\n\t) {\n\t\treturn undefined;\n\t}\n\treturn { model, binding: structuredClone(binding) };\n}\n\n/**\n * Resolve an owner-authored model policy without weakening it. Fixed policies never fall through;\n * ordered policies use only their declared order, and every candidate must have configured auth\n * plus exact support for its pinned thinking level.\n */\nexport function resolveConfiguredOrchestrationModel(\n\tprofile: OrchestrationProfile,\n\tmodelRegistry: ModelRegistry,\n\tisUnavailable: (model: Model<Api>) => boolean = () => false,\n): ResolvedOrchestrationModel | undefined {\n\tfor (const binding of profile.modelPolicy.candidates) {\n\t\tconst resolved = resolvePinnedOrchestrationModel(binding, modelRegistry, isUnavailable);\n\t\tif (!resolved) {\n\t\t\tif (profile.modelPolicy.mode === \"fixed\") return undefined;\n\t\t\tcontinue;\n\t\t}\n\t\treturn resolved;\n\t}\n\treturn undefined;\n}\n"]}

package/dist/core/orchestration/model-binding.js

@@ -0,0 +1,29 @@
+import { getSupportedThinkingLevels } from "@caupulican/pi-ai";
+export function resolvePinnedOrchestrationModel(binding, modelRegistry, isUnavailable = () => false) {
+    const model = modelRegistry.find(binding.provider, binding.modelId);
+    if (!model ||
+        !modelRegistry.hasConfiguredAuth(model) ||
+        isUnavailable(model) ||
+        !getSupportedThinkingLevels(model).includes(binding.thinkingLevel)) {
+        return undefined;
+    }
+    return { model, binding: structuredClone(binding) };
+}
+/**
+ * Resolve an owner-authored model policy without weakening it. Fixed policies never fall through;
+ * ordered policies use only their declared order, and every candidate must have configured auth
+ * plus exact support for its pinned thinking level.
+ */
+export function resolveConfiguredOrchestrationModel(profile, modelRegistry, isUnavailable = () => false) {
+    for (const binding of profile.modelPolicy.candidates) {
+        const resolved = resolvePinnedOrchestrationModel(binding, modelRegistry, isUnavailable);
+        if (!resolved) {
+            if (profile.modelPolicy.mode === "fixed")
+                return undefined;
+            continue;
+        }
+        return resolved;
+    }
+    return undefined;
+}
+//# sourceMappingURL=model-binding.js.map

package/dist/core/orchestration/model-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-binding.js","sourceRoot":"","sources":["../../../src/core/orchestration/model-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,0BAA0B,EAAc,MAAM,mBAAmB,CAAC;AASrF,MAAM,UAAU,+BAA+B,CAC9C,OAAkC,EAClC,aAA4B,EAC5B,aAAa,GAAmC,GAAG,EAAE,CAAC,KAAK,EAClB;IACzC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IACC,CAAC,KAAK;QACN,CAAC,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACvC,aAAa,CAAC,KAAK,CAAC;QACpB,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EACjE,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;AAAA,CACpD;AAED;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CAClD,OAA6B,EAC7B,aAA4B,EAC5B,aAAa,GAAmC,GAAG,EAAE,CAAC,KAAK,EAClB;IACzC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,+BAA+B,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QACxF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC3D,SAAS;QACV,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB","sourcesContent":["import { type Api, getSupportedThinkingLevels, type Model } from \"@caupulican/pi-ai\";\nimport type { ModelRegistry } from \"../model-registry.ts\";\nimport type { OrchestrationModelBinding, OrchestrationProfile } from \"./contracts.ts\";\n\nexport interface ResolvedOrchestrationModel {\n\tmodel: Model<Api>;\n\tbinding: OrchestrationModelBinding;\n}\n\nexport function resolvePinnedOrchestrationModel(\n\tbinding: OrchestrationModelBinding,\n\tmodelRegistry: ModelRegistry,\n\tisUnavailable: (model: Model<Api>) => boolean = () => false,\n): ResolvedOrchestrationModel | undefined {\n\tconst model = modelRegistry.find(binding.provider, binding.modelId);\n\tif (\n\t\t!model ||\n\t\t!modelRegistry.hasConfiguredAuth(model) ||\n\t\tisUnavailable(model) ||\n\t\t!getSupportedThinkingLevels(model).includes(binding.thinkingLevel)\n\t) {\n\t\treturn undefined;\n\t}\n\treturn { model, binding: structuredClone(binding) };\n}\n\n/**\n * Resolve an owner-authored model policy without weakening it. Fixed policies never fall through;\n * ordered policies use only their declared order, and every candidate must have configured auth\n * plus exact support for its pinned thinking level.\n */\nexport function resolveConfiguredOrchestrationModel(\n\tprofile: OrchestrationProfile,\n\tmodelRegistry: ModelRegistry,\n\tisUnavailable: (model: Model<Api>) => boolean = () => false,\n): ResolvedOrchestrationModel | undefined {\n\tfor (const binding of profile.modelPolicy.candidates) {\n\t\tconst resolved = resolvePinnedOrchestrationModel(binding, modelRegistry, isUnavailable);\n\t\tif (!resolved) {\n\t\t\tif (profile.modelPolicy.mode === \"fixed\") return undefined;\n\t\t\tcontinue;\n\t\t}\n\t\treturn resolved;\n\t}\n\treturn undefined;\n}\n"]}

package/dist/core/orchestration/policy-compiler.d.ts

@@ -0,0 +1,49 @@
+import { type ApprovalRequestContract, type CapabilityDecision, type ExecutionGrant, type HarnessCapability, type ResourcePointer, type RiskBudget, type ToolCapabilityManifest, type WorkerRole } from "./contracts.ts";
+export declare const DEFAULT_ROLE_CAPABILITY_CEILINGS: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;
+export interface CompileExecutionGrantInput {
+    objectiveId: string;
+    taskId: string;
+    attemptId: string;
+    subjectId: string;
+    role: WorkerRole;
+    requiredCapabilities: readonly HarnessCapability[];
+    requestedCapabilities?: readonly HarnessCapability[];
+    authorityCapabilities: readonly HarnessCapability[];
+    requestedTools: readonly string[];
+    toolManifests: readonly ToolCapabilityManifest[];
+    resources?: readonly ResourcePointer[];
+    readPaths?: readonly string[];
+    writePaths?: readonly string[];
+    deniedPaths?: readonly string[];
+    requestedBudget?: RiskBudget;
+    authorityBudget?: RiskBudget;
+    policyVersion: string;
+    expiresAt?: string;
+}
+export type PolicyCompilationResult = {
+    outcome: "allow";
+    grant: ExecutionGrant;
+    toolManifests: readonly ToolCapabilityManifest[];
+} | {
+    outcome: "approval-required";
+    approval: ApprovalRequestContract;
+    decisions: readonly CapabilityDecision[];
+    reasonCodes: readonly string[];
+} | {
+    outcome: "deny";
+    decisions: readonly CapabilityDecision[];
+    reasonCodes: readonly string[];
+};
+export interface PolicyCompilerOptions {
+    now?: () => string;
+    createId?: () => string;
+    roleCapabilityCeilings?: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;
+}
+export declare class ExecutionPolicyCompiler {
+    private readonly now;
+    private readonly createId;
+    private readonly roleCapabilityCeilings;
+    constructor(options?: PolicyCompilerOptions);
+    compile(input: CompileExecutionGrantInput): PolicyCompilationResult;
+}
+//# sourceMappingURL=policy-compiler.d.ts.map

package/dist/core/orchestration/policy-compiler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-compiler.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/policy-compiler.ts"],"names":[],"mappings":"AACA,OAAO,EACN,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,MAAM,gBAAgB,CAAC;AAGxB,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC,CAQvG,CAAC;AAEF,MAAM,WAAW,0BAA0B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,oBAAoB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACnD,qBAAqB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrD,qBAAqB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACpD,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACjD,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,uBAAuB,GAChC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAAE,GAC7F;IACA,OAAO,EAAE,mBAAmB,CAAC;IAC7B,QAAQ,EAAE,uBAAuB,CAAC;IAClC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACzC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjG,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC,CAAC,CAAC;CACpF;AAkDD,qBAAa,uBAAuB;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA6D;IAEpG,YAAY,OAAO,GAAE,qBAA0B,EAI9C;IAED,OAAO,CAAC,KAAK,EAAE,0BAA0B,GAAG,uBAAuB,CAmIlE;CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n\ttype ApprovalRequestContract,\n\ttype CapabilityDecision,\n\ttype ExecutionGrant,\n\ttype HarnessCapability,\n\tORCHESTRATION_SCHEMA_VERSION,\n\ttype ResourcePointer,\n\ttype RiskBudget,\n\ttype ToolCapabilityManifest,\n\ttype WorkerRole,\n} from \"./contracts.ts\";\nimport { exceededRiskBudgetFields, intersectRiskBudgets, validateRiskBudget } from \"./risk-budget.ts\";\n\nexport const DEFAULT_ROLE_CAPABILITY_CEILINGS: Readonly<Record<WorkerRole, readonly HarnessCapability[]>> = {\n\torchestrator: [\"workflow.delegate\"],\n\tplanner: [\"workflow.plan\"],\n\texplorer: [\"filesystem.read\", \"worktree.read\", \"network.http\", \"service.mcp\", \"memory.query\"],\n\timplementer: [\"filesystem.read\", \"filesystem.write\", \"worktree.read\", \"worktree.mutate\", \"memory.query\"],\n\toperator: [\"filesystem.read\", \"worktree.read\", \"process.exec\", \"tests.execute\", \"network.http\", \"service.mcp\"],\n\tverifier: [\"filesystem.read\", \"worktree.read\", \"process.exec\", \"tests.execute\", \"network.http\", \"service.mcp\"],\n\tdatabase: [\"memory.query\", \"memory.mutate\"],\n};\n\nexport interface CompileExecutionGrantInput {\n\tobjectiveId: string;\n\ttaskId: string;\n\tattemptId: string;\n\tsubjectId: string;\n\trole: WorkerRole;\n\trequiredCapabilities: readonly HarnessCapability[];\n\trequestedCapabilities?: readonly HarnessCapability[];\n\tauthorityCapabilities: readonly HarnessCapability[];\n\trequestedTools: readonly string[];\n\ttoolManifests: readonly ToolCapabilityManifest[];\n\tresources?: readonly ResourcePointer[];\n\treadPaths?: readonly string[];\n\twritePaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\trequestedBudget?: RiskBudget;\n\tauthorityBudget?: RiskBudget;\n\tpolicyVersion: string;\n\texpiresAt?: string;\n}\n\nexport type PolicyCompilationResult =\n\t| { outcome: \"allow\"; grant: ExecutionGrant; toolManifests: readonly ToolCapabilityManifest[] }\n\t| {\n\t\t\toutcome: \"approval-required\";\n\t\t\tapproval: ApprovalRequestContract;\n\t\t\tdecisions: readonly CapabilityDecision[];\n\t\t\treasonCodes: readonly string[];\n\t  }\n\t| { outcome: \"deny\"; decisions: readonly CapabilityDecision[]; reasonCodes: readonly string[] };\n\nexport interface PolicyCompilerOptions {\n\tnow?: () => string;\n\tcreateId?: () => string;\n\troleCapabilityCeilings?: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;\n}\n\nfunction unique<T>(values: readonly T[]): T[] {\n\treturn [...new Set(values)];\n}\n\nfunction freezeGrant(grant: ExecutionGrant): ExecutionGrant {\n\tfor (const resource of grant.resources) {\n\t\tif (resource.metadata) Object.freeze(resource.metadata);\n\t\tObject.freeze(resource);\n\t}\n\tfor (const decision of grant.decisionTrace) Object.freeze(decision);\n\tObject.freeze(grant.capabilities);\n\tObject.freeze(grant.allowedTools);\n\tObject.freeze(grant.resources);\n\tObject.freeze(grant.readPaths);\n\tObject.freeze(grant.writePaths);\n\tObject.freeze(grant.deniedPaths);\n\tObject.freeze(grant.budget);\n\tObject.freeze(grant.decisionTrace);\n\treturn Object.freeze(grant);\n}\n\nconst CAPABILITY_ENFORCEMENT = new Map<HarnessCapability, ToolCapabilityManifest[\"enforcements\"][number]>([\n\t[\"filesystem.read\", \"path-scope\"],\n\t[\"filesystem.write\", \"path-scope\"],\n\t[\"worktree.read\", \"path-scope\"],\n\t[\"worktree.mutate\", \"path-scope\"],\n\t[\"process.exec\", \"process-launcher\"],\n\t[\"tests.execute\", \"process-launcher\"],\n\t[\"network.http\", \"service-proxy\"],\n\t[\"service.mcp\", \"service-proxy\"],\n\t[\"credentials.use\", \"service-proxy\"],\n\t[\"credentials.modify\", \"control-plane\"],\n\t[\"memory.query\", \"memory-broker\"],\n\t[\"memory.mutate\", \"memory-broker\"],\n\t[\"settings.read\", \"control-plane\"],\n\t[\"settings.write\", \"control-plane\"],\n\t[\"skill.read\", \"path-scope\"],\n\t[\"skill.write\", \"path-scope\"],\n\t[\"source.read\", \"path-scope\"],\n\t[\"source.write\", \"path-scope\"],\n\t[\"research.execute\", \"control-plane\"],\n\t[\"workflow.plan\", \"control-plane\"],\n\t[\"workflow.delegate\", \"control-plane\"],\n\t[\"policy.modify\", \"control-plane\"],\n\t[\"learning.propose\", \"control-plane\"],\n\t[\"publish.execute\", \"control-plane\"],\n]);\n\nexport class ExecutionPolicyCompiler {\n\tprivate readonly now: () => string;\n\tprivate readonly createId: () => string;\n\tprivate readonly roleCapabilityCeilings: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;\n\n\tconstructor(options: PolicyCompilerOptions = {}) {\n\t\tthis.now = options.now ?? (() => new Date().toISOString());\n\t\tthis.createId = options.createId ?? randomUUID;\n\t\tthis.roleCapabilityCeilings = options.roleCapabilityCeilings ?? DEFAULT_ROLE_CAPABILITY_CEILINGS;\n\t}\n\n\tcompile(input: CompileExecutionGrantInput): PolicyCompilationResult {\n\t\tconst required = unique(input.requiredCapabilities);\n\t\tconst requested = unique([...(input.requestedCapabilities ?? required), ...required]);\n\t\tconst authority = new Set(input.authorityCapabilities);\n\t\tconst roleCeiling = new Set(this.roleCapabilityCeilings[input.role]);\n\t\tconst decisions: CapabilityDecision[] = [];\n\t\tconst roleDenied: HarnessCapability[] = [];\n\t\tconst approvalCapabilities: HarnessCapability[] = [];\n\t\tconst granted: HarnessCapability[] = [];\n\n\t\tfor (const capability of requested) {\n\t\t\tif (!roleCeiling.has(capability)) {\n\t\t\t\troleDenied.push(capability);\n\t\t\t\tdecisions.push({ capability, outcome: \"deny\", reasonCode: \"role_ceiling_denied\", source: input.role });\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!authority.has(capability)) {\n\t\t\t\tapprovalCapabilities.push(capability);\n\t\t\t\tdecisions.push({\n\t\t\t\t\tcapability,\n\t\t\t\t\toutcome: \"deny\",\n\t\t\t\t\treasonCode: \"owner_authority_required\",\n\t\t\t\t\tsource: \"authority\",\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tgranted.push(capability);\n\t\t\tdecisions.push({ capability, outcome: \"allow\", reasonCode: \"role_and_authority_allowed\", source: input.role });\n\t\t}\n\n\t\tif (roleDenied.some((capability) => required.includes(capability))) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"required_capability_exceeds_role_ceiling\"] };\n\t\t}\n\n\t\tconst requestedBudget = { ...(input.requestedBudget ?? {}) };\n\t\tconst authorityBudget = { ...(input.authorityBudget ?? {}) };\n\t\tvalidateRiskBudget(requestedBudget, \"requestedBudget\");\n\t\tvalidateRiskBudget(authorityBudget, \"authorityBudget\");\n\t\tconst exceededBudgetFields = exceededRiskBudgetFields(requestedBudget, authorityBudget);\n\t\tif (approvalCapabilities.some((capability) => required.includes(capability)) || exceededBudgetFields.length > 0) {\n\t\t\tconst approval: ApprovalRequestContract = {\n\t\t\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\t\t\tapprovalId: `approval-${this.createId()}`,\n\t\t\t\tobjectiveId: input.objectiveId,\n\t\t\t\ttaskId: input.taskId,\n\t\t\t\tattemptId: input.attemptId,\n\t\t\t\treasonCode:\n\t\t\t\t\texceededBudgetFields.length > 0\n\t\t\t\t\t\t? \"requested_budget_exceeds_authority\"\n\t\t\t\t\t\t: \"required_capability_needs_authority\",\n\t\t\t\tsummary:\n\t\t\t\t\texceededBudgetFields.length > 0\n\t\t\t\t\t\t? `Requested budget exceeds authority for: ${exceededBudgetFields.join(\", \")}.`\n\t\t\t\t\t\t: `Required capabilities need owner authority: ${approvalCapabilities.join(\", \")}.`,\n\t\t\t\trequestedCapabilities: approvalCapabilities,\n\t\t\t\t...(Object.keys(requestedBudget).length > 0 ? { requestedBudget } : {}),\n\t\t\t\treversible: true,\n\t\t\t\tcreatedAt: this.now(),\n\t\t\t};\n\t\t\treturn {\n\t\t\t\toutcome: \"approval-required\",\n\t\t\t\tapproval,\n\t\t\t\tdecisions,\n\t\t\t\treasonCodes: [approval.reasonCode],\n\t\t\t};\n\t\t}\n\n\t\tconst manifestsByName = new Map(input.toolManifests.map((manifest) => [manifest.toolName, manifest]));\n\t\tconst allowedManifests: ToolCapabilityManifest[] = [];\n\t\tconst toolReasonCodes: string[] = [];\n\t\tfor (const toolName of unique(input.requestedTools)) {\n\t\t\tconst manifest = manifestsByName.get(toolName);\n\t\t\tif (!manifest) {\n\t\t\t\ttoolReasonCodes.push(`unknown_tool:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!manifest.roles.includes(input.role)) {\n\t\t\t\ttoolReasonCodes.push(`tool_role_denied:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!manifest.capabilities.every((capability) => granted.includes(capability))) {\n\t\t\t\ttoolReasonCodes.push(`tool_capability_denied:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (\n\t\t\t\t!manifest.capabilities.every((capability) => {\n\t\t\t\t\tconst enforcement = CAPABILITY_ENFORCEMENT.get(capability);\n\t\t\t\t\treturn enforcement !== undefined && manifest.enforcements.includes(enforcement);\n\t\t\t\t})\n\t\t\t) {\n\t\t\t\ttoolReasonCodes.push(`tool_enforcement_missing:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tallowedManifests.push(structuredClone(manifest));\n\t\t}\n\n\t\tif (toolReasonCodes.length > 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: toolReasonCodes };\n\t\t}\n\n\t\tconst readPaths = unique(input.readPaths ?? []);\n\t\tconst writePaths = unique(input.writePaths ?? []);\n\t\tconst deniedPaths = unique(input.deniedPaths ?? []);\n\t\tif ((granted.includes(\"filesystem.read\") || granted.includes(\"worktree.read\")) && readPaths.length === 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"read_capability_missing_positive_path_scope\"] };\n\t\t}\n\t\tif ((granted.includes(\"filesystem.write\") || granted.includes(\"worktree.mutate\")) && writePaths.length === 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"write_capability_missing_positive_path_scope\"] };\n\t\t}\n\n\t\tconst grant = freezeGrant({\n\t\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\t\tgrantId: `grant-${this.createId()}`,\n\t\t\tobjectiveId: input.objectiveId,\n\t\t\ttaskId: input.taskId,\n\t\t\tattemptId: input.attemptId,\n\t\t\tsubjectId: input.subjectId,\n\t\t\trole: input.role,\n\t\t\tcapabilities: granted,\n\t\t\tallowedTools: allowedManifests.map((manifest) => manifest.toolName),\n\t\t\tresources: structuredClone(input.resources ?? []),\n\t\t\treadPaths,\n\t\t\twritePaths,\n\t\t\tdeniedPaths,\n\t\t\tbudget: intersectRiskBudgets(requestedBudget, authorityBudget),\n\t\t\tpolicyVersion: input.policyVersion,\n\t\t\tdecisionTrace: decisions,\n\t\t\tissuedAt: this.now(),\n\t\t\t...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n\t\t});\n\t\treturn { outcome: \"allow\", grant, toolManifests: allowedManifests };\n\t}\n}\n"]}

package/dist/core/orchestration/policy-compiler.js

@@ -0,0 +1,191 @@
+import { randomUUID } from "node:crypto";
+import { ORCHESTRATION_SCHEMA_VERSION, } from "./contracts.js";
+import { exceededRiskBudgetFields, intersectRiskBudgets, validateRiskBudget } from "./risk-budget.js";
+export const DEFAULT_ROLE_CAPABILITY_CEILINGS = {
+    orchestrator: ["workflow.delegate"],
+    planner: ["workflow.plan"],
+    explorer: ["filesystem.read", "worktree.read", "network.http", "service.mcp", "memory.query"],
+    implementer: ["filesystem.read", "filesystem.write", "worktree.read", "worktree.mutate", "memory.query"],
+    operator: ["filesystem.read", "worktree.read", "process.exec", "tests.execute", "network.http", "service.mcp"],
+    verifier: ["filesystem.read", "worktree.read", "process.exec", "tests.execute", "network.http", "service.mcp"],
+    database: ["memory.query", "memory.mutate"],
+};
+function unique(values) {
+    return [...new Set(values)];
+}
+function freezeGrant(grant) {
+    for (const resource of grant.resources) {
+        if (resource.metadata)
+            Object.freeze(resource.metadata);
+        Object.freeze(resource);
+    }
+    for (const decision of grant.decisionTrace)
+        Object.freeze(decision);
+    Object.freeze(grant.capabilities);
+    Object.freeze(grant.allowedTools);
+    Object.freeze(grant.resources);
+    Object.freeze(grant.readPaths);
+    Object.freeze(grant.writePaths);
+    Object.freeze(grant.deniedPaths);
+    Object.freeze(grant.budget);
+    Object.freeze(grant.decisionTrace);
+    return Object.freeze(grant);
+}
+const CAPABILITY_ENFORCEMENT = new Map([
+    ["filesystem.read", "path-scope"],
+    ["filesystem.write", "path-scope"],
+    ["worktree.read", "path-scope"],
+    ["worktree.mutate", "path-scope"],
+    ["process.exec", "process-launcher"],
+    ["tests.execute", "process-launcher"],
+    ["network.http", "service-proxy"],
+    ["service.mcp", "service-proxy"],
+    ["credentials.use", "service-proxy"],
+    ["credentials.modify", "control-plane"],
+    ["memory.query", "memory-broker"],
+    ["memory.mutate", "memory-broker"],
+    ["settings.read", "control-plane"],
+    ["settings.write", "control-plane"],
+    ["skill.read", "path-scope"],
+    ["skill.write", "path-scope"],
+    ["source.read", "path-scope"],
+    ["source.write", "path-scope"],
+    ["research.execute", "control-plane"],
+    ["workflow.plan", "control-plane"],
+    ["workflow.delegate", "control-plane"],
+    ["policy.modify", "control-plane"],
+    ["learning.propose", "control-plane"],
+    ["publish.execute", "control-plane"],
+]);
+export class ExecutionPolicyCompiler {
+    now;
+    createId;
+    roleCapabilityCeilings;
+    constructor(options = {}) {
+        this.now = options.now ?? (() => new Date().toISOString());
+        this.createId = options.createId ?? randomUUID;
+        this.roleCapabilityCeilings = options.roleCapabilityCeilings ?? DEFAULT_ROLE_CAPABILITY_CEILINGS;
+    }
+    compile(input) {
+        const required = unique(input.requiredCapabilities);
+        const requested = unique([...(input.requestedCapabilities ?? required), ...required]);
+        const authority = new Set(input.authorityCapabilities);
+        const roleCeiling = new Set(this.roleCapabilityCeilings[input.role]);
+        const decisions = [];
+        const roleDenied = [];
+        const approvalCapabilities = [];
+        const granted = [];
+        for (const capability of requested) {
+            if (!roleCeiling.has(capability)) {
+                roleDenied.push(capability);
+                decisions.push({ capability, outcome: "deny", reasonCode: "role_ceiling_denied", source: input.role });
+                continue;
+            }
+            if (!authority.has(capability)) {
+                approvalCapabilities.push(capability);
+                decisions.push({
+                    capability,
+                    outcome: "deny",
+                    reasonCode: "owner_authority_required",
+                    source: "authority",
+                });
+                continue;
+            }
+            granted.push(capability);
+            decisions.push({ capability, outcome: "allow", reasonCode: "role_and_authority_allowed", source: input.role });
+        }
+        if (roleDenied.some((capability) => required.includes(capability))) {
+            return { outcome: "deny", decisions, reasonCodes: ["required_capability_exceeds_role_ceiling"] };
+        }
+        const requestedBudget = { ...(input.requestedBudget ?? {}) };
+        const authorityBudget = { ...(input.authorityBudget ?? {}) };
+        validateRiskBudget(requestedBudget, "requestedBudget");
+        validateRiskBudget(authorityBudget, "authorityBudget");
+        const exceededBudgetFields = exceededRiskBudgetFields(requestedBudget, authorityBudget);
+        if (approvalCapabilities.some((capability) => required.includes(capability)) || exceededBudgetFields.length > 0) {
+            const approval = {
+                schemaVersion: ORCHESTRATION_SCHEMA_VERSION,
+                approvalId: `approval-${this.createId()}`,
+                objectiveId: input.objectiveId,
+                taskId: input.taskId,
+                attemptId: input.attemptId,
+                reasonCode: exceededBudgetFields.length > 0
+                    ? "requested_budget_exceeds_authority"
+                    : "required_capability_needs_authority",
+                summary: exceededBudgetFields.length > 0
+                    ? `Requested budget exceeds authority for: ${exceededBudgetFields.join(", ")}.`
+                    : `Required capabilities need owner authority: ${approvalCapabilities.join(", ")}.`,
+                requestedCapabilities: approvalCapabilities,
+                ...(Object.keys(requestedBudget).length > 0 ? { requestedBudget } : {}),
+                reversible: true,
+                createdAt: this.now(),
+            };
+            return {
+                outcome: "approval-required",
+                approval,
+                decisions,
+                reasonCodes: [approval.reasonCode],
+            };
+        }
+        const manifestsByName = new Map(input.toolManifests.map((manifest) => [manifest.toolName, manifest]));
+        const allowedManifests = [];
+        const toolReasonCodes = [];
+        for (const toolName of unique(input.requestedTools)) {
+            const manifest = manifestsByName.get(toolName);
+            if (!manifest) {
+                toolReasonCodes.push(`unknown_tool:${toolName}`);
+                continue;
+            }
+            if (!manifest.roles.includes(input.role)) {
+                toolReasonCodes.push(`tool_role_denied:${toolName}`);
+                continue;
+            }
+            if (!manifest.capabilities.every((capability) => granted.includes(capability))) {
+                toolReasonCodes.push(`tool_capability_denied:${toolName}`);
+                continue;
+            }
+            if (!manifest.capabilities.every((capability) => {
+                const enforcement = CAPABILITY_ENFORCEMENT.get(capability);
+                return enforcement !== undefined && manifest.enforcements.includes(enforcement);
+            })) {
+                toolReasonCodes.push(`tool_enforcement_missing:${toolName}`);
+                continue;
+            }
+            allowedManifests.push(structuredClone(manifest));
+        }
+        if (toolReasonCodes.length > 0) {
+            return { outcome: "deny", decisions, reasonCodes: toolReasonCodes };
+        }
+        const readPaths = unique(input.readPaths ?? []);
+        const writePaths = unique(input.writePaths ?? []);
+        const deniedPaths = unique(input.deniedPaths ?? []);
+        if ((granted.includes("filesystem.read") || granted.includes("worktree.read")) && readPaths.length === 0) {
+            return { outcome: "deny", decisions, reasonCodes: ["read_capability_missing_positive_path_scope"] };
+        }
+        if ((granted.includes("filesystem.write") || granted.includes("worktree.mutate")) && writePaths.length === 0) {
+            return { outcome: "deny", decisions, reasonCodes: ["write_capability_missing_positive_path_scope"] };
+        }
+        const grant = freezeGrant({
+            schemaVersion: ORCHESTRATION_SCHEMA_VERSION,
+            grantId: `grant-${this.createId()}`,
+            objectiveId: input.objectiveId,
+            taskId: input.taskId,
+            attemptId: input.attemptId,
+            subjectId: input.subjectId,
+            role: input.role,
+            capabilities: granted,
+            allowedTools: allowedManifests.map((manifest) => manifest.toolName),
+            resources: structuredClone(input.resources ?? []),
+            readPaths,
+            writePaths,
+            deniedPaths,
+            budget: intersectRiskBudgets(requestedBudget, authorityBudget),
+            policyVersion: input.policyVersion,
+            decisionTrace: decisions,
+            issuedAt: this.now(),
+            ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),
+        });
+        return { outcome: "allow", grant, toolManifests: allowedManifests };
+    }
+}
+//# sourceMappingURL=policy-compiler.js.map

package/dist/core/orchestration/policy-compiler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-compiler.js","sourceRoot":"","sources":["../../../src/core/orchestration/policy-compiler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAKN,4BAA4B,GAK5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtG,MAAM,CAAC,MAAM,gCAAgC,GAA+D;IAC3G,YAAY,EAAE,CAAC,mBAAmB,CAAC;IACnC,OAAO,EAAE,CAAC,eAAe,CAAC;IAC1B,QAAQ,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,CAAC;IAC7F,WAAW,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,CAAC;IACxG,QAAQ,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,CAAC;IAC9G,QAAQ,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,CAAC;IAC9G,QAAQ,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;CAC3C,CAAC;AAuCF,SAAS,MAAM,CAAI,MAAoB,EAAO;IAC7C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAAA,CAC5B;AAED,SAAS,WAAW,CAAC,KAAqB,EAAkB;IAC3D,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,QAAQ;YAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,aAAa;QAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5B;AAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAoE;IACzG,CAAC,iBAAiB,EAAE,YAAY,CAAC;IACjC,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAClC,CAAC,eAAe,EAAE,YAAY,CAAC;IAC/B,CAAC,iBAAiB,EAAE,YAAY,CAAC;IACjC,CAAC,cAAc,EAAE,kBAAkB,CAAC;IACpC,CAAC,eAAe,EAAE,kBAAkB,CAAC;IACrC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,aAAa,EAAE,eAAe,CAAC;IAChC,CAAC,iBAAiB,EAAE,eAAe,CAAC;IACpC,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACvC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,gBAAgB,EAAE,eAAe,CAAC;IACnC,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,CAAC,aAAa,EAAE,YAAY,CAAC;IAC7B,CAAC,aAAa,EAAE,YAAY,CAAC;IAC7B,CAAC,cAAc,EAAE,YAAY,CAAC;IAC9B,CAAC,kBAAkB,EAAE,eAAe,CAAC;IACrC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,mBAAmB,EAAE,eAAe,CAAC;IACtC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,kBAAkB,EAAE,eAAe,CAAC;IACrC,CAAC,iBAAiB,EAAE,eAAe,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,OAAO,uBAAuB;IAClB,GAAG,CAAe;IAClB,QAAQ,CAAe;IACvB,sBAAsB,CAA6D;IAEpG,YAAY,OAAO,GAA0B,EAAE,EAAE;QAChD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;QAC/C,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,gCAAgC,CAAC;IAAA,CACjG;IAED,OAAO,CAAC,KAAiC,EAA2B;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,IAAI,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAyB,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAwB,EAAE,CAAC;QAC3C,MAAM,oBAAoB,GAAwB,EAAE,CAAC;QACrD,MAAM,OAAO,GAAwB,EAAE,CAAC;QAExC,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvG,SAAS;YACV,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtC,SAAS,CAAC,IAAI,CAAC;oBACd,UAAU;oBACV,OAAO,EAAE,MAAM;oBACf,UAAU,EAAE,0BAA0B;oBACtC,MAAM,EAAE,WAAW;iBACnB,CAAC,CAAC;gBACH,SAAS;YACV,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACzB,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChH,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,0CAA0C,CAAC,EAAE,CAAC;QAClG,CAAC;QAED,MAAM,eAAe,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,MAAM,eAAe,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,kBAAkB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACvD,kBAAkB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACvD,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACxF,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjH,MAAM,QAAQ,GAA4B;gBACzC,aAAa,EAAE,4BAA4B;gBAC3C,UAAU,EAAE,YAAY,IAAI,CAAC,QAAQ,EAAE,EAAE;gBACzC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EACT,oBAAoB,CAAC,MAAM,GAAG,CAAC;oBAC9B,CAAC,CAAC,oCAAoC;oBACtC,CAAC,CAAC,qCAAqC;gBACzC,OAAO,EACN,oBAAoB,CAAC,MAAM,GAAG,CAAC;oBAC9B,CAAC,CAAC,2CAA2C,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC/E,CAAC,CAAC,+CAA+C,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACrF,qBAAqB,EAAE,oBAAoB;gBAC3C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACrB,CAAC;YACF,OAAO;gBACN,OAAO,EAAE,mBAAmB;gBAC5B,QAAQ;gBACR,SAAS;gBACT,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;aAClC,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtG,MAAM,gBAAgB,GAA6B,EAAE,CAAC;QACtD,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,eAAe,CAAC,IAAI,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC;gBACjD,SAAS;YACV,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,eAAe,CAAC,IAAI,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC;gBACrD,SAAS;YACV,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAChF,eAAe,CAAC,IAAI,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;gBAC3D,SAAS;YACV,CAAC;YACD,IACC,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC5C,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC3D,OAAO,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAA,CAChF,CAAC,EACD,CAAC;gBACF,eAAe,CAAC,IAAI,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;gBAC7D,SAAS;YACV,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1G,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,6CAA6C,CAAC,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9G,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,8CAA8C,CAAC,EAAE,CAAC;QACtG,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC;YACzB,aAAa,EAAE,4BAA4B;YAC3C,OAAO,EAAE,SAAS,IAAI,CAAC,QAAQ,EAAE,EAAE;YACnC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,OAAO;YACrB,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnE,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;YACjD,SAAS;YACT,UAAU;YACV,WAAW;YACX,MAAM,EAAE,oBAAoB,CAAC,eAAe,EAAE,eAAe,CAAC;YAC9D,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa,EAAE,SAAS;YACxB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAAA,CACpE;CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n\ttype ApprovalRequestContract,\n\ttype CapabilityDecision,\n\ttype ExecutionGrant,\n\ttype HarnessCapability,\n\tORCHESTRATION_SCHEMA_VERSION,\n\ttype ResourcePointer,\n\ttype RiskBudget,\n\ttype ToolCapabilityManifest,\n\ttype WorkerRole,\n} from \"./contracts.ts\";\nimport { exceededRiskBudgetFields, intersectRiskBudgets, validateRiskBudget } from \"./risk-budget.ts\";\n\nexport const DEFAULT_ROLE_CAPABILITY_CEILINGS: Readonly<Record<WorkerRole, readonly HarnessCapability[]>> = {\n\torchestrator: [\"workflow.delegate\"],\n\tplanner: [\"workflow.plan\"],\n\texplorer: [\"filesystem.read\", \"worktree.read\", \"network.http\", \"service.mcp\", \"memory.query\"],\n\timplementer: [\"filesystem.read\", \"filesystem.write\", \"worktree.read\", \"worktree.mutate\", \"memory.query\"],\n\toperator: [\"filesystem.read\", \"worktree.read\", \"process.exec\", \"tests.execute\", \"network.http\", \"service.mcp\"],\n\tverifier: [\"filesystem.read\", \"worktree.read\", \"process.exec\", \"tests.execute\", \"network.http\", \"service.mcp\"],\n\tdatabase: [\"memory.query\", \"memory.mutate\"],\n};\n\nexport interface CompileExecutionGrantInput {\n\tobjectiveId: string;\n\ttaskId: string;\n\tattemptId: string;\n\tsubjectId: string;\n\trole: WorkerRole;\n\trequiredCapabilities: readonly HarnessCapability[];\n\trequestedCapabilities?: readonly HarnessCapability[];\n\tauthorityCapabilities: readonly HarnessCapability[];\n\trequestedTools: readonly string[];\n\ttoolManifests: readonly ToolCapabilityManifest[];\n\tresources?: readonly ResourcePointer[];\n\treadPaths?: readonly string[];\n\twritePaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\trequestedBudget?: RiskBudget;\n\tauthorityBudget?: RiskBudget;\n\tpolicyVersion: string;\n\texpiresAt?: string;\n}\n\nexport type PolicyCompilationResult =\n\t| { outcome: \"allow\"; grant: ExecutionGrant; toolManifests: readonly ToolCapabilityManifest[] }\n\t| {\n\t\t\toutcome: \"approval-required\";\n\t\t\tapproval: ApprovalRequestContract;\n\t\t\tdecisions: readonly CapabilityDecision[];\n\t\t\treasonCodes: readonly string[];\n\t  }\n\t| { outcome: \"deny\"; decisions: readonly CapabilityDecision[]; reasonCodes: readonly string[] };\n\nexport interface PolicyCompilerOptions {\n\tnow?: () => string;\n\tcreateId?: () => string;\n\troleCapabilityCeilings?: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;\n}\n\nfunction unique<T>(values: readonly T[]): T[] {\n\treturn [...new Set(values)];\n}\n\nfunction freezeGrant(grant: ExecutionGrant): ExecutionGrant {\n\tfor (const resource of grant.resources) {\n\t\tif (resource.metadata) Object.freeze(resource.metadata);\n\t\tObject.freeze(resource);\n\t}\n\tfor (const decision of grant.decisionTrace) Object.freeze(decision);\n\tObject.freeze(grant.capabilities);\n\tObject.freeze(grant.allowedTools);\n\tObject.freeze(grant.resources);\n\tObject.freeze(grant.readPaths);\n\tObject.freeze(grant.writePaths);\n\tObject.freeze(grant.deniedPaths);\n\tObject.freeze(grant.budget);\n\tObject.freeze(grant.decisionTrace);\n\treturn Object.freeze(grant);\n}\n\nconst CAPABILITY_ENFORCEMENT = new Map<HarnessCapability, ToolCapabilityManifest[\"enforcements\"][number]>([\n\t[\"filesystem.read\", \"path-scope\"],\n\t[\"filesystem.write\", \"path-scope\"],\n\t[\"worktree.read\", \"path-scope\"],\n\t[\"worktree.mutate\", \"path-scope\"],\n\t[\"process.exec\", \"process-launcher\"],\n\t[\"tests.execute\", \"process-launcher\"],\n\t[\"network.http\", \"service-proxy\"],\n\t[\"service.mcp\", \"service-proxy\"],\n\t[\"credentials.use\", \"service-proxy\"],\n\t[\"credentials.modify\", \"control-plane\"],\n\t[\"memory.query\", \"memory-broker\"],\n\t[\"memory.mutate\", \"memory-broker\"],\n\t[\"settings.read\", \"control-plane\"],\n\t[\"settings.write\", \"control-plane\"],\n\t[\"skill.read\", \"path-scope\"],\n\t[\"skill.write\", \"path-scope\"],\n\t[\"source.read\", \"path-scope\"],\n\t[\"source.write\", \"path-scope\"],\n\t[\"research.execute\", \"control-plane\"],\n\t[\"workflow.plan\", \"control-plane\"],\n\t[\"workflow.delegate\", \"control-plane\"],\n\t[\"policy.modify\", \"control-plane\"],\n\t[\"learning.propose\", \"control-plane\"],\n\t[\"publish.execute\", \"control-plane\"],\n]);\n\nexport class ExecutionPolicyCompiler {\n\tprivate readonly now: () => string;\n\tprivate readonly createId: () => string;\n\tprivate readonly roleCapabilityCeilings: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;\n\n\tconstructor(options: PolicyCompilerOptions = {}) {\n\t\tthis.now = options.now ?? (() => new Date().toISOString());\n\t\tthis.createId = options.createId ?? randomUUID;\n\t\tthis.roleCapabilityCeilings = options.roleCapabilityCeilings ?? DEFAULT_ROLE_CAPABILITY_CEILINGS;\n\t}\n\n\tcompile(input: CompileExecutionGrantInput): PolicyCompilationResult {\n\t\tconst required = unique(input.requiredCapabilities);\n\t\tconst requested = unique([...(input.requestedCapabilities ?? required), ...required]);\n\t\tconst authority = new Set(input.authorityCapabilities);\n\t\tconst roleCeiling = new Set(this.roleCapabilityCeilings[input.role]);\n\t\tconst decisions: CapabilityDecision[] = [];\n\t\tconst roleDenied: HarnessCapability[] = [];\n\t\tconst approvalCapabilities: HarnessCapability[] = [];\n\t\tconst granted: HarnessCapability[] = [];\n\n\t\tfor (const capability of requested) {\n\t\t\tif (!roleCeiling.has(capability)) {\n\t\t\t\troleDenied.push(capability);\n\t\t\t\tdecisions.push({ capability, outcome: \"deny\", reasonCode: \"role_ceiling_denied\", source: input.role });\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!authority.has(capability)) {\n\t\t\t\tapprovalCapabilities.push(capability);\n\t\t\t\tdecisions.push({\n\t\t\t\t\tcapability,\n\t\t\t\t\toutcome: \"deny\",\n\t\t\t\t\treasonCode: \"owner_authority_required\",\n\t\t\t\t\tsource: \"authority\",\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tgranted.push(capability);\n\t\t\tdecisions.push({ capability, outcome: \"allow\", reasonCode: \"role_and_authority_allowed\", source: input.role });\n\t\t}\n\n\t\tif (roleDenied.some((capability) => required.includes(capability))) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"required_capability_exceeds_role_ceiling\"] };\n\t\t}\n\n\t\tconst requestedBudget = { ...(input.requestedBudget ?? {}) };\n\t\tconst authorityBudget = { ...(input.authorityBudget ?? {}) };\n\t\tvalidateRiskBudget(requestedBudget, \"requestedBudget\");\n\t\tvalidateRiskBudget(authorityBudget, \"authorityBudget\");\n\t\tconst exceededBudgetFields = exceededRiskBudgetFields(requestedBudget, authorityBudget);\n\t\tif (approvalCapabilities.some((capability) => required.includes(capability)) || exceededBudgetFields.length > 0) {\n\t\t\tconst approval: ApprovalRequestContract = {\n\t\t\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\t\t\tapprovalId: `approval-${this.createId()}`,\n\t\t\t\tobjectiveId: input.objectiveId,\n\t\t\t\ttaskId: input.taskId,\n\t\t\t\tattemptId: input.attemptId,\n\t\t\t\treasonCode:\n\t\t\t\t\texceededBudgetFields.length > 0\n\t\t\t\t\t\t? \"requested_budget_exceeds_authority\"\n\t\t\t\t\t\t: \"required_capability_needs_authority\",\n\t\t\t\tsummary:\n\t\t\t\t\texceededBudgetFields.length > 0\n\t\t\t\t\t\t? `Requested budget exceeds authority for: ${exceededBudgetFields.join(\", \")}.`\n\t\t\t\t\t\t: `Required capabilities need owner authority: ${approvalCapabilities.join(\", \")}.`,\n\t\t\t\trequestedCapabilities: approvalCapabilities,\n\t\t\t\t...(Object.keys(requestedBudget).length > 0 ? { requestedBudget } : {}),\n\t\t\t\treversible: true,\n\t\t\t\tcreatedAt: this.now(),\n\t\t\t};\n\t\t\treturn {\n\t\t\t\toutcome: \"approval-required\",\n\t\t\t\tapproval,\n\t\t\t\tdecisions,\n\t\t\t\treasonCodes: [approval.reasonCode],\n\t\t\t};\n\t\t}\n\n\t\tconst manifestsByName = new Map(input.toolManifests.map((manifest) => [manifest.toolName, manifest]));\n\t\tconst allowedManifests: ToolCapabilityManifest[] = [];\n\t\tconst toolReasonCodes: string[] = [];\n\t\tfor (const toolName of unique(input.requestedTools)) {\n\t\t\tconst manifest = manifestsByName.get(toolName);\n\t\t\tif (!manifest) {\n\t\t\t\ttoolReasonCodes.push(`unknown_tool:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!manifest.roles.includes(input.role)) {\n\t\t\t\ttoolReasonCodes.push(`tool_role_denied:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!manifest.capabilities.every((capability) => granted.includes(capability))) {\n\t\t\t\ttoolReasonCodes.push(`tool_capability_denied:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (\n\t\t\t\t!manifest.capabilities.every((capability) => {\n\t\t\t\t\tconst enforcement = CAPABILITY_ENFORCEMENT.get(capability);\n\t\t\t\t\treturn enforcement !== undefined && manifest.enforcements.includes(enforcement);\n\t\t\t\t})\n\t\t\t) {\n\t\t\t\ttoolReasonCodes.push(`tool_enforcement_missing:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tallowedManifests.push(structuredClone(manifest));\n\t\t}\n\n\t\tif (toolReasonCodes.length > 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: toolReasonCodes };\n\t\t}\n\n\t\tconst readPaths = unique(input.readPaths ?? []);\n\t\tconst writePaths = unique(input.writePaths ?? []);\n\t\tconst deniedPaths = unique(input.deniedPaths ?? []);\n\t\tif ((granted.includes(\"filesystem.read\") || granted.includes(\"worktree.read\")) && readPaths.length === 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"read_capability_missing_positive_path_scope\"] };\n\t\t}\n\t\tif ((granted.includes(\"filesystem.write\") || granted.includes(\"worktree.mutate\")) && writePaths.length === 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"write_capability_missing_positive_path_scope\"] };\n\t\t}\n\n\t\tconst grant = freezeGrant({\n\t\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\t\tgrantId: `grant-${this.createId()}`,\n\t\t\tobjectiveId: input.objectiveId,\n\t\t\ttaskId: input.taskId,\n\t\t\tattemptId: input.attemptId,\n\t\t\tsubjectId: input.subjectId,\n\t\t\trole: input.role,\n\t\t\tcapabilities: granted,\n\t\t\tallowedTools: allowedManifests.map((manifest) => manifest.toolName),\n\t\t\tresources: structuredClone(input.resources ?? []),\n\t\t\treadPaths,\n\t\t\twritePaths,\n\t\t\tdeniedPaths,\n\t\t\tbudget: intersectRiskBudgets(requestedBudget, authorityBudget),\n\t\t\tpolicyVersion: input.policyVersion,\n\t\t\tdecisionTrace: decisions,\n\t\t\tissuedAt: this.now(),\n\t\t\t...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n\t\t});\n\t\treturn { outcome: \"allow\", grant, toolManifests: allowedManifests };\n\t}\n}\n"]}

package/dist/core/orchestration/policy-gate.d.ts

@@ -0,0 +1,18 @@
+import type { CompileExecutionGrantInput, PolicyCompilationResult } from "./policy-compiler.ts";
+import { ExecutionPolicyCompiler } from "./policy-compiler.ts";
+import type { DurableTaskRuntime } from "./task-runtime.ts";
+export interface ExecutionPolicyGateOptions {
+    runtime: DurableTaskRuntime;
+    compiler?: ExecutionPolicyCompiler;
+}
+/**
+ * Atomic control-plane seam between policy evaluation and durable task state. An allow result binds
+ * its grant before execution can lease the attempt; an approval result persists the owner request.
+ */
+export declare class ExecutionPolicyGate {
+    private readonly runtime;
+    private readonly compiler;
+    constructor(options: ExecutionPolicyGateOptions);
+    evaluate(input: CompileExecutionGrantInput): PolicyCompilationResult;
+}
+//# sourceMappingURL=policy-gate.d.ts.map

package/dist/core/orchestration/policy-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-gate.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/policy-gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,WAAW,0BAA0B;IAC1C,OAAO,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACnC;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;IAEnD,YAAY,OAAO,EAAE,0BAA0B,EAG9C;IAED,QAAQ,CAAC,KAAK,EAAE,0BAA0B,GAAG,uBAAuB,CAQnE;CACD","sourcesContent":["import type { CompileExecutionGrantInput, PolicyCompilationResult } from \"./policy-compiler.ts\";\nimport { ExecutionPolicyCompiler } from \"./policy-compiler.ts\";\nimport type { DurableTaskRuntime } from \"./task-runtime.ts\";\n\nexport interface ExecutionPolicyGateOptions {\n\truntime: DurableTaskRuntime;\n\tcompiler?: ExecutionPolicyCompiler;\n}\n\n/**\n * Atomic control-plane seam between policy evaluation and durable task state. An allow result binds\n * its grant before execution can lease the attempt; an approval result persists the owner request.\n */\nexport class ExecutionPolicyGate {\n\tprivate readonly runtime: DurableTaskRuntime;\n\tprivate readonly compiler: ExecutionPolicyCompiler;\n\n\tconstructor(options: ExecutionPolicyGateOptions) {\n\t\tthis.runtime = options.runtime;\n\t\tthis.compiler = options.compiler ?? new ExecutionPolicyCompiler();\n\t}\n\n\tevaluate(input: CompileExecutionGrantInput): PolicyCompilationResult {\n\t\tconst result = this.compiler.compile(input);\n\t\tif (result.outcome === \"allow\") {\n\t\t\tthis.runtime.bindAttemptGrant(input.attemptId, result.grant);\n\t\t} else if (result.outcome === \"approval-required\") {\n\t\t\tthis.runtime.requestApproval(result.approval);\n\t\t}\n\t\treturn result;\n\t}\n}\n"]}

package/dist/core/orchestration/policy-gate.js

@@ -0,0 +1,24 @@
+import { ExecutionPolicyCompiler } from "./policy-compiler.js";
+/**
+ * Atomic control-plane seam between policy evaluation and durable task state. An allow result binds
+ * its grant before execution can lease the attempt; an approval result persists the owner request.
+ */
+export class ExecutionPolicyGate {
+    runtime;
+    compiler;
+    constructor(options) {
+        this.runtime = options.runtime;
+        this.compiler = options.compiler ?? new ExecutionPolicyCompiler();
+    }
+    evaluate(input) {
+        const result = this.compiler.compile(input);
+        if (result.outcome === "allow") {
+            this.runtime.bindAttemptGrant(input.attemptId, result.grant);
+        }
+        else if (result.outcome === "approval-required") {
+            this.runtime.requestApproval(result.approval);
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=policy-gate.js.map