@inhuman.tools/harness 0.1.0 → 0.3.0

package/dist/policy-processor/compile.js

@@ -1,217 +0,0 @@
-/**
- * Compile a policy.yaml document into CommandNode + path terms.
- * `"--"` is a handle, not a subcommand: omitted `policy` inherits.
- * Extra keys on a command object are refused — verbs live under `subcommands`.
- */
-import { parse as parseYaml } from "yaml";
-import { ErrorWithInvariant } from "./error-with-invariant.js";
-import { compileBlockRule, compilePathRule, mergePathTerms } from "./path-policy.js";
-export class PolicyCompileError extends ErrorWithInvariant {
-    name = "PolicyCompileError";
-}
-export class PolicyAssumeError extends ErrorWithInvariant {
-    name = "PolicyAssumeError";
-    expected;
-    actual;
-    command;
-    constructor(message, detail) {
-        super(message);
-        if (detail !== undefined) {
-            this.expected = detail.expected;
-            this.actual = detail.actual;
-            this.command = detail.command;
-        }
-    }
-}
-const DISPS = new Set(["approve", "allow", "ask", "deny", "block"]);
-const RESERVED = new Set(["policy", "arg_types", "arg_rest_type", "matcher", "--", "subcommands"]);
-export function compilePolicy(source) {
-    let raw;
-    try {
-        raw = parseYaml(source, { prettyErrors: true });
-    }
-    catch (error) {
-        throw new PolicyCompileError(error instanceof Error ? error.message : String(error));
-    }
-    if (raw === null || raw === undefined)
-        return { assume: [] };
-    PolicyCompileError.invariant(isRecord(raw), "policy.yaml: document must be a mapping");
-    const unknown = Object.keys(raw).filter((key) => !key.startsWith(".") && !["read_file", "write_file", "read_block", "write_block", "bash", "assume"].includes(key));
-    PolicyCompileError.invariant(unknown.length === 0, `policy.yaml: unknown top-level key ${unknown[0]}`);
-    return {
-        bash: raw.bash === undefined ? undefined : parseCommandDef(raw.bash, "bash", true),
-        read: mergePathTerms(parsePathList(raw.read_file, "read_file", "approve"), parseBlockList(raw.read_block, "read_block")),
-        write: mergePathTerms(parsePathList(raw.write_file, "write_file", "ask"), parseBlockList(raw.write_block, "write_block")),
-        assume: parseAssume(raw.assume),
-    };
-}
-function parsePathList(value, field, enable) {
-    if (value === undefined)
-        return undefined;
-    PolicyCompileError.invariant(Array.isArray(value), `${field}: list of strings`);
-    return {
-        rules: value.map((item, i) => {
-            PolicyCompileError.invariant(typeof item === "string", `${field}: each pattern is a string`);
-            return compilePathRule(item, i, enable);
-        }),
-    };
-}
-function parseBlockList(value, field) {
-    if (value === undefined)
-        return undefined;
-    PolicyCompileError.invariant(Array.isArray(value), `${field}: list of strings`);
-    return {
-        rules: value.map((item, i) => {
-            PolicyCompileError.invariant(typeof item === "string", `${field}: each pattern is a string`);
-            return compileBlockRule(item, i);
-        }),
-    };
-}
-function parseAssume(value) {
-    if (value === undefined)
-        return [];
-    PolicyCompileError.invariant(Array.isArray(value), "assume: list of { command, expect }");
-    return value.map((item, i) => {
-        PolicyCompileError.invariant(isRecord(item), `assume[${i}]: mapping`);
-        PolicyCompileError.invariant(typeof item.command === "string", `assume[${i}]: command is a string`);
-        const expect = asDisposition(item.expect);
-        PolicyCompileError.invariant(expect !== undefined, `assume[${i}]: expect is approve|ask|deny|block`);
-        return { command: item.command, expect };
-    });
-}
-function parseCommandDef(value, path, policyRequired) {
-    const disp = asDisposition(value);
-    if (disp !== undefined) {
-        return emptyNode(disp);
-    }
-    PolicyCompileError.invariant(isRecord(value), `${path}: command is a disposition or a mapping`);
-    const extra = Object.keys(value).filter((key) => !RESERVED.has(key));
-    PolicyCompileError.invariant(extra.length === 0, `${path}: unknown key ${extra[0]} — verbs go under subcommands`);
-    const policy = value.policy === undefined ? undefined : asDisposition(value.policy);
-    PolicyCompileError.invariant(value.policy === undefined || policy !== undefined, `${path}.policy: approve|ask|deny|block`);
-    PolicyCompileError.invariant(!policyRequired || policy !== undefined, `${path}: policy is required`);
-    const subcommands = {};
-    if (value.subcommands !== undefined) {
-        PolicyCompileError.invariant(isRecord(value.subcommands), `${path}.subcommands: mapping`);
-        for (const [name, def] of Object.entries(value.subcommands)) {
-            subcommands[String(name)] = parseCommandDef(def, `${path}.subcommands.${name}`, true);
-        }
-    }
-    return {
-        policy,
-        argTypes: parseArgTypes(value.arg_types, `${path}.arg_types`),
-        argRestType: parseArgType(value.arg_rest_type, `${path}.arg_rest_type`),
-        matchers: parseMatchers(value.matcher, `${path}.matcher`),
-        dash: value["--"] === undefined ? undefined : parseCommandDef(value["--"], `${path}.--`, false),
-        subcommands,
-    };
-}
-function emptyNode(policy) {
-    return { policy, argTypes: [], matchers: [], subcommands: {} };
-}
-function isArgType(value) {
-    return value === "read_path" || value === "write_path";
-}
-function parseArgTypes(value, path) {
-    if (value === undefined)
-        return [];
-    PolicyCompileError.invariant(Array.isArray(value), `${path}: list`);
-    return value.map((item, i) => {
-        const parsed = parseArgType(item, `${path}[${i}]`);
-        PolicyCompileError.invariant(parsed !== undefined, `${path}[${i}]: missing`);
-        return parsed;
-    });
-}
-function parseArgType(value, path) {
-    if (value === undefined)
-        return undefined;
-    PolicyCompileError.invariant(typeof value === "string" && isArgType(value), `${path}: read_path|write_path`);
-    return value;
-}
-function parseMatchers(value, path) {
-    if (value === undefined)
-        return [];
-    PolicyCompileError.invariant(Array.isArray(value), `${path}: list`);
-    return value.map((item, i) => parseMatcher(item, `${path}[${i}]`));
-}
-function parseMatcher(value, path) {
-    PolicyCompileError.invariant(isRecord(value), `${path}: mapping`);
-    const extra = Object.keys(value).filter((key) => !["flags", "glob", "tok", "matcher", "policy"].includes(key));
-    PolicyCompileError.invariant(extra.length === 0, `${path}: unknown key ${extra[0]}`);
-    const policy = value.policy === undefined ? undefined : asDisposition(value.policy);
-    PolicyCompileError.invariant(value.policy === undefined || policy !== undefined, `${path}.policy: approve|ask|deny|block`);
-    return {
-        flags: parseFlags(value.flags, `${path}.flags`),
-        globs: stringList(value.glob, `${path}.glob`),
-        toks: stringList(value.tok, `${path}.tok`),
-        matchers: parseMatchers(value.matcher, `${path}.matcher`),
-        policy,
-    };
-}
-function parseFlags(value, path) {
-    if (value === undefined)
-        return {};
-    PolicyCompileError.invariant(isRecord(value), `${path}: mapping`);
-    const out = {};
-    for (const [raw, spec] of Object.entries(value)) {
-        const canonical = String(raw);
-        out[canonical] = parseFlagConstraint(spec, canonical, `${path}.${canonical}`);
-    }
-    return out;
-}
-function parseFlagConstraint(value, canonical, path) {
-    if (value === true || value === null) {
-        return { names: [canonical], vals: [], takesValue: false };
-    }
-    PolicyCompileError.invariant(isRecord(value), `${path}: true or { alias, value, value_type }`);
-    const extra = Object.keys(value).filter((key) => !["alias", "value", "value_type"].includes(key));
-    PolicyCompileError.invariant(extra.length === 0, `${path}: unknown key ${extra[0]}`);
-    const aliases = stringList(value.alias, `${path}.alias`);
-    const vals = stringList(value.value, `${path}.value`);
-    const takesValue = vals.length > 0 || value.value_type !== undefined;
-    if (value.value_type !== undefined) {
-        PolicyCompileError.invariant(typeof value.value_type === "string", `${path}.value_type: string`);
-    }
-    return { names: [canonical, ...aliases], vals, takesValue };
-}
-function stringList(value, path) {
-    if (value === undefined)
-        return [];
-    if (typeof value === "string")
-        return [value];
-    PolicyCompileError.invariant(Array.isArray(value), `${path}: string or list of strings`);
-    return value.map((item, i) => {
-        PolicyCompileError.invariant(typeof item === "string", `${path}[${i}]: string`);
-        return item;
-    });
-}
-export function asDisposition(value) {
-    if (typeof value !== "string" || !DISPS.has(value))
-        return undefined;
-    return value === "allow" ? "approve" : value;
-}
-export function flagVocab(node) {
-    const names = new Set();
-    addMatcherFlags(node.matchers, names, false);
-    return names;
-}
-export function valueFlagNames(node) {
-    const names = new Set();
-    addMatcherFlags(node.matchers, names, true);
-    return names;
-}
-function addMatcherFlags(matchers, names, valueOnly) {
-    for (const matcher of matchers) {
-        for (const flag of Object.values(matcher.flags)) {
-            if (valueOnly && !flag.takesValue)
-                continue;
-            for (const name of flag.names)
-                names.add(name);
-        }
-        addMatcherFlags(matcher.matchers, names, valueOnly);
-    }
-}
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-//# sourceMappingURL=compile.js.map

package/dist/policy-processor/compile.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compile.js","sourceRoot":"","sources":["../../src/policy-processor/compile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAiB,MAAM,kBAAkB,CAAC;AAGpG,MAAM,OAAO,kBAAmB,SAAQ,kBAAkB;IACtC,IAAI,GAAG,oBAAoB,CAAC;CAC/C;AAED,MAAM,OAAO,iBAAkB,SAAQ,kBAAkB;IACrC,IAAI,GAAG,mBAAmB,CAAC;IACpC,QAAQ,CAAe;IACvB,MAAM,CAAe;IACrB,OAAO,CAAU;IAE1B,YAAY,OAAe,EAAE,MAAwE;QACnG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAChC,CAAC;IACH,CAAC;CACF;AAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;AAcnG,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7D,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,yCAAyC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CACrC,CAAC,GAAG,EAAE,EAAE,CACN,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CACpH,CAAC;IACF,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,sCAAsC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvG,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;QAClF,IAAI,EAAE,cAAc,CAClB,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,EACpD,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAC7C;QACD,KAAK,EAAE,cAAc,CACnB,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,EAClD,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAC/C;QACD,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa,EAAE,MAAyB;IAC7E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAChF,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YAC3B,kBAAkB,CAAC,SAAS,CAAC,OAAO,IAAI,KAAK,QAAQ,EAAE,GAAG,KAAK,4BAA4B,CAAC,CAAC;YAC7F,OAAO,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAChF,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YAC3B,kBAAkB,CAAC,SAAS,CAAC,OAAO,IAAI,KAAK,QAAQ,EAAE,GAAG,KAAK,4BAA4B,CAAC,CAAC;YAC7F,OAAO,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,qCAAqC,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC3B,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACtE,kBAAkB,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,UAAU,CAAC,wBAAwB,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,kBAAkB,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,UAAU,CAAC,qCAAqC,CAAC,CAAC;QACrG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY,EAAE,cAAuB;IAC5E,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,yCAAyC,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,IAAI,iBAAiB,KAAK,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC;IAClH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,kBAAkB,CAAC,SAAS,CAC1B,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAClD,GAAG,IAAI,iCAAiC,CACzC,CAAC;IACF,kBAAkB,CAAC,SAAS,CAAC,CAAC,cAAc,IAAI,MAAM,KAAK,SAAS,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IACrG,MAAM,WAAW,GAAgC,EAAE,CAAC;IACpD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,IAAI,gBAAgB,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,CAAC;QAC7D,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,IAAI,gBAAgB,CAAC;QACvE,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,CAAC;QACzD,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,KAAK,EAAE,KAAK,CAAC;QAC/F,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAAmB;IACpC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,YAAY,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,kBAAkB,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,kBAAkB,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,wBAAwB,CAAC,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/G,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,IAAI,iBAAiB,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,kBAAkB,CAAC,SAAS,CAC1B,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAClD,GAAG,IAAI,iCAAiC,CACzC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC;QAC/C,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC;QAC7C,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC;QAC1C,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,CAAC;QACzD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,IAAY;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;IAClE,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,SAAiB,EAAE,IAAY;IAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC;IACD,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,wCAAwC,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,IAAI,iBAAiB,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,kBAAkB,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,GAAG,IAAI,qBAAqB,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,IAAY;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC3B,kBAAkB,CAAC,SAAS,CAAC,OAAO,IAAI,KAAK,QAAQ,EAAE,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,KAAqB,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAiB;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAiB;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B,EAAE,KAAkB,EAAE,SAAkB;IAC3F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC5C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/policy-processor/error-with-invariant.d.ts

@@ -1,9 +0,0 @@
-/**
- * Error whose `static invariant` throws `new this(...ctorArgs)`.
- * Not on ErrorConstructor — a receiver with extra constructor args
- * (`(code, message)`) does not fight `(condition, message?)`.
- */
-export declare class ErrorWithInvariant extends Error {
-    static invariant<T extends new (...args: any) => ErrorWithInvariant>(this: T, condition: unknown, ...args: ConstructorParameters<T>): asserts condition;
-}
-//# sourceMappingURL=error-with-invariant.d.ts.map

package/dist/policy-processor/error-with-invariant.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"error-with-invariant.d.ts","sourceRoot":"","sources":["../../src/policy-processor/error-with-invariant.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,KAAK,GAAG,IAAI,EAAE,GAAG,KAAK,kBAAkB,EACjE,IAAI,EAAE,CAAC,EACP,SAAS,EAAE,OAAO,EAClB,GAAG,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAChC,OAAO,CAAC,SAAS;CAGrB"}

package/dist/policy-processor/error-with-invariant.js

@@ -1,12 +0,0 @@
-/**
- * Error whose `static invariant` throws `new this(...ctorArgs)`.
- * Not on ErrorConstructor — a receiver with extra constructor args
- * (`(code, message)`) does not fight `(condition, message?)`.
- */
-export class ErrorWithInvariant extends Error {
-    static invariant(condition, ...args) {
-        if (!condition)
-            throw new this(...args);
-    }
-}
-//# sourceMappingURL=error-with-invariant.js.map

package/dist/policy-processor/error-with-invariant.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"error-with-invariant.js","sourceRoot":"","sources":["../../src/policy-processor/error-with-invariant.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,CAAC,SAAS,CAEd,SAAkB,EAClB,GAAG,IAA8B;QAEjC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/policy-processor/evidence.d.ts

@@ -1,21 +0,0 @@
-/**
- * Classifier request cuts from the job's owning turn. Nested jobs keep
- * that turn; a caller-supplied turn would be the wrong one. Privileged
- * is user prompts on the owning turn and its tail ancestry — continue
- * mints `prompt: ""` with the authorization on the tail. Unattended /
- * eval with no user text: owning ProgrammaticJob expr (approval.md
- * EVIDENCE). The bag itself is not a remainder subject — only inner
- * ToolCallJob leaves.
- */
-import { ToolCallJob } from "@inhuman.tools/harness-model";
-export type EvidenceCuts = {
-    readonly privileged: string;
-    readonly priorTurn: string;
-    readonly quarantined: string;
-    readonly policy?: string;
-};
-export declare function evidenceCuts(job: ToolCallJob): EvidenceCuts;
-export declare function evidenceIdentity(cuts: EvidenceCuts): string;
-/** Cluster+payload remainder skip key. */
-export declare function evidencePayloadKey(job: ToolCallJob): string | null;
-//# sourceMappingURL=evidence.d.ts.map

package/dist/policy-processor/evidence.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/policy-processor/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAOL,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAGtC,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,YAAY,CAgC3D;AAyBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED,0CAA0C;AAC1C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAIlE"}

package/dist/policy-processor/evidence.js

@@ -1,169 +0,0 @@
-/**
- * Classifier request cuts from the job's owning turn. Nested jobs keep
- * that turn; a caller-supplied turn would be the wrong one. Privileged
- * is user prompts on the owning turn and its tail ancestry — continue
- * mints `prompt: ""` with the authorization on the tail. Unattended /
- * eval with no user text: owning ProgrammaticJob expr (approval.md
- * EVIDENCE). The bag itself is not a remainder subject — only inner
- * ToolCallJob leaves.
- */
-import { clusterOf, fileQuestion, ProgrammaticJob, reactChunks, SessionTurn, tapeCompletion, ToolCallJob, } from "@inhuman.tools/harness-model";
-import { parseTirithEvidence, tirithPolicyCut } from "@inhuman.tools/policy-tirith";
-export function evidenceCuts(job) {
-    const turn = owningTurn(job);
-    const program = owningProgram(job);
-    if (turn == null) {
-        return {
-            privileged: program?.expr.trim() || "",
-            priorTurn: "",
-            quarantined: "",
-            policy: policyPipCut(job.policyEvidenceJson),
-        };
-    }
-    const prior = [];
-    const quarantined = [];
-    for (const chunk of reactChunks(turn)) {
-        const completion = tapeCompletion(chunk);
-        if (completion != null) {
-            if (!completion.isDone || underJob(completion, job))
-                continue;
-            if (completion.responseText !== "")
-                prior.push(completion.responseText);
-            continue;
-        }
-        if (!(chunk instanceof ToolCallJob) || chunk === job)
-            continue;
-        if (chunk.sealedOutcomeJson() == null)
-            continue;
-        const text = observationText(chunk.observationPayload());
-        if (text === "")
-            continue;
-        quarantined.push(`${chunk.name} → ${text}`);
-    }
-    return {
-        privileged: privilegedUserText(turn, program),
-        priorTurn: prior.join("\n"),
-        quarantined: quarantined.join("\n"),
-        policy: policyPipCut(job.policyEvidenceJson),
-    };
-}
-function policyPipCut(json) {
-    if (json == null || json === "")
-        return "";
-    const report = parseTirithEvidence(json);
-    if (report != null)
-        return tirithPolicyCut(report);
-    return json;
-}
-/** Oldest-first user prompts on `turn` then tails. Expr only when none exist. */
-function privilegedUserText(turn, program) {
-    const seen = new Set();
-    const prompts = [];
-    let cell = turn;
-    while (cell != null && !seen.has(cell)) {
-        seen.add(cell);
-        const text = cell.prompt.trim();
-        if (text !== "")
-            prompts.push(text);
-        cell = cell.turnTail instanceof SessionTurn ? cell.turnTail : null;
-    }
-    prompts.reverse();
-    if (prompts.length > 0)
-        return prompts.join("\n");
-    return program?.expr.trim() || "";
-}
-export function evidenceIdentity(cuts) {
-    return JSON.stringify([cuts.privileged, cuts.priorTurn, cuts.quarantined, cuts.policy ?? ""]);
-}
-/** Cluster+payload remainder skip key. */
-export function evidencePayloadKey(job) {
-    const payload = canonicalPayload(job);
-    if (payload == null || payload === "")
-        return null;
-    return JSON.stringify([clusterOf(job.name), payload]);
-}
-function owningTurn(job) {
-    return ancestor(job, (parent) => parent instanceof SessionTurn);
-}
-function owningProgram(job) {
-    return ancestor(job, (parent) => parent instanceof ProgrammaticJob);
-}
-function ancestor(job, match) {
-    const seen = new Set();
-    let node = job;
-    while (node != null) {
-        if (seen.has(node))
-            return null;
-        seen.add(node);
-        const parent = node.parent;
-        if (match(parent))
-            return parent;
-        if (parent instanceof SessionTurn)
-            return null;
-        node = parent !== null && typeof parent === "object" && "parent" in parent ? parent : null;
-    }
-    return null;
-}
-function underJob(node, job) {
-    const seen = new Set();
-    let cur = node;
-    while (cur != null) {
-        if (seen.has(cur))
-            return false;
-        seen.add(cur);
-        if (cur === job)
-            return true;
-        const parent = cur.parent;
-        if (parent instanceof SessionTurn)
-            return false;
-        cur = parent !== null && typeof parent === "object" && "parent" in parent ? parent : null;
-    }
-    return false;
-}
-function observationText(value) {
-    if (typeof value === "string")
-        return value;
-    if (value === undefined)
-        return "";
-    try {
-        const json = JSON.stringify(value);
-        return typeof json === "string" ? json : "";
-    }
-    catch {
-        return String(value);
-    }
-}
-function canonicalPayload(job) {
-    const args = job.args;
-    switch (clusterOf(job.name)) {
-        case "bash": {
-            const command = args?.command;
-            if (typeof command !== "string" || command === "")
-                return null;
-            const cwd = args?.cwd;
-            if (typeof cwd === "string" && cwd !== "" && cwd !== ".")
-                return `${command}\ncwd ${cwd}`;
-            return command;
-        }
-        case "read":
-            return fileQuestion(args) ?? ".";
-        case "write":
-            return fileQuestion(args) ?? null;
-        case "mcp":
-            return `${job.name}\n${stableJson(args ?? {})}`;
-    }
-}
-function sortKeys(value) {
-    if (value === null || typeof value !== "object")
-        return value;
-    if (Array.isArray(value))
-        return value.map((item) => sortKeys(item));
-    const rec = value;
-    return Object.fromEntries(Object.keys(rec)
-        .toSorted()
-        .map((key) => [key, sortKeys(rec[key])]));
-}
-function stableJson(value) {
-    return JSON.stringify(sortKeys(value));
-}
-//# sourceMappingURL=evidence.js.map

package/dist/policy-processor/evidence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/policy-processor/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,SAAS,EACT,YAAY,EACZ,eAAe,EACf,WAAW,EACX,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AASpF,MAAM,UAAU,YAAY,CAAC,GAAgB;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,OAAO;YACL,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;YACtC,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,EAAE;YACf,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC;SAC7C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;gBAAE,SAAS;YAC9D,IAAI,UAAU,CAAC,YAAY,KAAK,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC,IAAI,KAAK,KAAK,GAAG;YAAE,SAAS;QAC/D,IAAI,KAAK,CAAC,iBAAiB,EAAE,IAAI,IAAI;YAAE,SAAS;QAChD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACzD,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,UAAU,EAAE,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC;QAC7C,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB;IACvC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,IAAiB,EAAE,OAA+B;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAe,CAAC;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,QAAQ,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,CAAC;IAClB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAkB;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,kBAAkB,CAAC,GAAgB;IACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB;IAClC,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,YAAY,WAAW,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB;IACrC,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAA6B,EAAE,CAAC,MAAM,YAAY,eAAe,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,QAAQ,CAAI,GAAwB,EAAE,KAAuC;IACpF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,IAAI,GAA+B,GAAG,CAAC;IAC3C,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,MAAM,GAAY,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACjC,IAAI,MAAM,YAAY,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,GAAG,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAE,MAA8B,CAAC,CAAC,CAAC,IAAI,CAAC;IACtH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,IAAyB,EAAE,GAAgB;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,GAAG,GAA+B,IAAI,CAAC;IAC3C,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,MAAM,GAAY,GAAG,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,YAAY,WAAW;YAAE,OAAO,KAAK,CAAC;QAChD,GAAG,GAAG,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAE,MAA8B,CAAC,CAAC,CAAC,IAAI,CAAC;IACrH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAgB;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,QAAQ,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;YAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG;gBAAE,OAAO,GAAG,OAAO,SAAS,GAAG,EAAE,CAAC;YAC1F,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,MAAM;YACT,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QACnC,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACpC,KAAK,KAAK;YACR,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACb,QAAQ,EAAE;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/policy-processor/identity.d.ts

@@ -1,15 +0,0 @@
-/**
- * Executable identity. Path-form argv0 is the named command iff `which`
- * returns the same path; otherwise it stays a path (root miss → ask).
- * No process-lifetime cache — PATH/cwd are part of identity.
- */
-export type Which = (name: string) => string | undefined;
-export declare function whichOnPath(name: string): string | undefined;
-export declare function basename(path: string): string;
-/** Named `cmd` is itself. Path-form is `cmd` only when `which` agrees. */
-export declare function resolveKnown(raw: string, known: ReadonlySet<string>, which: Which | undefined): string | undefined;
-/** Path-form argv0 rewritten to the known name, or the original token. */
-export declare function identityName(raw: string, known: ReadonlySet<string>, which: Which | undefined): string;
-export declare function samePath(referred: string, canonical: string): boolean;
-export declare function normalizeIdentity(raw: string): string | undefined;
-//# sourceMappingURL=identity.d.ts.map

package/dist/policy-processor/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/policy-processor/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAEzD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ5D;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7C;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOlH;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAEtG;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMjE"}

package/dist/policy-processor/identity.js

@@ -1,52 +0,0 @@
-/**
- * Executable identity. Path-form argv0 is the named command iff `which`
- * returns the same path; otherwise it stays a path (root miss → ask).
- * No process-lifetime cache — PATH/cwd are part of identity.
- */
-import { execFileSync } from "node:child_process";
-export function whichOnPath(name) {
-    if (name === "" || name.includes("/") || name.includes("\0"))
-        return undefined;
-    try {
-        const out = execFileSync("which", [name], { encoding: "utf8", timeout: 1000 }).trim();
-        return out === "" ? undefined : out.split("\n")[0];
-    }
-    catch {
-        return undefined;
-    }
-}
-export function basename(path) {
-    const slash = path.lastIndexOf("/");
-    return slash === -1 ? path : path.slice(slash + 1) || path;
-}
-/** Named `cmd` is itself. Path-form is `cmd` only when `which` agrees. */
-export function resolveKnown(raw, known, which) {
-    const base = basename(raw);
-    if (base === "" || !known.has(base))
-        return undefined;
-    if (!raw.includes("/"))
-        return base;
-    const canonical = which?.(base);
-    if (canonical === undefined)
-        return undefined;
-    return samePath(raw, canonical) ? base : undefined;
-}
-/** Path-form argv0 rewritten to the known name, or the original token. */
-export function identityName(raw, known, which) {
-    return resolveKnown(raw, known, which) ?? raw;
-}
-export function samePath(referred, canonical) {
-    const left = normalizeIdentity(referred);
-    const right = normalizeIdentity(canonical);
-    return left !== undefined && left === right;
-}
-export function normalizeIdentity(raw) {
-    if (raw === "" || raw.includes("\0"))
-        return undefined;
-    const slash = raw.replaceAll("\\", "/");
-    const parts = slash.split("/").filter((seg) => seg !== "" && seg !== ".");
-    if (parts.includes(".."))
-        return undefined;
-    return slash.startsWith("/") ? `/${parts.join("/")}` : parts.join("/");
-}
-//# sourceMappingURL=identity.js.map

package/dist/policy-processor/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/policy-processor/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIlD,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AAC7D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,KAA0B,EAAE,KAAwB;IAC5F,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,KAA0B,EAAE,KAAwB;IAC5F,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAiB;IAC1D,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzE,CAAC"}

package/dist/policy-processor/judge.d.ts

@@ -1,39 +0,0 @@
-import { type ToolCallJob } from "@inhuman.tools/harness-model";
-import type { LicenseScope } from "./scope.js";
-/**
- * Every remainder attempt is deadline-bounded. The first is short because the
- * first vote is what the human is waiting on — a miss must open the approval
- * window fast. Retries get longer: a slow-but-live model may still deliver a
- * late allow, and the loop never gives up (overnight runs rely on that). But no
- * attempt may run unbounded — with `scope.cap` a stuck judge squatting a slot
- * starves every job behind it, which is the hang.
- *
- * Below the stall timer on purpose: a live stream that trickles a token every
- * few minutes resets the stall timer forever, so the wall clock is the only
- * bound that fires.
- */
-export declare const FIRST_ATTEMPT_MS = 12000;
-export declare const RETRY_ATTEMPT_MS: number;
-export type JudgeRouteOpts = {
-    /** Kernel last-choice. Session mint is a snapshot; this overlay is live. */
-    readonly fallback?: Readonly<Record<string, string>>;
-    /** Connection `settings.model` when the judge wire is named but `judgeModel` is empty. */
-    readonly configuredModel?: (connectionId: string) => string;
-};
-export declare function judgeRoute(kvs: Readonly<Record<string, string>>, opts?: JudgeRouteOpts): {
-    readonly connection: string;
-    readonly model: string;
-    readonly key: string;
-};
-export declare class JudgeHandle {
-    #private;
-    readonly job: ToolCallJob;
-    readonly scope: LicenseScope;
-    accessor attempt: number;
-    constructor(job: ToolCallJob, scope: LicenseScope);
-    start(): void;
-    dispose(): void;
-    writeFail(text: string): void;
-    writeFailSticky(text: string): void;
-}
-//# sourceMappingURL=judge.d.ts.map

package/dist/policy-processor/judge.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"judge.d.ts","sourceRoot":"","sources":["../../src/policy-processor/judge.ts"],"names":[],"mappings":"AA8BA,OAAO,EAGL,KAAK,WAAW,EAGjB,MAAM,8BAA8B,CAAC;AAStC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,gBAAgB,QAAa,CAAC;AAqF3C,MAAM,MAAM,cAAc,GAAG;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;CAC7D,CAAC;AAEF,wBAAgB,UAAU,CACxB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,IAAI,CAAC,EAAE,cAAc,GACpB;IACD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAOA;AAmFD,qBAAa,WAAW;;IAQpB,QAAQ,CAAC,GAAG,EAAE,WAAW;IACzB,QAAQ,CAAC,KAAK,EAAE,YAAY;IARlB,QAAQ,CAAC,OAAO,SAAK;gBAOtB,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,YAAY;IAwB9B,KAAK,IAAI,IAAI;IAqIb,OAAO,IAAI,IAAI;IAUf,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAgB7B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;CAWpC"}