@grwnd/pi-governance 1.2.0 → 1.3.0

package/dist/index.cjs

@@ -1,8 +1,16 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -13,15 +21,3760 @@ var __copyProps = (to, from, except, desc) => {
       if (!__hasOwnProp.call(to, key) && key !== except)
         __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/types.js
+var require_types = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/types.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.UserType = exports2.Dict = exports2.isAsyncIterable = exports2.isIterable = exports2.isIterableIterator = exports2.QueryEventKind = exports2.isPolarTerm = exports2.isPolarPattern = exports2.isPolarExpression = exports2.isPolarInstance = exports2.isPolarVariable = exports2.isPolarPredicate = exports2.isPolarDict = exports2.isPolarList = exports2.isPolarBool = exports2.isPolarNum = exports2.isPolarComparisonOperator = exports2.isPolarStr = void 0;
+    var helpers_1 = require_helpers();
+    function isPolarStr(v) {
+      return v.String !== void 0;
+    }
+    exports2.isPolarStr = isPolarStr;
+    function isPolarComparisonOperator(s) {
+      return s in comparisonOperators;
+    }
+    exports2.isPolarComparisonOperator = isPolarComparisonOperator;
+    function isPolarNum(v) {
+      return v.Number !== void 0;
+    }
+    exports2.isPolarNum = isPolarNum;
+    function isPolarBool(v) {
+      return v.Boolean !== void 0;
+    }
+    exports2.isPolarBool = isPolarBool;
+    function isPolarList(v) {
+      return v.List !== void 0;
+    }
+    exports2.isPolarList = isPolarList;
+    function isPolarDict(v) {
+      return v.Dictionary !== void 0;
+    }
+    exports2.isPolarDict = isPolarDict;
+    function isPolarPredicate(v) {
+      return v.Call !== void 0;
+    }
+    exports2.isPolarPredicate = isPolarPredicate;
+    function isPolarVariable(v) {
+      return v.Variable !== void 0;
+    }
+    exports2.isPolarVariable = isPolarVariable;
+    function isPolarInstance(v) {
+      return v.ExternalInstance !== void 0;
+    }
+    exports2.isPolarInstance = isPolarInstance;
+    function isPolarExpression(v) {
+      return v.Expression !== void 0;
+    }
+    exports2.isPolarExpression = isPolarExpression;
+    function isPolarPattern(v) {
+      return v.Pattern !== void 0;
+    }
+    exports2.isPolarPattern = isPolarPattern;
+    function isPolarValue(x) {
+      if (!helpers_1.isObj(x))
+        return false;
+      const v = x;
+      return isPolarStr(v) || isPolarNum(v) || isPolarBool(v) || isPolarList(v) || isPolarDict(v) || isPolarPredicate(v) || isPolarVariable(v) || isPolarInstance(v) || isPolarExpression(v) || isPolarPattern(v);
+    }
+    function isPolarTerm(v) {
+      if (!helpers_1.isObj(v))
+        return false;
+      return isPolarValue(v.value);
+    }
+    exports2.isPolarTerm = isPolarTerm;
+    var comparisonOperators = {
+      Eq: "Eq",
+      Geq: "Geq",
+      Gt: "Gt",
+      Leq: "Leq",
+      Lt: "Lt",
+      Neq: "Neq"
+    };
+    var operators = {
+      Add: "Add",
+      And: "And",
+      Assign: "Assign",
+      Cut: "Cut",
+      Debug: "Debug",
+      Div: "Div",
+      Dot: "Dot",
+      ForAll: "ForAll",
+      In: "In",
+      Isa: "Isa",
+      Mod: "Mod",
+      Mul: "Mul",
+      New: "New",
+      Not: "Not",
+      Or: "Or",
+      Print: "Print",
+      Rem: "Rem",
+      Sub: "Sub",
+      Unify: "Unify",
+      ...comparisonOperators
+    };
+    var QueryEventKind;
+    (function(QueryEventKind2) {
+      QueryEventKind2[QueryEventKind2["Debug"] = 0] = "Debug";
+      QueryEventKind2[QueryEventKind2["Done"] = 1] = "Done";
+      QueryEventKind2[QueryEventKind2["ExternalCall"] = 2] = "ExternalCall";
+      QueryEventKind2[QueryEventKind2["ExternalIsa"] = 3] = "ExternalIsa";
+      QueryEventKind2[QueryEventKind2["ExternalIsaWithPath"] = 4] = "ExternalIsaWithPath";
+      QueryEventKind2[QueryEventKind2["ExternalIsSubspecializer"] = 5] = "ExternalIsSubspecializer";
+      QueryEventKind2[QueryEventKind2["ExternalIsSubclass"] = 6] = "ExternalIsSubclass";
+      QueryEventKind2[QueryEventKind2["ExternalOp"] = 7] = "ExternalOp";
+      QueryEventKind2[QueryEventKind2["MakeExternal"] = 8] = "MakeExternal";
+      QueryEventKind2[QueryEventKind2["NextExternal"] = 9] = "NextExternal";
+      QueryEventKind2[QueryEventKind2["Result"] = 10] = "Result";
+    })(QueryEventKind = exports2.QueryEventKind || (exports2.QueryEventKind = {}));
+    function isIterableIterator(x) {
+      return typeof (x === null || x === void 0 ? void 0 : x.next) === "function" && isIterable(x);
+    }
+    exports2.isIterableIterator = isIterableIterator;
+    function isIterable(x) {
+      try {
+        return Symbol.iterator in x;
+      } catch (e) {
+        if (e instanceof TypeError)
+          return false;
+        throw e;
+      }
+    }
+    exports2.isIterable = isIterable;
+    function isAsyncIterable(x) {
+      try {
+        return Symbol.asyncIterator in x;
+      } catch (e) {
+        if (e instanceof TypeError)
+          return false;
+        throw e;
+      }
+    }
+    exports2.isAsyncIterable = isAsyncIterable;
+    var Dict = class extends Object {
+      // eslint-disable-next-line @typescript-eslint/ban-types
+      constructor(obj) {
+        super();
+        if (obj) {
+          Object.assign(this, obj);
+        }
+      }
+    };
+    exports2.Dict = Dict;
+    var UserType = class {
+      constructor({ name, cls, id, fields, isaCheck }) {
+        this.name = name;
+        this.cls = cls;
+        this.fields = fields;
+        this.id = id;
+        this.isaCheck = isaCheck;
+      }
+    };
+    exports2.UserType = UserType;
+  }
+});
+
+// node_modules/.pnpm/lodash.isequal@4.5.0/node_modules/lodash.isequal/index.js
+var require_lodash = __commonJS({
+  "node_modules/.pnpm/lodash.isequal@4.5.0/node_modules/lodash.isequal/index.js"(exports2, module2) {
+    "use strict";
+    var LARGE_ARRAY_SIZE = 200;
+    var HASH_UNDEFINED = "__lodash_hash_undefined__";
+    var COMPARE_PARTIAL_FLAG = 1;
+    var COMPARE_UNORDERED_FLAG = 2;
+    var MAX_SAFE_INTEGER = 9007199254740991;
+    var argsTag = "[object Arguments]";
+    var arrayTag = "[object Array]";
+    var asyncTag = "[object AsyncFunction]";
+    var boolTag = "[object Boolean]";
+    var dateTag = "[object Date]";
+    var errorTag = "[object Error]";
+    var funcTag = "[object Function]";
+    var genTag = "[object GeneratorFunction]";
+    var mapTag = "[object Map]";
+    var numberTag = "[object Number]";
+    var nullTag = "[object Null]";
+    var objectTag = "[object Object]";
+    var promiseTag = "[object Promise]";
+    var proxyTag = "[object Proxy]";
+    var regexpTag = "[object RegExp]";
+    var setTag = "[object Set]";
+    var stringTag = "[object String]";
+    var symbolTag = "[object Symbol]";
+    var undefinedTag = "[object Undefined]";
+    var weakMapTag = "[object WeakMap]";
+    var arrayBufferTag = "[object ArrayBuffer]";
+    var dataViewTag = "[object DataView]";
+    var float32Tag = "[object Float32Array]";
+    var float64Tag = "[object Float64Array]";
+    var int8Tag = "[object Int8Array]";
+    var int16Tag = "[object Int16Array]";
+    var int32Tag = "[object Int32Array]";
+    var uint8Tag = "[object Uint8Array]";
+    var uint8ClampedTag = "[object Uint8ClampedArray]";
+    var uint16Tag = "[object Uint16Array]";
+    var uint32Tag = "[object Uint32Array]";
+    var reRegExpChar = /[\\^$.*+?()[\]{}|]/g;
+    var reIsHostCtor = /^\[object .+?Constructor\]$/;
+    var reIsUint = /^(?:0|[1-9]\d*)$/;
+    var typedArrayTags = {};
+    typedArrayTags[float32Tag] = typedArrayTags[float64Tag] = typedArrayTags[int8Tag] = typedArrayTags[int16Tag] = typedArrayTags[int32Tag] = typedArrayTags[uint8Tag] = typedArrayTags[uint8ClampedTag] = typedArrayTags[uint16Tag] = typedArrayTags[uint32Tag] = true;
+    typedArrayTags[argsTag] = typedArrayTags[arrayTag] = typedArrayTags[arrayBufferTag] = typedArrayTags[boolTag] = typedArrayTags[dataViewTag] = typedArrayTags[dateTag] = typedArrayTags[errorTag] = typedArrayTags[funcTag] = typedArrayTags[mapTag] = typedArrayTags[numberTag] = typedArrayTags[objectTag] = typedArrayTags[regexpTag] = typedArrayTags[setTag] = typedArrayTags[stringTag] = typedArrayTags[weakMapTag] = false;
+    var freeGlobal = typeof global == "object" && global && global.Object === Object && global;
+    var freeSelf = typeof self == "object" && self && self.Object === Object && self;
+    var root = freeGlobal || freeSelf || Function("return this")();
+    var freeExports = typeof exports2 == "object" && exports2 && !exports2.nodeType && exports2;
+    var freeModule = freeExports && typeof module2 == "object" && module2 && !module2.nodeType && module2;
+    var moduleExports = freeModule && freeModule.exports === freeExports;
+    var freeProcess = moduleExports && freeGlobal.process;
+    var nodeUtil = (function() {
+      try {
+        return freeProcess && freeProcess.binding && freeProcess.binding("util");
+      } catch (e) {
+      }
+    })();
+    var nodeIsTypedArray = nodeUtil && nodeUtil.isTypedArray;
+    function arrayFilter(array, predicate) {
+      var index = -1, length = array == null ? 0 : array.length, resIndex = 0, result = [];
+      while (++index < length) {
+        var value = array[index];
+        if (predicate(value, index, array)) {
+          result[resIndex++] = value;
+        }
+      }
+      return result;
+    }
+    function arrayPush(array, values) {
+      var index = -1, length = values.length, offset = array.length;
+      while (++index < length) {
+        array[offset + index] = values[index];
+      }
+      return array;
+    }
+    function arraySome(array, predicate) {
+      var index = -1, length = array == null ? 0 : array.length;
+      while (++index < length) {
+        if (predicate(array[index], index, array)) {
+          return true;
+        }
+      }
+      return false;
+    }
+    function baseTimes(n, iteratee) {
+      var index = -1, result = Array(n);
+      while (++index < n) {
+        result[index] = iteratee(index);
+      }
+      return result;
+    }
+    function baseUnary(func) {
+      return function(value) {
+        return func(value);
+      };
+    }
+    function cacheHas(cache, key) {
+      return cache.has(key);
+    }
+    function getValue(object, key) {
+      return object == null ? void 0 : object[key];
+    }
+    function mapToArray(map) {
+      var index = -1, result = Array(map.size);
+      map.forEach(function(value, key) {
+        result[++index] = [key, value];
+      });
+      return result;
+    }
+    function overArg(func, transform) {
+      return function(arg) {
+        return func(transform(arg));
+      };
+    }
+    function setToArray(set) {
+      var index = -1, result = Array(set.size);
+      set.forEach(function(value) {
+        result[++index] = value;
+      });
+      return result;
+    }
+    var arrayProto = Array.prototype;
+    var funcProto = Function.prototype;
+    var objectProto = Object.prototype;
+    var coreJsData = root["__core-js_shared__"];
+    var funcToString = funcProto.toString;
+    var hasOwnProperty = objectProto.hasOwnProperty;
+    var maskSrcKey = (function() {
+      var uid = /[^.]+$/.exec(coreJsData && coreJsData.keys && coreJsData.keys.IE_PROTO || "");
+      return uid ? "Symbol(src)_1." + uid : "";
+    })();
+    var nativeObjectToString = objectProto.toString;
+    var reIsNative = RegExp(
+      "^" + funcToString.call(hasOwnProperty).replace(reRegExpChar, "\\$&").replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, "$1.*?") + "$"
+    );
+    var Buffer2 = moduleExports ? root.Buffer : void 0;
+    var Symbol2 = root.Symbol;
+    var Uint8Array2 = root.Uint8Array;
+    var propertyIsEnumerable = objectProto.propertyIsEnumerable;
+    var splice = arrayProto.splice;
+    var symToStringTag = Symbol2 ? Symbol2.toStringTag : void 0;
+    var nativeGetSymbols = Object.getOwnPropertySymbols;
+    var nativeIsBuffer = Buffer2 ? Buffer2.isBuffer : void 0;
+    var nativeKeys = overArg(Object.keys, Object);
+    var DataView = getNative(root, "DataView");
+    var Map2 = getNative(root, "Map");
+    var Promise2 = getNative(root, "Promise");
+    var Set2 = getNative(root, "Set");
+    var WeakMap2 = getNative(root, "WeakMap");
+    var nativeCreate = getNative(Object, "create");
+    var dataViewCtorString = toSource(DataView);
+    var mapCtorString = toSource(Map2);
+    var promiseCtorString = toSource(Promise2);
+    var setCtorString = toSource(Set2);
+    var weakMapCtorString = toSource(WeakMap2);
+    var symbolProto = Symbol2 ? Symbol2.prototype : void 0;
+    var symbolValueOf = symbolProto ? symbolProto.valueOf : void 0;
+    function Hash(entries) {
+      var index = -1, length = entries == null ? 0 : entries.length;
+      this.clear();
+      while (++index < length) {
+        var entry = entries[index];
+        this.set(entry[0], entry[1]);
+      }
+    }
+    function hashClear() {
+      this.__data__ = nativeCreate ? nativeCreate(null) : {};
+      this.size = 0;
+    }
+    function hashDelete(key) {
+      var result = this.has(key) && delete this.__data__[key];
+      this.size -= result ? 1 : 0;
+      return result;
+    }
+    function hashGet(key) {
+      var data = this.__data__;
+      if (nativeCreate) {
+        var result = data[key];
+        return result === HASH_UNDEFINED ? void 0 : result;
+      }
+      return hasOwnProperty.call(data, key) ? data[key] : void 0;
+    }
+    function hashHas(key) {
+      var data = this.__data__;
+      return nativeCreate ? data[key] !== void 0 : hasOwnProperty.call(data, key);
+    }
+    function hashSet(key, value) {
+      var data = this.__data__;
+      this.size += this.has(key) ? 0 : 1;
+      data[key] = nativeCreate && value === void 0 ? HASH_UNDEFINED : value;
+      return this;
+    }
+    Hash.prototype.clear = hashClear;
+    Hash.prototype["delete"] = hashDelete;
+    Hash.prototype.get = hashGet;
+    Hash.prototype.has = hashHas;
+    Hash.prototype.set = hashSet;
+    function ListCache(entries) {
+      var index = -1, length = entries == null ? 0 : entries.length;
+      this.clear();
+      while (++index < length) {
+        var entry = entries[index];
+        this.set(entry[0], entry[1]);
+      }
+    }
+    function listCacheClear() {
+      this.__data__ = [];
+      this.size = 0;
+    }
+    function listCacheDelete(key) {
+      var data = this.__data__, index = assocIndexOf(data, key);
+      if (index < 0) {
+        return false;
+      }
+      var lastIndex = data.length - 1;
+      if (index == lastIndex) {
+        data.pop();
+      } else {
+        splice.call(data, index, 1);
+      }
+      --this.size;
+      return true;
+    }
+    function listCacheGet(key) {
+      var data = this.__data__, index = assocIndexOf(data, key);
+      return index < 0 ? void 0 : data[index][1];
+    }
+    function listCacheHas(key) {
+      return assocIndexOf(this.__data__, key) > -1;
+    }
+    function listCacheSet(key, value) {
+      var data = this.__data__, index = assocIndexOf(data, key);
+      if (index < 0) {
+        ++this.size;
+        data.push([key, value]);
+      } else {
+        data[index][1] = value;
+      }
+      return this;
+    }
+    ListCache.prototype.clear = listCacheClear;
+    ListCache.prototype["delete"] = listCacheDelete;
+    ListCache.prototype.get = listCacheGet;
+    ListCache.prototype.has = listCacheHas;
+    ListCache.prototype.set = listCacheSet;
+    function MapCache(entries) {
+      var index = -1, length = entries == null ? 0 : entries.length;
+      this.clear();
+      while (++index < length) {
+        var entry = entries[index];
+        this.set(entry[0], entry[1]);
+      }
+    }
+    function mapCacheClear() {
+      this.size = 0;
+      this.__data__ = {
+        "hash": new Hash(),
+        "map": new (Map2 || ListCache)(),
+        "string": new Hash()
+      };
+    }
+    function mapCacheDelete(key) {
+      var result = getMapData(this, key)["delete"](key);
+      this.size -= result ? 1 : 0;
+      return result;
+    }
+    function mapCacheGet(key) {
+      return getMapData(this, key).get(key);
+    }
+    function mapCacheHas(key) {
+      return getMapData(this, key).has(key);
+    }
+    function mapCacheSet(key, value) {
+      var data = getMapData(this, key), size = data.size;
+      data.set(key, value);
+      this.size += data.size == size ? 0 : 1;
+      return this;
+    }
+    MapCache.prototype.clear = mapCacheClear;
+    MapCache.prototype["delete"] = mapCacheDelete;
+    MapCache.prototype.get = mapCacheGet;
+    MapCache.prototype.has = mapCacheHas;
+    MapCache.prototype.set = mapCacheSet;
+    function SetCache(values) {
+      var index = -1, length = values == null ? 0 : values.length;
+      this.__data__ = new MapCache();
+      while (++index < length) {
+        this.add(values[index]);
+      }
+    }
+    function setCacheAdd(value) {
+      this.__data__.set(value, HASH_UNDEFINED);
+      return this;
+    }
+    function setCacheHas(value) {
+      return this.__data__.has(value);
+    }
+    SetCache.prototype.add = SetCache.prototype.push = setCacheAdd;
+    SetCache.prototype.has = setCacheHas;
+    function Stack(entries) {
+      var data = this.__data__ = new ListCache(entries);
+      this.size = data.size;
+    }
+    function stackClear() {
+      this.__data__ = new ListCache();
+      this.size = 0;
+    }
+    function stackDelete(key) {
+      var data = this.__data__, result = data["delete"](key);
+      this.size = data.size;
+      return result;
+    }
+    function stackGet(key) {
+      return this.__data__.get(key);
+    }
+    function stackHas(key) {
+      return this.__data__.has(key);
+    }
+    function stackSet(key, value) {
+      var data = this.__data__;
+      if (data instanceof ListCache) {
+        var pairs = data.__data__;
+        if (!Map2 || pairs.length < LARGE_ARRAY_SIZE - 1) {
+          pairs.push([key, value]);
+          this.size = ++data.size;
+          return this;
+        }
+        data = this.__data__ = new MapCache(pairs);
+      }
+      data.set(key, value);
+      this.size = data.size;
+      return this;
+    }
+    Stack.prototype.clear = stackClear;
+    Stack.prototype["delete"] = stackDelete;
+    Stack.prototype.get = stackGet;
+    Stack.prototype.has = stackHas;
+    Stack.prototype.set = stackSet;
+    function arrayLikeKeys(value, inherited) {
+      var isArr = isArray(value), isArg = !isArr && isArguments(value), isBuff = !isArr && !isArg && isBuffer(value), isType = !isArr && !isArg && !isBuff && isTypedArray(value), skipIndexes = isArr || isArg || isBuff || isType, result = skipIndexes ? baseTimes(value.length, String) : [], length = result.length;
+      for (var key in value) {
+        if ((inherited || hasOwnProperty.call(value, key)) && !(skipIndexes && // Safari 9 has enumerable `arguments.length` in strict mode.
+        (key == "length" || // Node.js 0.10 has enumerable non-index properties on buffers.
+        isBuff && (key == "offset" || key == "parent") || // PhantomJS 2 has enumerable non-index properties on typed arrays.
+        isType && (key == "buffer" || key == "byteLength" || key == "byteOffset") || // Skip index properties.
+        isIndex(key, length)))) {
+          result.push(key);
+        }
+      }
+      return result;
+    }
+    function assocIndexOf(array, key) {
+      var length = array.length;
+      while (length--) {
+        if (eq(array[length][0], key)) {
+          return length;
+        }
+      }
+      return -1;
+    }
+    function baseGetAllKeys(object, keysFunc, symbolsFunc) {
+      var result = keysFunc(object);
+      return isArray(object) ? result : arrayPush(result, symbolsFunc(object));
+    }
+    function baseGetTag(value) {
+      if (value == null) {
+        return value === void 0 ? undefinedTag : nullTag;
+      }
+      return symToStringTag && symToStringTag in Object(value) ? getRawTag(value) : objectToString(value);
+    }
+    function baseIsArguments(value) {
+      return isObjectLike(value) && baseGetTag(value) == argsTag;
+    }
+    function baseIsEqual(value, other, bitmask, customizer, stack) {
+      if (value === other) {
+        return true;
+      }
+      if (value == null || other == null || !isObjectLike(value) && !isObjectLike(other)) {
+        return value !== value && other !== other;
+      }
+      return baseIsEqualDeep(value, other, bitmask, customizer, baseIsEqual, stack);
+    }
+    function baseIsEqualDeep(object, other, bitmask, customizer, equalFunc, stack) {
+      var objIsArr = isArray(object), othIsArr = isArray(other), objTag = objIsArr ? arrayTag : getTag(object), othTag = othIsArr ? arrayTag : getTag(other);
+      objTag = objTag == argsTag ? objectTag : objTag;
+      othTag = othTag == argsTag ? objectTag : othTag;
+      var objIsObj = objTag == objectTag, othIsObj = othTag == objectTag, isSameTag = objTag == othTag;
+      if (isSameTag && isBuffer(object)) {
+        if (!isBuffer(other)) {
+          return false;
+        }
+        objIsArr = true;
+        objIsObj = false;
+      }
+      if (isSameTag && !objIsObj) {
+        stack || (stack = new Stack());
+        return objIsArr || isTypedArray(object) ? equalArrays(object, other, bitmask, customizer, equalFunc, stack) : equalByTag(object, other, objTag, bitmask, customizer, equalFunc, stack);
+      }
+      if (!(bitmask & COMPARE_PARTIAL_FLAG)) {
+        var objIsWrapped = objIsObj && hasOwnProperty.call(object, "__wrapped__"), othIsWrapped = othIsObj && hasOwnProperty.call(other, "__wrapped__");
+        if (objIsWrapped || othIsWrapped) {
+          var objUnwrapped = objIsWrapped ? object.value() : object, othUnwrapped = othIsWrapped ? other.value() : other;
+          stack || (stack = new Stack());
+          return equalFunc(objUnwrapped, othUnwrapped, bitmask, customizer, stack);
+        }
+      }
+      if (!isSameTag) {
+        return false;
+      }
+      stack || (stack = new Stack());
+      return equalObjects(object, other, bitmask, customizer, equalFunc, stack);
+    }
+    function baseIsNative(value) {
+      if (!isObject(value) || isMasked(value)) {
+        return false;
+      }
+      var pattern = isFunction(value) ? reIsNative : reIsHostCtor;
+      return pattern.test(toSource(value));
+    }
+    function baseIsTypedArray(value) {
+      return isObjectLike(value) && isLength(value.length) && !!typedArrayTags[baseGetTag(value)];
+    }
+    function baseKeys(object) {
+      if (!isPrototype(object)) {
+        return nativeKeys(object);
+      }
+      var result = [];
+      for (var key in Object(object)) {
+        if (hasOwnProperty.call(object, key) && key != "constructor") {
+          result.push(key);
+        }
+      }
+      return result;
+    }
+    function equalArrays(array, other, bitmask, customizer, equalFunc, stack) {
+      var isPartial = bitmask & COMPARE_PARTIAL_FLAG, arrLength = array.length, othLength = other.length;
+      if (arrLength != othLength && !(isPartial && othLength > arrLength)) {
+        return false;
+      }
+      var stacked = stack.get(array);
+      if (stacked && stack.get(other)) {
+        return stacked == other;
+      }
+      var index = -1, result = true, seen = bitmask & COMPARE_UNORDERED_FLAG ? new SetCache() : void 0;
+      stack.set(array, other);
+      stack.set(other, array);
+      while (++index < arrLength) {
+        var arrValue = array[index], othValue = other[index];
+        if (customizer) {
+          var compared = isPartial ? customizer(othValue, arrValue, index, other, array, stack) : customizer(arrValue, othValue, index, array, other, stack);
+        }
+        if (compared !== void 0) {
+          if (compared) {
+            continue;
+          }
+          result = false;
+          break;
+        }
+        if (seen) {
+          if (!arraySome(other, function(othValue2, othIndex) {
+            if (!cacheHas(seen, othIndex) && (arrValue === othValue2 || equalFunc(arrValue, othValue2, bitmask, customizer, stack))) {
+              return seen.push(othIndex);
+            }
+          })) {
+            result = false;
+            break;
+          }
+        } else if (!(arrValue === othValue || equalFunc(arrValue, othValue, bitmask, customizer, stack))) {
+          result = false;
+          break;
+        }
+      }
+      stack["delete"](array);
+      stack["delete"](other);
+      return result;
+    }
+    function equalByTag(object, other, tag, bitmask, customizer, equalFunc, stack) {
+      switch (tag) {
+        case dataViewTag:
+          if (object.byteLength != other.byteLength || object.byteOffset != other.byteOffset) {
+            return false;
+          }
+          object = object.buffer;
+          other = other.buffer;
+        case arrayBufferTag:
+          if (object.byteLength != other.byteLength || !equalFunc(new Uint8Array2(object), new Uint8Array2(other))) {
+            return false;
+          }
+          return true;
+        case boolTag:
+        case dateTag:
+        case numberTag:
+          return eq(+object, +other);
+        case errorTag:
+          return object.name == other.name && object.message == other.message;
+        case regexpTag:
+        case stringTag:
+          return object == other + "";
+        case mapTag:
+          var convert = mapToArray;
+        case setTag:
+          var isPartial = bitmask & COMPARE_PARTIAL_FLAG;
+          convert || (convert = setToArray);
+          if (object.size != other.size && !isPartial) {
+            return false;
+          }
+          var stacked = stack.get(object);
+          if (stacked) {
+            return stacked == other;
+          }
+          bitmask |= COMPARE_UNORDERED_FLAG;
+          stack.set(object, other);
+          var result = equalArrays(convert(object), convert(other), bitmask, customizer, equalFunc, stack);
+          stack["delete"](object);
+          return result;
+        case symbolTag:
+          if (symbolValueOf) {
+            return symbolValueOf.call(object) == symbolValueOf.call(other);
+          }
+      }
+      return false;
+    }
+    function equalObjects(object, other, bitmask, customizer, equalFunc, stack) {
+      var isPartial = bitmask & COMPARE_PARTIAL_FLAG, objProps = getAllKeys(object), objLength = objProps.length, othProps = getAllKeys(other), othLength = othProps.length;
+      if (objLength != othLength && !isPartial) {
+        return false;
+      }
+      var index = objLength;
+      while (index--) {
+        var key = objProps[index];
+        if (!(isPartial ? key in other : hasOwnProperty.call(other, key))) {
+          return false;
+        }
+      }
+      var stacked = stack.get(object);
+      if (stacked && stack.get(other)) {
+        return stacked == other;
+      }
+      var result = true;
+      stack.set(object, other);
+      stack.set(other, object);
+      var skipCtor = isPartial;
+      while (++index < objLength) {
+        key = objProps[index];
+        var objValue = object[key], othValue = other[key];
+        if (customizer) {
+          var compared = isPartial ? customizer(othValue, objValue, key, other, object, stack) : customizer(objValue, othValue, key, object, other, stack);
+        }
+        if (!(compared === void 0 ? objValue === othValue || equalFunc(objValue, othValue, bitmask, customizer, stack) : compared)) {
+          result = false;
+          break;
+        }
+        skipCtor || (skipCtor = key == "constructor");
+      }
+      if (result && !skipCtor) {
+        var objCtor = object.constructor, othCtor = other.constructor;
+        if (objCtor != othCtor && ("constructor" in object && "constructor" in other) && !(typeof objCtor == "function" && objCtor instanceof objCtor && typeof othCtor == "function" && othCtor instanceof othCtor)) {
+          result = false;
+        }
+      }
+      stack["delete"](object);
+      stack["delete"](other);
+      return result;
+    }
+    function getAllKeys(object) {
+      return baseGetAllKeys(object, keys, getSymbols);
+    }
+    function getMapData(map, key) {
+      var data = map.__data__;
+      return isKeyable(key) ? data[typeof key == "string" ? "string" : "hash"] : data.map;
+    }
+    function getNative(object, key) {
+      var value = getValue(object, key);
+      return baseIsNative(value) ? value : void 0;
+    }
+    function getRawTag(value) {
+      var isOwn = hasOwnProperty.call(value, symToStringTag), tag = value[symToStringTag];
+      try {
+        value[symToStringTag] = void 0;
+        var unmasked = true;
+      } catch (e) {
+      }
+      var result = nativeObjectToString.call(value);
+      if (unmasked) {
+        if (isOwn) {
+          value[symToStringTag] = tag;
+        } else {
+          delete value[symToStringTag];
+        }
+      }
+      return result;
+    }
+    var getSymbols = !nativeGetSymbols ? stubArray : function(object) {
+      if (object == null) {
+        return [];
+      }
+      object = Object(object);
+      return arrayFilter(nativeGetSymbols(object), function(symbol) {
+        return propertyIsEnumerable.call(object, symbol);
+      });
+    };
+    var getTag = baseGetTag;
+    if (DataView && getTag(new DataView(new ArrayBuffer(1))) != dataViewTag || Map2 && getTag(new Map2()) != mapTag || Promise2 && getTag(Promise2.resolve()) != promiseTag || Set2 && getTag(new Set2()) != setTag || WeakMap2 && getTag(new WeakMap2()) != weakMapTag) {
+      getTag = function(value) {
+        var result = baseGetTag(value), Ctor = result == objectTag ? value.constructor : void 0, ctorString = Ctor ? toSource(Ctor) : "";
+        if (ctorString) {
+          switch (ctorString) {
+            case dataViewCtorString:
+              return dataViewTag;
+            case mapCtorString:
+              return mapTag;
+            case promiseCtorString:
+              return promiseTag;
+            case setCtorString:
+              return setTag;
+            case weakMapCtorString:
+              return weakMapTag;
+          }
+        }
+        return result;
+      };
+    }
+    function isIndex(value, length) {
+      length = length == null ? MAX_SAFE_INTEGER : length;
+      return !!length && (typeof value == "number" || reIsUint.test(value)) && (value > -1 && value % 1 == 0 && value < length);
+    }
+    function isKeyable(value) {
+      var type = typeof value;
+      return type == "string" || type == "number" || type == "symbol" || type == "boolean" ? value !== "__proto__" : value === null;
+    }
+    function isMasked(func) {
+      return !!maskSrcKey && maskSrcKey in func;
+    }
+    function isPrototype(value) {
+      var Ctor = value && value.constructor, proto = typeof Ctor == "function" && Ctor.prototype || objectProto;
+      return value === proto;
+    }
+    function objectToString(value) {
+      return nativeObjectToString.call(value);
+    }
+    function toSource(func) {
+      if (func != null) {
+        try {
+          return funcToString.call(func);
+        } catch (e) {
+        }
+        try {
+          return func + "";
+        } catch (e) {
+        }
+      }
+      return "";
+    }
+    function eq(value, other) {
+      return value === other || value !== value && other !== other;
+    }
+    var isArguments = baseIsArguments(/* @__PURE__ */ (function() {
+      return arguments;
+    })()) ? baseIsArguments : function(value) {
+      return isObjectLike(value) && hasOwnProperty.call(value, "callee") && !propertyIsEnumerable.call(value, "callee");
+    };
+    var isArray = Array.isArray;
+    function isArrayLike(value) {
+      return value != null && isLength(value.length) && !isFunction(value);
+    }
+    var isBuffer = nativeIsBuffer || stubFalse;
+    function isEqual(value, other) {
+      return baseIsEqual(value, other);
+    }
+    function isFunction(value) {
+      if (!isObject(value)) {
+        return false;
+      }
+      var tag = baseGetTag(value);
+      return tag == funcTag || tag == genTag || tag == asyncTag || tag == proxyTag;
+    }
+    function isLength(value) {
+      return typeof value == "number" && value > -1 && value % 1 == 0 && value <= MAX_SAFE_INTEGER;
+    }
+    function isObject(value) {
+      var type = typeof value;
+      return value != null && (type == "object" || type == "function");
+    }
+    function isObjectLike(value) {
+      return value != null && typeof value == "object";
+    }
+    var isTypedArray = nodeIsTypedArray ? baseUnary(nodeIsTypedArray) : baseIsTypedArray;
+    function keys(object) {
+      return isArrayLike(object) ? arrayLikeKeys(object) : baseKeys(object);
+    }
+    function stubArray() {
+      return [];
+    }
+    function stubFalse() {
+      return false;
+    }
+    module2.exports = isEqual;
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/helpers.js
+var require_helpers = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/helpers.js"(exports2) {
+    "use strict";
+    var _a;
+    var _b;
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.isString = exports2.defaultEqualityFn = exports2.isObj = exports2.isConstructor = exports2.printError = exports2.PROMPT = exports2.readFile = exports2.parseQueryEvent = exports2.repr = exports2.ancestors = void 0;
+    var util_1 = require("util");
+    var fs_1 = require("fs");
+    var errors_1 = require_errors();
+    var types_1 = require_types();
+    var isEqual = require_lodash();
+    function ancestors(cls) {
+      if (!isConstructor(cls))
+        return [];
+      const ancestors2 = [cls];
+      function next(current) {
+        const parent = Object.getPrototypeOf(current);
+        if (parent === Function.prototype)
+          return;
+        if (!isConstructor(parent))
+          return;
+        ancestors2.push(parent);
+        next(parent);
+      }
+      next(cls);
+      return ancestors2;
+    }
+    exports2.ancestors = ancestors;
+    function repr(x) {
+      return util_1.inspect(x);
+    }
+    exports2.repr = repr;
+    function parseQueryEvent(event) {
+      try {
+        if (exports2.isString(event))
+          throw new Error();
+        switch (true) {
+          case event["Done"] !== void 0:
+            return { kind: types_1.QueryEventKind.Done };
+          case event["Result"] !== void 0:
+            return parseResult(event["Result"]);
+          case event["MakeExternal"] !== void 0:
+            return parseMakeExternal(event["MakeExternal"]);
+          case event["NextExternal"] !== void 0:
+            return parseNextExternal(event["NextExternal"]);
+          case event["ExternalCall"] !== void 0:
+            return parseExternalCall(event["ExternalCall"]);
+          case event["ExternalIsSubSpecializer"] !== void 0:
+            return parseExternalIsSubspecializer(event["ExternalIsSubSpecializer"]);
+          case event["ExternalIsSubclass"] !== void 0:
+            return parseExternalIsSubclass(event["ExternalIsSubclass"]);
+          case event["ExternalIsa"] !== void 0:
+            return parseExternalIsa(event["ExternalIsa"]);
+          case event["ExternalIsaWithPath"] !== void 0:
+            return parseExternalIsaWithPath(event["ExternalIsaWithPath"]);
+          case event["Debug"] !== void 0:
+            return parseDebug(event["Debug"]);
+          case event["ExternalOp"] !== void 0:
+            return parseExternalOp(event["ExternalOp"]);
+          default:
+            throw new Error();
+        }
+      } catch (e) {
+        if (e instanceof errors_1.PolarError)
+          throw e;
+        throw new errors_1.InvalidQueryEventError(JSON.stringify(event));
+      }
+    }
+    exports2.parseQueryEvent = parseQueryEvent;
+    function parseResult(event) {
+      if (!isObj(event))
+        throw new Error();
+      const { bindings } = event;
+      if (!isMapOfPolarTerms(bindings))
+        throw new Error();
+      return { kind: types_1.QueryEventKind.Result, data: { bindings } };
+    }
+    function parseMakeExternal(event) {
+      if (!isObj(event))
+        throw new Error();
+      const { instance_id: instanceId } = event;
+      if (!isSafeInteger(instanceId))
+        throw new Error();
+      const ctor = event["constructor"];
+      if (!types_1.isPolarTerm(ctor))
+        throw new Error();
+      if (!types_1.isPolarPredicate(ctor.value))
+        throw new Error();
+      if (ctor.value.Call.kwargs)
+        throw new errors_1.KwargsError();
+      const { name: tag, args: fields } = ctor.value.Call;
+      if (!exports2.isString(tag))
+        throw new Error();
+      if (!isArrayOf(fields, types_1.isPolarTerm))
+        throw new Error();
+      return {
+        kind: types_1.QueryEventKind.MakeExternal,
+        data: { fields, instanceId, tag }
+      };
+    }
+    function parseNextExternal(event) {
+      if (!isObj(event))
+        throw new Error();
+      const { call_id: callId, iterable } = event;
+      if (!isSafeInteger(callId))
+        throw new Error();
+      if (!types_1.isPolarTerm(iterable))
+        throw new Error();
+      return { kind: types_1.QueryEventKind.NextExternal, data: { callId, iterable } };
+    }
+    function parseExternalCall(event) {
+      if (!isObj(event))
+        throw new Error();
+      const { args, kwargs, attribute, call_id: callId, instance } = event;
+      if (args !== void 0 && !isArrayOf(args, types_1.isPolarTerm))
+        throw new Error();
+      if (kwargs)
+        throw new errors_1.KwargsError();
+      if (!exports2.isString(attribute))
+        throw new Error();
+      if (!isSafeInteger(callId))
+        throw new Error();
+      if (!types_1.isPolarTerm(instance))
+        throw new Error();
+      return {
+        kind: types_1.QueryEventKind.ExternalCall,
+        data: { args, attribute, callId, instance }
+      };
+    }
+    function parseExternalIsSubspecializer(event) {
+      if (!isObj(event))
+        throw new Error();
+      const { call_id: callId, instance_id: instanceId, left_class_tag: leftTag, right_class_tag: rightTag } = event;
+      if (!isSafeInteger(callId))
+        throw new Error();
+      if (!isSafeInteger(instanceId))
+        throw new Error();
+      if (!exports2.isString(leftTag))
+        throw new Error();
+      if (!exports2.isString(rightTag))
+        throw new Error();
+      return {
+        kind: types_1.QueryEventKind.ExternalIsSubspecializer,
+        data: { callId, instanceId, leftTag, rightTag }
+      };
+    }
+    function parseExternalIsSubclass(event) {
+      if (!isObj(event))
+        throw new Error();
+      const { call_id: callId, left_class_tag: leftTag, right_class_tag: rightTag } = event;
+      if (!isSafeInteger(callId))
+        throw new Error();
+      if (!exports2.isString(leftTag))
+        throw new Error();
+      if (!exports2.isString(rightTag))
+        throw new Error();
+      return {
+        kind: types_1.QueryEventKind.ExternalIsSubclass,
+        data: { callId, leftTag, rightTag }
+      };
+    }
+    function parseExternalIsa(event) {
+      if (!isObj(event))
+        throw new Error();
+      const { call_id: callId, instance, class_tag: tag } = event;
+      if (!isSafeInteger(callId))
+        throw new Error();
+      if (!types_1.isPolarTerm(instance))
+        throw new Error();
+      if (!exports2.isString(tag))
+        throw new Error();
+      return { kind: types_1.QueryEventKind.ExternalIsa, data: { callId, instance, tag } };
+    }
+    function parseExternalIsaWithPath(event) {
+      if (!isObj(event))
+        throw new Error();
+      const { path, call_id: callId, base_tag: baseTag, class_tag: classTag } = event;
+      if (!isSafeInteger(callId))
+        throw new Error();
+      if (!exports2.isString(baseTag))
+        throw new Error();
+      if (!exports2.isString(classTag))
+        throw new Error();
+      if (!isArrayOf(path, types_1.isPolarTerm))
+        throw new Error();
+      return {
+        kind: types_1.QueryEventKind.ExternalIsaWithPath,
+        data: { callId, baseTag, path, classTag }
+      };
+    }
+    function parseExternalOp(event) {
+      if (!isObj(event))
+        throw new Error();
+      const { call_id: callId, args, operator } = event;
+      if (!isSafeInteger(callId))
+        throw new Error();
+      if (!isArrayOf(args, types_1.isPolarTerm) || args.length !== 2)
+        throw new Error();
+      if (!exports2.isString(operator))
+        throw new Error();
+      if (!types_1.isPolarComparisonOperator(operator))
+        throw new errors_1.PolarError(`Unsupported external operation '${repr(args[0])} ${operator} ${repr(args[1])}'`);
+      return { kind: types_1.QueryEventKind.ExternalOp, data: { args, callId, operator } };
+    }
+    function parseDebug(event) {
+      if (!isObj(event))
+        throw new Error();
+      const { message } = event;
+      if (!exports2.isString(message))
+        throw new Error();
+      return { kind: types_1.QueryEventKind.Debug, data: { message } };
+    }
+    function readFile(file) {
+      return new Promise((res, rej) => fs_1.readFile(file, { encoding: "utf8" }, (err, contents) => err === null ? res(contents) : rej(err)));
+    }
+    exports2.readFile = readFile;
+    var RESET = "";
+    var FG_BLUE = "";
+    var FG_RED = "";
+    if (typeof ((_a = process === null || process === void 0 ? void 0 : process.stdout) === null || _a === void 0 ? void 0 : _a.getColorDepth) === "function" && process.stdout.getColorDepth() >= 4 && typeof ((_b = process === null || process === void 0 ? void 0 : process.stderr) === null || _b === void 0 ? void 0 : _b.getColorDepth) === "function" && process.stderr.getColorDepth() >= 4) {
+      RESET = "\x1B[0m";
+      FG_BLUE = "\x1B[34m";
+      FG_RED = "\x1B[31m";
+    }
+    exports2.PROMPT = FG_BLUE + "query> " + RESET;
+    function printError(e) {
+      console.error(FG_RED + e.name + RESET);
+      console.error(e.message);
+    }
+    exports2.printError = printError;
+    function isConstructor(f) {
+      try {
+        Reflect.construct(String, [], f);
+        return true;
+      } catch (e) {
+        return false;
+      }
+    }
+    exports2.isConstructor = isConstructor;
+    function isObj(x) {
+      return typeof x === "object" && x !== null;
+    }
+    exports2.isObj = isObj;
+    function defaultEqualityFn(a, b) {
+      return isEqual(a, b);
+    }
+    exports2.defaultEqualityFn = defaultEqualityFn;
+    var isString = (x) => typeof x === "string";
+    exports2.isString = isString;
+    var isMapOfPolarTerms = (x) => x instanceof Map && [...x.keys()].every(exports2.isString) && [...x.values()].every(types_1.isPolarTerm);
+    var isArrayOf = (x, p) => Array.isArray(x) && x.every(p);
+    function isSafeInteger(x) {
+      return Number.isSafeInteger(x);
+    }
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/errors.js
+var require_errors = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/errors.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.UnexpectedExpressionError = exports2.DataFilteringConfigurationError = exports2.UnregisteredInstanceError = exports2.UnregisteredClassError = exports2.PolarFileNotFoundError = exports2.PolarFileExtensionError = exports2.KwargsError = exports2.InvalidQueryEventError = exports2.InvalidConstructorError = exports2.InvalidIteratorError = exports2.InvalidCallError = exports2.InvalidAttributeError = exports2.InlineQueryFailedError = exports2.DuplicateInstanceRegistrationError = exports2.DuplicateClassAliasError = exports2.PolarError = exports2.ForbiddenError = exports2.NotFoundError = exports2.AuthorizationError = exports2.OsoError = void 0;
+    var helpers_1 = require_helpers();
+    var OsoError = class extends Error {
+      constructor(message) {
+        super(message);
+      }
+    };
+    exports2.OsoError = OsoError;
+    var AuthorizationError = class extends OsoError {
+    };
+    exports2.AuthorizationError = AuthorizationError;
+    var NotFoundError = class extends AuthorizationError {
+      constructor() {
+        super("Oso NotFoundError -- The current user does not have permission to read the given resource. You should handle this error by returning a 404 error to the client.");
+      }
+    };
+    exports2.NotFoundError = NotFoundError;
+    var ForbiddenError = class extends AuthorizationError {
+      constructor() {
+        super("Oso ForbiddenError -- The requested action was not allowed for the given resource. You should handle this error by returning a 403 error to the client.");
+      }
+    };
+    exports2.ForbiddenError = ForbiddenError;
+    var PolarError = class extends OsoError {
+    };
+    exports2.PolarError = PolarError;
+    var DuplicateClassAliasError = class extends PolarError {
+      constructor({ name, cls, existing }) {
+        super(`Attempted to alias ${cls.name} as '${name}', but ${existing.name} already has that alias.`);
+      }
+    };
+    exports2.DuplicateClassAliasError = DuplicateClassAliasError;
+    var DuplicateInstanceRegistrationError = class extends PolarError {
+      constructor(id) {
+        super(`Attempted to register instance ${id}, but an instance with that ID already exists.`);
+      }
+    };
+    exports2.DuplicateInstanceRegistrationError = DuplicateInstanceRegistrationError;
+    var InlineQueryFailedError = class extends PolarError {
+      constructor(source) {
+        super(`Inline query failed: ${source}`);
+      }
+    };
+    exports2.InlineQueryFailedError = InlineQueryFailedError;
+    var InvalidAttributeError = class extends PolarError {
+      constructor(instance, field) {
+        super(`${field} not found on ${helpers_1.repr(instance)}.`);
+      }
+    };
+    exports2.InvalidAttributeError = InvalidAttributeError;
+    var InvalidCallError = class extends PolarError {
+      constructor(instance, field) {
+        super(`${helpers_1.repr(instance)}.${field} is not a function`);
+      }
+    };
+    exports2.InvalidCallError = InvalidCallError;
+    var InvalidIteratorError = class extends PolarError {
+      constructor(term) {
+        super(`${helpers_1.repr(term)} is not iterable`);
+      }
+    };
+    exports2.InvalidIteratorError = InvalidIteratorError;
+    var InvalidConstructorError = class extends PolarError {
+      constructor(ctor) {
+        super(`${helpers_1.repr(ctor)} is not a constructor`);
+      }
+    };
+    exports2.InvalidConstructorError = InvalidConstructorError;
+    var InvalidQueryEventError = class extends PolarError {
+      constructor(event) {
+        super(`Invalid query event: ${event}`);
+      }
+    };
+    exports2.InvalidQueryEventError = InvalidQueryEventError;
+    var KwargsError = class extends PolarError {
+      constructor() {
+        super("JavaScript does not support keyword arguments");
+      }
+    };
+    exports2.KwargsError = KwargsError;
+    var PolarFileExtensionError = class extends PolarError {
+      constructor(file) {
+        super(`Polar files must have .polar extension. Offending file: ${file}`);
+      }
+    };
+    exports2.PolarFileExtensionError = PolarFileExtensionError;
+    var PolarFileNotFoundError = class extends PolarError {
+      constructor(file) {
+        super(`Could not find file: ${file}`);
+      }
+    };
+    exports2.PolarFileNotFoundError = PolarFileNotFoundError;
+    var UnregisteredClassError = class extends PolarError {
+      constructor(name) {
+        super(`Unregistered class: ${name}.`);
+      }
+    };
+    exports2.UnregisteredClassError = UnregisteredClassError;
+    var UnregisteredInstanceError = class extends PolarError {
+      constructor(id) {
+        super(`Unregistered instance: ${id}.`);
+      }
+    };
+    exports2.UnregisteredInstanceError = UnregisteredInstanceError;
+    var DataFilteringConfigurationError = class extends PolarError {
+      constructor() {
+        super("Missing 'adapter' implementation. Did you forget to call `Oso.setDataFilteringAdapter()`?");
+      }
+    };
+    exports2.DataFilteringConfigurationError = DataFilteringConfigurationError;
+    var UnexpectedExpressionError = class extends PolarError {
+      constructor() {
+        super(`Received Expression from Polar VM. The Expression type is only supported when
+  using data filtering features. Did you perform an
+  operation over an unbound variable in your policy?
+
+  To silence this error and receive an Expression result, pass the
+  \`{ acceptExpression: true }\` option to \`Oso.query()\` or \`Oso.queryRule()\`.`);
+      }
+    };
+    exports2.UnexpectedExpressionError = UnexpectedExpressionError;
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/messages.js
+var require_messages = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/messages.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.processMessage = void 0;
+    var MessageKind;
+    (function(MessageKind2) {
+      MessageKind2["Print"] = "Print";
+      MessageKind2["Warning"] = "Warning";
+    })(MessageKind || (MessageKind = {}));
+    function processMessage(message) {
+      switch (message.kind) {
+        case MessageKind.Print:
+          console.log(message.msg);
+          break;
+        case MessageKind.Warning:
+          console.warn("[warning]", message.msg);
+          break;
+      }
+    }
+    exports2.processMessage = processMessage;
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/filter.js
+var require_filter = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/filter.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.parseFilter = exports2.isProjection = exports2.Relation = void 0;
+    var errors_1 = require_errors();
+    var Relation = class {
+      constructor(kind, otherType, myField, otherField) {
+        this.kind = kind;
+        this.otherType = otherType;
+        this.myField = myField;
+        this.otherField = otherField;
+      }
+      serialize() {
+        return {
+          Relation: {
+            kind: this.kind,
+            other_class_tag: this.otherType,
+            my_field: this.myField,
+            other_field: this.otherField
+          }
+        };
+      }
+    };
+    exports2.Relation = Relation;
+    function isProjection(x) {
+      return x.typeName !== void 0;
+    }
+    exports2.isProjection = isProjection;
+    async function parseFilter(filter_json, host) {
+      const filter = {
+        model: filter_json.root,
+        relations: [],
+        conditions: [],
+        types: host.types
+      };
+      for (const [fromTypeName, fromFieldName, toTypeName] of filter_json.relations)
+        filter.relations.push({ fromTypeName, fromFieldName, toTypeName });
+      async function parseDatum(d, host2) {
+        const k = Object.getOwnPropertyNames(d)[0];
+        switch (k) {
+          case "Field": {
+            const [typeName, fieldName] = d[k];
+            return { typeName, fieldName };
+          }
+          case "Immediate":
+            return { value: await host2.toJs({ value: d[k] }) };
+          default: {
+            throw new errors_1.OsoError("Invalid filter json.");
+          }
+        }
+      }
+      for (const cs of filter_json.conditions) {
+        const and_group = [];
+        for (const [l, op, r] of cs) {
+          const condition = {
+            lhs: await parseDatum(l, host),
+            cmp: op,
+            rhs: await parseDatum(r, host)
+          };
+          and_group.push(condition);
+        }
+        filter.conditions.push(and_group);
+      }
+      return filter;
+    }
+    exports2.parseFilter = parseFilter;
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Query.js
+var require_Query = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Query.js"(exports2) {
+    "use strict";
+    var __classPrivateFieldSet = exports2 && exports2.__classPrivateFieldSet || function(receiver, state, value, kind, f) {
+      if (kind === "m") throw new TypeError("Private method is not writable");
+      if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+      if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+      return kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value), value;
+    };
+    var __classPrivateFieldGet = exports2 && exports2.__classPrivateFieldGet || function(receiver, state, kind, f) {
+      if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+      if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+      return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+    };
+    var _Query_ffiQuery;
+    var _Query_calls;
+    var _Query_host;
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.Query = void 0;
+    var readline_1 = require("readline");
+    var helpers_1 = require_helpers();
+    var errors_1 = require_errors();
+    var messages_1 = require_messages();
+    var types_1 = require_types();
+    var filter_1 = require_filter();
+    function getLogLevelsFromEnv() {
+      if (typeof (process === null || process === void 0 ? void 0 : process.env) === "undefined")
+        return [void 0, void 0];
+      return [process.env.RUST_LOG, process.env.POLAR_LOG];
+    }
+    var Query = class {
+      constructor(ffiQuery, host, bindings) {
+        _Query_ffiQuery.set(this, void 0);
+        _Query_calls.set(this, void 0);
+        _Query_host.set(this, void 0);
+        ffiQuery.setLoggingOptions(...getLogLevelsFromEnv());
+        __classPrivateFieldSet(this, _Query_ffiQuery, ffiQuery, "f");
+        __classPrivateFieldSet(this, _Query_calls, /* @__PURE__ */ new Map(), "f");
+        __classPrivateFieldSet(this, _Query_host, host, "f");
+        if (bindings)
+          for (const [k, v] of bindings)
+            this.bind(k, v);
+        this.results = this.start();
+      }
+      /**
+       * Process messages received from the Polar VM.
+       *
+       * @internal
+       */
+      bind(name, value) {
+        __classPrivateFieldGet(this, _Query_ffiQuery, "f").bind(name, __classPrivateFieldGet(this, _Query_host, "f").toPolar(value));
+      }
+      /**
+       * Process messages received from the Polar VM.
+       *
+       * @internal
+       */
+      processMessages() {
+        for (; ; ) {
+          const msg = __classPrivateFieldGet(this, _Query_ffiQuery, "f").nextMessage();
+          if (msg === void 0)
+            break;
+          messages_1.processMessage(msg);
+        }
+      }
+      /**
+       * Send result of predicate check back to the Polar VM.
+       *
+       * @internal
+       */
+      questionResult(result, callId) {
+        __classPrivateFieldGet(this, _Query_ffiQuery, "f").questionResult(callId, result);
+      }
+      /**
+       * Send next result of JavaScript method call or property lookup to the Polar
+       * VM.
+       *
+       * @internal
+       */
+      callResult(callId, result) {
+        __classPrivateFieldGet(this, _Query_ffiQuery, "f").callResult(callId, result);
+      }
+      /**
+       * Retrieve the next result from a registered call and prepare it for
+       * transmission back to the Polar VM.
+       *
+       * @internal
+       */
+      async nextCallResult(callId) {
+        const call = __classPrivateFieldGet(this, _Query_calls, "f").get(callId);
+        if (call === void 0)
+          throw new Error("invalid call");
+        const { done, value } = await call.next();
+        if (done)
+          return void 0;
+        return __classPrivateFieldGet(this, _Query_host, "f").toPolar(value);
+      }
+      /**
+       * Send application error back to the Polar VM.
+       *
+       * @internal
+       */
+      applicationError(message) {
+        __classPrivateFieldGet(this, _Query_ffiQuery, "f").appError(message);
+      }
+      /**
+       * Handle an external call on a relation.
+       *
+       * @internal
+       */
+      async handleRelation(receiver, rel) {
+        const typ = __classPrivateFieldGet(this, _Query_host, "f").getType(rel.otherType);
+        if (typ === void 0)
+          throw new errors_1.UnregisteredClassError(rel.otherType);
+        const value = receiver[rel.myField];
+        const condition = {
+          lhs: {
+            typeName: rel.otherType,
+            fieldName: rel.otherField
+          },
+          cmp: "Eq",
+          rhs: { value }
+        };
+        const filter = {
+          model: rel.otherType,
+          relations: [],
+          conditions: [[condition]],
+          types: __classPrivateFieldGet(this, _Query_host, "f").types
+        };
+        const query = __classPrivateFieldGet(this, _Query_host, "f").adapter.buildQuery(filter);
+        const results = await __classPrivateFieldGet(this, _Query_host, "f").adapter.executeQuery(query);
+        if (rel.kind === "one") {
+          if (results.length !== 1)
+            throw new Error(`Wrong number of parents: ${results.length}`);
+          return results[0];
+        } else {
+          return results;
+        }
+      }
+      /**
+       * Handle an application call.
+       *
+       * @internal
+       */
+      async handleCall(attr, callId, instance, args) {
+        var _a, _b;
+        let value;
+        try {
+          const receiver = await __classPrivateFieldGet(this, _Query_host, "f").toJs(instance);
+          if (receiver === null || receiver === void 0)
+            throw new (args ? errors_1.InvalidCallError : errors_1.InvalidAttributeError)(receiver, attr);
+          const rel = (_b = (_a = __classPrivateFieldGet(this, _Query_host, "f").getType(receiver.constructor)) === null || _a === void 0 ? void 0 : _a.fields) === null || _b === void 0 ? void 0 : _b.get(attr);
+          const self2 = receiver;
+          if (rel instanceof filter_1.Relation)
+            value = await this.handleRelation(self2, rel);
+          else if (args) {
+            if (typeof self2[attr] !== "function")
+              throw new errors_1.InvalidCallError(receiver, attr);
+            const jsArgs = await Promise.all(args.map((a) => __classPrivateFieldGet(this, _Query_host, "f").toJs(a)));
+            value = self2[attr](...jsArgs);
+          } else if (!(attr in self2))
+            throw new errors_1.InvalidAttributeError(receiver, attr);
+          else
+            value = self2[attr];
+        } catch (e) {
+          if (e instanceof TypeError || e instanceof errors_1.InvalidCallError || e instanceof errors_1.InvalidAttributeError) {
+            this.applicationError(e.message);
+          } else {
+            throw e;
+          }
+        } finally {
+          value = await Promise.resolve(value);
+          value = __classPrivateFieldGet(this, _Query_host, "f").toPolar(value);
+          this.callResult(callId, value);
+        }
+      }
+      async handleNextExternal(callId, iterable) {
+        if (!__classPrivateFieldGet(this, _Query_calls, "f").has(callId)) {
+          const value = await __classPrivateFieldGet(this, _Query_host, "f").toJs(iterable);
+          const generator = (async function* () {
+            if (types_1.isIterableIterator(value)) {
+              yield* value;
+            } else if (types_1.isAsyncIterable(value)) {
+              for await (const result2 of value) {
+                yield result2;
+              }
+            } else if (types_1.isIterable(value)) {
+              for (const result2 of value) {
+                yield result2;
+              }
+            } else {
+              throw new errors_1.InvalidIteratorError(typeof value);
+            }
+          })();
+          __classPrivateFieldGet(this, _Query_calls, "f").set(callId, generator);
+        }
+        const result = await this.nextCallResult(callId);
+        this.callResult(callId, result);
+      }
+      /**
+       * Create an `AsyncGenerator` that can be polled to advance the query loop.
+       *
+       * @internal
+       */
+      async *start() {
+        try {
+          while (true) {
+            const nextEvent = __classPrivateFieldGet(this, _Query_ffiQuery, "f").nextEvent();
+            this.processMessages();
+            const event = helpers_1.parseQueryEvent(nextEvent);
+            switch (event.kind) {
+              case types_1.QueryEventKind.Done:
+                return;
+              case types_1.QueryEventKind.Result: {
+                const { bindings } = event.data;
+                const transformed = /* @__PURE__ */ new Map();
+                for (const [k, v] of bindings) {
+                  transformed.set(k, await __classPrivateFieldGet(this, _Query_host, "f").toJs(v));
+                }
+                yield transformed;
+                break;
+              }
+              case types_1.QueryEventKind.MakeExternal: {
+                const { instanceId, tag, fields } = event.data;
+                if (__classPrivateFieldGet(this, _Query_host, "f").hasInstance(instanceId))
+                  throw new errors_1.DuplicateInstanceRegistrationError(instanceId);
+                await __classPrivateFieldGet(this, _Query_host, "f").makeInstance(tag, fields, instanceId);
+                break;
+              }
+              case types_1.QueryEventKind.ExternalCall: {
+                const { attribute, callId, instance, args } = event.data;
+                await this.handleCall(attribute, callId, instance, args);
+                break;
+              }
+              case types_1.QueryEventKind.ExternalIsSubspecializer: {
+                const { instanceId, leftTag, rightTag, callId } = event.data;
+                const answer = await __classPrivateFieldGet(this, _Query_host, "f").isSubspecializer(instanceId, leftTag, rightTag);
+                this.questionResult(answer, callId);
+                break;
+              }
+              case types_1.QueryEventKind.ExternalIsSubclass: {
+                const { leftTag, rightTag, callId } = event.data;
+                const answer = __classPrivateFieldGet(this, _Query_host, "f").isSubclass(leftTag, rightTag);
+                this.questionResult(answer, callId);
+                break;
+              }
+              case types_1.QueryEventKind.ExternalOp: {
+                const { args, callId, operator } = event.data;
+                const answer = await __classPrivateFieldGet(this, _Query_host, "f").externalOp(operator, args[0], args[1]);
+                this.questionResult(answer, callId);
+                break;
+              }
+              case types_1.QueryEventKind.ExternalIsa: {
+                const { instance, tag, callId } = event.data;
+                const answer = await __classPrivateFieldGet(this, _Query_host, "f").isa(instance, tag);
+                this.questionResult(answer, callId);
+                break;
+              }
+              case types_1.QueryEventKind.ExternalIsaWithPath: {
+                const { baseTag, path, classTag, callId } = event.data;
+                const answer = await __classPrivateFieldGet(this, _Query_host, "f").isaWithPath(baseTag, path, classTag);
+                this.questionResult(answer, callId);
+                break;
+              }
+              case types_1.QueryEventKind.NextExternal: {
+                const { callId, iterable } = event.data;
+                await this.handleNextExternal(callId, iterable);
+                break;
+              }
+              case types_1.QueryEventKind.Debug: {
+                if (typeof readline_1.createInterface !== "function") {
+                  console.warn("debug events not supported in browser Oso");
+                  break;
+                }
+                const { message } = event.data;
+                if (message)
+                  console.log(message);
+                readline_1.createInterface({
+                  input: process.stdin,
+                  output: process.stdout,
+                  prompt: "debug> ",
+                  tabSize: 4
+                }).on("line", (line) => {
+                  const trimmed = line.trim().replace(/;+$/, "");
+                  const command = __classPrivateFieldGet(this, _Query_host, "f").toPolar(trimmed);
+                  __classPrivateFieldGet(this, _Query_ffiQuery, "f").debugCommand(JSON.stringify(command));
+                  this.processMessages();
+                });
+                break;
+              }
+              default: {
+                const _ = event.kind;
+                return _;
+              }
+            }
+          }
+        } finally {
+          __classPrivateFieldGet(this, _Query_ffiQuery, "f").free();
+        }
+      }
+    };
+    exports2.Query = Query;
+    _Query_ffiQuery = /* @__PURE__ */ new WeakMap(), _Query_calls = /* @__PURE__ */ new WeakMap(), _Query_host = /* @__PURE__ */ new WeakMap();
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Expression.js
+var require_Expression = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Expression.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.Expression = void 0;
+    var Expression = class {
+      constructor(operator, args) {
+        this.operator = operator;
+        this.args = args;
+      }
+    };
+    exports2.Expression = Expression;
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Pattern.js
+var require_Pattern = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Pattern.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.Pattern = void 0;
+    var Pattern = class {
+      constructor({ tag, fields }) {
+        this.tag = tag;
+        this.fields = fields;
+      }
+    };
+    exports2.Pattern = Pattern;
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Predicate.js
+var require_Predicate = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Predicate.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.Predicate = void 0;
+    var Predicate = class {
+      constructor(name, args) {
+        this.name = name;
+        this.args = args;
+      }
+    };
+    exports2.Predicate = Predicate;
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Variable.js
+var require_Variable = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Variable.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.Variable = void 0;
+    var Variable = class {
+      constructor(name) {
+        this.name = name;
+      }
+    };
+    exports2.Variable = Variable;
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Host.js
+var require_Host = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Host.js"(exports2) {
+    "use strict";
+    var __classPrivateFieldSet = exports2 && exports2.__classPrivateFieldSet || function(receiver, state, value, kind, f) {
+      if (kind === "m") throw new TypeError("Private method is not writable");
+      if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+      if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+      return kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value), value;
+    };
+    var __classPrivateFieldGet = exports2 && exports2.__classPrivateFieldGet || function(receiver, state, kind, f) {
+      if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+      if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+      return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+    };
+    var _Host_ffiPolar;
+    var _Host_instances;
+    var _Host_opts;
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.Host = void 0;
+    var errors_1 = require_errors();
+    var helpers_1 = require_helpers();
+    var Expression_1 = require_Expression();
+    var Pattern_1 = require_Pattern();
+    var Predicate_1 = require_Predicate();
+    var Variable_1 = require_Variable();
+    var types_1 = require_types();
+    var types_2 = require_types();
+    var filter_1 = require_filter();
+    var Host = class _Host {
+      /** @internal */
+      constructor(ffiPolar, opts) {
+        _Host_ffiPolar.set(this, void 0);
+        _Host_instances.set(this, void 0);
+        _Host_opts.set(this, void 0);
+        __classPrivateFieldSet(this, _Host_ffiPolar, ffiPolar, "f");
+        __classPrivateFieldSet(this, _Host_opts, opts, "f");
+        __classPrivateFieldSet(this, _Host_instances, /* @__PURE__ */ new Map(), "f");
+        this.types = /* @__PURE__ */ new Map();
+        this.adapter = {
+          buildQuery: () => {
+            throw new errors_1.DataFilteringConfigurationError();
+          },
+          executeQuery: () => {
+            throw new errors_1.DataFilteringConfigurationError();
+          }
+        };
+      }
+      /**
+       * Shallow clone a host to extend its state for the duration of a particular
+       * query without modifying the longer-lived [[`Polar`]] host state.
+       *
+       * @internal
+       */
+      static clone(host, opts) {
+        const options = { ...__classPrivateFieldGet(host, _Host_opts, "f"), ...opts };
+        const clone = new _Host(__classPrivateFieldGet(host, _Host_ffiPolar, "f"), options);
+        __classPrivateFieldSet(clone, _Host_instances, new Map(__classPrivateFieldGet(host, _Host_instances, "f")), "f");
+        clone.types = new Map(host.types);
+        clone.adapter = host.adapter;
+        return clone;
+      }
+      /**
+       * Fetch a JavaScript class from the class cache.
+       *
+       * @param name Class name to look up.
+       *
+       * @internal
+       */
+      getClass(name) {
+        const typ = this.types.get(name);
+        if (typ === void 0)
+          throw new errors_1.UnregisteredClassError(name);
+        return typ.cls;
+      }
+      /**
+       * Get user type for `cls`.
+       *
+       * @param cls Class or class name.
+       */
+      getType(cls) {
+        if (cls === void 0)
+          return void 0;
+        return this.types.get(cls);
+      }
+      /**
+       * Return user types that are registered with Host.
+       */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      *distinctUserTypes() {
+        for (const [name, typ] of this.types)
+          if (helpers_1.isString(name))
+            yield typ;
+      }
+      serializeTypes() {
+        var _a;
+        const polarTypes = {};
+        for (const [tag, userType] of this.types) {
+          if (helpers_1.isString(tag)) {
+            const fields = userType.fields;
+            const fieldTypes = {};
+            for (const [k, v] of fields) {
+              if (v instanceof filter_1.Relation) {
+                fieldTypes[k] = v.serialize();
+              } else {
+                const class_tag = (_a = this.getType(v)) === null || _a === void 0 ? void 0 : _a.name;
+                if (class_tag === void 0)
+                  throw new errors_1.UnregisteredClassError(v.name);
+                fieldTypes[k] = { Base: { class_tag } };
+              }
+            }
+            polarTypes[tag] = fieldTypes;
+          }
+        }
+        return polarTypes;
+      }
+      /**
+       * Store a JavaScript class in the class cache.
+       *
+       * @param cls Class to cache.
+       * @param params Optional parameters.
+       *
+       * @internal
+       */
+      cacheClass(cls, params) {
+        params = params ? params : {};
+        let fields = params.fields || {};
+        if (!(fields instanceof Map))
+          fields = new Map(Object.entries(fields));
+        const { name } = params;
+        if (!helpers_1.isConstructor(cls))
+          throw new errors_1.InvalidConstructorError(cls);
+        const clsName = name ? name : cls.name;
+        const existing = this.types.get(clsName);
+        if (existing) {
+          throw new errors_1.DuplicateClassAliasError({
+            name: clsName,
+            cls,
+            existing: existing.cls
+          });
+        }
+        function defaultCheck(instance) {
+          return instance instanceof cls || (instance === null || instance === void 0 ? void 0 : instance.constructor) === cls;
+        }
+        const userType = new types_1.UserType({
+          name: clsName,
+          cls,
+          fields,
+          id: this.cacheInstance(cls),
+          isaCheck: params.isaCheck || defaultCheck
+        });
+        this.types.set(cls, userType);
+        this.types.set(clsName, userType);
+        return clsName;
+      }
+      /**
+       * Return cached instances.
+       *
+       * Only used by the test suite.
+       *
+       * @internal
+       */
+      instances() {
+        return Array.from(__classPrivateFieldGet(this, _Host_instances, "f").values());
+      }
+      /**
+       * Check if an instance exists in the instance cache.
+       *
+       * @internal
+       */
+      hasInstance(id) {
+        return __classPrivateFieldGet(this, _Host_instances, "f").has(id);
+      }
+      /**
+       * Fetch a JavaScript instance from the instance cache.
+       *
+       * Public for the test suite.
+       *
+       * @internal
+       */
+      getInstance(id) {
+        if (!this.hasInstance(id))
+          throw new errors_1.UnregisteredInstanceError(id);
+        return __classPrivateFieldGet(this, _Host_instances, "f").get(id);
+      }
+      /**
+       * Store a JavaScript instance in the instance cache, fetching a new instance
+       * ID from the Polar VM if an ID is not provided.
+       *
+       * @internal
+       */
+      cacheInstance(instance, id) {
+        let instanceId = id;
+        if (instanceId === void 0) {
+          instanceId = __classPrivateFieldGet(this, _Host_ffiPolar, "f").newId();
+        }
+        __classPrivateFieldGet(this, _Host_instances, "f").set(instanceId, instance);
+        return instanceId;
+      }
+      /**
+       * Register the MROs of all registered classes.
+       */
+      registerMros() {
+        for (const typ of this.distinctUserTypes()) {
+          const mro = helpers_1.ancestors(typ.cls).map((c) => {
+            var _a;
+            return (_a = this.getType(c)) === null || _a === void 0 ? void 0 : _a.id;
+          }).filter((id) => id !== void 0);
+          __classPrivateFieldGet(this, _Host_ffiPolar, "f").registerMro(typ.name, mro);
+        }
+      }
+      /**
+       * Construct a JavaScript instance and store it in the instance cache.
+       *
+       * @internal
+       */
+      async makeInstance(name, fields, id) {
+        const cls = this.getClass(name);
+        const args = await Promise.all(fields.map((f) => this.toJs(f)));
+        const instance = new cls(...args);
+        this.cacheInstance(instance, id);
+      }
+      /**
+       * Check if the left class is more specific than the right class with respect
+       * to the given instance.
+       *
+       * @internal
+       */
+      async isSubspecializer(id, left, right) {
+        let instance = this.getInstance(id);
+        instance = instance instanceof Promise ? await instance : instance;
+        const mro = helpers_1.ancestors(instance === null || instance === void 0 ? void 0 : instance.constructor);
+        const leftIndex = mro.indexOf(this.getClass(left));
+        const rightIndex = mro.indexOf(this.getClass(right));
+        if (leftIndex === -1) {
+          return false;
+        } else if (rightIndex === -1) {
+          return true;
+        } else {
+          return leftIndex < rightIndex;
+        }
+      }
+      /**
+       * Check if the left class is a subclass of the right class.
+       *
+       * @internal
+       */
+      isSubclass(left, right) {
+        const leftCls = this.getClass(left);
+        const rightCls = this.getClass(right);
+        const mro = helpers_1.ancestors(leftCls);
+        return mro.includes(rightCls);
+      }
+      /**
+       * Check if the given instance is an instance of a particular class.
+       *
+       * @internal
+       */
+      async isa(polarInstance, name) {
+        const instance = await this.toJs(polarInstance);
+        const userType = this.types.get(name);
+        if (userType !== void 0) {
+          return userType.isaCheck(instance);
+        } else {
+          const cls = this.getClass(name);
+          const inst = instance;
+          return inst instanceof cls || (inst === null || inst === void 0 ? void 0 : inst.constructor) === cls;
+        }
+      }
+      /**
+       * Check if a sequence of field accesses on the given class is an
+       * instance of another class.
+       *
+       * @internal
+       */
+      async isaWithPath(baseTag, path, classTag) {
+        var _a;
+        let tag = baseTag;
+        for (const fld of path) {
+          const field = await this.toJs(fld);
+          if (!helpers_1.isString(field))
+            throw new Error(`Not a field name: ${helpers_1.repr(field)}`);
+          const userType = this.types.get(tag);
+          if (userType === void 0)
+            return false;
+          let fieldType = userType.fields.get(field);
+          if (fieldType === void 0)
+            return false;
+          if (fieldType instanceof filter_1.Relation) {
+            switch (fieldType.kind) {
+              case "one": {
+                const otherCls = (_a = this.getType(fieldType.otherType)) === null || _a === void 0 ? void 0 : _a.cls;
+                if (otherCls === void 0)
+                  throw new errors_1.UnregisteredClassError(fieldType.otherType);
+                fieldType = otherCls;
+                break;
+              }
+              case "many":
+                fieldType = Array;
+                break;
+            }
+          }
+          const newBase = this.getType(fieldType);
+          if (newBase === void 0)
+            return false;
+          tag = newBase.name;
+        }
+        return classTag === tag;
+      }
+      /**
+       * Check if the given instances conform to the operator.
+       *
+       * @internal
+       */
+      async externalOp(op, leftTerm, rightTerm) {
+        const left = await this.toJs(leftTerm);
+        const right = await this.toJs(rightTerm);
+        switch (op) {
+          case "Eq":
+            return __classPrivateFieldGet(this, _Host_opts, "f").equalityFn(left, right);
+          case "Geq":
+            return left >= right;
+          case "Gt":
+            return left > right;
+          case "Leq":
+            return left <= right;
+          case "Lt":
+            return left < right;
+          case "Neq":
+            return !__classPrivateFieldGet(this, _Host_opts, "f").equalityFn(left, right);
+          default: {
+            const _ = op;
+            return _;
+          }
+        }
+      }
+      /**
+       * Turn a JavaScript value into a Polar term that's ready to be sent to the
+       * Polar VM.
+       *
+       * @internal
+       */
+      toPolar(v) {
+        var _a, _b, _c, _d;
+        switch (true) {
+          case typeof v === "boolean":
+            return { value: { Boolean: v } };
+          case Number.isInteger(v):
+            return { value: { Number: { Integer: v } } };
+          case typeof v === "number":
+            if (v === Infinity) {
+              v = "Infinity";
+            } else if (v === -Infinity) {
+              v = "-Infinity";
+            } else if (Number.isNaN(v)) {
+              v = "NaN";
+            }
+            return { value: { Number: { Float: v } } };
+          case helpers_1.isString(v):
+            return { value: { String: v } };
+          case Array.isArray(v): {
+            const polarTermList = v.map((a) => this.toPolar(a));
+            return { value: { List: polarTermList } };
+          }
+          case v instanceof Predicate_1.Predicate: {
+            const { name, args } = v;
+            const polarArgs = args.map((a) => this.toPolar(a));
+            return { value: { Call: { name, args: polarArgs } } };
+          }
+          case v instanceof Variable_1.Variable:
+            return { value: { Variable: v.name } };
+          case v instanceof Expression_1.Expression: {
+            const { operator, args } = v;
+            const polarArgs = args.map((a) => this.toPolar(a));
+            return { value: { Expression: { operator, args: polarArgs } } };
+          }
+          case v instanceof Pattern_1.Pattern: {
+            const { tag, fields } = v;
+            let dict = this.toPolar(fields).value;
+            if (!types_2.isPolarDict(dict))
+              dict = { Dictionary: { fields: /* @__PURE__ */ new Map() } };
+            if (tag === void 0)
+              return { value: { Pattern: dict } };
+            return {
+              value: { Pattern: { Instance: { tag, fields: dict.Dictionary } } }
+            };
+          }
+          case v instanceof types_2.Dict: {
+            const fields = new Map(Object.entries(v).map(([k, v2]) => [k, this.toPolar(v2)]));
+            return { value: { Dictionary: { fields } } };
+          }
+          default: {
+            let instanceId = void 0;
+            let classId = void 0;
+            const v_cast = v;
+            let classRepr = void 0;
+            if (helpers_1.isConstructor(v)) {
+              instanceId = (_a = this.getType(v)) === null || _a === void 0 ? void 0 : _a.id;
+              classId = instanceId;
+              classRepr = (_b = this.getType(v)) === null || _b === void 0 ? void 0 : _b.name;
+            } else {
+              const v_constructor = v_cast === null || v_cast === void 0 ? void 0 : v_cast.constructor;
+              if (v_constructor !== void 0 && this.types.has(v_constructor)) {
+                classId = (_c = this.getType(v_constructor)) === null || _c === void 0 ? void 0 : _c.id;
+                classRepr = (_d = this.getType(v_constructor)) === null || _d === void 0 ? void 0 : _d.name;
+              }
+            }
+            if (classRepr !== void 0 && !this.types.has(classRepr)) {
+              classRepr = void 0;
+            }
+            const instance_id = this.cacheInstance(v, instanceId);
+            return {
+              value: {
+                ExternalInstance: {
+                  instance_id,
+                  constructor: void 0,
+                  repr: helpers_1.repr(v),
+                  class_repr: classRepr,
+                  class_id: classId
+                }
+              }
+            };
+          }
+        }
+      }
+      /**
+       * Turn a Polar term from the Polar VM into a JavaScript value.
+       *
+       * @internal
+       */
+      async toJs(v) {
+        const t = v.value;
+        if (types_2.isPolarStr(t)) {
+          return t.String;
+        } else if (types_2.isPolarNum(t)) {
+          if ("Float" in t.Number) {
+            const f = t.Number.Float;
+            switch (f) {
+              case "Infinity":
+                return Infinity;
+              case "-Infinity":
+                return -Infinity;
+              case "NaN":
+                return NaN;
+              default:
+                if (typeof f !== "number")
+                  throw new errors_1.PolarError('Expected a floating point number, got "' + f + '"');
+                return f;
+            }
+          } else {
+            return t.Number.Integer;
+          }
+        } else if (types_2.isPolarBool(t)) {
+          return t.Boolean;
+        } else if (types_2.isPolarList(t)) {
+          return await Promise.all(t.List.map(async (el) => await this.toJs(el)));
+        } else if (types_2.isPolarDict(t)) {
+          const valueToJs = ([k, v2]) => this.toJs(v2).then((v3) => [k, v3]);
+          const { fields } = t.Dictionary;
+          const entries = await Promise.all([...fields.entries()].map(valueToJs));
+          return entries.reduce((dict, [k, v2]) => {
+            dict[k] = v2;
+            return dict;
+          }, new types_2.Dict({}));
+        } else if (types_2.isPolarInstance(t)) {
+          const i = this.getInstance(t.ExternalInstance.instance_id);
+          return i instanceof Promise ? await i : i;
+        } else if (types_2.isPolarPredicate(t)) {
+          const { name, args } = t.Call;
+          const jsArgs = await Promise.all(args.map((a) => this.toJs(a)));
+          return new Predicate_1.Predicate(name, jsArgs);
+        } else if (types_2.isPolarVariable(t)) {
+          return new Variable_1.Variable(t.Variable);
+        } else if (types_2.isPolarExpression(t)) {
+          if (!__classPrivateFieldGet(this, _Host_opts, "f").acceptExpression)
+            throw new errors_1.UnexpectedExpressionError();
+          const { operator, args: argTerms } = t.Expression;
+          const args = await Promise.all(argTerms.map((a) => this.toJs(a)));
+          return new Expression_1.Expression(operator, args);
+        } else if (types_2.isPolarPattern(t)) {
+          if ("Dictionary" in t.Pattern) {
+            const fields = await this.toJs({ value: t.Pattern });
+            return new Pattern_1.Pattern({ fields });
+          } else {
+            const { tag, fields: { fields } } = t.Pattern.Instance;
+            const dict = await this.toJs({ value: { Dictionary: { fields } } });
+            return new Pattern_1.Pattern({ tag, fields: dict });
+          }
+        } else {
+          const _ = t;
+          return _;
+        }
+      }
+    };
+    exports2.Host = Host;
+    _Host_ffiPolar = /* @__PURE__ */ new WeakMap(), _Host_instances = /* @__PURE__ */ new WeakMap(), _Host_opts = /* @__PURE__ */ new WeakMap();
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/polar_wasm_api.js
+var require_polar_wasm_api = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/polar_wasm_api.js"(exports2, module2) {
+    "use strict";
+    var imports = {};
+    imports["__wbindgen_placeholder__"] = module2.exports;
+    var wasm;
+    var { TextEncoder, TextDecoder } = require("util");
+    var heap = new Array(32).fill(void 0);
+    heap.push(void 0, null, true, false);
+    function getObject(idx) {
+      return heap[idx];
+    }
+    var WASM_VECTOR_LEN = 0;
+    var cachedUint8Memory0 = new Uint8Array();
+    function getUint8Memory0() {
+      if (cachedUint8Memory0.byteLength === 0) {
+        cachedUint8Memory0 = new Uint8Array(wasm.memory.buffer);
+      }
+      return cachedUint8Memory0;
+    }
+    var cachedTextEncoder = new TextEncoder("utf-8");
+    var encodeString = typeof cachedTextEncoder.encodeInto === "function" ? function(arg, view) {
+      return cachedTextEncoder.encodeInto(arg, view);
+    } : function(arg, view) {
+      const buf = cachedTextEncoder.encode(arg);
+      view.set(buf);
+      return {
+        read: arg.length,
+        written: buf.length
+      };
+    };
+    function passStringToWasm0(arg, malloc, realloc) {
+      if (realloc === void 0) {
+        const buf = cachedTextEncoder.encode(arg);
+        const ptr2 = malloc(buf.length);
+        getUint8Memory0().subarray(ptr2, ptr2 + buf.length).set(buf);
+        WASM_VECTOR_LEN = buf.length;
+        return ptr2;
+      }
+      let len = arg.length;
+      let ptr = malloc(len);
+      const mem = getUint8Memory0();
+      let offset = 0;
+      for (; offset < len; offset++) {
+        const code = arg.charCodeAt(offset);
+        if (code > 127) break;
+        mem[ptr + offset] = code;
+      }
+      if (offset !== len) {
+        if (offset !== 0) {
+          arg = arg.slice(offset);
+        }
+        ptr = realloc(ptr, len, len = offset + arg.length * 3);
+        const view = getUint8Memory0().subarray(ptr + offset, ptr + len);
+        const ret = encodeString(arg, view);
+        offset += ret.written;
+      }
+      WASM_VECTOR_LEN = offset;
+      return ptr;
+    }
+    function isLikeNone(x) {
+      return x === void 0 || x === null;
+    }
+    var cachedInt32Memory0 = new Int32Array();
+    function getInt32Memory0() {
+      if (cachedInt32Memory0.byteLength === 0) {
+        cachedInt32Memory0 = new Int32Array(wasm.memory.buffer);
+      }
+      return cachedInt32Memory0;
+    }
+    var heap_next = heap.length;
+    function dropObject(idx) {
+      if (idx < 36) return;
+      heap[idx] = heap_next;
+      heap_next = idx;
+    }
+    function takeObject(idx) {
+      const ret = getObject(idx);
+      dropObject(idx);
+      return ret;
+    }
+    var cachedFloat64Memory0 = new Float64Array();
+    function getFloat64Memory0() {
+      if (cachedFloat64Memory0.byteLength === 0) {
+        cachedFloat64Memory0 = new Float64Array(wasm.memory.buffer);
+      }
+      return cachedFloat64Memory0;
+    }
+    function addHeapObject(obj) {
+      if (heap_next === heap.length) heap.push(heap.length + 1);
+      const idx = heap_next;
+      heap_next = heap[idx];
+      heap[idx] = obj;
+      return idx;
+    }
+    var cachedTextDecoder = new TextDecoder("utf-8", { ignoreBOM: true, fatal: true });
+    cachedTextDecoder.decode();
+    function getStringFromWasm0(ptr, len) {
+      return cachedTextDecoder.decode(getUint8Memory0().subarray(ptr, ptr + len));
+    }
+    function debugString(val) {
+      const type = typeof val;
+      if (type == "number" || type == "boolean" || val == null) {
+        return `${val}`;
+      }
+      if (type == "string") {
+        return `"${val}"`;
+      }
+      if (type == "symbol") {
+        const description = val.description;
+        if (description == null) {
+          return "Symbol";
+        } else {
+          return `Symbol(${description})`;
+        }
+      }
+      if (type == "function") {
+        const name = val.name;
+        if (typeof name == "string" && name.length > 0) {
+          return `Function(${name})`;
+        } else {
+          return "Function";
+        }
+      }
+      if (Array.isArray(val)) {
+        const length = val.length;
+        let debug = "[";
+        if (length > 0) {
+          debug += debugString(val[0]);
+        }
+        for (let i = 1; i < length; i++) {
+          debug += ", " + debugString(val[i]);
+        }
+        debug += "]";
+        return debug;
+      }
+      const builtInMatches = /\[object ([^\]]+)\]/.exec(toString.call(val));
+      let className;
+      if (builtInMatches.length > 1) {
+        className = builtInMatches[1];
+      } else {
+        return toString.call(val);
+      }
+      if (className == "Object") {
+        try {
+          return "Object(" + JSON.stringify(val) + ")";
+        } catch (_) {
+          return "Object";
+        }
+      }
+      if (val instanceof Error) {
+        return `${val.name}: ${val.message}
+${val.stack}`;
+      }
+      return className;
+    }
+    function handleError(f, args) {
+      try {
+        return f.apply(this, args);
+      } catch (e) {
+        wasm.__wbindgen_exn_store(addHeapObject(e));
+      }
+    }
+    var Polar = class _Polar {
+      static __wrap(ptr) {
+        const obj = Object.create(_Polar.prototype);
+        obj.ptr = ptr;
+        return obj;
+      }
+      __destroy_into_raw() {
+        const ptr = this.ptr;
+        this.ptr = 0;
+        return ptr;
+      }
+      free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_polar_free(ptr);
+      }
+      /**
+      */
+      constructor() {
+        const ret = wasm.polar_wasm_new();
+        return _Polar.__wrap(ret);
+      }
+      /**
+      * @param {any} sources
+      */
+      load(sources) {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          wasm.polar_load(retptr, this.ptr, addHeapObject(sources));
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          if (r1) {
+            throw takeObject(r0);
+          }
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      */
+      clearRules() {
+        wasm.polar_clearRules(this.ptr);
+      }
+      /**
+      * @param {string} name
+      * @param {any} term
+      */
+      registerConstant(name, term) {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          const ptr0 = passStringToWasm0(name, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+          const len0 = WASM_VECTOR_LEN;
+          wasm.polar_registerConstant(retptr, this.ptr, ptr0, len0, addHeapObject(term));
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          if (r1) {
+            throw takeObject(r0);
+          }
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @returns {Query | undefined}
+      */
+      nextInlineQuery() {
+        const ret = wasm.polar_nextInlineQuery(this.ptr);
+        return ret === 0 ? void 0 : Query.__wrap(ret);
+      }
+      /**
+      * @param {string} src
+      * @returns {Query}
+      */
+      newQueryFromStr(src) {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          const ptr0 = passStringToWasm0(src, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+          const len0 = WASM_VECTOR_LEN;
+          wasm.polar_newQueryFromStr(retptr, this.ptr, ptr0, len0);
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          var r2 = getInt32Memory0()[retptr / 4 + 2];
+          if (r2) {
+            throw takeObject(r1);
+          }
+          return Query.__wrap(r0);
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @param {any} term
+      * @returns {Query}
+      */
+      newQueryFromTerm(term) {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          wasm.polar_newQueryFromTerm(retptr, this.ptr, addHeapObject(term));
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          var r2 = getInt32Memory0()[retptr / 4 + 2];
+          if (r2) {
+            throw takeObject(r1);
+          }
+          return Query.__wrap(r0);
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @returns {number}
+      */
+      newId() {
+        const ret = wasm.polar_newId(this.ptr);
+        return ret;
+      }
+      /**
+      * @returns {any}
+      */
+      nextMessage() {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          wasm.polar_nextMessage(retptr, this.ptr);
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          var r2 = getInt32Memory0()[retptr / 4 + 2];
+          if (r2) {
+            throw takeObject(r1);
+          }
+          return takeObject(r0);
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @param {string} name
+      * @param {any} mro
+      */
+      registerMro(name, mro) {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          const ptr0 = passStringToWasm0(name, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+          const len0 = WASM_VECTOR_LEN;
+          wasm.polar_registerMro(retptr, this.ptr, ptr0, len0, addHeapObject(mro));
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          if (r1) {
+            throw takeObject(r0);
+          }
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @param {any} types
+      * @param {any} partial_results
+      * @param {string} variable
+      * @param {string} class_tag
+      * @returns {any}
+      */
+      buildDataFilter(types, partial_results, variable, class_tag) {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          const ptr0 = passStringToWasm0(variable, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+          const len0 = WASM_VECTOR_LEN;
+          const ptr1 = passStringToWasm0(class_tag, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+          const len1 = WASM_VECTOR_LEN;
+          wasm.polar_buildDataFilter(retptr, this.ptr, addHeapObject(types), addHeapObject(partial_results), ptr0, len0, ptr1, len1);
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          var r2 = getInt32Memory0()[retptr / 4 + 2];
+          if (r2) {
+            throw takeObject(r1);
+          }
+          return takeObject(r0);
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @param {boolean} ignore_no_allow_warning
+      */
+      setIgnoreNoAllowWarning(ignore_no_allow_warning) {
+        wasm.polar_setIgnoreNoAllowWarning(this.ptr, ignore_no_allow_warning);
+      }
+    };
+    module2.exports.Polar = Polar;
+    var Query = class _Query {
+      static __wrap(ptr) {
+        const obj = Object.create(_Query.prototype);
+        obj.ptr = ptr;
+        return obj;
+      }
+      __destroy_into_raw() {
+        const ptr = this.ptr;
+        this.ptr = 0;
+        return ptr;
+      }
+      free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_query_free(ptr);
+      }
+      /**
+      * @returns {any}
+      */
+      nextEvent() {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          wasm.query_nextEvent(retptr, this.ptr);
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          var r2 = getInt32Memory0()[retptr / 4 + 2];
+          if (r2) {
+            throw takeObject(r1);
+          }
+          return takeObject(r0);
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @param {number} call_id
+      * @param {any} term
+      */
+      callResult(call_id, term) {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          wasm.query_callResult(retptr, this.ptr, call_id, addHeapObject(term));
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          if (r1) {
+            throw takeObject(r0);
+          }
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @param {number} call_id
+      * @param {boolean} result
+      */
+      questionResult(call_id, result) {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          wasm.query_questionResult(retptr, this.ptr, call_id, result);
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          if (r1) {
+            throw takeObject(r0);
+          }
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @param {string} command
+      */
+      debugCommand(command) {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          const ptr0 = passStringToWasm0(command, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+          const len0 = WASM_VECTOR_LEN;
+          wasm.query_debugCommand(retptr, this.ptr, ptr0, len0);
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          if (r1) {
+            throw takeObject(r0);
+          }
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @param {string} msg
+      */
+      appError(msg) {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          const ptr0 = passStringToWasm0(msg, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+          const len0 = WASM_VECTOR_LEN;
+          wasm.query_appError(retptr, this.ptr, ptr0, len0);
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          if (r1) {
+            throw takeObject(r0);
+          }
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @returns {any}
+      */
+      nextMessage() {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          wasm.query_nextMessage(retptr, this.ptr);
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          var r2 = getInt32Memory0()[retptr / 4 + 2];
+          if (r2) {
+            throw takeObject(r1);
+          }
+          return takeObject(r0);
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @returns {string}
+      */
+      source() {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          wasm.query_source(retptr, this.ptr);
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          return getStringFromWasm0(r0, r1);
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+          wasm.__wbindgen_free(r0, r1);
+        }
+      }
+      /**
+      * @param {string} name
+      * @param {any} term
+      */
+      bind(name, term) {
+        try {
+          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+          const ptr0 = passStringToWasm0(name, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+          const len0 = WASM_VECTOR_LEN;
+          wasm.query_bind(retptr, this.ptr, ptr0, len0, addHeapObject(term));
+          var r0 = getInt32Memory0()[retptr / 4 + 0];
+          var r1 = getInt32Memory0()[retptr / 4 + 1];
+          if (r1) {
+            throw takeObject(r0);
+          }
+        } finally {
+          wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+      }
+      /**
+      * @param {string | undefined} rust_log
+      * @param {string | undefined} polar_log
+      */
+      setLoggingOptions(rust_log, polar_log) {
+        var ptr0 = isLikeNone(rust_log) ? 0 : passStringToWasm0(rust_log, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        var len0 = WASM_VECTOR_LEN;
+        var ptr1 = isLikeNone(polar_log) ? 0 : passStringToWasm0(polar_log, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        var len1 = WASM_VECTOR_LEN;
+        wasm.query_setLoggingOptions(this.ptr, ptr0, len0, ptr1, len1);
+      }
+    };
+    module2.exports.Query = Query;
+    module2.exports.__wbindgen_string_get = function(arg0, arg1) {
+      const obj = getObject(arg1);
+      const ret = typeof obj === "string" ? obj : void 0;
+      var ptr0 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+      var len0 = WASM_VECTOR_LEN;
+      getInt32Memory0()[arg0 / 4 + 1] = len0;
+      getInt32Memory0()[arg0 / 4 + 0] = ptr0;
+    };
+    module2.exports.__wbindgen_object_drop_ref = function(arg0) {
+      takeObject(arg0);
+    };
+    module2.exports.__wbindgen_boolean_get = function(arg0) {
+      const v = getObject(arg0);
+      const ret = typeof v === "boolean" ? v ? 1 : 0 : 2;
+      return ret;
+    };
+    module2.exports.__wbindgen_number_get = function(arg0, arg1) {
+      const obj = getObject(arg1);
+      const ret = typeof obj === "number" ? obj : void 0;
+      getFloat64Memory0()[arg0 / 8 + 1] = isLikeNone(ret) ? 0 : ret;
+      getInt32Memory0()[arg0 / 4 + 0] = !isLikeNone(ret);
+    };
+    module2.exports.__wbindgen_is_object = function(arg0) {
+      const val = getObject(arg0);
+      const ret = typeof val === "object" && val !== null;
+      return ret;
+    };
+    module2.exports.__wbindgen_is_string = function(arg0) {
+      const ret = typeof getObject(arg0) === "string";
+      return ret;
+    };
+    module2.exports.__wbindgen_is_null = function(arg0) {
+      const ret = getObject(arg0) === null;
+      return ret;
+    };
+    module2.exports.__wbindgen_is_undefined = function(arg0) {
+      const ret = getObject(arg0) === void 0;
+      return ret;
+    };
+    module2.exports.__wbindgen_number_new = function(arg0) {
+      const ret = arg0;
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbindgen_object_clone_ref = function(arg0) {
+      const ret = getObject(arg0);
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbindgen_string_new = function(arg0, arg1) {
+      const ret = getStringFromWasm0(arg0, arg1);
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_String_9aa17d6248d519a5 = function(arg0, arg1) {
+      const ret = String(getObject(arg1));
+      const ptr0 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+      const len0 = WASM_VECTOR_LEN;
+      getInt32Memory0()[arg0 / 4 + 1] = len0;
+      getInt32Memory0()[arg0 / 4 + 0] = ptr0;
+    };
+    module2.exports.__wbg_get_723f83ba0c34871a = function(arg0, arg1) {
+      const ret = getObject(arg0)[takeObject(arg1)];
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_set_ce5827ace4c694dc = function(arg0, arg1, arg2) {
+      getObject(arg0)[takeObject(arg1)] = takeObject(arg2);
+    };
+    module2.exports.__wbg_new_abda76e883ba8a5f = function() {
+      const ret = new Error();
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_stack_658279fe44541cf6 = function(arg0, arg1) {
+      const ret = getObject(arg1).stack;
+      const ptr0 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+      const len0 = WASM_VECTOR_LEN;
+      getInt32Memory0()[arg0 / 4 + 1] = len0;
+      getInt32Memory0()[arg0 / 4 + 0] = ptr0;
+    };
+    module2.exports.__wbg_error_f851667af71bcfc6 = function(arg0, arg1) {
+      try {
+        console.error(getStringFromWasm0(arg0, arg1));
+      } finally {
+        wasm.__wbindgen_free(arg0, arg1);
+      }
+    };
+    module2.exports.__wbg_error_06ae29e21839d332 = function(arg0, arg1) {
+      console.error(getStringFromWasm0(arg0, arg1));
+    };
+    module2.exports.__wbg_get_57245cc7d7c7619d = function(arg0, arg1) {
+      const ret = getObject(arg0)[arg1 >>> 0];
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_length_6e3bbe7c8bd4dbd8 = function(arg0) {
+      const ret = getObject(arg0).length;
+      return ret;
+    };
+    module2.exports.__wbg_new_1d9a920c6bfc44a8 = function() {
+      const ret = new Array();
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbindgen_is_function = function(arg0) {
+      const ret = typeof getObject(arg0) === "function";
+      return ret;
+    };
+    module2.exports.__wbg_new_268f7b7dd3430798 = function() {
+      const ret = /* @__PURE__ */ new Map();
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_next_579e583d33566a86 = function(arg0) {
+      const ret = getObject(arg0).next;
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_next_aaef7c8aa5e212ac = function() {
+      return handleError(function(arg0) {
+        const ret = getObject(arg0).next();
+        return addHeapObject(ret);
+      }, arguments);
+    };
+    module2.exports.__wbg_done_1b73b0672e15f234 = function(arg0) {
+      const ret = getObject(arg0).done;
+      return ret;
+    };
+    module2.exports.__wbg_value_1ccc36bc03462d71 = function(arg0) {
+      const ret = getObject(arg0).value;
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_iterator_6f9d4f28845f426c = function() {
+      const ret = Symbol.iterator;
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_get_765201544a2b6869 = function() {
+      return handleError(function(arg0, arg1) {
+        const ret = Reflect.get(getObject(arg0), getObject(arg1));
+        return addHeapObject(ret);
+      }, arguments);
+    };
+    module2.exports.__wbg_call_97ae9d8645dc388b = function() {
+      return handleError(function(arg0, arg1) {
+        const ret = getObject(arg0).call(getObject(arg1));
+        return addHeapObject(ret);
+      }, arguments);
+    };
+    module2.exports.__wbg_new_0b9bfdd97583284e = function() {
+      const ret = new Object();
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_isArray_27c46c67f498e15d = function(arg0) {
+      const ret = Array.isArray(getObject(arg0));
+      return ret;
+    };
+    module2.exports.__wbg_push_740e4b286702d964 = function(arg0, arg1) {
+      const ret = getObject(arg0).push(getObject(arg1));
+      return ret;
+    };
+    module2.exports.__wbg_instanceof_ArrayBuffer_e5e48f4762c5610b = function(arg0) {
+      let result;
+      try {
+        result = getObject(arg0) instanceof ArrayBuffer;
+      } catch {
+        result = false;
+      }
+      const ret = result;
+      return ret;
+    };
+    module2.exports.__wbg_values_e42671acbf11ec04 = function(arg0) {
+      const ret = getObject(arg0).values();
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_new_8d2af00bc1e329ee = function(arg0, arg1) {
+      const ret = new Error(getStringFromWasm0(arg0, arg1));
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_setname_d26cefd43ea3a082 = function(arg0, arg1, arg2) {
+      getObject(arg0).name = getStringFromWasm0(arg1, arg2);
+    };
+    module2.exports.__wbg_set_933729cf5b66ac11 = function(arg0, arg1, arg2) {
+      const ret = getObject(arg0).set(getObject(arg1), getObject(arg2));
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_isSafeInteger_dfa0593e8d7ac35a = function(arg0) {
+      const ret = Number.isSafeInteger(getObject(arg0));
+      return ret;
+    };
+    module2.exports.__wbg_now_58886682b7e790d7 = function() {
+      const ret = Date.now();
+      return ret;
+    };
+    module2.exports.__wbg_entries_65a76a413fc91037 = function(arg0) {
+      const ret = Object.entries(getObject(arg0));
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_buffer_3f3d764d4747d564 = function(arg0) {
+      const ret = getObject(arg0).buffer;
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_new_8c3f0052272a457a = function(arg0) {
+      const ret = new Uint8Array(getObject(arg0));
+      return addHeapObject(ret);
+    };
+    module2.exports.__wbg_set_83db9690f9353e79 = function(arg0, arg1, arg2) {
+      getObject(arg0).set(getObject(arg1), arg2 >>> 0);
+    };
+    module2.exports.__wbg_length_9e1ae1900cb0fbd5 = function(arg0) {
+      const ret = getObject(arg0).length;
+      return ret;
+    };
+    module2.exports.__wbg_instanceof_Uint8Array_971eeda69eb75003 = function(arg0) {
+      let result;
+      try {
+        result = getObject(arg0) instanceof Uint8Array;
+      } catch {
+        result = false;
+      }
+      const ret = result;
+      return ret;
+    };
+    module2.exports.__wbg_has_8359f114ce042f5a = function() {
+      return handleError(function(arg0, arg1) {
+        const ret = Reflect.has(getObject(arg0), getObject(arg1));
+        return ret;
+      }, arguments);
+    };
+    module2.exports.__wbindgen_debug_string = function(arg0, arg1) {
+      const ret = debugString(getObject(arg1));
+      const ptr0 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+      const len0 = WASM_VECTOR_LEN;
+      getInt32Memory0()[arg0 / 4 + 1] = len0;
+      getInt32Memory0()[arg0 / 4 + 0] = ptr0;
+    };
+    module2.exports.__wbindgen_throw = function(arg0, arg1) {
+      throw new Error(getStringFromWasm0(arg0, arg1));
+    };
+    module2.exports.__wbindgen_memory = function() {
+      const ret = wasm.memory;
+      return addHeapObject(ret);
+    };
+    var path = require("path").join(__dirname, "polar_wasm_api_bg.wasm");
+    var bytes = require("fs").readFileSync(path);
+    var wasmModule = new WebAssembly.Module(bytes);
+    var wasmInstance = new WebAssembly.Instance(wasmModule, imports);
+    wasm = wasmInstance.exports;
+    module2.exports.__wasm = wasm;
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Polar.js
+var require_Polar = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Polar.js"(exports2) {
+    "use strict";
+    var __classPrivateFieldSet = exports2 && exports2.__classPrivateFieldSet || function(receiver, state, value, kind, f) {
+      if (kind === "m") throw new TypeError("Private method is not writable");
+      if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+      if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+      return kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value), value;
+    };
+    var __classPrivateFieldGet = exports2 && exports2.__classPrivateFieldGet || function(receiver, state, kind, f) {
+      if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+      if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+      return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+    };
+    var _Polar_ffiPolar;
+    var _Polar_host;
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.Polar = void 0;
+    var path_1 = require("path");
+    var readline_1 = require("readline");
+    var repl_1 = require("repl");
+    var errors_1 = require_errors();
+    var Query_1 = require_Query();
+    var Host_1 = require_Host();
+    var polar_wasm_api_1 = require_polar_wasm_api();
+    var Predicate_1 = require_Predicate();
+    var messages_1 = require_messages();
+    var types_1 = require_types();
+    var helpers_1 = require_helpers();
+    var Source = class {
+      constructor(src, filename) {
+        this.src = src;
+        this.filename = filename;
+      }
+    };
+    var Polar = class {
+      constructor(opts = {}) {
+        _Polar_ffiPolar.set(this, void 0);
+        _Polar_host.set(this, void 0);
+        __classPrivateFieldSet(this, _Polar_ffiPolar, new polar_wasm_api_1.Polar(), "f");
+        __classPrivateFieldGet(this, _Polar_ffiPolar, "f").setIgnoreNoAllowWarning(!!(process === null || process === void 0 ? void 0 : process.env.POLAR_IGNORE_NO_ALLOW_WARNING));
+        __classPrivateFieldSet(this, _Polar_host, new Host_1.Host(__classPrivateFieldGet(this, _Polar_ffiPolar, "f"), {
+          acceptExpression: false,
+          equalityFn: opts.equalityFn || helpers_1.defaultEqualityFn
+        }), "f");
+        this.registerConstant(null, "nil");
+        this.registerClass(Boolean);
+        this.registerClass(Number, { name: "Integer" });
+        this.registerClass(Number, { name: "Float" });
+        this.registerClass(String);
+        this.registerClass(Array, { name: "List" });
+        this.registerClass(types_1.Dict, { name: "Dictionary" });
+      }
+      /**
+       * Free the underlying WASM instance.
+       *
+       * Invariant: ensure that you do *not* do anything else with an instance
+       * after calling `free()` on it.
+       *
+       * This should *not* be something you need to do during the course of regular
+       * usage. It's generally only useful for scenarios where large numbers of
+       * instances are spun up and not cleanly reaped by the GC, such as during a
+       * long-running test process in 'watch' mode.
+       */
+      free() {
+        __classPrivateFieldGet(this, _Polar_ffiPolar, "f").free();
+      }
+      /**
+       * Process messages received from the Polar VM.
+       *
+       * @internal
+       */
+      processMessages() {
+        for (; ; ) {
+          const msg = __classPrivateFieldGet(this, _Polar_ffiPolar, "f").nextMessage();
+          if (msg === void 0)
+            break;
+          messages_1.processMessage(msg);
+        }
+      }
+      /**
+       * Clear rules from the Polar KB, but
+       * retain all registered classes and constants.
+       */
+      clearRules() {
+        __classPrivateFieldGet(this, _Polar_ffiPolar, "f").clearRules();
+        this.processMessages();
+      }
+      /**
+       * Load Polar policy files.
+       */
+      async loadFiles(filenames) {
+        if (filenames.length === 0)
+          return;
+        if (!path_1.extname) {
+          throw new errors_1.PolarError("loadFiles is not supported in the browser");
+        }
+        const sources = await Promise.all(filenames.map(async (filename) => {
+          if (path_1.extname(filename) !== ".polar")
+            throw new errors_1.PolarFileExtensionError(filename);
+          try {
+            const contents = await helpers_1.readFile(filename);
+            return new Source(contents, filename);
+          } catch (e) {
+            if (e.code === "ENOENT")
+              throw new errors_1.PolarFileNotFoundError(filename);
+            throw e;
+          }
+        }));
+        return this.loadSources(sources);
+      }
+      /**
+       * Load a Polar policy file.
+       *
+       * @deprecated `Oso.loadFile` has been deprecated in favor of `Oso.loadFiles`
+       * as of the 0.20 release. Please see changelog for migration instructions:
+       * https://docs.osohq.com/project/changelogs/2021-09-15.html
+       */
+      async loadFile(filename) {
+        console.error("`Oso.loadFile` has been deprecated in favor of `Oso.loadFiles` as of the 0.20 release.\n\nPlease see changelog for migration instructions: https://docs.osohq.com/project/changelogs/2021-09-15.html");
+        return this.loadFiles([filename]);
+      }
+      /**
+       * Load a Polar policy string.
+       */
+      async loadStr(contents, filename) {
+        return this.loadSources([new Source(contents, filename)]);
+      }
+      // Register MROs, load Polar code, and check inline queries.
+      async loadSources(sources) {
+        __classPrivateFieldGet(this, _Polar_ffiPolar, "f").load(sources);
+        this.processMessages();
+        return this.checkInlineQueries();
+      }
+      async checkInlineQueries() {
+        for (; ; ) {
+          const query = __classPrivateFieldGet(this, _Polar_ffiPolar, "f").nextInlineQuery();
+          this.processMessages();
+          if (query === void 0)
+            break;
+          const source = query.source();
+          const { results } = new Query_1.Query(query, this.getHost());
+          const { done } = await results.next();
+          await results.return();
+          if (done)
+            throw new errors_1.InlineQueryFailedError(source);
+        }
+      }
+      /**
+       * Query for a Polar predicate or string.
+       */
+      query(q, opts) {
+        const host = Host_1.Host.clone(this.getHost(), {
+          acceptExpression: (opts === null || opts === void 0 ? void 0 : opts.acceptExpression) || false
+        });
+        let ffiQuery;
+        if (helpers_1.isString(q)) {
+          ffiQuery = __classPrivateFieldGet(this, _Polar_ffiPolar, "f").newQueryFromStr(q);
+        } else {
+          const term = host.toPolar(q);
+          ffiQuery = __classPrivateFieldGet(this, _Polar_ffiPolar, "f").newQueryFromTerm(term);
+        }
+        this.processMessages();
+        return new Query_1.Query(ffiQuery, host, opts === null || opts === void 0 ? void 0 : opts.bindings).results;
+      }
+      queryRule(nameOrOpts, ...args) {
+        if (typeof nameOrOpts === "string")
+          return this.query(new Predicate_1.Predicate(nameOrOpts, args), {});
+        if (typeof args[0] !== "string")
+          throw new errors_1.PolarError("Invalid call of queryRule(): missing rule name");
+        const [ruleName, ...ruleArgs] = args;
+        return this.query(new Predicate_1.Predicate(ruleName, ruleArgs), nameOrOpts);
+      }
+      /**
+       * Query for a Polar rule, returning true if there are any results.
+       */
+      async queryRuleOnce(name, ...args) {
+        const results = this.query(new Predicate_1.Predicate(name, args));
+        const { done } = await results.next();
+        await results.return();
+        return !done;
+      }
+      /**
+       * Register a JavaScript class for use in Polar policies.
+       *
+       * @param cls The class to register.
+       * @param params An optional object with extra parameters.
+       */
+      registerClass(cls, params) {
+        const clsName = this.getHost().cacheClass(cls, params);
+        this.registerConstant(cls, clsName);
+        this.getHost().registerMros();
+      }
+      /**
+       * Register a JavaScript value for use in Polar policies.
+       */
+      registerConstant(value, name) {
+        const term = this.getHost().toPolar(value);
+        __classPrivateFieldGet(this, _Polar_ffiPolar, "f").registerConstant(name, term);
+      }
+      getHost() {
+        return __classPrivateFieldGet(this, _Polar_host, "f");
+      }
+      getFfi() {
+        return __classPrivateFieldGet(this, _Polar_ffiPolar, "f");
+      }
+      /** Start a REPL session. */
+      async repl(files) {
+        var _a;
+        if (typeof readline_1.createInterface !== "function")
+          throw new errors_1.PolarError("REPL is not supported in the browser");
+        try {
+          if (files === null || files === void 0 ? void 0 : files.length)
+            await this.loadFiles(files);
+        } catch (e) {
+          helpers_1.printError(e);
+        }
+        const repl = (_a = global.repl) === null || _a === void 0 ? void 0 : _a.repl;
+        if (repl) {
+          repl.setPrompt(helpers_1.PROMPT);
+          const evalQuery = this.evalReplInput.bind(this);
+          repl.eval = async (evalCmd, _ctx, _file, cb) => cb(null, await evalQuery(evalCmd));
+          const listeners = repl.listeners("exit");
+          repl.removeAllListeners("exit");
+          repl.prependOnceListener("exit", () => {
+            listeners.forEach((l) => repl.addListener("exit", l));
+            repl_1.start({ useGlobal: true });
+          });
+        } else {
+          const rl = readline_1.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+            prompt: helpers_1.PROMPT,
+            tabSize: 4
+          });
+          rl.prompt();
+          rl.on("line", async (line) => {
+            const result = await this.evalReplInput(line);
+            if (result !== void 0)
+              console.log(result);
+            rl.prompt();
+          });
+        }
+      }
+      /**
+       * Evaluate REPL input.
+       *
+       * @internal
+       */
+      async evalReplInput(query) {
+        const input = query.trim().replace(/;+$/, "");
+        try {
+          if (input !== "") {
+            const ffiQuery = __classPrivateFieldGet(this, _Polar_ffiPolar, "f").newQueryFromStr(input);
+            const query2 = new Query_1.Query(ffiQuery, this.getHost());
+            const results = [];
+            for await (const result of query2.results) {
+              results.push(result);
+            }
+            if (results.length === 0) {
+              return false;
+            } else {
+              for (const result of results) {
+                for (const [variable, value] of result) {
+                  console.log(variable + " = " + helpers_1.repr(value));
+                }
+              }
+              return true;
+            }
+          }
+        } catch (e) {
+          helpers_1.printError(e);
+        }
+      }
+    };
+    exports2.Polar = Polar;
+    _Polar_ffiPolar = /* @__PURE__ */ new WeakMap(), _Polar_host = /* @__PURE__ */ new WeakMap();
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Oso.js
+var require_Oso = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/Oso.js"(exports2) {
+    "use strict";
+    var __classPrivateFieldSet = exports2 && exports2.__classPrivateFieldSet || function(receiver, state, value, kind, f) {
+      if (kind === "m") throw new TypeError("Private method is not writable");
+      if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+      if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+      return kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value), value;
+    };
+    var __classPrivateFieldGet = exports2 && exports2.__classPrivateFieldGet || function(receiver, state, kind, f) {
+      if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+      if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+      return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+    };
+    var _Oso_notFoundError;
+    var _Oso_forbiddenError;
+    var _Oso_readAction;
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.Oso = void 0;
+    var Polar_1 = require_Polar();
+    var Variable_1 = require_Variable();
+    var Expression_1 = require_Expression();
+    var Pattern_1 = require_Pattern();
+    var errors_1 = require_errors();
+    var filter_1 = require_filter();
+    var Oso = class extends Polar_1.Polar {
+      constructor(opts = {}) {
+        super(opts);
+        _Oso_notFoundError.set(this, errors_1.NotFoundError);
+        _Oso_forbiddenError.set(this, errors_1.ForbiddenError);
+        _Oso_readAction.set(this, "read");
+        if (opts.notFoundError)
+          __classPrivateFieldSet(this, _Oso_notFoundError, opts.notFoundError, "f");
+        if (opts.forbiddenError)
+          __classPrivateFieldSet(this, _Oso_forbiddenError, opts.forbiddenError, "f");
+        if (opts.readAction)
+          __classPrivateFieldSet(this, _Oso_readAction, opts.readAction, "f");
+      }
+      /**
+       * Query the knowledge base to determine whether an actor is allowed to
+       * perform an action upon a resource.
+       *
+       * @param actor Subject.
+       * @param action Verb.
+       * @param resource Object.
+       * @returns An access control decision.
+       */
+      async isAllowed(actor, action, resource) {
+        return this.queryRuleOnce("allow", actor, action, resource);
+      }
+      /**
+       * Ensure that `actor` is allowed to perform `action` on
+       * `resource`.
+       *
+       * If the action is permitted with an `allow` rule in the policy, then
+       * this method returns `None`. If the action is not permitted by the
+       * policy, this method will raise an error.
+       *
+       * The error raised by this method depends on whether the actor can perform
+       * the `"read"` action on the resource. If they cannot read the resource,
+       * then a `NotFound` error is raised. Otherwise, a `ForbiddenError` is
+       * raised.
+       *
+       * @param actor The actor performing the request.
+       * @param action The action the actor is attempting to perform.
+       * @param resource The resource being accessed.
+       * @param checkRead If set to `false`, a `ForbiddenError` is always
+       *   thrown on authorization failures, regardless of whether the actor can
+       *   read the resource. Default is `true`.
+       */
+      async authorize(actor, action, resource, options = {}) {
+        if (typeof options.checkRead === "undefined")
+          options.checkRead = true;
+        if (await this.queryRuleOnce("allow", actor, action, resource)) {
+          return;
+        }
+        let isNotFound = false;
+        if (options.checkRead) {
+          if (action === __classPrivateFieldGet(this, _Oso_readAction, "f")) {
+            isNotFound = true;
+          } else {
+            const canRead = await this.queryRuleOnce("allow", actor, __classPrivateFieldGet(this, _Oso_readAction, "f"), resource);
+            if (!canRead) {
+              isNotFound = true;
+            }
+          }
+        }
+        const ErrorClass = isNotFound ? __classPrivateFieldGet(this, _Oso_notFoundError, "f") : __classPrivateFieldGet(this, _Oso_forbiddenError, "f");
+        throw new ErrorClass();
+      }
+      /**
+       * Determine the actions `actor` is allowed to take on `resource`.
+       *
+       * Collects all actions allowed by allow rules in the Polar policy for the
+       * given combination of actor and resource.
+       *
+       * @param actor The actor for whom to collect allowed actions
+       * @param resource The resource being accessed
+       * @param allowWildcard Flag to determine behavior if the policy
+       *   includes a wildcard action. E.g., a rule allowing any action:
+       *   `allow(_actor, _action, _resource)`. If `true`, the method will
+       *   return `["*"]`, if `false`, the method will raise an exception.
+       * @returns A list of the unique allowed actions.
+       */
+      async authorizedActions(actor, resource, options = {}) {
+        const results = this.queryRule("allow", actor, new Variable_1.Variable("action"), resource);
+        const actions = /* @__PURE__ */ new Set();
+        for await (const result of results) {
+          const action = result.get("action");
+          if (action instanceof Variable_1.Variable) {
+            if (!options.allowWildcard) {
+              throw new errors_1.OsoError(`
+            The result of authorizedActions() contained an "unconstrained" action that could represent any action, but allowWildcard was set to False. To fix, set allowWildcard to True and compare with the "*" string.
+          `);
+            } else {
+              return /* @__PURE__ */ new Set(["*"]);
+            }
+          }
+          actions.add(action);
+        }
+        return actions;
+      }
+      /**
+       * Ensure that `actor` is allowed to send `request` to the server.
+       *
+       * Checks the `allow_request` rule of a policy.
+       *
+       * If the request is permitted with an `allow_request` rule in the
+       * policy, then this method returns nothing. Otherwise, this method raises
+       * a `ForbiddenError`.
+       *
+       * @param actor The actor performing the request.
+       * @param request An object representing the request that was sent by the
+       *   actor.
+       */
+      async authorizeRequest(actor, request) {
+        const isAllowed = await this.queryRuleOnce("allow_request", actor, request);
+        if (!isAllowed) {
+          throw new (__classPrivateFieldGet(this, _Oso_forbiddenError, "f"))();
+        }
+      }
+      /**
+       * Ensure that `actor` is allowed to perform `action` on a given
+       * `resource`'s `field`.
+       *
+       * If the action is permitted by an `allow_field` rule in the policy,
+       * then this method returns nothing. If the action is not permitted by the
+       * policy, this method will raise a `ForbiddenError`.
+       *
+       * @param actor The actor performing the request.
+       * @param action The action the actor is attempting to perform on the
+       * field.
+       * @param resource The resource being accessed.
+       * @param field The name of the field being accessed.
+       */
+      async authorizeField(actor, action, resource, field) {
+        const isAllowed = await this.queryRuleOnce("allow_field", actor, action, resource, field);
+        if (!isAllowed) {
+          throw new (__classPrivateFieldGet(this, _Oso_forbiddenError, "f"))();
+        }
+      }
+      /**
+       * Determine the fields of `resource` on which `actor` is allowed to
+       * perform  `action`.
+       *
+       * Uses `allow_field` rules in the policy to find all allowed fields.
+       *
+       * @param actor The actor for whom to collect allowed fields.
+       * @param action The action being taken on the field.
+       * @param resource The resource being accessed.
+       * @param allowWildcard Flag to determine behavior if the policy \
+       *   includes a wildcard field. E.g., a rule allowing any field: \
+       *   `allow_field(_actor, _action, _resource, _field)`. If `true`, the \
+       *   method will return `["*"]`, if `false`, the method will raise an \
+       *   exception.
+       * @returns A list of the unique allowed fields.
+       */
+      async authorizedFields(actor, action, resource, options = {}) {
+        const results = this.queryRule("allow_field", actor, action, resource, new Variable_1.Variable("field"));
+        const fields = /* @__PURE__ */ new Set();
+        for await (const result of results) {
+          const field = result.get("field");
+          if (field instanceof Variable_1.Variable) {
+            if (!options.allowWildcard) {
+              throw new errors_1.OsoError(`
+            The result of authorizedFields() contained an "unconstrained" field that could represent any field, but allowWildcard was set to False. To fix, set allowWildcard to True and compare with the "*" string.
+          `);
+            } else {
+              return /* @__PURE__ */ new Set(["*"]);
+            }
+          }
+          fields.add(field);
+        }
+        return fields;
+      }
+      /**
+       * Create a query for all the resources of type `resourceCls` that `actor` is
+       * allowed to perform `action` on.
+       *
+       * @param actor Subject.
+       * @param action Verb.
+       * @param resourceCls Object type.
+       * @returns A query that selects authorized resources of type `resourceCls`
+       */
+      async authorizedQuery(actor, action, resourceCls) {
+        var _a;
+        const resource = new Variable_1.Variable("resource");
+        const host = this.getHost();
+        let clsName;
+        if (typeof resourceCls === "string") {
+          clsName = resourceCls;
+        } else {
+          clsName = (_a = host.getType(resourceCls)) === null || _a === void 0 ? void 0 : _a.name;
+          if (clsName === void 0)
+            throw new errors_1.UnregisteredClassError(resourceCls.name);
+        }
+        const constraint = new Expression_1.Expression("And", [
+          new Expression_1.Expression("Isa", [
+            resource,
+            new Pattern_1.Pattern({ tag: clsName, fields: {} })
+          ])
+        ]);
+        const bindings = /* @__PURE__ */ new Map();
+        bindings.set("resource", constraint);
+        const results = this.queryRule({
+          bindings,
+          acceptExpression: true
+        }, "allow", actor, action, resource);
+        const queryResults = [];
+        for await (const result of results) {
+          queryResults.push({
+            // convert bindings back into Polar
+            bindings: new Map([...result.entries()].map(([k, v]) => [k, host.toPolar(v)]))
+          });
+        }
+        const dataFilter = this.getFfi().buildDataFilter(host.serializeTypes(), queryResults, "resource", clsName);
+        const filter = await filter_1.parseFilter(dataFilter, host);
+        return host.adapter.buildQuery(filter);
+      }
+      /**
+       * Determine the resources of type `resourceCls` that `actor`
+       * is allowed to perform `action` on.
+       *
+       * @param actor Subject.
+       * @param action Verb.
+       * @param resourceCls Object type or string name of class
+       * @returns An array of authorized resources.
+       */
+      async authorizedResources(actor, action, resourceCls) {
+        const query = await this.authorizedQuery(actor, action, resourceCls);
+        if (!query)
+          return [];
+        return this.getHost().adapter.executeQuery(query);
+      }
+      /**
+       * Register adapter for data filtering query functions.
+       */
+      setDataFilteringAdapter(adapter) {
+        this.getHost().adapter = adapter;
+      }
+    };
+    exports2.Oso = Oso;
+    _Oso_notFoundError = /* @__PURE__ */ new WeakMap(), _Oso_forbiddenError = /* @__PURE__ */ new WeakMap(), _Oso_readAction = /* @__PURE__ */ new WeakMap();
+  }
+});
+
+// node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/index.js
+var require_src = __commonJS({
+  "node_modules/.pnpm/oso@0.27.3/node_modules/oso/dist/src/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.defaultEqualityFn = exports2.Relation = exports2.NotFoundError = exports2.ForbiddenError = exports2.AuthorizationError = exports2.Variable = exports2.Oso = void 0;
+    var Oso_1 = require_Oso();
+    Object.defineProperty(exports2, "Oso", { enumerable: true, get: function() {
+      return Oso_1.Oso;
+    } });
+    var Variable_1 = require_Variable();
+    Object.defineProperty(exports2, "Variable", { enumerable: true, get: function() {
+      return Variable_1.Variable;
+    } });
+    var errors_1 = require_errors();
+    Object.defineProperty(exports2, "AuthorizationError", { enumerable: true, get: function() {
+      return errors_1.AuthorizationError;
+    } });
+    Object.defineProperty(exports2, "ForbiddenError", { enumerable: true, get: function() {
+      return errors_1.ForbiddenError;
+    } });
+    Object.defineProperty(exports2, "NotFoundError", { enumerable: true, get: function() {
+      return errors_1.NotFoundError;
+    } });
+    var filter_1 = require_filter();
+    Object.defineProperty(exports2, "Relation", { enumerable: true, get: function() {
+      return filter_1.Relation;
+    } });
+    var helpers_1 = require_helpers();
+    Object.defineProperty(exports2, "defaultEqualityFn", { enumerable: true, get: function() {
+      return helpers_1.defaultEqualityFn;
+    } });
+  }
+});
+
+// src/lib/policy/oso-engine.ts
+var oso_engine_exports = {};
+__export(oso_engine_exports, {
+  OsoPolicyEngine: () => OsoPolicyEngine
+});
+var User, Tool, FilePath, AgentSession, OsoPolicyEngine;
+var init_oso_engine = __esm({
+  "src/lib/policy/oso-engine.ts"() {
+    "use strict";
+    User = class {
+      constructor(role, orgUnit) {
+        this.role = role;
+        this.orgUnit = orgUnit;
+      }
+    };
+    Tool = class {
+      constructor(name) {
+        this.name = name;
+      }
+    };
+    FilePath = class {
+      constructor(path, orgUnit) {
+        this.path = path;
+        this.orgUnit = orgUnit;
+      }
+    };
+    AgentSession = class {
+    };
+    OsoPolicyEngine = class _OsoPolicyEngine {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      oso;
+      roleConfigs = /* @__PURE__ */ new Map();
+      constructor() {
+      }
+      static async create(polarFiles, factStore) {
+        let OsoClass;
+        try {
+          const osoModule = await Promise.resolve().then(() => __toESM(require_src(), 1));
+          OsoClass = osoModule.Oso;
+        } catch {
+          throw new Error(
+            "oso package is not installed. Install it with: npm install oso\nOr switch to the YAML policy engine: policy.engine: yaml"
+          );
+        }
+        const engine = new _OsoPolicyEngine();
+        engine.oso = new OsoClass();
+        engine.oso.registerClass(User);
+        engine.oso.registerClass(Tool);
+        engine.oso.registerClass(FilePath);
+        engine.oso.registerClass(AgentSession);
+        for (const file of polarFiles) {
+          await engine.oso.loadFiles([file]);
+        }
+        const bindings = await factStore.getAllRoleBindings();
+        for (const binding of bindings) {
+          if (binding.config) {
+            engine.roleConfigs.set(binding.role, binding.config);
+          }
+        }
+        return engine;
+      }
+      evaluateTool(role, tool) {
+        const user = new User(role);
+        const toolResource = new Tool(tool);
+        try {
+          const result = this.oso.isAllowedSync?.(user, "invoke", toolResource);
+          if (result !== void 0) {
+            return result ? "allow" : "deny";
+          }
+        } catch {
+        }
+        return "deny";
+      }
+      async evaluateToolAsync(role, tool) {
+        const user = new User(role);
+        const toolResource = new Tool(tool);
+        const allowed = await this.oso.isAllowed(user, "invoke", toolResource);
+        return allowed ? "allow" : "deny";
+      }
+      evaluatePath(role, orgUnit, operation, _path) {
+        const user = new User(role, orgUnit);
+        const filePath = new FilePath(_path, orgUnit);
+        try {
+          const result = this.oso.isAllowedSync?.(user, operation, filePath);
+          if (result !== void 0) {
+            return result ? "allow" : "deny";
+          }
+        } catch {
+        }
+        return "deny";
+      }
+      async evaluatePathAsync(role, orgUnit, operation, path) {
+        const user = new User(role, orgUnit);
+        const filePath = new FilePath(path, orgUnit);
+        const allowed = await this.oso.isAllowed(user, operation, filePath);
+        return allowed ? "allow" : "deny";
+      }
+      requiresApproval(role, tool) {
+        try {
+          const user = new User(role);
+          const toolResource = new Tool(tool);
+          const result = this.oso.isAllowedSync?.(user, "auto_approve", toolResource);
+          if (result !== void 0) return !result;
+        } catch {
+        }
+        return true;
+      }
+      getExecutionMode(role) {
+        const config = this.roleConfigs.get(role);
+        return config?.execution_mode ?? "supervised";
+      }
+      getTemplateName(role) {
+        const config = this.roleConfigs.get(role);
+        return config?.prompt_template ?? "project-lead";
+      }
+      getBashOverrides(role) {
+        const config = this.roleConfigs.get(role);
+        const overrides = config?.bash_overrides;
+        if (!overrides) return {};
+        return {
+          additionalBlocked: overrides.additional_blocked?.map((p) => new RegExp(p)),
+          additionalAllowed: overrides.additional_allowed?.map((p) => new RegExp(p))
+        };
+      }
+      getTokenBudget(role) {
+        const config = this.roleConfigs.get(role);
+        return config?.token_budget_daily ?? -1;
+      }
+    };
+  }
+});
+
+// src/lib/facts/oso-memory-store.ts
+var oso_memory_store_exports = {};
+__export(oso_memory_store_exports, {
+  OsoMemoryFactStore: () => OsoMemoryFactStore
+});
+var OsoMemoryFactStore;
+var init_oso_memory_store = __esm({
+  "src/lib/facts/oso-memory-store.ts"() {
+    "use strict";
+    OsoMemoryFactStore = class {
+      bindings = [];
+      relations = [];
+      addRoleBinding(binding) {
+        this.bindings.push(binding);
+      }
+      addRelation(relation) {
+        this.relations.push(relation);
+      }
+      async getRoles(userId) {
+        return this.bindings.filter((b) => b.userId === userId);
+      }
+      async getAllRoleBindings() {
+        return [...this.bindings];
+      }
+      async getRelations(subject, predicate) {
+        return this.relations.filter((r) => r.subject === subject && r.predicate === predicate);
+      }
+    };
+  }
+});
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AuditLogger: () => AuditLogger,
+  BashClassifier: () => BashClassifier,
+  BudgetTracker: () => BudgetTracker,
+  CliApprover: () => CliApprover,
   ConfigValidationError: () => ConfigValidationError,
-  loadConfig: () => loadConfig
+  ConfigWatcher: () => ConfigWatcher,
+  DANGEROUS_PATTERNS: () => DANGEROUS_PATTERNS,
+  EnvIdentityProvider: () => EnvIdentityProvider,
+  IdentityChain: () => IdentityChain,
+  JsonlAuditSink: () => JsonlAuditSink,
+  LocalIdentityProvider: () => LocalIdentityProvider,
+  OsoMemoryFactStore: () => OsoMemoryFactStore,
+  SAFE_PATTERNS: () => SAFE_PATTERNS,
+  TemplateSelector: () => TemplateSelector,
+  WebhookApprover: () => WebhookApprover,
+  WebhookAuditSink: () => WebhookAuditSink,
+  YamlFactStore: () => YamlFactStore,
+  YamlPolicyEngine: () => YamlPolicyEngine,
+  createApprovalFlow: () => createApprovalFlow,
+  createIdentityChain: () => createIdentityChain,
+  createPolicyEngine: () => createPolicyEngine,
+  loadConfig: () => loadConfig,
+  renderTemplate: () => render
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -143,13 +3896,15 @@ var DEFAULTS = {
 };
 
 // src/lib/config/loader.ts
-var CONFIG_PATHS = [
-  process.env.GRWND_GOVERNANCE_CONFIG,
-  ".pi/governance.yaml",
-  `${process.env.HOME}/.pi/agent/governance.yaml`
-];
+function getConfigPaths() {
+  return [
+    process.env["GRWND_GOVERNANCE_CONFIG"],
+    ".pi/governance.yaml",
+    `${process.env["HOME"]}/.pi/agent/governance.yaml`
+  ];
+}
 function loadConfig() {
-  for (const path of CONFIG_PATHS) {
+  for (const path of getConfigPaths()) {
     if (path && (0, import_fs.existsSync)(path)) {
       const raw = (0, import_fs.readFileSync)(path, "utf-8");
       const parsed = (0, import_yaml.parse)(raw);
@@ -187,9 +3942,788 @@ ${details}`);
     this.name = "ConfigValidationError";
   }
 };
+
+// src/lib/policy/yaml-engine.ts
+var import_fs2 = require("fs");
+var import_yaml2 = require("yaml");
+var import_minimatch = require("minimatch");
+var YamlPolicyEngine = class {
+  rules;
+  constructor(rulesFilePathOrRules) {
+    if (typeof rulesFilePathOrRules === "string") {
+      const raw = (0, import_fs2.readFileSync)(rulesFilePathOrRules, "utf-8");
+      this.rules = (0, import_yaml2.parse)(raw);
+    } else {
+      this.rules = rulesFilePathOrRules;
+    }
+  }
+  getRole(role) {
+    const r = this.rules.roles[role];
+    if (!r) {
+      throw new Error(
+        `Unknown role: ${role}. Available roles: ${Object.keys(this.rules.roles).join(", ")}`
+      );
+    }
+    return r;
+  }
+  evaluateTool(role, tool) {
+    const r = this.getRole(role);
+    if (r.blocked_tools.includes(tool)) return "deny";
+    if (r.allowed_tools.includes("all") || r.allowed_tools.includes(tool)) {
+      return "allow";
+    }
+    return "deny";
+  }
+  evaluatePath(role, _orgUnit, _operation, path) {
+    const r = this.getRole(role);
+    for (const pattern of r.blocked_paths) {
+      if ((0, import_minimatch.minimatch)(path, pattern, { dot: true })) {
+        return "deny";
+      }
+    }
+    for (const pattern of r.allowed_paths) {
+      const resolved = pattern.replace("{{project_path}}", process.cwd());
+      if ((0, import_minimatch.minimatch)(path, resolved, { dot: true })) {
+        return "allow";
+      }
+    }
+    return "deny";
+  }
+  requiresApproval(role, tool) {
+    const r = this.getRole(role);
+    if (r.human_approval.auto_approve?.includes(tool)) return false;
+    if (r.human_approval.required_for.includes("all")) return true;
+    return r.human_approval.required_for.includes(tool);
+  }
+  getExecutionMode(role) {
+    return this.getRole(role).execution_mode;
+  }
+  getTemplateName(role) {
+    return this.getRole(role).prompt_template;
+  }
+  getBashOverrides(role) {
+    const r = this.getRole(role);
+    const overrides = r.bash_overrides;
+    if (!overrides) return {};
+    return {
+      additionalBlocked: overrides.additional_blocked?.map((p) => new RegExp(p)),
+      additionalAllowed: overrides.additional_allowed?.map((p) => new RegExp(p))
+    };
+  }
+  getTokenBudget(role) {
+    return this.getRole(role).token_budget_daily;
+  }
+};
+
+// src/lib/policy/factory.ts
+async function createPolicyEngine(config) {
+  const engine = config?.engine ?? "yaml";
+  if (engine === "yaml") {
+    const rulesFile = config?.yaml?.rules_file ?? "./governance-rules.yaml";
+    return new YamlPolicyEngine(rulesFile);
+  }
+  if (engine === "oso") {
+    const { OsoPolicyEngine: OsoPolicyEngine2 } = await Promise.resolve().then(() => (init_oso_engine(), oso_engine_exports));
+    const { OsoMemoryFactStore: OsoMemoryFactStore2 } = await Promise.resolve().then(() => (init_oso_memory_store(), oso_memory_store_exports));
+    const polarFiles = config?.oso?.polar_files ?? [
+      "./policies/base.polar",
+      "./policies/tools.polar"
+    ];
+    const factStore = new OsoMemoryFactStore2();
+    return OsoPolicyEngine2.create(polarFiles, factStore);
+  }
+  throw new Error(`Unknown policy engine: ${engine}. Must be 'yaml' or 'oso'.`);
+}
+
+// src/lib/identity/env-provider.ts
+var EnvIdentityProvider = class {
+  constructor(userVar = "GRWND_USER", roleVar = "GRWND_ROLE", orgUnitVar = "GRWND_ORG_UNIT") {
+    this.userVar = userVar;
+    this.roleVar = roleVar;
+    this.orgUnitVar = orgUnitVar;
+  }
+  name = "env";
+  async resolve() {
+    const userId = process.env[this.userVar];
+    const role = process.env[this.roleVar];
+    const orgUnit = process.env[this.orgUnitVar];
+    if (!userId || !role) return null;
+    return {
+      userId,
+      role,
+      orgUnit: orgUnit ?? "default",
+      source: "env"
+    };
+  }
+};
+
+// src/lib/identity/local-provider.ts
+var import_fs3 = require("fs");
+var import_yaml3 = require("yaml");
+var LocalIdentityProvider = class {
+  name = "local";
+  users;
+  constructor(usersFilePath) {
+    const raw = (0, import_fs3.readFileSync)(usersFilePath, "utf-8");
+    this.users = (0, import_yaml3.parse)(raw);
+  }
+  async resolve() {
+    const username = process.env.USER || process.env.USERNAME;
+    if (!username) return null;
+    const entry = this.users[username];
+    if (!entry) return null;
+    return {
+      userId: username,
+      role: entry.role,
+      orgUnit: entry.org_unit ?? "default",
+      source: "local"
+    };
+  }
+};
+
+// src/lib/identity/chain.ts
+var IdentityChain = class {
+  providers;
+  constructor(providers) {
+    this.providers = providers;
+  }
+  async resolve() {
+    for (const provider of this.providers) {
+      const identity = await provider.resolve();
+      if (identity) return identity;
+    }
+    return {
+      userId: "unknown",
+      role: "analyst",
+      // most restrictive role by default
+      orgUnit: "default",
+      source: "fallback"
+    };
+  }
+};
+function createIdentityChain(config) {
+  const providers = [];
+  providers.push(
+    new EnvIdentityProvider(
+      config?.env?.user_var,
+      config?.env?.role_var,
+      config?.env?.org_unit_var
+    )
+  );
+  if (config?.provider === "local" && config.local?.users_file) {
+    try {
+      providers.push(new LocalIdentityProvider(config.local.users_file));
+    } catch {
+    }
+  }
+  return new IdentityChain(providers);
+}
+
+// src/lib/facts/yaml-store.ts
+var import_node_fs = require("fs");
+var import_yaml4 = require("yaml");
+var YamlFactStore = class {
+  bindings;
+  constructor(input) {
+    if (typeof input === "string") {
+      const raw = (0, import_node_fs.readFileSync)(input, "utf-8");
+      const parsed = (0, import_yaml4.parse)(raw);
+      this.bindings = this.parseUsers(parsed);
+    } else {
+      this.bindings = this.parseUsers(input);
+    }
+  }
+  parseUsers(users) {
+    return Object.entries(users).map(([userId, entry]) => ({
+      userId,
+      role: entry.role,
+      orgUnit: entry.org_unit ?? "default",
+      config: entry.config
+    }));
+  }
+  async getRoles(userId) {
+    return this.bindings.filter((b) => b.userId === userId);
+  }
+  async getAllRoleBindings() {
+    return [...this.bindings];
+  }
+  async getRelations(_subject, _predicate) {
+    return [];
+  }
+};
+
+// src/index.ts
+init_oso_memory_store();
+
+// src/lib/bash/patterns.ts
+var SAFE_PATTERNS = [
+  // File viewing
+  /^(cat|head|tail|less|more)\s/,
+  /^(file|stat|wc|md5sum|sha256sum)\s/,
+  // Directory listing
+  /^(ls|ll|la|tree|du|df)\b/,
+  /^(pwd|cd)\b/,
+  // Searching
+  /^(grep|rg|ag|ack|find|fd|locate)\s/,
+  /^(which|whereis|type|command)\s/,
+  // Text processing (read-only)
+  /^(sort|uniq|cut|awk|sed)\s.*(?!-i)/,
+  // sed without -i (in-place)
+  /^(tr|diff|comm|join|paste)\s/,
+  /^(jq|yq|xmlstarlet)\s/,
+  // Git (read-only operations)
+  /^git\s+(log|status|diff|show|blame|branch|tag|remote|stash list)\b/,
+  /^git\s+(ls-files|ls-tree|rev-parse|describe)\b/,
+  // System info
+  /^(whoami|id|groups|uname|hostname|date|uptime|env|printenv)\b/,
+  /^(echo|printf)\s/,
+  // Package info (not install)
+  /^(npm|yarn|pnpm)\s+(list|ls|info|show|view|outdated|audit)\b/,
+  /^pip\s+(list|show|freeze)\b/,
+  /^(node|python|ruby|go)\s+--version\b/,
+  /^(node|python|ruby)\s+-e\s/,
+  // Networking (read-only)
+  /^(ping|dig|nslookup|host|traceroute|tracepath)\s/,
+  /^curl\s.*--head\b/,
+  /^curl\s.*-I\b/,
+  // Additional file viewing / inspection
+  /^(basename|dirname|realpath|readlink)\s/,
+  /^(xxd|od|hexdump)\s/,
+  /^(strings|nm|objdump)\s/,
+  // Additional search / navigation
+  /^(xargs)\s/,
+  /^(tee)\s/,
+  // Additional text processing (read-only)
+  /^(fmt|fold|column|expand|unexpand)\s/,
+  /^(tac|rev|nl)\s/,
+  /^(yes|seq|shuf)\s/,
+  // Additional system info
+  /^(lsof|ps|top|htop|vmstat|iostat|free|df)\b/,
+  /^(lscpu|lsblk|lsusb|lspci)\b/,
+  /^(nproc|getconf)\b/,
+  // Additional git read-only
+  /^git\s+(config\s+--get|config\s+-l|shortlog|reflog|cherry)\b/,
+  /^git\s+(cat-file|count-objects|fsck|verify-pack)\b/
+];
+var DANGEROUS_PATTERNS = [
+  // Destructive file operations
+  /\brm\s+(-[a-zA-Z]*r|-[a-zA-Z]*f|--recursive|--force)\b/,
+  /\brm\s+-[a-zA-Z]*rf\b/,
+  /\bshred\b/,
+  // Privilege escalation
+  /\bsudo\b/,
+  /\bsu\s+-?\s*\w/,
+  /\bdoas\b/,
+  // Permission/ownership changes
+  /\bchmod\b/,
+  /\bchown\b/,
+  /\bchgrp\b/,
+  // Disk/partition operations
+  /\bdd\b.*\bof=/,
+  /\bmkfs\b/,
+  /\bfdisk\b/,
+  /\bparted\b/,
+  /\bmount\b/,
+  /\bumount\b/,
+  // Remote code execution
+  /\bcurl\b.*\|\s*(bash|sh|zsh|python|perl|ruby)\b/,
+  /\bwget\b.*\|\s*(bash|sh|zsh|python|perl|ruby)\b/,
+  /\bcurl\b.*>\s*.*\.sh\s*&&/,
+  // Remote access
+  /\bssh\b/,
+  /\bscp\b/,
+  /\brsync\b.*:\//,
+  /\bnc\s+(-[a-zA-Z]*l|-[a-zA-Z]*p|--listen)\b/,
+  /\bncat\b/,
+  /\bsocat\b/,
+  /\btelnet\b/,
+  // System modification
+  /\bsystemctl\s+(start|stop|restart|enable|disable)\b/,
+  /\bservice\s+\w+\s+(start|stop|restart)\b/,
+  /\biptables\b/,
+  /\bufw\b/,
+  /\bfirewall-cmd\b/,
+  // Package installation (can run arbitrary post-install scripts)
+  /\bnpm\s+(install|i|add|ci)\b/,
+  /\byarn\s+(add|install)\b/,
+  /\bpnpm\s+(add|install|i)\b/,
+  /\bpip\s+install\b/,
+  /\bapt(-get)?\s+install\b/,
+  /\bbrew\s+install\b/,
+  /\bcargo\s+install\b/,
+  // Environment variable manipulation (can leak secrets)
+  /\bexport\b.*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)/i,
+  // Cron / scheduled tasks
+  /\bcrontab\b/,
+  /\bat\s+/,
+  // Container escape vectors
+  /\bdocker\s+(run|exec|build|push|pull)\b/,
+  /\bkubectl\s+(exec|run|apply|delete)\b/,
+  // Process manipulation
+  /\bkill\b/,
+  /\bkillall\b/,
+  /\bpkill\b/,
+  // History manipulation
+  /\bhistory\s+-c\b/,
+  /\bunset\s+HISTFILE\b/,
+  // Compiler/build (can execute arbitrary code)
+  /\bmake\s/,
+  /\bgcc\b/,
+  /\bg\+\+/
+];
+
+// src/lib/bash/classifier.ts
+var BashClassifier = class {
+  safePatterns;
+  dangerousPatterns;
+  constructor(overrides) {
+    this.safePatterns = [...SAFE_PATTERNS, ...overrides?.additionalAllowed ?? []];
+    this.dangerousPatterns = [...DANGEROUS_PATTERNS, ...overrides?.additionalBlocked ?? []];
+  }
+  classify(command) {
+    const trimmed = command.trim();
+    for (const pattern of this.dangerousPatterns) {
+      if (pattern.test(trimmed)) return "dangerous";
+    }
+    const segments = this.splitCommand(trimmed);
+    if (segments.length > 1) {
+      const classifications = segments.map((s) => this.classifySingle(s));
+      if (classifications.includes("dangerous")) return "dangerous";
+      if (classifications.includes("needs_review")) return "needs_review";
+      return "safe";
+    }
+    return this.classifySingle(trimmed);
+  }
+  classifySingle(command) {
+    const trimmed = command.trim();
+    for (const pattern of this.dangerousPatterns) {
+      if (pattern.test(trimmed)) return "dangerous";
+    }
+    for (const pattern of this.safePatterns) {
+      if (pattern.test(trimmed)) return "safe";
+    }
+    return "needs_review";
+  }
+  splitCommand(command) {
+    const segments = [];
+    let current = "";
+    let inSingleQuote = false;
+    let inDoubleQuote = false;
+    let escaped = false;
+    for (let i = 0; i < command.length; i++) {
+      const char = command[i];
+      if (escaped) {
+        current += char;
+        escaped = false;
+        continue;
+      }
+      if (char === "\\") {
+        escaped = true;
+        current += char;
+        continue;
+      }
+      if (char === "'" && !inDoubleQuote) {
+        inSingleQuote = !inSingleQuote;
+        current += char;
+        continue;
+      }
+      if (char === '"' && !inSingleQuote) {
+        inDoubleQuote = !inDoubleQuote;
+        current += char;
+        continue;
+      }
+      if (!inSingleQuote && !inDoubleQuote) {
+        if (char === "|" && command[i + 1] !== "|") {
+          segments.push(current.trim());
+          current = "";
+          continue;
+        }
+        if (char === ";") {
+          segments.push(current.trim());
+          current = "";
+          continue;
+        }
+        if (char === "&" && command[i + 1] === "&") {
+          segments.push(current.trim());
+          current = "";
+          i++;
+          continue;
+        }
+        if (char === "|" && command[i + 1] === "|") {
+          segments.push(current.trim());
+          current = "";
+          i++;
+          continue;
+        }
+      }
+      current += char;
+    }
+    if (current.trim()) segments.push(current.trim());
+    return segments.filter((s) => s.length > 0);
+  }
+};
+
+// src/lib/budget/tracker.ts
+var BudgetTracker = class {
+  _used = 0;
+  _budget;
+  constructor(budget) {
+    this._budget = budget;
+  }
+  /** Returns false if consuming would exceed the budget. On success, increments the counter. */
+  consume(amount = 1) {
+    if (this._budget === -1) {
+      this._used += amount;
+      return true;
+    }
+    if (this._used + amount > this._budget) return false;
+    this._used += amount;
+    return true;
+  }
+  remaining() {
+    if (this._budget === -1) return Infinity;
+    return Math.max(0, this._budget - this._used);
+  }
+  used() {
+    return this._used;
+  }
+  isUnlimited() {
+    return this._budget === -1;
+  }
+};
+
+// src/lib/config/watcher.ts
+var import_node_fs2 = require("fs");
+var import_yaml5 = require("yaml");
+var import_value2 = require("@sinclair/typebox/value");
+var ConfigWatcher = class {
+  watcher;
+  debounceTimer;
+  configPath;
+  onChange;
+  onError;
+  constructor(configPath, onChange, onError) {
+    this.configPath = configPath;
+    this.onChange = onChange;
+    this.onError = onError;
+  }
+  start() {
+    if (this.watcher) return;
+    this.watcher = (0, import_node_fs2.watch)(this.configPath, () => this.handleChange());
+  }
+  stop() {
+    if (this.debounceTimer) {
+      clearTimeout(this.debounceTimer);
+      this.debounceTimer = void 0;
+    }
+    if (this.watcher) {
+      this.watcher.close();
+      this.watcher = void 0;
+    }
+  }
+  handleChange() {
+    if (this.debounceTimer) clearTimeout(this.debounceTimer);
+    this.debounceTimer = setTimeout(() => this.reload(), 500);
+  }
+  reload() {
+    try {
+      const raw = (0, import_node_fs2.readFileSync)(this.configPath, "utf-8");
+      const parsed = (0, import_yaml5.parse)(raw);
+      const errors = [...import_value2.Value.Errors(GovernanceConfigSchema, parsed)];
+      if (errors.length > 0) {
+        const msg = errors.map((e) => `${e.path}: ${e.message}`).join("; ");
+        this.onError?.(new Error(`Config validation failed: ${msg}`));
+        return;
+      }
+      const config = import_value2.Value.Default(GovernanceConfigSchema, parsed);
+      this.onChange(config);
+    } catch (err) {
+      this.onError?.(err instanceof Error ? err : new Error(String(err)));
+    }
+  }
+};
+
+// src/lib/templates/selector.ts
+var import_node_fs3 = require("fs");
+var import_node_path = require("path");
+var import_node_url = require("url");
+var import_meta = {};
+function getBundledDir() {
+  try {
+    return (0, import_node_path.resolve)((0, import_node_path.dirname)((0, import_node_url.fileURLToPath)(import_meta.url)), "../../../prompts");
+  } catch {
+    return (0, import_node_path.resolve)(__dirname, "../../../prompts");
+  }
+}
+var TemplateSelector = class {
+  userDirectory;
+  bundledDirectory;
+  constructor(config) {
+    this.userDirectory = config?.directory ?? "./templates/";
+    this.bundledDirectory = getBundledDir();
+  }
+  /**
+   * Resolve a template name to an absolute file path.
+   * User templates take precedence over bundled templates.
+   */
+  resolve(templateName) {
+    const userPath = (0, import_node_path.resolve)((0, import_node_path.join)(this.userDirectory, `${templateName}.md`));
+    if ((0, import_node_fs3.existsSync)(userPath)) return userPath;
+    const bundledPath = (0, import_node_path.resolve)((0, import_node_path.join)(this.bundledDirectory, `${templateName}.md`));
+    if ((0, import_node_fs3.existsSync)(bundledPath)) return bundledPath;
+    throw new Error(
+      `Prompt template '${templateName}' not found. Searched: ${userPath}, ${bundledPath}`
+    );
+  }
+};
+
+// src/lib/templates/renderer.ts
+function render(templateContent, variables) {
+  return templateContent.replace(/\{\{(\w+)\}\}/g, (match, key) => {
+    const value = variables[key];
+    if (value === void 0) return match;
+    if (Array.isArray(value)) return value.join("\n");
+    return value;
+  });
+}
+
+// src/lib/audit/logger.ts
+var import_node_crypto = require("crypto");
+
+// src/lib/audit/sinks/jsonl.ts
+var import_promises = require("fs/promises");
+var import_node_path2 = require("path");
+var import_node_os = require("os");
+var JsonlAuditSink = class {
+  path;
+  buffer = [];
+  flushThreshold = 10;
+  constructor(path) {
+    this.path = path.replace(/^~/, (0, import_node_os.homedir)());
+  }
+  async write(record) {
+    this.buffer.push(record);
+    if (this.buffer.length >= this.flushThreshold) {
+      await this.flush();
+    }
+  }
+  async flush() {
+    if (this.buffer.length === 0) return;
+    const lines = this.buffer.map((r) => JSON.stringify(r)).join("\n") + "\n";
+    this.buffer = [];
+    await (0, import_promises.mkdir)((0, import_node_path2.dirname)(this.path), { recursive: true });
+    await (0, import_promises.appendFile)(this.path, lines, "utf-8");
+  }
+};
+
+// src/lib/audit/sinks/webhook.ts
+var WebhookAuditSink = class {
+  url;
+  buffer = [];
+  flushThreshold = 10;
+  constructor(url) {
+    this.url = url;
+  }
+  async write(record) {
+    this.buffer.push(record);
+    if (this.buffer.length >= this.flushThreshold) {
+      await this.flush();
+    }
+  }
+  async flush() {
+    if (this.buffer.length === 0) return;
+    const records = [...this.buffer];
+    this.buffer = [];
+    try {
+      await this.send(records);
+    } catch {
+      try {
+        await this.send(records);
+      } catch {
+      }
+    }
+  }
+  async send(records) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 1e4);
+    try {
+      const response = await fetch(this.url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(records),
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        throw new Error(`Webhook returned ${response.status}`);
+      }
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+};
+
+// src/lib/audit/logger.ts
+var AuditLogger = class {
+  sinks;
+  counts = /* @__PURE__ */ new Map();
+  constructor(config) {
+    const sinkConfigs = config?.sinks ?? [
+      { type: "jsonl", path: "~/.pi/agent/audit.jsonl" }
+    ];
+    this.sinks = [];
+    for (const sc of sinkConfigs) {
+      if (sc.type === "jsonl") {
+        this.sinks.push(new JsonlAuditSink(sc.path ?? "~/.pi/agent/audit.jsonl"));
+      } else if (sc.type === "webhook" && sc.url) {
+        this.sinks.push(new WebhookAuditSink(sc.url));
+      }
+    }
+    if (this.sinks.length === 0) {
+      this.sinks.push(new JsonlAuditSink("~/.pi/agent/audit.jsonl"));
+    }
+  }
+  async log(record) {
+    const full = {
+      ...record,
+      id: (0, import_node_crypto.randomUUID)(),
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.counts.set(full.event, (this.counts.get(full.event) ?? 0) + 1);
+    await Promise.all(this.sinks.map((s) => s.write(full)));
+  }
+  async flush() {
+    await Promise.all(this.sinks.map((s) => s.flush()));
+  }
+  getSummary() {
+    return new Map(this.counts);
+  }
+};
+
+// src/lib/hitl/cli-approver.ts
+var CliApprover = class {
+  ui;
+  timeoutSeconds;
+  constructor(ui, timeoutSeconds = 300) {
+    this.ui = ui;
+    this.timeoutSeconds = timeoutSeconds;
+  }
+  async requestApproval(toolCall, context) {
+    const title = `Approval Required: ${toolCall.toolName}`;
+    const inputSummary = Object.entries(toolCall.input).map(
+      ([k, v]) => `  ${k}: ${typeof v === "string" ? v.slice(0, 200) : JSON.stringify(v).slice(0, 200)}`
+    ).join("\n");
+    const message = `User: ${context.userId} (${context.role})
+Org: ${context.orgUnit}
+
+Tool: ${toolCall.toolName}
+Input:
+${inputSummary}`;
+    const start = Date.now();
+    try {
+      const approved = await this.ui.confirm(title, message, {
+        timeout: this.timeoutSeconds * 1e3
+      });
+      return {
+        approved,
+        approver: "cli",
+        duration: Date.now() - start,
+        reason: approved ? void 0 : "Denied by user"
+      };
+    } catch {
+      return {
+        approved: false,
+        approver: "cli",
+        duration: Date.now() - start,
+        reason: "Approval timed out"
+      };
+    }
+  }
+};
+
+// src/lib/hitl/webhook-approver.ts
+var WebhookApprover = class {
+  url;
+  timeoutMs;
+  constructor(url, timeoutSeconds = 300) {
+    this.url = url;
+    this.timeoutMs = timeoutSeconds * 1e3;
+  }
+  async requestApproval(toolCall, context) {
+    const start = Date.now();
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const response = await fetch(this.url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          toolCall: { toolName: toolCall.toolName, input: toolCall.input },
+          context
+        }),
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        return {
+          approved: false,
+          approver: "webhook",
+          duration: Date.now() - start,
+          reason: `Webhook returned ${response.status}`
+        };
+      }
+      const body = await response.json();
+      return {
+        approved: body.approved,
+        approver: "webhook",
+        duration: Date.now() - start,
+        reason: body.reason
+      };
+    } catch (err) {
+      return {
+        approved: false,
+        approver: "webhook",
+        duration: Date.now() - start,
+        reason: err instanceof Error && err.name === "AbortError" ? "Webhook timed out" : "Webhook request failed"
+      };
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+};
+
+// src/lib/hitl/approval.ts
+function createApprovalFlow(config, ui) {
+  if (config.approval_channel === "webhook" && config.webhook?.url) {
+    return new WebhookApprover(config.webhook.url, config.timeout_seconds);
+  }
+  if (!ui) {
+    throw new Error("CLI approval channel requires a ConfirmUI (ExtensionContext.ui)");
+  }
+  return new CliApprover(ui, config.timeout_seconds);
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AuditLogger,
+  BashClassifier,
+  BudgetTracker,
+  CliApprover,
   ConfigValidationError,
-  loadConfig
+  ConfigWatcher,
+  DANGEROUS_PATTERNS,
+  EnvIdentityProvider,
+  IdentityChain,
+  JsonlAuditSink,
+  LocalIdentityProvider,
+  OsoMemoryFactStore,
+  SAFE_PATTERNS,
+  TemplateSelector,
+  WebhookApprover,
+  WebhookAuditSink,
+  YamlFactStore,
+  YamlPolicyEngine,
+  createApprovalFlow,
+  createIdentityChain,
+  createPolicyEngine,
+  loadConfig,
+  renderTemplate
 });
 //# sourceMappingURL=index.cjs.map