npm - @caupulican/pi-adaptative - Versions diffs - 0.81.41 → 0.81.42 - Mend

@caupulican/pi-adaptative 0.81.41 → 0.81.42

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (237) hide show

package/dist/core/orchestration/profile-registry.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"profile-registry.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/profile-registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,cAAc,EACd,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,sBAAsB,EACtB,MAAM,gBAAgB,CAAC;AASxB,OAAO,EAGN,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,eAAe;IAC/B,SAAS,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC;CACvD;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,yBAAyB,CAAC;IACjC,KAAK,EAAE,cAAc,CAAC;IACtB,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAC;CACjD;AAED,MAAM,MAAM,yBAAyB,GAClC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC/C,OAAO,CAAC,uBAAuB,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,GACtD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,EAAE,CAAC;IAAC,WAAW,EAAE,SAAS,CAAC,2BAA2B,CAAC,CAAA;CAAE,CAAC;AAEpG,qBAAa,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACD;AAiBD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,4BAA4B,CAyB9F;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CA+IhF;AAMD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,oBAAoB,CAqInG;AAoBD,qBAAa,4BAA4B;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2C;IAEpE,YAAY,QAAQ,GAAE,SAAS,oBAAoB,EAAO,EA2CzD;IAED,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAM5C;IAED,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAGvD;IAED,IAAI,IAAI,oBAAoB,EAAE,CAE7B;CACD;AAED,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,eAAe,GACrB,yBAAyB,GAAG,SAAS,CAOvC;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,4BAA4B,CAAC;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,4BAA4B,CAAC;IACvC,MAAM,EAAE,eAAe,CAAC;IACxB,cAAc,EAAE,uBAAuB,CAAC;IACxC,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACjD,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IACtC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;CACtB,GAAG,yBAAyB,CAoC5B","sourcesContent":["import { describeToolCapabilityAuthority, resolveProfileToolCapability } from \"../tool-capability-policy.ts\";\nimport { isPlainRecord } from \"../util/value-guards.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationDispatchRequest,\n\tOrchestrationModelBinding,\n\tOrchestrationProfile,\n\tResourcePointer,\n\tTaskContract,\n\tToolCapabilityManifest,\n} from \"./contracts.ts\";\nimport {\n\tHARNESS_CAPABILITIES,\n\tORCHESTRATION_SCHEMA_VERSION,\n\tORCHESTRATION_THINKING_LEVELS,\n\ttoJsonObject,\n\tWORKER_ROLES,\n} from \"./contracts.ts\";\nimport { ORCHESTRATION_PROFILE_TOOL_NAMES } from \"./lane-tool-manifests.ts\";\nimport {\n\ttype CompileExecutionGrantInput,\n\tDEFAULT_ROLE_CAPABILITY_CEILINGS,\n\ttype ExecutionPolicyCompiler,\n\ttype PolicyCompilationResult,\n} from \"./policy-compiler.ts\";\nimport { RISK_BUDGET_FIELDS, validateRiskBudget } from \"./risk-budget.ts\";\n\nexport interface ModelHealthView {\n\tisHealthy(binding: OrchestrationModelBinding): boolean;\n}\n\nexport interface ProfileDispatchPlan {\n\tprofile: OrchestrationProfile;\n\tmodel: OrchestrationModelBinding;\n\tgrant: ExecutionGrant;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n}\n\nexport type ProfileDispatchPlanResult =\n\t\| { outcome: \"allow\"; plan: ProfileDispatchPlan }\n\t\| Exclude<PolicyCompilationResult, { outcome: \"allow\" }>\n\t\| { outcome: \"deny\"; decisions: readonly []; reasonCodes: readonly [\"profile_model_unavailable\"] };\n\nexport class OrchestrationProfileError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"OrchestrationProfileError\";\n\t}\n}\n\nfunction exactKeys(record: Record<string, unknown>, allowed: readonly string[]): boolean {\n\tconst allowedSet = new Set(allowed);\n\treturn Object.keys(record).every((key) => allowedSet.has(key));\n}\n\nfunction duplicateStrings(values: readonly string[]): string[] {\n\tconst seen = new Set<string>();\n\tconst duplicates = new Set<string>();\n\tfor (const value of values) {\n\t\tif (seen.has(value)) duplicates.add(value);\n\t\tseen.add(value);\n\t}\n\treturn [...duplicates];\n}\n\nexport function parseOrchestrationDispatchRequest(value: unknown): OrchestrationDispatchRequest {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Dispatch request must be an object.\");\n\tif (!exactKeys(value, [\"taskId\", \"profileId\", \"instructions\", \"resourcePointerIds\"])) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t\"Dispatch request contains an unsupported field. Model and thinking overrides are forbidden; select a profileId.\",\n\t\t);\n\t}\n\tif (\n\t\ttypeof value.taskId !== \"string\" \|\|\n\t\t!value.taskId \|\|\n\t\ttypeof value.profileId !== \"string\" \|\|\n\t\t!value.profileId \|\|\n\t\ttypeof value.instructions !== \"string\" \|\|\n\t\t!value.instructions.trim() \|\|\n\t\t!Array.isArray(value.resourcePointerIds) \|\|\n\t\t!value.resourcePointerIds.every((entry) => typeof entry === \"string\")\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Dispatch request is invalid.\");\n\t}\n\treturn {\n\t\ttaskId: value.taskId,\n\t\tprofileId: value.profileId,\n\t\tinstructions: value.instructions.trim(),\n\t\tresourcePointerIds: [...value.resourcePointerIds],\n\t};\n}\n\nexport function validateOrchestrationProfile(profile: OrchestrationProfile): void {\n\tif (profile.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' has an unsupported schema version.`);\n\t}\n\tif (!profile.profileId.trim() \|\| !profile.description.trim())\n\t\tthrow new OrchestrationProfileError(\"Profile id and description are required.\");\n\tif (profile.role !== \"orchestrator\" && profile.dispatchProfileIds.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Only orchestrator profiles may declare dispatchProfileIds ('${profile.profileId}').`,\n\t\t);\n\t}\n\tif (profile.dispatchProfileIds.includes(profile.profileId)) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot dispatch itself.`);\n\t}\n\tif (profile.requireIndependentVerification) {\n\t\tif (profile.role === \"verifier\") {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Verifier profile '${profile.profileId}' cannot require another verifier.`,\n\t\t\t);\n\t\t}\n\t\tif (!profile.verificationProfileId?.trim()) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' requires independent verification but has no verificationProfileId.`,\n\t\t\t);\n\t\t}\n\t} else if (profile.verificationProfileId !== undefined) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare verificationProfileId without requiring verification.`,\n\t\t);\n\t}\n\tif (profile.verificationProfileId === profile.profileId) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot verify itself.`);\n\t}\n\tfor (const [label, values] of [\n\t\t[\"capabilityCeiling\", profile.capabilityCeiling],\n\t\t[\"toolNames\", profile.toolNames],\n\t\t[\"resourceProfileNames\", profile.resourceProfileNames],\n\t\t[\"dispatchProfileIds\", profile.dispatchProfileIds],\n\t] as const) {\n\t\tconst duplicates = duplicateStrings(values);\n\t\tif (duplicates.length > 0) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' contains duplicate ${label}: ${duplicates.join(\", \")}.`,\n\t\t\t);\n\t\t}\n\t}\n\tconst duplicateModels = duplicateStrings(\n\t\tprofile.modelPolicy.candidates.map((candidate) => `${candidate.provider}/${candidate.modelId}`),\n\t);\n\tif (duplicateModels.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains duplicate model candidates: ${duplicateModels.join(\", \")}.`,\n\t\t);\n\t}\n\tconst roleCeiling = new Set(DEFAULT_ROLE_CAPABILITY_CEILINGS[profile.role]);\n\tconst outOfRoleCapabilities = profile.capabilityCeiling.filter((capability) => !roleCeiling.has(capability));\n\tif (outOfRoleCapabilities.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' exceeds the ${profile.role} role ceiling: ${outOfRoleCapabilities.join(\", \")}.`,\n\t\t);\n\t}\n\tif (profile.modelPolicy.candidates.length === 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' must declare a model candidate.`);\n\t}\n\tif (profile.modelPolicy.mode === \"fixed\" && profile.modelPolicy.candidates.length !== 1) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Fixed profile '${profile.profileId}' must declare exactly one model candidate.`,\n\t\t);\n\t}\n\tfor (const candidate of profile.modelPolicy.candidates) {\n\t\tif (!candidate.provider.trim() \|\| !candidate.modelId.trim()) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid model binding.`);\n\t\t}\n\t}\n\tif (!Number.isSafeInteger(profile.maxConcurrent) \|\| profile.maxConcurrent <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' maxConcurrent must be positive.`);\n\t}\n\tif (!Number.isSafeInteger(profile.leaseTtlMs) \|\| profile.leaseTtlMs <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' leaseTtlMs must be positive.`);\n\t}\n\ttry {\n\t\tvalidateRiskBudget(profile.budget, `Profile '${profile.profileId}' budget`);\n\t} catch (error) {\n\t\tthrow new OrchestrationProfileError(error instanceof Error ? error.message : String(error));\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.budget.maxWallClockMs <= 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' maxWallClockMs budget must be positive when specified.`,\n\t\t);\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.leaseTtlMs < profile.budget.maxWallClockMs) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' leaseTtlMs must cover its maxWallClockMs budget.`,\n\t\t);\n\t}\n\tconst processCapable =\n\t\tprofile.capabilityCeiling.includes(\"process.exec\") \|\| profile.capabilityCeiling.includes(\"tests.execute\");\n\tif (processCapable && (!profile.executionPolicy \|\| profile.executionPolicy.allowedExecutables.length === 0)) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' must declare executionPolicy.allowedExecutables for process capabilities.`,\n\t\t);\n\t}\n\tif (!processCapable && profile.executionPolicy) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare executionPolicy without process capabilities.`,\n\t\t);\n\t}\n\tif (profile.executionPolicy) {\n\t\tif (\n\t\t\tprofile.executionPolicy.allowedExecutables.some(\n\t\t\t\t(executable) => !executable.trim() \|\| /[\\0\\r\\n]/.test(executable),\n\t\t\t) \|\|\n\t\t\tprofile.executionPolicy.allowedEnvironmentVariables.some((name) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) \|\|\n\t\t\t!Number.isSafeInteger(profile.executionPolicy.maxOutputBytes) \|\|\n\t\t\tprofile.executionPolicy.maxOutputBytes <= 0\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' executionPolicy is invalid.`);\n\t\t}\n\t}\n\tconst unrestrictedProcessTools = profile.toolNames.filter((toolName) =>\n\t\t[\"bash\", \"python\", \"powershell\", \"run_toolkit_script\"].includes(toolName),\n\t);\n\tif (unrestrictedProcessTools.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot expose unrestricted process tools (${unrestrictedProcessTools.join(\", \")}); use run_process with executionPolicy.`,\n\t\t);\n\t}\n\tconst unknownTools = profile.toolNames.filter(\n\t\t(toolName) => !(ORCHESTRATION_PROFILE_TOOL_NAMES as readonly string[]).includes(toolName),\n\t);\n\tif (unknownTools.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains unclassified orchestration tools: ${unknownTools.join(\", \")}.`,\n\t\t);\n\t}\n\tfor (const toolName of profile.toolNames) {\n\t\tif (!resolveProfileToolCapability(profile, toolName)) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' tool '${toolName}' lacks ${describeToolCapabilityAuthority(toolName)} authority.`,\n\t\t\t);\n\t\t}\n\t}\n\ttoJsonObject({ profile });\n}\n\nfunction isStringArray(value: unknown): value is string[] {\n\treturn Array.isArray(value) && value.every((entry) => typeof entry === \"string\");\n}\n\nexport function parseOrchestrationProfile(value: unknown, sourcePath?: string): OrchestrationProfile {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Orchestration profile must be an object.\");\n\tif (\n\t\t!exactKeys(value, [\n\t\t\t\"schemaVersion\",\n\t\t\t\"profileId\",\n\t\t\t\"description\",\n\t\t\t\"role\",\n\t\t\t\"modelPolicy\",\n\t\t\t\"capabilityCeiling\",\n\t\t\t\"toolNames\",\n\t\t\t\"resourceProfileNames\",\n\t\t\t\"dispatchProfileIds\",\n\t\t\t\"executionPolicy\",\n\t\t\t\"budget\",\n\t\t\t\"maxConcurrent\",\n\t\t\t\"leaseTtlMs\",\n\t\t\t\"requireIndependentVerification\",\n\t\t\t\"verificationProfileId\",\n\t\t\t\"createdAt\",\n\t\t\t\"updatedAt\",\n\t\t])\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile contains an unsupported field.\");\n\t}\n\tconst modelPolicy = value.modelPolicy;\n\tconst budget = value.budget;\n\tconst executionPolicy = value.executionPolicy;\n\tif (\n\t\t!isPlainRecord(modelPolicy) \|\|\n\t\t!exactKeys(modelPolicy, [\"mode\", \"candidates\"]) \|\|\n\t\t!Array.isArray(modelPolicy.candidates)\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile modelPolicy is invalid.\");\n\t}\n\tif (!isPlainRecord(budget)) throw new OrchestrationProfileError(\"Orchestration profile budget is invalid.\");\n\tif (\n\t\texecutionPolicy !== undefined &&\n\t\t(!isPlainRecord(executionPolicy) \|\|\n\t\t\t!exactKeys(executionPolicy, [\"allowedExecutables\", \"allowedEnvironmentVariables\", \"maxOutputBytes\"]) \|\|\n\t\t\t!isStringArray(executionPolicy.allowedExecutables) \|\|\n\t\t\t!isStringArray(executionPolicy.allowedEnvironmentVariables) \|\|\n\t\t\t!Number.isSafeInteger(executionPolicy.maxOutputBytes))\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile executionPolicy is invalid.\");\n\t}\n\tconst candidates = modelPolicy.candidates.map((candidate) => {\n\t\tif (!isPlainRecord(candidate) \|\| !exactKeys(candidate, [\"provider\", \"modelId\", \"thinkingLevel\"])) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\tif (\n\t\t\ttypeof candidate.provider !== \"string\" \|\|\n\t\t\ttypeof candidate.modelId !== \"string\" \|\|\n\t\t\ttypeof candidate.thinkingLevel !== \"string\" \|\|\n\t\t\t!ORCHESTRATION_THINKING_LEVELS.includes(\n\t\t\t\tcandidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t\t)\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\treturn {\n\t\t\tprovider: candidate.provider,\n\t\t\tmodelId: candidate.modelId,\n\t\t\tthinkingLevel: candidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t};\n\t});\n\tif (\n\t\tvalue.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION \|\|\n\t\ttypeof value.profileId !== \"string\" \|\|\n\t\ttypeof value.description !== \"string\" \|\|\n\t\ttypeof value.role !== \"string\" \|\|\n\t\t!WORKER_ROLES.includes(value.role as (typeof WORKER_ROLES)[number]) \|\|\n\t\t(modelPolicy.mode !== \"fixed\" && modelPolicy.mode !== \"ordered-fallback\") \|\|\n\t\t!Array.isArray(value.capabilityCeiling) \|\|\n\t\t!value.capabilityCeiling.every(\n\t\t\t(capability) =>\n\t\t\t\ttypeof capability === \"string\" &&\n\t\t\t\tHARNESS_CAPABILITIES.includes(capability as (typeof HARNESS_CAPABILITIES)[number]),\n\t\t) \|\|\n\t\t!isStringArray(value.toolNames) \|\|\n\t\t!isStringArray(value.resourceProfileNames) \|\|\n\t\t!isStringArray(value.dispatchProfileIds) \|\|\n\t\t!Number.isSafeInteger(value.maxConcurrent) \|\|\n\t\t!Number.isSafeInteger(value.leaseTtlMs) \|\|\n\t\ttypeof value.requireIndependentVerification !== \"boolean\" \|\|\n\t\t(value.verificationProfileId !== undefined && typeof value.verificationProfileId !== \"string\") \|\|\n\t\ttypeof value.createdAt !== \"string\" \|\|\n\t\ttypeof value.updatedAt !== \"string\"\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile is invalid.\");\n\t}\n\tfor (const [key, candidate] of Object.entries(budget)) {\n\t\tif (\n\t\t\t!RISK_BUDGET_FIELDS.includes(key as (typeof RISK_BUDGET_FIELDS)[number]) \|\|\n\t\t\ttypeof candidate !== \"number\" \|\|\n\t\t\t!Number.isFinite(candidate) \|\|\n\t\t\tcandidate < 0\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile budget is invalid.\");\n\t\t}\n\t}\n\tconst profile = structuredClone({\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tprofileId: value.profileId,\n\t\tdescription: value.description,\n\t\trole: value.role as OrchestrationProfile[\"role\"],\n\t\tmodelPolicy: { mode: modelPolicy.mode as OrchestrationProfile[\"modelPolicy\"][\"mode\"], candidates },\n\t\tcapabilityCeiling: value.capabilityCeiling as OrchestrationProfile[\"capabilityCeiling\"],\n\t\ttoolNames: value.toolNames,\n\t\tresourceProfileNames: value.resourceProfileNames,\n\t\tdispatchProfileIds: value.dispatchProfileIds,\n\t\t...(executionPolicy\n\t\t\t? {\n\t\t\t\t\texecutionPolicy: {\n\t\t\t\t\t\tallowedExecutables: executionPolicy.allowedExecutables as string[],\n\t\t\t\t\t\tallowedEnvironmentVariables: executionPolicy.allowedEnvironmentVariables as string[],\n\t\t\t\t\t\tmaxOutputBytes: Number(executionPolicy.maxOutputBytes),\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t\tbudget,\n\t\tmaxConcurrent: Number(value.maxConcurrent),\n\t\tleaseTtlMs: Number(value.leaseTtlMs),\n\t\trequireIndependentVerification: value.requireIndependentVerification,\n\t\t...(typeof value.verificationProfileId === \"string\"\n\t\t\t? { verificationProfileId: value.verificationProfileId }\n\t\t\t: {}),\n\t\t...(sourcePath ? { sourcePath } : {}),\n\t\tcreatedAt: value.createdAt,\n\t\tupdatedAt: value.updatedAt,\n\t}) as OrchestrationProfile;\n\tvalidateOrchestrationProfile(profile);\n\treturn profile;\n}\n\nfunction freezeProfile(profile: OrchestrationProfile): OrchestrationProfile {\n\tconst clone = structuredClone(profile);\n\tfor (const candidate of clone.modelPolicy.candidates) Object.freeze(candidate);\n\tObject.freeze(clone.modelPolicy.candidates);\n\tObject.freeze(clone.modelPolicy);\n\tObject.freeze(clone.capabilityCeiling);\n\tObject.freeze(clone.toolNames);\n\tObject.freeze(clone.resourceProfileNames);\n\tObject.freeze(clone.dispatchProfileIds);\n\tif (clone.executionPolicy) {\n\t\tObject.freeze(clone.executionPolicy.allowedExecutables);\n\t\tObject.freeze(clone.executionPolicy.allowedEnvironmentVariables);\n\t\tObject.freeze(clone.executionPolicy);\n\t}\n\tObject.freeze(clone.budget);\n\treturn Object.freeze(clone);\n}\n\nexport class OrchestrationProfileRegistry {\n\tprivate readonly profiles = new Map<string, OrchestrationProfile>();\n\n\tconstructor(profiles: readonly OrchestrationProfile[] = []) {\n\t\tfor (const profile of profiles) this.register(profile);\n\t\tfor (const profile of this.profiles.values()) {\n\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\tconst target = this.profiles.get(dispatchedProfileId);\n\t\t\t\tif (!target) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' dispatches missing profile '${dispatchedProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (target.role === \"orchestrator\") {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' cannot recursively dispatch orchestrator '${dispatchedProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.verificationProfileId) {\n\t\t\t\tconst verifier = this.profiles.get(profile.verificationProfileId);\n\t\t\t\tif (!verifier) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' requires missing verifier profile '${profile.verificationProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (verifier.role !== \"verifier\") {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' verificationProfileId '${profile.verificationProfileId}' is not a verifier.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.role === \"orchestrator\") {\n\t\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\t\tconst worker = this.profiles.get(dispatchedProfileId);\n\t\t\t\t\tif (\n\t\t\t\t\t\tworker?.verificationProfileId &&\n\t\t\t\t\t\t!profile.dispatchProfileIds.includes(worker.verificationProfileId)\n\t\t\t\t\t) {\n\t\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t\t`Orchestrator '${profile.profileId}' dispatches '${worker.profileId}' but not its verifier '${worker.verificationProfileId}'.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tregister(profile: OrchestrationProfile): void {\n\t\tvalidateOrchestrationProfile(profile);\n\t\tif (this.profiles.has(profile.profileId)) {\n\t\t\tthrow new OrchestrationProfileError(`Duplicate orchestration profile '${profile.profileId}'.`);\n\t\t}\n\t\tthis.profiles.set(profile.profileId, freezeProfile(profile));\n\t}\n\n\tget(profileId: string): OrchestrationProfile \| undefined {\n\t\tconst profile = this.profiles.get(profileId);\n\t\treturn profile ? structuredClone(profile) : undefined;\n\t}\n\n\tlist(): OrchestrationProfile[] {\n\t\treturn [...this.profiles.values()].map((profile) => structuredClone(profile));\n\t}\n}\n\nexport function resolveProfileModel(\n\tprofile: OrchestrationProfile,\n\thealth: ModelHealthView,\n): OrchestrationModelBinding \| undefined {\n\tif (profile.modelPolicy.mode === \"fixed\") {\n\t\tconst fixed = profile.modelPolicy.candidates[0];\n\t\treturn fixed && health.isHealthy(fixed) ? structuredClone(fixed) : undefined;\n\t}\n\tconst selected = profile.modelPolicy.candidates.find((candidate) => health.isHealthy(candidate));\n\treturn selected ? structuredClone(selected) : undefined;\n}\n\nexport function planProfileDispatch(args: {\n\trequest: OrchestrationDispatchRequest;\n\ttask: TaskContract;\n\tattemptId: string;\n\tsubjectId: string;\n\tregistry: OrchestrationProfileRegistry;\n\thealth: ModelHealthView;\n\tpolicyCompiler: ExecutionPolicyCompiler;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n\tresources: readonly ResourcePointer[];\n\treadPaths: readonly string[];\n\twritePaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tpolicyVersion: string;\n}): ProfileDispatchPlanResult {\n\tconst profile = args.registry.get(args.request.profileId);\n\tif (!profile) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tif (profile.role !== args.task.role) {\n\t\treturn { outcome: \"deny\", decisions: [], reasonCodes: [\"required_capability_exceeds_role_ceiling\"] };\n\t}\n\tconst model = resolveProfileModel(profile, args.health);\n\tif (!model) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tconst selectedResources = args.resources.filter((resource) => args.request.resourcePointerIds.includes(resource.id));\n\tconst manifestsByName = new Map(args.toolManifests.map((manifest) => [manifest.toolName, manifest]));\n\tconst requestedTools = profile.toolNames.filter((toolName) => {\n\t\tconst manifest = manifestsByName.get(toolName);\n\t\treturn manifest?.capabilities.every((capability) => args.task.requiredCapabilities.includes(capability)) === true;\n\t});\n\tconst policyInput: CompileExecutionGrantInput = {\n\t\tobjectiveId: args.task.objectiveId,\n\t\ttaskId: args.task.taskId,\n\t\tattemptId: args.attemptId,\n\t\tsubjectId: args.subjectId,\n\t\trole: profile.role,\n\t\trequiredCapabilities: args.task.requiredCapabilities,\n\t\trequestedCapabilities: args.task.requiredCapabilities,\n\t\tauthorityCapabilities: profile.capabilityCeiling,\n\t\trequestedTools,\n\t\ttoolManifests: args.toolManifests,\n\t\tresources: selectedResources,\n\t\treadPaths: args.readPaths,\n\t\twritePaths: args.writePaths,\n\t\tdeniedPaths: args.deniedPaths,\n\t\trequestedBudget: profile.budget,\n\t\tauthorityBudget: profile.budget,\n\t\tpolicyVersion: args.policyVersion,\n\t};\n\tconst compiled = args.policyCompiler.compile(policyInput);\n\tif (compiled.outcome !== \"allow\") return compiled;\n\treturn { outcome: \"allow\", plan: { profile, model, grant: compiled.grant, toolManifests: compiled.toolManifests } };\n}\n"]}
1	+ {"version":3,"file":"profile-registry.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/profile-registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,cAAc,EACd,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EAEf,YAAY,EACZ,sBAAsB,EACtB,MAAM,gBAAgB,CAAC;AAiBxB,OAAO,EAGN,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,eAAe;IAC/B,SAAS,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC;CACvD;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,yBAAyB,CAAC;IACjC,KAAK,EAAE,cAAc,CAAC;IACtB,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAC;CACjD;AAED,MAAM,MAAM,yBAAyB,GAClC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC/C,OAAO,CAAC,uBAAuB,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,GACtD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,EAAE,CAAC;IAAC,WAAW,EAAE,SAAS,CAAC,2BAA2B,CAAC,CAAA;CAAE,CAAC;AAEpG,qBAAa,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACD;AAYD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,4BAA4B,CAiC9F;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAqLhF;AAUD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,oBAAoB,CAmJnG;AAoBD,qBAAa,4BAA4B;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2C;IAEpE,YAAY,QAAQ,GAAE,SAAS,oBAAoB,EAAO,EA2CzD;IAED,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAM5C;IAED,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAGvD;IAED,IAAI,IAAI,oBAAoB,EAAE,CAE7B;CACD;AAED,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,eAAe,GACrB,yBAAyB,GAAG,SAAS,CAOvC;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,4BAA4B,CAAC;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,4BAA4B,CAAC;IACvC,MAAM,EAAE,eAAe,CAAC;IACxB,cAAc,EAAE,uBAAuB,CAAC;IACxC,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACjD,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IACtC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;CACtB,GAAG,yBAAyB,CAoC5B","sourcesContent":["import { describeToolCapabilityAuthority, resolveProfileToolCapability } from \"../tool-capability-policy.ts\";\nimport { hasOnlyKeys, isPlainRecord } from \"../util/value-guards.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationDispatchRequest,\n\tOrchestrationModelBinding,\n\tOrchestrationProfile,\n\tResourcePointer,\n\tRiskBudget,\n\tTaskContract,\n\tToolCapabilityManifest,\n} from \"./contracts.ts\";\nimport {\n\tHARNESS_CAPABILITIES,\n\tMAX_ORCHESTRATION_COLLECTION_LENGTH,\n\tMAX_ORCHESTRATION_DESCRIPTION_LENGTH,\n\tMAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH,\n\tMAX_ORCHESTRATION_IDENTIFIER_LENGTH,\n\tMAX_ORCHESTRATION_MODEL_ID_LENGTH,\n\tMAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH,\n\tMAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES,\n\tMAX_WORKER_AUTHORITY_PATH_LENGTH,\n\tORCHESTRATION_SCHEMA_VERSION,\n\tORCHESTRATION_THINKING_LEVELS,\n\ttoJsonObject,\n\tWORKER_ROLES,\n} from \"./contracts.ts\";\nimport { ORCHESTRATION_PROFILE_TOOL_NAMES } from \"./lane-tool-manifests.ts\";\nimport {\n\ttype CompileExecutionGrantInput,\n\tDEFAULT_ROLE_CAPABILITY_CEILINGS,\n\ttype ExecutionPolicyCompiler,\n\ttype PolicyCompilationResult,\n} from \"./policy-compiler.ts\";\nimport { parseRiskBudget, validateRiskBudget } from \"./risk-budget.ts\";\n\nexport interface ModelHealthView {\n\tisHealthy(binding: OrchestrationModelBinding): boolean;\n}\n\nexport interface ProfileDispatchPlan {\n\tprofile: OrchestrationProfile;\n\tmodel: OrchestrationModelBinding;\n\tgrant: ExecutionGrant;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n}\n\nexport type ProfileDispatchPlanResult =\n\t\| { outcome: \"allow\"; plan: ProfileDispatchPlan }\n\t\| Exclude<PolicyCompilationResult, { outcome: \"allow\" }>\n\t\| { outcome: \"deny\"; decisions: readonly []; reasonCodes: readonly [\"profile_model_unavailable\"] };\n\nexport class OrchestrationProfileError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"OrchestrationProfileError\";\n\t}\n}\n\nfunction duplicateStrings(values: readonly string[]): string[] {\n\tconst seen = new Set<string>();\n\tconst duplicates = new Set<string>();\n\tfor (const value of values) {\n\t\tif (seen.has(value)) duplicates.add(value);\n\t\tseen.add(value);\n\t}\n\treturn [...duplicates];\n}\n\nexport function parseOrchestrationDispatchRequest(value: unknown): OrchestrationDispatchRequest {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Dispatch request must be an object.\");\n\tif (!hasOnlyKeys(value, [\"taskId\", \"profileId\", \"instructions\", \"resourcePointerIds\"])) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t\"Dispatch request contains an unsupported field. Model and thinking overrides are forbidden; select a profileId.\",\n\t\t);\n\t}\n\tif (\n\t\ttypeof value.taskId !== \"string\" \|\|\n\t\t!value.taskId \|\|\n\t\tvalue.taskId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\ttypeof value.profileId !== \"string\" \|\|\n\t\t!value.profileId \|\|\n\t\tvalue.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\ttypeof value.instructions !== \"string\" \|\|\n\t\tvalue.instructions.length > MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH \|\|\n\t\t!value.instructions.trim() \|\|\n\t\t!Array.isArray(value.resourcePointerIds) \|\|\n\t\tvalue.resourcePointerIds.length > MAX_ORCHESTRATION_COLLECTION_LENGTH \|\|\n\t\t!value.resourcePointerIds.every(\n\t\t\t(entry) =>\n\t\t\t\ttypeof entry === \"string\" && entry.length > 0 && entry.length <= MAX_ORCHESTRATION_IDENTIFIER_LENGTH,\n\t\t) \|\|\n\t\tnew Set(value.resourcePointerIds).size !== value.resourcePointerIds.length\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Dispatch request is invalid.\");\n\t}\n\treturn {\n\t\ttaskId: value.taskId,\n\t\tprofileId: value.profileId,\n\t\tinstructions: value.instructions.trim(),\n\t\tresourcePointerIds: [...value.resourcePointerIds],\n\t};\n}\n\nexport function validateOrchestrationProfile(profile: OrchestrationProfile): void {\n\tif (profile.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' has an unsupported schema version.`);\n\t}\n\tif (\n\t\tprofile.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\t!profile.profileId.trim() \|\|\n\t\tprofile.description.length > MAX_ORCHESTRATION_DESCRIPTION_LENGTH \|\|\n\t\t!profile.description.trim()\n\t)\n\t\tthrow new OrchestrationProfileError(\"Profile id and description are required.\");\n\tif (profile.role !== \"orchestrator\" && profile.dispatchProfileIds.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Only orchestrator profiles may declare dispatchProfileIds ('${profile.profileId}').`,\n\t\t);\n\t}\n\tif (profile.dispatchProfileIds.includes(profile.profileId)) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot dispatch itself.`);\n\t}\n\tif (profile.requireIndependentVerification) {\n\t\tif (profile.role === \"verifier\") {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Verifier profile '${profile.profileId}' cannot require another verifier.`,\n\t\t\t);\n\t\t}\n\t\tif (\n\t\t\t!profile.verificationProfileId?.trim() \|\|\n\t\t\tprofile.verificationProfileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' requires independent verification but has no verificationProfileId.`,\n\t\t\t);\n\t\t}\n\t} else if (profile.verificationProfileId !== undefined) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare verificationProfileId without requiring verification.`,\n\t\t);\n\t}\n\tif (profile.verificationProfileId === profile.profileId) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot verify itself.`);\n\t}\n\tif (\n\t\t!profile.createdAt.trim() \|\|\n\t\tprofile.createdAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\t!profile.updatedAt.trim() \|\|\n\t\tprofile.updatedAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' timestamps are invalid.`);\n\t}\n\tfor (const [label, values] of [\n\t\t[\"capabilityCeiling\", profile.capabilityCeiling],\n\t\t[\"toolNames\", profile.toolNames],\n\t\t[\"resourceProfileNames\", profile.resourceProfileNames],\n\t\t[\"dispatchProfileIds\", profile.dispatchProfileIds],\n\t] as const) {\n\t\tif (\n\t\t\tvalues.length > MAX_ORCHESTRATION_COLLECTION_LENGTH \|\|\n\t\t\tvalues.some((value) => !value.trim() \|\| value.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH)\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid ${label}.`);\n\t\t}\n\t\tconst duplicates = duplicateStrings(values);\n\t\tif (duplicates.length > 0) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' contains duplicate ${label}: ${duplicates.join(\", \")}.`,\n\t\t\t);\n\t\t}\n\t}\n\tconst roleCeiling = new Set(DEFAULT_ROLE_CAPABILITY_CEILINGS[profile.role]);\n\tconst outOfRoleCapabilities = profile.capabilityCeiling.filter((capability) => !roleCeiling.has(capability));\n\tif (outOfRoleCapabilities.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' exceeds the ${profile.role} role ceiling: ${outOfRoleCapabilities.join(\", \")}.`,\n\t\t);\n\t}\n\tif (\n\t\tprofile.modelPolicy.candidates.length === 0 \|\|\n\t\tprofile.modelPolicy.candidates.length > MAX_ORCHESTRATION_COLLECTION_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' must declare a model candidate.`);\n\t}\n\tif (profile.modelPolicy.mode === \"fixed\" && profile.modelPolicy.candidates.length !== 1) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Fixed profile '${profile.profileId}' must declare exactly one model candidate.`,\n\t\t);\n\t}\n\tfor (const candidate of profile.modelPolicy.candidates) {\n\t\tif (\n\t\t\tcandidate.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH \|\|\n\t\t\t!candidate.provider.trim() \|\|\n\t\t\tcandidate.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH \|\|\n\t\t\t!candidate.modelId.trim()\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid model binding.`);\n\t\t}\n\t}\n\tconst duplicateModels = duplicateStrings(\n\t\tprofile.modelPolicy.candidates.map((candidate) => `${candidate.provider}/${candidate.modelId}`),\n\t);\n\tif (duplicateModels.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains duplicate model candidates: ${duplicateModels.join(\", \")}.`,\n\t\t);\n\t}\n\tif (!Number.isSafeInteger(profile.maxConcurrent) \|\| profile.maxConcurrent <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' maxConcurrent must be positive.`);\n\t}\n\tif (!Number.isSafeInteger(profile.leaseTtlMs) \|\| profile.leaseTtlMs <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' leaseTtlMs must be positive.`);\n\t}\n\ttry {\n\t\tvalidateRiskBudget(profile.budget, `Profile '${profile.profileId}' budget`);\n\t} catch (error) {\n\t\tthrow new OrchestrationProfileError(error instanceof Error ? error.message : String(error));\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.budget.maxWallClockMs <= 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' maxWallClockMs budget must be positive when specified.`,\n\t\t);\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.leaseTtlMs < profile.budget.maxWallClockMs) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' leaseTtlMs must cover its maxWallClockMs budget.`,\n\t\t);\n\t}\n\tconst processCapable =\n\t\tprofile.capabilityCeiling.includes(\"process.exec\") \|\| profile.capabilityCeiling.includes(\"tests.execute\");\n\tif (processCapable && (!profile.executionPolicy \|\| profile.executionPolicy.allowedExecutables.length === 0)) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' must declare executionPolicy.allowedExecutables for process capabilities.`,\n\t\t);\n\t}\n\tif (!processCapable && profile.executionPolicy) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare executionPolicy without process capabilities.`,\n\t\t);\n\t}\n\tif (profile.executionPolicy) {\n\t\tif (\n\t\t\tprofile.executionPolicy.allowedExecutables.length > MAX_ORCHESTRATION_COLLECTION_LENGTH \|\|\n\t\t\tprofile.executionPolicy.allowedEnvironmentVariables.length > MAX_ORCHESTRATION_COLLECTION_LENGTH \|\|\n\t\t\tprofile.executionPolicy.allowedExecutables.some(\n\t\t\t\t(executable) =>\n\t\t\t\t\t!executable.trim() \|\|\n\t\t\t\t\texecutable.length > MAX_WORKER_AUTHORITY_PATH_LENGTH \|\|\n\t\t\t\t\t/[\\0\\r\\n]/.test(executable),\n\t\t\t) \|\|\n\t\t\tprofile.executionPolicy.allowedEnvironmentVariables.some(\n\t\t\t\t(name) => name.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\| !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name),\n\t\t\t) \|\|\n\t\t\t!Number.isSafeInteger(profile.executionPolicy.maxOutputBytes) \|\|\n\t\t\tprofile.executionPolicy.maxOutputBytes <= 0 \|\|\n\t\t\tprofile.executionPolicy.maxOutputBytes > MAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' executionPolicy is invalid.`);\n\t\t}\n\t}\n\tconst unrestrictedProcessTools = profile.toolNames.filter((toolName) =>\n\t\t[\"bash\", \"python\", \"powershell\", \"run_toolkit_script\"].includes(toolName),\n\t);\n\tif (unrestrictedProcessTools.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot expose unrestricted process tools (${unrestrictedProcessTools.join(\", \")}); use run_process with executionPolicy.`,\n\t\t);\n\t}\n\tconst unknownTools = profile.toolNames.filter(\n\t\t(toolName) => !(ORCHESTRATION_PROFILE_TOOL_NAMES as readonly string[]).includes(toolName),\n\t);\n\tif (unknownTools.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains unclassified orchestration tools: ${unknownTools.join(\", \")}.`,\n\t\t);\n\t}\n\tfor (const toolName of profile.toolNames) {\n\t\tif (!resolveProfileToolCapability(profile, toolName)) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' tool '${toolName}' lacks ${describeToolCapabilityAuthority(toolName)} authority.`,\n\t\t\t);\n\t\t}\n\t}\n\ttoJsonObject({ profile });\n}\n\nfunction isStringArray(value: unknown, maxLength = MAX_ORCHESTRATION_IDENTIFIER_LENGTH): value is string[] {\n\treturn (\n\t\tArray.isArray(value) &&\n\t\tvalue.length <= MAX_ORCHESTRATION_COLLECTION_LENGTH &&\n\t\tvalue.every((entry) => typeof entry === \"string\" && entry.length > 0 && entry.length <= maxLength)\n\t);\n}\n\nexport function parseOrchestrationProfile(value: unknown, sourcePath?: string): OrchestrationProfile {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Orchestration profile must be an object.\");\n\tif (\n\t\t!hasOnlyKeys(value, [\n\t\t\t\"schemaVersion\",\n\t\t\t\"profileId\",\n\t\t\t\"description\",\n\t\t\t\"role\",\n\t\t\t\"modelPolicy\",\n\t\t\t\"capabilityCeiling\",\n\t\t\t\"toolNames\",\n\t\t\t\"resourceProfileNames\",\n\t\t\t\"dispatchProfileIds\",\n\t\t\t\"executionPolicy\",\n\t\t\t\"budget\",\n\t\t\t\"maxConcurrent\",\n\t\t\t\"leaseTtlMs\",\n\t\t\t\"requireIndependentVerification\",\n\t\t\t\"verificationProfileId\",\n\t\t\t\"createdAt\",\n\t\t\t\"updatedAt\",\n\t\t])\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile contains an unsupported field.\");\n\t}\n\tconst modelPolicy = value.modelPolicy;\n\tconst rawBudget = value.budget;\n\tlet budget: RiskBudget;\n\tconst executionPolicy = value.executionPolicy;\n\tif (\n\t\t!isPlainRecord(modelPolicy) \|\|\n\t\t!hasOnlyKeys(modelPolicy, [\"mode\", \"candidates\"]) \|\|\n\t\t!Array.isArray(modelPolicy.candidates) \|\|\n\t\tmodelPolicy.candidates.length > MAX_ORCHESTRATION_COLLECTION_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile modelPolicy is invalid.\");\n\t}\n\ttry {\n\t\tbudget = parseRiskBudget(rawBudget, \"Orchestration profile budget\");\n\t} catch (error) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\terror instanceof Error ? error.message : \"Orchestration profile budget is invalid.\",\n\t\t);\n\t}\n\tif (\n\t\texecutionPolicy !== undefined &&\n\t\t(!isPlainRecord(executionPolicy) \|\|\n\t\t\t!hasOnlyKeys(executionPolicy, [\"allowedExecutables\", \"allowedEnvironmentVariables\", \"maxOutputBytes\"]) \|\|\n\t\t\t!isStringArray(executionPolicy.allowedExecutables, MAX_WORKER_AUTHORITY_PATH_LENGTH) \|\|\n\t\t\t!isStringArray(executionPolicy.allowedEnvironmentVariables) \|\|\n\t\t\t!Number.isSafeInteger(executionPolicy.maxOutputBytes))\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile executionPolicy is invalid.\");\n\t}\n\tconst candidates = modelPolicy.candidates.map((candidate) => {\n\t\tif (!isPlainRecord(candidate) \|\| !hasOnlyKeys(candidate, [\"provider\", \"modelId\", \"thinkingLevel\"])) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\tif (\n\t\t\ttypeof candidate.provider !== \"string\" \|\|\n\t\t\tcandidate.provider.length === 0 \|\|\n\t\t\tcandidate.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH \|\|\n\t\t\ttypeof candidate.modelId !== \"string\" \|\|\n\t\t\tcandidate.modelId.length === 0 \|\|\n\t\t\tcandidate.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH \|\|\n\t\t\ttypeof candidate.thinkingLevel !== \"string\" \|\|\n\t\t\t!ORCHESTRATION_THINKING_LEVELS.includes(\n\t\t\t\tcandidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t\t)\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\treturn {\n\t\t\tprovider: candidate.provider,\n\t\t\tmodelId: candidate.modelId,\n\t\t\tthinkingLevel: candidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t};\n\t});\n\tif (\n\t\tvalue.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION \|\|\n\t\ttypeof value.profileId !== \"string\" \|\|\n\t\tvalue.profileId.length === 0 \|\|\n\t\tvalue.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\ttypeof value.description !== \"string\" \|\|\n\t\tvalue.description.length === 0 \|\|\n\t\tvalue.description.length > MAX_ORCHESTRATION_DESCRIPTION_LENGTH \|\|\n\t\ttypeof value.role !== \"string\" \|\|\n\t\t!WORKER_ROLES.includes(value.role as (typeof WORKER_ROLES)[number]) \|\|\n\t\t(modelPolicy.mode !== \"fixed\" && modelPolicy.mode !== \"ordered-fallback\") \|\|\n\t\t!Array.isArray(value.capabilityCeiling) \|\|\n\t\tvalue.capabilityCeiling.length > MAX_ORCHESTRATION_COLLECTION_LENGTH \|\|\n\t\t!value.capabilityCeiling.every(\n\t\t\t(capability) =>\n\t\t\t\ttypeof capability === \"string\" &&\n\t\t\t\tHARNESS_CAPABILITIES.includes(capability as (typeof HARNESS_CAPABILITIES)[number]),\n\t\t) \|\|\n\t\t!isStringArray(value.toolNames) \|\|\n\t\t!isStringArray(value.resourceProfileNames) \|\|\n\t\t!isStringArray(value.dispatchProfileIds) \|\|\n\t\t!Number.isSafeInteger(value.maxConcurrent) \|\|\n\t\t!Number.isSafeInteger(value.leaseTtlMs) \|\|\n\t\ttypeof value.requireIndependentVerification !== \"boolean\" \|\|\n\t\t(value.verificationProfileId !== undefined &&\n\t\t\t(typeof value.verificationProfileId !== \"string\" \|\|\n\t\t\t\tvalue.verificationProfileId.length === 0 \|\|\n\t\t\t\tvalue.verificationProfileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH)) \|\|\n\t\ttypeof value.createdAt !== \"string\" \|\|\n\t\tvalue.createdAt.length === 0 \|\|\n\t\tvalue.createdAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\ttypeof value.updatedAt !== \"string\" \|\|\n\t\tvalue.updatedAt.length === 0 \|\|\n\t\tvalue.updatedAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile is invalid.\");\n\t}\n\tconst profile = structuredClone({\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tprofileId: value.profileId,\n\t\tdescription: value.description,\n\t\trole: value.role as OrchestrationProfile[\"role\"],\n\t\tmodelPolicy: { mode: modelPolicy.mode as OrchestrationProfile[\"modelPolicy\"][\"mode\"], candidates },\n\t\tcapabilityCeiling: value.capabilityCeiling as OrchestrationProfile[\"capabilityCeiling\"],\n\t\ttoolNames: value.toolNames,\n\t\tresourceProfileNames: value.resourceProfileNames,\n\t\tdispatchProfileIds: value.dispatchProfileIds,\n\t\t...(executionPolicy\n\t\t\t? {\n\t\t\t\t\texecutionPolicy: {\n\t\t\t\t\t\tallowedExecutables: executionPolicy.allowedExecutables as string[],\n\t\t\t\t\t\tallowedEnvironmentVariables: executionPolicy.allowedEnvironmentVariables as string[],\n\t\t\t\t\t\tmaxOutputBytes: Number(executionPolicy.maxOutputBytes),\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t\tbudget,\n\t\tmaxConcurrent: Number(value.maxConcurrent),\n\t\tleaseTtlMs: Number(value.leaseTtlMs),\n\t\trequireIndependentVerification: value.requireIndependentVerification,\n\t\t...(typeof value.verificationProfileId === \"string\"\n\t\t\t? { verificationProfileId: value.verificationProfileId }\n\t\t\t: {}),\n\t\t...(sourcePath ? { sourcePath } : {}),\n\t\tcreatedAt: value.createdAt,\n\t\tupdatedAt: value.updatedAt,\n\t}) as OrchestrationProfile;\n\tvalidateOrchestrationProfile(profile);\n\treturn profile;\n}\n\nfunction freezeProfile(profile: OrchestrationProfile): OrchestrationProfile {\n\tconst clone = structuredClone(profile);\n\tfor (const candidate of clone.modelPolicy.candidates) Object.freeze(candidate);\n\tObject.freeze(clone.modelPolicy.candidates);\n\tObject.freeze(clone.modelPolicy);\n\tObject.freeze(clone.capabilityCeiling);\n\tObject.freeze(clone.toolNames);\n\tObject.freeze(clone.resourceProfileNames);\n\tObject.freeze(clone.dispatchProfileIds);\n\tif (clone.executionPolicy) {\n\t\tObject.freeze(clone.executionPolicy.allowedExecutables);\n\t\tObject.freeze(clone.executionPolicy.allowedEnvironmentVariables);\n\t\tObject.freeze(clone.executionPolicy);\n\t}\n\tObject.freeze(clone.budget);\n\treturn Object.freeze(clone);\n}\n\nexport class OrchestrationProfileRegistry {\n\tprivate readonly profiles = new Map<string, OrchestrationProfile>();\n\n\tconstructor(profiles: readonly OrchestrationProfile[] = []) {\n\t\tfor (const profile of profiles) this.register(profile);\n\t\tfor (const profile of this.profiles.values()) {\n\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\tconst target = this.profiles.get(dispatchedProfileId);\n\t\t\t\tif (!target) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' dispatches missing profile '${dispatchedProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (target.role === \"orchestrator\") {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' cannot recursively dispatch orchestrator '${dispatchedProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.verificationProfileId) {\n\t\t\t\tconst verifier = this.profiles.get(profile.verificationProfileId);\n\t\t\t\tif (!verifier) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' requires missing verifier profile '${profile.verificationProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (verifier.role !== \"verifier\") {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' verificationProfileId '${profile.verificationProfileId}' is not a verifier.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.role === \"orchestrator\") {\n\t\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\t\tconst worker = this.profiles.get(dispatchedProfileId);\n\t\t\t\t\tif (\n\t\t\t\t\t\tworker?.verificationProfileId &&\n\t\t\t\t\t\t!profile.dispatchProfileIds.includes(worker.verificationProfileId)\n\t\t\t\t\t) {\n\t\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t\t`Orchestrator '${profile.profileId}' dispatches '${worker.profileId}' but not its verifier '${worker.verificationProfileId}'.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tregister(profile: OrchestrationProfile): void {\n\t\tvalidateOrchestrationProfile(profile);\n\t\tif (this.profiles.has(profile.profileId)) {\n\t\t\tthrow new OrchestrationProfileError(`Duplicate orchestration profile '${profile.profileId}'.`);\n\t\t}\n\t\tthis.profiles.set(profile.profileId, freezeProfile(profile));\n\t}\n\n\tget(profileId: string): OrchestrationProfile \| undefined {\n\t\tconst profile = this.profiles.get(profileId);\n\t\treturn profile ? structuredClone(profile) : undefined;\n\t}\n\n\tlist(): OrchestrationProfile[] {\n\t\treturn [...this.profiles.values()].map((profile) => structuredClone(profile));\n\t}\n}\n\nexport function resolveProfileModel(\n\tprofile: OrchestrationProfile,\n\thealth: ModelHealthView,\n): OrchestrationModelBinding \| undefined {\n\tif (profile.modelPolicy.mode === \"fixed\") {\n\t\tconst fixed = profile.modelPolicy.candidates[0];\n\t\treturn fixed && health.isHealthy(fixed) ? structuredClone(fixed) : undefined;\n\t}\n\tconst selected = profile.modelPolicy.candidates.find((candidate) => health.isHealthy(candidate));\n\treturn selected ? structuredClone(selected) : undefined;\n}\n\nexport function planProfileDispatch(args: {\n\trequest: OrchestrationDispatchRequest;\n\ttask: TaskContract;\n\tattemptId: string;\n\tsubjectId: string;\n\tregistry: OrchestrationProfileRegistry;\n\thealth: ModelHealthView;\n\tpolicyCompiler: ExecutionPolicyCompiler;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n\tresources: readonly ResourcePointer[];\n\treadPaths: readonly string[];\n\twritePaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tpolicyVersion: string;\n}): ProfileDispatchPlanResult {\n\tconst profile = args.registry.get(args.request.profileId);\n\tif (!profile) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tif (profile.role !== args.task.role) {\n\t\treturn { outcome: \"deny\", decisions: [], reasonCodes: [\"required_capability_exceeds_role_ceiling\"] };\n\t}\n\tconst model = resolveProfileModel(profile, args.health);\n\tif (!model) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tconst selectedResources = args.resources.filter((resource) => args.request.resourcePointerIds.includes(resource.id));\n\tconst manifestsByName = new Map(args.toolManifests.map((manifest) => [manifest.toolName, manifest]));\n\tconst requestedTools = profile.toolNames.filter((toolName) => {\n\t\tconst manifest = manifestsByName.get(toolName);\n\t\treturn manifest?.capabilities.every((capability) => args.task.requiredCapabilities.includes(capability)) === true;\n\t});\n\tconst policyInput: CompileExecutionGrantInput = {\n\t\tobjectiveId: args.task.objectiveId,\n\t\ttaskId: args.task.taskId,\n\t\tattemptId: args.attemptId,\n\t\tsubjectId: args.subjectId,\n\t\trole: profile.role,\n\t\trequiredCapabilities: args.task.requiredCapabilities,\n\t\trequestedCapabilities: args.task.requiredCapabilities,\n\t\tauthorityCapabilities: profile.capabilityCeiling,\n\t\trequestedTools,\n\t\ttoolManifests: args.toolManifests,\n\t\tresources: selectedResources,\n\t\treadPaths: args.readPaths,\n\t\twritePaths: args.writePaths,\n\t\tdeniedPaths: args.deniedPaths,\n\t\trequestedBudget: profile.budget,\n\t\tauthorityBudget: profile.budget,\n\t\tpolicyVersion: args.policyVersion,\n\t};\n\tconst compiled = args.policyCompiler.compile(policyInput);\n\tif (compiled.outcome !== \"allow\") return compiled;\n\treturn { outcome: \"allow\", plan: { profile, model, grant: compiled.grant, toolManifests: compiled.toolManifests } };\n}\n"]}

package/dist/core/orchestration/profile-registry.js CHANGED Viewed

@@ -1,19 +1,15 @@
 import { describeToolCapabilityAuthority, resolveProfileToolCapability } from "../tool-capability-policy.js";
-import { isPlainRecord } from "../util/value-guards.js";
-import { HARNESS_CAPABILITIES, ORCHESTRATION_SCHEMA_VERSION, ORCHESTRATION_THINKING_LEVELS, toJsonObject, WORKER_ROLES, } from "./contracts.js";
+import { hasOnlyKeys, isPlainRecord } from "../util/value-guards.js";
+import { HARNESS_CAPABILITIES, MAX_ORCHESTRATION_COLLECTION_LENGTH, MAX_ORCHESTRATION_DESCRIPTION_LENGTH, MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH, MAX_ORCHESTRATION_IDENTIFIER_LENGTH, MAX_ORCHESTRATION_MODEL_ID_LENGTH, MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH, MAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES, MAX_WORKER_AUTHORITY_PATH_LENGTH, ORCHESTRATION_SCHEMA_VERSION, ORCHESTRATION_THINKING_LEVELS, toJsonObject, WORKER_ROLES, } from "./contracts.js";
 import { ORCHESTRATION_PROFILE_TOOL_NAMES } from "./lane-tool-manifests.js";
 import { DEFAULT_ROLE_CAPABILITY_CEILINGS, } from "./policy-compiler.js";
-import { RISK_BUDGET_FIELDS, validateRiskBudget } from "./risk-budget.js";
+import { parseRiskBudget, validateRiskBudget } from "./risk-budget.js";
 export class OrchestrationProfileError extends Error {
     constructor(message) {
         super(message);
         this.name = "OrchestrationProfileError";
     }
 }
-function exactKeys(record, allowed) {
-    const allowedSet = new Set(allowed);
-    return Object.keys(record).every((key) => allowedSet.has(key));
-}
 function duplicateStrings(values) {
     const seen = new Set();
     const duplicates = new Set();
@@ -27,17 +23,22 @@ function duplicateStrings(values) {
 export function parseOrchestrationDispatchRequest(value) {
     if (!isPlainRecord(value))
         throw new OrchestrationProfileError("Dispatch request must be an object.");
-    if (!exactKeys(value, ["taskId", "profileId", "instructions", "resourcePointerIds"])) {
+    if (!hasOnlyKeys(value, ["taskId", "profileId", "instructions", "resourcePointerIds"])) {
         throw new OrchestrationProfileError("Dispatch request contains an unsupported field. Model and thinking overrides are forbidden; select a profileId.");
     }
     if (typeof value.taskId !== "string" ||
         !value.taskId ||
+        value.taskId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||
         typeof value.profileId !== "string" ||
         !value.profileId ||
+        value.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||
         typeof value.instructions !== "string" ||
+        value.instructions.length > MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH ||
         !value.instructions.trim() ||
         !Array.isArray(value.resourcePointerIds) ||
-        !value.resourcePointerIds.every((entry) => typeof entry === "string")) {
+        value.resourcePointerIds.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||
+        !value.resourcePointerIds.every((entry) => typeof entry === "string" && entry.length > 0 && entry.length <= MAX_ORCHESTRATION_IDENTIFIER_LENGTH) ||
+        new Set(value.resourcePointerIds).size !== value.resourcePointerIds.length) {
         throw new OrchestrationProfileError("Dispatch request is invalid.");
     }
     return {
@@ -51,7 +52,10 @@ export function validateOrchestrationProfile(profile) {
     if (profile.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION) {
         throw new OrchestrationProfileError(`Profile '${profile.profileId}' has an unsupported schema version.`);
     }
-    if (!profile.profileId.trim() || !profile.description.trim())
+    if (profile.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||
+        !profile.profileId.trim() ||
+        profile.description.length > MAX_ORCHESTRATION_DESCRIPTION_LENGTH ||
+        !profile.description.trim())
         throw new OrchestrationProfileError("Profile id and description are required.");
     if (profile.role !== "orchestrator" && profile.dispatchProfileIds.length > 0) {
         throw new OrchestrationProfileError(`Only orchestrator profiles may declare dispatchProfileIds ('${profile.profileId}').`);
@@ -63,7 +67,8 @@ export function validateOrchestrationProfile(profile) {
         if (profile.role === "verifier") {
             throw new OrchestrationProfileError(`Verifier profile '${profile.profileId}' cannot require another verifier.`);
         }
-        if (!profile.verificationProfileId?.trim()) {
+        if (!profile.verificationProfileId?.trim() ||
+            profile.verificationProfileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH) {
             throw new OrchestrationProfileError(`Profile '${profile.profileId}' requires independent verification but has no verificationProfileId.`);
         }
     }
@@ -73,37 +78,51 @@ export function validateOrchestrationProfile(profile) {
     if (profile.verificationProfileId === profile.profileId) {
         throw new OrchestrationProfileError(`Profile '${profile.profileId}' cannot verify itself.`);
     }
+    if (!profile.createdAt.trim() ||
+        profile.createdAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||
+        !profile.updatedAt.trim() ||
+        profile.updatedAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH) {
+        throw new OrchestrationProfileError(`Profile '${profile.profileId}' timestamps are invalid.`);
+    }
     for (const [label, values] of [
         ["capabilityCeiling", profile.capabilityCeiling],
         ["toolNames", profile.toolNames],
         ["resourceProfileNames", profile.resourceProfileNames],
         ["dispatchProfileIds", profile.dispatchProfileIds],
     ]) {
+        if (values.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||
+            values.some((value) => !value.trim() || value.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH)) {
+            throw new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid ${label}.`);
+        }
         const duplicates = duplicateStrings(values);
         if (duplicates.length > 0) {
             throw new OrchestrationProfileError(`Profile '${profile.profileId}' contains duplicate ${label}: ${duplicates.join(", ")}.`);
         }
     }
-    const duplicateModels = duplicateStrings(profile.modelPolicy.candidates.map((candidate) => `${candidate.provider}/${candidate.modelId}`));
-    if (duplicateModels.length > 0) {
-        throw new OrchestrationProfileError(`Profile '${profile.profileId}' contains duplicate model candidates: ${duplicateModels.join(", ")}.`);
-    }
     const roleCeiling = new Set(DEFAULT_ROLE_CAPABILITY_CEILINGS[profile.role]);
     const outOfRoleCapabilities = profile.capabilityCeiling.filter((capability) => !roleCeiling.has(capability));
     if (outOfRoleCapabilities.length > 0) {
         throw new OrchestrationProfileError(`Profile '${profile.profileId}' exceeds the ${profile.role} role ceiling: ${outOfRoleCapabilities.join(", ")}.`);
     }
-    if (profile.modelPolicy.candidates.length === 0) {
+    if (profile.modelPolicy.candidates.length === 0 ||
+        profile.modelPolicy.candidates.length > MAX_ORCHESTRATION_COLLECTION_LENGTH) {
         throw new OrchestrationProfileError(`Profile '${profile.profileId}' must declare a model candidate.`);
     }
     if (profile.modelPolicy.mode === "fixed" && profile.modelPolicy.candidates.length !== 1) {
         throw new OrchestrationProfileError(`Fixed profile '${profile.profileId}' must declare exactly one model candidate.`);
     }
     for (const candidate of profile.modelPolicy.candidates) {
-        if (!candidate.provider.trim() || !candidate.modelId.trim()) {
+        if (candidate.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH ||
+            !candidate.provider.trim() ||
+            candidate.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH ||
+            !candidate.modelId.trim()) {
             throw new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid model binding.`);
         }
     }
+    const duplicateModels = duplicateStrings(profile.modelPolicy.candidates.map((candidate) => `${candidate.provider}/${candidate.modelId}`));
+    if (duplicateModels.length > 0) {
+        throw new OrchestrationProfileError(`Profile '${profile.profileId}' contains duplicate model candidates: ${duplicateModels.join(", ")}.`);
+    }
     if (!Number.isSafeInteger(profile.maxConcurrent) || profile.maxConcurrent <= 0) {
         throw new OrchestrationProfileError(`Profile '${profile.profileId}' maxConcurrent must be positive.`);
     }
@@ -130,10 +149,15 @@ export function validateOrchestrationProfile(profile) {
         throw new OrchestrationProfileError(`Profile '${profile.profileId}' cannot declare executionPolicy without process capabilities.`);
     }
     if (profile.executionPolicy) {
-        if (profile.executionPolicy.allowedExecutables.some((executable) => !executable.trim() || /[\0\r\n]/.test(executable)) ||
-            profile.executionPolicy.allowedEnvironmentVariables.some((name) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) ||
+        if (profile.executionPolicy.allowedExecutables.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||
+            profile.executionPolicy.allowedEnvironmentVariables.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||
+            profile.executionPolicy.allowedExecutables.some((executable) => !executable.trim() ||
+                executable.length > MAX_WORKER_AUTHORITY_PATH_LENGTH ||
+                /[\0\r\n]/.test(executable)) ||
+            profile.executionPolicy.allowedEnvironmentVariables.some((name) => name.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) ||
             !Number.isSafeInteger(profile.executionPolicy.maxOutputBytes) ||
-            profile.executionPolicy.maxOutputBytes <= 0) {
+            profile.executionPolicy.maxOutputBytes <= 0 ||
+            profile.executionPolicy.maxOutputBytes > MAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES) {
             throw new OrchestrationProfileError(`Profile '${profile.profileId}' executionPolicy is invalid.`);
         }
     }
@@ -152,13 +176,15 @@ export function validateOrchestrationProfile(profile) {
     }
     toJsonObject({ profile });
 }
-function isStringArray(value) {
-    return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+function isStringArray(value, maxLength = MAX_ORCHESTRATION_IDENTIFIER_LENGTH) {
+    return (Array.isArray(value) &&
+        value.length <= MAX_ORCHESTRATION_COLLECTION_LENGTH &&
+        value.every((entry) => typeof entry === "string" && entry.length > 0 && entry.length <= maxLength));
 }
 export function parseOrchestrationProfile(value, sourcePath) {
     if (!isPlainRecord(value))
         throw new OrchestrationProfileError("Orchestration profile must be an object.");
-    if (!exactKeys(value, [
+    if (!hasOnlyKeys(value, [
         "schemaVersion",
         "profileId",
         "description",
@@ -180,29 +206,39 @@ export function parseOrchestrationProfile(value, sourcePath) {
         throw new OrchestrationProfileError("Orchestration profile contains an unsupported field.");
     }
     const modelPolicy = value.modelPolicy;
-    const budget = value.budget;
+    const rawBudget = value.budget;
+    let budget;
     const executionPolicy = value.executionPolicy;
     if (!isPlainRecord(modelPolicy) ||
-        !exactKeys(modelPolicy, ["mode", "candidates"]) ||
-        !Array.isArray(modelPolicy.candidates)) {
+        !hasOnlyKeys(modelPolicy, ["mode", "candidates"]) ||
+        !Array.isArray(modelPolicy.candidates) ||
+        modelPolicy.candidates.length > MAX_ORCHESTRATION_COLLECTION_LENGTH) {
         throw new OrchestrationProfileError("Orchestration profile modelPolicy is invalid.");
     }
-    if (!isPlainRecord(budget))
-        throw new OrchestrationProfileError("Orchestration profile budget is invalid.");
+    try {
+        budget = parseRiskBudget(rawBudget, "Orchestration profile budget");
+    }
+    catch (error) {
+        throw new OrchestrationProfileError(error instanceof Error ? error.message : "Orchestration profile budget is invalid.");
+    }
     if (executionPolicy !== undefined &&
         (!isPlainRecord(executionPolicy) ||
-            !exactKeys(executionPolicy, ["allowedExecutables", "allowedEnvironmentVariables", "maxOutputBytes"]) ||
-            !isStringArray(executionPolicy.allowedExecutables) ||
+            !hasOnlyKeys(executionPolicy, ["allowedExecutables", "allowedEnvironmentVariables", "maxOutputBytes"]) ||
+            !isStringArray(executionPolicy.allowedExecutables, MAX_WORKER_AUTHORITY_PATH_LENGTH) ||
             !isStringArray(executionPolicy.allowedEnvironmentVariables) ||
             !Number.isSafeInteger(executionPolicy.maxOutputBytes))) {
         throw new OrchestrationProfileError("Orchestration profile executionPolicy is invalid.");
     }
     const candidates = modelPolicy.candidates.map((candidate) => {
-        if (!isPlainRecord(candidate) || !exactKeys(candidate, ["provider", "modelId", "thinkingLevel"])) {
+        if (!isPlainRecord(candidate) || !hasOnlyKeys(candidate, ["provider", "modelId", "thinkingLevel"])) {
             throw new OrchestrationProfileError("Orchestration profile model candidate is invalid.");
         }
         if (typeof candidate.provider !== "string" ||
+            candidate.provider.length === 0 ||
+            candidate.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH ||
             typeof candidate.modelId !== "string" ||
+            candidate.modelId.length === 0 ||
+            candidate.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH ||
             typeof candidate.thinkingLevel !== "string" ||
             !ORCHESTRATION_THINKING_LEVELS.includes(candidate.thinkingLevel)) {
             throw new OrchestrationProfileError("Orchestration profile model candidate is invalid.");
@@ -215,11 +251,16 @@ export function parseOrchestrationProfile(value, sourcePath) {
     });
     if (value.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION ||
         typeof value.profileId !== "string" ||
+        value.profileId.length === 0 ||
+        value.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||
         typeof value.description !== "string" ||
+        value.description.length === 0 ||
+        value.description.length > MAX_ORCHESTRATION_DESCRIPTION_LENGTH ||
         typeof value.role !== "string" ||
         !WORKER_ROLES.includes(value.role) ||
         (modelPolicy.mode !== "fixed" && modelPolicy.mode !== "ordered-fallback") ||
         !Array.isArray(value.capabilityCeiling) ||
+        value.capabilityCeiling.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||
         !value.capabilityCeiling.every((capability) => typeof capability === "string" &&
             HARNESS_CAPABILITIES.includes(capability)) ||
         !isStringArray(value.toolNames) ||
@@ -228,19 +269,18 @@ export function parseOrchestrationProfile(value, sourcePath) {
         !Number.isSafeInteger(value.maxConcurrent) ||
         !Number.isSafeInteger(value.leaseTtlMs) ||
         typeof value.requireIndependentVerification !== "boolean" ||
-        (value.verificationProfileId !== undefined && typeof value.verificationProfileId !== "string") ||
+        (value.verificationProfileId !== undefined &&
+            (typeof value.verificationProfileId !== "string" ||
+                value.verificationProfileId.length === 0 ||
+                value.verificationProfileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH)) ||
         typeof value.createdAt !== "string" ||
-        typeof value.updatedAt !== "string") {
+        value.createdAt.length === 0 ||
+        value.createdAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||
+        typeof value.updatedAt !== "string" ||
+        value.updatedAt.length === 0 ||
+        value.updatedAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH) {
         throw new OrchestrationProfileError("Orchestration profile is invalid.");
     }
-    for (const [key, candidate] of Object.entries(budget)) {
-        if (!RISK_BUDGET_FIELDS.includes(key) ||
-            typeof candidate !== "number" ||
-            !Number.isFinite(candidate) ||
-            candidate < 0) {
-            throw new OrchestrationProfileError("Orchestration profile budget is invalid.");
-        }
-    }
     const profile = structuredClone({
         schemaVersion: ORCHESTRATION_SCHEMA_VERSION,
         profileId: value.profileId,

package/dist/core/orchestration/profile-registry.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"profile-registry.js","sourceRoot":"","sources":["../../../src/core/orchestration/profile-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAUxD,OAAO,EACN,oBAAoB,EACpB,4BAA4B,EAC5B,6BAA6B,EAC7B,YAAY,EACZ,YAAY,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAEN,gCAAgC,GAGhC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAkB1E,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe,EAAE;QAC5B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAAA,CACxC;CACD;AAED,SAAS,SAAS,CAAC,MAA+B,EAAE,OAA0B,EAAW;IACxF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAAA,CAC/D;AAED,SAAS,gBAAgB,CAAC,MAAyB,EAAY;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AAAA,CACvB;AAED,MAAM,UAAU,iCAAiC,CAAC,KAAc,EAAgC;IAC/F,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,qCAAqC,CAAC,CAAC;IACtG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,yBAAyB,CAClC,iHAAiH,CACjH,CAAC;IACH,CAAC;IACD,IACC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,MAAM;QACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,KAAK,CAAC,SAAS;QAChB,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;QAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACxC,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACpE,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,8BAA8B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACN,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;QACvC,kBAAkB,EAAE,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;KACjD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,4BAA4B,CAAC,OAA6B,EAAQ;IACjF,IAAI,OAAO,CAAC,aAAa,KAAK,4BAA4B,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,sCAAsC,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE;QAC3D,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,yBAAyB,CAClC,+DAA+D,OAAO,CAAC,SAAS,KAAK,CACrF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,2BAA2B,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,8BAA8B,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAClC,qBAAqB,OAAO,CAAC,SAAS,oCAAoC,CAC1E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,uEAAuE,CACpG,CAAC;QACH,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wEAAwE,CACrG,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,qBAAqB,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,yBAAyB,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI;QAC7B,CAAC,mBAAmB,EAAE,OAAO,CAAC,iBAAiB,CAAC;QAChD,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC;QAChC,CAAC,sBAAsB,EAAE,OAAO,CAAC,oBAAoB,CAAC;QACtD,CAAC,oBAAoB,EAAE,OAAO,CAAC,kBAAkB,CAAC;KACzC,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wBAAwB,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvF,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,eAAe,GAAG,gBAAgB,CACvC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAC;IACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,0CAA0C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,gCAAgC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7G,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,iBAAiB,OAAO,CAAC,IAAI,kBAAkB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/G,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,mCAAmC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,yBAAyB,CAClC,kBAAkB,OAAO,CAAC,SAAS,6CAA6C,CAChF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,sCAAsC,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,mCAAmC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,gCAAgC,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC;QACJ,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,OAAO,CAAC,SAAS,UAAU,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,0DAA0D,CACvF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACvG,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,oDAAoD,CACjF,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GACnB,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC3G,IAAI,cAAc,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,6EAA6E,CAC1G,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAChD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,gEAAgE,CAC7F,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,IACC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAC9C,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CACjE;YACD,OAAO,CAAC,eAAe,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1G,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;YAC7D,OAAO,CAAC,eAAe,CAAC,cAAc,IAAI,CAAC,EAC1C,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,+BAA+B,CAAC,CAAC;QACnG,CAAC;IACF,CAAC;IACD,MAAM,wBAAwB,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACzE,CAAC;IACF,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,+CAA+C,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CACzJ,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAC5C,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAE,gCAAsD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACzF,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,gDAAgD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,WAAW,QAAQ,WAAW,+BAA+B,CAAC,QAAQ,CAAC,aAAa,CACjH,CAAC;QACH,CAAC;IACF,CAAC;IACD,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAAA,CAC1B;AAED,SAAS,aAAa,CAAC,KAAc,EAAqB;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AAAA,CACjF;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc,EAAE,UAAmB,EAAwB;IACpG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;IAC3G,IACC,CAAC,SAAS,CAAC,KAAK,EAAE;QACjB,eAAe;QACf,WAAW;QACX,aAAa;QACb,MAAM;QACN,aAAa;QACb,mBAAmB;QACnB,WAAW;QACX,sBAAsB;QACtB,oBAAoB;QACpB,iBAAiB;QACjB,QAAQ;QACR,eAAe;QACf,YAAY;QACZ,gCAAgC;QAChC,uBAAuB;QACvB,WAAW;QACX,WAAW;KACX,CAAC,EACD,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,sDAAsD,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAC9C,IACC,CAAC,aAAa,CAAC,WAAW,CAAC;QAC3B,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC/C,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,EACrC,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,+CAA+C,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;IAC5G,IACC,eAAe,KAAK,SAAS;QAC7B,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC;YAC/B,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC,oBAAoB,EAAE,6BAA6B,EAAE,gBAAgB,CAAC,CAAC;YACpG,CAAC,aAAa,CAAC,eAAe,CAAC,kBAAkB,CAAC;YAClD,CAAC,aAAa,CAAC,eAAe,CAAC,2BAA2B,CAAC;YAC3D,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,EACtD,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;QAC1F,CAAC;QACD,IACC,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;YACtC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;YACrC,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ;YAC3C,CAAC,6BAA6B,CAAC,QAAQ,CACtC,SAAS,CAAC,aAA+D,CACzE,EACA,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;YACN,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,aAAa,EAAE,SAAS,CAAC,aAA+D;SACxF,CAAC;IAAA,CACF,CAAC,CAAC;IACH,IACC,KAAK,CAAC,aAAa,KAAK,4BAA4B;QACpD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAqC,CAAC;QACnE,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,kBAAkB,CAAC;QACzE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACvC,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAC7B,CAAC,UAAU,EAAE,EAAE,CACd,OAAO,UAAU,KAAK,QAAQ;YAC9B,oBAAoB,CAAC,QAAQ,CAAC,UAAmD,CAAC,CACnF;QACD,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,CAAC,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAC1C,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACxC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QACvC,OAAO,KAAK,CAAC,8BAA8B,KAAK,SAAS;QACzD,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,qBAAqB,KAAK,QAAQ,CAAC;QAC9F,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAClC,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,IACC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAA0C,CAAC;YACxE,OAAO,SAAS,KAAK,QAAQ;YAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC3B,SAAS,GAAG,CAAC,EACZ,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;QACjF,CAAC;IACF,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC;QAC/B,aAAa,EAAE,4BAA4B;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAoC;QAChD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAmD,EAAE,UAAU,EAAE;QAClG,iBAAiB,EAAE,KAAK,CAAC,iBAA8D;QACvF,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,GAAG,CAAC,eAAe;YAClB,CAAC,CAAC;gBACA,eAAe,EAAE;oBAChB,kBAAkB,EAAE,eAAe,CAAC,kBAA8B;oBAClE,2BAA2B,EAAE,eAAe,CAAC,2BAAuC;oBACpF,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC;iBACtD;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QACpC,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,GAAG,CAAC,OAAO,KAAK,CAAC,qBAAqB,KAAK,QAAQ;YAClD,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC1B,CAAyB,CAAC;IAC3B,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,aAAa,CAAC,OAA6B,EAAwB;IAC3E,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,UAAU;QAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5B;AAED,MAAM,OAAO,4BAA4B;IACvB,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEpE,YAAY,QAAQ,GAAoC,EAAE,EAAE;QAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,KAAK,MAAM,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBACtD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,iCAAiC,mBAAmB,IAAI,CACrF,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACpC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,+CAA+C,mBAAmB,IAAI,CACnG,CAAC;gBACH,CAAC;YACF,CAAC;YACD,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wCAAwC,OAAO,CAAC,qBAAqB,IAAI,CACtG,CAAC;gBACH,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAClC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,4BAA4B,OAAO,CAAC,qBAAqB,sBAAsB,CAC5G,CAAC;gBACH,CAAC;YACF,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,KAAK,MAAM,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;oBAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;oBACtD,IACC,MAAM,EAAE,qBAAqB;wBAC7B,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,EACjE,CAAC;wBACF,MAAM,IAAI,yBAAyB,CAClC,iBAAiB,OAAO,CAAC,SAAS,iBAAiB,MAAM,CAAC,SAAS,2BAA2B,MAAM,CAAC,qBAAqB,IAAI,CAC9H,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IAAA,CACD;IAED,QAAQ,CAAC,OAA6B,EAAQ;QAC7C,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,yBAAyB,CAAC,oCAAoC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,CAC7D;IAED,GAAG,CAAC,SAAiB,EAAoC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAAA,CACtD;IAED,IAAI,GAA2B;QAC9B,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,CAC9E;CACD;AAED,MAAM,UAAU,mBAAmB,CAClC,OAA6B,EAC7B,MAAuB,EACiB;IACxC,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACjG,OAAO,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACxD;AAED,MAAM,UAAU,mBAAmB,CAAC,IAcnC,EAA6B;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IACpG,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,0CAA0C,CAAC,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IAClG,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACrH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC;IAAA,CAClH,CAAC,CAAC;IACH,MAAM,WAAW,GAA+B;QAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;QAClC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;QACxB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB;QACpD,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB;QACrD,qBAAqB,EAAE,OAAO,CAAC,iBAAiB;QAChD,cAAc;QACd,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;KACjC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;AAAA,CACpH","sourcesContent":["import { describeToolCapabilityAuthority, resolveProfileToolCapability } from \"../tool-capability-policy.ts\";\nimport { isPlainRecord } from \"../util/value-guards.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationDispatchRequest,\n\tOrchestrationModelBinding,\n\tOrchestrationProfile,\n\tResourcePointer,\n\tTaskContract,\n\tToolCapabilityManifest,\n} from \"./contracts.ts\";\nimport {\n\tHARNESS_CAPABILITIES,\n\tORCHESTRATION_SCHEMA_VERSION,\n\tORCHESTRATION_THINKING_LEVELS,\n\ttoJsonObject,\n\tWORKER_ROLES,\n} from \"./contracts.ts\";\nimport { ORCHESTRATION_PROFILE_TOOL_NAMES } from \"./lane-tool-manifests.ts\";\nimport {\n\ttype CompileExecutionGrantInput,\n\tDEFAULT_ROLE_CAPABILITY_CEILINGS,\n\ttype ExecutionPolicyCompiler,\n\ttype PolicyCompilationResult,\n} from \"./policy-compiler.ts\";\nimport { RISK_BUDGET_FIELDS, validateRiskBudget } from \"./risk-budget.ts\";\n\nexport interface ModelHealthView {\n\tisHealthy(binding: OrchestrationModelBinding): boolean;\n}\n\nexport interface ProfileDispatchPlan {\n\tprofile: OrchestrationProfile;\n\tmodel: OrchestrationModelBinding;\n\tgrant: ExecutionGrant;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n}\n\nexport type ProfileDispatchPlanResult =\n\t\| { outcome: \"allow\"; plan: ProfileDispatchPlan }\n\t\| Exclude<PolicyCompilationResult, { outcome: \"allow\" }>\n\t\| { outcome: \"deny\"; decisions: readonly []; reasonCodes: readonly [\"profile_model_unavailable\"] };\n\nexport class OrchestrationProfileError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"OrchestrationProfileError\";\n\t}\n}\n\nfunction exactKeys(record: Record<string, unknown>, allowed: readonly string[]): boolean {\n\tconst allowedSet = new Set(allowed);\n\treturn Object.keys(record).every((key) => allowedSet.has(key));\n}\n\nfunction duplicateStrings(values: readonly string[]): string[] {\n\tconst seen = new Set<string>();\n\tconst duplicates = new Set<string>();\n\tfor (const value of values) {\n\t\tif (seen.has(value)) duplicates.add(value);\n\t\tseen.add(value);\n\t}\n\treturn [...duplicates];\n}\n\nexport function parseOrchestrationDispatchRequest(value: unknown): OrchestrationDispatchRequest {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Dispatch request must be an object.\");\n\tif (!exactKeys(value, [\"taskId\", \"profileId\", \"instructions\", \"resourcePointerIds\"])) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t\"Dispatch request contains an unsupported field. Model and thinking overrides are forbidden; select a profileId.\",\n\t\t);\n\t}\n\tif (\n\t\ttypeof value.taskId !== \"string\" \|\|\n\t\t!value.taskId \|\|\n\t\ttypeof value.profileId !== \"string\" \|\|\n\t\t!value.profileId \|\|\n\t\ttypeof value.instructions !== \"string\" \|\|\n\t\t!value.instructions.trim() \|\|\n\t\t!Array.isArray(value.resourcePointerIds) \|\|\n\t\t!value.resourcePointerIds.every((entry) => typeof entry === \"string\")\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Dispatch request is invalid.\");\n\t}\n\treturn {\n\t\ttaskId: value.taskId,\n\t\tprofileId: value.profileId,\n\t\tinstructions: value.instructions.trim(),\n\t\tresourcePointerIds: [...value.resourcePointerIds],\n\t};\n}\n\nexport function validateOrchestrationProfile(profile: OrchestrationProfile): void {\n\tif (profile.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' has an unsupported schema version.`);\n\t}\n\tif (!profile.profileId.trim() \|\| !profile.description.trim())\n\t\tthrow new OrchestrationProfileError(\"Profile id and description are required.\");\n\tif (profile.role !== \"orchestrator\" && profile.dispatchProfileIds.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Only orchestrator profiles may declare dispatchProfileIds ('${profile.profileId}').`,\n\t\t);\n\t}\n\tif (profile.dispatchProfileIds.includes(profile.profileId)) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot dispatch itself.`);\n\t}\n\tif (profile.requireIndependentVerification) {\n\t\tif (profile.role === \"verifier\") {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Verifier profile '${profile.profileId}' cannot require another verifier.`,\n\t\t\t);\n\t\t}\n\t\tif (!profile.verificationProfileId?.trim()) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' requires independent verification but has no verificationProfileId.`,\n\t\t\t);\n\t\t}\n\t} else if (profile.verificationProfileId !== undefined) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare verificationProfileId without requiring verification.`,\n\t\t);\n\t}\n\tif (profile.verificationProfileId === profile.profileId) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot verify itself.`);\n\t}\n\tfor (const [label, values] of [\n\t\t[\"capabilityCeiling\", profile.capabilityCeiling],\n\t\t[\"toolNames\", profile.toolNames],\n\t\t[\"resourceProfileNames\", profile.resourceProfileNames],\n\t\t[\"dispatchProfileIds\", profile.dispatchProfileIds],\n\t] as const) {\n\t\tconst duplicates = duplicateStrings(values);\n\t\tif (duplicates.length > 0) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' contains duplicate ${label}: ${duplicates.join(\", \")}.`,\n\t\t\t);\n\t\t}\n\t}\n\tconst duplicateModels = duplicateStrings(\n\t\tprofile.modelPolicy.candidates.map((candidate) => `${candidate.provider}/${candidate.modelId}`),\n\t);\n\tif (duplicateModels.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains duplicate model candidates: ${duplicateModels.join(\", \")}.`,\n\t\t);\n\t}\n\tconst roleCeiling = new Set(DEFAULT_ROLE_CAPABILITY_CEILINGS[profile.role]);\n\tconst outOfRoleCapabilities = profile.capabilityCeiling.filter((capability) => !roleCeiling.has(capability));\n\tif (outOfRoleCapabilities.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' exceeds the ${profile.role} role ceiling: ${outOfRoleCapabilities.join(\", \")}.`,\n\t\t);\n\t}\n\tif (profile.modelPolicy.candidates.length === 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' must declare a model candidate.`);\n\t}\n\tif (profile.modelPolicy.mode === \"fixed\" && profile.modelPolicy.candidates.length !== 1) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Fixed profile '${profile.profileId}' must declare exactly one model candidate.`,\n\t\t);\n\t}\n\tfor (const candidate of profile.modelPolicy.candidates) {\n\t\tif (!candidate.provider.trim() \|\| !candidate.modelId.trim()) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid model binding.`);\n\t\t}\n\t}\n\tif (!Number.isSafeInteger(profile.maxConcurrent) \|\| profile.maxConcurrent <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' maxConcurrent must be positive.`);\n\t}\n\tif (!Number.isSafeInteger(profile.leaseTtlMs) \|\| profile.leaseTtlMs <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' leaseTtlMs must be positive.`);\n\t}\n\ttry {\n\t\tvalidateRiskBudget(profile.budget, `Profile '${profile.profileId}' budget`);\n\t} catch (error) {\n\t\tthrow new OrchestrationProfileError(error instanceof Error ? error.message : String(error));\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.budget.maxWallClockMs <= 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' maxWallClockMs budget must be positive when specified.`,\n\t\t);\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.leaseTtlMs < profile.budget.maxWallClockMs) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' leaseTtlMs must cover its maxWallClockMs budget.`,\n\t\t);\n\t}\n\tconst processCapable =\n\t\tprofile.capabilityCeiling.includes(\"process.exec\") \|\| profile.capabilityCeiling.includes(\"tests.execute\");\n\tif (processCapable && (!profile.executionPolicy \|\| profile.executionPolicy.allowedExecutables.length === 0)) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' must declare executionPolicy.allowedExecutables for process capabilities.`,\n\t\t);\n\t}\n\tif (!processCapable && profile.executionPolicy) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare executionPolicy without process capabilities.`,\n\t\t);\n\t}\n\tif (profile.executionPolicy) {\n\t\tif (\n\t\t\tprofile.executionPolicy.allowedExecutables.some(\n\t\t\t\t(executable) => !executable.trim() \|\| /[\\0\\r\\n]/.test(executable),\n\t\t\t) \|\|\n\t\t\tprofile.executionPolicy.allowedEnvironmentVariables.some((name) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) \|\|\n\t\t\t!Number.isSafeInteger(profile.executionPolicy.maxOutputBytes) \|\|\n\t\t\tprofile.executionPolicy.maxOutputBytes <= 0\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' executionPolicy is invalid.`);\n\t\t}\n\t}\n\tconst unrestrictedProcessTools = profile.toolNames.filter((toolName) =>\n\t\t[\"bash\", \"python\", \"powershell\", \"run_toolkit_script\"].includes(toolName),\n\t);\n\tif (unrestrictedProcessTools.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot expose unrestricted process tools (${unrestrictedProcessTools.join(\", \")}); use run_process with executionPolicy.`,\n\t\t);\n\t}\n\tconst unknownTools = profile.toolNames.filter(\n\t\t(toolName) => !(ORCHESTRATION_PROFILE_TOOL_NAMES as readonly string[]).includes(toolName),\n\t);\n\tif (unknownTools.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains unclassified orchestration tools: ${unknownTools.join(\", \")}.`,\n\t\t);\n\t}\n\tfor (const toolName of profile.toolNames) {\n\t\tif (!resolveProfileToolCapability(profile, toolName)) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' tool '${toolName}' lacks ${describeToolCapabilityAuthority(toolName)} authority.`,\n\t\t\t);\n\t\t}\n\t}\n\ttoJsonObject({ profile });\n}\n\nfunction isStringArray(value: unknown): value is string[] {\n\treturn Array.isArray(value) && value.every((entry) => typeof entry === \"string\");\n}\n\nexport function parseOrchestrationProfile(value: unknown, sourcePath?: string): OrchestrationProfile {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Orchestration profile must be an object.\");\n\tif (\n\t\t!exactKeys(value, [\n\t\t\t\"schemaVersion\",\n\t\t\t\"profileId\",\n\t\t\t\"description\",\n\t\t\t\"role\",\n\t\t\t\"modelPolicy\",\n\t\t\t\"capabilityCeiling\",\n\t\t\t\"toolNames\",\n\t\t\t\"resourceProfileNames\",\n\t\t\t\"dispatchProfileIds\",\n\t\t\t\"executionPolicy\",\n\t\t\t\"budget\",\n\t\t\t\"maxConcurrent\",\n\t\t\t\"leaseTtlMs\",\n\t\t\t\"requireIndependentVerification\",\n\t\t\t\"verificationProfileId\",\n\t\t\t\"createdAt\",\n\t\t\t\"updatedAt\",\n\t\t])\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile contains an unsupported field.\");\n\t}\n\tconst modelPolicy = value.modelPolicy;\n\tconst budget = value.budget;\n\tconst executionPolicy = value.executionPolicy;\n\tif (\n\t\t!isPlainRecord(modelPolicy) \|\|\n\t\t!exactKeys(modelPolicy, [\"mode\", \"candidates\"]) \|\|\n\t\t!Array.isArray(modelPolicy.candidates)\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile modelPolicy is invalid.\");\n\t}\n\tif (!isPlainRecord(budget)) throw new OrchestrationProfileError(\"Orchestration profile budget is invalid.\");\n\tif (\n\t\texecutionPolicy !== undefined &&\n\t\t(!isPlainRecord(executionPolicy) \|\|\n\t\t\t!exactKeys(executionPolicy, [\"allowedExecutables\", \"allowedEnvironmentVariables\", \"maxOutputBytes\"]) \|\|\n\t\t\t!isStringArray(executionPolicy.allowedExecutables) \|\|\n\t\t\t!isStringArray(executionPolicy.allowedEnvironmentVariables) \|\|\n\t\t\t!Number.isSafeInteger(executionPolicy.maxOutputBytes))\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile executionPolicy is invalid.\");\n\t}\n\tconst candidates = modelPolicy.candidates.map((candidate) => {\n\t\tif (!isPlainRecord(candidate) \|\| !exactKeys(candidate, [\"provider\", \"modelId\", \"thinkingLevel\"])) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\tif (\n\t\t\ttypeof candidate.provider !== \"string\" \|\|\n\t\t\ttypeof candidate.modelId !== \"string\" \|\|\n\t\t\ttypeof candidate.thinkingLevel !== \"string\" \|\|\n\t\t\t!ORCHESTRATION_THINKING_LEVELS.includes(\n\t\t\t\tcandidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t\t)\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\treturn {\n\t\t\tprovider: candidate.provider,\n\t\t\tmodelId: candidate.modelId,\n\t\t\tthinkingLevel: candidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t};\n\t});\n\tif (\n\t\tvalue.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION \|\|\n\t\ttypeof value.profileId !== \"string\" \|\|\n\t\ttypeof value.description !== \"string\" \|\|\n\t\ttypeof value.role !== \"string\" \|\|\n\t\t!WORKER_ROLES.includes(value.role as (typeof WORKER_ROLES)[number]) \|\|\n\t\t(modelPolicy.mode !== \"fixed\" && modelPolicy.mode !== \"ordered-fallback\") \|\|\n\t\t!Array.isArray(value.capabilityCeiling) \|\|\n\t\t!value.capabilityCeiling.every(\n\t\t\t(capability) =>\n\t\t\t\ttypeof capability === \"string\" &&\n\t\t\t\tHARNESS_CAPABILITIES.includes(capability as (typeof HARNESS_CAPABILITIES)[number]),\n\t\t) \|\|\n\t\t!isStringArray(value.toolNames) \|\|\n\t\t!isStringArray(value.resourceProfileNames) \|\|\n\t\t!isStringArray(value.dispatchProfileIds) \|\|\n\t\t!Number.isSafeInteger(value.maxConcurrent) \|\|\n\t\t!Number.isSafeInteger(value.leaseTtlMs) \|\|\n\t\ttypeof value.requireIndependentVerification !== \"boolean\" \|\|\n\t\t(value.verificationProfileId !== undefined && typeof value.verificationProfileId !== \"string\") \|\|\n\t\ttypeof value.createdAt !== \"string\" \|\|\n\t\ttypeof value.updatedAt !== \"string\"\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile is invalid.\");\n\t}\n\tfor (const [key, candidate] of Object.entries(budget)) {\n\t\tif (\n\t\t\t!RISK_BUDGET_FIELDS.includes(key as (typeof RISK_BUDGET_FIELDS)[number]) \|\|\n\t\t\ttypeof candidate !== \"number\" \|\|\n\t\t\t!Number.isFinite(candidate) \|\|\n\t\t\tcandidate < 0\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile budget is invalid.\");\n\t\t}\n\t}\n\tconst profile = structuredClone({\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tprofileId: value.profileId,\n\t\tdescription: value.description,\n\t\trole: value.role as OrchestrationProfile[\"role\"],\n\t\tmodelPolicy: { mode: modelPolicy.mode as OrchestrationProfile[\"modelPolicy\"][\"mode\"], candidates },\n\t\tcapabilityCeiling: value.capabilityCeiling as OrchestrationProfile[\"capabilityCeiling\"],\n\t\ttoolNames: value.toolNames,\n\t\tresourceProfileNames: value.resourceProfileNames,\n\t\tdispatchProfileIds: value.dispatchProfileIds,\n\t\t...(executionPolicy\n\t\t\t? {\n\t\t\t\t\texecutionPolicy: {\n\t\t\t\t\t\tallowedExecutables: executionPolicy.allowedExecutables as string[],\n\t\t\t\t\t\tallowedEnvironmentVariables: executionPolicy.allowedEnvironmentVariables as string[],\n\t\t\t\t\t\tmaxOutputBytes: Number(executionPolicy.maxOutputBytes),\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t\tbudget,\n\t\tmaxConcurrent: Number(value.maxConcurrent),\n\t\tleaseTtlMs: Number(value.leaseTtlMs),\n\t\trequireIndependentVerification: value.requireIndependentVerification,\n\t\t...(typeof value.verificationProfileId === \"string\"\n\t\t\t? { verificationProfileId: value.verificationProfileId }\n\t\t\t: {}),\n\t\t...(sourcePath ? { sourcePath } : {}),\n\t\tcreatedAt: value.createdAt,\n\t\tupdatedAt: value.updatedAt,\n\t}) as OrchestrationProfile;\n\tvalidateOrchestrationProfile(profile);\n\treturn profile;\n}\n\nfunction freezeProfile(profile: OrchestrationProfile): OrchestrationProfile {\n\tconst clone = structuredClone(profile);\n\tfor (const candidate of clone.modelPolicy.candidates) Object.freeze(candidate);\n\tObject.freeze(clone.modelPolicy.candidates);\n\tObject.freeze(clone.modelPolicy);\n\tObject.freeze(clone.capabilityCeiling);\n\tObject.freeze(clone.toolNames);\n\tObject.freeze(clone.resourceProfileNames);\n\tObject.freeze(clone.dispatchProfileIds);\n\tif (clone.executionPolicy) {\n\t\tObject.freeze(clone.executionPolicy.allowedExecutables);\n\t\tObject.freeze(clone.executionPolicy.allowedEnvironmentVariables);\n\t\tObject.freeze(clone.executionPolicy);\n\t}\n\tObject.freeze(clone.budget);\n\treturn Object.freeze(clone);\n}\n\nexport class OrchestrationProfileRegistry {\n\tprivate readonly profiles = new Map<string, OrchestrationProfile>();\n\n\tconstructor(profiles: readonly OrchestrationProfile[] = []) {\n\t\tfor (const profile of profiles) this.register(profile);\n\t\tfor (const profile of this.profiles.values()) {\n\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\tconst target = this.profiles.get(dispatchedProfileId);\n\t\t\t\tif (!target) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' dispatches missing profile '${dispatchedProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (target.role === \"orchestrator\") {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' cannot recursively dispatch orchestrator '${dispatchedProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.verificationProfileId) {\n\t\t\t\tconst verifier = this.profiles.get(profile.verificationProfileId);\n\t\t\t\tif (!verifier) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' requires missing verifier profile '${profile.verificationProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (verifier.role !== \"verifier\") {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' verificationProfileId '${profile.verificationProfileId}' is not a verifier.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.role === \"orchestrator\") {\n\t\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\t\tconst worker = this.profiles.get(dispatchedProfileId);\n\t\t\t\t\tif (\n\t\t\t\t\t\tworker?.verificationProfileId &&\n\t\t\t\t\t\t!profile.dispatchProfileIds.includes(worker.verificationProfileId)\n\t\t\t\t\t) {\n\t\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t\t`Orchestrator '${profile.profileId}' dispatches '${worker.profileId}' but not its verifier '${worker.verificationProfileId}'.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tregister(profile: OrchestrationProfile): void {\n\t\tvalidateOrchestrationProfile(profile);\n\t\tif (this.profiles.has(profile.profileId)) {\n\t\t\tthrow new OrchestrationProfileError(`Duplicate orchestration profile '${profile.profileId}'.`);\n\t\t}\n\t\tthis.profiles.set(profile.profileId, freezeProfile(profile));\n\t}\n\n\tget(profileId: string): OrchestrationProfile \| undefined {\n\t\tconst profile = this.profiles.get(profileId);\n\t\treturn profile ? structuredClone(profile) : undefined;\n\t}\n\n\tlist(): OrchestrationProfile[] {\n\t\treturn [...this.profiles.values()].map((profile) => structuredClone(profile));\n\t}\n}\n\nexport function resolveProfileModel(\n\tprofile: OrchestrationProfile,\n\thealth: ModelHealthView,\n): OrchestrationModelBinding \| undefined {\n\tif (profile.modelPolicy.mode === \"fixed\") {\n\t\tconst fixed = profile.modelPolicy.candidates[0];\n\t\treturn fixed && health.isHealthy(fixed) ? structuredClone(fixed) : undefined;\n\t}\n\tconst selected = profile.modelPolicy.candidates.find((candidate) => health.isHealthy(candidate));\n\treturn selected ? structuredClone(selected) : undefined;\n}\n\nexport function planProfileDispatch(args: {\n\trequest: OrchestrationDispatchRequest;\n\ttask: TaskContract;\n\tattemptId: string;\n\tsubjectId: string;\n\tregistry: OrchestrationProfileRegistry;\n\thealth: ModelHealthView;\n\tpolicyCompiler: ExecutionPolicyCompiler;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n\tresources: readonly ResourcePointer[];\n\treadPaths: readonly string[];\n\twritePaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tpolicyVersion: string;\n}): ProfileDispatchPlanResult {\n\tconst profile = args.registry.get(args.request.profileId);\n\tif (!profile) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tif (profile.role !== args.task.role) {\n\t\treturn { outcome: \"deny\", decisions: [], reasonCodes: [\"required_capability_exceeds_role_ceiling\"] };\n\t}\n\tconst model = resolveProfileModel(profile, args.health);\n\tif (!model) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tconst selectedResources = args.resources.filter((resource) => args.request.resourcePointerIds.includes(resource.id));\n\tconst manifestsByName = new Map(args.toolManifests.map((manifest) => [manifest.toolName, manifest]));\n\tconst requestedTools = profile.toolNames.filter((toolName) => {\n\t\tconst manifest = manifestsByName.get(toolName);\n\t\treturn manifest?.capabilities.every((capability) => args.task.requiredCapabilities.includes(capability)) === true;\n\t});\n\tconst policyInput: CompileExecutionGrantInput = {\n\t\tobjectiveId: args.task.objectiveId,\n\t\ttaskId: args.task.taskId,\n\t\tattemptId: args.attemptId,\n\t\tsubjectId: args.subjectId,\n\t\trole: profile.role,\n\t\trequiredCapabilities: args.task.requiredCapabilities,\n\t\trequestedCapabilities: args.task.requiredCapabilities,\n\t\tauthorityCapabilities: profile.capabilityCeiling,\n\t\trequestedTools,\n\t\ttoolManifests: args.toolManifests,\n\t\tresources: selectedResources,\n\t\treadPaths: args.readPaths,\n\t\twritePaths: args.writePaths,\n\t\tdeniedPaths: args.deniedPaths,\n\t\trequestedBudget: profile.budget,\n\t\tauthorityBudget: profile.budget,\n\t\tpolicyVersion: args.policyVersion,\n\t};\n\tconst compiled = args.policyCompiler.compile(policyInput);\n\tif (compiled.outcome !== \"allow\") return compiled;\n\treturn { outcome: \"allow\", plan: { profile, model, grant: compiled.grant, toolManifests: compiled.toolManifests } };\n}\n"]}
1	+ {"version":3,"file":"profile-registry.js","sourceRoot":"","sources":["../../../src/core/orchestration/profile-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC7G,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAWrE,OAAO,EACN,oBAAoB,EACpB,mCAAmC,EACnC,oCAAoC,EACpC,8CAA8C,EAC9C,mCAAmC,EACnC,iCAAiC,EACjC,uCAAuC,EACvC,sCAAsC,EACtC,gCAAgC,EAChC,4BAA4B,EAC5B,6BAA6B,EAC7B,YAAY,EACZ,YAAY,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAEN,gCAAgC,GAGhC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAkBvE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe,EAAE;QAC5B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAAA,CACxC;CACD;AAED,SAAS,gBAAgB,CAAC,MAAyB,EAAY;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AAAA,CACvB;AAED,MAAM,UAAU,iCAAiC,CAAC,KAAc,EAAgC;IAC/F,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,qCAAqC,CAAC,CAAC;IACtG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,yBAAyB,CAClC,iHAAiH,CACjH,CAAC;IACH,CAAC;IACD,IACC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,MAAM;QACb,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,mCAAmC;QACzD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,KAAK,CAAC,SAAS;QAChB,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC5D,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,8CAA8C;QAC1E,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;QAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACxC,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,mCAAmC;QACrE,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAC9B,CAAC,KAAK,EAAE,EAAE,CACT,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,mCAAmC,CACrG;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,kBAAkB,CAAC,MAAM,EACzE,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,8BAA8B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACN,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;QACvC,kBAAkB,EAAE,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;KACjD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,4BAA4B,CAAC,OAA6B,EAAQ;IACjF,IAAI,OAAO,CAAC,aAAa,KAAK,4BAA4B,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,sCAAsC,CAAC,CAAC;IAC1G,CAAC;IACD,IACC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC9D,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACzB,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,oCAAoC;QACjE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE;QAE3B,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,yBAAyB,CAClC,+DAA+D,OAAO,CAAC,SAAS,KAAK,CACrF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,2BAA2B,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,8BAA8B,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAClC,qBAAqB,OAAO,CAAC,SAAS,oCAAoC,CAC1E,CAAC;QACH,CAAC;QACD,IACC,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,EAAE;YACtC,OAAO,CAAC,qBAAqB,CAAC,MAAM,GAAG,mCAAmC,EACzE,CAAC;YACF,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,uEAAuE,CACpG,CAAC;QACH,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wEAAwE,CACrG,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,qBAAqB,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,yBAAyB,CAAC,CAAC;IAC7F,CAAC;IACD,IACC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACzB,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC9D,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACzB,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC,EAC7D,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,2BAA2B,CAAC,CAAC;IAC/F,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI;QAC7B,CAAC,mBAAmB,EAAE,OAAO,CAAC,iBAAiB,CAAC;QAChD,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC;QAChC,CAAC,sBAAsB,EAAE,OAAO,CAAC,oBAAoB,CAAC;QACtD,CAAC,oBAAoB,EAAE,OAAO,CAAC,kBAAkB,CAAC;KACzC,EAAE,CAAC;QACZ,IACC,MAAM,CAAC,MAAM,GAAG,mCAAmC;YACnD,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,mCAAmC,CAAC,EAC1F,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,yBAAyB,KAAK,GAAG,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wBAAwB,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvF,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,gCAAgC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7G,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,iBAAiB,OAAO,CAAC,IAAI,kBAAkB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/G,CAAC;IACH,CAAC;IACD,IACC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC3C,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,mCAAmC,EAC1E,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,mCAAmC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,yBAAyB,CAClC,kBAAkB,OAAO,CAAC,SAAS,6CAA6C,CAChF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QACxD,IACC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,uCAAuC;YACnE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE;YAC1B,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,iCAAiC;YAC5D,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EACxB,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,sCAAsC,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IACD,MAAM,eAAe,GAAG,gBAAgB,CACvC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAC;IACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,0CAA0C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,mCAAmC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,gCAAgC,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC;QACJ,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,OAAO,CAAC,SAAS,UAAU,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,0DAA0D,CACvF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACvG,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,oDAAoD,CACjF,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GACnB,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC3G,IAAI,cAAc,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,6EAA6E,CAC1G,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAChD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,gEAAgE,CAC7F,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,IACC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,GAAG,mCAAmC;YACvF,OAAO,CAAC,eAAe,CAAC,2BAA2B,CAAC,MAAM,GAAG,mCAAmC;YAChG,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAC9C,CAAC,UAAU,EAAE,EAAE,CACd,CAAC,UAAU,CAAC,IAAI,EAAE;gBAClB,UAAU,CAAC,MAAM,GAAG,gCAAgC;gBACpD,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAC5B;YACD,OAAO,CAAC,eAAe,CAAC,2BAA2B,CAAC,IAAI,CACvD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,mCAAmC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CACrG;YACD,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;YAC7D,OAAO,CAAC,eAAe,CAAC,cAAc,IAAI,CAAC;YAC3C,OAAO,CAAC,eAAe,CAAC,cAAc,GAAG,sCAAsC,EAC9E,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,+BAA+B,CAAC,CAAC;QACnG,CAAC;IACF,CAAC;IACD,MAAM,wBAAwB,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACzE,CAAC;IACF,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,+CAA+C,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CACzJ,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAC5C,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAE,gCAAsD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACzF,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,gDAAgD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,WAAW,QAAQ,WAAW,+BAA+B,CAAC,QAAQ,CAAC,aAAa,CACjH,CAAC;QACH,CAAC;IACF,CAAC;IACD,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAAA,CAC1B;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,SAAS,GAAG,mCAAmC,EAAqB;IAC1G,OAAO,CACN,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,IAAI,mCAAmC;QACnD,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,CAClG,CAAC;AAAA,CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc,EAAE,UAAmB,EAAwB;IACpG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;IAC3G,IACC,CAAC,WAAW,CAAC,KAAK,EAAE;QACnB,eAAe;QACf,WAAW;QACX,aAAa;QACb,MAAM;QACN,aAAa;QACb,mBAAmB;QACnB,WAAW;QACX,sBAAsB;QACtB,oBAAoB;QACpB,iBAAiB;QACjB,QAAQ;QACR,eAAe;QACf,YAAY;QACZ,gCAAgC;QAChC,uBAAuB;QACvB,WAAW;QACX,WAAW;KACX,CAAC,EACD,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,sDAAsD,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAkB,CAAC;IACvB,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAC9C,IACC,CAAC,aAAa,CAAC,WAAW,CAAC;QAC3B,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACjD,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;QACtC,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,mCAAmC,EAClE,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,+CAA+C,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0CAA0C,CACnF,CAAC;IACH,CAAC;IACD,IACC,eAAe,KAAK,SAAS;QAC7B,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC;YAC/B,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC,oBAAoB,EAAE,6BAA6B,EAAE,gBAAgB,CAAC,CAAC;YACtG,CAAC,aAAa,CAAC,eAAe,CAAC,kBAAkB,EAAE,gCAAgC,CAAC;YACpF,CAAC,aAAa,CAAC,eAAe,CAAC,2BAA2B,CAAC;YAC3D,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,EACtD,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;QAC1F,CAAC;QACD,IACC,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;YACtC,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC/B,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,uCAAuC;YACnE,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;YACrC,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAC9B,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,iCAAiC;YAC5D,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ;YAC3C,CAAC,6BAA6B,CAAC,QAAQ,CACtC,SAAS,CAAC,aAA+D,CACzE,EACA,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;YACN,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,aAAa,EAAE,SAAS,CAAC,aAA+D;SACxF,CAAC;IAAA,CACF,CAAC,CAAC;IACH,IACC,KAAK,CAAC,aAAa,KAAK,4BAA4B;QACpD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC5D,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC9B,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,oCAAoC;QAC/D,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAqC,CAAC;QACnE,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,kBAAkB,CAAC;QACzE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACvC,KAAK,CAAC,iBAAiB,CAAC,MAAM,GAAG,mCAAmC;QACpE,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAC7B,CAAC,UAAU,EAAE,EAAE,CACd,OAAO,UAAU,KAAK,QAAQ;YAC9B,oBAAoB,CAAC,QAAQ,CAAC,UAAmD,CAAC,CACnF;QACD,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,CAAC,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAC1C,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACxC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QACvC,OAAO,KAAK,CAAC,8BAA8B,KAAK,SAAS;QACzD,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,CAAC,OAAO,KAAK,CAAC,qBAAqB,KAAK,QAAQ;gBAC/C,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC;gBACxC,KAAK,CAAC,qBAAqB,CAAC,MAAM,GAAG,mCAAmC,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC5D,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC,EAC3D,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC;QAC/B,aAAa,EAAE,4BAA4B;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAoC;QAChD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAmD,EAAE,UAAU,EAAE;QAClG,iBAAiB,EAAE,KAAK,CAAC,iBAA8D;QACvF,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,GAAG,CAAC,eAAe;YAClB,CAAC,CAAC;gBACA,eAAe,EAAE;oBAChB,kBAAkB,EAAE,eAAe,CAAC,kBAA8B;oBAClE,2BAA2B,EAAE,eAAe,CAAC,2BAAuC;oBACpF,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC;iBACtD;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QACpC,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,GAAG,CAAC,OAAO,KAAK,CAAC,qBAAqB,KAAK,QAAQ;YAClD,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC1B,CAAyB,CAAC;IAC3B,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,aAAa,CAAC,OAA6B,EAAwB;IAC3E,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,UAAU;QAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5B;AAED,MAAM,OAAO,4BAA4B;IACvB,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEpE,YAAY,QAAQ,GAAoC,EAAE,EAAE;QAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,KAAK,MAAM,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBACtD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,iCAAiC,mBAAmB,IAAI,CACrF,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACpC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,+CAA+C,mBAAmB,IAAI,CACnG,CAAC;gBACH,CAAC;YACF,CAAC;YACD,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wCAAwC,OAAO,CAAC,qBAAqB,IAAI,CACtG,CAAC;gBACH,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAClC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,4BAA4B,OAAO,CAAC,qBAAqB,sBAAsB,CAC5G,CAAC;gBACH,CAAC;YACF,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,KAAK,MAAM,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;oBAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;oBACtD,IACC,MAAM,EAAE,qBAAqB;wBAC7B,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,EACjE,CAAC;wBACF,MAAM,IAAI,yBAAyB,CAClC,iBAAiB,OAAO,CAAC,SAAS,iBAAiB,MAAM,CAAC,SAAS,2BAA2B,MAAM,CAAC,qBAAqB,IAAI,CAC9H,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IAAA,CACD;IAED,QAAQ,CAAC,OAA6B,EAAQ;QAC7C,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,yBAAyB,CAAC,oCAAoC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,CAC7D;IAED,GAAG,CAAC,SAAiB,EAAoC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAAA,CACtD;IAED,IAAI,GAA2B;QAC9B,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,CAC9E;CACD;AAED,MAAM,UAAU,mBAAmB,CAClC,OAA6B,EAC7B,MAAuB,EACiB;IACxC,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACjG,OAAO,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACxD;AAED,MAAM,UAAU,mBAAmB,CAAC,IAcnC,EAA6B;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IACpG,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,0CAA0C,CAAC,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IAClG,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACrH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC;IAAA,CAClH,CAAC,CAAC;IACH,MAAM,WAAW,GAA+B;QAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;QAClC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;QACxB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB;QACpD,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB;QACrD,qBAAqB,EAAE,OAAO,CAAC,iBAAiB;QAChD,cAAc;QACd,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;KACjC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;AAAA,CACpH","sourcesContent":["import { describeToolCapabilityAuthority, resolveProfileToolCapability } from \"../tool-capability-policy.ts\";\nimport { hasOnlyKeys, isPlainRecord } from \"../util/value-guards.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationDispatchRequest,\n\tOrchestrationModelBinding,\n\tOrchestrationProfile,\n\tResourcePointer,\n\tRiskBudget,\n\tTaskContract,\n\tToolCapabilityManifest,\n} from \"./contracts.ts\";\nimport {\n\tHARNESS_CAPABILITIES,\n\tMAX_ORCHESTRATION_COLLECTION_LENGTH,\n\tMAX_ORCHESTRATION_DESCRIPTION_LENGTH,\n\tMAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH,\n\tMAX_ORCHESTRATION_IDENTIFIER_LENGTH,\n\tMAX_ORCHESTRATION_MODEL_ID_LENGTH,\n\tMAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH,\n\tMAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES,\n\tMAX_WORKER_AUTHORITY_PATH_LENGTH,\n\tORCHESTRATION_SCHEMA_VERSION,\n\tORCHESTRATION_THINKING_LEVELS,\n\ttoJsonObject,\n\tWORKER_ROLES,\n} from \"./contracts.ts\";\nimport { ORCHESTRATION_PROFILE_TOOL_NAMES } from \"./lane-tool-manifests.ts\";\nimport {\n\ttype CompileExecutionGrantInput,\n\tDEFAULT_ROLE_CAPABILITY_CEILINGS,\n\ttype ExecutionPolicyCompiler,\n\ttype PolicyCompilationResult,\n} from \"./policy-compiler.ts\";\nimport { parseRiskBudget, validateRiskBudget } from \"./risk-budget.ts\";\n\nexport interface ModelHealthView {\n\tisHealthy(binding: OrchestrationModelBinding): boolean;\n}\n\nexport interface ProfileDispatchPlan {\n\tprofile: OrchestrationProfile;\n\tmodel: OrchestrationModelBinding;\n\tgrant: ExecutionGrant;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n}\n\nexport type ProfileDispatchPlanResult =\n\t\| { outcome: \"allow\"; plan: ProfileDispatchPlan }\n\t\| Exclude<PolicyCompilationResult, { outcome: \"allow\" }>\n\t\| { outcome: \"deny\"; decisions: readonly []; reasonCodes: readonly [\"profile_model_unavailable\"] };\n\nexport class OrchestrationProfileError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"OrchestrationProfileError\";\n\t}\n}\n\nfunction duplicateStrings(values: readonly string[]): string[] {\n\tconst seen = new Set<string>();\n\tconst duplicates = new Set<string>();\n\tfor (const value of values) {\n\t\tif (seen.has(value)) duplicates.add(value);\n\t\tseen.add(value);\n\t}\n\treturn [...duplicates];\n}\n\nexport function parseOrchestrationDispatchRequest(value: unknown): OrchestrationDispatchRequest {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Dispatch request must be an object.\");\n\tif (!hasOnlyKeys(value, [\"taskId\", \"profileId\", \"instructions\", \"resourcePointerIds\"])) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t\"Dispatch request contains an unsupported field. Model and thinking overrides are forbidden; select a profileId.\",\n\t\t);\n\t}\n\tif (\n\t\ttypeof value.taskId !== \"string\" \|\|\n\t\t!value.taskId \|\|\n\t\tvalue.taskId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\ttypeof value.profileId !== \"string\" \|\|\n\t\t!value.profileId \|\|\n\t\tvalue.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\ttypeof value.instructions !== \"string\" \|\|\n\t\tvalue.instructions.length > MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH \|\|\n\t\t!value.instructions.trim() \|\|\n\t\t!Array.isArray(value.resourcePointerIds) \|\|\n\t\tvalue.resourcePointerIds.length > MAX_ORCHESTRATION_COLLECTION_LENGTH \|\|\n\t\t!value.resourcePointerIds.every(\n\t\t\t(entry) =>\n\t\t\t\ttypeof entry === \"string\" && entry.length > 0 && entry.length <= MAX_ORCHESTRATION_IDENTIFIER_LENGTH,\n\t\t) \|\|\n\t\tnew Set(value.resourcePointerIds).size !== value.resourcePointerIds.length\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Dispatch request is invalid.\");\n\t}\n\treturn {\n\t\ttaskId: value.taskId,\n\t\tprofileId: value.profileId,\n\t\tinstructions: value.instructions.trim(),\n\t\tresourcePointerIds: [...value.resourcePointerIds],\n\t};\n}\n\nexport function validateOrchestrationProfile(profile: OrchestrationProfile): void {\n\tif (profile.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' has an unsupported schema version.`);\n\t}\n\tif (\n\t\tprofile.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\t!profile.profileId.trim() \|\|\n\t\tprofile.description.length > MAX_ORCHESTRATION_DESCRIPTION_LENGTH \|\|\n\t\t!profile.description.trim()\n\t)\n\t\tthrow new OrchestrationProfileError(\"Profile id and description are required.\");\n\tif (profile.role !== \"orchestrator\" && profile.dispatchProfileIds.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Only orchestrator profiles may declare dispatchProfileIds ('${profile.profileId}').`,\n\t\t);\n\t}\n\tif (profile.dispatchProfileIds.includes(profile.profileId)) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot dispatch itself.`);\n\t}\n\tif (profile.requireIndependentVerification) {\n\t\tif (profile.role === \"verifier\") {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Verifier profile '${profile.profileId}' cannot require another verifier.`,\n\t\t\t);\n\t\t}\n\t\tif (\n\t\t\t!profile.verificationProfileId?.trim() \|\|\n\t\t\tprofile.verificationProfileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' requires independent verification but has no verificationProfileId.`,\n\t\t\t);\n\t\t}\n\t} else if (profile.verificationProfileId !== undefined) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare verificationProfileId without requiring verification.`,\n\t\t);\n\t}\n\tif (profile.verificationProfileId === profile.profileId) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot verify itself.`);\n\t}\n\tif (\n\t\t!profile.createdAt.trim() \|\|\n\t\tprofile.createdAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\t!profile.updatedAt.trim() \|\|\n\t\tprofile.updatedAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' timestamps are invalid.`);\n\t}\n\tfor (const [label, values] of [\n\t\t[\"capabilityCeiling\", profile.capabilityCeiling],\n\t\t[\"toolNames\", profile.toolNames],\n\t\t[\"resourceProfileNames\", profile.resourceProfileNames],\n\t\t[\"dispatchProfileIds\", profile.dispatchProfileIds],\n\t] as const) {\n\t\tif (\n\t\t\tvalues.length > MAX_ORCHESTRATION_COLLECTION_LENGTH \|\|\n\t\t\tvalues.some((value) => !value.trim() \|\| value.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH)\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid ${label}.`);\n\t\t}\n\t\tconst duplicates = duplicateStrings(values);\n\t\tif (duplicates.length > 0) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' contains duplicate ${label}: ${duplicates.join(\", \")}.`,\n\t\t\t);\n\t\t}\n\t}\n\tconst roleCeiling = new Set(DEFAULT_ROLE_CAPABILITY_CEILINGS[profile.role]);\n\tconst outOfRoleCapabilities = profile.capabilityCeiling.filter((capability) => !roleCeiling.has(capability));\n\tif (outOfRoleCapabilities.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' exceeds the ${profile.role} role ceiling: ${outOfRoleCapabilities.join(\", \")}.`,\n\t\t);\n\t}\n\tif (\n\t\tprofile.modelPolicy.candidates.length === 0 \|\|\n\t\tprofile.modelPolicy.candidates.length > MAX_ORCHESTRATION_COLLECTION_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' must declare a model candidate.`);\n\t}\n\tif (profile.modelPolicy.mode === \"fixed\" && profile.modelPolicy.candidates.length !== 1) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Fixed profile '${profile.profileId}' must declare exactly one model candidate.`,\n\t\t);\n\t}\n\tfor (const candidate of profile.modelPolicy.candidates) {\n\t\tif (\n\t\t\tcandidate.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH \|\|\n\t\t\t!candidate.provider.trim() \|\|\n\t\t\tcandidate.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH \|\|\n\t\t\t!candidate.modelId.trim()\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid model binding.`);\n\t\t}\n\t}\n\tconst duplicateModels = duplicateStrings(\n\t\tprofile.modelPolicy.candidates.map((candidate) => `${candidate.provider}/${candidate.modelId}`),\n\t);\n\tif (duplicateModels.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains duplicate model candidates: ${duplicateModels.join(\", \")}.`,\n\t\t);\n\t}\n\tif (!Number.isSafeInteger(profile.maxConcurrent) \|\| profile.maxConcurrent <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' maxConcurrent must be positive.`);\n\t}\n\tif (!Number.isSafeInteger(profile.leaseTtlMs) \|\| profile.leaseTtlMs <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' leaseTtlMs must be positive.`);\n\t}\n\ttry {\n\t\tvalidateRiskBudget(profile.budget, `Profile '${profile.profileId}' budget`);\n\t} catch (error) {\n\t\tthrow new OrchestrationProfileError(error instanceof Error ? error.message : String(error));\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.budget.maxWallClockMs <= 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' maxWallClockMs budget must be positive when specified.`,\n\t\t);\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.leaseTtlMs < profile.budget.maxWallClockMs) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' leaseTtlMs must cover its maxWallClockMs budget.`,\n\t\t);\n\t}\n\tconst processCapable =\n\t\tprofile.capabilityCeiling.includes(\"process.exec\") \|\| profile.capabilityCeiling.includes(\"tests.execute\");\n\tif (processCapable && (!profile.executionPolicy \|\| profile.executionPolicy.allowedExecutables.length === 0)) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' must declare executionPolicy.allowedExecutables for process capabilities.`,\n\t\t);\n\t}\n\tif (!processCapable && profile.executionPolicy) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare executionPolicy without process capabilities.`,\n\t\t);\n\t}\n\tif (profile.executionPolicy) {\n\t\tif (\n\t\t\tprofile.executionPolicy.allowedExecutables.length > MAX_ORCHESTRATION_COLLECTION_LENGTH \|\|\n\t\t\tprofile.executionPolicy.allowedEnvironmentVariables.length > MAX_ORCHESTRATION_COLLECTION_LENGTH \|\|\n\t\t\tprofile.executionPolicy.allowedExecutables.some(\n\t\t\t\t(executable) =>\n\t\t\t\t\t!executable.trim() \|\|\n\t\t\t\t\texecutable.length > MAX_WORKER_AUTHORITY_PATH_LENGTH \|\|\n\t\t\t\t\t/[\\0\\r\\n]/.test(executable),\n\t\t\t) \|\|\n\t\t\tprofile.executionPolicy.allowedEnvironmentVariables.some(\n\t\t\t\t(name) => name.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\| !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name),\n\t\t\t) \|\|\n\t\t\t!Number.isSafeInteger(profile.executionPolicy.maxOutputBytes) \|\|\n\t\t\tprofile.executionPolicy.maxOutputBytes <= 0 \|\|\n\t\t\tprofile.executionPolicy.maxOutputBytes > MAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' executionPolicy is invalid.`);\n\t\t}\n\t}\n\tconst unrestrictedProcessTools = profile.toolNames.filter((toolName) =>\n\t\t[\"bash\", \"python\", \"powershell\", \"run_toolkit_script\"].includes(toolName),\n\t);\n\tif (unrestrictedProcessTools.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot expose unrestricted process tools (${unrestrictedProcessTools.join(\", \")}); use run_process with executionPolicy.`,\n\t\t);\n\t}\n\tconst unknownTools = profile.toolNames.filter(\n\t\t(toolName) => !(ORCHESTRATION_PROFILE_TOOL_NAMES as readonly string[]).includes(toolName),\n\t);\n\tif (unknownTools.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains unclassified orchestration tools: ${unknownTools.join(\", \")}.`,\n\t\t);\n\t}\n\tfor (const toolName of profile.toolNames) {\n\t\tif (!resolveProfileToolCapability(profile, toolName)) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' tool '${toolName}' lacks ${describeToolCapabilityAuthority(toolName)} authority.`,\n\t\t\t);\n\t\t}\n\t}\n\ttoJsonObject({ profile });\n}\n\nfunction isStringArray(value: unknown, maxLength = MAX_ORCHESTRATION_IDENTIFIER_LENGTH): value is string[] {\n\treturn (\n\t\tArray.isArray(value) &&\n\t\tvalue.length <= MAX_ORCHESTRATION_COLLECTION_LENGTH &&\n\t\tvalue.every((entry) => typeof entry === \"string\" && entry.length > 0 && entry.length <= maxLength)\n\t);\n}\n\nexport function parseOrchestrationProfile(value: unknown, sourcePath?: string): OrchestrationProfile {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Orchestration profile must be an object.\");\n\tif (\n\t\t!hasOnlyKeys(value, [\n\t\t\t\"schemaVersion\",\n\t\t\t\"profileId\",\n\t\t\t\"description\",\n\t\t\t\"role\",\n\t\t\t\"modelPolicy\",\n\t\t\t\"capabilityCeiling\",\n\t\t\t\"toolNames\",\n\t\t\t\"resourceProfileNames\",\n\t\t\t\"dispatchProfileIds\",\n\t\t\t\"executionPolicy\",\n\t\t\t\"budget\",\n\t\t\t\"maxConcurrent\",\n\t\t\t\"leaseTtlMs\",\n\t\t\t\"requireIndependentVerification\",\n\t\t\t\"verificationProfileId\",\n\t\t\t\"createdAt\",\n\t\t\t\"updatedAt\",\n\t\t])\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile contains an unsupported field.\");\n\t}\n\tconst modelPolicy = value.modelPolicy;\n\tconst rawBudget = value.budget;\n\tlet budget: RiskBudget;\n\tconst executionPolicy = value.executionPolicy;\n\tif (\n\t\t!isPlainRecord(modelPolicy) \|\|\n\t\t!hasOnlyKeys(modelPolicy, [\"mode\", \"candidates\"]) \|\|\n\t\t!Array.isArray(modelPolicy.candidates) \|\|\n\t\tmodelPolicy.candidates.length > MAX_ORCHESTRATION_COLLECTION_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile modelPolicy is invalid.\");\n\t}\n\ttry {\n\t\tbudget = parseRiskBudget(rawBudget, \"Orchestration profile budget\");\n\t} catch (error) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\terror instanceof Error ? error.message : \"Orchestration profile budget is invalid.\",\n\t\t);\n\t}\n\tif (\n\t\texecutionPolicy !== undefined &&\n\t\t(!isPlainRecord(executionPolicy) \|\|\n\t\t\t!hasOnlyKeys(executionPolicy, [\"allowedExecutables\", \"allowedEnvironmentVariables\", \"maxOutputBytes\"]) \|\|\n\t\t\t!isStringArray(executionPolicy.allowedExecutables, MAX_WORKER_AUTHORITY_PATH_LENGTH) \|\|\n\t\t\t!isStringArray(executionPolicy.allowedEnvironmentVariables) \|\|\n\t\t\t!Number.isSafeInteger(executionPolicy.maxOutputBytes))\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile executionPolicy is invalid.\");\n\t}\n\tconst candidates = modelPolicy.candidates.map((candidate) => {\n\t\tif (!isPlainRecord(candidate) \|\| !hasOnlyKeys(candidate, [\"provider\", \"modelId\", \"thinkingLevel\"])) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\tif (\n\t\t\ttypeof candidate.provider !== \"string\" \|\|\n\t\t\tcandidate.provider.length === 0 \|\|\n\t\t\tcandidate.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH \|\|\n\t\t\ttypeof candidate.modelId !== \"string\" \|\|\n\t\t\tcandidate.modelId.length === 0 \|\|\n\t\t\tcandidate.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH \|\|\n\t\t\ttypeof candidate.thinkingLevel !== \"string\" \|\|\n\t\t\t!ORCHESTRATION_THINKING_LEVELS.includes(\n\t\t\t\tcandidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t\t)\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\treturn {\n\t\t\tprovider: candidate.provider,\n\t\t\tmodelId: candidate.modelId,\n\t\t\tthinkingLevel: candidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t};\n\t});\n\tif (\n\t\tvalue.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION \|\|\n\t\ttypeof value.profileId !== \"string\" \|\|\n\t\tvalue.profileId.length === 0 \|\|\n\t\tvalue.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\ttypeof value.description !== \"string\" \|\|\n\t\tvalue.description.length === 0 \|\|\n\t\tvalue.description.length > MAX_ORCHESTRATION_DESCRIPTION_LENGTH \|\|\n\t\ttypeof value.role !== \"string\" \|\|\n\t\t!WORKER_ROLES.includes(value.role as (typeof WORKER_ROLES)[number]) \|\|\n\t\t(modelPolicy.mode !== \"fixed\" && modelPolicy.mode !== \"ordered-fallback\") \|\|\n\t\t!Array.isArray(value.capabilityCeiling) \|\|\n\t\tvalue.capabilityCeiling.length > MAX_ORCHESTRATION_COLLECTION_LENGTH \|\|\n\t\t!value.capabilityCeiling.every(\n\t\t\t(capability) =>\n\t\t\t\ttypeof capability === \"string\" &&\n\t\t\t\tHARNESS_CAPABILITIES.includes(capability as (typeof HARNESS_CAPABILITIES)[number]),\n\t\t) \|\|\n\t\t!isStringArray(value.toolNames) \|\|\n\t\t!isStringArray(value.resourceProfileNames) \|\|\n\t\t!isStringArray(value.dispatchProfileIds) \|\|\n\t\t!Number.isSafeInteger(value.maxConcurrent) \|\|\n\t\t!Number.isSafeInteger(value.leaseTtlMs) \|\|\n\t\ttypeof value.requireIndependentVerification !== \"boolean\" \|\|\n\t\t(value.verificationProfileId !== undefined &&\n\t\t\t(typeof value.verificationProfileId !== \"string\" \|\|\n\t\t\t\tvalue.verificationProfileId.length === 0 \|\|\n\t\t\t\tvalue.verificationProfileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH)) \|\|\n\t\ttypeof value.createdAt !== \"string\" \|\|\n\t\tvalue.createdAt.length === 0 \|\|\n\t\tvalue.createdAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH \|\|\n\t\ttypeof value.updatedAt !== \"string\" \|\|\n\t\tvalue.updatedAt.length === 0 \|\|\n\t\tvalue.updatedAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile is invalid.\");\n\t}\n\tconst profile = structuredClone({\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tprofileId: value.profileId,\n\t\tdescription: value.description,\n\t\trole: value.role as OrchestrationProfile[\"role\"],\n\t\tmodelPolicy: { mode: modelPolicy.mode as OrchestrationProfile[\"modelPolicy\"][\"mode\"], candidates },\n\t\tcapabilityCeiling: value.capabilityCeiling as OrchestrationProfile[\"capabilityCeiling\"],\n\t\ttoolNames: value.toolNames,\n\t\tresourceProfileNames: value.resourceProfileNames,\n\t\tdispatchProfileIds: value.dispatchProfileIds,\n\t\t...(executionPolicy\n\t\t\t? {\n\t\t\t\t\texecutionPolicy: {\n\t\t\t\t\t\tallowedExecutables: executionPolicy.allowedExecutables as string[],\n\t\t\t\t\t\tallowedEnvironmentVariables: executionPolicy.allowedEnvironmentVariables as string[],\n\t\t\t\t\t\tmaxOutputBytes: Number(executionPolicy.maxOutputBytes),\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t\tbudget,\n\t\tmaxConcurrent: Number(value.maxConcurrent),\n\t\tleaseTtlMs: Number(value.leaseTtlMs),\n\t\trequireIndependentVerification: value.requireIndependentVerification,\n\t\t...(typeof value.verificationProfileId === \"string\"\n\t\t\t? { verificationProfileId: value.verificationProfileId }\n\t\t\t: {}),\n\t\t...(sourcePath ? { sourcePath } : {}),\n\t\tcreatedAt: value.createdAt,\n\t\tupdatedAt: value.updatedAt,\n\t}) as OrchestrationProfile;\n\tvalidateOrchestrationProfile(profile);\n\treturn profile;\n}\n\nfunction freezeProfile(profile: OrchestrationProfile): OrchestrationProfile {\n\tconst clone = structuredClone(profile);\n\tfor (const candidate of clone.modelPolicy.candidates) Object.freeze(candidate);\n\tObject.freeze(clone.modelPolicy.candidates);\n\tObject.freeze(clone.modelPolicy);\n\tObject.freeze(clone.capabilityCeiling);\n\tObject.freeze(clone.toolNames);\n\tObject.freeze(clone.resourceProfileNames);\n\tObject.freeze(clone.dispatchProfileIds);\n\tif (clone.executionPolicy) {\n\t\tObject.freeze(clone.executionPolicy.allowedExecutables);\n\t\tObject.freeze(clone.executionPolicy.allowedEnvironmentVariables);\n\t\tObject.freeze(clone.executionPolicy);\n\t}\n\tObject.freeze(clone.budget);\n\treturn Object.freeze(clone);\n}\n\nexport class OrchestrationProfileRegistry {\n\tprivate readonly profiles = new Map<string, OrchestrationProfile>();\n\n\tconstructor(profiles: readonly OrchestrationProfile[] = []) {\n\t\tfor (const profile of profiles) this.register(profile);\n\t\tfor (const profile of this.profiles.values()) {\n\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\tconst target = this.profiles.get(dispatchedProfileId);\n\t\t\t\tif (!target) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' dispatches missing profile '${dispatchedProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (target.role === \"orchestrator\") {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' cannot recursively dispatch orchestrator '${dispatchedProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.verificationProfileId) {\n\t\t\t\tconst verifier = this.profiles.get(profile.verificationProfileId);\n\t\t\t\tif (!verifier) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' requires missing verifier profile '${profile.verificationProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (verifier.role !== \"verifier\") {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' verificationProfileId '${profile.verificationProfileId}' is not a verifier.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.role === \"orchestrator\") {\n\t\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\t\tconst worker = this.profiles.get(dispatchedProfileId);\n\t\t\t\t\tif (\n\t\t\t\t\t\tworker?.verificationProfileId &&\n\t\t\t\t\t\t!profile.dispatchProfileIds.includes(worker.verificationProfileId)\n\t\t\t\t\t) {\n\t\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t\t`Orchestrator '${profile.profileId}' dispatches '${worker.profileId}' but not its verifier '${worker.verificationProfileId}'.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tregister(profile: OrchestrationProfile): void {\n\t\tvalidateOrchestrationProfile(profile);\n\t\tif (this.profiles.has(profile.profileId)) {\n\t\t\tthrow new OrchestrationProfileError(`Duplicate orchestration profile '${profile.profileId}'.`);\n\t\t}\n\t\tthis.profiles.set(profile.profileId, freezeProfile(profile));\n\t}\n\n\tget(profileId: string): OrchestrationProfile \| undefined {\n\t\tconst profile = this.profiles.get(profileId);\n\t\treturn profile ? structuredClone(profile) : undefined;\n\t}\n\n\tlist(): OrchestrationProfile[] {\n\t\treturn [...this.profiles.values()].map((profile) => structuredClone(profile));\n\t}\n}\n\nexport function resolveProfileModel(\n\tprofile: OrchestrationProfile,\n\thealth: ModelHealthView,\n): OrchestrationModelBinding \| undefined {\n\tif (profile.modelPolicy.mode === \"fixed\") {\n\t\tconst fixed = profile.modelPolicy.candidates[0];\n\t\treturn fixed && health.isHealthy(fixed) ? structuredClone(fixed) : undefined;\n\t}\n\tconst selected = profile.modelPolicy.candidates.find((candidate) => health.isHealthy(candidate));\n\treturn selected ? structuredClone(selected) : undefined;\n}\n\nexport function planProfileDispatch(args: {\n\trequest: OrchestrationDispatchRequest;\n\ttask: TaskContract;\n\tattemptId: string;\n\tsubjectId: string;\n\tregistry: OrchestrationProfileRegistry;\n\thealth: ModelHealthView;\n\tpolicyCompiler: ExecutionPolicyCompiler;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n\tresources: readonly ResourcePointer[];\n\treadPaths: readonly string[];\n\twritePaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tpolicyVersion: string;\n}): ProfileDispatchPlanResult {\n\tconst profile = args.registry.get(args.request.profileId);\n\tif (!profile) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tif (profile.role !== args.task.role) {\n\t\treturn { outcome: \"deny\", decisions: [], reasonCodes: [\"required_capability_exceeds_role_ceiling\"] };\n\t}\n\tconst model = resolveProfileModel(profile, args.health);\n\tif (!model) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tconst selectedResources = args.resources.filter((resource) => args.request.resourcePointerIds.includes(resource.id));\n\tconst manifestsByName = new Map(args.toolManifests.map((manifest) => [manifest.toolName, manifest]));\n\tconst requestedTools = profile.toolNames.filter((toolName) => {\n\t\tconst manifest = manifestsByName.get(toolName);\n\t\treturn manifest?.capabilities.every((capability) => args.task.requiredCapabilities.includes(capability)) === true;\n\t});\n\tconst policyInput: CompileExecutionGrantInput = {\n\t\tobjectiveId: args.task.objectiveId,\n\t\ttaskId: args.task.taskId,\n\t\tattemptId: args.attemptId,\n\t\tsubjectId: args.subjectId,\n\t\trole: profile.role,\n\t\trequiredCapabilities: args.task.requiredCapabilities,\n\t\trequestedCapabilities: args.task.requiredCapabilities,\n\t\tauthorityCapabilities: profile.capabilityCeiling,\n\t\trequestedTools,\n\t\ttoolManifests: args.toolManifests,\n\t\tresources: selectedResources,\n\t\treadPaths: args.readPaths,\n\t\twritePaths: args.writePaths,\n\t\tdeniedPaths: args.deniedPaths,\n\t\trequestedBudget: profile.budget,\n\t\tauthorityBudget: profile.budget,\n\t\tpolicyVersion: args.policyVersion,\n\t};\n\tconst compiled = args.policyCompiler.compile(policyInput);\n\tif (compiled.outcome !== \"allow\") return compiled;\n\treturn { outcome: \"allow\", plan: { profile, model, grant: compiled.grant, toolManifests: compiled.toolManifests } };\n}\n"]}