@evalops/maestro 0.10.50 → 0.10.51

package/dist/runtime/env.js

@@ -132,6 +132,31 @@ function resolveHomePath(value, raw) {
             : value;
     return resolve(expanded);
 }
+function homeFromEnv(raw) {
+    return trim(raw.HOME) ?? trim(raw.USERPROFILE) ?? homedir();
+}
+function resolveDataLocalDir(raw) {
+    const home = homeFromEnv(raw);
+    if (process.platform === "darwin") {
+        return join(home, "Library", "Application Support");
+    }
+    if (process.platform === "win32") {
+        return (resolveHomePath(trim(raw.LOCALAPPDATA), raw) ??
+            resolveHomePath(trim(raw.APPDATA), raw) ??
+            join(home, "AppData", "Local"));
+    }
+    return (resolveHomePath(trim(raw.XDG_DATA_HOME), raw) ??
+        join(home, ".local", "share"));
+}
+function resolveRuntimeDir(raw) {
+    if (process.platform === "darwin") {
+        return resolveDataLocalDir(raw);
+    }
+    const xdgRuntimeDir = resolveHomePath(trim(raw.XDG_RUNTIME_DIR), raw);
+    if (xdgRuntimeDir)
+        return xdgRuntimeDir;
+    return resolveDataLocalDir(raw);
+}
 /**
  * Build an immutable snapshot of the env vars this codebase cares about.
  *
@@ -149,6 +174,9 @@ export function createRuntimeEnv(raw) {
         disableKeychain: parseBoolean(trim(raw.MAESTRO_DISABLE_KEYCHAIN)),
         maestroHome: trim(raw.MAESTRO_HOME) ?? join(homedir(), ".maestro"),
         maestroAgentDir: trim(raw.MAESTRO_AGENT_DIR),
+        missionStoreDir: resolveHomePath(trim(raw.MAESTRO_MISSION_STORE_DIR), raw),
+        snapshotBlobDir: resolveHomePath(trim(raw.MAESTRO_SNAPSHOT_BLOB_DIR), raw),
+        skillTrustStrict: parseBoolean(trim(raw.MAESTRO_SKILL_TRUST_STRICT)),
         telemetryEnabled: parseOptionalBoolean(trim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY)),
         telemetryFlag: trim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY),
         beaconFile: resolveHomePath(trim(raw.MAESTRO_BEACON_FILE), raw),
@@ -175,9 +203,31 @@ export function createRuntimeEnv(raw) {
         meterBaseUrl: firstNonEmpty(raw, METER_BASE_URL_VARS),
         meterAccessToken: firstNonEmpty(raw, METER_ACCESS_TOKEN_VARS),
         meterOrganizationId: firstNonEmpty(raw, METER_ORG_ID_VARS),
+        ambientLearnerFile: resolveHomePath(trim(raw.MAESTRO_AMBIENT_LEARNER_FILE), raw),
+        ambientLearnerDefaultFile: join(resolveDataLocalDir(raw), "ambient-agent", "learner.json"),
+        ambientSocketFile: join(resolveRuntimeDir(raw), "ambient-agent.sock"),
     });
 }
 const processWithRuntimeEnvCache = process;
+function isTestProcess() {
+    return process.env.NODE_ENV === "test" || process.env.VITEST === "true";
+}
+function maybeReportEarlyRuntimeEnvAccess() {
+    if (processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__) {
+        return;
+    }
+    const message = "defaultRuntimeEnv() was read before loadAndFinalizeEnv() completed. " +
+        "Bootstrap entry points must finish dotenv loading and security scrubbing before runtime env snapshots are created.";
+    if (process.env.MAESTRO_RUNTIME_ENV_STRICT_BOOTSTRAP === "1") {
+        throw new Error(message);
+    }
+    if (isTestProcess() ||
+        processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__) {
+        return;
+    }
+    processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__ = true;
+    console.warn(`[maestro] ${message}`);
+}
 /**
  * Return the process-wide snapshot of `process.env`.
  *
@@ -192,12 +242,20 @@ const processWithRuntimeEnvCache = process;
  * the migration.
  */
 export function defaultRuntimeEnv() {
+    maybeReportEarlyRuntimeEnvAccess();
     if (!processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__) {
         processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__ =
             createRuntimeEnv(process.env);
     }
     return processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__;
 }
+export function markRuntimeEnvFinalized() {
+    processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__ = true;
+    Reflect.deleteProperty(processWithRuntimeEnvCache, "__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__");
+}
+export function isRuntimeEnvFinalized() {
+    return processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__ === true;
+}
 /**
  * Drop the cached default snapshot so the next `defaultRuntimeEnv()` call
  * re-reads `process.env`.
@@ -209,5 +267,9 @@ export function defaultRuntimeEnv() {
 export function resetDefaultRuntimeEnv() {
     Reflect.deleteProperty(processWithRuntimeEnvCache, "__MAESTRO_DEFAULT_RUNTIME_ENV__");
 }
-export const resetDefaultRuntimeEnvForTests = resetDefaultRuntimeEnv;
+export function resetDefaultRuntimeEnvForTests() {
+    resetDefaultRuntimeEnv();
+    Reflect.deleteProperty(processWithRuntimeEnvCache, "__MAESTRO_RUNTIME_ENV_FINALIZED__");
+    Reflect.deleteProperty(processWithRuntimeEnvCache, "__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__");
+}
 //# sourceMappingURL=env.js.map

package/dist/runtime/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/runtime/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsG1C,SAAS,IAAI,CAAC,KAAc;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CACrB,GAAsB,EACtB,KAAwB;IAExB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC3B,wBAAwB;IACxB,yBAAyB;IACzB,gBAAgB;IAChB,2BAA2B;CAClB,CAAC;AAEX,MAAM,yBAAyB,GAAG;IACjC,8BAA8B;IAC9B,eAAe;CACN,CAAC;AAEX,MAAM,mBAAmB,GAAG;IAC3B,oBAAoB;IACpB,2BAA2B;IAC3B,2BAA2B;IAC3B,0BAA0B;IAC1B,kBAAkB;CACT,CAAC;AAEX,MAAM,uBAAuB,GAAG;IAC/B,4BAA4B;IAC5B,GAAG,yBAAyB;CACnB,CAAC;AAEX,MAAM,iBAAiB,GAAG;IACzB,+BAA+B;IAC/B,GAAG,mBAAmB;CACb,CAAC;AAEX,SAAS,aAAa,CAAC,KAAoB;IAC1C,QAAQ,KAAK,EAAE,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO;YACX,OAAO,KAAK,CAAC;QACd;YACC,OAAO,MAAM,CAAC;IAChB,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB;IACzC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACxD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAoB;IACpD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAoB;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CACvB,KAAoB,EACpB,GAAsB;IAEtB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;IAClE,MAAM,QAAQ,GACb,KAAK,KAAK,GAAG;QACZ,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC,CAAC,KAAK,CAAC;IACX,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACpD,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACvD,eAAe,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAElE,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACrD,kBAAkB,EAAE,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC;QAEjE,eAAe,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACjE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC;QAClE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAE5C,gBAAgB,EAAE,oBAAoB,CACrC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAC7D;QACD,aAAa,EACZ,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC9D,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC;QAC/D,cAAc,EAAE,aAAa,CAAC,GAAG,EAAE;YAClC,yBAAyB;YACzB,4BAA4B;YAC5B,+BAA+B;SAC/B,CAAC;QACF,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC9C,eAAe,EAAE,wBAAwB,CACxC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CACnC;QACD,mBAAmB,EAAE,uBAAuB,CAC3C,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CACtC;QACD,0BAA0B,EAAE,IAAI,CAC/B,GAAG,CAAC,sCAAsC,CAC1C;QAED,WAAW,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACpD,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAE3C,YAAY,EACX,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC;YACtD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC;QAC1D,gBAAgB,EAAE,aAAa,CAAC,GAAG,EAAE;YACpC,4BAA4B;YAC5B,+BAA+B;SAC/B,CAAC;QAEF,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACrD,gBAAgB,EAAE,aAAa,CAAC,GAAG,EAAE,uBAAuB,CAAC;QAC7D,mBAAmB,EAAE,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC;KAC1D,CAAC,CAAC;AACJ,CAAC;AAMD,MAAM,0BAA0B,GAAG,OAAqC,CAAC;AAEzE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB;IAChC,IAAI,CAAC,0BAA0B,CAAC,+BAA+B,EAAE,CAAC;QACjE,0BAA0B,CAAC,+BAA+B;YACzD,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,0BAA0B,CAAC,+BAA+B,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACrC,OAAO,CAAC,cAAc,CACrB,0BAA0B,EAC1B,iCAAiC,CACjC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,sBAAsB,CAAC","sourcesContent":["/**\n * Runtime environment substrate.\n *\n * # Why this exists\n *\n * Ambient `process.env` reads scattered through library code are the root\n * cause of an entire class of flakes:\n *\n *  - Logger config frozen at setup-file import time (PR #2768/#2769).\n *  - Meter test passing on runner-2, failing on runner-1 because the CI\n *    runner's env had `EVALOPS_ORG_ID` set (PR #2763).\n *  - CLI integration test `prints providers summary for filter` flaking\n *    intermittently because OAuth keychain mode was captured by the first\n *    test in a vitest worker (PRs #2752, #2761, #2762, #2766).\n *  - CLI aggregator's `setInterval` outliving the test that started it,\n *    later reading the *next* test's env-driven buffer path (PR #2772).\n *\n * Every one of those was the same shape: shared mutable state with no\n * causal ordering between writers and readers and no owner.\n *\n * The substrate fix is to make environment a *parameter*, not a *global*.\n * Library code receives a `RuntimeEnv`. Tests construct one with a literal.\n * The single place that reads `process.env` is `createRuntimeEnv` —\n * everything else passes the typed result around.\n *\n * # Migration strategy\n *\n * `defaultRuntimeEnv()` is a one-call-per-process snapshot of\n * `process.env`. Code not yet migrated can pick it up incrementally. The\n * `scripts/check-env-reads.mjs` baseline prevents *new* direct reads from\n * `process.env` in `src/` without going through `RuntimeEnv` first.\n *\n * # What's typed here\n *\n * The fields below are the env vars that have produced production flakes,\n * security gaps, or cross-test pollution in the last quarter. Untyped\n * vars stay as ambient `process.env` reads for now — the scanner just\n * prevents new ones being added — and graduate into this type as their\n * consumers are migrated.\n */\n\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\n\nexport type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\nexport interface RuntimeEnv {\n\t// --- Logger ---\n\treadonly logLevel: LogLevel;\n\treadonly logJsonFormat: boolean;\n\treadonly logSplitStreams: boolean;\n\n\t// --- EvalOps identity (the flake surface PR #2763 closed) ---\n\t/**\n\t * Organization id resolved across the documented alias list.\n\t * Source vars (first non-empty wins):\n\t *  - MAESTRO_EVALOPS_ORG_ID\n\t *  - EVALOPS_ORGANIZATION_ID\n\t *  - EVALOPS_ORG_ID\n\t *  - MAESTRO_ENTERPRISE_ORG_ID\n\t */\n\treadonly evalopsOrgId: string | null;\n\t/**\n\t * Access token resolved across the documented alias list.\n\t * Source vars: MAESTRO_EVALOPS_ACCESS_TOKEN, EVALOPS_TOKEN.\n\t */\n\treadonly evalopsAccessToken: string | null;\n\n\t// --- OAuth storage isolation (PRs #2752/#2761/#2762/#2766) ---\n\treadonly disableKeychain: boolean;\n\treadonly maestroHome: string;\n\treadonly maestroAgentDir: string | null;\n\n\t// --- CLI command aggregator / telemetry (PR #2772 timer leak) ---\n\t/**\n\t * Tri-state parsed signal: true (opt-in), false (opt-out), null (no\n\t * signal). For diagnostics that need the raw user string, see\n\t * `telemetryFlag` below.\n\t */\n\treadonly telemetryEnabled: boolean | null;\n\t/**\n\t * Raw `MAESTRO_TELEMETRY` (or `PLAYWRIGHT_TELEMETRY` fallback) string,\n\t * trimmed. Preserved separately from `telemetryEnabled` so diagnostic\n\t * surfaces (e.g. `getTelemetryStatus().flagValue`) can show the literal\n\t * user setting.\n\t */\n\treadonly telemetryFlag: string | null;\n\treadonly beaconFile: string | null;\n\treadonly beaconEndpoint: string | null;\n\treadonly beaconApiKey: string | null;\n\t/**\n\t * Beacon request timeout in ms. `null` means use the consumer's default.\n\t */\n\treadonly beaconTimeoutMs: number | null;\n\t/**\n\t * Telemetry sampling probability in `[0, 1]`. `null` means full sampling.\n\t */\n\treadonly telemetrySampleRate: number | null;\n\treadonly cliCommandBeaconBufferFile: string | null;\n\n\t// --- OpenTelemetry SDK boot (`src/opentelemetry.ts`) ---\n\t/**\n\t * Tri-state for `MAESTRO_OTEL`. `null` means no explicit signal —\n\t * the OTel boot logic infers enablement from the presence of an\n\t * exporter endpoint.\n\t */\n\treadonly otelEnabled: boolean | null;\n\t/**\n\t * Raw `MAESTRO_OTEL` string preserved for `getOpenTelemetryStatus`\n\t * reason-string diagnostics that distinguish \"MAESTRO_OTEL=1\" from\n\t * \"MAESTRO_OTEL=0\" in the human-readable reason.\n\t */\n\treadonly otelFlag: string | null;\n\treadonly otelServiceName: string | null;\n\treadonly otelSampler: string | null;\n\n\t// --- OpenTelemetry exporter (`src/telemetry.ts`) ---\n\t/**\n\t * Where the OTel exporter dumps a local log of telemetry events.\n\t * Source vars (first non-empty wins, tilde-expanded):\n\t *  - MAESTRO_TELEMETRY_FILE\n\t *  - PLAYWRIGHT_TELEMETRY_FILE\n\t *\n\t * This is separate from `beaconFile` (`MAESTRO_BEACON_FILE`) — the\n\t * OTel exporter writes structured events, the beacon writes one JSON\n\t * line per event. Users that set only one of the two expect the other\n\t * to remain off.\n\t */\n\treadonly exporterFile: string | null;\n\t/**\n\t * HTTP endpoint for the OTel exporter. Distinct from `beaconEndpoint`\n\t * because `MAESTRO_BEACON_ENDPOINT` is a beacon-specific override that\n\t * shouldn't redirect the OTel exporter.\n\t *  - MAESTRO_TELEMETRY_ENDPOINT\n\t *  - PLAYWRIGHT_TELEMETRY_ENDPOINT\n\t */\n\treadonly exporterEndpoint: string | null;\n\n\t// --- Meter remote-mirror gate (PR #2763 failure) ---\n\treadonly meterBaseUrl: string | null;\n\treadonly meterAccessToken: string | null;\n\treadonly meterOrganizationId: string | null;\n}\n\nfunction trim(value: unknown): string | null {\n\tif (typeof value !== \"string\") return null;\n\tconst t = value.trim();\n\treturn t.length > 0 ? t : null;\n}\n\nfunction firstNonEmpty(\n\traw: NodeJS.ProcessEnv,\n\tnames: readonly string[],\n): string | null {\n\tfor (const name of names) {\n\t\tconst v = trim(raw[name]);\n\t\tif (v) return v;\n\t}\n\treturn null;\n}\n\nconst EVALOPS_ORG_ID_VARS = [\n\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\"EVALOPS_ORGANIZATION_ID\",\n\t\"EVALOPS_ORG_ID\",\n\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n] as const;\n\nconst EVALOPS_ACCESS_TOKEN_VARS = [\n\t\"MAESTRO_EVALOPS_ACCESS_TOKEN\",\n\t\"EVALOPS_TOKEN\",\n] as const;\n\nconst METER_BASE_URL_VARS = [\n\t\"MAESTRO_METER_BASE\",\n\t\"MAESTRO_METER_SERVICE_URL\",\n\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\"EVALOPS_BASE_URL\",\n] as const;\n\nconst METER_ACCESS_TOKEN_VARS = [\n\t\"MAESTRO_METER_ACCESS_TOKEN\",\n\t...EVALOPS_ACCESS_TOKEN_VARS,\n] as const;\n\nconst METER_ORG_ID_VARS = [\n\t\"MAESTRO_METER_ORGANIZATION_ID\",\n\t...EVALOPS_ORG_ID_VARS,\n] as const;\n\nfunction parseLogLevel(value: string | null): LogLevel {\n\tswitch (value) {\n\t\tcase \"debug\":\n\t\tcase \"info\":\n\t\tcase \"warn\":\n\t\tcase \"error\":\n\t\t\treturn value;\n\t\tdefault:\n\t\t\treturn \"info\";\n\t}\n}\n\nfunction parseBoolean(value: string | null): boolean {\n\treturn value === \"1\" || value === \"true\";\n}\n\nexport function parseOptionalBoolean(value: string | null): boolean | null {\n\tif (value === null) return null;\n\tconst normalized = value.toLowerCase();\n\tif (normalized === \"0\" || normalized === \"false\") return false;\n\tif (normalized === \"1\" || normalized === \"true\") return true;\n\treturn null;\n}\n\nfunction parseOptionalSampleRate(value: string | null): number | null {\n\tif (value === null) return null;\n\tconst parsed = Number.parseFloat(value);\n\tif (!Number.isFinite(parsed)) return null;\n\treturn Math.min(Math.max(parsed, 0), 1);\n}\n\nfunction parseOptionalPositiveInt(value: string | null): number | null {\n\tif (value === null) return null;\n\tconst parsed = Number.parseInt(value, 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : null;\n}\n\nfunction resolveHomePath(\n\tvalue: string | null,\n\traw: NodeJS.ProcessEnv,\n): string | null {\n\tif (value === null) return null;\n\t// Match the legacy `resolveEnvPath` chain: honor an overridden HOME\n\t// (or USERPROFILE on Windows) before falling back to `homedir()`. This\n\t// keeps tests and tools that pin HOME to a temp dir working as they did\n\t// when this read went through `src/utils/path-expansion.ts`.\n\tconst home = trim(raw.HOME) ?? trim(raw.USERPROFILE) ?? homedir();\n\tconst expanded =\n\t\tvalue === \"~\"\n\t\t\t? home\n\t\t\t: value.startsWith(\"~/\") || value.startsWith(\"~\\\\\")\n\t\t\t\t? join(home, value.slice(2))\n\t\t\t\t: value;\n\treturn resolve(expanded);\n}\n\n/**\n * Build an immutable snapshot of the env vars this codebase cares about.\n *\n * Pure function: same input → same output. Call it once at process\n * startup (or in tests, with a literal) and thread the result through the\n * program. Do not call it on every operation — that defeats the purpose.\n */\nexport function createRuntimeEnv(raw: NodeJS.ProcessEnv): RuntimeEnv {\n\treturn Object.freeze({\n\t\tlogLevel: parseLogLevel(trim(raw.MAESTRO_LOG_LEVEL)),\n\t\tlogJsonFormat: parseBoolean(trim(raw.MAESTRO_LOG_JSON)),\n\t\tlogSplitStreams: parseBoolean(trim(raw.MAESTRO_LOG_SPLIT_STREAMS)),\n\n\t\tevalopsOrgId: firstNonEmpty(raw, EVALOPS_ORG_ID_VARS),\n\t\tevalopsAccessToken: firstNonEmpty(raw, EVALOPS_ACCESS_TOKEN_VARS),\n\n\t\tdisableKeychain: parseBoolean(trim(raw.MAESTRO_DISABLE_KEYCHAIN)),\n\t\tmaestroHome: trim(raw.MAESTRO_HOME) ?? join(homedir(), \".maestro\"),\n\t\tmaestroAgentDir: trim(raw.MAESTRO_AGENT_DIR),\n\n\t\ttelemetryEnabled: parseOptionalBoolean(\n\t\t\ttrim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY),\n\t\t),\n\t\ttelemetryFlag:\n\t\t\ttrim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY),\n\t\tbeaconFile: resolveHomePath(trim(raw.MAESTRO_BEACON_FILE), raw),\n\t\tbeaconEndpoint: firstNonEmpty(raw, [\n\t\t\t\"MAESTRO_BEACON_ENDPOINT\",\n\t\t\t\"MAESTRO_TELEMETRY_ENDPOINT\",\n\t\t\t\"PLAYWRIGHT_TELEMETRY_ENDPOINT\",\n\t\t]),\n\t\tbeaconApiKey: trim(raw.MAESTRO_BEACON_API_KEY),\n\t\tbeaconTimeoutMs: parseOptionalPositiveInt(\n\t\t\ttrim(raw.MAESTRO_BEACON_TIMEOUT_MS),\n\t\t),\n\t\ttelemetrySampleRate: parseOptionalSampleRate(\n\t\t\ttrim(raw.MAESTRO_TELEMETRY_SAMPLE) ??\n\t\t\t\ttrim(raw.PLAYWRIGHT_TELEMETRY_SAMPLE),\n\t\t),\n\t\tcliCommandBeaconBufferFile: trim(\n\t\t\traw.MAESTRO_CLI_COMMAND_BEACON_BUFFER_FILE,\n\t\t),\n\n\t\totelEnabled: parseOptionalBoolean(trim(raw.MAESTRO_OTEL)),\n\t\totelFlag: trim(raw.MAESTRO_OTEL),\n\t\totelServiceName: trim(raw.MAESTRO_OTEL_SERVICE_NAME),\n\t\totelSampler: trim(raw.MAESTRO_OTEL_SAMPLER),\n\n\t\texporterFile:\n\t\t\tresolveHomePath(trim(raw.MAESTRO_TELEMETRY_FILE), raw) ??\n\t\t\tresolveHomePath(trim(raw.PLAYWRIGHT_TELEMETRY_FILE), raw),\n\t\texporterEndpoint: firstNonEmpty(raw, [\n\t\t\t\"MAESTRO_TELEMETRY_ENDPOINT\",\n\t\t\t\"PLAYWRIGHT_TELEMETRY_ENDPOINT\",\n\t\t]),\n\n\t\tmeterBaseUrl: firstNonEmpty(raw, METER_BASE_URL_VARS),\n\t\tmeterAccessToken: firstNonEmpty(raw, METER_ACCESS_TOKEN_VARS),\n\t\tmeterOrganizationId: firstNonEmpty(raw, METER_ORG_ID_VARS),\n\t});\n}\n\ntype ProcessWithRuntimeEnvCache = typeof process & {\n\t__MAESTRO_DEFAULT_RUNTIME_ENV__?: RuntimeEnv;\n};\n\nconst processWithRuntimeEnvCache = process as ProcessWithRuntimeEnvCache;\n\n/**\n * Return the process-wide snapshot of `process.env`.\n *\n * Builds the snapshot lazily on first call so the timing of module load\n * doesn't matter — by the time anything calls this, env has finished\n * settling (CLI argv parsed, dotenv loaded, vitest setup files run). The\n * returned object is frozen and shared.\n *\n * Library code that's been migrated to the substrate should *not* call\n * this directly; it should accept a `RuntimeEnv` parameter. This export\n * exists as the bootstrap entry point and as a compatibility shim during\n * the migration.\n */\nexport function defaultRuntimeEnv(): RuntimeEnv {\n\tif (!processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__) {\n\t\tprocessWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__ =\n\t\t\tcreateRuntimeEnv(process.env);\n\t}\n\treturn processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__;\n}\n\n/**\n * Drop the cached default snapshot so the next `defaultRuntimeEnv()` call\n * re-reads `process.env`.\n *\n * Prefer constructing a `RuntimeEnv` with `createRuntimeEnv` and injecting it.\n * This reset is reserved for process bootstrap paths that intentionally mutate\n * `process.env` before handing control to migrated modules.\n */\nexport function resetDefaultRuntimeEnv(): void {\n\tReflect.deleteProperty(\n\t\tprocessWithRuntimeEnvCache,\n\t\t\"__MAESTRO_DEFAULT_RUNTIME_ENV__\",\n\t);\n}\n\nexport const resetDefaultRuntimeEnvForTests = resetDefaultRuntimeEnv;\n"]}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/runtime/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8G1C,SAAS,IAAI,CAAC,KAAc;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CACrB,GAAsB,EACtB,KAAwB;IAExB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC3B,wBAAwB;IACxB,yBAAyB;IACzB,gBAAgB;IAChB,2BAA2B;CAClB,CAAC;AAEX,MAAM,yBAAyB,GAAG;IACjC,8BAA8B;IAC9B,eAAe;CACN,CAAC;AAEX,MAAM,mBAAmB,GAAG;IAC3B,oBAAoB;IACpB,2BAA2B;IAC3B,2BAA2B;IAC3B,0BAA0B;IAC1B,kBAAkB;CACT,CAAC;AAEX,MAAM,uBAAuB,GAAG;IAC/B,4BAA4B;IAC5B,GAAG,yBAAyB;CACnB,CAAC;AAEX,MAAM,iBAAiB,GAAG;IACzB,+BAA+B;IAC/B,GAAG,mBAAmB;CACb,CAAC;AAEX,SAAS,aAAa,CAAC,KAAoB;IAC1C,QAAQ,KAAK,EAAE,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO;YACX,OAAO,KAAK,CAAC;QACd;YACC,OAAO,MAAM,CAAC;IAChB,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB;IACzC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACxD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAoB;IACpD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAoB;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CACvB,KAAoB,EACpB,GAAsB;IAEtB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;IAClE,MAAM,QAAQ,GACb,KAAK,KAAK,GAAG;QACZ,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC,CAAC,KAAK,CAAC;IACX,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,GAAsB;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAsB;IAClD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,CACN,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC;YAC5C,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAC9B,CAAC;IACH,CAAC;IACD,OAAO,CACN,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAC7B,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAsB;IAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACpD,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACvD,eAAe,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAElE,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACrD,kBAAkB,EAAE,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC;QAEjE,eAAe,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACjE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC;QAClE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC;QAC1E,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC;QAC1E,gBAAgB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAEpE,gBAAgB,EAAE,oBAAoB,CACrC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAC7D;QACD,aAAa,EACZ,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC9D,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC;QAC/D,cAAc,EAAE,aAAa,CAAC,GAAG,EAAE;YAClC,yBAAyB;YACzB,4BAA4B;YAC5B,+BAA+B;SAC/B,CAAC;QACF,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC9C,eAAe,EAAE,wBAAwB,CACxC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CACnC;QACD,mBAAmB,EAAE,uBAAuB,CAC3C,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CACtC;QACD,0BAA0B,EAAE,IAAI,CAC/B,GAAG,CAAC,sCAAsC,CAC1C;QAED,WAAW,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACpD,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAE3C,YAAY,EACX,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC;YACtD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC;QAC1D,gBAAgB,EAAE,aAAa,CAAC,GAAG,EAAE;YACpC,4BAA4B;YAC5B,+BAA+B;SAC/B,CAAC;QAEF,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACrD,gBAAgB,EAAE,aAAa,CAAC,GAAG,EAAE,uBAAuB,CAAC;QAC7D,mBAAmB,EAAE,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC;QAC1D,kBAAkB,EAAE,eAAe,CAClC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,EACtC,GAAG,CACH;QACD,yBAAyB,EAAE,IAAI,CAC9B,mBAAmB,CAAC,GAAG,CAAC,EACxB,eAAe,EACf,cAAc,CACd;QACD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAC;KACrE,CAAC,CAAC;AACJ,CAAC;AAQD,MAAM,0BAA0B,GAAG,OAAqC,CAAC;AAEzE,SAAS,aAAa;IACrB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;AACzE,CAAC;AAED,SAAS,gCAAgC;IACxC,IAAI,0BAA0B,CAAC,iCAAiC,EAAE,CAAC;QAClE,OAAO;IACR,CAAC;IACD,MAAM,OAAO,GACZ,sEAAsE;QACtE,oHAAoH,CAAC;IACtH,IAAI,OAAO,CAAC,GAAG,CAAC,oCAAoC,KAAK,GAAG,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,IACC,aAAa,EAAE;QACf,0BAA0B,CAAC,2CAA2C,EACrE,CAAC;QACF,OAAO;IACR,CAAC;IACD,0BAA0B,CAAC,2CAA2C,GAAG,IAAI,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB;IAChC,gCAAgC,EAAE,CAAC;IACnC,IAAI,CAAC,0BAA0B,CAAC,+BAA+B,EAAE,CAAC;QACjE,0BAA0B,CAAC,+BAA+B;YACzD,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,0BAA0B,CAAC,+BAA+B,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,uBAAuB;IACtC,0BAA0B,CAAC,iCAAiC,GAAG,IAAI,CAAC;IACpE,OAAO,CAAC,cAAc,CACrB,0BAA0B,EAC1B,6CAA6C,CAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,OAAO,0BAA0B,CAAC,iCAAiC,KAAK,IAAI,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACrC,OAAO,CAAC,cAAc,CACrB,0BAA0B,EAC1B,iCAAiC,CACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC7C,sBAAsB,EAAE,CAAC;IACzB,OAAO,CAAC,cAAc,CACrB,0BAA0B,EAC1B,mCAAmC,CACnC,CAAC;IACF,OAAO,CAAC,cAAc,CACrB,0BAA0B,EAC1B,6CAA6C,CAC7C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Runtime environment substrate.\n *\n * # Why this exists\n *\n * Ambient `process.env` reads scattered through library code are the root\n * cause of an entire class of flakes:\n *\n *  - Logger config frozen at setup-file import time (PR #2768/#2769).\n *  - Meter test passing on runner-2, failing on runner-1 because the CI\n *    runner's env had `EVALOPS_ORG_ID` set (PR #2763).\n *  - CLI integration test `prints providers summary for filter` flaking\n *    intermittently because OAuth keychain mode was captured by the first\n *    test in a vitest worker (PRs #2752, #2761, #2762, #2766).\n *  - CLI aggregator's `setInterval` outliving the test that started it,\n *    later reading the *next* test's env-driven buffer path (PR #2772).\n *\n * Every one of those was the same shape: shared mutable state with no\n * causal ordering between writers and readers and no owner.\n *\n * The substrate fix is to make environment a *parameter*, not a *global*.\n * Library code receives a `RuntimeEnv`. Tests construct one with a literal.\n * The single place that reads `process.env` is `createRuntimeEnv` —\n * everything else passes the typed result around.\n *\n * # Migration strategy\n *\n * `defaultRuntimeEnv()` is a one-call-per-process snapshot of\n * `process.env`. Code not yet migrated can pick it up incrementally. The\n * `scripts/check-env-reads.mjs` baseline prevents *new* direct reads from\n * `process.env` in `src/` without going through `RuntimeEnv` first.\n *\n * # What's typed here\n *\n * The fields below are the env vars that have produced production flakes,\n * security gaps, or cross-test pollution in the last quarter. Untyped\n * vars stay as ambient `process.env` reads for now — the scanner just\n * prevents new ones being added — and graduate into this type as their\n * consumers are migrated.\n */\n\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\n\nexport type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\nexport interface RuntimeEnv {\n\t// --- Logger ---\n\treadonly logLevel: LogLevel;\n\treadonly logJsonFormat: boolean;\n\treadonly logSplitStreams: boolean;\n\n\t// --- EvalOps identity (the flake surface PR #2763 closed) ---\n\t/**\n\t * Organization id resolved across the documented alias list.\n\t * Source vars (first non-empty wins):\n\t *  - MAESTRO_EVALOPS_ORG_ID\n\t *  - EVALOPS_ORGANIZATION_ID\n\t *  - EVALOPS_ORG_ID\n\t *  - MAESTRO_ENTERPRISE_ORG_ID\n\t */\n\treadonly evalopsOrgId: string | null;\n\t/**\n\t * Access token resolved across the documented alias list.\n\t * Source vars: MAESTRO_EVALOPS_ACCESS_TOKEN, EVALOPS_TOKEN.\n\t */\n\treadonly evalopsAccessToken: string | null;\n\n\t// --- OAuth storage isolation (PRs #2752/#2761/#2762/#2766) ---\n\treadonly disableKeychain: boolean;\n\treadonly maestroHome: string;\n\treadonly maestroAgentDir: string | null;\n\treadonly missionStoreDir: string | null;\n\treadonly snapshotBlobDir: string | null;\n\treadonly skillTrustStrict: boolean;\n\n\t// --- CLI command aggregator / telemetry (PR #2772 timer leak) ---\n\t/**\n\t * Tri-state parsed signal: true (opt-in), false (opt-out), null (no\n\t * signal). For diagnostics that need the raw user string, see\n\t * `telemetryFlag` below.\n\t */\n\treadonly telemetryEnabled: boolean | null;\n\t/**\n\t * Raw `MAESTRO_TELEMETRY` (or `PLAYWRIGHT_TELEMETRY` fallback) string,\n\t * trimmed. Preserved separately from `telemetryEnabled` so diagnostic\n\t * surfaces (e.g. `getTelemetryStatus().flagValue`) can show the literal\n\t * user setting.\n\t */\n\treadonly telemetryFlag: string | null;\n\treadonly beaconFile: string | null;\n\treadonly beaconEndpoint: string | null;\n\treadonly beaconApiKey: string | null;\n\t/**\n\t * Beacon request timeout in ms. `null` means use the consumer's default.\n\t */\n\treadonly beaconTimeoutMs: number | null;\n\t/**\n\t * Telemetry sampling probability in `[0, 1]`. `null` means full sampling.\n\t */\n\treadonly telemetrySampleRate: number | null;\n\treadonly cliCommandBeaconBufferFile: string | null;\n\n\t// --- OpenTelemetry SDK boot (`src/opentelemetry.ts`) ---\n\t/**\n\t * Tri-state for `MAESTRO_OTEL`. `null` means no explicit signal —\n\t * the OTel boot logic infers enablement from the presence of an\n\t * exporter endpoint.\n\t */\n\treadonly otelEnabled: boolean | null;\n\t/**\n\t * Raw `MAESTRO_OTEL` string preserved for `getOpenTelemetryStatus`\n\t * reason-string diagnostics that distinguish \"MAESTRO_OTEL=1\" from\n\t * \"MAESTRO_OTEL=0\" in the human-readable reason.\n\t */\n\treadonly otelFlag: string | null;\n\treadonly otelServiceName: string | null;\n\treadonly otelSampler: string | null;\n\n\t// --- OpenTelemetry exporter (`src/telemetry.ts`) ---\n\t/**\n\t * Where the OTel exporter dumps a local log of telemetry events.\n\t * Source vars (first non-empty wins, tilde-expanded):\n\t *  - MAESTRO_TELEMETRY_FILE\n\t *  - PLAYWRIGHT_TELEMETRY_FILE\n\t *\n\t * This is separate from `beaconFile` (`MAESTRO_BEACON_FILE`) — the\n\t * OTel exporter writes structured events, the beacon writes one JSON\n\t * line per event. Users that set only one of the two expect the other\n\t * to remain off.\n\t */\n\treadonly exporterFile: string | null;\n\t/**\n\t * HTTP endpoint for the OTel exporter. Distinct from `beaconEndpoint`\n\t * because `MAESTRO_BEACON_ENDPOINT` is a beacon-specific override that\n\t * shouldn't redirect the OTel exporter.\n\t *  - MAESTRO_TELEMETRY_ENDPOINT\n\t *  - PLAYWRIGHT_TELEMETRY_ENDPOINT\n\t */\n\treadonly exporterEndpoint: string | null;\n\n\t// --- Meter remote-mirror gate (PR #2763 failure) ---\n\treadonly meterBaseUrl: string | null;\n\treadonly meterAccessToken: string | null;\n\treadonly meterOrganizationId: string | null;\n\n\t// --- Ambient agent evidence ---\n\treadonly ambientLearnerFile: string | null;\n\treadonly ambientLearnerDefaultFile: string;\n\treadonly ambientSocketFile: string;\n}\n\nfunction trim(value: unknown): string | null {\n\tif (typeof value !== \"string\") return null;\n\tconst t = value.trim();\n\treturn t.length > 0 ? t : null;\n}\n\nfunction firstNonEmpty(\n\traw: NodeJS.ProcessEnv,\n\tnames: readonly string[],\n): string | null {\n\tfor (const name of names) {\n\t\tconst v = trim(raw[name]);\n\t\tif (v) return v;\n\t}\n\treturn null;\n}\n\nconst EVALOPS_ORG_ID_VARS = [\n\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\"EVALOPS_ORGANIZATION_ID\",\n\t\"EVALOPS_ORG_ID\",\n\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n] as const;\n\nconst EVALOPS_ACCESS_TOKEN_VARS = [\n\t\"MAESTRO_EVALOPS_ACCESS_TOKEN\",\n\t\"EVALOPS_TOKEN\",\n] as const;\n\nconst METER_BASE_URL_VARS = [\n\t\"MAESTRO_METER_BASE\",\n\t\"MAESTRO_METER_SERVICE_URL\",\n\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\"EVALOPS_BASE_URL\",\n] as const;\n\nconst METER_ACCESS_TOKEN_VARS = [\n\t\"MAESTRO_METER_ACCESS_TOKEN\",\n\t...EVALOPS_ACCESS_TOKEN_VARS,\n] as const;\n\nconst METER_ORG_ID_VARS = [\n\t\"MAESTRO_METER_ORGANIZATION_ID\",\n\t...EVALOPS_ORG_ID_VARS,\n] as const;\n\nfunction parseLogLevel(value: string | null): LogLevel {\n\tswitch (value) {\n\t\tcase \"debug\":\n\t\tcase \"info\":\n\t\tcase \"warn\":\n\t\tcase \"error\":\n\t\t\treturn value;\n\t\tdefault:\n\t\t\treturn \"info\";\n\t}\n}\n\nfunction parseBoolean(value: string | null): boolean {\n\treturn value === \"1\" || value === \"true\";\n}\n\nexport function parseOptionalBoolean(value: string | null): boolean | null {\n\tif (value === null) return null;\n\tconst normalized = value.toLowerCase();\n\tif (normalized === \"0\" || normalized === \"false\") return false;\n\tif (normalized === \"1\" || normalized === \"true\") return true;\n\treturn null;\n}\n\nfunction parseOptionalSampleRate(value: string | null): number | null {\n\tif (value === null) return null;\n\tconst parsed = Number.parseFloat(value);\n\tif (!Number.isFinite(parsed)) return null;\n\treturn Math.min(Math.max(parsed, 0), 1);\n}\n\nfunction parseOptionalPositiveInt(value: string | null): number | null {\n\tif (value === null) return null;\n\tconst parsed = Number.parseInt(value, 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : null;\n}\n\nfunction resolveHomePath(\n\tvalue: string | null,\n\traw: NodeJS.ProcessEnv,\n): string | null {\n\tif (value === null) return null;\n\t// Match the legacy `resolveEnvPath` chain: honor an overridden HOME\n\t// (or USERPROFILE on Windows) before falling back to `homedir()`. This\n\t// keeps tests and tools that pin HOME to a temp dir working as they did\n\t// when this read went through `src/utils/path-expansion.ts`.\n\tconst home = trim(raw.HOME) ?? trim(raw.USERPROFILE) ?? homedir();\n\tconst expanded =\n\t\tvalue === \"~\"\n\t\t\t? home\n\t\t\t: value.startsWith(\"~/\") || value.startsWith(\"~\\\\\")\n\t\t\t\t? join(home, value.slice(2))\n\t\t\t\t: value;\n\treturn resolve(expanded);\n}\n\nfunction homeFromEnv(raw: NodeJS.ProcessEnv): string {\n\treturn trim(raw.HOME) ?? trim(raw.USERPROFILE) ?? homedir();\n}\n\nfunction resolveDataLocalDir(raw: NodeJS.ProcessEnv): string {\n\tconst home = homeFromEnv(raw);\n\tif (process.platform === \"darwin\") {\n\t\treturn join(home, \"Library\", \"Application Support\");\n\t}\n\tif (process.platform === \"win32\") {\n\t\treturn (\n\t\t\tresolveHomePath(trim(raw.LOCALAPPDATA), raw) ??\n\t\t\tresolveHomePath(trim(raw.APPDATA), raw) ??\n\t\t\tjoin(home, \"AppData\", \"Local\")\n\t\t);\n\t}\n\treturn (\n\t\tresolveHomePath(trim(raw.XDG_DATA_HOME), raw) ??\n\t\tjoin(home, \".local\", \"share\")\n\t);\n}\n\nfunction resolveRuntimeDir(raw: NodeJS.ProcessEnv): string {\n\tif (process.platform === \"darwin\") {\n\t\treturn resolveDataLocalDir(raw);\n\t}\n\tconst xdgRuntimeDir = resolveHomePath(trim(raw.XDG_RUNTIME_DIR), raw);\n\tif (xdgRuntimeDir) return xdgRuntimeDir;\n\treturn resolveDataLocalDir(raw);\n}\n\n/**\n * Build an immutable snapshot of the env vars this codebase cares about.\n *\n * Pure function: same input → same output. Call it once at process\n * startup (or in tests, with a literal) and thread the result through the\n * program. Do not call it on every operation — that defeats the purpose.\n */\nexport function createRuntimeEnv(raw: NodeJS.ProcessEnv): RuntimeEnv {\n\treturn Object.freeze({\n\t\tlogLevel: parseLogLevel(trim(raw.MAESTRO_LOG_LEVEL)),\n\t\tlogJsonFormat: parseBoolean(trim(raw.MAESTRO_LOG_JSON)),\n\t\tlogSplitStreams: parseBoolean(trim(raw.MAESTRO_LOG_SPLIT_STREAMS)),\n\n\t\tevalopsOrgId: firstNonEmpty(raw, EVALOPS_ORG_ID_VARS),\n\t\tevalopsAccessToken: firstNonEmpty(raw, EVALOPS_ACCESS_TOKEN_VARS),\n\n\t\tdisableKeychain: parseBoolean(trim(raw.MAESTRO_DISABLE_KEYCHAIN)),\n\t\tmaestroHome: trim(raw.MAESTRO_HOME) ?? join(homedir(), \".maestro\"),\n\t\tmaestroAgentDir: trim(raw.MAESTRO_AGENT_DIR),\n\t\tmissionStoreDir: resolveHomePath(trim(raw.MAESTRO_MISSION_STORE_DIR), raw),\n\t\tsnapshotBlobDir: resolveHomePath(trim(raw.MAESTRO_SNAPSHOT_BLOB_DIR), raw),\n\t\tskillTrustStrict: parseBoolean(trim(raw.MAESTRO_SKILL_TRUST_STRICT)),\n\n\t\ttelemetryEnabled: parseOptionalBoolean(\n\t\t\ttrim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY),\n\t\t),\n\t\ttelemetryFlag:\n\t\t\ttrim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY),\n\t\tbeaconFile: resolveHomePath(trim(raw.MAESTRO_BEACON_FILE), raw),\n\t\tbeaconEndpoint: firstNonEmpty(raw, [\n\t\t\t\"MAESTRO_BEACON_ENDPOINT\",\n\t\t\t\"MAESTRO_TELEMETRY_ENDPOINT\",\n\t\t\t\"PLAYWRIGHT_TELEMETRY_ENDPOINT\",\n\t\t]),\n\t\tbeaconApiKey: trim(raw.MAESTRO_BEACON_API_KEY),\n\t\tbeaconTimeoutMs: parseOptionalPositiveInt(\n\t\t\ttrim(raw.MAESTRO_BEACON_TIMEOUT_MS),\n\t\t),\n\t\ttelemetrySampleRate: parseOptionalSampleRate(\n\t\t\ttrim(raw.MAESTRO_TELEMETRY_SAMPLE) ??\n\t\t\t\ttrim(raw.PLAYWRIGHT_TELEMETRY_SAMPLE),\n\t\t),\n\t\tcliCommandBeaconBufferFile: trim(\n\t\t\traw.MAESTRO_CLI_COMMAND_BEACON_BUFFER_FILE,\n\t\t),\n\n\t\totelEnabled: parseOptionalBoolean(trim(raw.MAESTRO_OTEL)),\n\t\totelFlag: trim(raw.MAESTRO_OTEL),\n\t\totelServiceName: trim(raw.MAESTRO_OTEL_SERVICE_NAME),\n\t\totelSampler: trim(raw.MAESTRO_OTEL_SAMPLER),\n\n\t\texporterFile:\n\t\t\tresolveHomePath(trim(raw.MAESTRO_TELEMETRY_FILE), raw) ??\n\t\t\tresolveHomePath(trim(raw.PLAYWRIGHT_TELEMETRY_FILE), raw),\n\t\texporterEndpoint: firstNonEmpty(raw, [\n\t\t\t\"MAESTRO_TELEMETRY_ENDPOINT\",\n\t\t\t\"PLAYWRIGHT_TELEMETRY_ENDPOINT\",\n\t\t]),\n\n\t\tmeterBaseUrl: firstNonEmpty(raw, METER_BASE_URL_VARS),\n\t\tmeterAccessToken: firstNonEmpty(raw, METER_ACCESS_TOKEN_VARS),\n\t\tmeterOrganizationId: firstNonEmpty(raw, METER_ORG_ID_VARS),\n\t\tambientLearnerFile: resolveHomePath(\n\t\t\ttrim(raw.MAESTRO_AMBIENT_LEARNER_FILE),\n\t\t\traw,\n\t\t),\n\t\tambientLearnerDefaultFile: join(\n\t\t\tresolveDataLocalDir(raw),\n\t\t\t\"ambient-agent\",\n\t\t\t\"learner.json\",\n\t\t),\n\t\tambientSocketFile: join(resolveRuntimeDir(raw), \"ambient-agent.sock\"),\n\t});\n}\n\ntype ProcessWithRuntimeEnvCache = typeof process & {\n\t__MAESTRO_DEFAULT_RUNTIME_ENV__?: RuntimeEnv;\n\t__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__?: boolean;\n\t__MAESTRO_RUNTIME_ENV_FINALIZED__?: boolean;\n};\n\nconst processWithRuntimeEnvCache = process as ProcessWithRuntimeEnvCache;\n\nfunction isTestProcess(): boolean {\n\treturn process.env.NODE_ENV === \"test\" || process.env.VITEST === \"true\";\n}\n\nfunction maybeReportEarlyRuntimeEnvAccess(): void {\n\tif (processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__) {\n\t\treturn;\n\t}\n\tconst message =\n\t\t\"defaultRuntimeEnv() was read before loadAndFinalizeEnv() completed. \" +\n\t\t\"Bootstrap entry points must finish dotenv loading and security scrubbing before runtime env snapshots are created.\";\n\tif (process.env.MAESTRO_RUNTIME_ENV_STRICT_BOOTSTRAP === \"1\") {\n\t\tthrow new Error(message);\n\t}\n\tif (\n\t\tisTestProcess() ||\n\t\tprocessWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__\n\t) {\n\t\treturn;\n\t}\n\tprocessWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__ = true;\n\tconsole.warn(`[maestro] ${message}`);\n}\n\n/**\n * Return the process-wide snapshot of `process.env`.\n *\n * Builds the snapshot lazily on first call so the timing of module load\n * doesn't matter — by the time anything calls this, env has finished\n * settling (CLI argv parsed, dotenv loaded, vitest setup files run). The\n * returned object is frozen and shared.\n *\n * Library code that's been migrated to the substrate should *not* call\n * this directly; it should accept a `RuntimeEnv` parameter. This export\n * exists as the bootstrap entry point and as a compatibility shim during\n * the migration.\n */\nexport function defaultRuntimeEnv(): RuntimeEnv {\n\tmaybeReportEarlyRuntimeEnvAccess();\n\tif (!processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__) {\n\t\tprocessWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__ =\n\t\t\tcreateRuntimeEnv(process.env);\n\t}\n\treturn processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__;\n}\n\nexport function markRuntimeEnvFinalized(): void {\n\tprocessWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__ = true;\n\tReflect.deleteProperty(\n\t\tprocessWithRuntimeEnvCache,\n\t\t\"__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__\",\n\t);\n}\n\nexport function isRuntimeEnvFinalized(): boolean {\n\treturn processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__ === true;\n}\n\n/**\n * Drop the cached default snapshot so the next `defaultRuntimeEnv()` call\n * re-reads `process.env`.\n *\n * Prefer constructing a `RuntimeEnv` with `createRuntimeEnv` and injecting it.\n * This reset is reserved for process bootstrap paths that intentionally mutate\n * `process.env` before handing control to migrated modules.\n */\nexport function resetDefaultRuntimeEnv(): void {\n\tReflect.deleteProperty(\n\t\tprocessWithRuntimeEnvCache,\n\t\t\"__MAESTRO_DEFAULT_RUNTIME_ENV__\",\n\t);\n}\n\nexport function resetDefaultRuntimeEnvForTests(): void {\n\tresetDefaultRuntimeEnv();\n\tReflect.deleteProperty(\n\t\tprocessWithRuntimeEnvCache,\n\t\t\"__MAESTRO_RUNTIME_ENV_FINALIZED__\",\n\t);\n\tReflect.deleteProperty(\n\t\tprocessWithRuntimeEnvCache,\n\t\t\"__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__\",\n\t);\n}\n"]}

package/dist/safety/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAYH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAmBzE;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,sEAAsE;IACtE,KAAK,CAAC,EAAE;QACP,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,sEAAsE;QACtE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,mDAAmD;IACnD,YAAY,CAAC,EAAE;QACd,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACR,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,0CAA0C;QAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACR,uDAAuD;QACvD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IAEF,oCAAoC;IACpC,KAAK,CAAC,EAAE;QACP,0EAA0E;QAC1E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,kCAAkC;IAClC,OAAO,CAAC,EAAE;QACT,8DAA8D;QAC9D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,+DAA+D;QAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,iDAAiD;QACjD,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,uEAAuE;QACvE,eAAe,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QACR,oDAAoD;QACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,0CAA0C;QAC1C,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,yCAAyC;QACzC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;CACF;AAimBD,wBAAgB,UAAU,CAAC,KAAK,UAAQ,GAAG,gBAAgB,GAAG,IAAI,CAgDjE;AAoGD,wBAAsB,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC1E,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAuBD;AAqJD,qBAAa,WAAY,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CA0BA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,EAC5B,KAAK,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D;IACF,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAmEA;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,IAAI,CASnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,gBAAgB,GAAG,IAAI,CAM1D"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAYH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAmBzE;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,sEAAsE;IACtE,KAAK,CAAC,EAAE;QACP,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,sEAAsE;QACtE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,mDAAmD;IACnD,YAAY,CAAC,EAAE;QACd,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACR,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,0CAA0C;QAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACR,uDAAuD;QACvD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IAEF,oCAAoC;IACpC,KAAK,CAAC,EAAE;QACP,0EAA0E;QAC1E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,kCAAkC;IAClC,OAAO,CAAC,EAAE;QACT,8DAA8D;QAC9D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,+DAA+D;QAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,iDAAiD;QACjD,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,uEAAuE;QACvE,eAAe,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QACR,oDAAoD;QACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,0CAA0C;QAC1C,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,yCAAyC;QACzC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;CACF;AA6lBD,wBAAgB,UAAU,CAAC,KAAK,UAAQ,GAAG,gBAAgB,GAAG,IAAI,CAgDjE;AAoGD,wBAAsB,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC1E,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAuBD;AAqJD,qBAAa,WAAY,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CA0BA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,EAC5B,KAAK,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D;IACF,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAmEA;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,IAAI,CASnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,gBAAgB,GAAG,IAAI,CAM1D"}

package/dist/safety/policy.js

@@ -100,7 +100,7 @@ import { Type } from "@sinclair/typebox";
 import { parse as parseTOML } from "smol-toml";
 import { PATHS } from "../config/constants.js";
 import { extractDependencies } from "../utils/dependency-extractor.js";
-import { safeJsonParse } from "../utils/json.js";
+import { isRecord, safeJsonParse } from "../utils/json.js";
 import { createLogger } from "../utils/logger.js";
 import { getHomeDir, resolveEnvPath } from "../utils/path-expansion.js";
 import { uniquePaths } from "../utils/path-utils.js";
@@ -186,9 +186,6 @@ let cachedPolicy = null;
 let cachedPolicyKey = null;
 let cachedPolicyLayers = [];
 let policyWatchers = [];
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function getPolicySources() {
     const sources = [];
     const userPolicyPath = getEffectiveUserPolicyPath();

package/dist/safety/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,EAEN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,KAAK,GACL,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EACN,eAAe,EACf,sBAAsB,GACtB,MAAM,uCAAuC,CAAC;AAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AA+E7C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAClD,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7C,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;KAC9C,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjD,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACnD,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAY1D,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAChF,MAAM,uBAAuB,GAAG,GAAW,EAAE,CAC5C,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAEhD,SAAS,2BAA2B;IACnC,OAAO,WAAW,CAAC;QAClB,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC1D,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC/C,iBAAiB,EAAE;QACnB,uBAAuB,EAAE;KACzB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IAClC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,GAAkB,EAAE;IAClD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC9D,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,IAAI,YAAY,GAA4B,IAAI,CAAC;AACjD,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,kBAAkB,GAAuB,EAAE,CAAC;AAChD,IAAI,cAAc,GAAgB,EAAE,CAAC;AAErC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB;IACxB,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,0BAA0B,EAAE,CAAC;IACpD,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,mBAAmB,GAAG,sBAAsB,EAAE,CAAC;IACrD,IAAI,mBAAmB,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB;IACjD,OAAO,OAAO;SACZ,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;SAClE,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB;IAC3B,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IACD,cAAc,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAuB;IACnD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,gCAAgC;YAChC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;gBAChD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC5B,0BAA0B;oBAC1B,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,mBAAmB,EAAE,CAAC;oBACvB,CAAC;gBACF,CAAC;qBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACnC,gEAAgE;oBAChE,gFAAgF;oBAChF,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;gBACxB,CAAC;YACF,CAAC,CAAC,CAAC;YACH,qDAAqD;YACrD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,oDAAoD;YACpD,4CAA4C;QAC7C,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACjD,CAAC;QACF,MAAM,IAAI,KAAK,CACd,yBAAyB,GAAG,+BAA+B,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,mBAAmB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAe;IACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,SAAS,uBAAuB,CAC/B,MAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,OAAe;IAEf,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IAC1C,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,OAAO,EACP,SAAS,EACT,iBAAiB,CACjB,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,CAAC,YAAY,GAAG;YACrB,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;SACN,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,QAAQ,EACR,UAAU,EACV,iBAAiB,CACjB,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC1E,IACC,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,cAAc,KAAK,SAAS;YAC5B,eAAe,KAAK,SAAS,EAC5B,CAAC;YACF,MAAM,CAAC,OAAO,GAAG;gBAChB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,GAAG,kBAAkB,CAC7C,MAAM,EACN,wBAAwB,CACxB,CAAC;IACF,MAAM,yBAAyB,GAAG,kBAAkB,CACnD,MAAM,EACN,8BAA8B,CAC9B,CAAC;IACF,MAAM,qBAAqB,GAAG,kBAAkB,CAC/C,MAAM,EACN,yBAAyB,CACzB,CAAC;IACF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CACnB,IAA0B,EAC1B,KAA2B;IAE3B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CACzB,IAAwB,EACxB,KAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAClC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,CAC5D,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,IAAI,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,yBAAyB,CACjC,UAAkE,EAClE,eAAuE;IAEvE,MAAM,OAAO,GAAG,eAAe,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAC1B,UAAuC,EACvC,eAA4C;IAE5C,MAAM,YAAY,GACjB,eAAe,EAAE,YAAY,IAAI,UAAU,EAAE,YAAY,CAAC;IAC3D,MAAM,YAAY,GAAG,WAAW,CAC/B,UAAU,EAAE,YAAY,EACxB,eAAe,EAAE,YAAY,CAC7B,CAAC;IACF,MAAM,cAAc,GACnB,UAAU,EAAE,cAAc,KAAK,IAAI;QACnC,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;IAC1C,MAAM,eAAe,GACpB,UAAU,EAAE,eAAe,KAAK,IAAI;QACpC,eAAe,EAAE,eAAe,KAAK,IAAI,CAAC;IAE3C,IACC,YAAY,KAAK,SAAS;QAC1B,YAAY,KAAK,SAAS;QAC1B,CAAC,cAAc;QACf,CAAC,eAAe,EACf,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACzB,UAAsC,EACtC,eAA2C;IAE3C,MAAM,mBAAmB,GAAG,iBAAiB,CAC5C,UAAU,EAAE,mBAAmB,EAC/B,eAAe,EAAE,mBAAmB,CACpC,CAAC;IACF,MAAM,yBAAyB,GAAG,iBAAiB,CAClD,UAAU,EAAE,yBAAyB,EACrC,eAAe,EAAE,yBAAyB,CAC1C,CAAC;IACF,MAAM,qBAAqB,GAAG,iBAAiB,CAC9C,UAAU,EAAE,qBAAqB,EACjC,eAAe,EAAE,qBAAqB,CACtC,CAAC;IAEF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;YAC/B,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,UAAmC,EACnC,eAAwC;IAExC,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC;IACxC,IAAI,CAAC,eAAe;QAAE,OAAO,UAAU,CAAC;IAExC,MAAM,MAAM,GAAqB;QAChC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;YAC5C,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;IAEF,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,YAAY,GAAG,yBAAyB,CAC7C,UAAU,CAAC,YAAY,EACvB,eAAe,CAAC,YAAY,CAC5B,CAAC;IACF,IAAI,YAAY;QAAE,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAErD,MAAM,MAAM,GAAG,yBAAyB,CACvC,UAAU,CAAC,MAAM,EACjB,eAAe,CAAC,MAAM,CACtB,CAAC;IACF,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG,WAAW,CACjC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAC3B,eAAe,CAAC,MAAM,EAAE,QAAQ,CAChC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CACjC,UAAU,CAAC,OAAO,EAClB,eAAe,CAAC,OAAO,CACvB,CAAC;IACF,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAEtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAwB,EAAE,UAAkB;IACzE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACd,qBAAqB,UAAU,KAAK,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAmB,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACd,uBAAuB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC7D,CAAC;QACH,CAAC;QACD,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAK,GAAG,KAAK;IACvC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,mEAAmE;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC;QACpB,eAAe,GAAG,IAAI,CAAC;QACvB,kBAAkB,GAAG,EAAE,CAAC;QACxB,mBAAmB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,YAAY,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7D,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YACnC,mBAAmB,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,UAAU,GAA4B,IAAI,CAAC;QAC/C,IAAI,eAAe,GAA4B,IAAI,CAAC;QAEpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC7B,UAAU,GAAG,YAAY,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACP,eAAe,GAAG,YAAY,CAAC;YAChC,CAAC;QACF,CAAC;QAED,YAAY,GAAG,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC1D,kBAAkB,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,MAAM,CACxD,CAAC,MAAM,EAA8B,EAAE,CAAC,MAAM,KAAK,IAAI,CACvD,CAAC;QACF,eAAe,GAAG,SAAS,CAAC;QAC5B,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,YAAY,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,4CAA4C,EAC5C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;QACF,kFAAkF;QAClF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAwB;IAExB,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAgB;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAwB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC1D,OAAO,CACN,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CACzE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAAwB,EACxB,OAA8B;IAE9B,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gEAAgE;SACxE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4DAA4D;SACpE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,8EAA8E;aAC/E,CAAC;QACH,CAAC;IACF,CAAC;IAED,IACC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9B,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EACrC,CAAC;QACF,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EACL,+EAA+E;SAChF,CAAC;IACH,CAAC;IAED,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7C,IAAI,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,yEAAyE;aAC1E,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA8B;IAI/D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,mBAAmB;SAC/G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAwB,EACxB,OAA8B;IAK9B,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,iBAAiB,CAAC;IAC1B,CAAC;IAED,gCAAgC;IAChC,IACC,MAAM,CAAC,KAAK;QACZ,OAAO,CAAC,IAAI,EAAE,KAAK;QACnB,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,EAClC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC3C,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;SAC7B,CAAC,CAAC;QACH,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qDAAqD,MAAM,CAAC,KAAK,8BAA8B,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG;SAC5H,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,sCAAsC;aACvE,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,+CAA+C;aAChF,CAAC;QACH,CAAC;IACF,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACb,+CAA+C;YAC/C,MAAM,mBAAmB,GAAG;gBAC3B,sBAAsB,CAAC,YAAY;gBACnC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,OAAO;gBAC9B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;aAC/B,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,yIAAyI;qBAC1I,CAAC;gBACH,CAAC;YACF,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBAE1C,iEAAiE;gBACjE,2EAA2E;gBAC3E,qDAAqD;gBACrD,MAAM,uBAAuB,GAC5B,mFAAmF,CAAC,IAAI,CACvF,OAAO,CACP,CAAC;gBACH,IACC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC;oBAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1B,CAAC;oBACF,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,+GAA+G;qBAChH,CAAC;gBACH,CAAC;gBAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;gBAEjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACxB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvC,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,6CAA6C;yBACvE,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5B,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,+CAA+C;yBACzE,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,YAAY,CAAC;QACrB,CAAC;IACF,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACpD,IAAI,yBAAyB,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YAChE,IAAI,eAAe,GAAG,yBAAyB,EAAE,CAAC;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,yBAAyB,wCAAwC;iBAC5I,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACrC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC3B,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAI/C,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,kBAAkB;SAC9G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAA4B,EAC5B,KAA4D;IAK5D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEtC,uBAAuB;QACvB,IACC,MAAM,CAAC,yBAAyB;YAChC,MAAM,CAAC,yBAAyB,GAAG,CAAC,EACnC,CAAC;YACF,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YACxD,IAAI,eAAe,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACxD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,yBAAyB,wCAAwC;iBACnJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,oBAAoB;QACpB,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBACnD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,iCAAiC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,uCAAuC;qBAC9H,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,sDAAsD;gBACtD,gGAAgG;gBAChG,qGAAqG;gBACrG,2EAA2E;gBAC3E,4DAA4D;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kCAAkC,MAAM,CAAC,mBAAmB,mEAAmE;iBACvI,CAAC;YACH,CAAC;QACF,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;oBAC7D,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,sCAAsC,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,qBAAqB,8DAA8D;qBACpK,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,iDAAiD;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,MAAM,CAAC,qBAAqB,qEAAqE;iBAChJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yCAAyC,KAAK,EAAE;SACxD,CAAC;IACH,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC9B,wEAAwE;IACxE,wFAAwF;IACxF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC/B,IAAI,CAAC;QACJ,OAAO,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC","sourcesContent":["/**\n * Enterprise Policy System - Access Control and Safety Enforcement\n *\n * This module implements enterprise-grade policy enforcement for the Maestro CLI,\n * enabling organizations to control what tools, models, paths, and network hosts\n * can be accessed during agent execution.\n *\n * ## Policy File Location\n *\n * Policies are loaded from `~/.maestro/policy.json` (or the legacy `.composer`\n * policy file as a fallback) and `.maestro/workspace.toml` in the current\n * workspace. The global JSON file is typically deployed by enterprise IT and\n * should be protected with appropriate permissions. Workspace TOML applies a\n * stricter project-specific layer.\n *\n * ## Policy Structure\n *\n * ```json\n * {\n *   \"orgId\": \"org-12345\",\n *   \"tools\": {\n *     \"allowed\": [\"Read\", \"Grep\", \"Glob\"],\n *     \"blocked\": [\"Bash\", \"Write\"]\n *   },\n *   \"models\": {\n *     \"allowed\": [\"anthropic/claude-*\"],\n *     \"blocked\": [\"openai/*\"]\n *   },\n *   \"paths\": {\n *     \"allowed\": [\"/home/user/projects/**\"],\n *     \"blocked\": [\"/etc/**\", \"/root/**\"]\n *   },\n *   \"network\": {\n *     \"allowedHosts\": [\"api.github.com\"],\n *     \"blockedHosts\": [\"*.internal.corp\"],\n *     \"blockLocalhost\": true,\n *     \"blockPrivateIPs\": true\n *   },\n *   \"limits\": {\n *     \"maxTokensPerSession\": 100000,\n *     \"maxSessionDurationMinutes\": 60,\n *     \"maxConcurrentSessions\": 3\n *   }\n * }\n * ```\n *\n * Workspace policies use TOML keys such as `allowed_models`, `blocked_tools`,\n * `file_boundaries`, and `max_tokens_per_session`.\n *\n * ## Rule Evaluation\n *\n * Policies use an allow/block list pattern with the following evaluation order:\n *\n * 1. If `blocked` list exists and matches → **DENY**\n * 2. If `allowed` list exists and doesn't match → **DENY**\n * 3. Otherwise → **ALLOW**\n *\n * This means:\n * - If only `allowed` is specified, everything else is blocked\n * - If only `blocked` is specified, everything else is allowed\n * - If both are specified, blocked takes precedence\n *\n * ## Pattern Matching\n *\n * Patterns support glob syntax via the `minimatch` library:\n *\n * | Pattern             | Matches                              |\n * |---------------------|--------------------------------------|\n * | `*`                 | Any single segment                   |\n * | `**`                | Any number of segments               |\n * | `*.md`              | Any file ending in .md               |\n * | `src/** (all .ts)`  | Any .ts file under src/              |\n *\n * ## Network Safety\n *\n * Network policies can block:\n * - Specific hosts by name or pattern\n * - Localhost (127.0.0.1, ::1)\n * - Private IP ranges (10.x, 172.16-31.x, 192.168.x)\n *\n * DNS resolution is performed to validate hosts before connection.\n *\n * ## Hot Reloading\n *\n * The policy file is watched for changes and automatically reloaded.\n * This enables policy updates without restarting active sessions.\n *\n * ## Error Handling\n *\n * Policy violations throw `PolicyError` which includes:\n * - The violated rule type (tool, model, path, network)\n * - A user-friendly error message\n * - Context about what was blocked\n *\n * @module safety/policy\n */\n\nimport {\n\ttype FSWatcher,\n\texistsSync,\n\tlstatSync,\n\treadFileSync,\n\twatch,\n} from \"node:fs\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { Type } from \"@sinclair/typebox\";\nimport { parse as parseTOML } from \"smol-toml\";\nimport type { ActionApprovalContext } from \"../agent/action-approval.js\";\nimport { PATHS } from \"../config/constants.js\";\nimport { extractDependencies } from \"../utils/dependency-extractor.js\";\nimport { safeJsonParse } from \"../utils/json.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { getHomeDir, resolveEnvPath } from \"../utils/path-expansion.js\";\nimport { expandHomeDir, resolveRealPath } from \"../utils/path-matcher.js\";\nimport { uniquePaths } from \"../utils/path-utils.js\";\nimport { compileTypeboxSchema } from \"../utils/typebox-ajv.js\";\nimport { dangerousPatterns as shellDangerousPatterns } from \"./bash-safety-analyzer.js\";\nimport { checkModelAccess } from \"./validators/model-policy-validator.js\";\nimport { checkNetworkPolicy } from \"./validators/network-policy-validator.js\";\nimport {\n\tcheckPathPolicy,\n\textractPolicyFilePaths,\n} from \"./validators/path-policy-validator.js\";\n\nconst logger = createLogger(\"safety:policy\");\n\n/**\n * Enterprise policy configuration interface.\n *\n * Defines all available policy controls that organizations can configure\n * to restrict agent behavior according to their security requirements.\n */\nexport interface EnterprisePolicy {\n\t/** Organization identifier for audit logging and policy association */\n\torgId?: string;\n\n\t/** Tool execution restrictions (e.g., block Bash, allow only Read) */\n\ttools?: {\n\t\t/** Whitelist of allowed tool names (glob patterns supported) */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked tool names (takes precedence over allowed) */\n\t\tblocked?: string[];\n\t};\n\n\t/** Package/dependency installation restrictions */\n\tdependencies?: {\n\t\t/** Whitelist of allowed package patterns */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked package patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Model access restrictions (format: \"provider/model-id\") */\n\tmodels?: {\n\t\t/** Whitelist of allowed model patterns (e.g., \"anthropic/*\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked model patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Required skill names for workspace-controlled workflows */\n\tskills?: {\n\t\t/** Skills that must be available for this workspace */\n\t\trequired?: string[];\n\t};\n\n\t/** File system path restrictions */\n\tpaths?: {\n\t\t/** Whitelist of allowed path patterns (e.g., \"/home/user/projects/**\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked path patterns (e.g., \"/etc/**\") */\n\t\tblocked?: string[];\n\t};\n\n\t/** Network access restrictions */\n\tnetwork?: {\n\t\t/** Whitelist of allowed hostnames (e.g., \"api.github.com\") */\n\t\tallowedHosts?: string[];\n\t\t/** Blacklist of blocked hostnames (e.g., \"*.internal.corp\") */\n\t\tblockedHosts?: string[];\n\t\t/** Block access to localhost (127.0.0.1, ::1) */\n\t\tblockLocalhost?: boolean;\n\t\t/** Block access to private IP ranges (10.x, 172.16-31.x, 192.168.x) */\n\t\tblockPrivateIPs?: boolean;\n\t};\n\n\t/**\n\t * Session limits for resource control.\n\t *\n\t * NOTE: These are schema definitions for policy configuration.\n\t * Actual enforcement requires integration with the billing/token-tracker system.\n\t * Currently exposed via getPolicyLimits() for consumers that want to implement limits.\n\t */\n\tlimits?: {\n\t\t/** Maximum tokens per session before termination */\n\t\tmaxTokensPerSession?: number;\n\t\t/** Maximum session duration in minutes */\n\t\tmaxSessionDurationMinutes?: number;\n\t\t/** Maximum concurrent active sessions */\n\t\tmaxConcurrentSessions?: number;\n\t};\n}\n\nconst PolicySchema = Type.Object({\n\torgId: Type.Optional(Type.String()),\n\ttools: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tdependencies: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tmodels: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tskills: Type.Optional(\n\t\tType.Object({\n\t\t\trequired: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tpaths: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tnetwork: Type.Optional(\n\t\tType.Object({\n\t\t\tallowedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockLocalhost: Type.Optional(Type.Boolean()),\n\t\t\tblockPrivateIPs: Type.Optional(Type.Boolean()),\n\t\t}),\n\t),\n\tlimits: Type.Optional(\n\t\tType.Object({\n\t\t\tmaxTokensPerSession: Type.Optional(Type.Number()),\n\t\t\tmaxSessionDurationMinutes: Type.Optional(Type.Number()),\n\t\t\tmaxConcurrentSessions: Type.Optional(Type.Number()),\n\t\t}),\n\t),\n});\n\nconst validatePolicy = compileTypeboxSchema(PolicySchema);\n\ntype PolicyFormat = \"json\" | \"toml\";\ntype PolicyScope = \"user\" | \"workspace\";\ntype UnknownRecord = Record<string, unknown>;\n\ninterface PolicySource {\n\tpath: string;\n\tformat: PolicyFormat;\n\tscope: PolicyScope;\n}\n\nconst getUserPolicyPath = (): string => join(PATHS.MAESTRO_HOME, \"policy.json\");\nconst getLegacyUserPolicyPath = (): string =>\n\tjoin(getHomeDir(), \".composer\", \"policy.json\");\n\nfunction getUserPolicyPathCandidates(): string[] {\n\treturn uniquePaths([\n\t\tresolveEnvPath(process.env.MAESTRO_ENTERPRISE_POLICY_PATH),\n\t\tresolveEnvPath(process.env.MAESTRO_POLICY_PATH),\n\t\tgetUserPolicyPath(),\n\t\tgetLegacyUserPolicyPath(),\n\t]);\n}\n\nfunction getEffectiveUserPolicyPath(): string | null {\n\tconst candidates = getUserPolicyPathCandidates();\n\treturn candidates.find(isPolicyFile) ?? null;\n}\n\nconst isPolicyFile = (path: string): boolean => {\n\tif (!existsSync(path)) return false;\n\ttry {\n\t\treturn lstatSync(path).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n};\n\nconst getWorkspacePolicyPath = (): string | null => {\n\tlet current = resolve(process.cwd());\n\twhile (true) {\n\t\tconst candidate = join(current, \".maestro\", \"workspace.toml\");\n\t\tif (isPolicyFile(candidate)) {\n\t\t\treturn candidate;\n\t\t}\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) {\n\t\t\treturn null;\n\t\t}\n\t\tcurrent = parent;\n\t}\n};\n\nlet cachedPolicy: EnterprisePolicy | null = null;\nlet cachedPolicyKey: string | null = null;\nlet cachedPolicyLayers: EnterprisePolicy[] = [];\nlet policyWatchers: FSWatcher[] = [];\n\nfunction isRecord(value: unknown): value is UnknownRecord {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getPolicySources(): PolicySource[] {\n\tconst sources: PolicySource[] = [];\n\tconst userPolicyPath = getEffectiveUserPolicyPath();\n\tif (userPolicyPath) {\n\t\tsources.push({ path: userPolicyPath, format: \"json\", scope: \"user\" });\n\t}\n\n\tconst workspacePolicyPath = getWorkspacePolicyPath();\n\tif (workspacePolicyPath) {\n\t\tsources.push({\n\t\t\tpath: workspacePolicyPath,\n\t\t\tformat: \"toml\",\n\t\t\tscope: \"workspace\",\n\t\t});\n\t}\n\treturn sources;\n}\n\nfunction getPolicyCacheKey(sources: PolicySource[]): string {\n\treturn sources\n\t\t.map((source) => `${source.scope}:${source.format}:${source.path}`)\n\t\t.join(\"|\");\n}\n\nfunction closePolicyWatchers() {\n\tfor (const watcher of policyWatchers) {\n\t\twatcher.close();\n\t}\n\tpolicyWatchers = [];\n}\n\nfunction startPolicyWatchers(sources: PolicySource[]) {\n\tif (policyWatchers.length > 0) return;\n\n\tfor (const source of sources) {\n\t\ttry {\n\t\t\t// Only watch if the file exists\n\t\t\tif (!isPolicyFile(source.path)) continue;\n\n\t\t\tconst watcher = watch(source.path, (eventType) => {\n\t\t\t\tif (eventType === \"rename\") {\n\t\t\t\t\t// File deleted or renamed\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t\tif (!isPolicyFile(source.path)) {\n\t\t\t\t\t\tclosePolicyWatchers();\n\t\t\t\t\t}\n\t\t\t\t} else if (eventType === \"change\") {\n\t\t\t\t\t// File modified - invalidate cache so next loadPolicy() reloads\n\t\t\t\t\t// We don't proactively reload here to avoid race conditions with partial writes\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t}\n\t\t\t});\n\t\t\t// Prevent the watcher from keeping the process alive\n\t\t\twatcher.unref();\n\t\t\tpolicyWatchers.push(watcher);\n\t\t} catch (error) {\n\t\t\t// Ignore watcher errors (e.g. system limit reached)\n\t\t\t// We fall back to standard caching behavior\n\t\t}\n\t}\n}\n\nfunction readStringArray(\n\tsource: UnknownRecord,\n\tkey: string,\n): string[] | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (\n\t\t!Array.isArray(value) ||\n\t\t!value.every((entry) => typeof entry === \"string\")\n\t) {\n\t\tthrow new Error(\n\t\t\t`Workspace policy key \"${key}\" must be an array of strings`,\n\t\t);\n\t}\n\treturn value;\n}\n\nfunction readOptionalString(\n\tsource: UnknownRecord,\n\tkey: string,\n): string | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"string\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a string`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalNumber(\n\tsource: UnknownRecord,\n\tkey: string,\n): number | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"number\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a number`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalBoolean(\n\tsource: UnknownRecord,\n\tkey: string,\n): boolean | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a boolean`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalRecord(\n\tsource: UnknownRecord,\n\tkey: string,\n): UnknownRecord | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (!isRecord(value)) {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a table`);\n\t}\n\treturn value;\n}\n\nfunction selectWorkspacePolicyRoot(parsed: unknown): UnknownRecord {\n\tif (!isRecord(parsed)) {\n\t\tthrow new Error(\"Workspace policy must be a TOML table\");\n\t}\n\n\tconst nestedPolicy = parsed.policy;\n\tif (nestedPolicy === undefined) {\n\t\treturn parsed;\n\t}\n\tif (!isRecord(nestedPolicy)) {\n\t\tthrow new Error('Workspace policy key \"policy\" must be a table');\n\t}\n\treturn nestedPolicy;\n}\n\nfunction getWorkspaceStringArray(\n\tsource: UnknownRecord,\n\ttableName: string,\n\ttableKey: string,\n\tflatKey: string,\n): string[] | undefined {\n\tconst flatValue = readStringArray(source, flatKey);\n\tif (flatValue !== undefined) return flatValue;\n\n\tconst table = readOptionalRecord(source, tableName);\n\treturn table ? readStringArray(table, tableKey) : undefined;\n}\n\nfunction mapWorkspacePolicy(parsed: unknown): EnterprisePolicy {\n\tconst source = selectWorkspacePolicyRoot(parsed);\n\tconst policy: EnterprisePolicy = {};\n\n\tconst orgId = readOptionalString(source, \"org_id\");\n\tif (orgId !== undefined) {\n\t\tpolicy.orgId = orgId;\n\t}\n\n\tconst allowedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"allowed\",\n\t\t\"allowed_tools\",\n\t);\n\tconst blockedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"blocked\",\n\t\t\"blocked_tools\",\n\t);\n\tif (allowedTools !== undefined || blockedTools !== undefined) {\n\t\tpolicy.tools = {\n\t\t\t...(allowedTools !== undefined ? { allowed: allowedTools } : {}),\n\t\t\t...(blockedTools !== undefined ? { blocked: blockedTools } : {}),\n\t\t};\n\t}\n\n\tconst allowedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"allowed\",\n\t\t\"allowed_models\",\n\t);\n\tconst blockedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"blocked\",\n\t\t\"blocked_models\",\n\t);\n\tif (allowedModels !== undefined || blockedModels !== undefined) {\n\t\tpolicy.models = {\n\t\t\t...(allowedModels !== undefined ? { allowed: allowedModels } : {}),\n\t\t\t...(blockedModels !== undefined ? { blocked: blockedModels } : {}),\n\t\t};\n\t}\n\n\tconst fileBoundaries = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"allowed\",\n\t\t\"file_boundaries\",\n\t);\n\tconst blockedPaths = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"blocked\",\n\t\t\"blocked_paths\",\n\t);\n\tif (fileBoundaries !== undefined || blockedPaths !== undefined) {\n\t\tpolicy.paths = {\n\t\t\t...(fileBoundaries !== undefined ? { allowed: fileBoundaries } : {}),\n\t\t\t...(blockedPaths !== undefined ? { blocked: blockedPaths } : {}),\n\t\t};\n\t}\n\n\tconst allowedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"allowed\",\n\t\t\"allowed_dependencies\",\n\t);\n\tconst blockedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"blocked\",\n\t\t\"blocked_dependencies\",\n\t);\n\tif (allowedDependencies !== undefined || blockedDependencies !== undefined) {\n\t\tpolicy.dependencies = {\n\t\t\t...(allowedDependencies !== undefined\n\t\t\t\t? { allowed: allowedDependencies }\n\t\t\t\t: {}),\n\t\t\t...(blockedDependencies !== undefined\n\t\t\t\t? { blocked: blockedDependencies }\n\t\t\t\t: {}),\n\t\t};\n\t}\n\n\tconst requiredSkills = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"skills\",\n\t\t\"required\",\n\t\t\"required_skills\",\n\t);\n\tif (requiredSkills !== undefined) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = readOptionalRecord(source, \"network\");\n\tif (network) {\n\t\tconst allowedHosts = readStringArray(network, \"allowed_hosts\");\n\t\tconst blockedHosts = readStringArray(network, \"blocked_hosts\");\n\t\tconst blockLocalhost = readOptionalBoolean(network, \"block_localhost\");\n\t\tconst blockPrivateIPs = readOptionalBoolean(network, \"block_private_ips\");\n\t\tif (\n\t\t\tallowedHosts !== undefined ||\n\t\t\tblockedHosts !== undefined ||\n\t\t\tblockLocalhost !== undefined ||\n\t\t\tblockPrivateIPs !== undefined\n\t\t) {\n\t\t\tpolicy.network = {\n\t\t\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t\t\t...(blockLocalhost !== undefined ? { blockLocalhost } : {}),\n\t\t\t\t...(blockPrivateIPs !== undefined ? { blockPrivateIPs } : {}),\n\t\t\t};\n\t\t}\n\t}\n\n\tconst maxTokensPerSession = readOptionalNumber(\n\t\tsource,\n\t\t\"max_tokens_per_session\",\n\t);\n\tconst maxSessionDurationMinutes = readOptionalNumber(\n\t\tsource,\n\t\t\"max_session_duration_minutes\",\n\t);\n\tconst maxConcurrentSessions = readOptionalNumber(\n\t\tsource,\n\t\t\"max_concurrent_sessions\",\n\t);\n\tif (\n\t\tmaxTokensPerSession !== undefined ||\n\t\tmaxSessionDurationMinutes !== undefined ||\n\t\tmaxConcurrentSessions !== undefined\n\t) {\n\t\tpolicy.limits = {\n\t\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t\t? { maxSessionDurationMinutes }\n\t\t\t\t: {}),\n\t\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t\t};\n\t}\n\n\treturn policy;\n}\n\nfunction uniqueUnion(\n\tleft: string[] | undefined,\n\tright: string[] | undefined,\n): string[] | undefined {\n\tconst values = [...(left ?? []), ...(right ?? [])];\n\treturn values.length > 0 ? [...new Set(values)] : undefined;\n}\n\nfunction minPositiveNumber(\n\tleft: number | undefined,\n\tright: number | undefined,\n): number | undefined {\n\tconst values = [left, right].filter(\n\t\t(value): value is number => value !== undefined && value > 0,\n\t);\n\tif (values.length === 0) {\n\t\treturn left ?? right;\n\t}\n\treturn Math.min(...values);\n}\n\nfunction mergeAllowedBlockedPolicy(\n\tuserPolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n\tworkspacePolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n): { allowed?: string[]; blocked?: string[] } | undefined {\n\tconst allowed = workspacePolicy?.allowed ?? userPolicy?.allowed;\n\tconst blocked = uniqueUnion(userPolicy?.blocked, workspacePolicy?.blocked);\n\tif (allowed === undefined && blocked === undefined) return undefined;\n\treturn {\n\t\t...(allowed !== undefined ? { allowed } : {}),\n\t\t...(blocked !== undefined ? { blocked } : {}),\n\t};\n}\n\nfunction mergeNetworkPolicy(\n\tuserPolicy: EnterprisePolicy[\"network\"],\n\tworkspacePolicy: EnterprisePolicy[\"network\"],\n): EnterprisePolicy[\"network\"] {\n\tconst allowedHosts =\n\t\tworkspacePolicy?.allowedHosts ?? userPolicy?.allowedHosts;\n\tconst blockedHosts = uniqueUnion(\n\t\tuserPolicy?.blockedHosts,\n\t\tworkspacePolicy?.blockedHosts,\n\t);\n\tconst blockLocalhost =\n\t\tuserPolicy?.blockLocalhost === true ||\n\t\tworkspacePolicy?.blockLocalhost === true;\n\tconst blockPrivateIPs =\n\t\tuserPolicy?.blockPrivateIPs === true ||\n\t\tworkspacePolicy?.blockPrivateIPs === true;\n\n\tif (\n\t\tallowedHosts === undefined &&\n\t\tblockedHosts === undefined &&\n\t\t!blockLocalhost &&\n\t\t!blockPrivateIPs\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t...(blockLocalhost ? { blockLocalhost } : {}),\n\t\t...(blockPrivateIPs ? { blockPrivateIPs } : {}),\n\t};\n}\n\nfunction mergePolicyLimits(\n\tuserPolicy: EnterprisePolicy[\"limits\"],\n\tworkspacePolicy: EnterprisePolicy[\"limits\"],\n): EnterprisePolicy[\"limits\"] {\n\tconst maxTokensPerSession = minPositiveNumber(\n\t\tuserPolicy?.maxTokensPerSession,\n\t\tworkspacePolicy?.maxTokensPerSession,\n\t);\n\tconst maxSessionDurationMinutes = minPositiveNumber(\n\t\tuserPolicy?.maxSessionDurationMinutes,\n\t\tworkspacePolicy?.maxSessionDurationMinutes,\n\t);\n\tconst maxConcurrentSessions = minPositiveNumber(\n\t\tuserPolicy?.maxConcurrentSessions,\n\t\tworkspacePolicy?.maxConcurrentSessions,\n\t);\n\n\tif (\n\t\tmaxTokensPerSession === undefined &&\n\t\tmaxSessionDurationMinutes === undefined &&\n\t\tmaxConcurrentSessions === undefined\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t? { maxSessionDurationMinutes }\n\t\t\t: {}),\n\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t};\n}\n\nfunction mergePolicies(\n\tuserPolicy: EnterprisePolicy | null,\n\tworkspacePolicy: EnterprisePolicy | null,\n): EnterprisePolicy | null {\n\tif (!userPolicy) return workspacePolicy;\n\tif (!workspacePolicy) return userPolicy;\n\n\tconst policy: EnterprisePolicy = {\n\t\t...(userPolicy.orgId || workspacePolicy.orgId\n\t\t\t? { orgId: workspacePolicy.orgId ?? userPolicy.orgId }\n\t\t\t: {}),\n\t};\n\n\tconst tools = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.tools,\n\t\tworkspacePolicy.tools,\n\t);\n\tif (tools) policy.tools = tools;\n\n\tconst dependencies = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.dependencies,\n\t\tworkspacePolicy.dependencies,\n\t);\n\tif (dependencies) policy.dependencies = dependencies;\n\n\tconst models = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.models,\n\t\tworkspacePolicy.models,\n\t);\n\tif (models) policy.models = models;\n\n\tconst paths = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.paths,\n\t\tworkspacePolicy.paths,\n\t);\n\tif (paths) policy.paths = paths;\n\n\tconst requiredSkills = uniqueUnion(\n\t\tuserPolicy.skills?.required,\n\t\tworkspacePolicy.skills?.required,\n\t);\n\tif (requiredSkills) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = mergeNetworkPolicy(\n\t\tuserPolicy.network,\n\t\tworkspacePolicy.network,\n\t);\n\tif (network) policy.network = network;\n\n\tconst limits = mergePolicyLimits(userPolicy.limits, workspacePolicy.limits);\n\tif (limits) policy.limits = limits;\n\n\treturn policy;\n}\n\nfunction validateLoadedPolicy(policy: EnterprisePolicy, sourcePath: string) {\n\tif (!validatePolicy(policy)) {\n\t\tthrow new Error(\n\t\t\t`Invalid schema in ${sourcePath}: ${validatePolicy.errors?.map((e) => e.message).join(\", \")}`,\n\t\t);\n\t}\n}\n\nfunction loadPolicySource(source: PolicySource): EnterprisePolicy {\n\tconst raw = readFileSync(source.path, \"utf8\");\n\tif (source.format === \"json\") {\n\t\tconst result = safeJsonParse<EnterprisePolicy>(raw);\n\t\tif (!result.success) {\n\t\t\tthrow new Error(\n\t\t\t\t`JSON parse error in ${source.path}: ${result.error.message}`,\n\t\t\t);\n\t\t}\n\t\tvalidateLoadedPolicy(result.data, source.path);\n\t\treturn result.data;\n\t}\n\n\tconst workspacePolicy = mapWorkspacePolicy(parseTOML(raw));\n\tvalidateLoadedPolicy(workspacePolicy, source.path);\n\treturn workspacePolicy;\n}\n\nexport function loadPolicy(force = false): EnterprisePolicy | null {\n\tconst sources = getPolicySources();\n\t// Check if file exists first - if not, clear cache and return null\n\tif (sources.length === 0) {\n\t\tcachedPolicy = null;\n\t\tcachedPolicyKey = null;\n\t\tcachedPolicyLayers = [];\n\t\tclosePolicyWatchers();\n\t\treturn null;\n\t}\n\n\tconst policyKey = getPolicyCacheKey(sources);\n\tif (cachedPolicy && cachedPolicyKey === policyKey && !force) {\n\t\treturn cachedPolicy;\n\t}\n\n\ttry {\n\t\tif (cachedPolicyKey !== policyKey) {\n\t\t\tclosePolicyWatchers();\n\t\t}\n\n\t\tlet userPolicy: EnterprisePolicy | null = null;\n\t\tlet workspacePolicy: EnterprisePolicy | null = null;\n\n\t\tfor (const source of sources) {\n\t\t\tconst loadedPolicy = loadPolicySource(source);\n\t\t\tif (source.scope === \"user\") {\n\t\t\t\tuserPolicy = loadedPolicy;\n\t\t\t} else {\n\t\t\t\tworkspacePolicy = loadedPolicy;\n\t\t\t}\n\t\t}\n\n\t\tcachedPolicy = mergePolicies(userPolicy, workspacePolicy);\n\t\tcachedPolicyLayers = [userPolicy, workspacePolicy].filter(\n\t\t\t(policy): policy is EnterprisePolicy => policy !== null,\n\t\t);\n\t\tcachedPolicyKey = policyKey;\n\t\tstartPolicyWatchers(sources);\n\t\treturn cachedPolicy;\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Critical: Failed to load enterprise policy\",\n\t\t\terror instanceof Error ? error : new Error(String(error)),\n\t\t);\n\t\t// Throw to ensure we fail closed (block access) rather than treating as no policy\n\t\tthrow error;\n\t}\n}\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\nfunction getEffectivePolicyLayers(\n\tpolicy: EnterprisePolicy,\n): EnterprisePolicy[] {\n\treturn cachedPolicyLayers.length > 0 ? cachedPolicyLayers : [policy];\n}\n\nfunction hasOwnKey(value: object, key: PropertyKey): boolean {\n\treturn Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.trim().length > 0;\n}\n\nfunction hasActiveDurationLimit(policy: EnterprisePolicy): boolean {\n\tconst duration = policy.limits?.maxSessionDurationMinutes;\n\treturn (\n\t\ttypeof duration === \"number\" && Number.isFinite(duration) && duration > 0\n\t);\n}\n\nfunction validatePolicyContext(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): { allowed: false; reason: string } | null {\n\tif (!isNonEmptyString(context.toolName)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: toolName.\",\n\t\t};\n\t}\n\n\tif (!hasOwnKey(context, \"args\")) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: args.\",\n\t\t};\n\t}\n\n\tif (context.user) {\n\t\tif (!isNonEmptyString(context.user.orgId)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Policy evaluation context has invalid user context: missing organization id.\",\n\t\t\t};\n\t\t}\n\t}\n\n\tif (\n\t\tisNonEmptyString(policy.orgId) &&\n\t\t!isNonEmptyString(context.user?.orgId)\n\t) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason:\n\t\t\t\t\"Organization-bound policy requires user organization context. Access blocked.\",\n\t\t};\n\t}\n\n\tif (hasActiveDurationLimit(policy)) {\n\t\tconst startedAt = context.session?.startedAt;\n\t\tif (!(startedAt instanceof Date) || !Number.isFinite(startedAt.getTime())) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Session duration policy requires session start context. Access blocked.\",\n\t\t\t};\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport async function checkPolicy(context: ActionApprovalContext): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Access blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tconst result = await checkPolicyLayer(policyLayer, context);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nasync function checkPolicyLayer(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tconst contextValidation = validatePolicyContext(policy, context);\n\tif (contextValidation) {\n\t\treturn contextValidation;\n\t}\n\n\t// 0. Organization Context Check\n\tif (\n\t\tpolicy.orgId &&\n\t\tcontext.user?.orgId &&\n\t\tpolicy.orgId !== context.user.orgId\n\t) {\n\t\tlogger.warn(\"Org mismatch, action blocked\", {\n\t\t\tpolicyOrgId: policy.orgId,\n\t\t\tuserOrgId: context.user.orgId,\n\t\t});\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Organization mismatch: This machine is managed by ${policy.orgId}, but you are signed in to ${context.user.orgId}.`,\n\t\t};\n\t}\n\n\t// 1. Tool Constraints\n\tif (policy.tools) {\n\t\tconst { allowed, blocked } = policy.tools;\n\t\tif (allowed && !allowed.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is not in the approved tools list.`,\n\t\t\t};\n\t\t}\n\t\tif (blocked?.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is explicitly blocked by enterprise policy.`,\n\t\t\t};\n\t\t}\n\t}\n\n\t// 2. Dangerous Patterns & Dependency Constraints\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getCommandArg(context);\n\t\tif (command) {\n\t\t\t// Check for obfuscation and dangerous patterns\n\t\t\tconst obfuscationPatterns = [\n\t\t\t\tshellDangerousPatterns.base64Decode,\n\t\t\t\tshellDangerousPatterns.opensslEnc,\n\t\t\t\tshellDangerousPatterns.pythonEval,\n\t\t\t\tshellDangerousPatterns.perlEval,\n\t\t\t\tshellDangerousPatterns.nodeEval,\n\t\t\t\tshellDangerousPatterns.phpEval,\n\t\t\t\tshellDangerousPatterns.rubyEval,\n\t\t\t\tshellDangerousPatterns.evalCall,\n\t\t\t\tshellDangerousPatterns.execCall,\n\t\t\t];\n\t\t\tfor (const pattern of obfuscationPatterns) {\n\t\t\t\tif (pattern.test(command)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains obfuscated or dangerous patterns (e.g. base64 decoding, inline code execution) which are blocked by enterprise policy.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (policy.dependencies) {\n\t\t\t\tconst deps = extractDependencies(command);\n\n\t\t\t\t// Check for shell metacharacters in any package install command,\n\t\t\t\t// even when no explicit package names are extracted (e.g., \"npm install\").\n\t\t\t\t// This prevents bypass via \"npm install && rm -rf /\"\n\t\t\t\tconst isPackageInstallCommand =\n\t\t\t\t\t/(?:npm|yarn|pnpm|bun|pip|pip3|gem|cargo|go\\s+get|composer)\\s+(?:install|add|i\\b)/i.test(\n\t\t\t\t\t\tcommand,\n\t\t\t\t\t);\n\t\t\t\tif (\n\t\t\t\t\t(deps.length > 0 || isPackageInstallCommand) &&\n\t\t\t\t\t/[;&|`$()<>]/.test(command)\n\t\t\t\t) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains shell metacharacters which are not allowed by enterprise policy during package installation.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\tconst { allowed, blocked } = policy.dependencies;\n\n\t\t\t\tfor (const dep of deps) {\n\t\t\t\t\tif (allowed && !allowed.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is not in the approved dependencies list.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t\tif (blocked?.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is explicitly blocked by enterprise policy.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// 3. Path Constraints\n\tif (policy.paths) {\n\t\tconst filePaths = extractPolicyFilePaths(context);\n\t\tconst pathCheck = checkPathPolicy(filePaths, policy.paths);\n\t\tif (!pathCheck.allowed) {\n\t\t\treturn pathCheck;\n\t\t}\n\t}\n\n\t// 4. Network Constraints\n\tif (policy.network) {\n\t\tconst networkCheck = await checkNetworkPolicy(context, policy.network);\n\t\tif (!networkCheck.allowed) {\n\t\t\treturn networkCheck;\n\t\t}\n\t}\n\n\t// 5. Session Limits\n\tif (policy.limits && context.session) {\n\t\tconst { maxSessionDurationMinutes } = policy.limits;\n\t\tif (maxSessionDurationMinutes && maxSessionDurationMinutes > 0) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - context.session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nexport class PolicyError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"PolicyError\";\n\t}\n}\n\n/**\n * Check if a model is allowed by policy\n * Called separately from tool checks since model selection happens at a different time\n */\nexport function checkModelPolicy(modelId: string): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Model blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tif (!policyLayer.models) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst result = checkModelAccess(modelId, policyLayer.models);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * Check if the current session has exceeded policy limits\n */\nexport function checkSessionLimits(\n\tsession: { startedAt: Date },\n\tusage?: { tokenCount?: number; activeSessionCount?: number },\n): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\ttry {\n\t\tconst limits = getPolicyLimits();\n\t\tif (!limits) return { allowed: true };\n\n\t\t// Check duration limit\n\t\tif (\n\t\t\tlimits.maxSessionDurationMinutes &&\n\t\t\tlimits.maxSessionDurationMinutes > 0\n\t\t) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > limits.maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${limits.maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check token limit\n\t\tif (limits.maxTokensPerSession && limits.maxTokensPerSession > 0) {\n\t\t\tif (usage?.tokenCount !== undefined) {\n\t\t\t\tif (usage.tokenCount > limits.maxTokensPerSession) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Session token limit exceeded (${usage.tokenCount}/${limits.maxTokensPerSession} tokens). Please start a new session.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Usage undefined but limit is set - should we block?\n\t\t\t\t// To be safe (fail-closed) for strict limits, we probably should if we can't verify compliance.\n\t\t\t\t// However, if usage is undefined because metrics are disabled/failing, this might be too aggressive.\n\t\t\t\t// Given user feedback \"Fail-Open Error Handling\", we should warn or block.\n\t\t\t\t// Let's block if we can't verify usage against a set limit.\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session token limit is active (${limits.maxTokensPerSession}) but token usage data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check concurrent sessions limit\n\t\tif (limits.maxConcurrentSessions && limits.maxConcurrentSessions > 0) {\n\t\t\tif (usage?.activeSessionCount !== undefined) {\n\t\t\t\tif (usage.activeSessionCount > limits.maxConcurrentSessions) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Concurrent session limit exceeded (${usage.activeSessionCount}/${limits.maxConcurrentSessions}). Please close existing sessions before starting a new one.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Same fail-closed logic for concurrent sessions\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Concurrent session limit is active (${limits.maxConcurrentSessions}) but session count data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { allowed: true };\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Policy error checking session limits: ${error}`,\n\t\t};\n\t}\n}\n\n/**\n * Get the current policy limits\n */\nexport function getPolicyLimits(): EnterprisePolicy[\"limits\"] | null {\n\t// Catch errors and return null (no limits) to prevent crashing callers.\n\t// Strict enforcement should rely on checkSessionLimits() which handles its own loading.\n\ttry {\n\t\tconst policy = loadPolicy();\n\t\treturn policy?.limits ?? null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get the full loaded policy (for admin UI display)\n */\nexport function getCurrentPolicy(): EnterprisePolicy | null {\n\ttry {\n\t\treturn loadPolicy();\n\t} catch {\n\t\treturn null;\n\t}\n}\n"]}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,EAEN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,KAAK,GACL,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EACN,eAAe,EACf,sBAAsB,GACtB,MAAM,uCAAuC,CAAC;AAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AA+E7C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAClD,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7C,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;KAC9C,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjD,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACnD,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAY1D,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAChF,MAAM,uBAAuB,GAAG,GAAW,EAAE,CAC5C,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAEhD,SAAS,2BAA2B;IACnC,OAAO,WAAW,CAAC;QAClB,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC1D,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC/C,iBAAiB,EAAE;QACnB,uBAAuB,EAAE;KACzB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IAClC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,GAAkB,EAAE;IAClD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC9D,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,IAAI,YAAY,GAA4B,IAAI,CAAC;AACjD,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,kBAAkB,GAAuB,EAAE,CAAC;AAChD,IAAI,cAAc,GAAgB,EAAE,CAAC;AAErC,SAAS,gBAAgB;IACxB,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,0BAA0B,EAAE,CAAC;IACpD,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,mBAAmB,GAAG,sBAAsB,EAAE,CAAC;IACrD,IAAI,mBAAmB,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB;IACjD,OAAO,OAAO;SACZ,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;SAClE,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB;IAC3B,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IACD,cAAc,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAuB;IACnD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,gCAAgC;YAChC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;gBAChD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC5B,0BAA0B;oBAC1B,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,mBAAmB,EAAE,CAAC;oBACvB,CAAC;gBACF,CAAC;qBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACnC,gEAAgE;oBAChE,gFAAgF;oBAChF,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;gBACxB,CAAC;YACF,CAAC,CAAC,CAAC;YACH,qDAAqD;YACrD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,oDAAoD;YACpD,4CAA4C;QAC7C,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACjD,CAAC;QACF,MAAM,IAAI,KAAK,CACd,yBAAyB,GAAG,+BAA+B,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,mBAAmB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAe;IACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,SAAS,uBAAuB,CAC/B,MAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,OAAe;IAEf,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IAC1C,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,OAAO,EACP,SAAS,EACT,iBAAiB,CACjB,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,CAAC,YAAY,GAAG;YACrB,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;SACN,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,QAAQ,EACR,UAAU,EACV,iBAAiB,CACjB,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC1E,IACC,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,cAAc,KAAK,SAAS;YAC5B,eAAe,KAAK,SAAS,EAC5B,CAAC;YACF,MAAM,CAAC,OAAO,GAAG;gBAChB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,GAAG,kBAAkB,CAC7C,MAAM,EACN,wBAAwB,CACxB,CAAC;IACF,MAAM,yBAAyB,GAAG,kBAAkB,CACnD,MAAM,EACN,8BAA8B,CAC9B,CAAC;IACF,MAAM,qBAAqB,GAAG,kBAAkB,CAC/C,MAAM,EACN,yBAAyB,CACzB,CAAC;IACF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CACnB,IAA0B,EAC1B,KAA2B;IAE3B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CACzB,IAAwB,EACxB,KAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAClC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,CAC5D,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,IAAI,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,yBAAyB,CACjC,UAAkE,EAClE,eAAuE;IAEvE,MAAM,OAAO,GAAG,eAAe,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAC1B,UAAuC,EACvC,eAA4C;IAE5C,MAAM,YAAY,GACjB,eAAe,EAAE,YAAY,IAAI,UAAU,EAAE,YAAY,CAAC;IAC3D,MAAM,YAAY,GAAG,WAAW,CAC/B,UAAU,EAAE,YAAY,EACxB,eAAe,EAAE,YAAY,CAC7B,CAAC;IACF,MAAM,cAAc,GACnB,UAAU,EAAE,cAAc,KAAK,IAAI;QACnC,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;IAC1C,MAAM,eAAe,GACpB,UAAU,EAAE,eAAe,KAAK,IAAI;QACpC,eAAe,EAAE,eAAe,KAAK,IAAI,CAAC;IAE3C,IACC,YAAY,KAAK,SAAS;QAC1B,YAAY,KAAK,SAAS;QAC1B,CAAC,cAAc;QACf,CAAC,eAAe,EACf,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACzB,UAAsC,EACtC,eAA2C;IAE3C,MAAM,mBAAmB,GAAG,iBAAiB,CAC5C,UAAU,EAAE,mBAAmB,EAC/B,eAAe,EAAE,mBAAmB,CACpC,CAAC;IACF,MAAM,yBAAyB,GAAG,iBAAiB,CAClD,UAAU,EAAE,yBAAyB,EACrC,eAAe,EAAE,yBAAyB,CAC1C,CAAC;IACF,MAAM,qBAAqB,GAAG,iBAAiB,CAC9C,UAAU,EAAE,qBAAqB,EACjC,eAAe,EAAE,qBAAqB,CACtC,CAAC;IAEF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;YAC/B,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,UAAmC,EACnC,eAAwC;IAExC,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC;IACxC,IAAI,CAAC,eAAe;QAAE,OAAO,UAAU,CAAC;IAExC,MAAM,MAAM,GAAqB;QAChC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;YAC5C,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;IAEF,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,YAAY,GAAG,yBAAyB,CAC7C,UAAU,CAAC,YAAY,EACvB,eAAe,CAAC,YAAY,CAC5B,CAAC;IACF,IAAI,YAAY;QAAE,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAErD,MAAM,MAAM,GAAG,yBAAyB,CACvC,UAAU,CAAC,MAAM,EACjB,eAAe,CAAC,MAAM,CACtB,CAAC;IACF,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG,WAAW,CACjC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAC3B,eAAe,CAAC,MAAM,EAAE,QAAQ,CAChC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CACjC,UAAU,CAAC,OAAO,EAClB,eAAe,CAAC,OAAO,CACvB,CAAC;IACF,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAEtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAwB,EAAE,UAAkB;IACzE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACd,qBAAqB,UAAU,KAAK,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAmB,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACd,uBAAuB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC7D,CAAC;QACH,CAAC;QACD,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAK,GAAG,KAAK;IACvC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,mEAAmE;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC;QACpB,eAAe,GAAG,IAAI,CAAC;QACvB,kBAAkB,GAAG,EAAE,CAAC;QACxB,mBAAmB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,YAAY,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7D,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YACnC,mBAAmB,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,UAAU,GAA4B,IAAI,CAAC;QAC/C,IAAI,eAAe,GAA4B,IAAI,CAAC;QAEpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC7B,UAAU,GAAG,YAAY,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACP,eAAe,GAAG,YAAY,CAAC;YAChC,CAAC;QACF,CAAC;QAED,YAAY,GAAG,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC1D,kBAAkB,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,MAAM,CACxD,CAAC,MAAM,EAA8B,EAAE,CAAC,MAAM,KAAK,IAAI,CACvD,CAAC;QACF,eAAe,GAAG,SAAS,CAAC;QAC5B,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,YAAY,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,4CAA4C,EAC5C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;QACF,kFAAkF;QAClF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAwB;IAExB,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAgB;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAwB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC1D,OAAO,CACN,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CACzE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAAwB,EACxB,OAA8B;IAE9B,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gEAAgE;SACxE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4DAA4D;SACpE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,8EAA8E;aAC/E,CAAC;QACH,CAAC;IACF,CAAC;IAED,IACC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9B,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EACrC,CAAC;QACF,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EACL,+EAA+E;SAChF,CAAC;IACH,CAAC;IAED,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7C,IAAI,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,yEAAyE;aAC1E,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA8B;IAI/D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,mBAAmB;SAC/G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAwB,EACxB,OAA8B;IAK9B,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,iBAAiB,CAAC;IAC1B,CAAC;IAED,gCAAgC;IAChC,IACC,MAAM,CAAC,KAAK;QACZ,OAAO,CAAC,IAAI,EAAE,KAAK;QACnB,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,EAClC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC3C,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;SAC7B,CAAC,CAAC;QACH,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qDAAqD,MAAM,CAAC,KAAK,8BAA8B,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG;SAC5H,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,sCAAsC;aACvE,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,+CAA+C;aAChF,CAAC;QACH,CAAC;IACF,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACb,+CAA+C;YAC/C,MAAM,mBAAmB,GAAG;gBAC3B,sBAAsB,CAAC,YAAY;gBACnC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,OAAO;gBAC9B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;aAC/B,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,yIAAyI;qBAC1I,CAAC;gBACH,CAAC;YACF,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBAE1C,iEAAiE;gBACjE,2EAA2E;gBAC3E,qDAAqD;gBACrD,MAAM,uBAAuB,GAC5B,mFAAmF,CAAC,IAAI,CACvF,OAAO,CACP,CAAC;gBACH,IACC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC;oBAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1B,CAAC;oBACF,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,+GAA+G;qBAChH,CAAC;gBACH,CAAC;gBAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;gBAEjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACxB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvC,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,6CAA6C;yBACvE,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5B,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,+CAA+C;yBACzE,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,YAAY,CAAC;QACrB,CAAC;IACF,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACpD,IAAI,yBAAyB,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YAChE,IAAI,eAAe,GAAG,yBAAyB,EAAE,CAAC;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,yBAAyB,wCAAwC;iBAC5I,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACrC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC3B,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAI/C,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,kBAAkB;SAC9G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAA4B,EAC5B,KAA4D;IAK5D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEtC,uBAAuB;QACvB,IACC,MAAM,CAAC,yBAAyB;YAChC,MAAM,CAAC,yBAAyB,GAAG,CAAC,EACnC,CAAC;YACF,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YACxD,IAAI,eAAe,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACxD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,yBAAyB,wCAAwC;iBACnJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,oBAAoB;QACpB,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBACnD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,iCAAiC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,uCAAuC;qBAC9H,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,sDAAsD;gBACtD,gGAAgG;gBAChG,qGAAqG;gBACrG,2EAA2E;gBAC3E,4DAA4D;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kCAAkC,MAAM,CAAC,mBAAmB,mEAAmE;iBACvI,CAAC;YACH,CAAC;QACF,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;oBAC7D,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,sCAAsC,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,qBAAqB,8DAA8D;qBACpK,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,iDAAiD;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,MAAM,CAAC,qBAAqB,qEAAqE;iBAChJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yCAAyC,KAAK,EAAE;SACxD,CAAC;IACH,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC9B,wEAAwE;IACxE,wFAAwF;IACxF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC/B,IAAI,CAAC;QACJ,OAAO,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC","sourcesContent":["/**\n * Enterprise Policy System - Access Control and Safety Enforcement\n *\n * This module implements enterprise-grade policy enforcement for the Maestro CLI,\n * enabling organizations to control what tools, models, paths, and network hosts\n * can be accessed during agent execution.\n *\n * ## Policy File Location\n *\n * Policies are loaded from `~/.maestro/policy.json` (or the legacy `.composer`\n * policy file as a fallback) and `.maestro/workspace.toml` in the current\n * workspace. The global JSON file is typically deployed by enterprise IT and\n * should be protected with appropriate permissions. Workspace TOML applies a\n * stricter project-specific layer.\n *\n * ## Policy Structure\n *\n * ```json\n * {\n *   \"orgId\": \"org-12345\",\n *   \"tools\": {\n *     \"allowed\": [\"Read\", \"Grep\", \"Glob\"],\n *     \"blocked\": [\"Bash\", \"Write\"]\n *   },\n *   \"models\": {\n *     \"allowed\": [\"anthropic/claude-*\"],\n *     \"blocked\": [\"openai/*\"]\n *   },\n *   \"paths\": {\n *     \"allowed\": [\"/home/user/projects/**\"],\n *     \"blocked\": [\"/etc/**\", \"/root/**\"]\n *   },\n *   \"network\": {\n *     \"allowedHosts\": [\"api.github.com\"],\n *     \"blockedHosts\": [\"*.internal.corp\"],\n *     \"blockLocalhost\": true,\n *     \"blockPrivateIPs\": true\n *   },\n *   \"limits\": {\n *     \"maxTokensPerSession\": 100000,\n *     \"maxSessionDurationMinutes\": 60,\n *     \"maxConcurrentSessions\": 3\n *   }\n * }\n * ```\n *\n * Workspace policies use TOML keys such as `allowed_models`, `blocked_tools`,\n * `file_boundaries`, and `max_tokens_per_session`.\n *\n * ## Rule Evaluation\n *\n * Policies use an allow/block list pattern with the following evaluation order:\n *\n * 1. If `blocked` list exists and matches → **DENY**\n * 2. If `allowed` list exists and doesn't match → **DENY**\n * 3. Otherwise → **ALLOW**\n *\n * This means:\n * - If only `allowed` is specified, everything else is blocked\n * - If only `blocked` is specified, everything else is allowed\n * - If both are specified, blocked takes precedence\n *\n * ## Pattern Matching\n *\n * Patterns support glob syntax via the `minimatch` library:\n *\n * | Pattern             | Matches                              |\n * |---------------------|--------------------------------------|\n * | `*`                 | Any single segment                   |\n * | `**`                | Any number of segments               |\n * | `*.md`              | Any file ending in .md               |\n * | `src/** (all .ts)`  | Any .ts file under src/              |\n *\n * ## Network Safety\n *\n * Network policies can block:\n * - Specific hosts by name or pattern\n * - Localhost (127.0.0.1, ::1)\n * - Private IP ranges (10.x, 172.16-31.x, 192.168.x)\n *\n * DNS resolution is performed to validate hosts before connection.\n *\n * ## Hot Reloading\n *\n * The policy file is watched for changes and automatically reloaded.\n * This enables policy updates without restarting active sessions.\n *\n * ## Error Handling\n *\n * Policy violations throw `PolicyError` which includes:\n * - The violated rule type (tool, model, path, network)\n * - A user-friendly error message\n * - Context about what was blocked\n *\n * @module safety/policy\n */\n\nimport {\n\ttype FSWatcher,\n\texistsSync,\n\tlstatSync,\n\treadFileSync,\n\twatch,\n} from \"node:fs\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { Type } from \"@sinclair/typebox\";\nimport { parse as parseTOML } from \"smol-toml\";\nimport type { ActionApprovalContext } from \"../agent/action-approval.js\";\nimport { PATHS } from \"../config/constants.js\";\nimport { extractDependencies } from \"../utils/dependency-extractor.js\";\nimport { isRecord, safeJsonParse } from \"../utils/json.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { getHomeDir, resolveEnvPath } from \"../utils/path-expansion.js\";\nimport { expandHomeDir, resolveRealPath } from \"../utils/path-matcher.js\";\nimport { uniquePaths } from \"../utils/path-utils.js\";\nimport { compileTypeboxSchema } from \"../utils/typebox-ajv.js\";\nimport { dangerousPatterns as shellDangerousPatterns } from \"./bash-safety-analyzer.js\";\nimport { checkModelAccess } from \"./validators/model-policy-validator.js\";\nimport { checkNetworkPolicy } from \"./validators/network-policy-validator.js\";\nimport {\n\tcheckPathPolicy,\n\textractPolicyFilePaths,\n} from \"./validators/path-policy-validator.js\";\n\nconst logger = createLogger(\"safety:policy\");\n\n/**\n * Enterprise policy configuration interface.\n *\n * Defines all available policy controls that organizations can configure\n * to restrict agent behavior according to their security requirements.\n */\nexport interface EnterprisePolicy {\n\t/** Organization identifier for audit logging and policy association */\n\torgId?: string;\n\n\t/** Tool execution restrictions (e.g., block Bash, allow only Read) */\n\ttools?: {\n\t\t/** Whitelist of allowed tool names (glob patterns supported) */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked tool names (takes precedence over allowed) */\n\t\tblocked?: string[];\n\t};\n\n\t/** Package/dependency installation restrictions */\n\tdependencies?: {\n\t\t/** Whitelist of allowed package patterns */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked package patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Model access restrictions (format: \"provider/model-id\") */\n\tmodels?: {\n\t\t/** Whitelist of allowed model patterns (e.g., \"anthropic/*\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked model patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Required skill names for workspace-controlled workflows */\n\tskills?: {\n\t\t/** Skills that must be available for this workspace */\n\t\trequired?: string[];\n\t};\n\n\t/** File system path restrictions */\n\tpaths?: {\n\t\t/** Whitelist of allowed path patterns (e.g., \"/home/user/projects/**\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked path patterns (e.g., \"/etc/**\") */\n\t\tblocked?: string[];\n\t};\n\n\t/** Network access restrictions */\n\tnetwork?: {\n\t\t/** Whitelist of allowed hostnames (e.g., \"api.github.com\") */\n\t\tallowedHosts?: string[];\n\t\t/** Blacklist of blocked hostnames (e.g., \"*.internal.corp\") */\n\t\tblockedHosts?: string[];\n\t\t/** Block access to localhost (127.0.0.1, ::1) */\n\t\tblockLocalhost?: boolean;\n\t\t/** Block access to private IP ranges (10.x, 172.16-31.x, 192.168.x) */\n\t\tblockPrivateIPs?: boolean;\n\t};\n\n\t/**\n\t * Session limits for resource control.\n\t *\n\t * NOTE: These are schema definitions for policy configuration.\n\t * Actual enforcement requires integration with the billing/token-tracker system.\n\t * Currently exposed via getPolicyLimits() for consumers that want to implement limits.\n\t */\n\tlimits?: {\n\t\t/** Maximum tokens per session before termination */\n\t\tmaxTokensPerSession?: number;\n\t\t/** Maximum session duration in minutes */\n\t\tmaxSessionDurationMinutes?: number;\n\t\t/** Maximum concurrent active sessions */\n\t\tmaxConcurrentSessions?: number;\n\t};\n}\n\nconst PolicySchema = Type.Object({\n\torgId: Type.Optional(Type.String()),\n\ttools: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tdependencies: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tmodels: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tskills: Type.Optional(\n\t\tType.Object({\n\t\t\trequired: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tpaths: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tnetwork: Type.Optional(\n\t\tType.Object({\n\t\t\tallowedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockLocalhost: Type.Optional(Type.Boolean()),\n\t\t\tblockPrivateIPs: Type.Optional(Type.Boolean()),\n\t\t}),\n\t),\n\tlimits: Type.Optional(\n\t\tType.Object({\n\t\t\tmaxTokensPerSession: Type.Optional(Type.Number()),\n\t\t\tmaxSessionDurationMinutes: Type.Optional(Type.Number()),\n\t\t\tmaxConcurrentSessions: Type.Optional(Type.Number()),\n\t\t}),\n\t),\n});\n\nconst validatePolicy = compileTypeboxSchema(PolicySchema);\n\ntype PolicyFormat = \"json\" | \"toml\";\ntype PolicyScope = \"user\" | \"workspace\";\ntype UnknownRecord = Record<string, unknown>;\n\ninterface PolicySource {\n\tpath: string;\n\tformat: PolicyFormat;\n\tscope: PolicyScope;\n}\n\nconst getUserPolicyPath = (): string => join(PATHS.MAESTRO_HOME, \"policy.json\");\nconst getLegacyUserPolicyPath = (): string =>\n\tjoin(getHomeDir(), \".composer\", \"policy.json\");\n\nfunction getUserPolicyPathCandidates(): string[] {\n\treturn uniquePaths([\n\t\tresolveEnvPath(process.env.MAESTRO_ENTERPRISE_POLICY_PATH),\n\t\tresolveEnvPath(process.env.MAESTRO_POLICY_PATH),\n\t\tgetUserPolicyPath(),\n\t\tgetLegacyUserPolicyPath(),\n\t]);\n}\n\nfunction getEffectiveUserPolicyPath(): string | null {\n\tconst candidates = getUserPolicyPathCandidates();\n\treturn candidates.find(isPolicyFile) ?? null;\n}\n\nconst isPolicyFile = (path: string): boolean => {\n\tif (!existsSync(path)) return false;\n\ttry {\n\t\treturn lstatSync(path).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n};\n\nconst getWorkspacePolicyPath = (): string | null => {\n\tlet current = resolve(process.cwd());\n\twhile (true) {\n\t\tconst candidate = join(current, \".maestro\", \"workspace.toml\");\n\t\tif (isPolicyFile(candidate)) {\n\t\t\treturn candidate;\n\t\t}\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) {\n\t\t\treturn null;\n\t\t}\n\t\tcurrent = parent;\n\t}\n};\n\nlet cachedPolicy: EnterprisePolicy | null = null;\nlet cachedPolicyKey: string | null = null;\nlet cachedPolicyLayers: EnterprisePolicy[] = [];\nlet policyWatchers: FSWatcher[] = [];\n\nfunction getPolicySources(): PolicySource[] {\n\tconst sources: PolicySource[] = [];\n\tconst userPolicyPath = getEffectiveUserPolicyPath();\n\tif (userPolicyPath) {\n\t\tsources.push({ path: userPolicyPath, format: \"json\", scope: \"user\" });\n\t}\n\n\tconst workspacePolicyPath = getWorkspacePolicyPath();\n\tif (workspacePolicyPath) {\n\t\tsources.push({\n\t\t\tpath: workspacePolicyPath,\n\t\t\tformat: \"toml\",\n\t\t\tscope: \"workspace\",\n\t\t});\n\t}\n\treturn sources;\n}\n\nfunction getPolicyCacheKey(sources: PolicySource[]): string {\n\treturn sources\n\t\t.map((source) => `${source.scope}:${source.format}:${source.path}`)\n\t\t.join(\"|\");\n}\n\nfunction closePolicyWatchers() {\n\tfor (const watcher of policyWatchers) {\n\t\twatcher.close();\n\t}\n\tpolicyWatchers = [];\n}\n\nfunction startPolicyWatchers(sources: PolicySource[]) {\n\tif (policyWatchers.length > 0) return;\n\n\tfor (const source of sources) {\n\t\ttry {\n\t\t\t// Only watch if the file exists\n\t\t\tif (!isPolicyFile(source.path)) continue;\n\n\t\t\tconst watcher = watch(source.path, (eventType) => {\n\t\t\t\tif (eventType === \"rename\") {\n\t\t\t\t\t// File deleted or renamed\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t\tif (!isPolicyFile(source.path)) {\n\t\t\t\t\t\tclosePolicyWatchers();\n\t\t\t\t\t}\n\t\t\t\t} else if (eventType === \"change\") {\n\t\t\t\t\t// File modified - invalidate cache so next loadPolicy() reloads\n\t\t\t\t\t// We don't proactively reload here to avoid race conditions with partial writes\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t}\n\t\t\t});\n\t\t\t// Prevent the watcher from keeping the process alive\n\t\t\twatcher.unref();\n\t\t\tpolicyWatchers.push(watcher);\n\t\t} catch (error) {\n\t\t\t// Ignore watcher errors (e.g. system limit reached)\n\t\t\t// We fall back to standard caching behavior\n\t\t}\n\t}\n}\n\nfunction readStringArray(\n\tsource: UnknownRecord,\n\tkey: string,\n): string[] | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (\n\t\t!Array.isArray(value) ||\n\t\t!value.every((entry) => typeof entry === \"string\")\n\t) {\n\t\tthrow new Error(\n\t\t\t`Workspace policy key \"${key}\" must be an array of strings`,\n\t\t);\n\t}\n\treturn value;\n}\n\nfunction readOptionalString(\n\tsource: UnknownRecord,\n\tkey: string,\n): string | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"string\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a string`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalNumber(\n\tsource: UnknownRecord,\n\tkey: string,\n): number | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"number\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a number`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalBoolean(\n\tsource: UnknownRecord,\n\tkey: string,\n): boolean | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a boolean`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalRecord(\n\tsource: UnknownRecord,\n\tkey: string,\n): UnknownRecord | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (!isRecord(value)) {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a table`);\n\t}\n\treturn value;\n}\n\nfunction selectWorkspacePolicyRoot(parsed: unknown): UnknownRecord {\n\tif (!isRecord(parsed)) {\n\t\tthrow new Error(\"Workspace policy must be a TOML table\");\n\t}\n\n\tconst nestedPolicy = parsed.policy;\n\tif (nestedPolicy === undefined) {\n\t\treturn parsed;\n\t}\n\tif (!isRecord(nestedPolicy)) {\n\t\tthrow new Error('Workspace policy key \"policy\" must be a table');\n\t}\n\treturn nestedPolicy;\n}\n\nfunction getWorkspaceStringArray(\n\tsource: UnknownRecord,\n\ttableName: string,\n\ttableKey: string,\n\tflatKey: string,\n): string[] | undefined {\n\tconst flatValue = readStringArray(source, flatKey);\n\tif (flatValue !== undefined) return flatValue;\n\n\tconst table = readOptionalRecord(source, tableName);\n\treturn table ? readStringArray(table, tableKey) : undefined;\n}\n\nfunction mapWorkspacePolicy(parsed: unknown): EnterprisePolicy {\n\tconst source = selectWorkspacePolicyRoot(parsed);\n\tconst policy: EnterprisePolicy = {};\n\n\tconst orgId = readOptionalString(source, \"org_id\");\n\tif (orgId !== undefined) {\n\t\tpolicy.orgId = orgId;\n\t}\n\n\tconst allowedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"allowed\",\n\t\t\"allowed_tools\",\n\t);\n\tconst blockedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"blocked\",\n\t\t\"blocked_tools\",\n\t);\n\tif (allowedTools !== undefined || blockedTools !== undefined) {\n\t\tpolicy.tools = {\n\t\t\t...(allowedTools !== undefined ? { allowed: allowedTools } : {}),\n\t\t\t...(blockedTools !== undefined ? { blocked: blockedTools } : {}),\n\t\t};\n\t}\n\n\tconst allowedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"allowed\",\n\t\t\"allowed_models\",\n\t);\n\tconst blockedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"blocked\",\n\t\t\"blocked_models\",\n\t);\n\tif (allowedModels !== undefined || blockedModels !== undefined) {\n\t\tpolicy.models = {\n\t\t\t...(allowedModels !== undefined ? { allowed: allowedModels } : {}),\n\t\t\t...(blockedModels !== undefined ? { blocked: blockedModels } : {}),\n\t\t};\n\t}\n\n\tconst fileBoundaries = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"allowed\",\n\t\t\"file_boundaries\",\n\t);\n\tconst blockedPaths = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"blocked\",\n\t\t\"blocked_paths\",\n\t);\n\tif (fileBoundaries !== undefined || blockedPaths !== undefined) {\n\t\tpolicy.paths = {\n\t\t\t...(fileBoundaries !== undefined ? { allowed: fileBoundaries } : {}),\n\t\t\t...(blockedPaths !== undefined ? { blocked: blockedPaths } : {}),\n\t\t};\n\t}\n\n\tconst allowedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"allowed\",\n\t\t\"allowed_dependencies\",\n\t);\n\tconst blockedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"blocked\",\n\t\t\"blocked_dependencies\",\n\t);\n\tif (allowedDependencies !== undefined || blockedDependencies !== undefined) {\n\t\tpolicy.dependencies = {\n\t\t\t...(allowedDependencies !== undefined\n\t\t\t\t? { allowed: allowedDependencies }\n\t\t\t\t: {}),\n\t\t\t...(blockedDependencies !== undefined\n\t\t\t\t? { blocked: blockedDependencies }\n\t\t\t\t: {}),\n\t\t};\n\t}\n\n\tconst requiredSkills = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"skills\",\n\t\t\"required\",\n\t\t\"required_skills\",\n\t);\n\tif (requiredSkills !== undefined) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = readOptionalRecord(source, \"network\");\n\tif (network) {\n\t\tconst allowedHosts = readStringArray(network, \"allowed_hosts\");\n\t\tconst blockedHosts = readStringArray(network, \"blocked_hosts\");\n\t\tconst blockLocalhost = readOptionalBoolean(network, \"block_localhost\");\n\t\tconst blockPrivateIPs = readOptionalBoolean(network, \"block_private_ips\");\n\t\tif (\n\t\t\tallowedHosts !== undefined ||\n\t\t\tblockedHosts !== undefined ||\n\t\t\tblockLocalhost !== undefined ||\n\t\t\tblockPrivateIPs !== undefined\n\t\t) {\n\t\t\tpolicy.network = {\n\t\t\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t\t\t...(blockLocalhost !== undefined ? { blockLocalhost } : {}),\n\t\t\t\t...(blockPrivateIPs !== undefined ? { blockPrivateIPs } : {}),\n\t\t\t};\n\t\t}\n\t}\n\n\tconst maxTokensPerSession = readOptionalNumber(\n\t\tsource,\n\t\t\"max_tokens_per_session\",\n\t);\n\tconst maxSessionDurationMinutes = readOptionalNumber(\n\t\tsource,\n\t\t\"max_session_duration_minutes\",\n\t);\n\tconst maxConcurrentSessions = readOptionalNumber(\n\t\tsource,\n\t\t\"max_concurrent_sessions\",\n\t);\n\tif (\n\t\tmaxTokensPerSession !== undefined ||\n\t\tmaxSessionDurationMinutes !== undefined ||\n\t\tmaxConcurrentSessions !== undefined\n\t) {\n\t\tpolicy.limits = {\n\t\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t\t? { maxSessionDurationMinutes }\n\t\t\t\t: {}),\n\t\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t\t};\n\t}\n\n\treturn policy;\n}\n\nfunction uniqueUnion(\n\tleft: string[] | undefined,\n\tright: string[] | undefined,\n): string[] | undefined {\n\tconst values = [...(left ?? []), ...(right ?? [])];\n\treturn values.length > 0 ? [...new Set(values)] : undefined;\n}\n\nfunction minPositiveNumber(\n\tleft: number | undefined,\n\tright: number | undefined,\n): number | undefined {\n\tconst values = [left, right].filter(\n\t\t(value): value is number => value !== undefined && value > 0,\n\t);\n\tif (values.length === 0) {\n\t\treturn left ?? right;\n\t}\n\treturn Math.min(...values);\n}\n\nfunction mergeAllowedBlockedPolicy(\n\tuserPolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n\tworkspacePolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n): { allowed?: string[]; blocked?: string[] } | undefined {\n\tconst allowed = workspacePolicy?.allowed ?? userPolicy?.allowed;\n\tconst blocked = uniqueUnion(userPolicy?.blocked, workspacePolicy?.blocked);\n\tif (allowed === undefined && blocked === undefined) return undefined;\n\treturn {\n\t\t...(allowed !== undefined ? { allowed } : {}),\n\t\t...(blocked !== undefined ? { blocked } : {}),\n\t};\n}\n\nfunction mergeNetworkPolicy(\n\tuserPolicy: EnterprisePolicy[\"network\"],\n\tworkspacePolicy: EnterprisePolicy[\"network\"],\n): EnterprisePolicy[\"network\"] {\n\tconst allowedHosts =\n\t\tworkspacePolicy?.allowedHosts ?? userPolicy?.allowedHosts;\n\tconst blockedHosts = uniqueUnion(\n\t\tuserPolicy?.blockedHosts,\n\t\tworkspacePolicy?.blockedHosts,\n\t);\n\tconst blockLocalhost =\n\t\tuserPolicy?.blockLocalhost === true ||\n\t\tworkspacePolicy?.blockLocalhost === true;\n\tconst blockPrivateIPs =\n\t\tuserPolicy?.blockPrivateIPs === true ||\n\t\tworkspacePolicy?.blockPrivateIPs === true;\n\n\tif (\n\t\tallowedHosts === undefined &&\n\t\tblockedHosts === undefined &&\n\t\t!blockLocalhost &&\n\t\t!blockPrivateIPs\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t...(blockLocalhost ? { blockLocalhost } : {}),\n\t\t...(blockPrivateIPs ? { blockPrivateIPs } : {}),\n\t};\n}\n\nfunction mergePolicyLimits(\n\tuserPolicy: EnterprisePolicy[\"limits\"],\n\tworkspacePolicy: EnterprisePolicy[\"limits\"],\n): EnterprisePolicy[\"limits\"] {\n\tconst maxTokensPerSession = minPositiveNumber(\n\t\tuserPolicy?.maxTokensPerSession,\n\t\tworkspacePolicy?.maxTokensPerSession,\n\t);\n\tconst maxSessionDurationMinutes = minPositiveNumber(\n\t\tuserPolicy?.maxSessionDurationMinutes,\n\t\tworkspacePolicy?.maxSessionDurationMinutes,\n\t);\n\tconst maxConcurrentSessions = minPositiveNumber(\n\t\tuserPolicy?.maxConcurrentSessions,\n\t\tworkspacePolicy?.maxConcurrentSessions,\n\t);\n\n\tif (\n\t\tmaxTokensPerSession === undefined &&\n\t\tmaxSessionDurationMinutes === undefined &&\n\t\tmaxConcurrentSessions === undefined\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t? { maxSessionDurationMinutes }\n\t\t\t: {}),\n\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t};\n}\n\nfunction mergePolicies(\n\tuserPolicy: EnterprisePolicy | null,\n\tworkspacePolicy: EnterprisePolicy | null,\n): EnterprisePolicy | null {\n\tif (!userPolicy) return workspacePolicy;\n\tif (!workspacePolicy) return userPolicy;\n\n\tconst policy: EnterprisePolicy = {\n\t\t...(userPolicy.orgId || workspacePolicy.orgId\n\t\t\t? { orgId: workspacePolicy.orgId ?? userPolicy.orgId }\n\t\t\t: {}),\n\t};\n\n\tconst tools = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.tools,\n\t\tworkspacePolicy.tools,\n\t);\n\tif (tools) policy.tools = tools;\n\n\tconst dependencies = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.dependencies,\n\t\tworkspacePolicy.dependencies,\n\t);\n\tif (dependencies) policy.dependencies = dependencies;\n\n\tconst models = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.models,\n\t\tworkspacePolicy.models,\n\t);\n\tif (models) policy.models = models;\n\n\tconst paths = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.paths,\n\t\tworkspacePolicy.paths,\n\t);\n\tif (paths) policy.paths = paths;\n\n\tconst requiredSkills = uniqueUnion(\n\t\tuserPolicy.skills?.required,\n\t\tworkspacePolicy.skills?.required,\n\t);\n\tif (requiredSkills) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = mergeNetworkPolicy(\n\t\tuserPolicy.network,\n\t\tworkspacePolicy.network,\n\t);\n\tif (network) policy.network = network;\n\n\tconst limits = mergePolicyLimits(userPolicy.limits, workspacePolicy.limits);\n\tif (limits) policy.limits = limits;\n\n\treturn policy;\n}\n\nfunction validateLoadedPolicy(policy: EnterprisePolicy, sourcePath: string) {\n\tif (!validatePolicy(policy)) {\n\t\tthrow new Error(\n\t\t\t`Invalid schema in ${sourcePath}: ${validatePolicy.errors?.map((e) => e.message).join(\", \")}`,\n\t\t);\n\t}\n}\n\nfunction loadPolicySource(source: PolicySource): EnterprisePolicy {\n\tconst raw = readFileSync(source.path, \"utf8\");\n\tif (source.format === \"json\") {\n\t\tconst result = safeJsonParse<EnterprisePolicy>(raw);\n\t\tif (!result.success) {\n\t\t\tthrow new Error(\n\t\t\t\t`JSON parse error in ${source.path}: ${result.error.message}`,\n\t\t\t);\n\t\t}\n\t\tvalidateLoadedPolicy(result.data, source.path);\n\t\treturn result.data;\n\t}\n\n\tconst workspacePolicy = mapWorkspacePolicy(parseTOML(raw));\n\tvalidateLoadedPolicy(workspacePolicy, source.path);\n\treturn workspacePolicy;\n}\n\nexport function loadPolicy(force = false): EnterprisePolicy | null {\n\tconst sources = getPolicySources();\n\t// Check if file exists first - if not, clear cache and return null\n\tif (sources.length === 0) {\n\t\tcachedPolicy = null;\n\t\tcachedPolicyKey = null;\n\t\tcachedPolicyLayers = [];\n\t\tclosePolicyWatchers();\n\t\treturn null;\n\t}\n\n\tconst policyKey = getPolicyCacheKey(sources);\n\tif (cachedPolicy && cachedPolicyKey === policyKey && !force) {\n\t\treturn cachedPolicy;\n\t}\n\n\ttry {\n\t\tif (cachedPolicyKey !== policyKey) {\n\t\t\tclosePolicyWatchers();\n\t\t}\n\n\t\tlet userPolicy: EnterprisePolicy | null = null;\n\t\tlet workspacePolicy: EnterprisePolicy | null = null;\n\n\t\tfor (const source of sources) {\n\t\t\tconst loadedPolicy = loadPolicySource(source);\n\t\t\tif (source.scope === \"user\") {\n\t\t\t\tuserPolicy = loadedPolicy;\n\t\t\t} else {\n\t\t\t\tworkspacePolicy = loadedPolicy;\n\t\t\t}\n\t\t}\n\n\t\tcachedPolicy = mergePolicies(userPolicy, workspacePolicy);\n\t\tcachedPolicyLayers = [userPolicy, workspacePolicy].filter(\n\t\t\t(policy): policy is EnterprisePolicy => policy !== null,\n\t\t);\n\t\tcachedPolicyKey = policyKey;\n\t\tstartPolicyWatchers(sources);\n\t\treturn cachedPolicy;\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Critical: Failed to load enterprise policy\",\n\t\t\terror instanceof Error ? error : new Error(String(error)),\n\t\t);\n\t\t// Throw to ensure we fail closed (block access) rather than treating as no policy\n\t\tthrow error;\n\t}\n}\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\nfunction getEffectivePolicyLayers(\n\tpolicy: EnterprisePolicy,\n): EnterprisePolicy[] {\n\treturn cachedPolicyLayers.length > 0 ? cachedPolicyLayers : [policy];\n}\n\nfunction hasOwnKey(value: object, key: PropertyKey): boolean {\n\treturn Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.trim().length > 0;\n}\n\nfunction hasActiveDurationLimit(policy: EnterprisePolicy): boolean {\n\tconst duration = policy.limits?.maxSessionDurationMinutes;\n\treturn (\n\t\ttypeof duration === \"number\" && Number.isFinite(duration) && duration > 0\n\t);\n}\n\nfunction validatePolicyContext(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): { allowed: false; reason: string } | null {\n\tif (!isNonEmptyString(context.toolName)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: toolName.\",\n\t\t};\n\t}\n\n\tif (!hasOwnKey(context, \"args\")) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: args.\",\n\t\t};\n\t}\n\n\tif (context.user) {\n\t\tif (!isNonEmptyString(context.user.orgId)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Policy evaluation context has invalid user context: missing organization id.\",\n\t\t\t};\n\t\t}\n\t}\n\n\tif (\n\t\tisNonEmptyString(policy.orgId) &&\n\t\t!isNonEmptyString(context.user?.orgId)\n\t) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason:\n\t\t\t\t\"Organization-bound policy requires user organization context. Access blocked.\",\n\t\t};\n\t}\n\n\tif (hasActiveDurationLimit(policy)) {\n\t\tconst startedAt = context.session?.startedAt;\n\t\tif (!(startedAt instanceof Date) || !Number.isFinite(startedAt.getTime())) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Session duration policy requires session start context. Access blocked.\",\n\t\t\t};\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport async function checkPolicy(context: ActionApprovalContext): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Access blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tconst result = await checkPolicyLayer(policyLayer, context);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nasync function checkPolicyLayer(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tconst contextValidation = validatePolicyContext(policy, context);\n\tif (contextValidation) {\n\t\treturn contextValidation;\n\t}\n\n\t// 0. Organization Context Check\n\tif (\n\t\tpolicy.orgId &&\n\t\tcontext.user?.orgId &&\n\t\tpolicy.orgId !== context.user.orgId\n\t) {\n\t\tlogger.warn(\"Org mismatch, action blocked\", {\n\t\t\tpolicyOrgId: policy.orgId,\n\t\t\tuserOrgId: context.user.orgId,\n\t\t});\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Organization mismatch: This machine is managed by ${policy.orgId}, but you are signed in to ${context.user.orgId}.`,\n\t\t};\n\t}\n\n\t// 1. Tool Constraints\n\tif (policy.tools) {\n\t\tconst { allowed, blocked } = policy.tools;\n\t\tif (allowed && !allowed.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is not in the approved tools list.`,\n\t\t\t};\n\t\t}\n\t\tif (blocked?.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is explicitly blocked by enterprise policy.`,\n\t\t\t};\n\t\t}\n\t}\n\n\t// 2. Dangerous Patterns & Dependency Constraints\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getCommandArg(context);\n\t\tif (command) {\n\t\t\t// Check for obfuscation and dangerous patterns\n\t\t\tconst obfuscationPatterns = [\n\t\t\t\tshellDangerousPatterns.base64Decode,\n\t\t\t\tshellDangerousPatterns.opensslEnc,\n\t\t\t\tshellDangerousPatterns.pythonEval,\n\t\t\t\tshellDangerousPatterns.perlEval,\n\t\t\t\tshellDangerousPatterns.nodeEval,\n\t\t\t\tshellDangerousPatterns.phpEval,\n\t\t\t\tshellDangerousPatterns.rubyEval,\n\t\t\t\tshellDangerousPatterns.evalCall,\n\t\t\t\tshellDangerousPatterns.execCall,\n\t\t\t];\n\t\t\tfor (const pattern of obfuscationPatterns) {\n\t\t\t\tif (pattern.test(command)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains obfuscated or dangerous patterns (e.g. base64 decoding, inline code execution) which are blocked by enterprise policy.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (policy.dependencies) {\n\t\t\t\tconst deps = extractDependencies(command);\n\n\t\t\t\t// Check for shell metacharacters in any package install command,\n\t\t\t\t// even when no explicit package names are extracted (e.g., \"npm install\").\n\t\t\t\t// This prevents bypass via \"npm install && rm -rf /\"\n\t\t\t\tconst isPackageInstallCommand =\n\t\t\t\t\t/(?:npm|yarn|pnpm|bun|pip|pip3|gem|cargo|go\\s+get|composer)\\s+(?:install|add|i\\b)/i.test(\n\t\t\t\t\t\tcommand,\n\t\t\t\t\t);\n\t\t\t\tif (\n\t\t\t\t\t(deps.length > 0 || isPackageInstallCommand) &&\n\t\t\t\t\t/[;&|`$()<>]/.test(command)\n\t\t\t\t) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains shell metacharacters which are not allowed by enterprise policy during package installation.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\tconst { allowed, blocked } = policy.dependencies;\n\n\t\t\t\tfor (const dep of deps) {\n\t\t\t\t\tif (allowed && !allowed.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is not in the approved dependencies list.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t\tif (blocked?.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is explicitly blocked by enterprise policy.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// 3. Path Constraints\n\tif (policy.paths) {\n\t\tconst filePaths = extractPolicyFilePaths(context);\n\t\tconst pathCheck = checkPathPolicy(filePaths, policy.paths);\n\t\tif (!pathCheck.allowed) {\n\t\t\treturn pathCheck;\n\t\t}\n\t}\n\n\t// 4. Network Constraints\n\tif (policy.network) {\n\t\tconst networkCheck = await checkNetworkPolicy(context, policy.network);\n\t\tif (!networkCheck.allowed) {\n\t\t\treturn networkCheck;\n\t\t}\n\t}\n\n\t// 5. Session Limits\n\tif (policy.limits && context.session) {\n\t\tconst { maxSessionDurationMinutes } = policy.limits;\n\t\tif (maxSessionDurationMinutes && maxSessionDurationMinutes > 0) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - context.session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nexport class PolicyError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"PolicyError\";\n\t}\n}\n\n/**\n * Check if a model is allowed by policy\n * Called separately from tool checks since model selection happens at a different time\n */\nexport function checkModelPolicy(modelId: string): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Model blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tif (!policyLayer.models) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst result = checkModelAccess(modelId, policyLayer.models);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * Check if the current session has exceeded policy limits\n */\nexport function checkSessionLimits(\n\tsession: { startedAt: Date },\n\tusage?: { tokenCount?: number; activeSessionCount?: number },\n): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\ttry {\n\t\tconst limits = getPolicyLimits();\n\t\tif (!limits) return { allowed: true };\n\n\t\t// Check duration limit\n\t\tif (\n\t\t\tlimits.maxSessionDurationMinutes &&\n\t\t\tlimits.maxSessionDurationMinutes > 0\n\t\t) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > limits.maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${limits.maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check token limit\n\t\tif (limits.maxTokensPerSession && limits.maxTokensPerSession > 0) {\n\t\t\tif (usage?.tokenCount !== undefined) {\n\t\t\t\tif (usage.tokenCount > limits.maxTokensPerSession) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Session token limit exceeded (${usage.tokenCount}/${limits.maxTokensPerSession} tokens). Please start a new session.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Usage undefined but limit is set - should we block?\n\t\t\t\t// To be safe (fail-closed) for strict limits, we probably should if we can't verify compliance.\n\t\t\t\t// However, if usage is undefined because metrics are disabled/failing, this might be too aggressive.\n\t\t\t\t// Given user feedback \"Fail-Open Error Handling\", we should warn or block.\n\t\t\t\t// Let's block if we can't verify usage against a set limit.\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session token limit is active (${limits.maxTokensPerSession}) but token usage data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check concurrent sessions limit\n\t\tif (limits.maxConcurrentSessions && limits.maxConcurrentSessions > 0) {\n\t\t\tif (usage?.activeSessionCount !== undefined) {\n\t\t\t\tif (usage.activeSessionCount > limits.maxConcurrentSessions) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Concurrent session limit exceeded (${usage.activeSessionCount}/${limits.maxConcurrentSessions}). Please close existing sessions before starting a new one.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Same fail-closed logic for concurrent sessions\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Concurrent session limit is active (${limits.maxConcurrentSessions}) but session count data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { allowed: true };\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Policy error checking session limits: ${error}`,\n\t\t};\n\t}\n}\n\n/**\n * Get the current policy limits\n */\nexport function getPolicyLimits(): EnterprisePolicy[\"limits\"] | null {\n\t// Catch errors and return null (no limits) to prevent crashing callers.\n\t// Strict enforcement should rely on checkSessionLimits() which handles its own loading.\n\ttry {\n\t\tconst policy = loadPolicy();\n\t\treturn policy?.limits ?? null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get the full loaded policy (for admin UI display)\n */\nexport function getCurrentPolicy(): EnterprisePolicy | null {\n\ttry {\n\t\treturn loadPolicy();\n\t} catch {\n\t\treturn null;\n\t}\n}\n"]}

package/dist/sandbox/docker-sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker-sandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/docker-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAWH,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAyB3E,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,aAAc,YAAW,OAAO;IAC5C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,cAAc,CAAS;gBAEnB,MAAM,GAAE,mBAAwB;IAKtC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YAenB,eAAe;IAUvB,IAAI,CACT,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,UAAU,CAAC;IA8DhB,YAAY,CACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,mBAAwB,GAC/B,OAAO,CAAC,UAAU,CAAC;IAkFhB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYvC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwCvD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAa9B"}
+{"version":3,"file":"docker-sandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/docker-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAWH,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAyB3E,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,aAAc,YAAW,OAAO;IAC5C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,cAAc,CAAS;gBAEnB,MAAM,GAAE,mBAAwB;IAKtC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YAenB,eAAe;IAUvB,IAAI,CACT,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,UAAU,CAAC;IA8DhB,YAAY,CACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,mBAAwB,GAC/B,OAAO,CAAC,UAAU,CAAC;IAkFhB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBvC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwCvD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAa9B"}

package/dist/sandbox/docker-sandbox.js

@@ -235,10 +235,15 @@ export class DockerSandbox {
         // shell interpolation of the path on host OR in container.
         // Previously: `cat "${path}"` was sent through a shell, so
         // `path` containing `"` or `$` could break or inject (#2473).
-        const result = await this.execWithArgs("cat", [path]);
+        const result = await this.execWithArgs("cat", [path], {
+            maxBuffer: EXEC_WITH_ARGS_MAX_BUFFER + 1,
+        });
         if (result.exitCode !== 0) {
             throw new Error(`Failed to read file: ${result.stderr}`);
         }
+        if (Buffer.byteLength(result.stdout, "utf8") > EXEC_WITH_ARGS_MAX_BUFFER) {
+            throw new Error(`Failed to read file: ${path} exceeds the ${EXEC_WITH_ARGS_MAX_BUFFER} byte Docker read limit`);
+        }
         return result.stdout;
     }
     async writeFile(path, content) {