@intutic/cli 2.9.1 → 3.0.1

package/dist/lib/decideLocal.js

@@ -0,0 +1,178 @@
+/**
+ * Where `intutic decide` keeps its machine state, under `~/.intutic/decide/`:
+ *
+ * - `engine.json` (0600): the engine's url, adapter, model, timeoutMs,
+ *   parallel and structured, and the per-call p95 `doctor` measured
+ *   (`q95Ms`). Never the key: `INTUTIC_DECIDE_API_KEY` is read from the
+ *   environment only, and never written or logged.
+ * - `evals/<ruleHash>/<digest>.json`: a pin a passing `decide eval` earned,
+ *   which the snapshot writer reads; `evals/<ruleHash>/runs/<id>.json`, each
+ *   run's report; `evals/<ruleHash>/candidates/<digest>.json`, what
+ *   `decide calibrate` fitted.
+ * - `canary.json`, the canary cache; `stats/<ruleHash>.json`, the drift
+ *   stats; `disabled`, the `decide disable` marker.
+ *
+ * The decide log is `~/.intutic/logs/decide-YYYY-MM-DD.jsonl`.
+ *
+ * Every path is computed at call time from the home directory, so a test's
+ * HOME applies. Nothing here imports the sync daemon: `decide check` runs
+ * on every gated call and its start-up time is the gate's budget.
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs';
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { createDecideEngine, DecideEngineError, decideStoredQ95Ms, resolveDecideEngineConfig, } from '@intutic/shared-types';
+export const sha256Hex = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
+export function decideDir() {
+    return join(homedir(), '.intutic', 'decide');
+}
+export function engineFile() {
+    return join(decideDir(), 'engine.json');
+}
+export function evalsDir(ruleHash) {
+    return join(decideDir(), 'evals', ruleHash);
+}
+export function runsDir(ruleHash) {
+    return join(evalsDir(ruleHash), 'runs');
+}
+export function candidatesDir(ruleHash) {
+    return join(evalsDir(ruleHash), 'candidates');
+}
+export function statsDir() {
+    return join(decideDir(), 'stats');
+}
+export function canaryFile() {
+    return join(decideDir(), 'canary.json');
+}
+export function disabledFile() {
+    return join(decideDir(), 'disabled');
+}
+export function logsDir() {
+    return join(homedir(), '.intutic', 'logs');
+}
+/** A model digest as a file name: anything but `[A-Za-z0-9._-]` becomes `-`. */
+export function digestFileName(modelDigest) {
+    return `${modelDigest.replace(/[^A-Za-z0-9._-]/g, '-')}.json`;
+}
+/** The fields `engine.json` may hold. The key is never one of them. */
+export const ENGINE_FILE_FIELDS = ['url', 'adapter', 'model', 'timeoutMs', 'parallel', 'structured', 'ollama', 'q95Ms', 'q95MeasuredAt'];
+/** engine.json, parsed, or null when there is none. Throws when it does not parse. */
+export function readEngineFile() {
+    let text;
+    try {
+        text = node_fs.readFileSync(engineFile(), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const v = JSON.parse(text);
+    if (typeof v !== 'object' || v === null || Array.isArray(v))
+        throw new Error(`${engineFile()} must hold a JSON object`);
+    return v;
+}
+/** Writes engine.json (0600 in a 0700 directory), keeping only the known fields: a key passed in by mistake is dropped. */
+export function writeEngineFile(values) {
+    const kept = {};
+    for (const k of ENGINE_FILE_FIELDS)
+        if (values[k] !== undefined)
+            kept[k] = values[k];
+    writeJson(engineFile(), kept);
+}
+/** Writes JSON whole by a rename, mode 0600, its directory 0700. */
+export function writeJson(file, value) {
+    const dir = file.replace(/[\\/][^\\/]*$/, '');
+    node_fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+    node_fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 });
+    node_fs.renameSync(tmp, file);
+}
+export function readJson(file) {
+    try {
+        return JSON.parse(node_fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** The environment variables the engine configuration reads, and only those. */
+export function decideEnv() {
+    return {
+        INTUTIC_DECIDE_ENGINE_URL: process.env.INTUTIC_DECIDE_ENGINE_URL,
+        INTUTIC_DECIDE_ADAPTER: process.env.INTUTIC_DECIDE_ADAPTER,
+        INTUTIC_DECIDE_MODEL: process.env.INTUTIC_DECIDE_MODEL,
+        INTUTIC_DECIDE_TIMEOUT_MS: process.env.INTUTIC_DECIDE_TIMEOUT_MS,
+        INTUTIC_DECIDE_PARALLEL: process.env.INTUTIC_DECIDE_PARALLEL,
+        INTUTIC_DECIDE_API_KEY: process.env.INTUTIC_DECIDE_API_KEY,
+        INTUTIC_DECIDE_MODEL_DIGEST: process.env.INTUTIC_DECIDE_MODEL_DIGEST,
+        INTUTIC_SELF_HOSTED_DECISION_HOSTS: process.env.INTUTIC_SELF_HOSTED_DECISION_HOSTS,
+        INTUTIC_DECIDE_MAX_RESPONSE_STATE_BYTES: process.env.INTUTIC_DECIDE_MAX_RESPONSE_STATE_BYTES,
+    };
+}
+/** The engine engine.json and the environment describe. Never throws. */
+export function loadEngine(env = decideEnv()) {
+    let file;
+    try {
+        file = readEngineFile();
+    }
+    catch (err) {
+        return { cfg: null, engine: new DecideEngineError('not_configured', err instanceof Error ? err.message : String(err)), q95Ms: null };
+    }
+    // Read as every gate's decide tier reads it.
+    const q95 = decideStoredQ95Ms(file);
+    let cfg;
+    try {
+        cfg = resolveDecideEngineConfig(file, env);
+    }
+    catch (err) {
+        return { cfg: null, engine: err instanceof DecideEngineError ? err : new DecideEngineError('not_configured', String(err)), q95Ms: q95 };
+    }
+    try {
+        return { cfg, engine: createDecideEngine(cfg), q95Ms: q95 };
+    }
+    catch (err) {
+        return { cfg, engine: err instanceof DecideEngineError ? err : new DecideEngineError('not_configured', String(err)), q95Ms: q95 };
+    }
+}
+/** `host:port` of an engine URL, for logs; never its path, query or credentials. */
+export function engineHost(url) {
+    try {
+        const u = new URL(url);
+        return u.port ? `${u.hostname}:${u.port}` : u.hostname;
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * What 3.0 does not do with a readable rule as written, one sentence each,
+ * for `decide lint`, `gates install` and `doctor`:
+ *
+ * - `context: ["last_user_turn"]`: reserved. No gate supplies the user's last
+ *   turn, so the rule is asked without one, and `decide test` and
+ *   `decide eval` ask it the same way so the eval measures what a gate asks.
+ *
+ * An `on: response` rule is carried out: the gateway judges each complete
+ * response by it.
+ */
+export function decideRuleNotes(rule) {
+    const out = [];
+    if ((rule.context ?? []).includes('last_user_turn')) {
+        out.push(`decide rule ${rule.id} declares context: ["last_user_turn"], which is reserved and not supplied in 3.0: ` +
+            'no gate passes the user\'s last turn, so the rule is asked without it (in `decide test` and `decide eval` too)');
+    }
+    return out;
+}
+/** The drift baseline of a stored eval run, or null. */
+export function readEvalRunBaseline(ruleHash, evalRunId) {
+    if (!/^[A-Za-z0-9._-]+$/.test(evalRunId))
+        return null;
+    const run = readJson(join(runsDir(ruleHash), `${evalRunId}.json`));
+    const b = run?.baseline;
+    if (!b || typeof b.escalationRate !== 'number' || typeof b.questions !== 'object' || b.questions === null)
+        return null;
+    return b;
+}
+//# sourceMappingURL=decideLocal.js.map

package/dist/lib/decideLocal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decideLocal.js","sourceRoot":"","sources":["../../src/lib/decideLocal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,GAI1B,MAAM,uBAAuB,CAAA;AAE9B,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE1G,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;AAC9C,CAAC;AACD,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAA;AACzC,CAAC;AACD,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AAC7C,CAAC;AACD,MAAM,UAAU,OAAO,CAAC,QAAgB;IACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;AACzC,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAA;AAC/C,CAAC;AACD,MAAM,UAAU,QAAQ;IACtB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAA;AACnC,CAAC;AACD,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAA;AACzC,CAAC;AACD,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,UAAU,CAAC,CAAA;AACtC,CAAC;AACD,MAAM,UAAU,OAAO;IACrB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAA;AAC/D,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAU,CAAA;AAEjJ,sFAAsF;AACtF,MAAM,UAAU,cAAc;IAC5B,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;IACrC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,EAAE,0BAA0B,CAAC,CAAA;IACvH,OAAO,CAA4B,CAAA;AACrC,CAAC;AAED,2HAA2H;AAC3H,MAAM,UAAU,eAAe,CAAC,MAA+B;IAC7D,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,IAAI,kBAAkB;QAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACpF,SAAS,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAc;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IAC7C,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAA;IACtD,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAClF,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAI,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAWD,gFAAgF;AAChF,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAChE,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAC1D,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACtD,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAChE,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;QAC5D,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAC1D,2BAA2B,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACpE,kCAAkC,EAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC;QAClF,uCAAuC,EAAE,OAAO,CAAC,GAAG,CAAC,uCAAuC;KAC7F,CAAA;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,UAAU,CAAC,MAA0C,SAAS,EAAE;IAC9E,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,cAAc,EAAE,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACtI,CAAC;IACD,6CAA6C;IAC7C,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,GAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,GAAG,GAAG,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;IACzI,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;IACnI,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,IAA6D;IAC3F,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CACN,eAAe,IAAI,CAAC,EAAE,oFAAoF;YACxG,gHAAgH,CACnH,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAUD,wDAAwD;AACxD,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,SAAiB;IACrE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAgB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC,CAAA;IACjF,MAAM,CAAC,GAAG,GAAG,EAAE,QAAQ,CAAA;IACvB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtH,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/lib/decideRules.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The local SOPs' `decide:` rules as `intutic decide` sees them: each line
+ * with its file and line number, parsed as the snapshot writer parses it
+ * (`localDecideRules`), and the snapshot rewritten after a pin or the
+ * disable marker changes.
+ *
+ * @module
+ */
+import { type DecideDecl } from '@intutic/shared-types';
+export interface LocalDecideLine {
+    sopId: string;
+    /** `.intutic/sops/<file>` or `.intutic/sops/<folder>/<file>`. */
+    file: string;
+    /** 1-based line number in the file. */
+    line: number;
+    sopTitle: string;
+    ruleText: string;
+    decl: DecideDecl;
+    /** `<sopId>#<id>` for a readable rule. */
+    ref: string | null;
+    ruleHash: string | null;
+}
+/** The workspace the decide commands read: the recorded one, else the current directory. */
+export declare function decideWorkspaceRoot(override?: string): string;
+/** Every local SOP's `decide:` lines, in snapshot order, each parsed with its SOP's other lines. */
+export declare function loadLocalDecideLines(root: string): Promise<LocalDecideLine[]>;
+/**
+ * The rule `spec` names: its ref (`local:data.md#prod-data-export`), its id
+ * when only one local rule has it, or `<file>#<id>` / `<file>` for a SOP
+ * file with one rule. Throws a message for the user otherwise.
+ */
+export declare function findDecideRule(lines: readonly LocalDecideLine[], spec: string): LocalDecideLine & {
+    decl: Extract<DecideDecl, {
+        kind: 'rule';
+    }>;
+};
+/**
+ * Writes the policy snapshot again so a changed pin or the disable marker
+ * applies now: the local snapshot (`intutic gates install`'s) is rewritten
+ * here; a connected machine's sync daemon rewrites its own on its next poll.
+ */
+export declare function rewriteDecideSnapshot(): Promise<'local' | 'connected' | 'none'>;
+//# sourceMappingURL=decideRules.d.ts.map

package/dist/lib/decideRules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decideRules.d.ts","sourceRoot":"","sources":["../../src/lib/decideRules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAKL,KAAK,UAAU,EAEhB,MAAM,uBAAuB,CAAA;AAO9B,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,UAAU,CAAA;IAChB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,4FAA4F;AAC5F,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAG7D;AAMD,oGAAoG;AACpG,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CA4BnF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAgBjJ;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC,CAcrF"}

package/dist/lib/decideRules.js

@@ -0,0 +1,104 @@
+/**
+ * The local SOPs' `decide:` rules as `intutic decide` sees them: each line
+ * with its file and line number, parsed as the snapshot writer parses it
+ * (`localDecideRules`), and the snapshot rewritten after a pin or the
+ * disable marker changes.
+ *
+ * @module
+ */
+import * as node_path from 'node:path';
+import { decideRuleHash, decideRuleRef, parseDecideLines, splitFrontMatter, } from '@intutic/shared-types';
+import { homedir } from 'node:os';
+import { loadLocalSopEntries, localDecideRules, localHoldTokensFor, writeLocalPolicySnapshot } from '@intutic/sync-daemon';
+import { loadConfig, loadCredentials } from '../config/store.js';
+import { decideDir, sha256Hex } from './decideLocal.js';
+import { gatesSource } from './localGates.js';
+/** The workspace the decide commands read: the recorded one, else the current directory. */
+export function decideWorkspaceRoot(override) {
+    if (override)
+        return node_path.resolve(override);
+    return loadConfig()?.workspaceRoot ?? process.cwd();
+}
+function sopFile(sopId) {
+    return `.intutic/sops/${sopId.replace(/^local:/, '').replace(':', '/')}`;
+}
+/** Every local SOP's `decide:` lines, in snapshot order, each parsed with its SOP's other lines. */
+export async function loadLocalDecideLines(root) {
+    const entries = await loadLocalSopEntries(root, [], { ignoreSelection: true });
+    const served = await localDecideRules(entries, { decideDir: decideDir() });
+    const out = [];
+    for (const entry of entries) {
+        const { front } = splitFrontMatter(entry.content);
+        const numbered = front
+            .split('\n')
+            .map((l, k) => ({ text: l.trim(), line: k + 1 }))
+            .filter((l) => l.text.startsWith('decide:'));
+        if (numbered.length === 0)
+            continue;
+        const mine = served.filter((s) => s.sopId === entry.sopId);
+        const decls = parseDecideLines(numbered.map((l) => l.text.slice('decide:'.length)));
+        decls.forEach((decl, i) => {
+            const s = mine[i];
+            out.push({
+                sopId: entry.sopId,
+                file: sopFile(entry.sopId),
+                line: numbered[i].line,
+                sopTitle: s?.sopTitle ?? entry.title,
+                ruleText: s?.ruleText ?? '',
+                decl,
+                ref: decl.kind === 'rule' ? decideRuleRef(entry.sopId, decl.rule.id) : null,
+                ruleHash: decl.kind === 'rule' ? decideRuleHash(decl.rule, sha256Hex) : null,
+            });
+        });
+    }
+    return out;
+}
+/**
+ * The rule `spec` names: its ref (`local:data.md#prod-data-export`), its id
+ * when only one local rule has it, or `<file>#<id>` / `<file>` for a SOP
+ * file with one rule. Throws a message for the user otherwise.
+ */
+export function findDecideRule(lines, spec) {
+    const readable = lines.filter((l) => l.decl.kind === 'rule');
+    let hits = readable.filter((l) => l.ref === spec);
+    if (hits.length === 0)
+        hits = readable.filter((l) => l.decl.rule.id === spec);
+    if (hits.length === 0) {
+        const [file, id] = spec.split('#');
+        const base = node_path.basename(file);
+        hits = readable.filter((l) => (l.file === file || l.file.endsWith(`/${file}`) || node_path.basename(l.file) === base) && (id === undefined || l.decl.rule.id === id));
+    }
+    if (hits.length === 1)
+        return hits[0];
+    if (hits.length === 0) {
+        const broken = lines.find((l) => l.decl.kind === 'unreadable' && (l.decl.id === spec || spec.endsWith(`#${l.decl.id}`)));
+        if (broken && broken.decl.kind === 'unreadable')
+            throw new Error(`${broken.file}:${broken.line}: ${broken.decl.error}`);
+        throw new Error(`No local decide rule named ${spec}. \`intutic decide lint\` lists them.`);
+    }
+    throw new Error(`${spec} names ${hits.length} rules: use one of ${hits.map((h) => h.ref).join(', ')}`);
+}
+/**
+ * Writes the policy snapshot again so a changed pin or the disable marker
+ * applies now: the local snapshot (`intutic gates install`'s) is rewritten
+ * here; a connected machine's sync daemon rewrites its own on its next poll.
+ */
+export async function rewriteDecideSnapshot() {
+    if ((await loadCredentials()) !== null)
+        return 'connected';
+    if ((await gatesSource()) !== 'local')
+        return 'none';
+    const config = loadConfig();
+    if (!config)
+        return 'none';
+    const disconnected = new Set(config.disconnectedHarnesses ?? []);
+    const harnesses = config.harnesses.filter((h) => !disconnected.has(h));
+    const root = config.workspaceRoot;
+    const holdTokens = await localHoldTokensFor(root, [], undefined, harnesses);
+    const localSops = await loadLocalSopEntries(root, harnesses, { ignoreSelection: true });
+    const decideRules = await localDecideRules(localSops, { decideDir: decideDir() });
+    // The rule records and lane holds the snapshot carries beside the decide rules.
+    await writeLocalPolicySnapshot({ localHoldTokens: holdTokens, snapshotDir: node_path.join(homedir(), '.intutic', 'hooks'), decideRules, localSops });
+    return 'local';
+}
+//# sourceMappingURL=decideRules.js.map

package/dist/lib/decideRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decideRules.js","sourceRoot":"","sources":["../../src/lib/decideRules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EACL,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,gBAAgB,GAGjB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC1H,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAgB7C,4FAA4F;AAC5F,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChD,OAAO,UAAU,EAAE,EAAE,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;AACrD,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,iBAAiB,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;IAC1E,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,KAAK;aACnB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;QAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACnF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YACxB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,GAAG,CAAC,IAAI,CAAC;gBACP,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC1B,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI;gBACvB,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,KAAK,CAAC,KAAK;gBACpC,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,EAAE;gBAC3B,IAAI;gBACJ,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC3E,QAAQ,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;aAC7E,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiC,EAAE,IAAY;IAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAA0E,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;IACpI,IAAI,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAA;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,CAAA;IAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAK,CAAC,CAAA;QACtC,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACvK,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,CAAE,CAAA;IACtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;QACxH,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;QACvH,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,uCAAuC,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,UAAU,IAAI,CAAC,MAAM,sBAAsB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACxG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,KAAK,IAAI;QAAE,OAAO,WAAW,CAAA;IAC1D,IAAI,CAAC,MAAM,WAAW,EAAE,CAAC,KAAK,OAAO;QAAE,OAAO,MAAM,CAAA;IACpD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAA;IAC1B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAA;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAkB,CAAA;IACvF,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAA;IACjC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAA;IACvF,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;IACjF,gFAAgF;IAChF,MAAM,wBAAwB,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAA;IACpJ,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/lib/localGates.d.ts

@@ -3,13 +3,13 @@
  * `intutic gates install` writes, and `intutic start` refreshes.
  *
  * The same writers `intutic connect` runs, fed from this machine only: the
- * local `.intutic/sops` for the rules files and the `review_before:` tokens,
- * and a policy snapshot compiled from no workspace policy
- * (`writeLocalPolicySnapshot`), which still carries the destructive-command
- * and skill tiers. Nothing here fetches, drains or reports; no MCP server is
- * wrapped and no file is made immutable. The harnesses' LLM traffic is
- * pointed at the local proxy only with `routing`, since a harness routed at a
- * proxy that is not running stops working.
+ * local `.intutic/sops` for the rules files, the `review_before:` tokens and
+ * the `decide:` rules, and a policy snapshot compiled from no workspace
+ * policy (`writeLocalPolicySnapshot`), which still carries the
+ * destructive-command and skill tiers. Nothing here fetches, drains or
+ * reports; no MCP server is wrapped and no file is made immutable. The
+ * harnesses' LLM traffic is pointed at the local proxy only with `routing`,
+ * since a harness routed at a proxy that is not running stops working.
  *
  * @module
  */

package/dist/lib/localGates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"localGates.d.ts","sourceRoot":"","sources":["../../src/lib/localGates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAmBrD,gGAAgG;AAChG,eAAO,MAAM,wBAAwB,QAAmB,CAAA;AAExD,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAA;IAChB,yCAAyC;IACzC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,yBAAyB;IACzB,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC9B;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,QAAQ,CAAA;IACd,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,EAAE,SAAS,EAAE,CAAA;IAClB,wEAAwE;IACxE,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/C,0DAA0D;IAC1D,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAMD;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,CAYzE;AAED,qEAAqE;AACrE,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE5D;AAyBD;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+D1F"}
+{"version":3,"file":"localGates.d.ts","sourceRoot":"","sources":["../../src/lib/localGates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAgB,MAAM,uBAAuB,CAAA;AAqBnE,gGAAgG;AAChG,eAAO,MAAM,wBAAwB,QAAmB,CAAA;AAExD,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAA;IAChB,yCAAyC;IACzC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,yBAAyB;IACzB,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC9B;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,QAAQ,CAAA;IACd,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,EAAE,SAAS,EAAE,CAAA;IAClB,wEAAwE;IACxE,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/C,0DAA0D;IAC1D,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAMD;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,CAYzE;AAED,qEAAqE;AACrE,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE5D;AAqFD;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgF1F"}

package/dist/lib/localGates.js

@@ -3,25 +3,26 @@
  * `intutic gates install` writes, and `intutic start` refreshes.
  *
  * The same writers `intutic connect` runs, fed from this machine only: the
- * local `.intutic/sops` for the rules files and the `review_before:` tokens,
- * and a policy snapshot compiled from no workspace policy
- * (`writeLocalPolicySnapshot`), which still carries the destructive-command
- * and skill tiers. Nothing here fetches, drains or reports; no MCP server is
- * wrapped and no file is made immutable. The harnesses' LLM traffic is
- * pointed at the local proxy only with `routing`, since a harness routed at a
- * proxy that is not running stops working.
+ * local `.intutic/sops` for the rules files, the `review_before:` tokens and
+ * the `decide:` rules, and a policy snapshot compiled from no workspace
+ * policy (`writeLocalPolicySnapshot`), which still carries the
+ * destructive-command and skill tiers. Nothing here fetches, drains or
+ * reports; no MCP server is wrapped and no file is made immutable. The
+ * harnesses' LLM traffic is pointed at the local proxy only with `routing`,
+ * since a harness routed at a proxy that is not running stops working.
  *
  * @module
  */
 import * as node_fs from 'node:fs/promises';
 import * as node_path from 'node:path';
 import { homedir } from 'node:os';
-import { gateKindForHarness, HarnessType } from '@intutic/shared-types';
-import { buildSnapshotRules, findGateFile, loadLocalSopEntries, localHoldTokensFor, localResolvedPolicy, noteProxyUrl, SNAPSHOT_JSON, SNAPSHOT_RULES, updatePreToolUseHooks, writeLocalPolicySnapshot, writeRuntimeEnv, } from '@intutic/sync-daemon';
+import { DECIDE_MAX_RULES_PER_CALL, gateKindForHarness, HarnessType, parseDecideLines, parseFrontMatterEnforcing, splitFrontMatter } from '@intutic/shared-types';
+import { buildSnapshotRules, findGateFile, loadLocalSopEntries, localDecideRules, localHoldTokensFor, localResolvedPolicy, noteProxyUrl, SNAPSHOT_JSON, SNAPSHOT_RULES, updatePreToolUseHooks, writeLocalPolicySnapshot, writeRuntimeEnv, } from '@intutic/sync-daemon';
 import { getAdapter } from '../harness/detector.js';
 import { writeHarnessConfigs } from '../harness/writeHarnessConfigs.js';
 import { loadCredentials } from '../config/store.js';
 import { localProxyPort } from './localProxy.js';
+import { decideRuleNotes } from './decideLocal.js';
 /** The hook events log is rotated past this size; nothing drains it without a control plane. */
 export const HOOK_EVENTS_ROTATE_BYTES = 10 * 1024 * 1024;
 function snapshotDir() {
@@ -75,6 +76,70 @@ async function rotateHookEvents(workspaceRoot, dryRun) {
         await node_fs.rename(log, `${log}.1`);
     return `${log}.1`;
 }
+/**
+ * One warning per `decide:` line that does not read, naming its SOP file and
+ * line number. The snapshot refuses the tools such a line names until it is
+ * fixed. A bare or non-JSON line gets the one-rule-per-line hint.
+ */
+function unreadableDecideLines(entries) {
+    const out = [];
+    for (const entry of entries) {
+        const numbered = splitFrontMatter(entry.content)
+            .front.split('\n')
+            .map((l, k) => ({ text: l.trim(), line: k + 1 }))
+            .filter((l) => l.text.startsWith('decide:'));
+        if (numbered.length === 0)
+            continue;
+        const file = `.intutic/sops/${entry.sopId.replace(/^local:/, '').replace(':', '/')}`;
+        parseDecideLines(numbered.map((l) => l.text.slice('decide:'.length))).forEach((d, i) => {
+            if (d.kind === 'unreadable')
+                out.push(`${file}:${numbered[i].line}: decide line ${i + 1} does not read, so its tools are refused: ${d.error}`);
+        });
+    }
+    return out;
+}
+/**
+ * One warning per readable `decide:` rule 3.0 does not carry out as written
+ * (`decideRuleNotes`: a reserved `context`), naming its SOP file and line
+ * number.
+ */
+function notedDecideRules(entries) {
+    const out = [];
+    for (const entry of entries) {
+        const numbered = splitFrontMatter(entry.content)
+            .front.split('\n')
+            .map((l, k) => ({ text: l.trim(), line: k + 1 }))
+            .filter((l) => l.text.startsWith('decide:'));
+        if (numbered.length === 0)
+            continue;
+        const file = `.intutic/sops/${entry.sopId.replace(/^local:/, '').replace(':', '/')}`;
+        parseDecideLines(numbered.map((l) => l.text.slice('decide:'.length))).forEach((d, i) => {
+            if (d.kind === 'rule')
+                for (const note of decideRuleNotes(d.rule))
+                    out.push(`${file}:${numbered[i].line}: ${note}`);
+        });
+    }
+    return out;
+}
+/** Tools more than {@link DECIDE_MAX_RULES_PER_CALL} local decide rules name: a call evaluates only that many. */
+function crowdedDecideTools(entries) {
+    const byTool = new Map();
+    for (const entry of entries) {
+        const values = splitFrontMatter(entry.content)
+            .front.split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l.startsWith('decide:'))
+            .map((l) => l.slice('decide:'.length));
+        for (const d of parseDecideLines(values)) {
+            if (d.kind === 'rule' && d.rule.on === 'tool_call')
+                for (const t of new Set(d.rule.tools ?? []))
+                    byTool.set(t, (byTool.get(t) ?? 0) + 1);
+        }
+    }
+    return [...byTool]
+        .filter(([, n]) => n > DECIDE_MAX_RULES_PER_CALL)
+        .map(([tool, n]) => `${n} decide rules name ${tool}; a call evaluates at most ${DECIDE_MAX_RULES_PER_CALL}, and an enforcing rule past that refuses the call`);
+}
 /**
  * Writes (or with `dryRun`, reports) the local gates. See the module note for
  * what it does not do.
@@ -93,12 +158,30 @@ export async function installLocalGates(opts) {
         onError: (err) => warn(`Could not read every local SOP in .intutic/sops; the rules files are written without the ones that failed: ${err instanceof Error ? err.message : String(err)}`),
     });
     const holdTokens = await localHoldTokensFor(root, [], undefined, harnesses);
+    // Every local SOP's decide: rules, whatever the session selected, as for
+    // the holds: the selection narrows the rules files, never what is enforced.
+    const allSops = await loadLocalSopEntries(root, harnesses, { ignoreSelection: true });
+    const decideRules = await localDecideRules(allSops, { decideDir: node_path.join(homedir(), '.intutic', 'decide') });
+    for (const line of [...unreadableDecideLines(allSops), ...notedDecideRules(allSops), ...crowdedDecideTools(allSops)])
+        warn(line);
+    // Every local SOP's rule records and lane holds: qualified
+    // requires_before, scope_paths_mode: enforce, plan_approval:, closed_lanes:.
+    // With no control plane, plan_approval: refuses every call that is not a
+    // read (no plan can be approved), and a lane hold refuses rather than holds.
+    for (const entry of allSops) {
+        // An enforcing plan_approval record compiles from a SOP with no roles:,
+        // not in mode: shadow (compileSopGateRecords, @intutic/shared-types).
+        const fm = parseFrontMatterEnforcing(splitFrontMatter(entry.content).front);
+        if (fm.planApproval !== null && fm.roles.length === 0 && fm.mode !== 'shadow') {
+            warn(`${entry.sopId} sets plan_approval:, and with no control plane no plan can be approved: every gated call that is not a read is refused (PLAN_NOT_APPROVED). Remove it, or connect a workspace.`);
+        }
+    }
     let snapshot;
     if (dryRun) {
-        snapshot = { digest: '', ruleCount: buildSnapshotRules(localResolvedPolicy(), holdTokens, 'block').length };
+        snapshot = { digest: '', ruleCount: buildSnapshotRules({ ...localResolvedPolicy(), decideRules }, holdTokens, 'block', allSops).length };
     }
     else {
-        snapshot = await writeLocalPolicySnapshot({ localHoldTokens: holdTokens, snapshotDir: snapshotDir() });
+        snapshot = await writeLocalPolicySnapshot({ localHoldTokens: holdTokens, snapshotDir: snapshotDir(), decideRules, localSops: allSops });
     }
     files.push(node_path.join(snapshotDir(), SNAPSHOT_RULES), node_path.join(snapshotDir(), SNAPSHOT_JSON));
     if (dryRun) {

package/dist/lib/localGates.js.map

@@ -1 +1 @@
-{"version":3,"file":"localGates.js","sourceRoot":"","sources":["../../src/lib/localGates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEvE,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,GAChB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,gGAAgG;AAChG,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAiCxD,SAAS,WAAW;IAClB,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,OAAO,CAAC,MAAM,WAAW,EAAE,CAAC,KAAK,OAAO,CAAA;AAC1C,CAAC;AAED,iHAAiH;AACjH,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AACjF,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,MAAe;IACpE,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACpF,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,wBAAwB;YAAE,OAAO,IAAI,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAA;IAClD,OAAO,GAAG,GAAG,IAAI,CAAA;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAuB;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAA;IAC/B,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,oBAAoB,cAAc,EAAE,EAAE,CAAA;IACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IACtB,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,SAA0B,EAAE;QACvE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,IAAI,CAAC,8GAA8G,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;KACzK,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,SAA0B,CAAC,CAAA;IAE5F,IAAI,QAA+C,CAAA;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,QAAQ,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAA;IAC7G,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,MAAM,wBAAwB,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;IACxG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC,CAAA;IAEvG,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,cAAc,CAAA;YAC1C,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAgB,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAC1H,CAAC;IACH,CAAC;SAAM,CAAC;QACN,gEAAgE;QAChE,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;YAChE,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;SACxC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,MAAM,qBAAqB,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QAC7D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAA;QAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAA;IACvI,CAAC;IAED,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IACzE,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,MAAM;YAAE,MAAM,eAAe,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;QAC7G,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACpD,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAEhC,MAAM,KAAK,GAAgB,EAAE,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAsB,CAAC,CAAA;QACvD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACvG,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;AAC9E,CAAC"}
+{"version":3,"file":"localGates.js","sourceRoot":"","sources":["../../src/lib/localGates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAEjK,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,GAChB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAElD,gGAAgG;AAChG,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAiCxD,SAAS,WAAW;IAClB,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,OAAO,CAAC,MAAM,WAAW,EAAE,CAAC,KAAK,OAAO,CAAA;AAC1C,CAAC;AAED,iHAAiH;AACjH,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AACjF,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,MAAe;IACpE,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACpF,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,wBAAwB;YAAE,OAAO,IAAI,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAA;IAClD,OAAO,GAAG,GAAG,IAAI,CAAA;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,OAAgC;IAC7D,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;aAC7C,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;aACjB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;QAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QACnC,MAAM,IAAI,GAAG,iBAAiB,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAA;QACpF,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACrF,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QACjJ,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;aAC7C,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;aACjB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;QAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QACnC,MAAM,IAAI,GAAG,iBAAiB,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAA;QACpF,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACrF,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;gBAAE,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC,CAAA;QACtH,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,kHAAkH;AAClH,SAAS,kBAAkB,CAAC,OAAgC;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;aAC3C,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;aACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QACxC,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,WAAW;gBAAE,KAAK,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1I,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC;SACf,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,yBAAyB,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,sBAAsB,IAAI,8BAA8B,yBAAyB,oDAAoD,CAAC,CAAA;AAClK,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAuB;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAA;IAC/B,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,oBAAoB,cAAc,EAAE,EAAE,CAAA;IACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IACtB,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,SAA0B,EAAE;QACvE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,IAAI,CAAC,8GAA8G,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;KACzK,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,SAA0B,CAAC,CAAA;IAC5F,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,SAA0B,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAA;IACtG,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAA;IACnH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAEhI,2DAA2D;IAC3D,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,EAAE,GAAG,yBAAyB,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAA;QAC3E,IAAI,EAAE,CAAC,YAAY,KAAK,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9E,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,iLAAiL,CAAC,CAAA;QACvM,CAAC;IACH,CAAC;IACD,IAAI,QAA+C,CAAA;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,QAAQ,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,EAAE,GAAG,mBAAmB,EAAE,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAA;IAC1I,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,MAAM,wBAAwB,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;IACzI,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC,CAAA;IAEvG,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,cAAc,CAAA;YAC1C,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAgB,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAC1H,CAAC;IACH,CAAC;SAAM,CAAC;QACN,gEAAgE;QAChE,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;YAChE,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;SACxC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,MAAM,qBAAqB,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QAC7D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAA;QAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAA;IACvI,CAAC;IAED,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IACzE,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,MAAM;YAAE,MAAM,eAAe,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;QAC7G,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACpD,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAEhC,MAAM,KAAK,GAAgB,EAAE,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAsB,CAAC,CAAA;QACvD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACvG,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;AAC9E,CAAC"}

package/dist/lib/policySnapshot.d.ts

@@ -56,6 +56,25 @@ export interface PolicySnapshotHealth {
     ruleCount: number;
     /** Rules dropped because their regex would not compile. */
     droppedRules: number;
+    /** The format its `@format` record names; 1 without one. */
+    formatVersion: number;
+    /**
+     * Decide rules whose `@decide` records decode, as the gates read them. Each
+     * one's fallback line is left out of {@link ruleCount} only when the gates
+     * evaluate decide rules ({@link CAN_EVALUATE_DECIDE}). 0 on `invalid`.
+     */
+    decideRules: number;
+    /**
+     * Rule records (`@rule`) that decode, as the gates read them. The
+     * fallback line each enforcing one names is left out of {@link ruleCount}:
+     * every v23 hook gate evaluates the record instead. 0 on `invalid`.
+     */
+    gateRules: number;
+    /**
+     * Whether a `plan_approval:` record is in force: every call waits for an
+     * approved plan, which only a control plane can hold.
+     */
+    planApproval: boolean;
     /** Where the snapshot was looked for. */
     path: string;
 }
@@ -68,6 +87,14 @@ export interface PolicySnapshotHealth {
  * doctor inspect a directory nothing writes to and report every snapshot absent.
  */
 export declare function resolveSnapshotRulesPath(): string;
+/**
+ * Whether the gates this reports on, and this CLI, evaluate the decide rules
+ * a snapshot carries. They do: every gate family evaluates them (the shell
+ * and n8n gates through `intutic decide check`), so a fallback line a decoded
+ * record names is skipped by the gates and not counted as a rule here. A
+ * fallback line no decoded record names still refuses, and is counted.
+ */
+export declare const CAN_EVALUATE_DECIDE = true;
 /**
  * Classify snapshot text exactly as `intuticLoadSnapshot` does.
  *

package/dist/lib/policySnapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policySnapshot.d.ts","sourceRoot":"","sources":["../../src/lib/policySnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAOH;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;AAE3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,aAAa,CAAA;IACpB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAIjD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACrE,oBAAoB,CAwFtB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GACtD,oBAAoB,CAkBtB"}
+{"version":3,"file":"policySnapshot.d.ts","sourceRoot":"","sources":["../../src/lib/policySnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAkBH;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;AAE3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,aAAa,CAAA;IACpB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAA;IACpB,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAIjD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAA;AAQvC;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACrE,oBAAoB,CAgItB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GACtD,oBAAoB,CAsBtB"}