@caupulican/pi-adaptative 0.93.3 → 0.93.4

package/dist/core/orchestration/capability-gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability-gateway.js","sourceRoot":"","sources":["../../../src/core/orchestration/capability-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AA6ElE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAM9B;IACA,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,QAAQ,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;IACvF,OAAO,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,wBAAwB,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,gCAAgC,GAAqC,IAAI,GAAG,CAAC;IAClF,4BAA4B;IAC5B,wBAAwB;IACxB,uBAAuB;IACvB,6BAA6B;CAC7B,CAAC,CAAC;AAEH,MAAM,OAAO,4BAA6B,SAAQ,6BAA6B;IAG9E,YAAY,UAA+B,EAAE,OAAe;QAC3D,KAAK,CAAC,gCAAgC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC7G,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,CAAC;CACD;AAED,MAAM,iBAAiB,GAAmC,IAAI,GAAG,CAAC;IACjE,iBAAiB;IACjB,kBAAkB;IAClB,eAAe;IACf,iBAAiB;CACjB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAmC,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE5G,SAAS,eAAe,CAAC,GAAW,EAAE,KAAa;IAClD,IAAI,CAAC;QACJ,OAAO,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA0B;IACvD,IAAI,CAAC;QACJ,4BAA4B,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CACd,mGAAmG,CACnG,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAwB;IACpD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC5E,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IAC/E,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACxF,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC3F,MAAM,WAAW,GAChB,KAAK,CAAC,WAAW,KAAK,SAAS;QAC9B,CAAC,CAAC,WAAW,GAAG,YAAY,GAAG,eAAe,GAAG,gBAAgB;QACjE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IAChE,IACC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;QAClC,WAAW,GAAG,CAAC;QACf,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC;QACnC,YAAY,GAAG,CAAC;QAChB,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC;QACtC,eAAe,GAAG,CAAC;QACnB,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC;QACvC,gBAAgB,GAAG,CAAC;QACpB,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;QAClC,WAAW,GAAG,CAAC;QACf,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QACzB,OAAO,GAAG,CAAC,EACV,CAAC;QACF,MAAM,IAAI,KAAK,CACd,uGAAuG,CACvG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC/F,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAiB;IAgB7B,YAAY,OAAiC;QAC5C,MAAM,YAAY,GAAwB,OAAO,CAAC,YAAY,IAAI;YACjE,SAAS,EAAE,CAAC;YACZ,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,eAAe,EAAE,CAAC;YAClB,gBAAgB,EAAE,CAAC;YACnB,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,iBAAiB,EAAE,CAAC;SACpB,CAAC;QACF,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,kBAAkB,GAAG,YAAY,CAAC,iBAAiB,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC9C,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,eAAe,CAAC;QACpD,IAAI,CAAC,gBAAgB,GAAG,YAAY,CAAC,gBAAgB,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,OAAO,CACZ,QAAgC,EAChC,QAAgB,EAChB,MAAe,EACf,MAA4B;QAE5B,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,MAAM,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,8FAA8F;IAC9F,iBAAiB,CAAC,QAAgC,EAAE,QAAgB,EAAE,MAAe;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,WAAW,CAAC,KAAwB;QACnC,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAChE,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC,eAAe,CAAC;QACzE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QACjD,IACC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;YAClC,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC;YACnC,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC;YACtC,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC;YACvC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;YAClC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EACxB,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,mGAAmG;IACnG,qBAAqB,CAAC,OAAO,GAAG,UAAU;QACzC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,qBAAqB,CAC1B,kBAA0B,EAC1B,OAAO,GAAG,UAAU,EACpB,MAAoB;QAEpB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,IAAI,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,cAAc,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,cAAc,IAAI,kBAAkB,CAAC,CAAC;QACrF,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClG,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC;QACzC,OAAO;YACN,SAAS;YACT,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS;SACxB,CAAC;IACH,CAAC;IAED,2BAA2B;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;QAC5C,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IAED,oBAAoB;QACnB,MAAM,cAAc,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,EAAE,CAAC;QAC7D,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,eAAe,CAAC;QACzD,IAAI,eAAe,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAClD,CAAC;IAED,QAAQ;QACP,OAAO;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;SACnD,CAAC;IACH,CAAC;IAEO,SAAS,CAChB,QAAgC,EAChC,QAAgB,EAChB,MAAe,EACf,GAAW,EACX,WAAmB;QAEnB,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,oBAAoB,IAAI,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,SAAS,QAAQ,sBAAsB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,SAAS,QAAQ,2CAA2C,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAChG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,SAAS,QAAQ,qCAAqC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAEnD,IAAI,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/F,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAC5E,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,SAAS,QAAQ,uCAAuC,CAAC,CAAC;YACzG,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;oBAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC;oBACnE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,OAAO,uBAAuB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBAChG,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAEO,aAAa,CAAC,QAAgB,EAAE,WAAmB;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACjC,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAChF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,4BAA4B,EAAE,6BAA6B,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3F,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,yBAAyB,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,wBAAwB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,WAAW,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,6BAA6B,EAAE,8BAA8B,CAAC,CAAC;QACpF,CAAC;IACF,CAAC;IAEO,WAAW;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAEO,aAAa,CAAC,GAAW;QAChC,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,WAAW,CAAC;IACpB,CAAC;IAEO,WAAW,CAAC,OAAe,EAAE,YAA+B;QACnE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,IAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC3D,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACpC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,IAAI,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,IAAI,CAAC,QAAgB,EAAE,UAA+B,EAAE,OAAe;QAC9E,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACzC,MAAM,IAAI,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,QAAgB,EAAE,OAAyB,EAAE,UAA+B;QACzF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAC3B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;YAC/B,QAAQ;YACR,OAAO;YACP,UAAU;YACV,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;SAC9C,CAAC,CAAC;IACJ,CAAC;CACD","sourcesContent":["import { resolve } from \"node:path\";\nimport { BoundedCompletionFailureError } from \"../autonomy/bounded-completion.ts\";\nimport { extractPathArguments } from \"../autonomy/envelope-enforcement.ts\";\nimport { isPathWithinScope, safeRealpathSync } from \"../autonomy/path-scope.ts\";\nimport { validateAttemptUsageSnapshot } from \"./attempt-usage.ts\";\nimport type { AttemptUsageSnapshot, ExecutionGrant, HarnessCapability, ToolCapabilityManifest } from \"./contracts.ts\";\n\nexport type GatewayDecisionCode =\n\t| \"allowed\"\n\t| \"grant_expired\"\n\t| \"tool_not_granted\"\n\t| \"manifest_name_mismatch\"\n\t| \"capability_not_granted\"\n\t| \"path_argument_required\"\n\t| \"path_outside_scope\"\n\t| \"scope_denied\"\n\t| \"tool_call_budget_exhausted\"\n\t| \"token_budget_exhausted\"\n\t| \"cost_budget_exhausted\"\n\t| \"wall_clock_budget_exhausted\";\n\nexport interface GatewayAuditRecord {\n\tgrantId: string;\n\tattemptId: string;\n\ttoolName: string;\n\toutcome: \"allow\" | \"deny\";\n\treasonCode: GatewayDecisionCode;\n\tat: string;\n}\n\nexport interface CapabilityGatewayOptions {\n\tgrant: ExecutionGrant;\n\tcwd: string;\n\t/** Durable active usage carried forward when an attempt resumes in a new process. */\n\tinitialUsage?: GatewayInitialUsage;\n\tnow?: () => number;\n\tonAudit?: (record: GatewayAuditRecord) => void;\n\t/** Session-tree cumulative budget owner. Per-attempt grants remain independently enforced. */\n\tsharedBudget?: SharedCapabilityBudget;\n}\n\nexport interface GatewayUsageDelta {\n\tinputTokens?: number;\n\toutputTokens?: number;\n\tcacheReadTokens?: number;\n\tcacheWriteTokens?: number;\n\t/** Provider-authoritative total. Defaults to the supplied detail sum when omitted. */\n\ttotalTokens?: number;\n\tcostUsd?: number;\n}\n\nexport interface GatewayUsageSnapshot {\n\ttoolCalls: number;\n\tinputTokens: number;\n\toutputTokens: number;\n\tcacheReadTokens: number;\n\tcacheWriteTokens: number;\n\ttotalTokens: number;\n\tcostUsd: number;\n\twallClockMs: number;\n}\n\nexport interface ProviderBudgetReservation {\n\tmaxTokens: number;\n\trelease(): void;\n}\n\nexport interface SharedCapabilityBudget {\n\tassertBudgetAvailable(subject: string): void;\n\trecordAttemptUsage(usage: GatewayUsageSnapshot): void;\n\tremainingTokens(): number | undefined;\n\treserveProviderBudget(\n\t\trequestedMaxTokens: number,\n\t\tsubject: string,\n\t\tsignal?: AbortSignal,\n\t): Promise<ProviderBudgetReservation>;\n}\n\n/** Persistable cumulative usage from a prior active segment; excludes restart downtime. */\nexport type GatewayInitialUsage = AttemptUsageSnapshot;\n\n/**\n * Weight applied to prompt-cache reads when charging token budgets. Cache reads re-bill the\n * same context on every request (a worker's fixed system prompt alone is thousands of tokens),\n * so charging them at face value turns `maxTokens` into a request counter: a 9k grant died in\n * 2-3 responses while doing ~500 tokens of real work per response (field session 019fd4dc).\n * The weight mirrors the typical cache-read price ratio; money stays bounded by `maxCostUsd`.\n */\nexport const CACHE_READ_BUDGET_WEIGHT = 0.1;\n\n/**\n * Tokens charged against `maxTokens` budgets: real work at face value, cache reads discounted.\n * A provider-authoritative total above the detail sum is unattributed usage and charges fully.\n */\nexport function budgetedTokens(usage: {\n\tinputTokens: number;\n\toutputTokens: number;\n\tcacheReadTokens: number;\n\tcacheWriteTokens: number;\n\ttotalTokens: number;\n}): number {\n\tconst detailed = usage.inputTokens + usage.outputTokens + usage.cacheWriteTokens;\n\tconst unattributed = Math.max(0, usage.totalTokens - detailed - usage.cacheReadTokens);\n\treturn detailed + unattributed + Math.ceil(usage.cacheReadTokens * CACHE_READ_BUDGET_WEIGHT);\n}\n\nconst BUDGET_EXHAUSTION_DECISION_CODES: ReadonlySet<GatewayDecisionCode> = new Set([\n\t\"tool_call_budget_exhausted\",\n\t\"token_budget_exhausted\",\n\t\"cost_budget_exhausted\",\n\t\"wall_clock_budget_exhausted\",\n]);\n\nexport class CapabilityGatewayDeniedError extends BoundedCompletionFailureError {\n\treadonly reasonCode: GatewayDecisionCode;\n\n\tconstructor(reasonCode: GatewayDecisionCode, message: string) {\n\t\tsuper(BUDGET_EXHAUSTION_DECISION_CODES.has(reasonCode) ? \"budget_exhausted\" : \"failed\", reasonCode, message);\n\t\tthis.name = \"CapabilityGatewayDeniedError\";\n\t\tthis.reasonCode = reasonCode;\n\t}\n}\n\nconst PATH_CAPABILITIES: ReadonlySet<HarnessCapability> = new Set([\n\t\"filesystem.read\",\n\t\"filesystem.write\",\n\t\"worktree.read\",\n\t\"worktree.mutate\",\n]);\n\nconst WRITE_CAPABILITIES: ReadonlySet<HarnessCapability> = new Set([\"filesystem.write\", \"worktree.mutate\"]);\n\nfunction resolveRealPath(cwd: string, value: string): string | undefined {\n\ttry {\n\t\treturn safeRealpathSync(resolve(cwd, value));\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction validateInitialUsage(usage: GatewayInitialUsage): void {\n\ttry {\n\t\tvalidateAttemptUsageSnapshot(usage, \"CapabilityGateway: initial usage\");\n\t} catch {\n\t\tthrow new Error(\n\t\t\t\"CapabilityGateway: initial usage must contain finite non-negative values and safe-integer counts.\",\n\t\t);\n\t}\n}\n\nfunction validatedUsageDelta(delta: GatewayUsageDelta): Required<GatewayUsageDelta> {\n\tconst inputTokens = delta.inputTokens === undefined ? 0 : delta.inputTokens;\n\tconst outputTokens = delta.outputTokens === undefined ? 0 : delta.outputTokens;\n\tconst cacheReadTokens = delta.cacheReadTokens === undefined ? 0 : delta.cacheReadTokens;\n\tconst cacheWriteTokens = delta.cacheWriteTokens === undefined ? 0 : delta.cacheWriteTokens;\n\tconst totalTokens =\n\t\tdelta.totalTokens === undefined\n\t\t\t? inputTokens + outputTokens + cacheReadTokens + cacheWriteTokens\n\t\t\t: delta.totalTokens;\n\tconst costUsd = delta.costUsd === undefined ? 0 : delta.costUsd;\n\tif (\n\t\t!Number.isSafeInteger(inputTokens) ||\n\t\tinputTokens < 0 ||\n\t\t!Number.isSafeInteger(outputTokens) ||\n\t\toutputTokens < 0 ||\n\t\t!Number.isSafeInteger(cacheReadTokens) ||\n\t\tcacheReadTokens < 0 ||\n\t\t!Number.isSafeInteger(cacheWriteTokens) ||\n\t\tcacheWriteTokens < 0 ||\n\t\t!Number.isSafeInteger(totalTokens) ||\n\t\ttotalTokens < 0 ||\n\t\t!Number.isFinite(costUsd) ||\n\t\tcostUsd < 0\n\t) {\n\t\tthrow new Error(\n\t\t\t\"CapabilityGateway: usage delta must contain finite non-negative values and safe-integer token counts.\",\n\t\t);\n\t}\n\treturn { inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, totalTokens, costUsd };\n}\n\n/**\n * Per-invocation enforcement for an already-compiled grant. The compiler controls what may be\n * loaded; this gateway independently rechecks authority, path scope, expiry, and cumulative budget\n * immediately before execution.\n */\nexport class CapabilityGateway {\n\tprivate readonly grant: ExecutionGrant;\n\tprivate readonly cwd: string;\n\tprivate readonly now: () => number;\n\tprivate readonly onAudit?: (record: GatewayAuditRecord) => void;\n\tprivate readonly sharedBudget?: SharedCapabilityBudget;\n\tprivate readonly startedAt: number;\n\tprivate readonly initialWallClockMs: number;\n\tprivate toolCalls: number;\n\tprivate inputTokens: number;\n\tprivate outputTokens: number;\n\tprivate cacheReadTokens: number;\n\tprivate cacheWriteTokens: number;\n\tprivate totalTokens: number;\n\tprivate costUsd: number;\n\n\tconstructor(options: CapabilityGatewayOptions) {\n\t\tconst initialUsage: GatewayInitialUsage = options.initialUsage ?? {\n\t\t\ttoolCalls: 0,\n\t\t\tinputTokens: 0,\n\t\t\toutputTokens: 0,\n\t\t\tcacheReadTokens: 0,\n\t\t\tcacheWriteTokens: 0,\n\t\t\ttotalTokens: 0,\n\t\t\tcostUsd: 0,\n\t\t\tactiveWallClockMs: 0,\n\t\t};\n\t\tvalidateInitialUsage(initialUsage);\n\t\tthis.grant = options.grant;\n\t\tthis.cwd = options.cwd;\n\t\tthis.now = options.now ?? Date.now;\n\t\tthis.onAudit = options.onAudit;\n\t\tthis.sharedBudget = options.sharedBudget;\n\t\tthis.startedAt = this.currentTime();\n\t\tthis.initialWallClockMs = initialUsage.activeWallClockMs;\n\t\tthis.toolCalls = initialUsage.toolCalls;\n\t\tthis.inputTokens = initialUsage.inputTokens;\n\t\tthis.outputTokens = initialUsage.outputTokens;\n\t\tthis.cacheReadTokens = initialUsage.cacheReadTokens;\n\t\tthis.cacheWriteTokens = initialUsage.cacheWriteTokens;\n\t\tthis.totalTokens = initialUsage.totalTokens;\n\t\tthis.costUsd = initialUsage.costUsd;\n\t\tthis.sharedBudget?.recordAttemptUsage(this.getUsage());\n\t}\n\n\tasync execute<T>(\n\t\tmanifest: ToolCapabilityManifest,\n\t\ttoolName: string,\n\t\tparams: unknown,\n\t\tinvoke: () => Promise<T> | T,\n\t): Promise<T> {\n\t\tthis.authorizeToolCall(manifest, toolName, params);\n\t\treturn await invoke();\n\t}\n\n\t/** Immediate pre-execution authorization for runtimes that expose a before-tool-call hook. */\n\tauthorizeToolCall(manifest: ToolCapabilityManifest, toolName: string, params: unknown): void {\n\t\tconst now = this.currentTime();\n\t\tconst wallClockMs = this.wallClockMsAt(now);\n\t\tthis.authorize(manifest, toolName, params, now, wallClockMs);\n\t\tconst toolCalls = this.toolCalls + 1;\n\t\tif (!Number.isSafeInteger(toolCalls)) {\n\t\t\tthrow new Error(\"CapabilityGateway: tool-call count would exceed safe cumulative usage bounds.\");\n\t\t}\n\t\tthis.toolCalls = toolCalls;\n\t\tthis.sharedBudget?.recordAttemptUsage(this.getUsage());\n\t\tthis.audit(toolName, \"allow\", \"allowed\");\n\t}\n\n\trecordUsage(delta: GatewayUsageDelta): void {\n\t\tconst validated = validatedUsageDelta(delta);\n\t\tconst inputTokens = this.inputTokens + validated.inputTokens;\n\t\tconst outputTokens = this.outputTokens + validated.outputTokens;\n\t\tconst cacheReadTokens = this.cacheReadTokens + validated.cacheReadTokens;\n\t\tconst cacheWriteTokens = this.cacheWriteTokens + validated.cacheWriteTokens;\n\t\tconst totalTokens = this.totalTokens + validated.totalTokens;\n\t\tconst costUsd = this.costUsd + validated.costUsd;\n\t\tif (\n\t\t\t!Number.isSafeInteger(inputTokens) ||\n\t\t\t!Number.isSafeInteger(outputTokens) ||\n\t\t\t!Number.isSafeInteger(cacheReadTokens) ||\n\t\t\t!Number.isSafeInteger(cacheWriteTokens) ||\n\t\t\t!Number.isSafeInteger(totalTokens) ||\n\t\t\t!Number.isFinite(costUsd)\n\t\t) {\n\t\t\tthrow new Error(\"CapabilityGateway: usage delta would exceed safe cumulative usage bounds.\");\n\t\t}\n\t\tthis.inputTokens = inputTokens;\n\t\tthis.outputTokens = outputTokens;\n\t\tthis.cacheReadTokens = cacheReadTokens;\n\t\tthis.cacheWriteTokens = cacheWriteTokens;\n\t\tthis.totalTokens = totalTokens;\n\t\tthis.costUsd = costUsd;\n\t\tthis.sharedBudget?.recordAttemptUsage(this.getUsage());\n\t}\n\n\t/** Enforce resumed cumulative budgets before a provider request that has no tool-call boundary. */\n\tassertBudgetAvailable(subject = \"provider\"): void {\n\t\tthis.enforceBudget(subject, this.wallClockMsAt(this.currentTime()));\n\t\tthis.sharedBudget?.assertBudgetAvailable(subject);\n\t}\n\n\tasync reserveProviderBudget(\n\t\trequestedMaxTokens: number,\n\t\tsubject = \"provider\",\n\t\tsignal?: AbortSignal,\n\t): Promise<ProviderBudgetReservation> {\n\t\tif (!Number.isSafeInteger(requestedMaxTokens) || requestedMaxTokens <= 0) {\n\t\t\tthrow new Error(\"CapabilityGateway: provider token reservation must be a positive safe integer.\");\n\t\t}\n\t\tthis.assertBudgetAvailable(subject);\n\t\tconst localRemaining = this.remainingAttemptTokenBudget();\n\t\tconst maxTokens = Math.min(requestedMaxTokens, localRemaining ?? requestedMaxTokens);\n\t\tif (maxTokens <= 0) {\n\t\t\tthis.deny(subject, \"token_budget_exhausted\", \"Token budget exhausted.\");\n\t\t}\n\t\tif (this.sharedBudget) return this.sharedBudget.reserveProviderBudget(maxTokens, subject, signal);\n\t\tif (signal?.aborted) throw signal.reason;\n\t\treturn {\n\t\t\tmaxTokens,\n\t\t\trelease: () => undefined,\n\t\t};\n\t}\n\n\tremainingAttemptTokenBudget(): number | undefined {\n\t\tconst maximum = this.grant.budget.maxTokens;\n\t\treturn maximum === undefined ? undefined : Math.max(0, maximum - budgetedTokens(this.getUsage()));\n\t}\n\n\tremainingTokenBudget(): number | undefined {\n\t\tconst localRemaining = this.remainingAttemptTokenBudget();\n\t\tconst sharedRemaining = this.sharedBudget?.remainingTokens();\n\t\tif (localRemaining === undefined) return sharedRemaining;\n\t\tif (sharedRemaining === undefined) return localRemaining;\n\t\treturn Math.min(localRemaining, sharedRemaining);\n\t}\n\n\tgetUsage(): GatewayUsageSnapshot {\n\t\treturn {\n\t\t\ttoolCalls: this.toolCalls,\n\t\t\tinputTokens: this.inputTokens,\n\t\t\toutputTokens: this.outputTokens,\n\t\t\tcacheReadTokens: this.cacheReadTokens,\n\t\t\tcacheWriteTokens: this.cacheWriteTokens,\n\t\t\ttotalTokens: this.totalTokens,\n\t\t\tcostUsd: this.costUsd,\n\t\t\twallClockMs: this.wallClockMsAt(this.currentTime()),\n\t\t};\n\t}\n\n\tprivate authorize(\n\t\tmanifest: ToolCapabilityManifest,\n\t\ttoolName: string,\n\t\tparams: unknown,\n\t\tnow: number,\n\t\twallClockMs: number,\n\t): void {\n\t\tif (this.grant.expiresAt && Date.parse(this.grant.expiresAt) <= now) {\n\t\t\tthis.deny(toolName, \"grant_expired\", `Execution grant '${this.grant.grantId}' expired.`);\n\t\t}\n\t\tif (!this.grant.allowedTools.includes(toolName)) {\n\t\t\tthis.deny(toolName, \"tool_not_granted\", `Tool '${toolName}' is not in grant '${this.grant.grantId}'.`);\n\t\t}\n\t\tif (manifest.toolName !== toolName) {\n\t\t\tthis.deny(toolName, \"manifest_name_mismatch\", `Tool '${toolName}' does not match its capability manifest.`);\n\t\t}\n\t\tif (!manifest.capabilities.every((capability) => this.grant.capabilities.includes(capability))) {\n\t\t\tthis.deny(toolName, \"capability_not_granted\", `Tool '${toolName}' requires an ungranted capability.`);\n\t\t}\n\t\tthis.enforceBudget(toolName, wallClockMs);\n\t\tthis.sharedBudget?.assertBudgetAvailable(toolName);\n\n\t\tif (manifest.capabilities.some((capability) => PATH_CAPABILITIES.has(capability))) {\n\t\t\tconst isWrite = manifest.capabilities.some((capability) => WRITE_CAPABILITIES.has(capability));\n\t\t\tconst allowedPaths = isWrite ? this.grant.writePaths : this.grant.readPaths;\n\t\t\tconst paths = extractPathArguments(params);\n\t\t\tif (paths.length === 0) {\n\t\t\t\tthis.deny(toolName, \"path_argument_required\", `Tool '${toolName}' requires an explicit path argument.`);\n\t\t\t}\n\t\t\tfor (const rawPath of paths) {\n\t\t\t\tif (!this.pathAllowed(rawPath, allowedPaths)) {\n\t\t\t\t\tconst reasonCode = isWrite ? \"scope_denied\" : \"path_outside_scope\";\n\t\t\t\t\tthis.deny(toolName, reasonCode, `Path '${rawPath}' is outside grant '${this.grant.grantId}'.`);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate enforceBudget(toolName: string, wallClockMs: number): void {\n\t\tconst budget = this.grant.budget;\n\t\tif (budget.maxToolCalls !== undefined && this.toolCalls >= budget.maxToolCalls) {\n\t\t\tthis.deny(toolName, \"tool_call_budget_exhausted\", \"Tool-call budget exhausted.\");\n\t\t}\n\t\tif (budget.maxTokens !== undefined && budgetedTokens(this.getUsage()) >= budget.maxTokens) {\n\t\t\tthis.deny(toolName, \"token_budget_exhausted\", \"Token budget exhausted.\");\n\t\t}\n\t\tif (budget.maxCostUsd !== undefined && this.costUsd >= budget.maxCostUsd) {\n\t\t\tthis.deny(toolName, \"cost_budget_exhausted\", \"Cost budget exhausted.\");\n\t\t}\n\t\tif (budget.maxWallClockMs !== undefined && wallClockMs >= budget.maxWallClockMs) {\n\t\t\tthis.deny(toolName, \"wall_clock_budget_exhausted\", \"Wall-clock budget exhausted.\");\n\t\t}\n\t}\n\n\tprivate currentTime(): number {\n\t\tconst now = this.now();\n\t\tif (!Number.isFinite(now)) {\n\t\t\tthrow new Error(\"CapabilityGateway: clock source must return a finite time.\");\n\t\t}\n\t\treturn now;\n\t}\n\n\tprivate wallClockMsAt(now: number): number {\n\t\tconst elapsed = now - this.startedAt;\n\t\tif (!Number.isFinite(elapsed)) {\n\t\t\tthrow new Error(\"CapabilityGateway: active wall-clock elapsed time must be finite.\");\n\t\t}\n\t\tconst wallClockMs = this.initialWallClockMs + Math.max(0, elapsed);\n\t\tif (!Number.isFinite(wallClockMs) || wallClockMs < 0) {\n\t\t\tthrow new Error(\"CapabilityGateway: accumulated wall-clock usage must be finite and non-negative.\");\n\t\t}\n\t\treturn wallClockMs;\n\t}\n\n\tprivate pathAllowed(rawPath: string, allowedPaths: readonly string[]): boolean {\n\t\tconst target = resolveRealPath(this.cwd, rawPath);\n\t\tif (!target || allowedPaths.length === 0) return false;\n\t\tfor (const denied of this.grant.deniedPaths) {\n\t\t\tconst root = resolveRealPath(this.cwd, denied);\n\t\t\tif (root && isPathWithinScope(target, root)) return false;\n\t\t}\n\t\treturn allowedPaths.some((allowed) => {\n\t\t\tconst root = resolveRealPath(this.cwd, allowed);\n\t\t\treturn root !== undefined && isPathWithinScope(target, root);\n\t\t});\n\t}\n\n\tprivate deny(toolName: string, reasonCode: GatewayDecisionCode, message: string): never {\n\t\tthis.audit(toolName, \"deny\", reasonCode);\n\t\tthrow new CapabilityGatewayDeniedError(reasonCode, message);\n\t}\n\n\tprivate audit(toolName: string, outcome: \"allow\" | \"deny\", reasonCode: GatewayDecisionCode): void {\n\t\tthis.onAudit?.({\n\t\t\tgrantId: this.grant.grantId,\n\t\t\tattemptId: this.grant.attemptId,\n\t\t\ttoolName,\n\t\t\toutcome,\n\t\t\treasonCode,\n\t\t\tat: new Date(this.currentTime()).toISOString(),\n\t\t});\n\t}\n}\n"]}
+{"version":3,"file":"capability-gateway.js","sourceRoot":"","sources":["../../../src/core/orchestration/capability-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EACN,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AA6ElE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAM9B;IACA,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,QAAQ,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;IACvF,OAAO,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,wBAAwB,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,gCAAgC,GAAqC,IAAI,GAAG,CAAC;IAClF,4BAA4B;IAC5B,wBAAwB;IACxB,uBAAuB;IACvB,6BAA6B;CAC7B,CAAC,CAAC;AAEH,MAAM,OAAO,4BAA6B,SAAQ,6BAA6B;IAG9E,YAAY,UAA+B,EAAE,OAAe;QAC3D,KAAK,CAAC,gCAAgC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC7G,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,CAAC;CACD;AAED,MAAM,iBAAiB,GAAmC,IAAI,GAAG,CAAC;IACjE,iBAAiB;IACjB,kBAAkB;IAClB,eAAe;IACf,iBAAiB;CACjB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAmC,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE5G,SAAS,eAAe,CAAC,GAAW,EAAE,KAAa;IAClD,IAAI,CAAC;QACJ,OAAO,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA0B;IACvD,IAAI,CAAC;QACJ,4BAA4B,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CACd,mGAAmG,CACnG,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAwB;IACpD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC5E,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IAC/E,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACxF,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC3F,MAAM,WAAW,GAChB,KAAK,CAAC,WAAW,KAAK,SAAS;QAC9B,CAAC,CAAC,WAAW,GAAG,YAAY,GAAG,eAAe,GAAG,gBAAgB;QACjE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IAChE,IACC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;QAClC,WAAW,GAAG,CAAC;QACf,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC;QACnC,YAAY,GAAG,CAAC;QAChB,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC;QACtC,eAAe,GAAG,CAAC;QACnB,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC;QACvC,gBAAgB,GAAG,CAAC;QACpB,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;QAClC,WAAW,GAAG,CAAC;QACf,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QACzB,OAAO,GAAG,CAAC,EACV,CAAC;QACF,MAAM,IAAI,KAAK,CACd,uGAAuG,CACvG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC/F,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAiB;IAgB7B,YAAY,OAAiC;QAC5C,MAAM,YAAY,GAAwB,OAAO,CAAC,YAAY,IAAI;YACjE,SAAS,EAAE,CAAC;YACZ,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,eAAe,EAAE,CAAC;YAClB,gBAAgB,EAAE,CAAC;YACnB,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,iBAAiB,EAAE,CAAC;SACpB,CAAC;QACF,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,kBAAkB,GAAG,YAAY,CAAC,iBAAiB,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC9C,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,eAAe,CAAC;QACpD,IAAI,CAAC,gBAAgB,GAAG,YAAY,CAAC,gBAAgB,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,OAAO,CACZ,QAAgC,EAChC,QAAgB,EAChB,MAAe,EACf,MAA4B;QAE5B,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,MAAM,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,8FAA8F;IAC9F,iBAAiB,CAAC,QAAgC,EAAE,QAAgB,EAAE,MAAe;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,WAAW,CAAC,KAAwB;QACnC,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAChE,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC,eAAe,CAAC;QACzE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QACjD,IACC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;YAClC,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC;YACnC,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC;YACtC,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC;YACvC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;YAClC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EACxB,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,mGAAmG;IACnG,qBAAqB,CAAC,OAAO,GAAG,UAAU;QACzC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,qBAAqB,CAC1B,kBAA0B,EAC1B,OAAO,GAAG,UAAU,EACpB,MAAoB;QAEpB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,IAAI,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,cAAc,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,cAAc,IAAI,kBAAkB,CAAC,CAAC;QACrF,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClG,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC;QACzC,OAAO;YACN,SAAS;YACT,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS;SACxB,CAAC;IACH,CAAC;IAED,2BAA2B;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;QAC5C,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IAED,oBAAoB;QACnB,MAAM,cAAc,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,EAAE,CAAC;QAC7D,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,eAAe,CAAC;QACzD,IAAI,eAAe,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAClD,CAAC;IAED,QAAQ;QACP,OAAO;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;SACnD,CAAC;IACH,CAAC;IAEO,SAAS,CAChB,QAAgC,EAChC,QAAgB,EAChB,MAAe,EACf,GAAW,EACX,WAAmB;QAEnB,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,oBAAoB,IAAI,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,SAAS,QAAQ,sBAAsB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,SAAS,QAAQ,2CAA2C,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAChG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,SAAS,QAAQ,qCAAqC,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,QAAQ,CAAC;YACzD,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;YACtE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QACzB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CACR,QAAQ,EACR,wBAAwB,EACxB,SAAS,QAAQ,+DAA+D,CAChF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAEnD,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,oBAAoB,GAAG,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,eAAe;YACjC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;YACpE,CAAC,CAAC,oBAAoB;gBACrB,CAAC,CAAC,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC;gBAC3D,CAAC,CAAC,MAAM,CAAC;QACX,MAAM,KAAK,GAAG,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtF,IACC,UAAU,KAAK,MAAM;YACrB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAC7F,CAAC;YACF,MAAM,OAAO,GACZ,UAAU,KAAK,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YACrG,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,SAAS,QAAQ,uCAAuC,CAAC,CAAC;YACzG,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;oBAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC;oBACnE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,OAAO,uBAAuB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBAChG,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAEO,aAAa,CAAC,QAAgB,EAAE,WAAmB;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACjC,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAChF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,4BAA4B,EAAE,6BAA6B,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3F,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,yBAAyB,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,wBAAwB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,WAAW,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,6BAA6B,EAAE,8BAA8B,CAAC,CAAC;QACpF,CAAC;IACF,CAAC;IAEO,WAAW;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAEO,aAAa,CAAC,GAAW;QAChC,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,WAAW,CAAC;IACpB,CAAC;IAEO,WAAW,CAAC,OAAe,EAAE,YAA+B;QACnE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACrD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,IAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC3D,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,IAAI,CAAC,QAAgB,EAAE,UAA+B,EAAE,OAAe;QAC9E,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACzC,MAAM,IAAI,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,QAAgB,EAAE,OAAyB,EAAE,UAA+B;QACzF,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAC3B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;YAC/B,QAAQ;YACR,OAAO;YACP,UAAU;YACV,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;SAC9C,CAAC,CAAC;IACJ,CAAC;CACD","sourcesContent":["import { resolve } from \"node:path\";\nimport { BoundedCompletionFailureError } from \"../autonomy/bounded-completion.ts\";\nimport { extractToolPathArguments } from \"../autonomy/envelope-enforcement.ts\";\nimport { isPathWithinScope, safeRealpathSync } from \"../autonomy/path-scope.ts\";\nimport {\n\tgetToolCapabilityPolicy,\n\tresolveCapabilityPathAccess,\n\tresolveToolCallCapabilities,\n\tresolveToolCallPathAccess,\n} from \"../tool-capability-policy.ts\";\nimport { validateAttemptUsageSnapshot } from \"./attempt-usage.ts\";\nimport type { AttemptUsageSnapshot, ExecutionGrant, HarnessCapability, ToolCapabilityManifest } from \"./contracts.ts\";\n\nexport type GatewayDecisionCode =\n\t| \"allowed\"\n\t| \"grant_expired\"\n\t| \"tool_not_granted\"\n\t| \"manifest_name_mismatch\"\n\t| \"capability_not_granted\"\n\t| \"path_argument_required\"\n\t| \"path_outside_scope\"\n\t| \"scope_denied\"\n\t| \"tool_call_budget_exhausted\"\n\t| \"token_budget_exhausted\"\n\t| \"cost_budget_exhausted\"\n\t| \"wall_clock_budget_exhausted\";\n\nexport interface GatewayAuditRecord {\n\tgrantId: string;\n\tattemptId: string;\n\ttoolName: string;\n\toutcome: \"allow\" | \"deny\";\n\treasonCode: GatewayDecisionCode;\n\tat: string;\n}\n\nexport interface CapabilityGatewayOptions {\n\tgrant: ExecutionGrant;\n\tcwd: string;\n\t/** Durable active usage carried forward when an attempt resumes in a new process. */\n\tinitialUsage?: GatewayInitialUsage;\n\tnow?: () => number;\n\tonAudit?: (record: GatewayAuditRecord) => void;\n\t/** Session-tree cumulative budget owner. Per-attempt grants remain independently enforced. */\n\tsharedBudget?: SharedCapabilityBudget;\n}\n\nexport interface GatewayUsageDelta {\n\tinputTokens?: number;\n\toutputTokens?: number;\n\tcacheReadTokens?: number;\n\tcacheWriteTokens?: number;\n\t/** Provider-authoritative total. Defaults to the supplied detail sum when omitted. */\n\ttotalTokens?: number;\n\tcostUsd?: number;\n}\n\nexport interface GatewayUsageSnapshot {\n\ttoolCalls: number;\n\tinputTokens: number;\n\toutputTokens: number;\n\tcacheReadTokens: number;\n\tcacheWriteTokens: number;\n\ttotalTokens: number;\n\tcostUsd: number;\n\twallClockMs: number;\n}\n\nexport interface ProviderBudgetReservation {\n\tmaxTokens: number;\n\trelease(): void;\n}\n\nexport interface SharedCapabilityBudget {\n\tassertBudgetAvailable(subject: string): void;\n\trecordAttemptUsage(usage: GatewayUsageSnapshot): void;\n\tremainingTokens(): number | undefined;\n\treserveProviderBudget(\n\t\trequestedMaxTokens: number,\n\t\tsubject: string,\n\t\tsignal?: AbortSignal,\n\t): Promise<ProviderBudgetReservation>;\n}\n\n/** Persistable cumulative usage from a prior active segment; excludes restart downtime. */\nexport type GatewayInitialUsage = AttemptUsageSnapshot;\n\n/**\n * Weight applied to prompt-cache reads when charging token budgets. Cache reads re-bill the\n * same context on every request (a worker's fixed system prompt alone is thousands of tokens),\n * so charging them at face value turns `maxTokens` into a request counter: a 9k grant died in\n * 2-3 responses while doing ~500 tokens of real work per response (field session 019fd4dc).\n * The weight mirrors the typical cache-read price ratio; money stays bounded by `maxCostUsd`.\n */\nexport const CACHE_READ_BUDGET_WEIGHT = 0.1;\n\n/**\n * Tokens charged against `maxTokens` budgets: real work at face value, cache reads discounted.\n * A provider-authoritative total above the detail sum is unattributed usage and charges fully.\n */\nexport function budgetedTokens(usage: {\n\tinputTokens: number;\n\toutputTokens: number;\n\tcacheReadTokens: number;\n\tcacheWriteTokens: number;\n\ttotalTokens: number;\n}): number {\n\tconst detailed = usage.inputTokens + usage.outputTokens + usage.cacheWriteTokens;\n\tconst unattributed = Math.max(0, usage.totalTokens - detailed - usage.cacheReadTokens);\n\treturn detailed + unattributed + Math.ceil(usage.cacheReadTokens * CACHE_READ_BUDGET_WEIGHT);\n}\n\nconst BUDGET_EXHAUSTION_DECISION_CODES: ReadonlySet<GatewayDecisionCode> = new Set([\n\t\"tool_call_budget_exhausted\",\n\t\"token_budget_exhausted\",\n\t\"cost_budget_exhausted\",\n\t\"wall_clock_budget_exhausted\",\n]);\n\nexport class CapabilityGatewayDeniedError extends BoundedCompletionFailureError {\n\treadonly reasonCode: GatewayDecisionCode;\n\n\tconstructor(reasonCode: GatewayDecisionCode, message: string) {\n\t\tsuper(BUDGET_EXHAUSTION_DECISION_CODES.has(reasonCode) ? \"budget_exhausted\" : \"failed\", reasonCode, message);\n\t\tthis.name = \"CapabilityGatewayDeniedError\";\n\t\tthis.reasonCode = reasonCode;\n\t}\n}\n\nconst PATH_CAPABILITIES: ReadonlySet<HarnessCapability> = new Set([\n\t\"filesystem.read\",\n\t\"filesystem.write\",\n\t\"worktree.read\",\n\t\"worktree.mutate\",\n]);\n\nconst WRITE_CAPABILITIES: ReadonlySet<HarnessCapability> = new Set([\"filesystem.write\", \"worktree.mutate\"]);\n\nfunction resolveRealPath(cwd: string, value: string): string | undefined {\n\ttry {\n\t\treturn safeRealpathSync(resolve(cwd, value));\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction validateInitialUsage(usage: GatewayInitialUsage): void {\n\ttry {\n\t\tvalidateAttemptUsageSnapshot(usage, \"CapabilityGateway: initial usage\");\n\t} catch {\n\t\tthrow new Error(\n\t\t\t\"CapabilityGateway: initial usage must contain finite non-negative values and safe-integer counts.\",\n\t\t);\n\t}\n}\n\nfunction validatedUsageDelta(delta: GatewayUsageDelta): Required<GatewayUsageDelta> {\n\tconst inputTokens = delta.inputTokens === undefined ? 0 : delta.inputTokens;\n\tconst outputTokens = delta.outputTokens === undefined ? 0 : delta.outputTokens;\n\tconst cacheReadTokens = delta.cacheReadTokens === undefined ? 0 : delta.cacheReadTokens;\n\tconst cacheWriteTokens = delta.cacheWriteTokens === undefined ? 0 : delta.cacheWriteTokens;\n\tconst totalTokens =\n\t\tdelta.totalTokens === undefined\n\t\t\t? inputTokens + outputTokens + cacheReadTokens + cacheWriteTokens\n\t\t\t: delta.totalTokens;\n\tconst costUsd = delta.costUsd === undefined ? 0 : delta.costUsd;\n\tif (\n\t\t!Number.isSafeInteger(inputTokens) ||\n\t\tinputTokens < 0 ||\n\t\t!Number.isSafeInteger(outputTokens) ||\n\t\toutputTokens < 0 ||\n\t\t!Number.isSafeInteger(cacheReadTokens) ||\n\t\tcacheReadTokens < 0 ||\n\t\t!Number.isSafeInteger(cacheWriteTokens) ||\n\t\tcacheWriteTokens < 0 ||\n\t\t!Number.isSafeInteger(totalTokens) ||\n\t\ttotalTokens < 0 ||\n\t\t!Number.isFinite(costUsd) ||\n\t\tcostUsd < 0\n\t) {\n\t\tthrow new Error(\n\t\t\t\"CapabilityGateway: usage delta must contain finite non-negative values and safe-integer token counts.\",\n\t\t);\n\t}\n\treturn { inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, totalTokens, costUsd };\n}\n\n/**\n * Per-invocation enforcement for an already-compiled grant. The compiler controls what may be\n * loaded; this gateway independently rechecks authority, path scope, expiry, and cumulative budget\n * immediately before execution.\n */\nexport class CapabilityGateway {\n\tprivate readonly grant: ExecutionGrant;\n\tprivate readonly cwd: string;\n\tprivate readonly now: () => number;\n\tprivate readonly onAudit?: (record: GatewayAuditRecord) => void;\n\tprivate readonly sharedBudget?: SharedCapabilityBudget;\n\tprivate readonly startedAt: number;\n\tprivate readonly initialWallClockMs: number;\n\tprivate toolCalls: number;\n\tprivate inputTokens: number;\n\tprivate outputTokens: number;\n\tprivate cacheReadTokens: number;\n\tprivate cacheWriteTokens: number;\n\tprivate totalTokens: number;\n\tprivate costUsd: number;\n\n\tconstructor(options: CapabilityGatewayOptions) {\n\t\tconst initialUsage: GatewayInitialUsage = options.initialUsage ?? {\n\t\t\ttoolCalls: 0,\n\t\t\tinputTokens: 0,\n\t\t\toutputTokens: 0,\n\t\t\tcacheReadTokens: 0,\n\t\t\tcacheWriteTokens: 0,\n\t\t\ttotalTokens: 0,\n\t\t\tcostUsd: 0,\n\t\t\tactiveWallClockMs: 0,\n\t\t};\n\t\tvalidateInitialUsage(initialUsage);\n\t\tthis.grant = options.grant;\n\t\tthis.cwd = options.cwd;\n\t\tthis.now = options.now ?? Date.now;\n\t\tthis.onAudit = options.onAudit;\n\t\tthis.sharedBudget = options.sharedBudget;\n\t\tthis.startedAt = this.currentTime();\n\t\tthis.initialWallClockMs = initialUsage.activeWallClockMs;\n\t\tthis.toolCalls = initialUsage.toolCalls;\n\t\tthis.inputTokens = initialUsage.inputTokens;\n\t\tthis.outputTokens = initialUsage.outputTokens;\n\t\tthis.cacheReadTokens = initialUsage.cacheReadTokens;\n\t\tthis.cacheWriteTokens = initialUsage.cacheWriteTokens;\n\t\tthis.totalTokens = initialUsage.totalTokens;\n\t\tthis.costUsd = initialUsage.costUsd;\n\t\tthis.sharedBudget?.recordAttemptUsage(this.getUsage());\n\t}\n\n\tasync execute<T>(\n\t\tmanifest: ToolCapabilityManifest,\n\t\ttoolName: string,\n\t\tparams: unknown,\n\t\tinvoke: () => Promise<T> | T,\n\t): Promise<T> {\n\t\tthis.authorizeToolCall(manifest, toolName, params);\n\t\treturn await invoke();\n\t}\n\n\t/** Immediate pre-execution authorization for runtimes that expose a before-tool-call hook. */\n\tauthorizeToolCall(manifest: ToolCapabilityManifest, toolName: string, params: unknown): void {\n\t\tconst now = this.currentTime();\n\t\tconst wallClockMs = this.wallClockMsAt(now);\n\t\tthis.authorize(manifest, toolName, params, now, wallClockMs);\n\t\tconst toolCalls = this.toolCalls + 1;\n\t\tif (!Number.isSafeInteger(toolCalls)) {\n\t\t\tthrow new Error(\"CapabilityGateway: tool-call count would exceed safe cumulative usage bounds.\");\n\t\t}\n\t\tthis.toolCalls = toolCalls;\n\t\tthis.sharedBudget?.recordAttemptUsage(this.getUsage());\n\t\tthis.audit(toolName, \"allow\", \"allowed\");\n\t}\n\n\trecordUsage(delta: GatewayUsageDelta): void {\n\t\tconst validated = validatedUsageDelta(delta);\n\t\tconst inputTokens = this.inputTokens + validated.inputTokens;\n\t\tconst outputTokens = this.outputTokens + validated.outputTokens;\n\t\tconst cacheReadTokens = this.cacheReadTokens + validated.cacheReadTokens;\n\t\tconst cacheWriteTokens = this.cacheWriteTokens + validated.cacheWriteTokens;\n\t\tconst totalTokens = this.totalTokens + validated.totalTokens;\n\t\tconst costUsd = this.costUsd + validated.costUsd;\n\t\tif (\n\t\t\t!Number.isSafeInteger(inputTokens) ||\n\t\t\t!Number.isSafeInteger(outputTokens) ||\n\t\t\t!Number.isSafeInteger(cacheReadTokens) ||\n\t\t\t!Number.isSafeInteger(cacheWriteTokens) ||\n\t\t\t!Number.isSafeInteger(totalTokens) ||\n\t\t\t!Number.isFinite(costUsd)\n\t\t) {\n\t\t\tthrow new Error(\"CapabilityGateway: usage delta would exceed safe cumulative usage bounds.\");\n\t\t}\n\t\tthis.inputTokens = inputTokens;\n\t\tthis.outputTokens = outputTokens;\n\t\tthis.cacheReadTokens = cacheReadTokens;\n\t\tthis.cacheWriteTokens = cacheWriteTokens;\n\t\tthis.totalTokens = totalTokens;\n\t\tthis.costUsd = costUsd;\n\t\tthis.sharedBudget?.recordAttemptUsage(this.getUsage());\n\t}\n\n\t/** Enforce resumed cumulative budgets before a provider request that has no tool-call boundary. */\n\tassertBudgetAvailable(subject = \"provider\"): void {\n\t\tthis.enforceBudget(subject, this.wallClockMsAt(this.currentTime()));\n\t\tthis.sharedBudget?.assertBudgetAvailable(subject);\n\t}\n\n\tasync reserveProviderBudget(\n\t\trequestedMaxTokens: number,\n\t\tsubject = \"provider\",\n\t\tsignal?: AbortSignal,\n\t): Promise<ProviderBudgetReservation> {\n\t\tif (!Number.isSafeInteger(requestedMaxTokens) || requestedMaxTokens <= 0) {\n\t\t\tthrow new Error(\"CapabilityGateway: provider token reservation must be a positive safe integer.\");\n\t\t}\n\t\tthis.assertBudgetAvailable(subject);\n\t\tconst localRemaining = this.remainingAttemptTokenBudget();\n\t\tconst maxTokens = Math.min(requestedMaxTokens, localRemaining ?? requestedMaxTokens);\n\t\tif (maxTokens <= 0) {\n\t\t\tthis.deny(subject, \"token_budget_exhausted\", \"Token budget exhausted.\");\n\t\t}\n\t\tif (this.sharedBudget) return this.sharedBudget.reserveProviderBudget(maxTokens, subject, signal);\n\t\tif (signal?.aborted) throw signal.reason;\n\t\treturn {\n\t\t\tmaxTokens,\n\t\t\trelease: () => undefined,\n\t\t};\n\t}\n\n\tremainingAttemptTokenBudget(): number | undefined {\n\t\tconst maximum = this.grant.budget.maxTokens;\n\t\treturn maximum === undefined ? undefined : Math.max(0, maximum - budgetedTokens(this.getUsage()));\n\t}\n\n\tremainingTokenBudget(): number | undefined {\n\t\tconst localRemaining = this.remainingAttemptTokenBudget();\n\t\tconst sharedRemaining = this.sharedBudget?.remainingTokens();\n\t\tif (localRemaining === undefined) return sharedRemaining;\n\t\tif (sharedRemaining === undefined) return localRemaining;\n\t\treturn Math.min(localRemaining, sharedRemaining);\n\t}\n\n\tgetUsage(): GatewayUsageSnapshot {\n\t\treturn {\n\t\t\ttoolCalls: this.toolCalls,\n\t\t\tinputTokens: this.inputTokens,\n\t\t\toutputTokens: this.outputTokens,\n\t\t\tcacheReadTokens: this.cacheReadTokens,\n\t\t\tcacheWriteTokens: this.cacheWriteTokens,\n\t\t\ttotalTokens: this.totalTokens,\n\t\t\tcostUsd: this.costUsd,\n\t\t\twallClockMs: this.wallClockMsAt(this.currentTime()),\n\t\t};\n\t}\n\n\tprivate authorize(\n\t\tmanifest: ToolCapabilityManifest,\n\t\ttoolName: string,\n\t\tparams: unknown,\n\t\tnow: number,\n\t\twallClockMs: number,\n\t): void {\n\t\tif (this.grant.expiresAt && Date.parse(this.grant.expiresAt) <= now) {\n\t\t\tthis.deny(toolName, \"grant_expired\", `Execution grant '${this.grant.grantId}' expired.`);\n\t\t}\n\t\tif (!this.grant.allowedTools.includes(toolName)) {\n\t\t\tthis.deny(toolName, \"tool_not_granted\", `Tool '${toolName}' is not in grant '${this.grant.grantId}'.`);\n\t\t}\n\t\tif (manifest.toolName !== toolName) {\n\t\t\tthis.deny(toolName, \"manifest_name_mismatch\", `Tool '${toolName}' does not match its capability manifest.`);\n\t\t}\n\t\tif (!manifest.capabilities.every((capability) => this.grant.capabilities.includes(capability))) {\n\t\t\tthis.deny(toolName, \"capability_not_granted\", `Tool '${toolName}' requires an ungranted capability.`);\n\t\t}\n\t\tconst callCapabilities = getToolCapabilityPolicy(toolName)\n\t\t\t? resolveToolCallCapabilities(manifest.capabilities, toolName, params)\n\t\t\t: manifest.capabilities;\n\t\tif (!callCapabilities) {\n\t\t\tthis.deny(\n\t\t\t\ttoolName,\n\t\t\t\t\"capability_not_granted\",\n\t\t\t\t`Tool '${toolName}' action requires a capability outside its compiled manifest.`,\n\t\t\t);\n\t\t}\n\t\tthis.enforceBudget(toolName, wallClockMs);\n\t\tthis.sharedBudget?.assertBudgetAvailable(toolName);\n\n\t\tconst canonicalPolicy = getToolCapabilityPolicy(toolName);\n\t\tconst hasDeclaredPathScope = manifest.enforcements.includes(\"path-scope\");\n\t\tconst pathAccess = canonicalPolicy\n\t\t\t? resolveToolCallPathAccess(manifest.capabilities, toolName, params)\n\t\t\t: hasDeclaredPathScope\n\t\t\t\t? (resolveCapabilityPathAccess(callCapabilities) ?? \"none\")\n\t\t\t\t: \"none\";\n\t\tconst paths = pathAccess === \"none\" ? [] : extractToolPathArguments(toolName, params);\n\t\tif (\n\t\t\tpathAccess !== \"none\" &&\n\t\t\t(callCapabilities.some((capability) => PATH_CAPABILITIES.has(capability)) || paths.length > 0)\n\t\t) {\n\t\t\tconst isWrite =\n\t\t\t\tpathAccess === \"write\" || callCapabilities.some((capability) => WRITE_CAPABILITIES.has(capability));\n\t\t\tconst allowedPaths = isWrite ? this.grant.writePaths : this.grant.readPaths;\n\t\t\tif (paths.length === 0) {\n\t\t\t\tthis.deny(toolName, \"path_argument_required\", `Tool '${toolName}' requires an explicit path argument.`);\n\t\t\t}\n\t\t\tfor (const rawPath of paths) {\n\t\t\t\tif (!this.pathAllowed(rawPath, allowedPaths)) {\n\t\t\t\t\tconst reasonCode = isWrite ? \"scope_denied\" : \"path_outside_scope\";\n\t\t\t\t\tthis.deny(toolName, reasonCode, `Path '${rawPath}' is outside grant '${this.grant.grantId}'.`);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate enforceBudget(toolName: string, wallClockMs: number): void {\n\t\tconst budget = this.grant.budget;\n\t\tif (budget.maxToolCalls !== undefined && this.toolCalls >= budget.maxToolCalls) {\n\t\t\tthis.deny(toolName, \"tool_call_budget_exhausted\", \"Tool-call budget exhausted.\");\n\t\t}\n\t\tif (budget.maxTokens !== undefined && budgetedTokens(this.getUsage()) >= budget.maxTokens) {\n\t\t\tthis.deny(toolName, \"token_budget_exhausted\", \"Token budget exhausted.\");\n\t\t}\n\t\tif (budget.maxCostUsd !== undefined && this.costUsd >= budget.maxCostUsd) {\n\t\t\tthis.deny(toolName, \"cost_budget_exhausted\", \"Cost budget exhausted.\");\n\t\t}\n\t\tif (budget.maxWallClockMs !== undefined && wallClockMs >= budget.maxWallClockMs) {\n\t\t\tthis.deny(toolName, \"wall_clock_budget_exhausted\", \"Wall-clock budget exhausted.\");\n\t\t}\n\t}\n\n\tprivate currentTime(): number {\n\t\tconst now = this.now();\n\t\tif (!Number.isFinite(now)) {\n\t\t\tthrow new Error(\"CapabilityGateway: clock source must return a finite time.\");\n\t\t}\n\t\treturn now;\n\t}\n\n\tprivate wallClockMsAt(now: number): number {\n\t\tconst elapsed = now - this.startedAt;\n\t\tif (!Number.isFinite(elapsed)) {\n\t\t\tthrow new Error(\"CapabilityGateway: active wall-clock elapsed time must be finite.\");\n\t\t}\n\t\tconst wallClockMs = this.initialWallClockMs + Math.max(0, elapsed);\n\t\tif (!Number.isFinite(wallClockMs) || wallClockMs < 0) {\n\t\t\tthrow new Error(\"CapabilityGateway: accumulated wall-clock usage must be finite and non-negative.\");\n\t\t}\n\t\treturn wallClockMs;\n\t}\n\n\tprivate pathAllowed(rawPath: string, allowedPaths: readonly string[]): boolean {\n\t\tif (allowedPaths.length === 0) return false;\n\t\tconst lexicalTarget = resolve(this.cwd, rawPath);\n\t\tconst allowedRoots = allowedPaths.flatMap((allowed) => {\n\t\t\tconst lexicalRoot = resolve(this.cwd, allowed);\n\t\t\tconst realRoot = resolveRealPath(this.cwd, allowed);\n\t\t\treturn realRoot ? [lexicalRoot, realRoot] : [lexicalRoot];\n\t\t});\n\t\tif (!allowedRoots.some((root) => isPathWithinScope(lexicalTarget, root))) {\n\t\t\treturn false;\n\t\t}\n\t\tconst target = resolveRealPath(this.cwd, rawPath);\n\t\tif (!target) return false;\n\t\tfor (const denied of this.grant.deniedPaths) {\n\t\t\tconst root = resolveRealPath(this.cwd, denied);\n\t\t\tif (root && isPathWithinScope(target, root)) return false;\n\t\t}\n\t\treturn allowedRoots.some((root) => isPathWithinScope(target, root));\n\t}\n\n\tprivate deny(toolName: string, reasonCode: GatewayDecisionCode, message: string): never {\n\t\tthis.audit(toolName, \"deny\", reasonCode);\n\t\tthrow new CapabilityGatewayDeniedError(reasonCode, message);\n\t}\n\n\tprivate audit(toolName: string, outcome: \"allow\" | \"deny\", reasonCode: GatewayDecisionCode): void {\n\t\tthis.onAudit?.({\n\t\t\tgrantId: this.grant.grantId,\n\t\t\tattemptId: this.grant.attemptId,\n\t\t\ttoolName,\n\t\t\toutcome,\n\t\t\treasonCode,\n\t\t\tat: new Date(this.currentTime()).toISOString(),\n\t\t});\n\t}\n}\n"]}

package/dist/core/orchestration/lane-tool-manifests.js

@@ -1,5 +1,5 @@
 import { mapToolNamesForPlatform } from "../default-tool-surface.js";
-import { getToolCapabilityPolicy, resolveProfileToolCapability } from "../tool-capability-policy.js";
+import { getToolCapabilityPolicy, resolveProfileToolCapabilities } from "../tool-capability-policy.js";
 export const CLASSIFIED_LANE_TOOL_NAMES = [
     "read",
     "grep",
@@ -24,15 +24,15 @@ export function buildLaneToolManifests(profile, enabledToolNames) {
         if (!enabled.has(toolName))
             continue;
         const policy = getToolCapabilityPolicy(toolName);
-        const capability = resolveProfileToolCapability(profile, toolName);
-        if (!capability || !policy)
+        const capabilities = resolveProfileToolCapabilities(profile, toolName);
+        if (!capabilities || !policy)
             continue;
         manifests.push({
             toolName,
             moduleSpecifier: `../tools/${toolName}.ts`,
-            capabilities: [capability],
+            capabilities,
             roles: [profile.role],
-            enforcements: [policy.enforcement],
+            enforcements: policy.enforcements,
         });
     }
     return manifests;

package/dist/core/orchestration/lane-tool-manifests.js.map

@@ -1 +1 @@
-{"version":3,"file":"lane-tool-manifests.js","sourceRoot":"","sources":["../../../src/core/orchestration/lane-tool-manifests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAGrG,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACzC,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,MAAM;CACG,CAAC;AACX,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,0BAA0B,EAAE,UAAU,CAAU,CAAC;AAErG;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACrC,OAA6B,EAC7B,gBAAmC;IAEnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,SAAS,GAA6B,EAAE,CAAC;IAE/C,KAAK,MAAM,QAAQ,IAAI,IAAI,GAAG,CAAC,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM;YAAE,SAAS;QACrC,SAAS,CAAC,IAAI,CAAC;YACd,QAAQ;YACR,eAAe,EAAE,YAAY,QAAQ,KAAK;YAC1C,YAAY,EAAE,CAAC,UAAU,CAAC;YAC1B,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YACrB,YAAY,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;SAClC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC","sourcesContent":["import { mapToolNamesForPlatform } from \"../default-tool-surface.ts\";\nimport { getToolCapabilityPolicy, resolveProfileToolCapability } from \"../tool-capability-policy.ts\";\nimport type { OrchestrationProfile, ToolCapabilityManifest } from \"./contracts.ts\";\n\nexport const CLASSIFIED_LANE_TOOL_NAMES = [\n\t\"read\",\n\t\"grep\",\n\t\"find\",\n\t\"ls\",\n\t\"write\",\n\t\"edit\",\n\t\"memory\",\n\t\"python\",\n\t\"run_process\",\n\t\"bash\",\n] as const;\nexport const ORCHESTRATION_PROFILE_TOOL_NAMES = [...CLASSIFIED_LANE_TOOL_NAMES, \"delegate\"] as const;\n\n/**\n * Manifest-only lane catalogue. It contains no tool factories, so policy compilation can omit\n * denied tools before their executable implementations are constructed.\n */\nexport function buildLaneToolManifests(\n\tprofile: OrchestrationProfile,\n\tenabledToolNames: readonly string[],\n): ToolCapabilityManifest[] {\n\tconst enabled = new Set(enabledToolNames);\n\tconst manifests: ToolCapabilityManifest[] = [];\n\n\tfor (const toolName of new Set(mapToolNamesForPlatform(profile.toolNames))) {\n\t\tif (!enabled.has(toolName)) continue;\n\t\tconst policy = getToolCapabilityPolicy(toolName);\n\t\tconst capability = resolveProfileToolCapability(profile, toolName);\n\t\tif (!capability || !policy) continue;\n\t\tmanifests.push({\n\t\t\ttoolName,\n\t\t\tmoduleSpecifier: `../tools/${toolName}.ts`,\n\t\t\tcapabilities: [capability],\n\t\t\troles: [profile.role],\n\t\t\tenforcements: [policy.enforcement],\n\t\t});\n\t}\n\treturn manifests;\n}\n"]}
+{"version":3,"file":"lane-tool-manifests.js","sourceRoot":"","sources":["../../../src/core/orchestration/lane-tool-manifests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAGvG,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACzC,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;IACJ,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,MAAM;CACG,CAAC;AACX,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,0BAA0B,EAAE,UAAU,CAAU,CAAC;AAErG;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACrC,OAA6B,EAC7B,gBAAmC;IAEnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,SAAS,GAA6B,EAAE,CAAC;IAE/C,KAAK,MAAM,QAAQ,IAAI,IAAI,GAAG,CAAC,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,8BAA8B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM;YAAE,SAAS;QACvC,SAAS,CAAC,IAAI,CAAC;YACd,QAAQ;YACR,eAAe,EAAE,YAAY,QAAQ,KAAK;YAC1C,YAAY;YACZ,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YACrB,YAAY,EAAE,MAAM,CAAC,YAAY;SACjC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC","sourcesContent":["import { mapToolNamesForPlatform } from \"../default-tool-surface.ts\";\nimport { getToolCapabilityPolicy, resolveProfileToolCapabilities } from \"../tool-capability-policy.ts\";\nimport type { OrchestrationProfile, ToolCapabilityManifest } from \"./contracts.ts\";\n\nexport const CLASSIFIED_LANE_TOOL_NAMES = [\n\t\"read\",\n\t\"grep\",\n\t\"find\",\n\t\"ls\",\n\t\"write\",\n\t\"edit\",\n\t\"memory\",\n\t\"python\",\n\t\"run_process\",\n\t\"bash\",\n] as const;\nexport const ORCHESTRATION_PROFILE_TOOL_NAMES = [...CLASSIFIED_LANE_TOOL_NAMES, \"delegate\"] as const;\n\n/**\n * Manifest-only lane catalogue. It contains no tool factories, so policy compilation can omit\n * denied tools before their executable implementations are constructed.\n */\nexport function buildLaneToolManifests(\n\tprofile: OrchestrationProfile,\n\tenabledToolNames: readonly string[],\n): ToolCapabilityManifest[] {\n\tconst enabled = new Set(enabledToolNames);\n\tconst manifests: ToolCapabilityManifest[] = [];\n\n\tfor (const toolName of new Set(mapToolNamesForPlatform(profile.toolNames))) {\n\t\tif (!enabled.has(toolName)) continue;\n\t\tconst policy = getToolCapabilityPolicy(toolName);\n\t\tconst capabilities = resolveProfileToolCapabilities(profile, toolName);\n\t\tif (!capabilities || !policy) continue;\n\t\tmanifests.push({\n\t\t\ttoolName,\n\t\t\tmoduleSpecifier: `../tools/${toolName}.ts`,\n\t\t\tcapabilities,\n\t\t\troles: [profile.role],\n\t\t\tenforcements: policy.enforcements,\n\t\t});\n\t}\n\treturn manifests;\n}\n"]}

package/dist/core/orchestration/policy-compiler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-compiler.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/policy-compiler.ts"],"names":[],"mappings":"AACA,OAAO,EACN,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAEnB,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,MAAM,gBAAgB,CAAC;AAGxB,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC,CAQvG,CAAC;AAEF,MAAM,WAAW,0BAA0B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,oBAAoB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACnD,qBAAqB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrD,qBAAqB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACpD,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACjD,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,uBAAuB,GAChC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAAE,GAC7F;IACA,OAAO,EAAE,mBAAmB,CAAC;IAC7B,QAAQ,EAAE,uBAAuB,CAAC;IAClC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACzC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjG,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC,CAAC,CAAC;CACpF;AAiDD,qBAAa,uBAAuB;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA6D;IAEpG,YAAY,OAAO,GAAE,qBAA0B,EAI9C;IAED,OAAO,CAAC,KAAK,EAAE,0BAA0B,GAAG,uBAAuB,CAmIlE;CACD"}
+{"version":3,"file":"policy-compiler.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/policy-compiler.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAEnB,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,MAAM,gBAAgB,CAAC;AAGxB,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC,CAQvG,CAAC;AAEF,MAAM,WAAW,0BAA0B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,oBAAoB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACnD,qBAAqB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrD,qBAAqB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACpD,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACjD,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,uBAAuB,GAChC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,aAAa,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAAE,GAC7F;IACA,OAAO,EAAE,mBAAmB,CAAC;IAC7B,QAAQ,EAAE,uBAAuB,CAAC;IAClC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACzC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjG,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACxB,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC,CAAC,CAAC;CACpF;AAiDD,qBAAa,uBAAuB;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA6D;IAEpG,YAAY,OAAO,GAAE,qBAA0B,EAI9C;IAED,OAAO,CAAC,KAAK,EAAE,0BAA0B,GAAG,uBAAuB,CA2IlE;CACD"}

package/dist/core/orchestration/policy-compiler.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { getToolCapabilityPolicy } from "../tool-capability-policy.js";
 import { HARNESS_CAPABILITIES, ORCHESTRATION_SCHEMA_VERSION, } from "./contracts.js";
 import { exceededRiskBudgetFields, intersectRiskBudgets, validateRiskBudget } from "./risk-budget.js";
 export const DEFAULT_ROLE_CAPABILITY_CEILINGS = {
@@ -140,6 +141,12 @@ export class ExecutionPolicyCompiler {
                 toolReasonCodes.push(`tool_capability_denied:${toolName}`);
                 continue;
             }
+            const canonicalPolicy = getToolCapabilityPolicy(toolName);
+            if (canonicalPolicy &&
+                !canonicalPolicy.enforcements.every((enforcement) => manifest.enforcements.includes(enforcement))) {
+                toolReasonCodes.push(`tool_enforcement_missing:${toolName}`);
+                continue;
+            }
             if (!manifest.capabilities.every((capability) => {
                 const enforcement = CAPABILITY_ENFORCEMENT.get(capability);
                 return enforcement !== undefined && manifest.enforcements.includes(enforcement);

package/dist/core/orchestration/policy-compiler.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-compiler.js","sourceRoot":"","sources":["../../../src/core/orchestration/policy-compiler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAIN,oBAAoB,EAEpB,4BAA4B,GAK5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtG,MAAM,CAAC,MAAM,gCAAgC,GAA+D;IAC3G,YAAY,EAAE,oBAAoB;IAClC,OAAO,EAAE,oBAAoB;IAC7B,QAAQ,EAAE,oBAAoB;IAC9B,WAAW,EAAE,oBAAoB;IACjC,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,oBAAoB;CAC9B,CAAC;AAuCF,SAAS,MAAM,CAAI,MAAoB;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,KAAqB;IACzC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,QAAQ;YAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,aAAa;QAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAoE;IACzG,CAAC,iBAAiB,EAAE,YAAY,CAAC;IACjC,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAClC,CAAC,eAAe,EAAE,YAAY,CAAC;IAC/B,CAAC,iBAAiB,EAAE,YAAY,CAAC;IACjC,CAAC,cAAc,EAAE,kBAAkB,CAAC;IACpC,CAAC,eAAe,EAAE,kBAAkB,CAAC;IACrC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,aAAa,EAAE,eAAe,CAAC;IAChC,CAAC,iBAAiB,EAAE,eAAe,CAAC;IACpC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,gBAAgB,EAAE,eAAe,CAAC;IACnC,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,CAAC,aAAa,EAAE,YAAY,CAAC;IAC7B,CAAC,aAAa,EAAE,YAAY,CAAC;IAC7B,CAAC,cAAc,EAAE,YAAY,CAAC;IAC9B,CAAC,kBAAkB,EAAE,eAAe,CAAC;IACrC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,mBAAmB,EAAE,eAAe,CAAC;IACtC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,kBAAkB,EAAE,eAAe,CAAC;IACrC,CAAC,iBAAiB,EAAE,eAAe,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,OAAO,uBAAuB;IAKnC,YAAY,OAAO,GAA0B,EAAE;QAC9C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;QAC/C,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,gCAAgC,CAAC;IAClG,CAAC;IAED,OAAO,CAAC,KAAiC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,IAAI,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAyB,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAwB,EAAE,CAAC;QAC3C,MAAM,oBAAoB,GAAwB,EAAE,CAAC;QACrD,MAAM,OAAO,GAAwB,EAAE,CAAC;QAExC,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvG,SAAS;YACV,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtC,SAAS,CAAC,IAAI,CAAC;oBACd,UAAU;oBACV,OAAO,EAAE,MAAM;oBACf,UAAU,EAAE,0BAA0B;oBACtC,MAAM,EAAE,WAAW;iBACnB,CAAC,CAAC;gBACH,SAAS;YACV,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACzB,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChH,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,0CAA0C,CAAC,EAAE,CAAC;QAClG,CAAC;QAED,MAAM,eAAe,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,MAAM,eAAe,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,kBAAkB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACvD,kBAAkB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACvD,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACxF,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjH,MAAM,QAAQ,GAA4B;gBACzC,aAAa,EAAE,4BAA4B;gBAC3C,UAAU,EAAE,YAAY,IAAI,CAAC,QAAQ,EAAE,EAAE;gBACzC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EACT,oBAAoB,CAAC,MAAM,GAAG,CAAC;oBAC9B,CAAC,CAAC,oCAAoC;oBACtC,CAAC,CAAC,qCAAqC;gBACzC,OAAO,EACN,oBAAoB,CAAC,MAAM,GAAG,CAAC;oBAC9B,CAAC,CAAC,2CAA2C,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC/E,CAAC,CAAC,+CAA+C,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACrF,qBAAqB,EAAE,oBAAoB;gBAC3C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACrB,CAAC;YACF,OAAO;gBACN,OAAO,EAAE,mBAAmB;gBAC5B,QAAQ;gBACR,SAAS;gBACT,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;aAClC,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtG,MAAM,gBAAgB,GAA6B,EAAE,CAAC;QACtD,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,eAAe,CAAC,IAAI,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC;gBACjD,SAAS;YACV,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,eAAe,CAAC,IAAI,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC;gBACrD,SAAS;YACV,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAChF,eAAe,CAAC,IAAI,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;gBAC3D,SAAS;YACV,CAAC;YACD,IACC,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE;gBAC3C,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC3D,OAAO,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACjF,CAAC,CAAC,EACD,CAAC;gBACF,eAAe,CAAC,IAAI,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;gBAC7D,SAAS;YACV,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1G,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,6CAA6C,CAAC,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9G,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,8CAA8C,CAAC,EAAE,CAAC;QACtG,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC;YACzB,aAAa,EAAE,4BAA4B;YAC3C,OAAO,EAAE,SAAS,IAAI,CAAC,QAAQ,EAAE,EAAE;YACnC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,OAAO;YACrB,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnE,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;YACjD,SAAS;YACT,UAAU;YACV,WAAW;YACX,MAAM,EAAE,oBAAoB,CAAC,eAAe,EAAE,eAAe,CAAC;YAC9D,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa,EAAE,SAAS;YACxB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC;IACrE,CAAC;CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n\ttype ApprovalRequestContract,\n\ttype CapabilityDecision,\n\ttype ExecutionGrant,\n\tHARNESS_CAPABILITIES,\n\ttype HarnessCapability,\n\tORCHESTRATION_SCHEMA_VERSION,\n\ttype ResourcePointer,\n\ttype RiskBudget,\n\ttype ToolCapabilityManifest,\n\ttype WorkerRole,\n} from \"./contracts.ts\";\nimport { exceededRiskBudgetFields, intersectRiskBudgets, validateRiskBudget } from \"./risk-budget.ts\";\n\nexport const DEFAULT_ROLE_CAPABILITY_CEILINGS: Readonly<Record<WorkerRole, readonly HarnessCapability[]>> = {\n\torchestrator: HARNESS_CAPABILITIES,\n\tplanner: HARNESS_CAPABILITIES,\n\texplorer: HARNESS_CAPABILITIES,\n\timplementer: HARNESS_CAPABILITIES,\n\toperator: HARNESS_CAPABILITIES,\n\tverifier: HARNESS_CAPABILITIES,\n\tdatabase: HARNESS_CAPABILITIES,\n};\n\nexport interface CompileExecutionGrantInput {\n\tobjectiveId: string;\n\ttaskId: string;\n\tattemptId: string;\n\tsubjectId: string;\n\trole: WorkerRole;\n\trequiredCapabilities: readonly HarnessCapability[];\n\trequestedCapabilities?: readonly HarnessCapability[];\n\tauthorityCapabilities: readonly HarnessCapability[];\n\trequestedTools: readonly string[];\n\ttoolManifests: readonly ToolCapabilityManifest[];\n\tresources?: readonly ResourcePointer[];\n\treadPaths?: readonly string[];\n\twritePaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\trequestedBudget?: RiskBudget;\n\tauthorityBudget?: RiskBudget;\n\tpolicyVersion: string;\n\texpiresAt?: string;\n}\n\nexport type PolicyCompilationResult =\n\t| { outcome: \"allow\"; grant: ExecutionGrant; toolManifests: readonly ToolCapabilityManifest[] }\n\t| {\n\t\t\toutcome: \"approval-required\";\n\t\t\tapproval: ApprovalRequestContract;\n\t\t\tdecisions: readonly CapabilityDecision[];\n\t\t\treasonCodes: readonly string[];\n\t  }\n\t| { outcome: \"deny\"; decisions: readonly CapabilityDecision[]; reasonCodes: readonly string[] };\n\nexport interface PolicyCompilerOptions {\n\tnow?: () => string;\n\tcreateId?: () => string;\n\troleCapabilityCeilings?: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;\n}\n\nfunction unique<T>(values: readonly T[]): T[] {\n\treturn [...new Set(values)];\n}\n\nfunction freezeGrant(grant: ExecutionGrant): ExecutionGrant {\n\tfor (const resource of grant.resources) {\n\t\tif (resource.metadata) Object.freeze(resource.metadata);\n\t\tObject.freeze(resource);\n\t}\n\tfor (const decision of grant.decisionTrace) Object.freeze(decision);\n\tObject.freeze(grant.capabilities);\n\tObject.freeze(grant.allowedTools);\n\tObject.freeze(grant.resources);\n\tObject.freeze(grant.readPaths);\n\tObject.freeze(grant.writePaths);\n\tObject.freeze(grant.deniedPaths);\n\tObject.freeze(grant.budget);\n\tObject.freeze(grant.decisionTrace);\n\treturn Object.freeze(grant);\n}\n\nconst CAPABILITY_ENFORCEMENT = new Map<HarnessCapability, ToolCapabilityManifest[\"enforcements\"][number]>([\n\t[\"filesystem.read\", \"path-scope\"],\n\t[\"filesystem.write\", \"path-scope\"],\n\t[\"worktree.read\", \"path-scope\"],\n\t[\"worktree.mutate\", \"path-scope\"],\n\t[\"process.exec\", \"process-launcher\"],\n\t[\"tests.execute\", \"process-launcher\"],\n\t[\"network.http\", \"service-proxy\"],\n\t[\"service.mcp\", \"service-proxy\"],\n\t[\"credentials.use\", \"service-proxy\"],\n\t[\"memory.query\", \"memory-broker\"],\n\t[\"memory.mutate\", \"memory-broker\"],\n\t[\"settings.read\", \"control-plane\"],\n\t[\"settings.write\", \"control-plane\"],\n\t[\"skill.read\", \"path-scope\"],\n\t[\"skill.write\", \"path-scope\"],\n\t[\"source.read\", \"path-scope\"],\n\t[\"source.write\", \"path-scope\"],\n\t[\"research.execute\", \"control-plane\"],\n\t[\"workflow.plan\", \"control-plane\"],\n\t[\"workflow.delegate\", \"control-plane\"],\n\t[\"policy.modify\", \"control-plane\"],\n\t[\"learning.propose\", \"control-plane\"],\n\t[\"publish.execute\", \"control-plane\"],\n]);\n\nexport class ExecutionPolicyCompiler {\n\tprivate readonly now: () => string;\n\tprivate readonly createId: () => string;\n\tprivate readonly roleCapabilityCeilings: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;\n\n\tconstructor(options: PolicyCompilerOptions = {}) {\n\t\tthis.now = options.now ?? (() => new Date().toISOString());\n\t\tthis.createId = options.createId ?? randomUUID;\n\t\tthis.roleCapabilityCeilings = options.roleCapabilityCeilings ?? DEFAULT_ROLE_CAPABILITY_CEILINGS;\n\t}\n\n\tcompile(input: CompileExecutionGrantInput): PolicyCompilationResult {\n\t\tconst required = unique(input.requiredCapabilities);\n\t\tconst requested = unique([...(input.requestedCapabilities ?? required), ...required]);\n\t\tconst authority = new Set(input.authorityCapabilities);\n\t\tconst roleCeiling = new Set(this.roleCapabilityCeilings[input.role]);\n\t\tconst decisions: CapabilityDecision[] = [];\n\t\tconst roleDenied: HarnessCapability[] = [];\n\t\tconst approvalCapabilities: HarnessCapability[] = [];\n\t\tconst granted: HarnessCapability[] = [];\n\n\t\tfor (const capability of requested) {\n\t\t\tif (!roleCeiling.has(capability)) {\n\t\t\t\troleDenied.push(capability);\n\t\t\t\tdecisions.push({ capability, outcome: \"deny\", reasonCode: \"role_ceiling_denied\", source: input.role });\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!authority.has(capability)) {\n\t\t\t\tapprovalCapabilities.push(capability);\n\t\t\t\tdecisions.push({\n\t\t\t\t\tcapability,\n\t\t\t\t\toutcome: \"deny\",\n\t\t\t\t\treasonCode: \"owner_authority_required\",\n\t\t\t\t\tsource: \"authority\",\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tgranted.push(capability);\n\t\t\tdecisions.push({ capability, outcome: \"allow\", reasonCode: \"role_and_authority_allowed\", source: input.role });\n\t\t}\n\n\t\tif (roleDenied.some((capability) => required.includes(capability))) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"required_capability_exceeds_role_ceiling\"] };\n\t\t}\n\n\t\tconst requestedBudget = { ...(input.requestedBudget ?? {}) };\n\t\tconst authorityBudget = { ...(input.authorityBudget ?? {}) };\n\t\tvalidateRiskBudget(requestedBudget, \"requestedBudget\");\n\t\tvalidateRiskBudget(authorityBudget, \"authorityBudget\");\n\t\tconst exceededBudgetFields = exceededRiskBudgetFields(requestedBudget, authorityBudget);\n\t\tif (approvalCapabilities.some((capability) => required.includes(capability)) || exceededBudgetFields.length > 0) {\n\t\t\tconst approval: ApprovalRequestContract = {\n\t\t\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\t\t\tapprovalId: `approval-${this.createId()}`,\n\t\t\t\tobjectiveId: input.objectiveId,\n\t\t\t\ttaskId: input.taskId,\n\t\t\t\tattemptId: input.attemptId,\n\t\t\t\treasonCode:\n\t\t\t\t\texceededBudgetFields.length > 0\n\t\t\t\t\t\t? \"requested_budget_exceeds_authority\"\n\t\t\t\t\t\t: \"required_capability_needs_authority\",\n\t\t\t\tsummary:\n\t\t\t\t\texceededBudgetFields.length > 0\n\t\t\t\t\t\t? `Requested budget exceeds authority for: ${exceededBudgetFields.join(\", \")}.`\n\t\t\t\t\t\t: `Required capabilities need owner authority: ${approvalCapabilities.join(\", \")}.`,\n\t\t\t\trequestedCapabilities: approvalCapabilities,\n\t\t\t\t...(Object.keys(requestedBudget).length > 0 ? { requestedBudget } : {}),\n\t\t\t\treversible: true,\n\t\t\t\tcreatedAt: this.now(),\n\t\t\t};\n\t\t\treturn {\n\t\t\t\toutcome: \"approval-required\",\n\t\t\t\tapproval,\n\t\t\t\tdecisions,\n\t\t\t\treasonCodes: [approval.reasonCode],\n\t\t\t};\n\t\t}\n\n\t\tconst manifestsByName = new Map(input.toolManifests.map((manifest) => [manifest.toolName, manifest]));\n\t\tconst allowedManifests: ToolCapabilityManifest[] = [];\n\t\tconst toolReasonCodes: string[] = [];\n\t\tfor (const toolName of unique(input.requestedTools)) {\n\t\t\tconst manifest = manifestsByName.get(toolName);\n\t\t\tif (!manifest) {\n\t\t\t\ttoolReasonCodes.push(`unknown_tool:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!manifest.roles.includes(input.role)) {\n\t\t\t\ttoolReasonCodes.push(`tool_role_denied:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!manifest.capabilities.every((capability) => granted.includes(capability))) {\n\t\t\t\ttoolReasonCodes.push(`tool_capability_denied:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (\n\t\t\t\t!manifest.capabilities.every((capability) => {\n\t\t\t\t\tconst enforcement = CAPABILITY_ENFORCEMENT.get(capability);\n\t\t\t\t\treturn enforcement !== undefined && manifest.enforcements.includes(enforcement);\n\t\t\t\t})\n\t\t\t) {\n\t\t\t\ttoolReasonCodes.push(`tool_enforcement_missing:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tallowedManifests.push(structuredClone(manifest));\n\t\t}\n\n\t\tif (toolReasonCodes.length > 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: toolReasonCodes };\n\t\t}\n\n\t\tconst readPaths = unique(input.readPaths ?? []);\n\t\tconst writePaths = unique(input.writePaths ?? []);\n\t\tconst deniedPaths = unique(input.deniedPaths ?? []);\n\t\tif ((granted.includes(\"filesystem.read\") || granted.includes(\"worktree.read\")) && readPaths.length === 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"read_capability_missing_positive_path_scope\"] };\n\t\t}\n\t\tif ((granted.includes(\"filesystem.write\") || granted.includes(\"worktree.mutate\")) && writePaths.length === 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"write_capability_missing_positive_path_scope\"] };\n\t\t}\n\n\t\tconst grant = freezeGrant({\n\t\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\t\tgrantId: `grant-${this.createId()}`,\n\t\t\tobjectiveId: input.objectiveId,\n\t\t\ttaskId: input.taskId,\n\t\t\tattemptId: input.attemptId,\n\t\t\tsubjectId: input.subjectId,\n\t\t\trole: input.role,\n\t\t\tcapabilities: granted,\n\t\t\tallowedTools: allowedManifests.map((manifest) => manifest.toolName),\n\t\t\tresources: structuredClone(input.resources ?? []),\n\t\t\treadPaths,\n\t\t\twritePaths,\n\t\t\tdeniedPaths,\n\t\t\tbudget: intersectRiskBudgets(requestedBudget, authorityBudget),\n\t\t\tpolicyVersion: input.policyVersion,\n\t\t\tdecisionTrace: decisions,\n\t\t\tissuedAt: this.now(),\n\t\t\t...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n\t\t});\n\t\treturn { outcome: \"allow\", grant, toolManifests: allowedManifests };\n\t}\n}\n"]}
+{"version":3,"file":"policy-compiler.js","sourceRoot":"","sources":["../../../src/core/orchestration/policy-compiler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAIN,oBAAoB,EAEpB,4BAA4B,GAK5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtG,MAAM,CAAC,MAAM,gCAAgC,GAA+D;IAC3G,YAAY,EAAE,oBAAoB;IAClC,OAAO,EAAE,oBAAoB;IAC7B,QAAQ,EAAE,oBAAoB;IAC9B,WAAW,EAAE,oBAAoB;IACjC,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,oBAAoB;CAC9B,CAAC;AAuCF,SAAS,MAAM,CAAI,MAAoB;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,KAAqB;IACzC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,QAAQ;YAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,aAAa;QAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAoE;IACzG,CAAC,iBAAiB,EAAE,YAAY,CAAC;IACjC,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAClC,CAAC,eAAe,EAAE,YAAY,CAAC;IAC/B,CAAC,iBAAiB,EAAE,YAAY,CAAC;IACjC,CAAC,cAAc,EAAE,kBAAkB,CAAC;IACpC,CAAC,eAAe,EAAE,kBAAkB,CAAC;IACrC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,aAAa,EAAE,eAAe,CAAC;IAChC,CAAC,iBAAiB,EAAE,eAAe,CAAC;IACpC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,gBAAgB,EAAE,eAAe,CAAC;IACnC,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,CAAC,aAAa,EAAE,YAAY,CAAC;IAC7B,CAAC,aAAa,EAAE,YAAY,CAAC;IAC7B,CAAC,cAAc,EAAE,YAAY,CAAC;IAC9B,CAAC,kBAAkB,EAAE,eAAe,CAAC;IACrC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,mBAAmB,EAAE,eAAe,CAAC;IACtC,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,kBAAkB,EAAE,eAAe,CAAC;IACrC,CAAC,iBAAiB,EAAE,eAAe,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,OAAO,uBAAuB;IAKnC,YAAY,OAAO,GAA0B,EAAE;QAC9C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;QAC/C,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,gCAAgC,CAAC;IAClG,CAAC;IAED,OAAO,CAAC,KAAiC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,IAAI,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAyB,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAwB,EAAE,CAAC;QAC3C,MAAM,oBAAoB,GAAwB,EAAE,CAAC;QACrD,MAAM,OAAO,GAAwB,EAAE,CAAC;QAExC,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvG,SAAS;YACV,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtC,SAAS,CAAC,IAAI,CAAC;oBACd,UAAU;oBACV,OAAO,EAAE,MAAM;oBACf,UAAU,EAAE,0BAA0B;oBACtC,MAAM,EAAE,WAAW;iBACnB,CAAC,CAAC;gBACH,SAAS;YACV,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACzB,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChH,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,0CAA0C,CAAC,EAAE,CAAC;QAClG,CAAC;QAED,MAAM,eAAe,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,MAAM,eAAe,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,kBAAkB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACvD,kBAAkB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACvD,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACxF,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjH,MAAM,QAAQ,GAA4B;gBACzC,aAAa,EAAE,4BAA4B;gBAC3C,UAAU,EAAE,YAAY,IAAI,CAAC,QAAQ,EAAE,EAAE;gBACzC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EACT,oBAAoB,CAAC,MAAM,GAAG,CAAC;oBAC9B,CAAC,CAAC,oCAAoC;oBACtC,CAAC,CAAC,qCAAqC;gBACzC,OAAO,EACN,oBAAoB,CAAC,MAAM,GAAG,CAAC;oBAC9B,CAAC,CAAC,2CAA2C,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC/E,CAAC,CAAC,+CAA+C,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACrF,qBAAqB,EAAE,oBAAoB;gBAC3C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACrB,CAAC;YACF,OAAO;gBACN,OAAO,EAAE,mBAAmB;gBAC5B,QAAQ;gBACR,SAAS;gBACT,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;aAClC,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtG,MAAM,gBAAgB,GAA6B,EAAE,CAAC;QACtD,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,eAAe,CAAC,IAAI,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC;gBACjD,SAAS;YACV,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,eAAe,CAAC,IAAI,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC;gBACrD,SAAS;YACV,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAChF,eAAe,CAAC,IAAI,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;gBAC3D,SAAS;YACV,CAAC;YACD,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;YAC1D,IACC,eAAe;gBACf,CAAC,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAChG,CAAC;gBACF,eAAe,CAAC,IAAI,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;gBAC7D,SAAS;YACV,CAAC;YACD,IACC,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE;gBAC3C,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC3D,OAAO,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACjF,CAAC,CAAC,EACD,CAAC;gBACF,eAAe,CAAC,IAAI,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;gBAC7D,SAAS;YACV,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1G,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,6CAA6C,CAAC,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9G,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,8CAA8C,CAAC,EAAE,CAAC;QACtG,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC;YACzB,aAAa,EAAE,4BAA4B;YAC3C,OAAO,EAAE,SAAS,IAAI,CAAC,QAAQ,EAAE,EAAE;YACnC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,OAAO;YACrB,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnE,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;YACjD,SAAS;YACT,UAAU;YACV,WAAW;YACX,MAAM,EAAE,oBAAoB,CAAC,eAAe,EAAE,eAAe,CAAC;YAC9D,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa,EAAE,SAAS;YACxB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC;IACrE,CAAC;CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { getToolCapabilityPolicy } from \"../tool-capability-policy.ts\";\nimport {\n\ttype ApprovalRequestContract,\n\ttype CapabilityDecision,\n\ttype ExecutionGrant,\n\tHARNESS_CAPABILITIES,\n\ttype HarnessCapability,\n\tORCHESTRATION_SCHEMA_VERSION,\n\ttype ResourcePointer,\n\ttype RiskBudget,\n\ttype ToolCapabilityManifest,\n\ttype WorkerRole,\n} from \"./contracts.ts\";\nimport { exceededRiskBudgetFields, intersectRiskBudgets, validateRiskBudget } from \"./risk-budget.ts\";\n\nexport const DEFAULT_ROLE_CAPABILITY_CEILINGS: Readonly<Record<WorkerRole, readonly HarnessCapability[]>> = {\n\torchestrator: HARNESS_CAPABILITIES,\n\tplanner: HARNESS_CAPABILITIES,\n\texplorer: HARNESS_CAPABILITIES,\n\timplementer: HARNESS_CAPABILITIES,\n\toperator: HARNESS_CAPABILITIES,\n\tverifier: HARNESS_CAPABILITIES,\n\tdatabase: HARNESS_CAPABILITIES,\n};\n\nexport interface CompileExecutionGrantInput {\n\tobjectiveId: string;\n\ttaskId: string;\n\tattemptId: string;\n\tsubjectId: string;\n\trole: WorkerRole;\n\trequiredCapabilities: readonly HarnessCapability[];\n\trequestedCapabilities?: readonly HarnessCapability[];\n\tauthorityCapabilities: readonly HarnessCapability[];\n\trequestedTools: readonly string[];\n\ttoolManifests: readonly ToolCapabilityManifest[];\n\tresources?: readonly ResourcePointer[];\n\treadPaths?: readonly string[];\n\twritePaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\trequestedBudget?: RiskBudget;\n\tauthorityBudget?: RiskBudget;\n\tpolicyVersion: string;\n\texpiresAt?: string;\n}\n\nexport type PolicyCompilationResult =\n\t| { outcome: \"allow\"; grant: ExecutionGrant; toolManifests: readonly ToolCapabilityManifest[] }\n\t| {\n\t\t\toutcome: \"approval-required\";\n\t\t\tapproval: ApprovalRequestContract;\n\t\t\tdecisions: readonly CapabilityDecision[];\n\t\t\treasonCodes: readonly string[];\n\t  }\n\t| { outcome: \"deny\"; decisions: readonly CapabilityDecision[]; reasonCodes: readonly string[] };\n\nexport interface PolicyCompilerOptions {\n\tnow?: () => string;\n\tcreateId?: () => string;\n\troleCapabilityCeilings?: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;\n}\n\nfunction unique<T>(values: readonly T[]): T[] {\n\treturn [...new Set(values)];\n}\n\nfunction freezeGrant(grant: ExecutionGrant): ExecutionGrant {\n\tfor (const resource of grant.resources) {\n\t\tif (resource.metadata) Object.freeze(resource.metadata);\n\t\tObject.freeze(resource);\n\t}\n\tfor (const decision of grant.decisionTrace) Object.freeze(decision);\n\tObject.freeze(grant.capabilities);\n\tObject.freeze(grant.allowedTools);\n\tObject.freeze(grant.resources);\n\tObject.freeze(grant.readPaths);\n\tObject.freeze(grant.writePaths);\n\tObject.freeze(grant.deniedPaths);\n\tObject.freeze(grant.budget);\n\tObject.freeze(grant.decisionTrace);\n\treturn Object.freeze(grant);\n}\n\nconst CAPABILITY_ENFORCEMENT = new Map<HarnessCapability, ToolCapabilityManifest[\"enforcements\"][number]>([\n\t[\"filesystem.read\", \"path-scope\"],\n\t[\"filesystem.write\", \"path-scope\"],\n\t[\"worktree.read\", \"path-scope\"],\n\t[\"worktree.mutate\", \"path-scope\"],\n\t[\"process.exec\", \"process-launcher\"],\n\t[\"tests.execute\", \"process-launcher\"],\n\t[\"network.http\", \"service-proxy\"],\n\t[\"service.mcp\", \"service-proxy\"],\n\t[\"credentials.use\", \"service-proxy\"],\n\t[\"memory.query\", \"memory-broker\"],\n\t[\"memory.mutate\", \"memory-broker\"],\n\t[\"settings.read\", \"control-plane\"],\n\t[\"settings.write\", \"control-plane\"],\n\t[\"skill.read\", \"path-scope\"],\n\t[\"skill.write\", \"path-scope\"],\n\t[\"source.read\", \"path-scope\"],\n\t[\"source.write\", \"path-scope\"],\n\t[\"research.execute\", \"control-plane\"],\n\t[\"workflow.plan\", \"control-plane\"],\n\t[\"workflow.delegate\", \"control-plane\"],\n\t[\"policy.modify\", \"control-plane\"],\n\t[\"learning.propose\", \"control-plane\"],\n\t[\"publish.execute\", \"control-plane\"],\n]);\n\nexport class ExecutionPolicyCompiler {\n\tprivate readonly now: () => string;\n\tprivate readonly createId: () => string;\n\tprivate readonly roleCapabilityCeilings: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;\n\n\tconstructor(options: PolicyCompilerOptions = {}) {\n\t\tthis.now = options.now ?? (() => new Date().toISOString());\n\t\tthis.createId = options.createId ?? randomUUID;\n\t\tthis.roleCapabilityCeilings = options.roleCapabilityCeilings ?? DEFAULT_ROLE_CAPABILITY_CEILINGS;\n\t}\n\n\tcompile(input: CompileExecutionGrantInput): PolicyCompilationResult {\n\t\tconst required = unique(input.requiredCapabilities);\n\t\tconst requested = unique([...(input.requestedCapabilities ?? required), ...required]);\n\t\tconst authority = new Set(input.authorityCapabilities);\n\t\tconst roleCeiling = new Set(this.roleCapabilityCeilings[input.role]);\n\t\tconst decisions: CapabilityDecision[] = [];\n\t\tconst roleDenied: HarnessCapability[] = [];\n\t\tconst approvalCapabilities: HarnessCapability[] = [];\n\t\tconst granted: HarnessCapability[] = [];\n\n\t\tfor (const capability of requested) {\n\t\t\tif (!roleCeiling.has(capability)) {\n\t\t\t\troleDenied.push(capability);\n\t\t\t\tdecisions.push({ capability, outcome: \"deny\", reasonCode: \"role_ceiling_denied\", source: input.role });\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!authority.has(capability)) {\n\t\t\t\tapprovalCapabilities.push(capability);\n\t\t\t\tdecisions.push({\n\t\t\t\t\tcapability,\n\t\t\t\t\toutcome: \"deny\",\n\t\t\t\t\treasonCode: \"owner_authority_required\",\n\t\t\t\t\tsource: \"authority\",\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tgranted.push(capability);\n\t\t\tdecisions.push({ capability, outcome: \"allow\", reasonCode: \"role_and_authority_allowed\", source: input.role });\n\t\t}\n\n\t\tif (roleDenied.some((capability) => required.includes(capability))) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"required_capability_exceeds_role_ceiling\"] };\n\t\t}\n\n\t\tconst requestedBudget = { ...(input.requestedBudget ?? {}) };\n\t\tconst authorityBudget = { ...(input.authorityBudget ?? {}) };\n\t\tvalidateRiskBudget(requestedBudget, \"requestedBudget\");\n\t\tvalidateRiskBudget(authorityBudget, \"authorityBudget\");\n\t\tconst exceededBudgetFields = exceededRiskBudgetFields(requestedBudget, authorityBudget);\n\t\tif (approvalCapabilities.some((capability) => required.includes(capability)) || exceededBudgetFields.length > 0) {\n\t\t\tconst approval: ApprovalRequestContract = {\n\t\t\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\t\t\tapprovalId: `approval-${this.createId()}`,\n\t\t\t\tobjectiveId: input.objectiveId,\n\t\t\t\ttaskId: input.taskId,\n\t\t\t\tattemptId: input.attemptId,\n\t\t\t\treasonCode:\n\t\t\t\t\texceededBudgetFields.length > 0\n\t\t\t\t\t\t? \"requested_budget_exceeds_authority\"\n\t\t\t\t\t\t: \"required_capability_needs_authority\",\n\t\t\t\tsummary:\n\t\t\t\t\texceededBudgetFields.length > 0\n\t\t\t\t\t\t? `Requested budget exceeds authority for: ${exceededBudgetFields.join(\", \")}.`\n\t\t\t\t\t\t: `Required capabilities need owner authority: ${approvalCapabilities.join(\", \")}.`,\n\t\t\t\trequestedCapabilities: approvalCapabilities,\n\t\t\t\t...(Object.keys(requestedBudget).length > 0 ? { requestedBudget } : {}),\n\t\t\t\treversible: true,\n\t\t\t\tcreatedAt: this.now(),\n\t\t\t};\n\t\t\treturn {\n\t\t\t\toutcome: \"approval-required\",\n\t\t\t\tapproval,\n\t\t\t\tdecisions,\n\t\t\t\treasonCodes: [approval.reasonCode],\n\t\t\t};\n\t\t}\n\n\t\tconst manifestsByName = new Map(input.toolManifests.map((manifest) => [manifest.toolName, manifest]));\n\t\tconst allowedManifests: ToolCapabilityManifest[] = [];\n\t\tconst toolReasonCodes: string[] = [];\n\t\tfor (const toolName of unique(input.requestedTools)) {\n\t\t\tconst manifest = manifestsByName.get(toolName);\n\t\t\tif (!manifest) {\n\t\t\t\ttoolReasonCodes.push(`unknown_tool:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!manifest.roles.includes(input.role)) {\n\t\t\t\ttoolReasonCodes.push(`tool_role_denied:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!manifest.capabilities.every((capability) => granted.includes(capability))) {\n\t\t\t\ttoolReasonCodes.push(`tool_capability_denied:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst canonicalPolicy = getToolCapabilityPolicy(toolName);\n\t\t\tif (\n\t\t\t\tcanonicalPolicy &&\n\t\t\t\t!canonicalPolicy.enforcements.every((enforcement) => manifest.enforcements.includes(enforcement))\n\t\t\t) {\n\t\t\t\ttoolReasonCodes.push(`tool_enforcement_missing:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (\n\t\t\t\t!manifest.capabilities.every((capability) => {\n\t\t\t\t\tconst enforcement = CAPABILITY_ENFORCEMENT.get(capability);\n\t\t\t\t\treturn enforcement !== undefined && manifest.enforcements.includes(enforcement);\n\t\t\t\t})\n\t\t\t) {\n\t\t\t\ttoolReasonCodes.push(`tool_enforcement_missing:${toolName}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tallowedManifests.push(structuredClone(manifest));\n\t\t}\n\n\t\tif (toolReasonCodes.length > 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: toolReasonCodes };\n\t\t}\n\n\t\tconst readPaths = unique(input.readPaths ?? []);\n\t\tconst writePaths = unique(input.writePaths ?? []);\n\t\tconst deniedPaths = unique(input.deniedPaths ?? []);\n\t\tif ((granted.includes(\"filesystem.read\") || granted.includes(\"worktree.read\")) && readPaths.length === 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"read_capability_missing_positive_path_scope\"] };\n\t\t}\n\t\tif ((granted.includes(\"filesystem.write\") || granted.includes(\"worktree.mutate\")) && writePaths.length === 0) {\n\t\t\treturn { outcome: \"deny\", decisions, reasonCodes: [\"write_capability_missing_positive_path_scope\"] };\n\t\t}\n\n\t\tconst grant = freezeGrant({\n\t\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\t\tgrantId: `grant-${this.createId()}`,\n\t\t\tobjectiveId: input.objectiveId,\n\t\t\ttaskId: input.taskId,\n\t\t\tattemptId: input.attemptId,\n\t\t\tsubjectId: input.subjectId,\n\t\t\trole: input.role,\n\t\t\tcapabilities: granted,\n\t\t\tallowedTools: allowedManifests.map((manifest) => manifest.toolName),\n\t\t\tresources: structuredClone(input.resources ?? []),\n\t\t\treadPaths,\n\t\t\twritePaths,\n\t\t\tdeniedPaths,\n\t\t\tbudget: intersectRiskBudgets(requestedBudget, authorityBudget),\n\t\t\tpolicyVersion: input.policyVersion,\n\t\t\tdecisionTrace: decisions,\n\t\t\tissuedAt: this.now(),\n\t\t\t...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n\t\t});\n\t\treturn { outcome: \"allow\", grant, toolManifests: allowedManifests };\n\t}\n}\n"]}

package/dist/core/orchestration/profile-registry.js

@@ -1,4 +1,4 @@
-import { describeToolCapabilityAuthority, resolveProfileToolCapability } from "../tool-capability-policy.js";
+import { describeToolCapabilityAuthority, resolveProfileToolCapabilities } from "../tool-capability-policy.js";
 import { hasOnlyKeys, isPlainRecord } from "../util/value-guards.js";
 import { HARNESS_CAPABILITIES, MAX_ORCHESTRATION_AGENT_BINDINGS, MAX_ORCHESTRATION_AGENT_DEPTH, MAX_ORCHESTRATION_COLLECTION_LENGTH, MAX_ORCHESTRATION_DESCRIPTION_LENGTH, MAX_ORCHESTRATION_DIRECT_CHILDREN, MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH, MAX_ORCHESTRATION_IDENTIFIER_LENGTH, MAX_ORCHESTRATION_MODEL_ID_LENGTH, MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH, MAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES, MAX_WORKER_AUTHORITY_PATH_LENGTH, ORCHESTRATION_SCHEMA_VERSION, ORCHESTRATION_THINKING_LEVELS, toJsonObject, WORKER_ROLES, } from "./contracts.js";
 import { ORCHESTRATION_PROFILE_TOOL_NAMES } from "./lane-tool-manifests.js";
@@ -180,7 +180,7 @@ export function validateOrchestrationProfile(profile) {
         throw new OrchestrationProfileError(`Profile '${profile.profileId}' contains unclassified orchestration tools: ${unknownTools.join(", ")}.`);
     }
     for (const toolName of profile.toolNames) {
-        if (!resolveProfileToolCapability(profile, toolName)) {
+        if (!resolveProfileToolCapabilities(profile, toolName)) {
             throw new OrchestrationProfileError(`Profile '${profile.profileId}' tool '${toolName}' lacks ${describeToolCapabilityAuthority(toolName)} authority.`);
         }
     }

package/dist/core/orchestration/profile-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile-registry.js","sourceRoot":"","sources":["../../../src/core/orchestration/profile-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC7G,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAWrE,OAAO,EACN,oBAAoB,EACpB,gCAAgC,EAChC,6BAA6B,EAC7B,mCAAmC,EACnC,oCAAoC,EACpC,iCAAiC,EACjC,8CAA8C,EAC9C,mCAAmC,EACnC,iCAAiC,EACjC,uCAAuC,EACvC,sCAAsC,EACtC,gCAAgC,EAChC,4BAA4B,EAC5B,6BAA6B,EAC7B,YAAY,EACZ,YAAY,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAEN,gCAAgC,GAGhC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAkBvE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IACzC,CAAC;CACD;AAED,SAAS,gBAAgB,CAAC,MAAyB;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC/D,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,qCAAqC,CAAC,CAAC;IACtG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,yBAAyB,CAAC,kEAAkE,CAAC,CAAC;IACzG,CAAC;IACD,IACC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,MAAM;QACb,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,mCAAmC;QACzD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,KAAK,CAAC,SAAS;QAChB,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC5D,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,8CAA8C;QAC1E,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;QAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACxC,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,mCAAmC;QACrE,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAC9B,CAAC,KAAK,EAAE,EAAE,CACT,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,mCAAmC,CACrG;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,kBAAkB,CAAC,MAAM,EACzE,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,8BAA8B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACN,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;QACvC,kBAAkB,EAAE,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;KACjD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAA6B;IACzE,IAAI,OAAO,CAAC,aAAa,KAAK,4BAA4B,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,sCAAsC,CAAC,CAAC;IAC1G,CAAC;IACD,IACC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC9D,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACzB,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,oCAAoC;QACjE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE;QAE3B,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,yBAAyB,CAClC,+DAA+D,OAAO,CAAC,SAAS,KAAK,CACrF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,2BAA2B,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,8BAA8B,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAClC,qBAAqB,OAAO,CAAC,SAAS,oCAAoC,CAC1E,CAAC;QACH,CAAC;QACD,IACC,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,EAAE;YACtC,OAAO,CAAC,qBAAqB,CAAC,MAAM,GAAG,mCAAmC,EACzE,CAAC;YACF,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,uEAAuE,CACpG,CAAC;QACH,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wEAAwE,CACrG,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,qBAAqB,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,yBAAyB,CAAC,CAAC;IAC7F,CAAC;IACD,IACC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACzB,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC9D,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACzB,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC,EAC7D,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,2BAA2B,CAAC,CAAC;IAC/F,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI;QAC7B,CAAC,mBAAmB,EAAE,OAAO,CAAC,iBAAiB,CAAC;QAChD,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC;QAChC,CAAC,sBAAsB,EAAE,OAAO,CAAC,oBAAoB,CAAC;QACtD,CAAC,oBAAoB,EAAE,OAAO,CAAC,kBAAkB,CAAC;KACzC,EAAE,CAAC;QACZ,IACC,MAAM,CAAC,MAAM,GAAG,mCAAmC;YACnD,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,mCAAmC,CAAC,EAC1F,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,yBAAyB,KAAK,GAAG,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wBAAwB,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvF,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,gCAAgC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7G,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,iBAAiB,OAAO,CAAC,IAAI,kBAAkB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/G,CAAC;IACH,CAAC;IACD,IACC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC3C,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,mCAAmC,EAC1E,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,mCAAmC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,yBAAyB,CAClC,kBAAkB,OAAO,CAAC,SAAS,6CAA6C,CAChF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QACxD,IACC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,uCAAuC;YACnE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE;YAC1B,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,iCAAiC;YAC5D,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EACxB,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,sCAAsC,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IACD,MAAM,eAAe,GAAG,gBAAgB,CACvC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAC;IACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,0CAA0C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,mCAAmC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,gCAAgC,CAAC,CAAC;IACpG,CAAC;IACD,IACC,OAAO,CAAC,gBAAgB;QACxB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YACxD,OAAO,CAAC,gBAAgB,CAAC,QAAQ,GAAG,CAAC;YACrC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,GAAG,6BAA6B;YACjE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;YACnE,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,GAAG,CAAC;YAChD,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,GAAG,iCAAiC;YAChF,CAAC,OAAO,CAAC,gBAAgB,CAAC,yBAAyB,KAAK,SAAS;gBAChE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;oBACzE,OAAO,CAAC,gBAAgB,CAAC,yBAAyB,GAAG,CAAC;oBACtD,OAAO,CAAC,gBAAgB,CAAC,yBAAyB,GAAG,gCAAgC,CAAC,CAAC,CAAC,EAC1F,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,iCAAiC,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC;QACJ,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,OAAO,CAAC,SAAS,UAAU,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,0DAA0D,CACvF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACvG,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,oDAAoD,CACjF,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GACnB,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC3G,MAAM,qBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxE,IAAI,qBAAqB,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACpH,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,oEAAoE,CACjG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAChD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,gEAAgE,CAC7F,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,IACC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,GAAG,mCAAmC;YACvF,OAAO,CAAC,eAAe,CAAC,2BAA2B,CAAC,MAAM,GAAG,mCAAmC;YAChG,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAC9C,CAAC,UAAU,EAAE,EAAE,CACd,CAAC,UAAU,CAAC,IAAI,EAAE;gBAClB,UAAU,CAAC,MAAM,GAAG,gCAAgC;gBACpD,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAC5B;YACD,OAAO,CAAC,eAAe,CAAC,2BAA2B,CAAC,IAAI,CACvD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,mCAAmC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CACrG;YACD,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;YAC7D,OAAO,CAAC,eAAe,CAAC,cAAc,IAAI,CAAC;YAC3C,OAAO,CAAC,eAAe,CAAC,cAAc,GAAG,sCAAsC,EAC9E,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,+BAA+B,CAAC,CAAC;QACnG,CAAC;IACF,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAC5C,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAE,gCAAsD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACzF,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,gDAAgD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,WAAW,QAAQ,WAAW,+BAA+B,CAAC,QAAQ,CAAC,aAAa,CACjH,CAAC;QACH,CAAC;IACF,CAAC;IACD,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,SAAS,GAAG,mCAAmC;IACrF,OAAO,CACN,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,IAAI,mCAAmC;QACnD,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,CAClG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc,EAAE,UAAmB;IAC5E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;IAC3G,IACC,CAAC,WAAW,CAAC,KAAK,EAAE;QACnB,eAAe;QACf,WAAW;QACX,aAAa;QACb,MAAM;QACN,aAAa;QACb,mBAAmB;QACnB,WAAW;QACX,sBAAsB;QACtB,oBAAoB;QACpB,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ;QACR,eAAe;QACf,YAAY;QACZ,gCAAgC;QAChC,uBAAuB;QACvB,WAAW;QACX,WAAW;KACX,CAAC,EACD,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,sDAAsD,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAkB,CAAC;IACvB,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAC9C,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAChD,IACC,CAAC,aAAa,CAAC,WAAW,CAAC;QAC3B,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACjD,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;QACtC,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,mCAAmC,EAClE,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,+CAA+C,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0CAA0C,CACnF,CAAC;IACH,CAAC;IACD,IACC,eAAe,KAAK,SAAS;QAC7B,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC;YAC/B,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC,oBAAoB,EAAE,6BAA6B,EAAE,gBAAgB,CAAC,CAAC;YACtG,CAAC,aAAa,CAAC,eAAe,CAAC,kBAAkB,EAAE,gCAAgC,CAAC;YACpF,CAAC,aAAa,CAAC,eAAe,CAAC,2BAA2B,CAAC;YAC3D,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,EACtD,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;IAC1F,CAAC;IACD,IACC,gBAAgB,KAAK,SAAS;QAC9B,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC;YAChC,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,UAAU,EAAE,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;YAChG,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAChD,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;YAC3D,CAAC,gBAAgB,CAAC,yBAAyB,KAAK,SAAS;gBACxD,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC,EACpE,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,qDAAqD,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC3D,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;QAC1F,CAAC;QACD,IACC,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;YACtC,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC/B,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,uCAAuC;YACnE,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;YACrC,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAC9B,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,iCAAiC;YAC5D,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ;YAC3C,CAAC,6BAA6B,CAAC,QAAQ,CACtC,SAAS,CAAC,aAA+D,CACzE,EACA,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;YACN,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,aAAa,EAAE,SAAS,CAAC,aAA+D;SACxF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IACC,KAAK,CAAC,aAAa,KAAK,4BAA4B;QACpD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC5D,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC9B,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,oCAAoC;QAC/D,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAqC,CAAC;QACnE,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,kBAAkB,CAAC;QACzE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACvC,KAAK,CAAC,iBAAiB,CAAC,MAAM,GAAG,mCAAmC;QACpE,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAC7B,CAAC,UAAU,EAAE,EAAE,CACd,OAAO,UAAU,KAAK,QAAQ;YAC9B,oBAAoB,CAAC,QAAQ,CAAC,UAAmD,CAAC,CACnF;QACD,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,CAAC,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAC1C,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACxC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QACvC,OAAO,KAAK,CAAC,8BAA8B,KAAK,SAAS;QACzD,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,CAAC,OAAO,KAAK,CAAC,qBAAqB,KAAK,QAAQ;gBAC/C,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC;gBACxC,KAAK,CAAC,qBAAqB,CAAC,MAAM,GAAG,mCAAmC,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC5D,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC,EAC3D,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC;QAC/B,aAAa,EAAE,4BAA4B;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAoC;QAChD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAmD,EAAE,UAAU,EAAE;QAClG,iBAAiB,EAAE,KAAK,CAAC,iBAA8D;QACvF,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,GAAG,CAAC,eAAe;YAClB,CAAC,CAAC;gBACA,eAAe,EAAE;oBAChB,kBAAkB,EAAE,eAAe,CAAC,kBAA8B;oBAClE,2BAA2B,EAAE,eAAe,CAAC,2BAAuC;oBACpF,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC;iBACtD;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,aAAa,CAAC,gBAAgB,CAAC;YAClC,CAAC,CAAC;gBACA,gBAAgB,EAAE;oBACjB,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC;oBAC3C,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;oBACjE,GAAG,CAAC,gBAAgB,CAAC,yBAAyB,KAAK,SAAS;wBAC3D,CAAC,CAAC,EAAE,yBAAyB,EAAE,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE;wBACnF,CAAC,CAAC,EAAE,CAAC;iBACN;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QACpC,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,GAAG,CAAC,OAAO,KAAK,CAAC,qBAAqB,KAAK,QAAQ;YAClD,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC1B,CAAyB,CAAC;IAC3B,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,OAA6B;IACnD,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,UAAU;QAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAClE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,OAAO,4BAA4B;IAGxC,YAAY,QAAQ,GAAoC,EAAE;QAFzC,aAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;QAGnE,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,KAAK,MAAM,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBACtD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,iCAAiC,mBAAmB,IAAI,CACrF,CAAC;gBACH,CAAC;YACF,CAAC;YACD,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wCAAwC,OAAO,CAAC,qBAAqB,IAAI,CACtG,CAAC;gBACH,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAClC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,4BAA4B,OAAO,CAAC,qBAAqB,sBAAsB,CAC5G,CAAC;gBACH,CAAC;YACF,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,KAAK,MAAM,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;oBAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;oBACtD,IACC,MAAM,EAAE,qBAAqB;wBAC7B,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,EACjE,CAAC;wBACF,MAAM,IAAI,yBAAyB,CAClC,iBAAiB,OAAO,CAAC,SAAS,iBAAiB,MAAM,CAAC,SAAS,2BAA2B,MAAM,CAAC,qBAAqB,IAAI,CAC9H,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,QAAQ,CAAC,OAA6B;QACrC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,yBAAyB,CAAC,oCAAoC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,GAAG,CAAC,SAAiB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,CAAC;CACD;AAED,MAAM,UAAU,mBAAmB,CAClC,OAA6B,EAC7B,MAAuB;IAEvB,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACjG,OAAO,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAcnC;IACA,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IACpG,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,0CAA0C,CAAC,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IAClG,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACrH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC5D,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC;IACnH,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAA+B;QAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;QAClC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;QACxB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB;QACpD,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB;QACrD,qBAAqB,EAAE,OAAO,CAAC,iBAAiB;QAChD,cAAc;QACd,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;KACjC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;AACrH,CAAC","sourcesContent":["import { describeToolCapabilityAuthority, resolveProfileToolCapability } from \"../tool-capability-policy.ts\";\nimport { hasOnlyKeys, isPlainRecord } from \"../util/value-guards.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationDispatchRequest,\n\tOrchestrationModelBinding,\n\tOrchestrationProfile,\n\tResourcePointer,\n\tRiskBudget,\n\tTaskContract,\n\tToolCapabilityManifest,\n} from \"./contracts.ts\";\nimport {\n\tHARNESS_CAPABILITIES,\n\tMAX_ORCHESTRATION_AGENT_BINDINGS,\n\tMAX_ORCHESTRATION_AGENT_DEPTH,\n\tMAX_ORCHESTRATION_COLLECTION_LENGTH,\n\tMAX_ORCHESTRATION_DESCRIPTION_LENGTH,\n\tMAX_ORCHESTRATION_DIRECT_CHILDREN,\n\tMAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH,\n\tMAX_ORCHESTRATION_IDENTIFIER_LENGTH,\n\tMAX_ORCHESTRATION_MODEL_ID_LENGTH,\n\tMAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH,\n\tMAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES,\n\tMAX_WORKER_AUTHORITY_PATH_LENGTH,\n\tORCHESTRATION_SCHEMA_VERSION,\n\tORCHESTRATION_THINKING_LEVELS,\n\ttoJsonObject,\n\tWORKER_ROLES,\n} from \"./contracts.ts\";\nimport { ORCHESTRATION_PROFILE_TOOL_NAMES } from \"./lane-tool-manifests.ts\";\nimport {\n\ttype CompileExecutionGrantInput,\n\tDEFAULT_ROLE_CAPABILITY_CEILINGS,\n\ttype ExecutionPolicyCompiler,\n\ttype PolicyCompilationResult,\n} from \"./policy-compiler.ts\";\nimport { parseRiskBudget, validateRiskBudget } from \"./risk-budget.ts\";\n\nexport interface ModelHealthView {\n\tisHealthy(binding: OrchestrationModelBinding): boolean;\n}\n\nexport interface ProfileDispatchPlan {\n\tprofile: OrchestrationProfile;\n\tmodel: OrchestrationModelBinding;\n\tgrant: ExecutionGrant;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n}\n\nexport type ProfileDispatchPlanResult =\n\t| { outcome: \"allow\"; plan: ProfileDispatchPlan }\n\t| Exclude<PolicyCompilationResult, { outcome: \"allow\" }>\n\t| { outcome: \"deny\"; decisions: readonly []; reasonCodes: readonly [\"profile_model_unavailable\"] };\n\nexport class OrchestrationProfileError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"OrchestrationProfileError\";\n\t}\n}\n\nfunction duplicateStrings(values: readonly string[]): string[] {\n\tconst seen = new Set<string>();\n\tconst duplicates = new Set<string>();\n\tfor (const value of values) {\n\t\tif (seen.has(value)) duplicates.add(value);\n\t\tseen.add(value);\n\t}\n\treturn [...duplicates];\n}\n\nexport function parseOrchestrationDispatchRequest(value: unknown): OrchestrationDispatchRequest {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Dispatch request must be an object.\");\n\tif (!hasOnlyKeys(value, [\"taskId\", \"profileId\", \"instructions\", \"resourcePointerIds\"])) {\n\t\tthrow new OrchestrationProfileError(\"Dispatch request contains an unsupported durable metadata field.\");\n\t}\n\tif (\n\t\ttypeof value.taskId !== \"string\" ||\n\t\t!value.taskId ||\n\t\tvalue.taskId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\ttypeof value.profileId !== \"string\" ||\n\t\t!value.profileId ||\n\t\tvalue.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\ttypeof value.instructions !== \"string\" ||\n\t\tvalue.instructions.length > MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH ||\n\t\t!value.instructions.trim() ||\n\t\t!Array.isArray(value.resourcePointerIds) ||\n\t\tvalue.resourcePointerIds.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||\n\t\t!value.resourcePointerIds.every(\n\t\t\t(entry) =>\n\t\t\t\ttypeof entry === \"string\" && entry.length > 0 && entry.length <= MAX_ORCHESTRATION_IDENTIFIER_LENGTH,\n\t\t) ||\n\t\tnew Set(value.resourcePointerIds).size !== value.resourcePointerIds.length\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Dispatch request is invalid.\");\n\t}\n\treturn {\n\t\ttaskId: value.taskId,\n\t\tprofileId: value.profileId,\n\t\tinstructions: value.instructions.trim(),\n\t\tresourcePointerIds: [...value.resourcePointerIds],\n\t};\n}\n\nexport function validateOrchestrationProfile(profile: OrchestrationProfile): void {\n\tif (profile.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' has an unsupported schema version.`);\n\t}\n\tif (\n\t\tprofile.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\t!profile.profileId.trim() ||\n\t\tprofile.description.length > MAX_ORCHESTRATION_DESCRIPTION_LENGTH ||\n\t\t!profile.description.trim()\n\t)\n\t\tthrow new OrchestrationProfileError(\"Profile id and description are required.\");\n\tif (profile.role !== \"orchestrator\" && profile.dispatchProfileIds.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Only orchestrator profiles may declare dispatchProfileIds ('${profile.profileId}').`,\n\t\t);\n\t}\n\tif (profile.dispatchProfileIds.includes(profile.profileId)) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot dispatch itself.`);\n\t}\n\tif (profile.requireIndependentVerification) {\n\t\tif (profile.role === \"verifier\") {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Verifier profile '${profile.profileId}' cannot require another verifier.`,\n\t\t\t);\n\t\t}\n\t\tif (\n\t\t\t!profile.verificationProfileId?.trim() ||\n\t\t\tprofile.verificationProfileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' requires independent verification but has no verificationProfileId.`,\n\t\t\t);\n\t\t}\n\t} else if (profile.verificationProfileId !== undefined) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare verificationProfileId without requiring verification.`,\n\t\t);\n\t}\n\tif (profile.verificationProfileId === profile.profileId) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot verify itself.`);\n\t}\n\tif (\n\t\t!profile.createdAt.trim() ||\n\t\tprofile.createdAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\t!profile.updatedAt.trim() ||\n\t\tprofile.updatedAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' timestamps are invalid.`);\n\t}\n\tfor (const [label, values] of [\n\t\t[\"capabilityCeiling\", profile.capabilityCeiling],\n\t\t[\"toolNames\", profile.toolNames],\n\t\t[\"resourceProfileNames\", profile.resourceProfileNames],\n\t\t[\"dispatchProfileIds\", profile.dispatchProfileIds],\n\t] as const) {\n\t\tif (\n\t\t\tvalues.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||\n\t\t\tvalues.some((value) => !value.trim() || value.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH)\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid ${label}.`);\n\t\t}\n\t\tconst duplicates = duplicateStrings(values);\n\t\tif (duplicates.length > 0) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' contains duplicate ${label}: ${duplicates.join(\", \")}.`,\n\t\t\t);\n\t\t}\n\t}\n\tconst roleCeiling = new Set(DEFAULT_ROLE_CAPABILITY_CEILINGS[profile.role]);\n\tconst outOfRoleCapabilities = profile.capabilityCeiling.filter((capability) => !roleCeiling.has(capability));\n\tif (outOfRoleCapabilities.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' exceeds the ${profile.role} role ceiling: ${outOfRoleCapabilities.join(\", \")}.`,\n\t\t);\n\t}\n\tif (\n\t\tprofile.modelPolicy.candidates.length === 0 ||\n\t\tprofile.modelPolicy.candidates.length > MAX_ORCHESTRATION_COLLECTION_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' must declare a model candidate.`);\n\t}\n\tif (profile.modelPolicy.mode === \"fixed\" && profile.modelPolicy.candidates.length !== 1) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Fixed profile '${profile.profileId}' must declare exactly one model candidate.`,\n\t\t);\n\t}\n\tfor (const candidate of profile.modelPolicy.candidates) {\n\t\tif (\n\t\t\tcandidate.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH ||\n\t\t\t!candidate.provider.trim() ||\n\t\t\tcandidate.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH ||\n\t\t\t!candidate.modelId.trim()\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid model binding.`);\n\t\t}\n\t}\n\tconst duplicateModels = duplicateStrings(\n\t\tprofile.modelPolicy.candidates.map((candidate) => `${candidate.provider}/${candidate.modelId}`),\n\t);\n\tif (duplicateModels.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains duplicate model candidates: ${duplicateModels.join(\", \")}.`,\n\t\t);\n\t}\n\tif (!Number.isSafeInteger(profile.maxConcurrent) || profile.maxConcurrent <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' maxConcurrent must be positive.`);\n\t}\n\tif (!Number.isSafeInteger(profile.leaseTtlMs) || profile.leaseTtlMs <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' leaseTtlMs must be positive.`);\n\t}\n\tif (\n\t\tprofile.delegationLimits &&\n\t\t(!Number.isSafeInteger(profile.delegationLimits.maxDepth) ||\n\t\t\tprofile.delegationLimits.maxDepth < 0 ||\n\t\t\tprofile.delegationLimits.maxDepth > MAX_ORCHESTRATION_AGENT_DEPTH ||\n\t\t\t!Number.isSafeInteger(profile.delegationLimits.maxChildrenPerAgent) ||\n\t\t\tprofile.delegationLimits.maxChildrenPerAgent < 0 ||\n\t\t\tprofile.delegationLimits.maxChildrenPerAgent > MAX_ORCHESTRATION_DIRECT_CHILDREN ||\n\t\t\t(profile.delegationLimits.maxNestedAgentsPerSession !== undefined &&\n\t\t\t\t(!Number.isSafeInteger(profile.delegationLimits.maxNestedAgentsPerSession) ||\n\t\t\t\t\tprofile.delegationLimits.maxNestedAgentsPerSession < 0 ||\n\t\t\t\t\tprofile.delegationLimits.maxNestedAgentsPerSession > MAX_ORCHESTRATION_AGENT_BINDINGS)))\n\t) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' delegationLimits are invalid.`);\n\t}\n\ttry {\n\t\tvalidateRiskBudget(profile.budget, `Profile '${profile.profileId}' budget`);\n\t} catch (error) {\n\t\tthrow new OrchestrationProfileError(error instanceof Error ? error.message : String(error));\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.budget.maxWallClockMs <= 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' maxWallClockMs budget must be positive when specified.`,\n\t\t);\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.leaseTtlMs < profile.budget.maxWallClockMs) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' leaseTtlMs must cover its maxWallClockMs budget.`,\n\t\t);\n\t}\n\tconst processCapable =\n\t\tprofile.capabilityCeiling.includes(\"process.exec\") || profile.capabilityCeiling.includes(\"tests.execute\");\n\tconst directProcessLauncher = profile.toolNames.includes(\"run_process\");\n\tif (directProcessLauncher && (!profile.executionPolicy || profile.executionPolicy.allowedExecutables.length === 0)) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' must declare executionPolicy.allowedExecutables for run_process.`,\n\t\t);\n\t}\n\tif (!processCapable && profile.executionPolicy) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare executionPolicy without process capabilities.`,\n\t\t);\n\t}\n\tif (profile.executionPolicy) {\n\t\tif (\n\t\t\tprofile.executionPolicy.allowedExecutables.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||\n\t\t\tprofile.executionPolicy.allowedEnvironmentVariables.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||\n\t\t\tprofile.executionPolicy.allowedExecutables.some(\n\t\t\t\t(executable) =>\n\t\t\t\t\t!executable.trim() ||\n\t\t\t\t\texecutable.length > MAX_WORKER_AUTHORITY_PATH_LENGTH ||\n\t\t\t\t\t/[\\0\\r\\n]/.test(executable),\n\t\t\t) ||\n\t\t\tprofile.executionPolicy.allowedEnvironmentVariables.some(\n\t\t\t\t(name) => name.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name),\n\t\t\t) ||\n\t\t\t!Number.isSafeInteger(profile.executionPolicy.maxOutputBytes) ||\n\t\t\tprofile.executionPolicy.maxOutputBytes <= 0 ||\n\t\t\tprofile.executionPolicy.maxOutputBytes > MAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' executionPolicy is invalid.`);\n\t\t}\n\t}\n\tconst unknownTools = profile.toolNames.filter(\n\t\t(toolName) => !(ORCHESTRATION_PROFILE_TOOL_NAMES as readonly string[]).includes(toolName),\n\t);\n\tif (unknownTools.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains unclassified orchestration tools: ${unknownTools.join(\", \")}.`,\n\t\t);\n\t}\n\tfor (const toolName of profile.toolNames) {\n\t\tif (!resolveProfileToolCapability(profile, toolName)) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' tool '${toolName}' lacks ${describeToolCapabilityAuthority(toolName)} authority.`,\n\t\t\t);\n\t\t}\n\t}\n\ttoJsonObject({ profile });\n}\n\nfunction isStringArray(value: unknown, maxLength = MAX_ORCHESTRATION_IDENTIFIER_LENGTH): value is string[] {\n\treturn (\n\t\tArray.isArray(value) &&\n\t\tvalue.length <= MAX_ORCHESTRATION_COLLECTION_LENGTH &&\n\t\tvalue.every((entry) => typeof entry === \"string\" && entry.length > 0 && entry.length <= maxLength)\n\t);\n}\n\nexport function parseOrchestrationProfile(value: unknown, sourcePath?: string): OrchestrationProfile {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Orchestration profile must be an object.\");\n\tif (\n\t\t!hasOnlyKeys(value, [\n\t\t\t\"schemaVersion\",\n\t\t\t\"profileId\",\n\t\t\t\"description\",\n\t\t\t\"role\",\n\t\t\t\"modelPolicy\",\n\t\t\t\"capabilityCeiling\",\n\t\t\t\"toolNames\",\n\t\t\t\"resourceProfileNames\",\n\t\t\t\"dispatchProfileIds\",\n\t\t\t\"executionPolicy\",\n\t\t\t\"delegationLimits\",\n\t\t\t\"budget\",\n\t\t\t\"maxConcurrent\",\n\t\t\t\"leaseTtlMs\",\n\t\t\t\"requireIndependentVerification\",\n\t\t\t\"verificationProfileId\",\n\t\t\t\"createdAt\",\n\t\t\t\"updatedAt\",\n\t\t])\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile contains an unsupported field.\");\n\t}\n\tconst modelPolicy = value.modelPolicy;\n\tconst rawBudget = value.budget;\n\tlet budget: RiskBudget;\n\tconst executionPolicy = value.executionPolicy;\n\tconst delegationLimits = value.delegationLimits;\n\tif (\n\t\t!isPlainRecord(modelPolicy) ||\n\t\t!hasOnlyKeys(modelPolicy, [\"mode\", \"candidates\"]) ||\n\t\t!Array.isArray(modelPolicy.candidates) ||\n\t\tmodelPolicy.candidates.length > MAX_ORCHESTRATION_COLLECTION_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile modelPolicy is invalid.\");\n\t}\n\ttry {\n\t\tbudget = parseRiskBudget(rawBudget, \"Orchestration profile budget\");\n\t} catch (error) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\terror instanceof Error ? error.message : \"Orchestration profile budget is invalid.\",\n\t\t);\n\t}\n\tif (\n\t\texecutionPolicy !== undefined &&\n\t\t(!isPlainRecord(executionPolicy) ||\n\t\t\t!hasOnlyKeys(executionPolicy, [\"allowedExecutables\", \"allowedEnvironmentVariables\", \"maxOutputBytes\"]) ||\n\t\t\t!isStringArray(executionPolicy.allowedExecutables, MAX_WORKER_AUTHORITY_PATH_LENGTH) ||\n\t\t\t!isStringArray(executionPolicy.allowedEnvironmentVariables) ||\n\t\t\t!Number.isSafeInteger(executionPolicy.maxOutputBytes))\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile executionPolicy is invalid.\");\n\t}\n\tif (\n\t\tdelegationLimits !== undefined &&\n\t\t(!isPlainRecord(delegationLimits) ||\n\t\t\t!hasOnlyKeys(delegationLimits, [\"maxDepth\", \"maxChildrenPerAgent\", \"maxNestedAgentsPerSession\"]) ||\n\t\t\t!Number.isSafeInteger(delegationLimits.maxDepth) ||\n\t\t\t!Number.isSafeInteger(delegationLimits.maxChildrenPerAgent) ||\n\t\t\t(delegationLimits.maxNestedAgentsPerSession !== undefined &&\n\t\t\t\t!Number.isSafeInteger(delegationLimits.maxNestedAgentsPerSession)))\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile delegationLimits are invalid.\");\n\t}\n\tconst candidates = modelPolicy.candidates.map((candidate) => {\n\t\tif (!isPlainRecord(candidate) || !hasOnlyKeys(candidate, [\"provider\", \"modelId\", \"thinkingLevel\"])) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\tif (\n\t\t\ttypeof candidate.provider !== \"string\" ||\n\t\t\tcandidate.provider.length === 0 ||\n\t\t\tcandidate.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH ||\n\t\t\ttypeof candidate.modelId !== \"string\" ||\n\t\t\tcandidate.modelId.length === 0 ||\n\t\t\tcandidate.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH ||\n\t\t\ttypeof candidate.thinkingLevel !== \"string\" ||\n\t\t\t!ORCHESTRATION_THINKING_LEVELS.includes(\n\t\t\t\tcandidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t\t)\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\treturn {\n\t\t\tprovider: candidate.provider,\n\t\t\tmodelId: candidate.modelId,\n\t\t\tthinkingLevel: candidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t};\n\t});\n\tif (\n\t\tvalue.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION ||\n\t\ttypeof value.profileId !== \"string\" ||\n\t\tvalue.profileId.length === 0 ||\n\t\tvalue.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\ttypeof value.description !== \"string\" ||\n\t\tvalue.description.length === 0 ||\n\t\tvalue.description.length > MAX_ORCHESTRATION_DESCRIPTION_LENGTH ||\n\t\ttypeof value.role !== \"string\" ||\n\t\t!WORKER_ROLES.includes(value.role as (typeof WORKER_ROLES)[number]) ||\n\t\t(modelPolicy.mode !== \"fixed\" && modelPolicy.mode !== \"ordered-fallback\") ||\n\t\t!Array.isArray(value.capabilityCeiling) ||\n\t\tvalue.capabilityCeiling.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||\n\t\t!value.capabilityCeiling.every(\n\t\t\t(capability) =>\n\t\t\t\ttypeof capability === \"string\" &&\n\t\t\t\tHARNESS_CAPABILITIES.includes(capability as (typeof HARNESS_CAPABILITIES)[number]),\n\t\t) ||\n\t\t!isStringArray(value.toolNames) ||\n\t\t!isStringArray(value.resourceProfileNames) ||\n\t\t!isStringArray(value.dispatchProfileIds) ||\n\t\t!Number.isSafeInteger(value.maxConcurrent) ||\n\t\t!Number.isSafeInteger(value.leaseTtlMs) ||\n\t\ttypeof value.requireIndependentVerification !== \"boolean\" ||\n\t\t(value.verificationProfileId !== undefined &&\n\t\t\t(typeof value.verificationProfileId !== \"string\" ||\n\t\t\t\tvalue.verificationProfileId.length === 0 ||\n\t\t\t\tvalue.verificationProfileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH)) ||\n\t\ttypeof value.createdAt !== \"string\" ||\n\t\tvalue.createdAt.length === 0 ||\n\t\tvalue.createdAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\ttypeof value.updatedAt !== \"string\" ||\n\t\tvalue.updatedAt.length === 0 ||\n\t\tvalue.updatedAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile is invalid.\");\n\t}\n\tconst profile = structuredClone({\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tprofileId: value.profileId,\n\t\tdescription: value.description,\n\t\trole: value.role as OrchestrationProfile[\"role\"],\n\t\tmodelPolicy: { mode: modelPolicy.mode as OrchestrationProfile[\"modelPolicy\"][\"mode\"], candidates },\n\t\tcapabilityCeiling: value.capabilityCeiling as OrchestrationProfile[\"capabilityCeiling\"],\n\t\ttoolNames: value.toolNames,\n\t\tresourceProfileNames: value.resourceProfileNames,\n\t\tdispatchProfileIds: value.dispatchProfileIds,\n\t\t...(executionPolicy\n\t\t\t? {\n\t\t\t\t\texecutionPolicy: {\n\t\t\t\t\t\tallowedExecutables: executionPolicy.allowedExecutables as string[],\n\t\t\t\t\t\tallowedEnvironmentVariables: executionPolicy.allowedEnvironmentVariables as string[],\n\t\t\t\t\t\tmaxOutputBytes: Number(executionPolicy.maxOutputBytes),\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(isPlainRecord(delegationLimits)\n\t\t\t? {\n\t\t\t\t\tdelegationLimits: {\n\t\t\t\t\t\tmaxDepth: Number(delegationLimits.maxDepth),\n\t\t\t\t\t\tmaxChildrenPerAgent: Number(delegationLimits.maxChildrenPerAgent),\n\t\t\t\t\t\t...(delegationLimits.maxNestedAgentsPerSession !== undefined\n\t\t\t\t\t\t\t? { maxNestedAgentsPerSession: Number(delegationLimits.maxNestedAgentsPerSession) }\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t\tbudget,\n\t\tmaxConcurrent: Number(value.maxConcurrent),\n\t\tleaseTtlMs: Number(value.leaseTtlMs),\n\t\trequireIndependentVerification: value.requireIndependentVerification,\n\t\t...(typeof value.verificationProfileId === \"string\"\n\t\t\t? { verificationProfileId: value.verificationProfileId }\n\t\t\t: {}),\n\t\t...(sourcePath ? { sourcePath } : {}),\n\t\tcreatedAt: value.createdAt,\n\t\tupdatedAt: value.updatedAt,\n\t}) as OrchestrationProfile;\n\tvalidateOrchestrationProfile(profile);\n\treturn profile;\n}\n\nfunction freezeProfile(profile: OrchestrationProfile): OrchestrationProfile {\n\tconst clone = structuredClone(profile);\n\tfor (const candidate of clone.modelPolicy.candidates) Object.freeze(candidate);\n\tObject.freeze(clone.modelPolicy.candidates);\n\tObject.freeze(clone.modelPolicy);\n\tObject.freeze(clone.capabilityCeiling);\n\tObject.freeze(clone.toolNames);\n\tObject.freeze(clone.resourceProfileNames);\n\tObject.freeze(clone.dispatchProfileIds);\n\tif (clone.executionPolicy) {\n\t\tObject.freeze(clone.executionPolicy.allowedExecutables);\n\t\tObject.freeze(clone.executionPolicy.allowedEnvironmentVariables);\n\t\tObject.freeze(clone.executionPolicy);\n\t}\n\tif (clone.delegationLimits) Object.freeze(clone.delegationLimits);\n\tObject.freeze(clone.budget);\n\treturn Object.freeze(clone);\n}\n\nexport class OrchestrationProfileRegistry {\n\tprivate readonly profiles = new Map<string, OrchestrationProfile>();\n\n\tconstructor(profiles: readonly OrchestrationProfile[] = []) {\n\t\tfor (const profile of profiles) this.register(profile);\n\t\tfor (const profile of this.profiles.values()) {\n\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\tconst target = this.profiles.get(dispatchedProfileId);\n\t\t\t\tif (!target) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' dispatches missing profile '${dispatchedProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.verificationProfileId) {\n\t\t\t\tconst verifier = this.profiles.get(profile.verificationProfileId);\n\t\t\t\tif (!verifier) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' requires missing verifier profile '${profile.verificationProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (verifier.role !== \"verifier\") {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' verificationProfileId '${profile.verificationProfileId}' is not a verifier.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.role === \"orchestrator\") {\n\t\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\t\tconst worker = this.profiles.get(dispatchedProfileId);\n\t\t\t\t\tif (\n\t\t\t\t\t\tworker?.verificationProfileId &&\n\t\t\t\t\t\t!profile.dispatchProfileIds.includes(worker.verificationProfileId)\n\t\t\t\t\t) {\n\t\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t\t`Orchestrator '${profile.profileId}' dispatches '${worker.profileId}' but not its verifier '${worker.verificationProfileId}'.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tregister(profile: OrchestrationProfile): void {\n\t\tvalidateOrchestrationProfile(profile);\n\t\tif (this.profiles.has(profile.profileId)) {\n\t\t\tthrow new OrchestrationProfileError(`Duplicate orchestration profile '${profile.profileId}'.`);\n\t\t}\n\t\tthis.profiles.set(profile.profileId, freezeProfile(profile));\n\t}\n\n\tget(profileId: string): OrchestrationProfile | undefined {\n\t\tconst profile = this.profiles.get(profileId);\n\t\treturn profile ? structuredClone(profile) : undefined;\n\t}\n\n\tlist(): OrchestrationProfile[] {\n\t\treturn [...this.profiles.values()].map((profile) => structuredClone(profile));\n\t}\n}\n\nexport function resolveProfileModel(\n\tprofile: OrchestrationProfile,\n\thealth: ModelHealthView,\n): OrchestrationModelBinding | undefined {\n\tif (profile.modelPolicy.mode === \"fixed\") {\n\t\tconst fixed = profile.modelPolicy.candidates[0];\n\t\treturn fixed && health.isHealthy(fixed) ? structuredClone(fixed) : undefined;\n\t}\n\tconst selected = profile.modelPolicy.candidates.find((candidate) => health.isHealthy(candidate));\n\treturn selected ? structuredClone(selected) : undefined;\n}\n\nexport function planProfileDispatch(args: {\n\trequest: OrchestrationDispatchRequest;\n\ttask: TaskContract;\n\tattemptId: string;\n\tsubjectId: string;\n\tregistry: OrchestrationProfileRegistry;\n\thealth: ModelHealthView;\n\tpolicyCompiler: ExecutionPolicyCompiler;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n\tresources: readonly ResourcePointer[];\n\treadPaths: readonly string[];\n\twritePaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tpolicyVersion: string;\n}): ProfileDispatchPlanResult {\n\tconst profile = args.registry.get(args.request.profileId);\n\tif (!profile) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tif (profile.role !== args.task.role) {\n\t\treturn { outcome: \"deny\", decisions: [], reasonCodes: [\"required_capability_exceeds_role_ceiling\"] };\n\t}\n\tconst model = resolveProfileModel(profile, args.health);\n\tif (!model) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tconst selectedResources = args.resources.filter((resource) => args.request.resourcePointerIds.includes(resource.id));\n\tconst manifestsByName = new Map(args.toolManifests.map((manifest) => [manifest.toolName, manifest]));\n\tconst requestedTools = profile.toolNames.filter((toolName) => {\n\t\tconst manifest = manifestsByName.get(toolName);\n\t\treturn manifest?.capabilities.every((capability) => args.task.requiredCapabilities.includes(capability)) === true;\n\t});\n\tconst policyInput: CompileExecutionGrantInput = {\n\t\tobjectiveId: args.task.objectiveId,\n\t\ttaskId: args.task.taskId,\n\t\tattemptId: args.attemptId,\n\t\tsubjectId: args.subjectId,\n\t\trole: profile.role,\n\t\trequiredCapabilities: args.task.requiredCapabilities,\n\t\trequestedCapabilities: args.task.requiredCapabilities,\n\t\tauthorityCapabilities: profile.capabilityCeiling,\n\t\trequestedTools,\n\t\ttoolManifests: args.toolManifests,\n\t\tresources: selectedResources,\n\t\treadPaths: args.readPaths,\n\t\twritePaths: args.writePaths,\n\t\tdeniedPaths: args.deniedPaths,\n\t\trequestedBudget: profile.budget,\n\t\tauthorityBudget: profile.budget,\n\t\tpolicyVersion: args.policyVersion,\n\t};\n\tconst compiled = args.policyCompiler.compile(policyInput);\n\tif (compiled.outcome !== \"allow\") return compiled;\n\treturn { outcome: \"allow\", plan: { profile, model, grant: compiled.grant, toolManifests: compiled.toolManifests } };\n}\n"]}
+{"version":3,"file":"profile-registry.js","sourceRoot":"","sources":["../../../src/core/orchestration/profile-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC/G,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAWrE,OAAO,EACN,oBAAoB,EACpB,gCAAgC,EAChC,6BAA6B,EAC7B,mCAAmC,EACnC,oCAAoC,EACpC,iCAAiC,EACjC,8CAA8C,EAC9C,mCAAmC,EACnC,iCAAiC,EACjC,uCAAuC,EACvC,sCAAsC,EACtC,gCAAgC,EAChC,4BAA4B,EAC5B,6BAA6B,EAC7B,YAAY,EACZ,YAAY,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAEN,gCAAgC,GAGhC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAkBvE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IACzC,CAAC;CACD;AAED,SAAS,gBAAgB,CAAC,MAAyB;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC/D,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,qCAAqC,CAAC,CAAC;IACtG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,yBAAyB,CAAC,kEAAkE,CAAC,CAAC;IACzG,CAAC;IACD,IACC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,MAAM;QACb,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,mCAAmC;QACzD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,KAAK,CAAC,SAAS;QAChB,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC5D,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,8CAA8C;QAC1E,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;QAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACxC,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,mCAAmC;QACrE,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAC9B,CAAC,KAAK,EAAE,EAAE,CACT,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,mCAAmC,CACrG;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,kBAAkB,CAAC,MAAM,EACzE,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,8BAA8B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACN,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;QACvC,kBAAkB,EAAE,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;KACjD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAA6B;IACzE,IAAI,OAAO,CAAC,aAAa,KAAK,4BAA4B,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,sCAAsC,CAAC,CAAC;IAC1G,CAAC;IACD,IACC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC9D,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACzB,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,oCAAoC;QACjE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE;QAE3B,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,yBAAyB,CAClC,+DAA+D,OAAO,CAAC,SAAS,KAAK,CACrF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,2BAA2B,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,8BAA8B,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAClC,qBAAqB,OAAO,CAAC,SAAS,oCAAoC,CAC1E,CAAC;QACH,CAAC;QACD,IACC,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,EAAE;YACtC,OAAO,CAAC,qBAAqB,CAAC,MAAM,GAAG,mCAAmC,EACzE,CAAC;YACF,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,uEAAuE,CACpG,CAAC;QACH,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wEAAwE,CACrG,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,qBAAqB,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,yBAAyB,CAAC,CAAC;IAC7F,CAAC;IACD,IACC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACzB,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC9D,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;QACzB,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC,EAC7D,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,2BAA2B,CAAC,CAAC;IAC/F,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI;QAC7B,CAAC,mBAAmB,EAAE,OAAO,CAAC,iBAAiB,CAAC;QAChD,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC;QAChC,CAAC,sBAAsB,EAAE,OAAO,CAAC,oBAAoB,CAAC;QACtD,CAAC,oBAAoB,EAAE,OAAO,CAAC,kBAAkB,CAAC;KACzC,EAAE,CAAC;QACZ,IACC,MAAM,CAAC,MAAM,GAAG,mCAAmC;YACnD,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,mCAAmC,CAAC,EAC1F,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,yBAAyB,KAAK,GAAG,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wBAAwB,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvF,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,gCAAgC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7G,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,iBAAiB,OAAO,CAAC,IAAI,kBAAkB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/G,CAAC;IACH,CAAC;IACD,IACC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC3C,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,mCAAmC,EAC1E,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,mCAAmC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,yBAAyB,CAClC,kBAAkB,OAAO,CAAC,SAAS,6CAA6C,CAChF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QACxD,IACC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,uCAAuC;YACnE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE;YAC1B,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,iCAAiC;YAC5D,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EACxB,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,sCAAsC,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IACD,MAAM,eAAe,GAAG,gBAAgB,CACvC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAC;IACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,0CAA0C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,mCAAmC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,gCAAgC,CAAC,CAAC;IACpG,CAAC;IACD,IACC,OAAO,CAAC,gBAAgB;QACxB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YACxD,OAAO,CAAC,gBAAgB,CAAC,QAAQ,GAAG,CAAC;YACrC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,GAAG,6BAA6B;YACjE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;YACnE,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,GAAG,CAAC;YAChD,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,GAAG,iCAAiC;YAChF,CAAC,OAAO,CAAC,gBAAgB,CAAC,yBAAyB,KAAK,SAAS;gBAChE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;oBACzE,OAAO,CAAC,gBAAgB,CAAC,yBAAyB,GAAG,CAAC;oBACtD,OAAO,CAAC,gBAAgB,CAAC,yBAAyB,GAAG,gCAAgC,CAAC,CAAC,CAAC,EAC1F,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,iCAAiC,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC;QACJ,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,OAAO,CAAC,SAAS,UAAU,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,0DAA0D,CACvF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACvG,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,oDAAoD,CACjF,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GACnB,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC3G,MAAM,qBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxE,IAAI,qBAAqB,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACpH,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,oEAAoE,CACjG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAChD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,gEAAgE,CAC7F,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,IACC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,GAAG,mCAAmC;YACvF,OAAO,CAAC,eAAe,CAAC,2BAA2B,CAAC,MAAM,GAAG,mCAAmC;YAChG,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAC9C,CAAC,UAAU,EAAE,EAAE,CACd,CAAC,UAAU,CAAC,IAAI,EAAE;gBAClB,UAAU,CAAC,MAAM,GAAG,gCAAgC;gBACpD,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAC5B;YACD,OAAO,CAAC,eAAe,CAAC,2BAA2B,CAAC,IAAI,CACvD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,mCAAmC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CACrG;YACD,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;YAC7D,OAAO,CAAC,eAAe,CAAC,cAAc,IAAI,CAAC;YAC3C,OAAO,CAAC,eAAe,CAAC,cAAc,GAAG,sCAAsC,EAC9E,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,YAAY,OAAO,CAAC,SAAS,+BAA+B,CAAC,CAAC;QACnG,CAAC;IACF,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAC5C,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAE,gCAAsD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACzF,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,gDAAgD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,8BAA8B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,WAAW,QAAQ,WAAW,+BAA+B,CAAC,QAAQ,CAAC,aAAa,CACjH,CAAC;QACH,CAAC;IACF,CAAC;IACD,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,SAAS,GAAG,mCAAmC;IACrF,OAAO,CACN,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,IAAI,mCAAmC;QACnD,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,CAClG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc,EAAE,UAAmB;IAC5E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,CAAC,CAAC;IAC3G,IACC,CAAC,WAAW,CAAC,KAAK,EAAE;QACnB,eAAe;QACf,WAAW;QACX,aAAa;QACb,MAAM;QACN,aAAa;QACb,mBAAmB;QACnB,WAAW;QACX,sBAAsB;QACtB,oBAAoB;QACpB,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ;QACR,eAAe;QACf,YAAY;QACZ,gCAAgC;QAChC,uBAAuB;QACvB,WAAW;QACX,WAAW;KACX,CAAC,EACD,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,sDAAsD,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAkB,CAAC;IACvB,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAC9C,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAChD,IACC,CAAC,aAAa,CAAC,WAAW,CAAC;QAC3B,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACjD,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;QACtC,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,mCAAmC,EAClE,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,+CAA+C,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0CAA0C,CACnF,CAAC;IACH,CAAC;IACD,IACC,eAAe,KAAK,SAAS;QAC7B,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC;YAC/B,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC,oBAAoB,EAAE,6BAA6B,EAAE,gBAAgB,CAAC,CAAC;YACtG,CAAC,aAAa,CAAC,eAAe,CAAC,kBAAkB,EAAE,gCAAgC,CAAC;YACpF,CAAC,aAAa,CAAC,eAAe,CAAC,2BAA2B,CAAC;YAC3D,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,EACtD,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;IAC1F,CAAC;IACD,IACC,gBAAgB,KAAK,SAAS;QAC9B,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC;YAChC,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,UAAU,EAAE,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;YAChG,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAChD,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;YAC3D,CAAC,gBAAgB,CAAC,yBAAyB,KAAK,SAAS;gBACxD,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC,EACpE,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,qDAAqD,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC3D,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;QAC1F,CAAC;QACD,IACC,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;YACtC,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC/B,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,uCAAuC;YACnE,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;YACrC,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAC9B,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,iCAAiC;YAC5D,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ;YAC3C,CAAC,6BAA6B,CAAC,QAAQ,CACtC,SAAS,CAAC,aAA+D,CACzE,EACA,CAAC;YACF,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;YACN,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,aAAa,EAAE,SAAS,CAAC,aAA+D;SACxF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IACC,KAAK,CAAC,aAAa,KAAK,4BAA4B;QACpD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC5D,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC9B,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,oCAAoC;QAC/D,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAqC,CAAC;QACnE,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,kBAAkB,CAAC;QACzE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACvC,KAAK,CAAC,iBAAiB,CAAC,MAAM,GAAG,mCAAmC;QACpE,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAC7B,CAAC,UAAU,EAAE,EAAE,CACd,OAAO,UAAU,KAAK,QAAQ;YAC9B,oBAAoB,CAAC,QAAQ,CAAC,UAAmD,CAAC,CACnF;QACD,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,CAAC,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAC1C,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACxC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QACvC,OAAO,KAAK,CAAC,8BAA8B,KAAK,SAAS;QACzD,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,CAAC,OAAO,KAAK,CAAC,qBAAqB,KAAK,QAAQ;gBAC/C,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC;gBACxC,KAAK,CAAC,qBAAqB,CAAC,MAAM,GAAG,mCAAmC,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC;QAC5D,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mCAAmC,EAC3D,CAAC;QACF,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC;QAC/B,aAAa,EAAE,4BAA4B;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAoC;QAChD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAmD,EAAE,UAAU,EAAE;QAClG,iBAAiB,EAAE,KAAK,CAAC,iBAA8D;QACvF,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,GAAG,CAAC,eAAe;YAClB,CAAC,CAAC;gBACA,eAAe,EAAE;oBAChB,kBAAkB,EAAE,eAAe,CAAC,kBAA8B;oBAClE,2BAA2B,EAAE,eAAe,CAAC,2BAAuC;oBACpF,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC;iBACtD;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,aAAa,CAAC,gBAAgB,CAAC;YAClC,CAAC,CAAC;gBACA,gBAAgB,EAAE;oBACjB,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC;oBAC3C,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;oBACjE,GAAG,CAAC,gBAAgB,CAAC,yBAAyB,KAAK,SAAS;wBAC3D,CAAC,CAAC,EAAE,yBAAyB,EAAE,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE;wBACnF,CAAC,CAAC,EAAE,CAAC;iBACN;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QACN,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QACpC,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,GAAG,CAAC,OAAO,KAAK,CAAC,qBAAqB,KAAK,QAAQ;YAClD,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC1B,CAAyB,CAAC;IAC3B,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,OAA6B;IACnD,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,UAAU;QAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAClE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,OAAO,4BAA4B;IAGxC,YAAY,QAAQ,GAAoC,EAAE;QAFzC,aAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;QAGnE,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,KAAK,MAAM,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBACtD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,iCAAiC,mBAAmB,IAAI,CACrF,CAAC;gBACH,CAAC;YACF,CAAC;YACD,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,wCAAwC,OAAO,CAAC,qBAAqB,IAAI,CACtG,CAAC;gBACH,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAClC,MAAM,IAAI,yBAAyB,CAClC,YAAY,OAAO,CAAC,SAAS,4BAA4B,OAAO,CAAC,qBAAqB,sBAAsB,CAC5G,CAAC;gBACH,CAAC;YACF,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,KAAK,MAAM,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;oBAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;oBACtD,IACC,MAAM,EAAE,qBAAqB;wBAC7B,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,EACjE,CAAC;wBACF,MAAM,IAAI,yBAAyB,CAClC,iBAAiB,OAAO,CAAC,SAAS,iBAAiB,MAAM,CAAC,SAAS,2BAA2B,MAAM,CAAC,qBAAqB,IAAI,CAC9H,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,QAAQ,CAAC,OAA6B;QACrC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,yBAAyB,CAAC,oCAAoC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,GAAG,CAAC,SAAiB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,CAAC;CACD;AAED,MAAM,UAAU,mBAAmB,CAClC,OAA6B,EAC7B,MAAuB;IAEvB,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACjG,OAAO,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAcnC;IACA,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IACpG,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,0CAA0C,CAAC,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IAClG,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACrH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC5D,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC;IACnH,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAA+B;QAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;QAClC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;QACxB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB;QACpD,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB;QACrD,qBAAqB,EAAE,OAAO,CAAC,iBAAiB;QAChD,cAAc;QACd,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;KACjC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;AACrH,CAAC","sourcesContent":["import { describeToolCapabilityAuthority, resolveProfileToolCapabilities } from \"../tool-capability-policy.ts\";\nimport { hasOnlyKeys, isPlainRecord } from \"../util/value-guards.ts\";\nimport type {\n\tExecutionGrant,\n\tOrchestrationDispatchRequest,\n\tOrchestrationModelBinding,\n\tOrchestrationProfile,\n\tResourcePointer,\n\tRiskBudget,\n\tTaskContract,\n\tToolCapabilityManifest,\n} from \"./contracts.ts\";\nimport {\n\tHARNESS_CAPABILITIES,\n\tMAX_ORCHESTRATION_AGENT_BINDINGS,\n\tMAX_ORCHESTRATION_AGENT_DEPTH,\n\tMAX_ORCHESTRATION_COLLECTION_LENGTH,\n\tMAX_ORCHESTRATION_DESCRIPTION_LENGTH,\n\tMAX_ORCHESTRATION_DIRECT_CHILDREN,\n\tMAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH,\n\tMAX_ORCHESTRATION_IDENTIFIER_LENGTH,\n\tMAX_ORCHESTRATION_MODEL_ID_LENGTH,\n\tMAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH,\n\tMAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES,\n\tMAX_WORKER_AUTHORITY_PATH_LENGTH,\n\tORCHESTRATION_SCHEMA_VERSION,\n\tORCHESTRATION_THINKING_LEVELS,\n\ttoJsonObject,\n\tWORKER_ROLES,\n} from \"./contracts.ts\";\nimport { ORCHESTRATION_PROFILE_TOOL_NAMES } from \"./lane-tool-manifests.ts\";\nimport {\n\ttype CompileExecutionGrantInput,\n\tDEFAULT_ROLE_CAPABILITY_CEILINGS,\n\ttype ExecutionPolicyCompiler,\n\ttype PolicyCompilationResult,\n} from \"./policy-compiler.ts\";\nimport { parseRiskBudget, validateRiskBudget } from \"./risk-budget.ts\";\n\nexport interface ModelHealthView {\n\tisHealthy(binding: OrchestrationModelBinding): boolean;\n}\n\nexport interface ProfileDispatchPlan {\n\tprofile: OrchestrationProfile;\n\tmodel: OrchestrationModelBinding;\n\tgrant: ExecutionGrant;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n}\n\nexport type ProfileDispatchPlanResult =\n\t| { outcome: \"allow\"; plan: ProfileDispatchPlan }\n\t| Exclude<PolicyCompilationResult, { outcome: \"allow\" }>\n\t| { outcome: \"deny\"; decisions: readonly []; reasonCodes: readonly [\"profile_model_unavailable\"] };\n\nexport class OrchestrationProfileError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"OrchestrationProfileError\";\n\t}\n}\n\nfunction duplicateStrings(values: readonly string[]): string[] {\n\tconst seen = new Set<string>();\n\tconst duplicates = new Set<string>();\n\tfor (const value of values) {\n\t\tif (seen.has(value)) duplicates.add(value);\n\t\tseen.add(value);\n\t}\n\treturn [...duplicates];\n}\n\nexport function parseOrchestrationDispatchRequest(value: unknown): OrchestrationDispatchRequest {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Dispatch request must be an object.\");\n\tif (!hasOnlyKeys(value, [\"taskId\", \"profileId\", \"instructions\", \"resourcePointerIds\"])) {\n\t\tthrow new OrchestrationProfileError(\"Dispatch request contains an unsupported durable metadata field.\");\n\t}\n\tif (\n\t\ttypeof value.taskId !== \"string\" ||\n\t\t!value.taskId ||\n\t\tvalue.taskId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\ttypeof value.profileId !== \"string\" ||\n\t\t!value.profileId ||\n\t\tvalue.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\ttypeof value.instructions !== \"string\" ||\n\t\tvalue.instructions.length > MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH ||\n\t\t!value.instructions.trim() ||\n\t\t!Array.isArray(value.resourcePointerIds) ||\n\t\tvalue.resourcePointerIds.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||\n\t\t!value.resourcePointerIds.every(\n\t\t\t(entry) =>\n\t\t\t\ttypeof entry === \"string\" && entry.length > 0 && entry.length <= MAX_ORCHESTRATION_IDENTIFIER_LENGTH,\n\t\t) ||\n\t\tnew Set(value.resourcePointerIds).size !== value.resourcePointerIds.length\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Dispatch request is invalid.\");\n\t}\n\treturn {\n\t\ttaskId: value.taskId,\n\t\tprofileId: value.profileId,\n\t\tinstructions: value.instructions.trim(),\n\t\tresourcePointerIds: [...value.resourcePointerIds],\n\t};\n}\n\nexport function validateOrchestrationProfile(profile: OrchestrationProfile): void {\n\tif (profile.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' has an unsupported schema version.`);\n\t}\n\tif (\n\t\tprofile.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\t!profile.profileId.trim() ||\n\t\tprofile.description.length > MAX_ORCHESTRATION_DESCRIPTION_LENGTH ||\n\t\t!profile.description.trim()\n\t)\n\t\tthrow new OrchestrationProfileError(\"Profile id and description are required.\");\n\tif (profile.role !== \"orchestrator\" && profile.dispatchProfileIds.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Only orchestrator profiles may declare dispatchProfileIds ('${profile.profileId}').`,\n\t\t);\n\t}\n\tif (profile.dispatchProfileIds.includes(profile.profileId)) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot dispatch itself.`);\n\t}\n\tif (profile.requireIndependentVerification) {\n\t\tif (profile.role === \"verifier\") {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Verifier profile '${profile.profileId}' cannot require another verifier.`,\n\t\t\t);\n\t\t}\n\t\tif (\n\t\t\t!profile.verificationProfileId?.trim() ||\n\t\t\tprofile.verificationProfileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' requires independent verification but has no verificationProfileId.`,\n\t\t\t);\n\t\t}\n\t} else if (profile.verificationProfileId !== undefined) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare verificationProfileId without requiring verification.`,\n\t\t);\n\t}\n\tif (profile.verificationProfileId === profile.profileId) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' cannot verify itself.`);\n\t}\n\tif (\n\t\t!profile.createdAt.trim() ||\n\t\tprofile.createdAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\t!profile.updatedAt.trim() ||\n\t\tprofile.updatedAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' timestamps are invalid.`);\n\t}\n\tfor (const [label, values] of [\n\t\t[\"capabilityCeiling\", profile.capabilityCeiling],\n\t\t[\"toolNames\", profile.toolNames],\n\t\t[\"resourceProfileNames\", profile.resourceProfileNames],\n\t\t[\"dispatchProfileIds\", profile.dispatchProfileIds],\n\t] as const) {\n\t\tif (\n\t\t\tvalues.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||\n\t\t\tvalues.some((value) => !value.trim() || value.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH)\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid ${label}.`);\n\t\t}\n\t\tconst duplicates = duplicateStrings(values);\n\t\tif (duplicates.length > 0) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' contains duplicate ${label}: ${duplicates.join(\", \")}.`,\n\t\t\t);\n\t\t}\n\t}\n\tconst roleCeiling = new Set(DEFAULT_ROLE_CAPABILITY_CEILINGS[profile.role]);\n\tconst outOfRoleCapabilities = profile.capabilityCeiling.filter((capability) => !roleCeiling.has(capability));\n\tif (outOfRoleCapabilities.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' exceeds the ${profile.role} role ceiling: ${outOfRoleCapabilities.join(\", \")}.`,\n\t\t);\n\t}\n\tif (\n\t\tprofile.modelPolicy.candidates.length === 0 ||\n\t\tprofile.modelPolicy.candidates.length > MAX_ORCHESTRATION_COLLECTION_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' must declare a model candidate.`);\n\t}\n\tif (profile.modelPolicy.mode === \"fixed\" && profile.modelPolicy.candidates.length !== 1) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Fixed profile '${profile.profileId}' must declare exactly one model candidate.`,\n\t\t);\n\t}\n\tfor (const candidate of profile.modelPolicy.candidates) {\n\t\tif (\n\t\t\tcandidate.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH ||\n\t\t\t!candidate.provider.trim() ||\n\t\t\tcandidate.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH ||\n\t\t\t!candidate.modelId.trim()\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' contains an invalid model binding.`);\n\t\t}\n\t}\n\tconst duplicateModels = duplicateStrings(\n\t\tprofile.modelPolicy.candidates.map((candidate) => `${candidate.provider}/${candidate.modelId}`),\n\t);\n\tif (duplicateModels.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains duplicate model candidates: ${duplicateModels.join(\", \")}.`,\n\t\t);\n\t}\n\tif (!Number.isSafeInteger(profile.maxConcurrent) || profile.maxConcurrent <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' maxConcurrent must be positive.`);\n\t}\n\tif (!Number.isSafeInteger(profile.leaseTtlMs) || profile.leaseTtlMs <= 0) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' leaseTtlMs must be positive.`);\n\t}\n\tif (\n\t\tprofile.delegationLimits &&\n\t\t(!Number.isSafeInteger(profile.delegationLimits.maxDepth) ||\n\t\t\tprofile.delegationLimits.maxDepth < 0 ||\n\t\t\tprofile.delegationLimits.maxDepth > MAX_ORCHESTRATION_AGENT_DEPTH ||\n\t\t\t!Number.isSafeInteger(profile.delegationLimits.maxChildrenPerAgent) ||\n\t\t\tprofile.delegationLimits.maxChildrenPerAgent < 0 ||\n\t\t\tprofile.delegationLimits.maxChildrenPerAgent > MAX_ORCHESTRATION_DIRECT_CHILDREN ||\n\t\t\t(profile.delegationLimits.maxNestedAgentsPerSession !== undefined &&\n\t\t\t\t(!Number.isSafeInteger(profile.delegationLimits.maxNestedAgentsPerSession) ||\n\t\t\t\t\tprofile.delegationLimits.maxNestedAgentsPerSession < 0 ||\n\t\t\t\t\tprofile.delegationLimits.maxNestedAgentsPerSession > MAX_ORCHESTRATION_AGENT_BINDINGS)))\n\t) {\n\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' delegationLimits are invalid.`);\n\t}\n\ttry {\n\t\tvalidateRiskBudget(profile.budget, `Profile '${profile.profileId}' budget`);\n\t} catch (error) {\n\t\tthrow new OrchestrationProfileError(error instanceof Error ? error.message : String(error));\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.budget.maxWallClockMs <= 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' maxWallClockMs budget must be positive when specified.`,\n\t\t);\n\t}\n\tif (profile.budget.maxWallClockMs !== undefined && profile.leaseTtlMs < profile.budget.maxWallClockMs) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' leaseTtlMs must cover its maxWallClockMs budget.`,\n\t\t);\n\t}\n\tconst processCapable =\n\t\tprofile.capabilityCeiling.includes(\"process.exec\") || profile.capabilityCeiling.includes(\"tests.execute\");\n\tconst directProcessLauncher = profile.toolNames.includes(\"run_process\");\n\tif (directProcessLauncher && (!profile.executionPolicy || profile.executionPolicy.allowedExecutables.length === 0)) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' must declare executionPolicy.allowedExecutables for run_process.`,\n\t\t);\n\t}\n\tif (!processCapable && profile.executionPolicy) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' cannot declare executionPolicy without process capabilities.`,\n\t\t);\n\t}\n\tif (profile.executionPolicy) {\n\t\tif (\n\t\t\tprofile.executionPolicy.allowedExecutables.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||\n\t\t\tprofile.executionPolicy.allowedEnvironmentVariables.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||\n\t\t\tprofile.executionPolicy.allowedExecutables.some(\n\t\t\t\t(executable) =>\n\t\t\t\t\t!executable.trim() ||\n\t\t\t\t\texecutable.length > MAX_WORKER_AUTHORITY_PATH_LENGTH ||\n\t\t\t\t\t/[\\0\\r\\n]/.test(executable),\n\t\t\t) ||\n\t\t\tprofile.executionPolicy.allowedEnvironmentVariables.some(\n\t\t\t\t(name) => name.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name),\n\t\t\t) ||\n\t\t\t!Number.isSafeInteger(profile.executionPolicy.maxOutputBytes) ||\n\t\t\tprofile.executionPolicy.maxOutputBytes <= 0 ||\n\t\t\tprofile.executionPolicy.maxOutputBytes > MAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(`Profile '${profile.profileId}' executionPolicy is invalid.`);\n\t\t}\n\t}\n\tconst unknownTools = profile.toolNames.filter(\n\t\t(toolName) => !(ORCHESTRATION_PROFILE_TOOL_NAMES as readonly string[]).includes(toolName),\n\t);\n\tif (unknownTools.length > 0) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\t`Profile '${profile.profileId}' contains unclassified orchestration tools: ${unknownTools.join(\", \")}.`,\n\t\t);\n\t}\n\tfor (const toolName of profile.toolNames) {\n\t\tif (!resolveProfileToolCapabilities(profile, toolName)) {\n\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t`Profile '${profile.profileId}' tool '${toolName}' lacks ${describeToolCapabilityAuthority(toolName)} authority.`,\n\t\t\t);\n\t\t}\n\t}\n\ttoJsonObject({ profile });\n}\n\nfunction isStringArray(value: unknown, maxLength = MAX_ORCHESTRATION_IDENTIFIER_LENGTH): value is string[] {\n\treturn (\n\t\tArray.isArray(value) &&\n\t\tvalue.length <= MAX_ORCHESTRATION_COLLECTION_LENGTH &&\n\t\tvalue.every((entry) => typeof entry === \"string\" && entry.length > 0 && entry.length <= maxLength)\n\t);\n}\n\nexport function parseOrchestrationProfile(value: unknown, sourcePath?: string): OrchestrationProfile {\n\tif (!isPlainRecord(value)) throw new OrchestrationProfileError(\"Orchestration profile must be an object.\");\n\tif (\n\t\t!hasOnlyKeys(value, [\n\t\t\t\"schemaVersion\",\n\t\t\t\"profileId\",\n\t\t\t\"description\",\n\t\t\t\"role\",\n\t\t\t\"modelPolicy\",\n\t\t\t\"capabilityCeiling\",\n\t\t\t\"toolNames\",\n\t\t\t\"resourceProfileNames\",\n\t\t\t\"dispatchProfileIds\",\n\t\t\t\"executionPolicy\",\n\t\t\t\"delegationLimits\",\n\t\t\t\"budget\",\n\t\t\t\"maxConcurrent\",\n\t\t\t\"leaseTtlMs\",\n\t\t\t\"requireIndependentVerification\",\n\t\t\t\"verificationProfileId\",\n\t\t\t\"createdAt\",\n\t\t\t\"updatedAt\",\n\t\t])\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile contains an unsupported field.\");\n\t}\n\tconst modelPolicy = value.modelPolicy;\n\tconst rawBudget = value.budget;\n\tlet budget: RiskBudget;\n\tconst executionPolicy = value.executionPolicy;\n\tconst delegationLimits = value.delegationLimits;\n\tif (\n\t\t!isPlainRecord(modelPolicy) ||\n\t\t!hasOnlyKeys(modelPolicy, [\"mode\", \"candidates\"]) ||\n\t\t!Array.isArray(modelPolicy.candidates) ||\n\t\tmodelPolicy.candidates.length > MAX_ORCHESTRATION_COLLECTION_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile modelPolicy is invalid.\");\n\t}\n\ttry {\n\t\tbudget = parseRiskBudget(rawBudget, \"Orchestration profile budget\");\n\t} catch (error) {\n\t\tthrow new OrchestrationProfileError(\n\t\t\terror instanceof Error ? error.message : \"Orchestration profile budget is invalid.\",\n\t\t);\n\t}\n\tif (\n\t\texecutionPolicy !== undefined &&\n\t\t(!isPlainRecord(executionPolicy) ||\n\t\t\t!hasOnlyKeys(executionPolicy, [\"allowedExecutables\", \"allowedEnvironmentVariables\", \"maxOutputBytes\"]) ||\n\t\t\t!isStringArray(executionPolicy.allowedExecutables, MAX_WORKER_AUTHORITY_PATH_LENGTH) ||\n\t\t\t!isStringArray(executionPolicy.allowedEnvironmentVariables) ||\n\t\t\t!Number.isSafeInteger(executionPolicy.maxOutputBytes))\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile executionPolicy is invalid.\");\n\t}\n\tif (\n\t\tdelegationLimits !== undefined &&\n\t\t(!isPlainRecord(delegationLimits) ||\n\t\t\t!hasOnlyKeys(delegationLimits, [\"maxDepth\", \"maxChildrenPerAgent\", \"maxNestedAgentsPerSession\"]) ||\n\t\t\t!Number.isSafeInteger(delegationLimits.maxDepth) ||\n\t\t\t!Number.isSafeInteger(delegationLimits.maxChildrenPerAgent) ||\n\t\t\t(delegationLimits.maxNestedAgentsPerSession !== undefined &&\n\t\t\t\t!Number.isSafeInteger(delegationLimits.maxNestedAgentsPerSession)))\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile delegationLimits are invalid.\");\n\t}\n\tconst candidates = modelPolicy.candidates.map((candidate) => {\n\t\tif (!isPlainRecord(candidate) || !hasOnlyKeys(candidate, [\"provider\", \"modelId\", \"thinkingLevel\"])) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\tif (\n\t\t\ttypeof candidate.provider !== \"string\" ||\n\t\t\tcandidate.provider.length === 0 ||\n\t\t\tcandidate.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH ||\n\t\t\ttypeof candidate.modelId !== \"string\" ||\n\t\t\tcandidate.modelId.length === 0 ||\n\t\t\tcandidate.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH ||\n\t\t\ttypeof candidate.thinkingLevel !== \"string\" ||\n\t\t\t!ORCHESTRATION_THINKING_LEVELS.includes(\n\t\t\t\tcandidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t\t)\n\t\t) {\n\t\t\tthrow new OrchestrationProfileError(\"Orchestration profile model candidate is invalid.\");\n\t\t}\n\t\treturn {\n\t\t\tprovider: candidate.provider,\n\t\t\tmodelId: candidate.modelId,\n\t\t\tthinkingLevel: candidate.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t\t};\n\t});\n\tif (\n\t\tvalue.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION ||\n\t\ttypeof value.profileId !== \"string\" ||\n\t\tvalue.profileId.length === 0 ||\n\t\tvalue.profileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\ttypeof value.description !== \"string\" ||\n\t\tvalue.description.length === 0 ||\n\t\tvalue.description.length > MAX_ORCHESTRATION_DESCRIPTION_LENGTH ||\n\t\ttypeof value.role !== \"string\" ||\n\t\t!WORKER_ROLES.includes(value.role as (typeof WORKER_ROLES)[number]) ||\n\t\t(modelPolicy.mode !== \"fixed\" && modelPolicy.mode !== \"ordered-fallback\") ||\n\t\t!Array.isArray(value.capabilityCeiling) ||\n\t\tvalue.capabilityCeiling.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||\n\t\t!value.capabilityCeiling.every(\n\t\t\t(capability) =>\n\t\t\t\ttypeof capability === \"string\" &&\n\t\t\t\tHARNESS_CAPABILITIES.includes(capability as (typeof HARNESS_CAPABILITIES)[number]),\n\t\t) ||\n\t\t!isStringArray(value.toolNames) ||\n\t\t!isStringArray(value.resourceProfileNames) ||\n\t\t!isStringArray(value.dispatchProfileIds) ||\n\t\t!Number.isSafeInteger(value.maxConcurrent) ||\n\t\t!Number.isSafeInteger(value.leaseTtlMs) ||\n\t\ttypeof value.requireIndependentVerification !== \"boolean\" ||\n\t\t(value.verificationProfileId !== undefined &&\n\t\t\t(typeof value.verificationProfileId !== \"string\" ||\n\t\t\t\tvalue.verificationProfileId.length === 0 ||\n\t\t\t\tvalue.verificationProfileId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH)) ||\n\t\ttypeof value.createdAt !== \"string\" ||\n\t\tvalue.createdAt.length === 0 ||\n\t\tvalue.createdAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH ||\n\t\ttypeof value.updatedAt !== \"string\" ||\n\t\tvalue.updatedAt.length === 0 ||\n\t\tvalue.updatedAt.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH\n\t) {\n\t\tthrow new OrchestrationProfileError(\"Orchestration profile is invalid.\");\n\t}\n\tconst profile = structuredClone({\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tprofileId: value.profileId,\n\t\tdescription: value.description,\n\t\trole: value.role as OrchestrationProfile[\"role\"],\n\t\tmodelPolicy: { mode: modelPolicy.mode as OrchestrationProfile[\"modelPolicy\"][\"mode\"], candidates },\n\t\tcapabilityCeiling: value.capabilityCeiling as OrchestrationProfile[\"capabilityCeiling\"],\n\t\ttoolNames: value.toolNames,\n\t\tresourceProfileNames: value.resourceProfileNames,\n\t\tdispatchProfileIds: value.dispatchProfileIds,\n\t\t...(executionPolicy\n\t\t\t? {\n\t\t\t\t\texecutionPolicy: {\n\t\t\t\t\t\tallowedExecutables: executionPolicy.allowedExecutables as string[],\n\t\t\t\t\t\tallowedEnvironmentVariables: executionPolicy.allowedEnvironmentVariables as string[],\n\t\t\t\t\t\tmaxOutputBytes: Number(executionPolicy.maxOutputBytes),\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(isPlainRecord(delegationLimits)\n\t\t\t? {\n\t\t\t\t\tdelegationLimits: {\n\t\t\t\t\t\tmaxDepth: Number(delegationLimits.maxDepth),\n\t\t\t\t\t\tmaxChildrenPerAgent: Number(delegationLimits.maxChildrenPerAgent),\n\t\t\t\t\t\t...(delegationLimits.maxNestedAgentsPerSession !== undefined\n\t\t\t\t\t\t\t? { maxNestedAgentsPerSession: Number(delegationLimits.maxNestedAgentsPerSession) }\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t\tbudget,\n\t\tmaxConcurrent: Number(value.maxConcurrent),\n\t\tleaseTtlMs: Number(value.leaseTtlMs),\n\t\trequireIndependentVerification: value.requireIndependentVerification,\n\t\t...(typeof value.verificationProfileId === \"string\"\n\t\t\t? { verificationProfileId: value.verificationProfileId }\n\t\t\t: {}),\n\t\t...(sourcePath ? { sourcePath } : {}),\n\t\tcreatedAt: value.createdAt,\n\t\tupdatedAt: value.updatedAt,\n\t}) as OrchestrationProfile;\n\tvalidateOrchestrationProfile(profile);\n\treturn profile;\n}\n\nfunction freezeProfile(profile: OrchestrationProfile): OrchestrationProfile {\n\tconst clone = structuredClone(profile);\n\tfor (const candidate of clone.modelPolicy.candidates) Object.freeze(candidate);\n\tObject.freeze(clone.modelPolicy.candidates);\n\tObject.freeze(clone.modelPolicy);\n\tObject.freeze(clone.capabilityCeiling);\n\tObject.freeze(clone.toolNames);\n\tObject.freeze(clone.resourceProfileNames);\n\tObject.freeze(clone.dispatchProfileIds);\n\tif (clone.executionPolicy) {\n\t\tObject.freeze(clone.executionPolicy.allowedExecutables);\n\t\tObject.freeze(clone.executionPolicy.allowedEnvironmentVariables);\n\t\tObject.freeze(clone.executionPolicy);\n\t}\n\tif (clone.delegationLimits) Object.freeze(clone.delegationLimits);\n\tObject.freeze(clone.budget);\n\treturn Object.freeze(clone);\n}\n\nexport class OrchestrationProfileRegistry {\n\tprivate readonly profiles = new Map<string, OrchestrationProfile>();\n\n\tconstructor(profiles: readonly OrchestrationProfile[] = []) {\n\t\tfor (const profile of profiles) this.register(profile);\n\t\tfor (const profile of this.profiles.values()) {\n\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\tconst target = this.profiles.get(dispatchedProfileId);\n\t\t\t\tif (!target) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' dispatches missing profile '${dispatchedProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.verificationProfileId) {\n\t\t\t\tconst verifier = this.profiles.get(profile.verificationProfileId);\n\t\t\t\tif (!verifier) {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' requires missing verifier profile '${profile.verificationProfileId}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (verifier.role !== \"verifier\") {\n\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t`Profile '${profile.profileId}' verificationProfileId '${profile.verificationProfileId}' is not a verifier.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (profile.role === \"orchestrator\") {\n\t\t\t\tfor (const dispatchedProfileId of profile.dispatchProfileIds) {\n\t\t\t\t\tconst worker = this.profiles.get(dispatchedProfileId);\n\t\t\t\t\tif (\n\t\t\t\t\t\tworker?.verificationProfileId &&\n\t\t\t\t\t\t!profile.dispatchProfileIds.includes(worker.verificationProfileId)\n\t\t\t\t\t) {\n\t\t\t\t\t\tthrow new OrchestrationProfileError(\n\t\t\t\t\t\t\t`Orchestrator '${profile.profileId}' dispatches '${worker.profileId}' but not its verifier '${worker.verificationProfileId}'.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tregister(profile: OrchestrationProfile): void {\n\t\tvalidateOrchestrationProfile(profile);\n\t\tif (this.profiles.has(profile.profileId)) {\n\t\t\tthrow new OrchestrationProfileError(`Duplicate orchestration profile '${profile.profileId}'.`);\n\t\t}\n\t\tthis.profiles.set(profile.profileId, freezeProfile(profile));\n\t}\n\n\tget(profileId: string): OrchestrationProfile | undefined {\n\t\tconst profile = this.profiles.get(profileId);\n\t\treturn profile ? structuredClone(profile) : undefined;\n\t}\n\n\tlist(): OrchestrationProfile[] {\n\t\treturn [...this.profiles.values()].map((profile) => structuredClone(profile));\n\t}\n}\n\nexport function resolveProfileModel(\n\tprofile: OrchestrationProfile,\n\thealth: ModelHealthView,\n): OrchestrationModelBinding | undefined {\n\tif (profile.modelPolicy.mode === \"fixed\") {\n\t\tconst fixed = profile.modelPolicy.candidates[0];\n\t\treturn fixed && health.isHealthy(fixed) ? structuredClone(fixed) : undefined;\n\t}\n\tconst selected = profile.modelPolicy.candidates.find((candidate) => health.isHealthy(candidate));\n\treturn selected ? structuredClone(selected) : undefined;\n}\n\nexport function planProfileDispatch(args: {\n\trequest: OrchestrationDispatchRequest;\n\ttask: TaskContract;\n\tattemptId: string;\n\tsubjectId: string;\n\tregistry: OrchestrationProfileRegistry;\n\thealth: ModelHealthView;\n\tpolicyCompiler: ExecutionPolicyCompiler;\n\ttoolManifests: readonly ToolCapabilityManifest[];\n\tresources: readonly ResourcePointer[];\n\treadPaths: readonly string[];\n\twritePaths?: readonly string[];\n\tdeniedPaths?: readonly string[];\n\tpolicyVersion: string;\n}): ProfileDispatchPlanResult {\n\tconst profile = args.registry.get(args.request.profileId);\n\tif (!profile) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tif (profile.role !== args.task.role) {\n\t\treturn { outcome: \"deny\", decisions: [], reasonCodes: [\"required_capability_exceeds_role_ceiling\"] };\n\t}\n\tconst model = resolveProfileModel(profile, args.health);\n\tif (!model) return { outcome: \"deny\", decisions: [], reasonCodes: [\"profile_model_unavailable\"] };\n\tconst selectedResources = args.resources.filter((resource) => args.request.resourcePointerIds.includes(resource.id));\n\tconst manifestsByName = new Map(args.toolManifests.map((manifest) => [manifest.toolName, manifest]));\n\tconst requestedTools = profile.toolNames.filter((toolName) => {\n\t\tconst manifest = manifestsByName.get(toolName);\n\t\treturn manifest?.capabilities.every((capability) => args.task.requiredCapabilities.includes(capability)) === true;\n\t});\n\tconst policyInput: CompileExecutionGrantInput = {\n\t\tobjectiveId: args.task.objectiveId,\n\t\ttaskId: args.task.taskId,\n\t\tattemptId: args.attemptId,\n\t\tsubjectId: args.subjectId,\n\t\trole: profile.role,\n\t\trequiredCapabilities: args.task.requiredCapabilities,\n\t\trequestedCapabilities: args.task.requiredCapabilities,\n\t\tauthorityCapabilities: profile.capabilityCeiling,\n\t\trequestedTools,\n\t\ttoolManifests: args.toolManifests,\n\t\tresources: selectedResources,\n\t\treadPaths: args.readPaths,\n\t\twritePaths: args.writePaths,\n\t\tdeniedPaths: args.deniedPaths,\n\t\trequestedBudget: profile.budget,\n\t\tauthorityBudget: profile.budget,\n\t\tpolicyVersion: args.policyVersion,\n\t};\n\tconst compiled = args.policyCompiler.compile(policyInput);\n\tif (compiled.outcome !== \"allow\") return compiled;\n\treturn { outcome: \"allow\", plan: { profile, model, grant: compiled.grant, toolManifests: compiled.toolManifests } };\n}\n"]}

package/dist/core/pipelines/active-context.d.ts

@@ -0,0 +1,16 @@
+import { createCustomMessage } from "@caupulican/pi-agent-core";
+import { type DiscoverPipelineOptions } from "./discover.ts";
+import type { PipelineRun } from "./types.ts";
+export interface ActivePipelineContext {
+    run: PipelineRun;
+    text: string;
+}
+/** Resolve durable run identity, definition ownership, and bounded prompt text through one path. */
+export declare function resolveActivePipelineContext(options: DiscoverPipelineOptions, snapshot?: PipelineRun): ActivePipelineContext | undefined;
+/** Build the optional per-turn pipeline message without leaking discovery failures into prompt admission. */
+export declare function createActivePipelineContextMessage(args: {
+    options: DiscoverPipelineOptions;
+    snapshot?: PipelineRun;
+    onError(message: string): void;
+}): ReturnType<typeof createCustomMessage> | undefined;
+//# sourceMappingURL=active-context.d.ts.map

package/dist/core/pipelines/active-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-context.d.ts","sourceRoot":"","sources":["../../../src/core/pipelines/active-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,KAAK,uBAAuB,EAAmC,MAAM,eAAe,CAAC;AAE9F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,qBAAqB;IACrC,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,uBAAuB,EAChC,QAAQ,CAAC,EAAE,WAAW,GACpB,qBAAqB,GAAG,SAAS,CAOnC;AAED,6GAA6G;AAC7G,wBAAgB,kCAAkC,CAAC,IAAI,EAAE;IACxD,OAAO,EAAE,uBAAuB,CAAC;IACjC,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,GAAG,SAAS,CAgBrD"}