@inhuman.tools/harness 0.0.0-stage → 0.1.0

package/dist/policy-processor/compile.js

@@ -0,0 +1,217 @@
+/**
+ * Compile a policy.yaml document into CommandNode + path terms.
+ * `"--"` is a handle, not a subcommand: omitted `policy` inherits.
+ * Extra keys on a command object are refused — verbs live under `subcommands`.
+ */
+import { parse as parseYaml } from "yaml";
+import { ErrorWithInvariant } from "./error-with-invariant.js";
+import { compileBlockRule, compilePathRule, mergePathTerms } from "./path-policy.js";
+export class PolicyCompileError extends ErrorWithInvariant {
+    name = "PolicyCompileError";
+}
+export class PolicyAssumeError extends ErrorWithInvariant {
+    name = "PolicyAssumeError";
+    expected;
+    actual;
+    command;
+    constructor(message, detail) {
+        super(message);
+        if (detail !== undefined) {
+            this.expected = detail.expected;
+            this.actual = detail.actual;
+            this.command = detail.command;
+        }
+    }
+}
+const DISPS = new Set(["approve", "allow", "ask", "deny", "block"]);
+const RESERVED = new Set(["policy", "arg_types", "arg_rest_type", "matcher", "--", "subcommands"]);
+export function compilePolicy(source) {
+    let raw;
+    try {
+        raw = parseYaml(source, { prettyErrors: true });
+    }
+    catch (error) {
+        throw new PolicyCompileError(error instanceof Error ? error.message : String(error));
+    }
+    if (raw === null || raw === undefined)
+        return { assume: [] };
+    PolicyCompileError.invariant(isRecord(raw), "policy.yaml: document must be a mapping");
+    const unknown = Object.keys(raw).filter((key) => !key.startsWith(".") && !["read_file", "write_file", "read_block", "write_block", "bash", "assume"].includes(key));
+    PolicyCompileError.invariant(unknown.length === 0, `policy.yaml: unknown top-level key ${unknown[0]}`);
+    return {
+        bash: raw.bash === undefined ? undefined : parseCommandDef(raw.bash, "bash", true),
+        read: mergePathTerms(parsePathList(raw.read_file, "read_file", "approve"), parseBlockList(raw.read_block, "read_block")),
+        write: mergePathTerms(parsePathList(raw.write_file, "write_file", "ask"), parseBlockList(raw.write_block, "write_block")),
+        assume: parseAssume(raw.assume),
+    };
+}
+function parsePathList(value, field, enable) {
+    if (value === undefined)
+        return undefined;
+    PolicyCompileError.invariant(Array.isArray(value), `${field}: list of strings`);
+    return {
+        rules: value.map((item, i) => {
+            PolicyCompileError.invariant(typeof item === "string", `${field}: each pattern is a string`);
+            return compilePathRule(item, i, enable);
+        }),
+    };
+}
+function parseBlockList(value, field) {
+    if (value === undefined)
+        return undefined;
+    PolicyCompileError.invariant(Array.isArray(value), `${field}: list of strings`);
+    return {
+        rules: value.map((item, i) => {
+            PolicyCompileError.invariant(typeof item === "string", `${field}: each pattern is a string`);
+            return compileBlockRule(item, i);
+        }),
+    };
+}
+function parseAssume(value) {
+    if (value === undefined)
+        return [];
+    PolicyCompileError.invariant(Array.isArray(value), "assume: list of { command, expect }");
+    return value.map((item, i) => {
+        PolicyCompileError.invariant(isRecord(item), `assume[${i}]: mapping`);
+        PolicyCompileError.invariant(typeof item.command === "string", `assume[${i}]: command is a string`);
+        const expect = asDisposition(item.expect);
+        PolicyCompileError.invariant(expect !== undefined, `assume[${i}]: expect is approve|ask|deny|block`);
+        return { command: item.command, expect };
+    });
+}
+function parseCommandDef(value, path, policyRequired) {
+    const disp = asDisposition(value);
+    if (disp !== undefined) {
+        return emptyNode(disp);
+    }
+    PolicyCompileError.invariant(isRecord(value), `${path}: command is a disposition or a mapping`);
+    const extra = Object.keys(value).filter((key) => !RESERVED.has(key));
+    PolicyCompileError.invariant(extra.length === 0, `${path}: unknown key ${extra[0]} — verbs go under subcommands`);
+    const policy = value.policy === undefined ? undefined : asDisposition(value.policy);
+    PolicyCompileError.invariant(value.policy === undefined || policy !== undefined, `${path}.policy: approve|ask|deny|block`);
+    PolicyCompileError.invariant(!policyRequired || policy !== undefined, `${path}: policy is required`);
+    const subcommands = {};
+    if (value.subcommands !== undefined) {
+        PolicyCompileError.invariant(isRecord(value.subcommands), `${path}.subcommands: mapping`);
+        for (const [name, def] of Object.entries(value.subcommands)) {
+            subcommands[String(name)] = parseCommandDef(def, `${path}.subcommands.${name}`, true);
+        }
+    }
+    return {
+        policy,
+        argTypes: parseArgTypes(value.arg_types, `${path}.arg_types`),
+        argRestType: parseArgType(value.arg_rest_type, `${path}.arg_rest_type`),
+        matchers: parseMatchers(value.matcher, `${path}.matcher`),
+        dash: value["--"] === undefined ? undefined : parseCommandDef(value["--"], `${path}.--`, false),
+        subcommands,
+    };
+}
+function emptyNode(policy) {
+    return { policy, argTypes: [], matchers: [], subcommands: {} };
+}
+function isArgType(value) {
+    return value === "read_path" || value === "write_path";
+}
+function parseArgTypes(value, path) {
+    if (value === undefined)
+        return [];
+    PolicyCompileError.invariant(Array.isArray(value), `${path}: list`);
+    return value.map((item, i) => {
+        const parsed = parseArgType(item, `${path}[${i}]`);
+        PolicyCompileError.invariant(parsed !== undefined, `${path}[${i}]: missing`);
+        return parsed;
+    });
+}
+function parseArgType(value, path) {
+    if (value === undefined)
+        return undefined;
+    PolicyCompileError.invariant(typeof value === "string" && isArgType(value), `${path}: read_path|write_path`);
+    return value;
+}
+function parseMatchers(value, path) {
+    if (value === undefined)
+        return [];
+    PolicyCompileError.invariant(Array.isArray(value), `${path}: list`);
+    return value.map((item, i) => parseMatcher(item, `${path}[${i}]`));
+}
+function parseMatcher(value, path) {
+    PolicyCompileError.invariant(isRecord(value), `${path}: mapping`);
+    const extra = Object.keys(value).filter((key) => !["flags", "glob", "tok", "matcher", "policy"].includes(key));
+    PolicyCompileError.invariant(extra.length === 0, `${path}: unknown key ${extra[0]}`);
+    const policy = value.policy === undefined ? undefined : asDisposition(value.policy);
+    PolicyCompileError.invariant(value.policy === undefined || policy !== undefined, `${path}.policy: approve|ask|deny|block`);
+    return {
+        flags: parseFlags(value.flags, `${path}.flags`),
+        globs: stringList(value.glob, `${path}.glob`),
+        toks: stringList(value.tok, `${path}.tok`),
+        matchers: parseMatchers(value.matcher, `${path}.matcher`),
+        policy,
+    };
+}
+function parseFlags(value, path) {
+    if (value === undefined)
+        return {};
+    PolicyCompileError.invariant(isRecord(value), `${path}: mapping`);
+    const out = {};
+    for (const [raw, spec] of Object.entries(value)) {
+        const canonical = String(raw);
+        out[canonical] = parseFlagConstraint(spec, canonical, `${path}.${canonical}`);
+    }
+    return out;
+}
+function parseFlagConstraint(value, canonical, path) {
+    if (value === true || value === null) {
+        return { names: [canonical], vals: [], takesValue: false };
+    }
+    PolicyCompileError.invariant(isRecord(value), `${path}: true or { alias, value, value_type }`);
+    const extra = Object.keys(value).filter((key) => !["alias", "value", "value_type"].includes(key));
+    PolicyCompileError.invariant(extra.length === 0, `${path}: unknown key ${extra[0]}`);
+    const aliases = stringList(value.alias, `${path}.alias`);
+    const vals = stringList(value.value, `${path}.value`);
+    const takesValue = vals.length > 0 || value.value_type !== undefined;
+    if (value.value_type !== undefined) {
+        PolicyCompileError.invariant(typeof value.value_type === "string", `${path}.value_type: string`);
+    }
+    return { names: [canonical, ...aliases], vals, takesValue };
+}
+function stringList(value, path) {
+    if (value === undefined)
+        return [];
+    if (typeof value === "string")
+        return [value];
+    PolicyCompileError.invariant(Array.isArray(value), `${path}: string or list of strings`);
+    return value.map((item, i) => {
+        PolicyCompileError.invariant(typeof item === "string", `${path}[${i}]: string`);
+        return item;
+    });
+}
+export function asDisposition(value) {
+    if (typeof value !== "string" || !DISPS.has(value))
+        return undefined;
+    return value === "allow" ? "approve" : value;
+}
+export function flagVocab(node) {
+    const names = new Set();
+    addMatcherFlags(node.matchers, names, false);
+    return names;
+}
+export function valueFlagNames(node) {
+    const names = new Set();
+    addMatcherFlags(node.matchers, names, true);
+    return names;
+}
+function addMatcherFlags(matchers, names, valueOnly) {
+    for (const matcher of matchers) {
+        for (const flag of Object.values(matcher.flags)) {
+            if (valueOnly && !flag.takesValue)
+                continue;
+            for (const name of flag.names)
+                names.add(name);
+        }
+        addMatcherFlags(matcher.matchers, names, valueOnly);
+    }
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=compile.js.map

package/dist/policy-processor/compile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile.js","sourceRoot":"","sources":["../../src/policy-processor/compile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAiB,MAAM,kBAAkB,CAAC;AAGpG,MAAM,OAAO,kBAAmB,SAAQ,kBAAkB;IACtC,IAAI,GAAG,oBAAoB,CAAC;CAC/C;AAED,MAAM,OAAO,iBAAkB,SAAQ,kBAAkB;IACrC,IAAI,GAAG,mBAAmB,CAAC;IACpC,QAAQ,CAAe;IACvB,MAAM,CAAe;IACrB,OAAO,CAAU;IAE1B,YAAY,OAAe,EAAE,MAAwE;QACnG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAChC,CAAC;IACH,CAAC;CACF;AAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;AAcnG,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7D,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,yCAAyC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CACrC,CAAC,GAAG,EAAE,EAAE,CACN,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CACpH,CAAC;IACF,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,sCAAsC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvG,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;QAClF,IAAI,EAAE,cAAc,CAClB,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,EACpD,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAC7C;QACD,KAAK,EAAE,cAAc,CACnB,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,EAClD,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAC/C;QACD,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa,EAAE,MAAyB;IAC7E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAChF,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YAC3B,kBAAkB,CAAC,SAAS,CAAC,OAAO,IAAI,KAAK,QAAQ,EAAE,GAAG,KAAK,4BAA4B,CAAC,CAAC;YAC7F,OAAO,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAChF,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YAC3B,kBAAkB,CAAC,SAAS,CAAC,OAAO,IAAI,KAAK,QAAQ,EAAE,GAAG,KAAK,4BAA4B,CAAC,CAAC;YAC7F,OAAO,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,qCAAqC,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC3B,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACtE,kBAAkB,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,UAAU,CAAC,wBAAwB,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,kBAAkB,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,UAAU,CAAC,qCAAqC,CAAC,CAAC;QACrG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY,EAAE,cAAuB;IAC5E,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,yCAAyC,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,IAAI,iBAAiB,KAAK,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC;IAClH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,kBAAkB,CAAC,SAAS,CAC1B,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAClD,GAAG,IAAI,iCAAiC,CACzC,CAAC;IACF,kBAAkB,CAAC,SAAS,CAAC,CAAC,cAAc,IAAI,MAAM,KAAK,SAAS,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IACrG,MAAM,WAAW,GAAgC,EAAE,CAAC;IACpD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,IAAI,gBAAgB,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,CAAC;QAC7D,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,IAAI,gBAAgB,CAAC;QACvE,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,CAAC;QACzD,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,KAAK,EAAE,KAAK,CAAC;QAC/F,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAAmB;IACpC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,YAAY,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,kBAAkB,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,kBAAkB,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,wBAAwB,CAAC,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/G,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,IAAI,iBAAiB,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,kBAAkB,CAAC,SAAS,CAC1B,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAClD,GAAG,IAAI,iCAAiC,CACzC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC;QAC/C,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC;QAC7C,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC;QAC1C,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,CAAC;QACzD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,IAAY;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;IAClE,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,SAAiB,EAAE,IAAY;IAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC;IACD,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,wCAAwC,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,IAAI,iBAAiB,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,kBAAkB,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,GAAG,IAAI,qBAAqB,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,IAAY;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC3B,kBAAkB,CAAC,SAAS,CAAC,OAAO,IAAI,KAAK,QAAQ,EAAE,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,KAAqB,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAiB;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAiB;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B,EAAE,KAAkB,EAAE,SAAkB;IAC3F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC5C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/policy-processor/error-with-invariant.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Error whose `static invariant` throws `new this(...ctorArgs)`.
+ * Not on ErrorConstructor — a receiver with extra constructor args
+ * (`(code, message)`) does not fight `(condition, message?)`.
+ */
+export declare class ErrorWithInvariant extends Error {
+    static invariant<T extends new (...args: any) => ErrorWithInvariant>(this: T, condition: unknown, ...args: ConstructorParameters<T>): asserts condition;
+}
+//# sourceMappingURL=error-with-invariant.d.ts.map

package/dist/policy-processor/error-with-invariant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-with-invariant.d.ts","sourceRoot":"","sources":["../../src/policy-processor/error-with-invariant.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,KAAK,GAAG,IAAI,EAAE,GAAG,KAAK,kBAAkB,EACjE,IAAI,EAAE,CAAC,EACP,SAAS,EAAE,OAAO,EAClB,GAAG,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAChC,OAAO,CAAC,SAAS;CAGrB"}

package/dist/policy-processor/error-with-invariant.js

@@ -0,0 +1,12 @@
+/**
+ * Error whose `static invariant` throws `new this(...ctorArgs)`.
+ * Not on ErrorConstructor — a receiver with extra constructor args
+ * (`(code, message)`) does not fight `(condition, message?)`.
+ */
+export class ErrorWithInvariant extends Error {
+    static invariant(condition, ...args) {
+        if (!condition)
+            throw new this(...args);
+    }
+}
+//# sourceMappingURL=error-with-invariant.js.map

package/dist/policy-processor/error-with-invariant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-with-invariant.js","sourceRoot":"","sources":["../../src/policy-processor/error-with-invariant.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,CAAC,SAAS,CAEd,SAAkB,EAClB,GAAG,IAA8B;QAEjC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/policy-processor/evidence.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Classifier request cuts from the job's owning turn. Nested jobs keep
+ * that turn; a caller-supplied turn would be the wrong one. Privileged
+ * is user prompts on the owning turn and its tail ancestry — continue
+ * mints `prompt: ""` with the authorization on the tail. Unattended /
+ * eval with no user text: owning ProgrammaticJob expr (approval.md
+ * EVIDENCE). The bag itself is not a remainder subject — only inner
+ * ToolCallJob leaves.
+ */
+import { ToolCallJob } from "@inhuman.tools/harness-model";
+export type EvidenceCuts = {
+    readonly privileged: string;
+    readonly priorTurn: string;
+    readonly quarantined: string;
+    readonly policy?: string;
+};
+export declare function evidenceCuts(job: ToolCallJob): EvidenceCuts;
+export declare function evidenceIdentity(cuts: EvidenceCuts): string;
+/** Cluster+payload remainder skip key. */
+export declare function evidencePayloadKey(job: ToolCallJob): string | null;
+//# sourceMappingURL=evidence.d.ts.map

package/dist/policy-processor/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/policy-processor/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAOL,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAGtC,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,YAAY,CAgC3D;AAyBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED,0CAA0C;AAC1C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAIlE"}

package/dist/policy-processor/evidence.js

@@ -0,0 +1,169 @@
+/**
+ * Classifier request cuts from the job's owning turn. Nested jobs keep
+ * that turn; a caller-supplied turn would be the wrong one. Privileged
+ * is user prompts on the owning turn and its tail ancestry — continue
+ * mints `prompt: ""` with the authorization on the tail. Unattended /
+ * eval with no user text: owning ProgrammaticJob expr (approval.md
+ * EVIDENCE). The bag itself is not a remainder subject — only inner
+ * ToolCallJob leaves.
+ */
+import { clusterOf, fileQuestion, ProgrammaticJob, reactChunks, SessionTurn, tapeCompletion, ToolCallJob, } from "@inhuman.tools/harness-model";
+import { parseTirithEvidence, tirithPolicyCut } from "@inhuman.tools/policy-tirith";
+export function evidenceCuts(job) {
+    const turn = owningTurn(job);
+    const program = owningProgram(job);
+    if (turn == null) {
+        return {
+            privileged: program?.expr.trim() || "",
+            priorTurn: "",
+            quarantined: "",
+            policy: policyPipCut(job.policyEvidenceJson),
+        };
+    }
+    const prior = [];
+    const quarantined = [];
+    for (const chunk of reactChunks(turn)) {
+        const completion = tapeCompletion(chunk);
+        if (completion != null) {
+            if (!completion.isDone || underJob(completion, job))
+                continue;
+            if (completion.responseText !== "")
+                prior.push(completion.responseText);
+            continue;
+        }
+        if (!(chunk instanceof ToolCallJob) || chunk === job)
+            continue;
+        if (chunk.sealedOutcomeJson() == null)
+            continue;
+        const text = observationText(chunk.observationPayload());
+        if (text === "")
+            continue;
+        quarantined.push(`${chunk.name} → ${text}`);
+    }
+    return {
+        privileged: privilegedUserText(turn, program),
+        priorTurn: prior.join("\n"),
+        quarantined: quarantined.join("\n"),
+        policy: policyPipCut(job.policyEvidenceJson),
+    };
+}
+function policyPipCut(json) {
+    if (json == null || json === "")
+        return "";
+    const report = parseTirithEvidence(json);
+    if (report != null)
+        return tirithPolicyCut(report);
+    return json;
+}
+/** Oldest-first user prompts on `turn` then tails. Expr only when none exist. */
+function privilegedUserText(turn, program) {
+    const seen = new Set();
+    const prompts = [];
+    let cell = turn;
+    while (cell != null && !seen.has(cell)) {
+        seen.add(cell);
+        const text = cell.prompt.trim();
+        if (text !== "")
+            prompts.push(text);
+        cell = cell.turnTail instanceof SessionTurn ? cell.turnTail : null;
+    }
+    prompts.reverse();
+    if (prompts.length > 0)
+        return prompts.join("\n");
+    return program?.expr.trim() || "";
+}
+export function evidenceIdentity(cuts) {
+    return JSON.stringify([cuts.privileged, cuts.priorTurn, cuts.quarantined, cuts.policy ?? ""]);
+}
+/** Cluster+payload remainder skip key. */
+export function evidencePayloadKey(job) {
+    const payload = canonicalPayload(job);
+    if (payload == null || payload === "")
+        return null;
+    return JSON.stringify([clusterOf(job.name), payload]);
+}
+function owningTurn(job) {
+    return ancestor(job, (parent) => parent instanceof SessionTurn);
+}
+function owningProgram(job) {
+    return ancestor(job, (parent) => parent instanceof ProgrammaticJob);
+}
+function ancestor(job, match) {
+    const seen = new Set();
+    let node = job;
+    while (node != null) {
+        if (seen.has(node))
+            return null;
+        seen.add(node);
+        const parent = node.parent;
+        if (match(parent))
+            return parent;
+        if (parent instanceof SessionTurn)
+            return null;
+        node = parent !== null && typeof parent === "object" && "parent" in parent ? parent : null;
+    }
+    return null;
+}
+function underJob(node, job) {
+    const seen = new Set();
+    let cur = node;
+    while (cur != null) {
+        if (seen.has(cur))
+            return false;
+        seen.add(cur);
+        if (cur === job)
+            return true;
+        const parent = cur.parent;
+        if (parent instanceof SessionTurn)
+            return false;
+        cur = parent !== null && typeof parent === "object" && "parent" in parent ? parent : null;
+    }
+    return false;
+}
+function observationText(value) {
+    if (typeof value === "string")
+        return value;
+    if (value === undefined)
+        return "";
+    try {
+        const json = JSON.stringify(value);
+        return typeof json === "string" ? json : "";
+    }
+    catch {
+        return String(value);
+    }
+}
+function canonicalPayload(job) {
+    const args = job.args;
+    switch (clusterOf(job.name)) {
+        case "bash": {
+            const command = args?.command;
+            if (typeof command !== "string" || command === "")
+                return null;
+            const cwd = args?.cwd;
+            if (typeof cwd === "string" && cwd !== "" && cwd !== ".")
+                return `${command}\ncwd ${cwd}`;
+            return command;
+        }
+        case "read":
+            return fileQuestion(args) ?? ".";
+        case "write":
+            return fileQuestion(args) ?? null;
+        case "mcp":
+            return `${job.name}\n${stableJson(args ?? {})}`;
+    }
+}
+function sortKeys(value) {
+    if (value === null || typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map((item) => sortKeys(item));
+    const rec = value;
+    return Object.fromEntries(Object.keys(rec)
+        .toSorted()
+        .map((key) => [key, sortKeys(rec[key])]));
+}
+function stableJson(value) {
+    return JSON.stringify(sortKeys(value));
+}
+//# sourceMappingURL=evidence.js.map

package/dist/policy-processor/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/policy-processor/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,SAAS,EACT,YAAY,EACZ,eAAe,EACf,WAAW,EACX,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AASpF,MAAM,UAAU,YAAY,CAAC,GAAgB;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,OAAO;YACL,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;YACtC,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,EAAE;YACf,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC;SAC7C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;gBAAE,SAAS;YAC9D,IAAI,UAAU,CAAC,YAAY,KAAK,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC,IAAI,KAAK,KAAK,GAAG;YAAE,SAAS;QAC/D,IAAI,KAAK,CAAC,iBAAiB,EAAE,IAAI,IAAI;YAAE,SAAS;QAChD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACzD,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC;QAC7C,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB;IACvC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,IAAiB,EAAE,OAA+B;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAe,CAAC;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,QAAQ,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,CAAC;IAClB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAkB;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,kBAAkB,CAAC,GAAgB;IACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB;IAClC,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,YAAY,WAAW,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB;IACrC,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAA6B,EAAE,CAAC,MAAM,YAAY,eAAe,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,QAAQ,CAAI,GAAwB,EAAE,KAAuC;IACpF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,IAAI,GAA+B,GAAG,CAAC;IAC3C,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,MAAM,GAAY,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACjC,IAAI,MAAM,YAAY,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,GAAG,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAE,MAA8B,CAAC,CAAC,CAAC,IAAI,CAAC;IACtH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,IAAyB,EAAE,GAAgB;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,GAAG,GAA+B,IAAI,CAAC;IAC3C,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,MAAM,GAAY,GAAG,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,YAAY,WAAW;YAAE,OAAO,KAAK,CAAC;QAChD,GAAG,GAAG,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAE,MAA8B,CAAC,CAAC,CAAC,IAAI,CAAC;IACrH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAgB;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,QAAQ,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;YAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG;gBAAE,OAAO,GAAG,OAAO,SAAS,GAAG,EAAE,CAAC;YAC1F,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,MAAM;YACT,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QACnC,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACpC,KAAK,KAAK;YACR,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACb,QAAQ,EAAE;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/policy-processor/explain.d.ts

@@ -0,0 +1,2 @@
+export { explainCall, type Explanation, type ExplainProbe } from "@inhuman.tools/turn/explain";
+//# sourceMappingURL=explain.d.ts.map

package/dist/policy-processor/explain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain.d.ts","sourceRoot":"","sources":["../../src/policy-processor/explain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/policy-processor/explain.js

@@ -0,0 +1,2 @@
+export { explainCall } from "@inhuman.tools/turn/explain";
+//# sourceMappingURL=explain.js.map

package/dist/policy-processor/explain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain.js","sourceRoot":"","sources":["../../src/policy-processor/explain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAuC,MAAM,6BAA6B,CAAC"}

package/dist/policy-processor/identity.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Executable identity. Path-form argv0 is the named command iff `which`
+ * returns the same path; otherwise it stays a path (root miss → ask).
+ * No process-lifetime cache — PATH/cwd are part of identity.
+ */
+export type Which = (name: string) => string | undefined;
+export declare function whichOnPath(name: string): string | undefined;
+export declare function basename(path: string): string;
+/** Named `cmd` is itself. Path-form is `cmd` only when `which` agrees. */
+export declare function resolveKnown(raw: string, known: ReadonlySet<string>, which: Which | undefined): string | undefined;
+/** Path-form argv0 rewritten to the known name, or the original token. */
+export declare function identityName(raw: string, known: ReadonlySet<string>, which: Which | undefined): string;
+export declare function samePath(referred: string, canonical: string): boolean;
+export declare function normalizeIdentity(raw: string): string | undefined;
+//# sourceMappingURL=identity.d.ts.map

package/dist/policy-processor/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/policy-processor/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAEzD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ5D;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7C;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOlH;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAEtG;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMjE"}

package/dist/policy-processor/identity.js

@@ -0,0 +1,52 @@
+/**
+ * Executable identity. Path-form argv0 is the named command iff `which`
+ * returns the same path; otherwise it stays a path (root miss → ask).
+ * No process-lifetime cache — PATH/cwd are part of identity.
+ */
+import { execFileSync } from "node:child_process";
+export function whichOnPath(name) {
+    if (name === "" || name.includes("/") || name.includes("\0"))
+        return undefined;
+    try {
+        const out = execFileSync("which", [name], { encoding: "utf8", timeout: 1000 }).trim();
+        return out === "" ? undefined : out.split("\n")[0];
+    }
+    catch {
+        return undefined;
+    }
+}
+export function basename(path) {
+    const slash = path.lastIndexOf("/");
+    return slash === -1 ? path : path.slice(slash + 1) || path;
+}
+/** Named `cmd` is itself. Path-form is `cmd` only when `which` agrees. */
+export function resolveKnown(raw, known, which) {
+    const base = basename(raw);
+    if (base === "" || !known.has(base))
+        return undefined;
+    if (!raw.includes("/"))
+        return base;
+    const canonical = which?.(base);
+    if (canonical === undefined)
+        return undefined;
+    return samePath(raw, canonical) ? base : undefined;
+}
+/** Path-form argv0 rewritten to the known name, or the original token. */
+export function identityName(raw, known, which) {
+    return resolveKnown(raw, known, which) ?? raw;
+}
+export function samePath(referred, canonical) {
+    const left = normalizeIdentity(referred);
+    const right = normalizeIdentity(canonical);
+    return left !== undefined && left === right;
+}
+export function normalizeIdentity(raw) {
+    if (raw === "" || raw.includes("\0"))
+        return undefined;
+    const slash = raw.replaceAll("\\", "/");
+    const parts = slash.split("/").filter((seg) => seg !== "" && seg !== ".");
+    if (parts.includes(".."))
+        return undefined;
+    return slash.startsWith("/") ? `/${parts.join("/")}` : parts.join("/");
+}
+//# sourceMappingURL=identity.js.map

package/dist/policy-processor/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/policy-processor/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIlD,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AAC7D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,KAA0B,EAAE,KAAwB;IAC5F,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,KAA0B,EAAE,KAAwB;IAC5F,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAiB;IAC1D,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzE,CAAC"}

package/dist/policy-processor/index.d.ts

@@ -0,0 +1,2 @@
+export type { Disposition as Disposition, Policy as Policy } from "@inhuman.tools/turn/policy";
+//# sourceMappingURL=index.d.ts.map

package/dist/policy-processor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy-processor/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,IAAI,WAAW,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/policy-processor/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/policy-processor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy-processor/index.ts"],"names":[],"mappings":""}

package/dist/policy-processor/judge.d.ts

@@ -0,0 +1,39 @@
+import { type ToolCallJob } from "@inhuman.tools/harness-model";
+import type { LicenseScope } from "./scope.js";
+/**
+ * Every remainder attempt is deadline-bounded. The first is short because the
+ * first vote is what the human is waiting on — a miss must open the approval
+ * window fast. Retries get longer: a slow-but-live model may still deliver a
+ * late allow, and the loop never gives up (overnight runs rely on that). But no
+ * attempt may run unbounded — with `scope.cap` a stuck judge squatting a slot
+ * starves every job behind it, which is the hang.
+ *
+ * Below the stall timer on purpose: a live stream that trickles a token every
+ * few minutes resets the stall timer forever, so the wall clock is the only
+ * bound that fires.
+ */
+export declare const FIRST_ATTEMPT_MS = 12000;
+export declare const RETRY_ATTEMPT_MS: number;
+export type JudgeRouteOpts = {
+    /** Kernel last-choice. Session mint is a snapshot; this overlay is live. */
+    readonly fallback?: Readonly<Record<string, string>>;
+    /** Connection `settings.model` when the judge wire is named but `judgeModel` is empty. */
+    readonly configuredModel?: (connectionId: string) => string;
+};
+export declare function judgeRoute(kvs: Readonly<Record<string, string>>, opts?: JudgeRouteOpts): {
+    readonly connection: string;
+    readonly model: string;
+    readonly key: string;
+};
+export declare class JudgeHandle {
+    #private;
+    readonly job: ToolCallJob;
+    readonly scope: LicenseScope;
+    accessor attempt: number;
+    constructor(job: ToolCallJob, scope: LicenseScope);
+    start(): void;
+    dispose(): void;
+    writeFail(text: string): void;
+    writeFailSticky(text: string): void;
+}
+//# sourceMappingURL=judge.d.ts.map

package/dist/policy-processor/judge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"judge.d.ts","sourceRoot":"","sources":["../../src/policy-processor/judge.ts"],"names":[],"mappings":"AA8BA,OAAO,EAGL,KAAK,WAAW,EAGjB,MAAM,8BAA8B,CAAC;AAStC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,gBAAgB,QAAa,CAAC;AAqF3C,MAAM,MAAM,cAAc,GAAG;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;CAC7D,CAAC;AAEF,wBAAgB,UAAU,CACxB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,IAAI,CAAC,EAAE,cAAc,GACpB;IACD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAOA;AAmFD,qBAAa,WAAW;;IAQpB,QAAQ,CAAC,GAAG,EAAE,WAAW;IACzB,QAAQ,CAAC,KAAK,EAAE,YAAY;IARlB,QAAQ,CAAC,OAAO,SAAK;gBAOtB,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,YAAY;IAwB9B,KAAK,IAAI,IAAI;IAqIb,OAAO,IAAI,IAAI;IAUf,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAgB7B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;CAWpC"}