@inhuman.tools/harness 0.0.0-stage → 0.1.0

package/dist/policy-processor/judge.js

@@ -0,0 +1,435 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+/**
+ * Remainder-classifier handle. Auto ask (floor ask + hatch). Cache is
+ * remainder skip. Empty connection or model gates the classifier, not
+ * identity — `dotprompt/run` requires both, and a run plan with one
+ * missing retries the invariant forever.
+ * `start` owns the run-plan reaction; minting does not begin I/O.
+ * Eligibility lives on the scope key set — this handle re-runs when the
+ * plan inputs change. Timer ticks are events (backoff). Floor `block`
+ * never mints these. Cluster ports share this handle. Classifier
+ * prompt files load on first require, not at import.
+ */
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { DefaultedMap } from "@here.build/collections";
+import { disposeRunContext, execState, jsToScheme, makeCallCtx, parse, toJS, } from "@inhuman.tools/arrival";
+import { applyCallback } from "@inhuman.tools/arrival/host-internals";
+import { ASymbol } from "@inhuman.tools/arrival/reflect-internals";
+import { loaderFromResolver } from "@inhuman.tools/arrival-modules";
+import { promptIsolatedCapability } from "@inhuman.tools/env-capability-module-prompt";
+import { fileQuestion, isJsonSchemaUnsupported, clusterOf, workspacePath, } from "@inhuman.tools/harness-model";
+import { classifierResources, processorCapability } from "@inhuman.tools/policy/floor";
+import { parseTirithEvidence, tirithCoverage } from "@inhuman.tools/policy-tirith";
+import { action, comparer, observable, reaction, runInAction } from "mobx";
+import { trace } from "../diagnostics/index.js";
+import { classifierArgs } from "./cluster.js";
+import { evidenceCuts, evidenceIdentity } from "./evidence.js";
+/**
+ * Every remainder attempt is deadline-bounded. The first is short because the
+ * first vote is what the human is waiting on — a miss must open the approval
+ * window fast. Retries get longer: a slow-but-live model may still deliver a
+ * late allow, and the loop never gives up (overnight runs rely on that). But no
+ * attempt may run unbounded — with `scope.cap` a stuck judge squatting a slot
+ * starves every job behind it, which is the hang.
+ *
+ * Below the stall timer on purpose: a live stream that trickles a token every
+ * few minutes resets the stall timer forever, so the wall clock is the only
+ * bound that fires.
+ */
+export const FIRST_ATTEMPT_MS = 12_000;
+export const RETRY_ATTEMPT_MS = 5 * 60_000;
+function voteOf(value) {
+    switch (typeof value) {
+        case "string":
+            switch (value) {
+                case "allow":
+                case "deny":
+                    return { decision: value };
+                default:
+                    return value.trim() === "" ? { fail: "classifier did not vote" } : { fail: value };
+            }
+        case "object": {
+            if (value === null || Array.isArray(value))
+                return { fail: "classifier did not vote" };
+            const rec = value;
+            const decision = rec.decision ?? rec[":decision"];
+            switch (decision) {
+                case "allow":
+                case "deny":
+                    return { decision };
+                default:
+                    return { fail: "classifier did not vote" };
+            }
+        }
+        default:
+            return { fail: "classifier did not vote" };
+    }
+}
+async function applyClassifier(runCtx, fn, args) {
+    const boxed = applyCallback(fn, args.map((value) => jsToScheme(runCtx, value)), makeCallCtx(runCtx));
+    const signal = runCtx.signal;
+    if (signal === undefined || signal.aborted)
+        return toJS(await boxed);
+    const gate = new AbortController();
+    const winner = AbortSignal.any([signal, gate.signal]);
+    const abort = new Promise((_resolve, reject) => {
+        winner.addEventListener("abort", () => {
+            reject(signal.reason instanceof Error ? signal.reason : new Error("classifier aborted"));
+        }, { once: true });
+    });
+    try {
+        return toJS(await Promise.race([Promise.resolve(boxed), abort]));
+    }
+    finally {
+        gate.abort();
+    }
+}
+const here = path.dirname(fileURLToPath(import.meta.url));
+const classifierCache = new DefaultedMap((p) => {
+    switch (p) {
+        case "classifier-bash.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-bash.prompt"), "utf8");
+        case "classifier-read.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-read.prompt"), "utf8");
+        case "classifier-write.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-write.prompt"), "utf8");
+        case "classifier-write-outside.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-write-outside.prompt"), "utf8");
+        case "classifier-write-risky.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-write-risky.prompt"), "utf8");
+        case "classifier-mcp.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-mcp.prompt"), "utf8");
+        case "classifier-bash-incomplete.prompt":
+            return readFileSync(path.join(here, "../../policy/classifier-bash-incomplete.prompt"), "utf8");
+        default:
+            throw new Error(`no such file: ${p}`);
+    }
+});
+const classifierFiles = loaderFromResolver((p) => classifierCache.get(p));
+export function judgeRoute(kvs, opts) {
+    const fallback = opts?.fallback ?? {};
+    const connection = (kvs.judgeConnection || fallback.judgeConnection || kvs.connection || "").trim();
+    const judgeModel = (kvs.judgeModel || fallback.judgeModel || "").trim();
+    const configured = connection !== "" && opts?.configuredModel != null ? opts.configuredModel(connection).trim() : "";
+    const model = (judgeModel || configured || kvs.model || "").trim();
+    return { connection, model, key: `${connection}\n${model}` };
+}
+const programReads = observable.map({}, { deep: false });
+const programReadsStarted = new Set();
+function startProgramRead(source) {
+    if (programReadsStarted.has(source))
+        return;
+    programReadsStarted.add(source);
+    void parse(source).then((forms) => runInAction(() => programReads.set(source, { state: "forms", forms })), () => runInAction(() => programReads.set(source, { state: "broken" })));
+}
+/** One symbol. The reader has already dropped comments. A string `"allow"` is not this. */
+function literalOf(forms) {
+    const form = forms.length === 1 ? forms[0] : undefined;
+    if (!(form instanceof ASymbol))
+        return undefined;
+    return form.__name__ === "allow" || form.__name__ === "deny" ? form.__name__ : undefined;
+}
+function remainderPlan(scope, job, attempt) {
+    const source = scope.root.judgeAskProgram;
+    const route = judgeRoute(scope.root.kvs, {
+        fallback: scope.judgeFallbackKvs,
+        configuredModel: scope.judgeConfiguredModel,
+    });
+    const cuts = evidenceCuts(job);
+    const identity = evidenceIdentity(cuts);
+    const cached = scope.remainderHit(job, identity);
+    if (cached !== null)
+        return { kind: "cache", decision: cached, attempt };
+    const read = programReads.get(source);
+    if (read === undefined)
+        return { kind: "unread", source, attempt };
+    if (read.state === "forms") {
+        const decision = literalOf(read.forms);
+        if (decision !== undefined)
+            return { kind: "literal", decision, identity, attempt };
+        // No forms is the empty result exec returns. A top-level define is #<void>, not empty.
+        if (read.forms.length === 0)
+            return { kind: "empty", attempt };
+    }
+    if (scope.schemaHaltKeys.has(route.key))
+        return { kind: "halt", attempt };
+    if (route.connection === "" || route.model === "")
+        return { kind: "noconnect", attempt };
+    if (source.trim() === "")
+        return { kind: "empty", attempt };
+    return {
+        kind: "run",
+        source,
+        connection: route.connection,
+        model: route.model,
+        attempt,
+        identity,
+        privileged: cuts.privileged,
+        priorTurn: cuts.priorTurn,
+        quarantined: cuts.quarantined,
+        policy: cuts.policy ?? "",
+    };
+}
+let JudgeHandle = (() => {
+    let _instanceExtraInitializers = [];
+    let _attempt_decorators;
+    let _attempt_initializers = [];
+    let _attempt_extraInitializers = [];
+    let _start_decorators;
+    let _writeFail_decorators;
+    let _writeFailSticky_decorators;
+    return class JudgeHandle {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _attempt_decorators = [observable];
+            _start_decorators = [action];
+            _writeFail_decorators = [action];
+            _writeFailSticky_decorators = [action];
+            __esDecorate(this, null, _attempt_decorators, { kind: "accessor", name: "attempt", static: false, private: false, access: { has: obj => "attempt" in obj, get: obj => obj.attempt, set: (obj, value) => { obj.attempt = value; } }, metadata: _metadata }, _attempt_initializers, _attempt_extraInitializers);
+            __esDecorate(this, null, _start_decorators, { kind: "method", name: "start", static: false, private: false, access: { has: obj => "start" in obj, get: obj => obj.start }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _writeFail_decorators, { kind: "method", name: "writeFail", static: false, private: false, access: { has: obj => "writeFail" in obj, get: obj => obj.writeFail }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _writeFailSticky_decorators, { kind: "method", name: "writeFailSticky", static: false, private: false, access: { has: obj => "writeFailSticky" in obj, get: obj => obj.writeFailSticky }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        job = __runInitializers(this, _instanceExtraInitializers);
+        scope;
+        #attempt_accessor_storage = __runInitializers(this, _attempt_initializers, 0);
+        get attempt() { return this.#attempt_accessor_storage; }
+        set attempt(value) { this.#attempt_accessor_storage = value; }
+        #timer = __runInitializers(this, _attempt_extraInitializers);
+        #attemptAbort;
+        #stop;
+        #seq = 0;
+        constructor(job, scope) {
+            this.job = job;
+            this.scope = scope;
+        }
+        async #classifierApplyArgs() {
+            const args = classifierArgs(this.job.name, this.job.args);
+            if (args === undefined)
+                return undefined;
+            const cluster = clusterOf(this.job.name);
+            if (cluster === "write") {
+                const question = fileQuestion(this.job.args ?? undefined);
+                if (question === undefined)
+                    return undefined;
+                const source = this.scope.root.policyProgram.trim() === "" ? this.scope.distSource() : this.scope.root.policyProgram;
+                const policy = await this.scope.compiledPolicy(source);
+                const kind = policy.writeKind(workspacePath(this.scope.root.path, question)) ?? "outside";
+                return [...args, kind];
+            }
+            if (cluster === "bash") {
+                const report = parseTirithEvidence(this.job.policyEvidenceJson);
+                if (report != null && tirithCoverage(report) === "incomplete")
+                    return [...args, "incomplete"];
+            }
+            return args;
+        }
+        start() {
+            if (this.#stop !== undefined || this.scope.closed)
+                return;
+            this.#stop = reaction(() => remainderPlan(this.scope, this.job, this.attempt), async (plan) => {
+                this.#clearTimer();
+                const seq = ++this.#seq;
+                const jobId = this.job.toolCallId || this.job.name;
+                trace("harness:judge", `plan ${plan.kind} job=${jobId} tool=${this.job.name} attempt=${plan.attempt}${plan.kind === "run" ? ` model=${plan.model}` : ""}`);
+                switch (plan.kind) {
+                    case "cache":
+                        runInAction(() => {
+                            if (this.job.judgeResult !== null)
+                                return;
+                            this.job.judgeResult = plan.decision;
+                        });
+                        return;
+                    case "literal":
+                        runInAction(() => {
+                            if (this.job.judgeResult !== null)
+                                return;
+                            this.job.judgeResult = plan.decision;
+                            this.scope.remainderStore(this.job, plan.identity, plan.decision);
+                        });
+                        return;
+                    case "halt":
+                        this.writeFailSticky("json_schema unsupported: auto mode needs a model that supports structured output");
+                        return;
+                    case "noconnect":
+                        this.writeFail("no model connection");
+                        return;
+                    case "empty":
+                        return;
+                    case "unread":
+                        startProgramRead(plan.source);
+                        return;
+                    case "run":
+                        break;
+                }
+                const started = Date.now();
+                const attemptMs = this.scope.judgeDeadlineMs(plan.attempt);
+                this.#attemptAbort = new AbortController();
+                const attemptAbort = this.#attemptAbort;
+                const deadline = setTimeout(() => {
+                    attemptAbort.abort(new Error(`classifier timed out after ${attemptMs}ms`));
+                }, attemptMs);
+                deadline.unref();
+                try {
+                    let vote = { fail: "classifier did not vote" };
+                    let state;
+                    try {
+                        state = await execState(plan.source, {
+                            capabilities: [processorCapability, promptIsolatedCapability],
+                            signal: attemptAbort.signal,
+                            config: {
+                                privileged: plan.privileged,
+                                priorTurn: plan.priorTurn,
+                                quarantined: plan.quarantined,
+                                policy: plan.policy,
+                                rejectionThreshold: this.scope.rejectionThreshold,
+                                loader: classifierFiles,
+                                job: this.job,
+                                connectionId: plan.connection,
+                                completionModel: plan.model,
+                                complete: this.scope.complete,
+                            },
+                        });
+                    }
+                    catch (error) {
+                        vote = { fail: error instanceof Error ? error.message : String(error) };
+                    }
+                    if (state !== undefined) {
+                        try {
+                            const cluster = clusterOf(this.job.name);
+                            const fn = classifierResources(state.runCtx)[cluster];
+                            if (fn === undefined) {
+                                vote = { fail: `no classifier/${cluster}` };
+                            }
+                            else {
+                                const args = await this.#classifierApplyArgs();
+                                vote =
+                                    args === undefined
+                                        ? { fail: "classifier did not vote" }
+                                        : voteOf(await applyClassifier(state.runCtx, fn, args));
+                            }
+                        }
+                        finally {
+                            await disposeRunContext(state.runCtx);
+                        }
+                    }
+                    if (seq !== this.#seq) {
+                        trace("harness:judge", `stale job=${jobId} ms=${Date.now() - started}`);
+                        return;
+                    }
+                    runInAction(() => {
+                        if (this.job.judgeResult !== null)
+                            return;
+                        if ("fail" in vote) {
+                            trace("harness:judge", `fail job=${jobId} ms=${Date.now() - started} ${vote.fail}`);
+                            if (isJsonSchemaUnsupported(vote.fail)) {
+                                this.scope.schemaHaltKeys.add(`${plan.connection}\n${plan.model}`);
+                                this.writeFailSticky(vote.fail);
+                                return;
+                            }
+                            this.writeFail(vote.fail);
+                            return;
+                        }
+                        trace("harness:judge", `vote ${vote.decision} job=${jobId} ms=${Date.now() - started}`);
+                        this.job.judgeResult = vote.decision;
+                        this.scope.remainderStore(this.job, plan.identity, vote.decision);
+                    });
+                }
+                catch (error) {
+                    if (seq !== this.#seq)
+                        return;
+                    trace("harness:judge", `throw job=${jobId} ms=${Date.now() - started} ${error instanceof Error ? error.message : String(error)}`);
+                    runInAction(() => {
+                        const text = error instanceof Error ? error.message : String(error);
+                        if (isJsonSchemaUnsupported(text)) {
+                            this.scope.schemaHaltKeys.add(`${plan.connection}\n${plan.model}`);
+                            this.writeFailSticky(text);
+                            return;
+                        }
+                        this.writeFail(text);
+                    });
+                }
+                finally {
+                    clearTimeout(deadline);
+                    if (!attemptAbort.signal.aborted)
+                        attemptAbort.abort();
+                    if (this.#attemptAbort === attemptAbort)
+                        this.#attemptAbort = undefined;
+                }
+            }, { equals: comparer.structural, fireImmediately: true });
+        }
+        dispose() {
+            this.#seq += 1;
+            this.#clearTimer();
+            this.#attemptAbort?.abort();
+            this.#attemptAbort = undefined;
+            this.#stop?.();
+            this.#stop = undefined;
+        }
+        writeFail(text) {
+            if (this.job.judgeResult !== null)
+                return;
+            if (text.trim() !== "")
+                this.job.judgeFailMessage = text;
+            if (this.scope.closed)
+                return;
+            this.#clearTimer();
+            const n = this.attempt + 1;
+            this.#timer = setTimeout(action("judgeBackoff", () => {
+                this.#timer = undefined;
+                this.attempt = n;
+            }), this.scope.backoffMs(n));
+        }
+        writeFailSticky(text) {
+            if (this.job.judgeResult !== null)
+                return;
+            if (text.trim() !== "")
+                this.job.judgeFailMessage = text;
+            this.#clearTimer();
+        }
+        #clearTimer() {
+            if (this.#timer === undefined)
+                return;
+            clearTimeout(this.#timer);
+            this.#timer = undefined;
+        }
+    };
+})();
+export { JudgeHandle };
+//# sourceMappingURL=judge.js.map

package/dist/policy-processor/judge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"judge.js","sourceRoot":"","sources":["../../src/policy-processor/judge.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,WAAW,EACX,KAAK,EACL,IAAI,GAGL,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,0CAA0C,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,uBAAuB,EAEvB,SAAS,EACT,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAA0B,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAEnG,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAErC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAG/D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AAI3C,SAAS,MAAM,CAAC,KAAc;IAC5B,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,QAAQ,KAAK,EAAE,CAAC;gBACd,KAAK,OAAO,CAAC;gBACb,KAAK,MAAM;oBACT,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;gBAC7B;oBACE,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACvF,CAAC;QACH,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;YACvF,MAAM,GAAG,GAAG,KAAgC,CAAC;YAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,OAAO,CAAC;gBACb,KAAK,MAAM;oBACT,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB;oBACE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QACD;YACE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,MAAkB,EAClB,EAAuC,EACvC,IAAe;IAEf,MAAM,KAAK,GAAG,aAAa,CACzB,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAgB,CAAC,EAC7D,WAAW,CAAC,MAAM,CAAC,CACpB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACpD,MAAM,CAAC,gBAAgB,CACrB,OAAO,EACP,GAAG,EAAE;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC3F,CAAC,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,eAAe,GAAG,IAAI,YAAY,CAAC,CAAC,CAAS,EAAU,EAAE;IAC7D,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,wBAAwB;YAC3B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qCAAqC,CAAC,EAAE,MAAM,CAAC,CAAC;QACtF,KAAK,wBAAwB;YAC3B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qCAAqC,CAAC,EAAE,MAAM,CAAC,CAAC;QACtF,KAAK,yBAAyB;YAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sCAAsC,CAAC,EAAE,MAAM,CAAC,CAAC;QACvF,KAAK,iCAAiC;YACpC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,8CAA8C,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/F,KAAK,+BAA+B;YAClC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,4CAA4C,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7F,KAAK,uBAAuB;YAC1B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oCAAoC,CAAC,EAAE,MAAM,CAAC,CAAC;QACrF,KAAK,mCAAmC;YACtC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gDAAgD,CAAC,EAAE,MAAM,CAAC,CAAC;QACjG;YACE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAS1E,MAAM,UAAU,UAAU,CACxB,GAAqC,EACrC,IAAqB;IAMrB,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpG,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,UAAU,KAAK,EAAE,IAAI,IAAI,EAAE,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrH,MAAM,KAAK,GAAG,CAAC,UAAU,IAAI,UAAU,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,UAAU,KAAK,KAAK,EAAE,EAAE,CAAC;AAC/D,CAAC;AA6BD,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAsB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9E,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE9C,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO;IAC5C,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CACrB,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EACjF,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,KAA6B;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,IAAI,CAAC,CAAC,IAAI,YAAY,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3F,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB,EAAE,GAAgB,EAAE,OAAe;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC;IAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;QACvC,QAAQ,EAAE,KAAK,CAAC,gBAAgB;QAChC,eAAe,EAAE,KAAK,CAAC,oBAAoB;KAC5C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnE,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpF,uFAAuF;QACvF,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC1E,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IACzF,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC5D,OAAO;QACL,IAAI,EAAE,KAAK;QACX,MAAM;QACN,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO;QACP,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;KAC1B,CAAC;AACJ,CAAC;IAEY,WAAW;;;;;;;;iBAAX,WAAW;;;mCACrB,UAAU;iCA+BV,MAAM;qCA+IN,MAAM;2CAgBN,MAAM;YA9LK,0KAAS,OAAO,6BAAP,OAAO,yFAAK;YAgCjC,kKAAA,KAAK,6DAmIJ;YAYD,8KAAA,SAAS,6DAaR;YAGD,gMAAA,eAAe,6DAId;;;QA5LU,GAAG,GARH,mDAAW;QASX,KAAK;QARJ,2EAAmB,CAAC,EAAC;QAArB,IAAS,OAAO,6CAAK;QAArB,IAAS,OAAO,mDAAK;QACjC,MAAM,uDAA4C;QAClD,aAAa,CAA8B;QAC3C,KAAK,CAAgC;QACrC,IAAI,GAAG,CAAC,CAAC;QAET,YACW,GAAgB,EAChB,KAAmB;YADnB,QAAG,GAAH,GAAG,CAAa;YAChB,UAAK,GAAL,KAAK,CAAc;QAC3B,CAAC;QAEJ,KAAK,CAAC,oBAAoB;YACxB,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;gBAC1D,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAC;gBAC7C,MAAM,MAAM,GACV,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;gBACxG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,SAAS,CAAC;gBAC1F,OAAO,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAChE,IAAI,MAAM,IAAI,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,YAAY;oBAAE,OAAO,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC,CAAC;YAChG,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,KAAK;YACH,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO;YAC1D,IAAI,CAAC,KAAK,GAAG,QAAQ,CACnB,GAAc,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAClE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACb,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC;gBACxB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBACnD,KAAK,CACH,eAAe,EACf,QAAQ,IAAI,CAAC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACnI,CAAC;gBACF,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;oBAClB,KAAK,OAAO;wBACV,WAAW,CAAC,GAAG,EAAE;4BACf,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI;gCAAE,OAAO;4BAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC;wBACvC,CAAC,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,SAAS;wBACZ,WAAW,CAAC,GAAG,EAAE;4BACf,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI;gCAAE,OAAO;4BAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC;4BACrC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;wBACpE,CAAC,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,MAAM;wBACT,IAAI,CAAC,eAAe,CAAC,kFAAkF,CAAC,CAAC;wBACzG,OAAO;oBACT,KAAK,WAAW;wBACd,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;wBACtC,OAAO;oBACT,KAAK,OAAO;wBACV,OAAO;oBACT,KAAK,QAAQ;wBACX,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBAC9B,OAAO;oBACT,KAAK,KAAK;wBACR,MAAM;gBACV,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,CAAC,aAAa,GAAG,IAAI,eAAe,EAAE,CAAC;gBAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;gBACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC/B,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,8BAA8B,SAAS,IAAI,CAAC,CAAC,CAAC;gBAC7E,CAAC,EAAE,SAAS,CAAC,CAAC;gBACd,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,IAAI,GAAc,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;oBAC1D,IAAI,KAAK,CAAC;oBACV,IAAI,CAAC;wBACH,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE;4BACnC,YAAY,EAAE,CAAC,mBAAmB,EAAE,wBAAwB,CAAC;4BAC7D,MAAM,EAAE,YAAY,CAAC,MAAM;4BAC3B,MAAM,EAAE;gCACN,UAAU,EAAE,IAAI,CAAC,UAAU;gCAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;gCACzB,WAAW,EAAE,IAAI,CAAC,WAAW;gCAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gCACnB,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB;gCACjD,MAAM,EAAE,eAAe;gCACvB,GAAG,EAAE,IAAI,CAAC,GAAG;gCACb,YAAY,EAAE,IAAI,CAAC,UAAU;gCAC7B,eAAe,EAAE,IAAI,CAAC,KAAK;gCAC3B,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;6BAC9B;yBACF,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1E,CAAC;oBACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,IAAI,CAAC;4BACH,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BACzC,MAAM,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;4BACtD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gCACrB,IAAI,GAAG,EAAE,IAAI,EAAE,iBAAiB,OAAO,EAAE,EAAE,CAAC;4BAC9C,CAAC;iCAAM,CAAC;gCACN,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;gCAC/C,IAAI;oCACF,IAAI,KAAK,SAAS;wCAChB,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;wCACrC,CAAC,CAAC,MAAM,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;4BAC9D,CAAC;wBACH,CAAC;gCAAS,CAAC;4BACT,MAAM,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACxC,CAAC;oBACH,CAAC;oBACD,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;wBACtB,KAAK,CAAC,eAAe,EAAE,aAAa,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;wBACxE,OAAO;oBACT,CAAC;oBACD,WAAW,CAAC,GAAG,EAAE;wBACf,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI;4BAAE,OAAO;wBAC1C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;4BACnB,KAAK,CAAC,eAAe,EAAE,YAAY,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;4BACpF,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gCACvC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gCACnE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gCAChC,OAAO;4BACT,CAAC;4BACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;4BAC1B,OAAO;wBACT,CAAC;wBACD,KAAK,CAAC,eAAe,EAAE,QAAQ,IAAI,CAAC,QAAQ,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;wBACxF,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC;wBACrC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACpE,CAAC,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI;wBAAE,OAAO;oBAC9B,KAAK,CACH,eAAe,EACf,aAAa,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1G,CAAC;oBACF,WAAW,CAAC,GAAG,EAAE;wBACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBACpE,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;4BAClC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;4BACnE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;4BAC3B,OAAO;wBACT,CAAC;wBACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;oBACvB,CAAC,CAAC,CAAC;gBACL,CAAC;wBAAS,CAAC;oBACT,YAAY,CAAC,QAAQ,CAAC,CAAC;oBACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO;wBAAE,YAAY,CAAC,KAAK,EAAE,CAAC;oBACvD,IAAI,IAAI,CAAC,aAAa,KAAK,YAAY;wBAAE,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;gBAC1E,CAAC;YACH,CAAC,EACD,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,CACvD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACf,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;QAGD,SAAS,CAAC,IAAY;YACpB,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO;YAC1C,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC;YACzD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO;YAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,GAAG,UAAU,CACtB,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE;gBAC1B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;gBACxB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACnB,CAAC,CAAC,EACF,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CACxB,CAAC;QACJ,CAAC;QAGD,eAAe,CAAC,IAAY;YAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO;YAC1C,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC;YACzD,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;QAED,WAAW;YACT,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO;YACtC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,CAAC;;;SA1MU,WAAW"}

package/dist/policy-processor/license.d.ts

@@ -0,0 +1,2 @@
+export { license, noteDenied } from "@inhuman.tools/turn/license";
+//# sourceMappingURL=license.d.ts.map

package/dist/policy-processor/license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/policy-processor/license.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/policy-processor/license.js

@@ -0,0 +1,2 @@
+export { license, noteDenied } from "@inhuman.tools/turn/license";
+//# sourceMappingURL=license.js.map

package/dist/policy-processor/license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.js","sourceRoot":"","sources":["../../src/policy-processor/license.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/policy-processor/lift.d.ts

@@ -0,0 +1,4 @@
+import type { Disposition } from "./types.js";
+/** Match-all / pipeline lattice: any-block > any-deny > any-ask > all-approve. */
+export declare function lattice(hits: readonly Disposition[]): Disposition;
+//# sourceMappingURL=lift.d.ts.map

package/dist/policy-processor/lift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lift.d.ts","sourceRoot":"","sources":["../../src/policy-processor/lift.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,kFAAkF;AAClF,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,CAKjE"}

package/dist/policy-processor/lift.js

@@ -0,0 +1,11 @@
+/** Match-all / pipeline lattice: any-block > any-deny > any-ask > all-approve. */
+export function lattice(hits) {
+    if (hits.includes("block"))
+        return "block";
+    if (hits.includes("deny"))
+        return "deny";
+    if (hits.includes("ask"))
+        return "ask";
+    return "approve";
+}
+//# sourceMappingURL=lift.js.map

package/dist/policy-processor/lift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lift.js","sourceRoot":"","sources":["../../src/policy-processor/lift.ts"],"names":[],"mappings":"AAEA,kFAAkF;AAClF,MAAM,UAAU,OAAO,CAAC,IAA4B;IAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/policy-processor/path-policy.d.ts

@@ -0,0 +1,32 @@
+/**
+ * File-access cluster: policy.yaml `read_file` / `write_file` enable lists
+ * and `read_block` / `write_block` hard-block lists.
+ * Enable `!` is deny (remainder carve-out). Block lists are unliftable.
+ * Suffix wildcard is implied — PAT matches itself and descendants.
+ * Miss is deny (closed). Unresolvable path is ask.
+ * Read enable is approve (silent in-tree). Write enable is ask: the list is
+ * what the agent may attempt, not a grant. Yolo rewrites that ask and deny.
+ * Realpath / cwd / ~ live on the host; this matcher sees the prepared string.
+ */
+import type { Disposition, WriteRemainderKind } from "./types.js";
+export type PathRule = {
+    readonly id: string;
+    readonly polarity: "approve" | "ask" | "deny" | "block";
+    readonly stem: string;
+    readonly unanchored: boolean;
+};
+export type PathTerm = {
+    readonly rules: PathRule[];
+};
+export declare function compilePathRule(text: string, index: number, enable?: "approve" | "ask"): PathRule;
+export declare function compileBlockRule(text: string, index: number): PathRule;
+export declare function mergePathTerms(enable: PathTerm | undefined, block: PathTerm | undefined): PathTerm | undefined;
+export declare function checkPath(term: PathTerm, path: string): Disposition;
+/**
+ * Write-deny remainder intern. Null when the floor is not deny.
+ * protected: enable `!` inside an enable root. outside: miss, left the
+ * enable set. risky: enable `!` and left the enable set. `write_block`
+ * never reaches this.
+ */
+export declare function writeRemainderKind(term: PathTerm, path: string): WriteRemainderKind | null;
+//# sourceMappingURL=path-policy.d.ts.map

package/dist/policy-processor/path-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-policy.d.ts","sourceRoot":"","sources":["../../src/policy-processor/path-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;CAC5B,CAAC;AAEF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,SAAS,GAAG,KAAiB,GAAG,QAAQ,CAY5G;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,CActE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAG9G;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAKnE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAW1F"}