@dotcontext/cli 0.8.1 → 0.9.0

package/dist/services/harness/policyService.d.ts

@@ -0,0 +1,116 @@
+import { type StackInfo } from '../stack';
+export type HarnessPolicyEffect = 'allow' | 'deny' | 'require_approval';
+export type HarnessPolicyRisk = 'low' | 'medium' | 'high' | 'critical';
+export type HarnessPolicyTarget = 'tool' | 'action' | 'path' | 'risk';
+export type HarnessPolicyScope = HarnessPolicyTarget;
+export type HarnessPolicyDefaultEffect = 'allow' | 'deny';
+export interface HarnessPolicyRuleSelector {
+    tools?: string[];
+    actions?: string[];
+    paths?: string[];
+    risk?: HarnessPolicyRisk;
+}
+export interface HarnessPolicyRule {
+    id: string;
+    effect: HarnessPolicyEffect;
+    when?: HarnessPolicyRuleSelector;
+    target?: HarnessPolicyTarget;
+    pattern?: string;
+    approvalRole?: string;
+    reason?: string;
+}
+export interface HarnessPolicyDocument {
+    version: 1;
+    defaultEffect: HarnessPolicyDefaultEffect;
+    rules: HarnessPolicyRule[];
+}
+export interface HarnessPolicyApproval {
+    approvedBy?: string;
+    note?: string;
+}
+export interface HarnessPolicyEvaluationInput {
+    tool?: string;
+    action: string;
+    paths?: string[];
+    path?: string;
+    risk?: HarnessPolicyRisk;
+    approval?: HarnessPolicyApproval;
+    approvalRole?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface HarnessPolicyLegacyEnforcementInput {
+    scope: HarnessPolicyScope;
+    target?: string;
+    path?: string;
+    risk?: HarnessPolicyRisk;
+    metadata?: Record<string, unknown>;
+    approval?: HarnessPolicyApproval;
+    approvalRole?: string;
+}
+export interface HarnessPolicyMatch {
+    rule: HarnessPolicyRule;
+    requiresApproval: boolean;
+    blocked: boolean;
+    approved: boolean;
+}
+export interface HarnessPolicyDecision {
+    allowed: boolean;
+    blocked: boolean;
+    requiresApproval: boolean;
+    reasons: string[];
+    matchedRules: HarnessPolicyMatch[];
+    policy: HarnessPolicyDocument;
+}
+export type HarnessPolicyEvaluationResult = HarnessPolicyDecision;
+export interface CreateHarnessPolicyRuleInput {
+    id: string;
+    effect: HarnessPolicyEffect;
+    target: HarnessPolicyTarget;
+    pattern: string;
+    approvalRole?: string;
+    reason?: string;
+}
+export interface HarnessPolicyServiceOptions {
+    repoPath: string;
+}
+export interface CreateHarnessBootstrapPolicyOptions {
+    stackInfo?: StackInfo;
+}
+export declare class HarnessPolicyBlockedError extends Error {
+    readonly decision: HarnessPolicyDecision;
+    constructor(message: string, decision: HarnessPolicyDecision);
+}
+export declare class HarnessPolicyService {
+    private readonly options;
+    constructor(options: HarnessPolicyServiceOptions);
+    private get repoPath();
+    private get policyPath();
+    private toEvaluationInput;
+    loadPolicy(): Promise<HarnessPolicyDocument>;
+    savePolicy(policy: HarnessPolicyDocument): Promise<HarnessPolicyDocument>;
+    listRules(): Promise<HarnessPolicyRule[]>;
+    private evaluateWithPolicy;
+    evaluate(input: HarnessPolicyEvaluationInput, policy?: HarnessPolicyDocument): Promise<HarnessPolicyDecision>;
+    evaluateAndAuthorize(input: HarnessPolicyEvaluationInput, policy?: HarnessPolicyDocument): Promise<HarnessPolicyDecision>;
+    authorize(input: HarnessPolicyEvaluationInput, policy?: HarnessPolicyDocument): Promise<HarnessPolicyDecision>;
+    enforce(input: HarnessPolicyEvaluationInput | HarnessPolicyLegacyEnforcementInput, policy?: HarnessPolicyDocument): Promise<HarnessPolicyDecision>;
+    setPolicyFromRules(input: {
+        defaultEffect?: HarnessPolicyDefaultEffect;
+        rules?: HarnessPolicyRule[];
+    }): Promise<HarnessPolicyDocument>;
+    setPolicy(policy: HarnessPolicyDocument): Promise<HarnessPolicyDocument>;
+    setPolicyDocument(policy: HarnessPolicyDocument): Promise<HarnessPolicyDocument>;
+    registerRule(input: CreateHarnessPolicyRuleInput): Promise<HarnessPolicyRule>;
+    evaluateLegacy(input: HarnessPolicyEvaluationInput): Promise<HarnessPolicyEvaluationResult>;
+    assertAllowed(input: HarnessPolicyEvaluationInput): Promise<void>;
+    evaluatePolicy(input: HarnessPolicyEvaluationInput): Promise<HarnessPolicyEvaluationResult>;
+    evaluateRule(input: HarnessPolicyEvaluationInput): Promise<HarnessPolicyEvaluationResult>;
+    getPolicy(): Promise<HarnessPolicyDocument>;
+    private detectStackInfo;
+    private readTopLevelEntries;
+    private getCorePathPatterns;
+    private getConfigPathPatterns;
+    private buildCoreRuleReason;
+    createBootstrapPolicy(options?: CreateHarnessBootstrapPolicyOptions): Promise<HarnessPolicyDocument>;
+}
+//# sourceMappingURL=policyService.d.ts.map

package/dist/services/harness/policyService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyService.d.ts","sourceRoot":"","sources":["../../../src/services/harness/policyService.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAEzD,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC;AACxE,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AACvE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AACrD,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,mBAAmB,CAAC;IAC5B,IAAI,CAAC,EAAE,yBAAyB,CAAC;IACjC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,0BAA0B,CAAC;IAC1C,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,iBAAiB,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAED,MAAM,MAAM,6BAA6B,GAAG,qBAAqB,CAAC;AAElE,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,qBAAa,yBAA0B,SAAQ,KAAK;aAGhC,QAAQ,EAAE,qBAAqB;gBAD/C,OAAO,EAAE,MAAM,EACC,QAAQ,EAAE,qBAAqB;CAKlD;AAmKD,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,2BAA2B;IAEjE,OAAO,KAAK,QAAQ,GAEnB;IAED,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,CAAC,iBAAiB;IAkBnB,UAAU,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAiB5C,UAAU,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAWzE,SAAS,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAK/C,OAAO,CAAC,kBAAkB;IAqEpB,QAAQ,CAAC,KAAK,EAAE,4BAA4B,EAAE,MAAM,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAK7G,oBAAoB,CACxB,KAAK,EAAE,4BAA4B,EACnC,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC;IAK3B,SAAS,CACb,KAAK,EAAE,4BAA4B,EACnC,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC;IAiB3B,OAAO,CACX,KAAK,EAAE,4BAA4B,GAAG,mCAAmC,EACzE,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC;IAI3B,kBAAkB,CAAC,KAAK,EAAE;QAC9B,aAAa,CAAC,EAAE,0BAA0B,CAAC;QAC3C,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;KAC7B,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQ5B,SAAS,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQxE,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIhF,YAAY,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAgB7E,cAAc,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAI3F,aAAa,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC;IAejE,cAAc,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAI3F,YAAY,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAIzF,SAAS,IAAI,OAAO,CAAC,qBAAqB,CAAC;YAInC,eAAe;YAQf,mBAAmB;IA4BjC,OAAO,CAAC,mBAAmB;YAeb,qBAAqB;IAwBnC,OAAO,CAAC,mBAAmB;IAcrB,qBAAqB,CACzB,OAAO,GAAE,mCAAwC,GAChD,OAAO,CAAC,qBAAqB,CAAC;CA8ClC"}

package/dist/services/harness/policyService.js

@@ -0,0 +1,510 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HarnessPolicyService = exports.HarnessPolicyBlockedError = void 0;
+const fs = __importStar(require("fs-extra"));
+const path = __importStar(require("path"));
+const stack_1 = require("../stack");
+class HarnessPolicyBlockedError extends Error {
+    constructor(message, decision) {
+        super(message);
+        this.decision = decision;
+        this.name = 'HarnessPolicyBlockedError';
+    }
+}
+exports.HarnessPolicyBlockedError = HarnessPolicyBlockedError;
+function normalizePath(input) {
+    return input.split(path.sep).join('/');
+}
+function escapeRegex(input) {
+    return input.replace(/[|\\{}()[\]^$+?.]/g, '\\$&');
+}
+function globToRegExp(pattern) {
+    const normalized = normalizePath(pattern);
+    const regex = normalized
+        .split('**').join('__DOUBLE_STAR__')
+        .split('*').join('__STAR__')
+        .split('?').join('__QMARK__');
+    const escaped = escapeRegex(regex)
+        .replace(/__DOUBLE_STAR__/g, '.*')
+        .replace(/__STAR__/g, '[^/]*')
+        .replace(/__QMARK__/g, '.');
+    return new RegExp(`^${escaped}$`, 'i');
+}
+function matchesAnyPattern(value, patterns) {
+    const normalizedValue = normalizePath(value);
+    return patterns.some((pattern) => {
+        if (pattern.includes('*') || pattern.includes('?')) {
+            return globToRegExp(pattern).test(normalizedValue);
+        }
+        const normalizedPattern = normalizePath(pattern);
+        return normalizedValue === normalizedPattern || normalizedValue.includes(normalizedPattern);
+    });
+}
+function riskRank(risk) {
+    return {
+        low: 1,
+        medium: 2,
+        high: 3,
+        critical: 4,
+    }[risk];
+}
+function compareRisk(inputRisk, ruleRisk) {
+    if (!ruleRisk) {
+        return true;
+    }
+    if (!inputRisk) {
+        return false;
+    }
+    return riskRank(inputRisk) >= riskRank(ruleRisk);
+}
+function normalizeRule(rule) {
+    if (rule.when) {
+        return rule;
+    }
+    const selector = {};
+    if (rule.target === 'tool' && rule.pattern) {
+        selector.tools = [rule.pattern];
+    }
+    else if (rule.target === 'action' && rule.pattern) {
+        selector.actions = [rule.pattern];
+    }
+    else if (rule.target === 'path' && rule.pattern) {
+        selector.paths = [rule.pattern];
+    }
+    else if (rule.target === 'risk' && rule.pattern) {
+        selector.risk = rule.pattern;
+    }
+    return {
+        ...rule,
+        when: selector,
+    };
+}
+function isLegacyEnforcementInput(input) {
+    return input.scope !== undefined;
+}
+const CORE_DIRECTORY_CANDIDATES = [
+    'src',
+    'app',
+    'apps',
+    'lib',
+    'libs',
+    'packages',
+    'modules',
+    'services',
+    'server',
+    'client',
+    'web',
+    'frontend',
+    'backend',
+    'api',
+    'cmd',
+    'pkg',
+    'internal',
+    'bin',
+];
+const ROOT_CONFIG_FILE_CANDIDATES = [
+    'package.json',
+    'package-lock.json',
+    'pnpm-lock.yaml',
+    'yarn.lock',
+    'bun.lockb',
+    'tsconfig.json',
+    'pyproject.toml',
+    'requirements.txt',
+    'setup.py',
+    'go.mod',
+    'go.sum',
+    'Cargo.toml',
+    'Cargo.lock',
+    'pom.xml',
+    'build.gradle',
+    'build.gradle.kts',
+    'settings.gradle',
+    'Gemfile',
+    'composer.json',
+    'Makefile',
+    'turbo.json',
+    'nx.json',
+    'lerna.json',
+    'pnpm-workspace.yaml',
+];
+const ROOT_SOURCE_FILE_EXTENSIONS = new Set([
+    '.ts',
+    '.tsx',
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+    '.py',
+    '.go',
+    '.rs',
+    '.java',
+    '.kt',
+    '.rb',
+    '.php',
+    '.cs',
+    '.swift',
+]);
+const CONFIG_DIRECTORY_PATTERNS = [
+    { path: '.github/workflows', pattern: '.github/workflows/**' },
+    { path: '.circleci', pattern: '.circleci/**' },
+    { path: 'docker', pattern: 'docker/**' },
+    { path: 'infra', pattern: 'infra/**' },
+    { path: 'infrastructure', pattern: 'infrastructure/**' },
+    { path: 'terraform', pattern: 'terraform/**' },
+    { path: 'k8s', pattern: 'k8s/**' },
+    { path: 'helm', pattern: 'helm/**' },
+    { path: 'deploy', pattern: 'deploy/**' },
+    { path: 'deployment', pattern: 'deployment/**' },
+    { path: '.devcontainer', pattern: '.devcontainer/**' },
+];
+class HarnessPolicyService {
+    constructor(options) {
+        this.options = options;
+    }
+    get repoPath() {
+        return path.resolve(this.options.repoPath);
+    }
+    get policyPath() {
+        return path.join(this.repoPath, '.context', 'harness', 'policy.json');
+    }
+    toEvaluationInput(input) {
+        if (!isLegacyEnforcementInput(input)) {
+            return input;
+        }
+        return {
+            tool: 'harness',
+            action: input.target ?? input.scope,
+            paths: input.path ? [input.path] : undefined,
+            risk: input.risk,
+            metadata: input.metadata,
+            approval: input.approval,
+            approvalRole: input.approvalRole,
+        };
+    }
+    async loadPolicy() {
+        if (!(await fs.pathExists(this.policyPath))) {
+            return {
+                version: 1,
+                defaultEffect: 'allow',
+                rules: [],
+            };
+        }
+        const loaded = await fs.readJson(this.policyPath);
+        return {
+            version: 1,
+            defaultEffect: loaded.defaultEffect === 'deny' ? 'deny' : 'allow',
+            rules: Array.isArray(loaded.rules) ? loaded.rules.map(normalizeRule) : [],
+        };
+    }
+    async savePolicy(policy) {
+        await fs.ensureDir(path.dirname(this.policyPath));
+        const normalized = {
+            version: 1,
+            defaultEffect: policy.defaultEffect === 'deny' ? 'deny' : 'allow',
+            rules: policy.rules.map(normalizeRule),
+        };
+        await fs.writeJson(this.policyPath, normalized, { spaces: 2 });
+        return normalized;
+    }
+    async listRules() {
+        const policy = await this.loadPolicy();
+        return policy.rules.map(normalizeRule);
+    }
+    evaluateWithPolicy(input, policy) {
+        const currentPolicy = policy ?? {
+            version: 1,
+            defaultEffect: 'allow',
+            rules: [],
+        };
+        const matchedRules = [];
+        const reasons = [];
+        const tool = input.tool ?? 'harness';
+        const paths = input.paths ?? (input.path ? [input.path] : []);
+        for (const rawRule of currentPolicy.rules) {
+            const rule = normalizeRule(rawRule);
+            const selector = rule.when ?? {};
+            const toolMatch = !selector.tools || selector.tools.length === 0
+                ? true
+                : matchesAnyPattern(tool, selector.tools);
+            const actionMatch = !selector.actions || selector.actions.length === 0
+                ? true
+                : matchesAnyPattern(input.action, selector.actions);
+            const pathMatch = !selector.paths || selector.paths.length === 0
+                ? true
+                : paths.some((value) => matchesAnyPattern(value, selector.paths));
+            const riskMatch = compareRisk(input.risk, selector.risk);
+            if (!(toolMatch && actionMatch && pathMatch && riskMatch)) {
+                continue;
+            }
+            const approvedByProvided = Boolean(input.approval?.approvedBy);
+            const approvalRoleSatisfied = !rule.approvalRole || input.approvalRole === rule.approvalRole;
+            const approved = approvedByProvided && approvalRoleSatisfied;
+            const requiresApproval = rule.effect === 'require_approval' && !approved;
+            const blocked = rule.effect === 'deny' || requiresApproval;
+            matchedRules.push({
+                rule,
+                requiresApproval,
+                blocked,
+                approved,
+            });
+            if (rule.reason) {
+                reasons.push(rule.reason);
+            }
+            else if (requiresApproval && rule.approvalRole) {
+                reasons.push(`Policy rule ${rule.id} requires approval by role: ${rule.approvalRole}`);
+            }
+            else {
+                reasons.push(`Policy rule matched: ${rule.id}`);
+            }
+        }
+        const blocked = matchedRules.some((match) => match.blocked);
+        const requiresApproval = matchedRules.some((match) => match.requiresApproval);
+        const allowed = !blocked && (currentPolicy.defaultEffect === 'allow' || matchedRules.length > 0);
+        if (!allowed && matchedRules.length === 0) {
+            reasons.push(`Default policy effect is ${currentPolicy.defaultEffect}`);
+        }
+        return {
+            allowed,
+            blocked,
+            requiresApproval,
+            reasons,
+            matchedRules,
+            policy: currentPolicy,
+        };
+    }
+    async evaluate(input, policy) {
+        const currentPolicy = policy ?? await this.loadPolicy();
+        return this.evaluateWithPolicy(input, currentPolicy);
+    }
+    async evaluateAndAuthorize(input, policy) {
+        const currentPolicy = policy ?? await this.loadPolicy();
+        return this.evaluateWithPolicy(input, currentPolicy);
+    }
+    async authorize(input, policy) {
+        const decision = await this.evaluateAndAuthorize(input, policy);
+        if (decision.requiresApproval) {
+            throw new HarnessPolicyBlockedError(`Policy approval required for ${(input.tool ?? 'harness')}.${input.action}`, decision);
+        }
+        if (decision.blocked || !decision.allowed) {
+            throw new HarnessPolicyBlockedError(`Policy blocked ${(input.tool ?? 'harness')}.${input.action}`, decision);
+        }
+        return decision;
+    }
+    async enforce(input, policy) {
+        return this.authorize(this.toEvaluationInput(input), policy);
+    }
+    async setPolicyFromRules(input) {
+        return this.savePolicy({
+            version: 1,
+            defaultEffect: input.defaultEffect ?? 'allow',
+            rules: (input.rules ?? []).map(normalizeRule),
+        });
+    }
+    async setPolicy(policy) {
+        return this.savePolicy({
+            version: 1,
+            defaultEffect: policy.defaultEffect,
+            rules: policy.rules.map(normalizeRule),
+        });
+    }
+    async setPolicyDocument(policy) {
+        return this.setPolicy(policy);
+    }
+    async registerRule(input) {
+        const policy = await this.loadPolicy();
+        const rule = {
+            id: input.id,
+            effect: input.effect,
+            target: input.target,
+            pattern: input.pattern,
+            approvalRole: input.approvalRole,
+            reason: input.reason,
+        };
+        policy.rules = policy.rules.filter((existing) => existing.id !== rule.id);
+        policy.rules.push(rule);
+        await this.savePolicy(policy);
+        return normalizeRule(rule);
+    }
+    async evaluateLegacy(input) {
+        return this.evaluate(input);
+    }
+    async assertAllowed(input) {
+        try {
+            await this.authorize(input);
+        }
+        catch (error) {
+            if (error instanceof HarnessPolicyBlockedError) {
+                const message = error.decision.requiresApproval
+                    ? `Policy approval required for ${(input.tool ?? 'harness')}.${input.action}`
+                    : `Policy blocked ${(input.tool ?? 'harness')}.${input.action}`;
+                throw new HarnessPolicyBlockedError(message, error.decision);
+            }
+            throw error;
+        }
+    }
+    async evaluatePolicy(input) {
+        return this.evaluate(input);
+    }
+    async evaluateRule(input) {
+        return this.evaluate(input);
+    }
+    async getPolicy() {
+        return this.loadPolicy();
+    }
+    async detectStackInfo() {
+        try {
+            return await new stack_1.StackDetector().detect(this.repoPath);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async readTopLevelEntries() {
+        try {
+            const entries = await fs.readdir(this.repoPath);
+            const files = [];
+            const directories = [];
+            await Promise.all(entries.map(async (entry) => {
+                const fullPath = path.join(this.repoPath, entry);
+                const stats = await fs.stat(fullPath);
+                if (stats.isDirectory()) {
+                    directories.push(entry);
+                }
+                else {
+                    files.push(entry);
+                }
+            }));
+            return {
+                files: files.sort(),
+                directories: directories.sort(),
+            };
+        }
+        catch {
+            return {
+                files: [],
+                directories: [],
+            };
+        }
+    }
+    getCorePathPatterns(topLevelEntries) {
+        const directorySet = new Set(topLevelEntries.directories);
+        const paths = CORE_DIRECTORY_CANDIDATES
+            .filter((directory) => directorySet.has(directory))
+            .map((directory) => `${directory}/**`);
+        if (paths.length > 0) {
+            return [...new Set(paths)];
+        }
+        return topLevelEntries.files
+            .filter((file) => ROOT_SOURCE_FILE_EXTENSIONS.has(path.extname(file).toLowerCase()))
+            .sort();
+    }
+    async getConfigPathPatterns(topLevelEntries) {
+        const fileSet = new Set(topLevelEntries.files);
+        const patterns = ROOT_CONFIG_FILE_CANDIDATES
+            .filter((file) => fileSet.has(file))
+            .slice();
+        for (const file of topLevelEntries.files) {
+            if (file === 'Dockerfile' || file.startsWith('Dockerfile.')) {
+                patterns.push(file);
+            }
+            if (/^docker-compose\.(ya?ml)$/i.test(file)) {
+                patterns.push(file);
+            }
+        }
+        for (const candidate of CONFIG_DIRECTORY_PATTERNS) {
+            if (await fs.pathExists(path.join(this.repoPath, candidate.path))) {
+                patterns.push(candidate.pattern);
+            }
+        }
+        return [...new Set(patterns)].sort();
+    }
+    buildCoreRuleReason(stackInfo) {
+        const descriptors = [
+            stackInfo?.isMonorepo ? 'monorepo' : null,
+            stackInfo?.primaryLanguage ?? null,
+            stackInfo?.frameworks[0] ?? null,
+        ].filter((value) => Boolean(value));
+        if (descriptors.length === 0) {
+            return 'High-risk changes to core repository paths require approval.';
+        }
+        return `High-risk changes to core ${descriptors.join(' ')} paths require approval.`;
+    }
+    async createBootstrapPolicy(options = {}) {
+        const stackInfo = options.stackInfo ?? await this.detectStackInfo();
+        const topLevelEntries = await this.readTopLevelEntries();
+        const corePaths = this.getCorePathPatterns(topLevelEntries);
+        const configPaths = await this.getConfigPathPatterns(topLevelEntries);
+        const rules = [];
+        if (corePaths.length > 0) {
+            rules.push({
+                id: 'protect-repository-core',
+                effect: 'require_approval',
+                when: {
+                    paths: corePaths,
+                    risk: 'high',
+                },
+                reason: this.buildCoreRuleReason(stackInfo),
+            });
+        }
+        if (configPaths.length > 0) {
+            rules.push({
+                id: 'protect-repository-config',
+                effect: 'require_approval',
+                when: {
+                    paths: configPaths,
+                    risk: 'high',
+                },
+                reason: 'High-risk changes to repository automation and build configuration require approval.',
+            });
+        }
+        rules.push({
+            id: 'block-secrets',
+            effect: 'deny',
+            when: {
+                paths: ['**/.env*', '**/*.pem', '**/*.key', '**/*secret*'],
+            },
+            reason: 'Secret-like files are blocked by policy.',
+        });
+        return {
+            version: 1,
+            defaultEffect: 'allow',
+            rules,
+        };
+    }
+}
+exports.HarnessPolicyService = HarnessPolicyService;
+//# sourceMappingURL=policyService.js.map

package/dist/services/harness/policyService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyService.js","sourceRoot":"","sources":["../../../src/services/harness/policyService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6CAA+B;AAC/B,2CAA6B;AAC7B,oCAAyD;AA4FzD,MAAa,yBAA0B,SAAQ,KAAK;IAClD,YACE,OAAe,EACC,QAA+B;QAE/C,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,aAAQ,GAAR,QAAQ,CAAuB;QAG/C,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AARD,8DAQC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,UAAU;SACrB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;SACnC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;SAC3B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC;SACjC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC;SAC7B,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAE9B,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,QAAkB;IAC1D,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,eAAe,KAAK,iBAAiB,IAAI,eAAe,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB;IACvC,OAAO;QACL,GAAG,EAAE,CAAC;QACN,MAAM,EAAE,CAAC;QACT,IAAI,EAAE,CAAC;QACP,QAAQ,EAAE,CAAC;KACZ,CAAC,IAAI,CAAC,CAAC;AACV,CAAC;AAED,SAAS,WAAW,CAAC,SAAwC,EAAE,QAAuC;IACpG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,IAAuB;IAC5C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3C,QAAQ,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACpD,QAAQ,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClD,QAAQ,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,OAA4B,CAAC;IACpD,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE,QAAQ;KACf,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyE;IAEzE,OAAQ,KAA6C,CAAC,KAAK,KAAK,SAAS,CAAC;AAC5E,CAAC;AAED,MAAM,yBAAyB,GAAG;IAChC,KAAK;IACL,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,UAAU;IACV,SAAS;IACT,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,UAAU;IACV,SAAS;IACT,KAAK;IACL,KAAK;IACL,KAAK;IACL,UAAU;IACV,KAAK;CACG,CAAC;AAEX,MAAM,2BAA2B,GAAG;IAClC,cAAc;IACd,mBAAmB;IACnB,gBAAgB;IAChB,WAAW;IACX,WAAW;IACX,eAAe;IACf,gBAAgB;IAChB,kBAAkB;IAClB,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,cAAc;IACd,kBAAkB;IAClB,iBAAiB;IACjB,SAAS;IACT,eAAe;IACf,UAAU;IACV,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,qBAAqB;CACb,CAAC;AAEX,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO;IACP,KAAK;IACL,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAA6C;IAC1E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,sBAAsB,EAAE;IAC9D,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;IAC9C,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE;IACxC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE;IACtC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACxD,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;IAC9C,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE;IAClC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;IACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE;IACxC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE;IAChD,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,EAAE;CAC9C,CAAC;AAEX,MAAa,oBAAoB;IAC/B,YAA6B,OAAoC;QAApC,YAAO,GAAP,OAAO,CAA6B;IAAG,CAAC;IAErE,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACxE,CAAC;IAEO,iBAAiB,CACvB,KAAyE;QAEzE,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK;YACnC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC5C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,EAAE;aACV,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAmC,CAAC;QACpF,OAAO;YACL,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACjE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,KAA6B,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;SACnG,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAA6B;QAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAClD,MAAM,UAAU,GAA0B;YACxC,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACjE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;SACvC,CAAC;QACF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAEO,kBAAkB,CAAC,KAAmC,EAAE,MAA6B;QAC3F,MAAM,aAAa,GAAG,MAAM,IAAI;YAC9B,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE,EAAE;SACV,CAAC;QACF,MAAM,YAAY,GAAyB,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE9D,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAC9D,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBACpE,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAC9D,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAM,CAAC,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAEzD,IAAI,CAAC,CAAC,SAAS,IAAI,WAAW,IAAI,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC;gBAC1D,SAAS;YACX,CAAC;YAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC/D,MAAM,qBAAqB,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC;YAC7F,MAAM,QAAQ,GAAG,kBAAkB,IAAI,qBAAqB,CAAC;YAC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,KAAK,kBAAkB,IAAI,CAAC,QAAQ,CAAC;YACzE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,gBAAgB,CAAC;YAE3D,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI;gBACJ,gBAAgB;gBAChB,OAAO;gBACP,QAAQ;aACT,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,gBAAgB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,EAAE,+BAA+B,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YACzF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,KAAK,OAAO,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEjG,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,4BAA4B,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO;YACP,gBAAgB;YAChB,OAAO;YACP,YAAY;YACZ,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAmC,EAAE,MAA8B;QAChF,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAmC,EACnC,MAA8B;QAE9B,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAmC,EACnC,MAA8B;QAE9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC9B,MAAM,IAAI,yBAAyB,CACjC,gCAAgC,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAC3E,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAC7D,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,KAAyE,EACzE,MAA8B;QAE9B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAGxB;QACC,OAAO,IAAI,CAAC,UAAU,CAAC;YACrB,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,OAAO;YAC7C,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAA6B;QAC3C,OAAO,IAAI,CAAC,UAAU,CAAC;YACrB,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAA6B;QACnD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAmC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,GAAsB;YAC9B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAmC;QACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAmC;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,gBAAgB;oBAC7C,CAAC,CAAC,gCAAgC,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE;oBAC7E,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClE,MAAM,IAAI,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAmC;QACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAmC;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,qBAAa,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAa,EAAE,CAAC;YAEjC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACjD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC,CAAC,CAAC,CAAC;YAEJ,OAAO;gBACL,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;gBACnB,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE;aAChC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,eAA2D;QACrF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,yBAAyB;aACpC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;aAClD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,KAAK,CAAC,CAAC;QAEzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,eAAe,CAAC,KAAK;aACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;aACnF,IAAI,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,eAA2D;QAC7F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAa,2BAA2B;aACnD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACnC,KAAK,EAAE,CAAC;QAEX,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;YACzC,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC5D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,yBAAyB,EAAE,CAAC;YAClD,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAClE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAEO,mBAAmB,CAAC,SAAqB;QAC/C,MAAM,WAAW,GAAG;YAClB,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YACzC,SAAS,EAAE,eAAe,IAAI,IAAI;YAClC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI;SACjC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAErD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,8DAA8D,CAAC;QACxE,CAAC;QAED,OAAO,6BAA6B,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,UAA+C,EAAE;QAEjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACpE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACtE,MAAM,KAAK,GAAwB,EAAE,CAAC;QAEtC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,yBAAyB;gBAC7B,MAAM,EAAE,kBAAkB;gBAC1B,IAAI,EAAE;oBACJ,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,MAAM;iBACb;gBACD,MAAM,EAAE,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,2BAA2B;gBAC/B,MAAM,EAAE,kBAAkB;gBAC1B,IAAI,EAAE;oBACJ,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,MAAM;iBACb;gBACD,MAAM,EAAE,sFAAsF;aAC/F,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,eAAe;YACnB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC;aAC3D;YACD,MAAM,EAAE,0CAA0C;SACnD,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,OAAO;YACtB,KAAK;SACN,CAAC;IACJ,CAAC;CACF;AA1XD,oDA0XC"}