@intutic/gate 2.9.0 → 3.0.0

package/dist/decideEvaluate.js

@@ -0,0 +1,504 @@
+/**
+ * Evaluating one tool call's decide rules against the engine, inside the
+ * engine protections:
+ *
+ * 1. Decisions only add friction: nothing is asked unless the deterministic
+ *    tiers allowed the call, and a decide outcome can refuse or escalate,
+ *    never lower another rule's verdict. Shadow rules never change the call.
+ * 2. The state is built from the call's own fields and the rule's text only
+ *    (`buildDecideToolCallState`); a context field goes in quoted and marked
+ *    untrusted.
+ * 3. Choice questions are asked in every order and averaged; orders that
+ *    disagree make the answer unknown (`decide.ts`).
+ * 4. A rule enforces only under a pin for the model digest the engine
+ *    reports on this call; any other digest runs it as shadow.
+ * 5. Pins belong to a rule hash: pins earned by another wording are not this
+ *    rule's.
+ * 6. A known-answer canary, cached per engine URL and model digest for
+ *    {@link DECIDE_CANARY_TTL_MS}, runs beside the rule's questions when the
+ *    cache is missing, failed or stale. A failed canary discards every
+ *    answer: the engine is unavailable, which refuses an enforcing rule.
+ *
+ * And the latency budget: with the engine's per-call p95 (`q95Ms`, which
+ * `intutic doctor` measures and stores in engine.json), a rule whose
+ * estimate does not fit the time left is not asked. An enforcing one
+ * escalates, as an unknown answer does; a shadow one is logged and allowed.
+ *
+ * Self-contained but for the decide modules beside it, so `@intutic/gate`
+ * carries a byte-identical copy. The canary cache's file is reached through
+ * the `fs` its caller passes ({@link createDecideCanaryFileStore}). The Python
+ * (`intutic_clawde/gate/decide_evaluate.py`) and Rust
+ * (`proxy/src/decide/evaluate.rs`) ports run the same `rollout` and
+ * `evaluate` cases of `fixtures/decide-engine-vectors.json`.
+ *
+ * @module
+ */
+import { DECIDE_DEFAULT_BAND, DECIDE_JS_SOURCE, decideAtoms, decideCallOutcome, decideOptions, decideRuleHash, decideRuleOutcome, selectDecideRules, validateDecideRule, } from './decide.js';
+import { DECIDE_RECORD_JS_SOURCE } from './decideRecord.js';
+import { buildDecideToolCallState, DECIDE_ENGINE_JS_SOURCE, DecideEngineError, decideEngineErrorOutcome, decideModuleSource, runDecideCanary, } from './decideEngine.js';
+import { DECIDE_HOST_GUARD_JS_SOURCE } from './decideHostGuard.js';
+import { DECIDE_LOG_JS_SOURCE } from './decideLog.js';
+/**
+ * Whether a rule enforces on this call. Only when its author wrote `enforce`,
+ * the snapshot stamped it `enforce`, and one of its pins is for `modelDigest`;
+ * otherwise it runs as shadow and `why` says which condition failed. A null
+ * digest (the engine could not say) leaves a stamped rule enforcing, so the
+ * engine's unavailability refuses rather than opening the call.
+ */
+export function decideEffectiveRollout(entry, modelDigest) {
+    if (entry.ir.rollout !== 'enforce')
+        return { effective: 'shadow', why: 'rollout', pin: null };
+    if (entry.rollout !== 'enforce')
+        return { effective: 'shadow', why: entry.stampedBy === 'rule' ? 'rollout' : entry.stampedBy, pin: null };
+    if (entry.pins.length === 0)
+        return { effective: 'shadow', why: 'no-pins', pin: null };
+    if (modelDigest === null)
+        return { effective: 'enforce', why: null, pin: null };
+    const pin = entry.pins.find((p) => p.modelDigest === modelDigest);
+    return pin ? { effective: 'enforce', why: null, pin } : { effective: 'shadow', why: 'not_evaluated', pin: null };
+}
+// ---------------------------------------------------------------------------
+// The canary cache (protection 6)
+// ---------------------------------------------------------------------------
+/** A canary result older than this is run again. */
+export const DECIDE_CANARY_TTL_MS = 600_000;
+/** The cache's file name in `~/.intutic/decide/`. */
+export const DECIDE_CANARY_FILE = 'canary.json';
+/** The most engine and digest pairs the file keeps, newest last. */
+const CANARY_ENTRIES_MAX = 16;
+/** A passed result younger than {@link DECIDE_CANARY_TTL_MS}. A failed one is never fresh: it runs again. */
+export function decideCanaryFresh(entry, nowMs) {
+    return entry !== null && entry.ok && entry.atMs <= nowMs && nowMs - entry.atMs < DECIDE_CANARY_TTL_MS;
+}
+function canaryEntry(v) {
+    if (typeof v !== 'object' || v === null)
+        return null;
+    const e = v;
+    const num = (x) => typeof x === 'number' && Number.isFinite(x);
+    if (typeof e.url !== 'string' || typeof e.modelDigest !== 'string' || typeof e.ok !== 'boolean')
+        return null;
+    if (!num(e.atMs) || !num(e.pViolation) || !num(e.pClean) || typeof e.choiceTop !== 'string')
+        return null;
+    return { url: e.url, modelDigest: e.modelDigest, ok: e.ok, atMs: e.atMs, pViolation: e.pViolation, pClean: e.pClean, choiceTop: e.choiceTop };
+}
+/**
+ * The canary cache as one JSON file, `{"v":1,"entries":[…]}`, mode 0600 in a
+ * 0700 directory, replaced whole by a rename so a reader never sees half of
+ * it. A file that does not read is an empty cache, and the canary runs.
+ */
+export function createDecideCanaryFileStore(file, fs) {
+    const readAll = () => {
+        try {
+            const doc = JSON.parse(fs.readFileSync(file, 'utf8'));
+            if (doc.v !== 1 || !Array.isArray(doc.entries))
+                return [];
+            return doc.entries.map(canaryEntry).filter((e) => e !== null);
+        }
+        catch {
+            return [];
+        }
+    };
+    return {
+        read(url, modelDigest) {
+            return readAll().find((e) => e.url === url && e.modelDigest === modelDigest) ?? null;
+        },
+        write(entry) {
+            const entries = [...readAll().filter((e) => e.url !== entry.url || e.modelDigest !== entry.modelDigest), entry].slice(-CANARY_ENTRIES_MAX);
+            const dir = file.replace(/[\\/][^\\/]*$/, '');
+            if (dir && dir !== file)
+                fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+            const tmp = `${file}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+            fs.writeFileSync(tmp, JSON.stringify({ v: 1, entries }) + '\n', { mode: 0o600 });
+            fs.renameSync(tmp, file);
+        },
+    };
+}
+const ALLOW = { outcome: 'allow', code: null, ruleRef: null, via: null, reason: null };
+function errorCode(err) {
+    return err instanceof DecideEngineError ? err.code : 'bad_response';
+}
+/**
+ * A call's verdict in the order of evidence: deterministic
+ * refusals, then consequence (holds), then trajectory, then model judgement
+ * last. `before` is the verdict of everything before decide; `decide` is
+ * what the decide rules answered, or null when none was asked. A hold or a
+ * refusal before decide stands whatever decide says; inside an open lane a
+ * decide refusal or escalation still applies.
+ */
+export function decideVerdictInOrder(before, decide) {
+    if (before !== 'allow')
+        return before;
+    return decide === null ? 'allow' : decide.outcome;
+}
+// ---------------------------------------------------------------------------
+// The latency budget
+// ---------------------------------------------------------------------------
+/** The engine calls one evaluation of `rule` makes: a yes/no question one, a choice two, or three past three options (none_of_these counted). */
+export function decideRuleCalls(rule) {
+    let n = 0;
+    for (const q of Object.values(rule.questions))
+        n += q.type === 'yes_no' ? 1 : decideOptions(q).length > 3 ? 3 : 2;
+    return n;
+}
+/** The estimated time to evaluate `rule`: the per-call p95 times its calls over `parallel`. */
+export function decideRuleEstimateMs(rule, q95Ms, parallel) {
+    return Math.round(q95Ms * Math.ceil(decideRuleCalls(rule) / Math.max(1, parallel)));
+}
+/** The per-call p95 `intutic doctor` stored in engine.json (`q95Ms`, parsed), or null when there is none. */
+export function decideStoredQ95Ms(file) {
+    const v = file !== null && typeof file === 'object' && !Array.isArray(file) ? file.q95Ms : undefined;
+    return typeof v === 'number' && Number.isFinite(v) && v > 0 ? v : null;
+}
+/**
+ * Evaluates the decide rules a tool call matches. Never throws: an engine
+ * error is an unavailable rule (or, for `too_large`, an unknown one), which
+ * refuses with GOVERNANCE_UNAVAILABLE when the rule enforces.
+ *
+ * With the engine's p95 (`deps.q95Ms`), a rule whose estimate does not fit
+ * the time left before `deadlineMs` is not asked: its report carries
+ * `budget_skip`, and it is unknown. An enforcing one escalates (or refuses,
+ * with `escalate: refuse`); a shadow one is allowed. The rest are asked.
+ */
+export async function evaluateDecideCall(input, deps) {
+    const q95 = deps.q95Ms ?? null;
+    if (q95 === null || input.deterministic !== 'allow')
+        return evaluateDecideRules(input, deps);
+    const leftMs = input.deadlineMs - (deps.now ?? Date.now)();
+    const inBudget = [];
+    const overBudget = [];
+    for (const r of input.rules) {
+        const v = validateDecideRule(r.ir);
+        const named = r.ir.on === 'tool_call' && (r.ir.tools ?? []).includes(input.tool);
+        if (named && v.ok && decideRuleEstimateMs(v.rule, q95, deps.parallel ?? 1) > leftMs)
+            overBudget.push(r);
+        else
+            inBudget.push(r);
+    }
+    const ev = await evaluateDecideRules({ ...input, rules: inBudget }, deps);
+    if (overBudget.length === 0)
+        return ev;
+    const digest = ev.engine?.modelDigest ?? null;
+    const skipped = overBudget.map((r) => {
+        const v = validateDecideRule(r.ir);
+        const pins = v.ok && decideRuleHash(v.rule, deps.sha256Hex) === r.ruleHash ? r.pins : [];
+        const eff = decideEffectiveRollout({ ...r, pins }, digest);
+        const escalate = v.ok ? v.rule.escalate ?? 'ask' : 'ask';
+        const report = { ref: r.ref, ruleHash: r.ruleHash, effective: eff.effective, why: eff.why, error: 'budget_skip', modelDigest: digest, answers: null };
+        if (eff.effective === 'shadow')
+            return { ...report, outcome: 'allow', code: null, via: null };
+        if (escalate === 'refuse')
+            return { ...report, outcome: 'refuse', code: 'DECIDE_ESCALATED', via: null };
+        return { ...report, outcome: 'escalate', code: 'DECIDE_ESCALATED', via: escalate };
+    });
+    const rules = [...ev.rules, ...skipped];
+    // A refusal for too many rules on the tool comes before any rule is asked, and stands.
+    const call = ev.rules.length === 0 && ev.call.outcome !== 'allow' ? ev.call : decideCallOutcome({ unavailable: null }, rules);
+    return { ...ev, call, rules };
+}
+/** {@link evaluateDecideCall} on every rule it is given, with no budget estimate. */
+async function evaluateDecideRules(input, deps) {
+    const now = deps.now ?? Date.now;
+    if (input.deterministic !== 'allow') {
+        const reason = input.deterministic === 'hold' ? 'the call is held for a person; a decide answer never releases a hold' : 'a deterministic rule refused the call';
+        return {
+            call: { outcome: 'refuse', code: null, ruleRef: null, via: null, reason },
+            rules: [],
+            skipped: [],
+            engine: null,
+            canary: null,
+        };
+    }
+    const matched = input.rules.filter((r) => r.ir.on === 'tool_call' && (r.ir.tools ?? []).includes(input.tool));
+    if (matched.length === 0)
+        return { call: ALLOW, rules: [], skipped: [], engine: null, canary: null };
+    const engine = deps.engine instanceof DecideEngineError ? null : deps.engine;
+    let engineError = deps.engine instanceof DecideEngineError ? deps.engine.code : null;
+    let identity = null;
+    if (engine) {
+        try {
+            identity = await engine.describe(input.deadlineMs);
+        }
+        catch (err) {
+            engineError = errorCode(err);
+        }
+    }
+    const entries = matched.map((r) => {
+        const v = validateDecideRule(r.ir);
+        // Pins are earned by one rule hash: a rule whose hash is not the one its
+        // pins were stored under has none.
+        const pins = v.ok && decideRuleHash(v.rule, deps.sha256Hex) === r.ruleHash ? r.pins : [];
+        const entry = { ...r, pins };
+        return { entry, v, pre: decideEffectiveRollout(entry, identity?.modelDigest ?? null) };
+    });
+    const selection = selectDecideRules(entries.map((e) => ({ ref: e.entry.ref, on: e.entry.ir.on, tools: e.entry.ir.tools, effective: e.pre.effective, e })), input.tool);
+    const skipped = selection.skipped.map((c) => c.ref);
+    if (selection.unavailable) {
+        return { call: decideCallOutcome(selection, []), rules: [], skipped, engine: identity, canary: null };
+    }
+    const askRule = async (e) => {
+        if (!engine || engineError)
+            return { answers: null, error: engineError ?? 'not_configured', modelDigest: null };
+        if (!e.v.ok)
+            return { answers: null, error: 'bad_response', modelDigest: null };
+        const rule = e.v.rule;
+        const questions = Object.keys(rule.questions).map((name) => {
+            const q = rule.questions[name];
+            return q.type === 'choice' ? { name, type: 'choice', ask: q.ask, options: decideOptions(q) } : { name, type: 'yes_no', ask: q.ask };
+        });
+        try {
+            const state = buildDecideToolCallState({
+                ruleId: rule.id,
+                sopTitle: e.entry.sopTitle,
+                ruleText: e.entry.ruleText,
+                tool: input.tool,
+                cwd: input.cwd,
+                toolInput: input.toolInput,
+                ...((rule.context ?? []).includes('last_user_turn') ? { lastUserTurn: input.lastUserTurn ?? null } : {}),
+            });
+            const res = await engine.ask(state, questions, input.deadlineMs);
+            return { answers: res.answers, error: null, modelDigest: res.modelDigest };
+        }
+        catch (err) {
+            return { answers: null, error: errorCode(err), modelDigest: null };
+        }
+    };
+    let canary = null;
+    // `canary_failed` only when the canary was answered and the answer was
+    // wrong; an engine that did not answer it at all carries its own error
+    // (`upstream`, `timeout`, …).
+    let canaryRun = Promise.resolve(null);
+    if (engine && !engineError && identity) {
+        const key = identity.modelDigest;
+        if (decideCanaryFresh(deps.canary.read(deps.engineUrl, key), now())) {
+            canary = 'cached';
+        }
+        else {
+            canaryRun = runDecideCanary(engine.ask, input.deadlineMs).then((r) => {
+                try {
+                    deps.canary.write({ url: deps.engineUrl, modelDigest: key, ok: r.ok, atMs: now(), pViolation: r.pViolation, pClean: r.pClean, choiceTop: r.choiceTop });
+                }
+                catch {
+                    // An unwritable cache only means the canary runs again next call.
+                }
+                return r.ok ? null : 'canary_failed';
+            }, (err) => errorCode(err));
+        }
+    }
+    const [canaryError, asked] = await Promise.all([canaryRun, Promise.all(selection.evaluate.map((c) => askRule(c.e)))]);
+    if (canary === null && engine && !engineError && identity)
+        canary = canaryError === null ? 'ok' : canaryError === 'canary_failed' ? 'failed' : null;
+    const reports = selection.evaluate.map((c, i) => {
+        const e = c.e;
+        const a = asked[i];
+        const digest = a.modelDigest ?? identity?.modelDigest ?? null;
+        const eff = decideEffectiveRollout(e.entry, digest);
+        const base = { ref: e.entry.ref, ruleHash: e.entry.ruleHash, effective: eff.effective, why: eff.why, modelDigest: digest };
+        if (canaryError !== null) {
+            // A canary that got no answer: the rule's own engine error when it has
+            // one (it asked the same engine), else the canary's.
+            const error = canaryError !== 'canary_failed' && a.error && decideEngineErrorOutcome(a.error) === 'unavailable' ? a.error : canaryError;
+            return { ...base, outcome: 'unavailable', code: null, via: null, error, answers: null };
+        }
+        if (a.error && decideEngineErrorOutcome(a.error) === 'unavailable') {
+            return { ...base, outcome: 'unavailable', code: null, via: null, error: a.error, answers: null };
+        }
+        if (!e.v.ok)
+            return { ...base, outcome: 'unavailable', code: null, via: null, error: 'bad_response', answers: null };
+        const inputs = {};
+        for (const [name, ans] of Object.entries(a.answers ?? {}))
+            inputs[name] = { p: ans.p, perOrder: ans.perOrder };
+        // A pin's fitted combiner replaces `when`. Its per-question temperatures
+        // are not applied here.
+        const pin = eff.pin;
+        const combiner = pin?.combiner
+            ? { bias: pin.combiner.bias, weights: pin.combiner.weights, band: pin.band ?? e.v.rule.band ?? DECIDE_DEFAULT_BAND }
+            : null;
+        const o = decideRuleOutcome(e.v.rule, e.v.expr, inputs, combiner);
+        return { ...base, outcome: o.outcome, code: o.code, via: o.via, error: a.error, answers: a.answers };
+    });
+    const results = reports.map((r) => ({ ref: r.ref, effective: r.effective, outcome: r.outcome, code: r.code, via: r.via }));
+    return { call: decideCallOutcome(selection, results), rules: reports, skipped, engine: identity, canary };
+}
+/**
+ * The questions a rule could not answer: a yes/no question between its bands,
+ * a choice none of whose options cleared `yes_at` while one stayed unknown.
+ * Every question when none can be named (no answers came back).
+ */
+function unknownQuestions(entry, answers) {
+    const v = validateDecideRule(entry.ir);
+    if (!v.ok)
+        return [];
+    const names = Object.keys(v.rule.questions);
+    if (answers) {
+        const inputs = {};
+        for (const [name, ans] of Object.entries(answers))
+            inputs[name] = { p: ans.p, perOrder: ans.perOrder };
+        const atoms = decideAtoms(v.rule, inputs);
+        const unknown = names.filter((name) => {
+            if (atoms.yes[name] !== undefined)
+                return atoms.yes[name] === 'U';
+            const values = Object.values(atoms.eq[name] ?? {});
+            return !values.includes('T') && values.includes('U');
+        });
+        if (unknown.length > 0)
+            return unknown.map((name) => v.rule.questions[name].ask);
+    }
+    return names.map((name) => v.rule.questions[name].ask);
+}
+/** What one evaluated rule says, for a refusal, a question or a shadow record. */
+function decideRuleReason(report, entry) {
+    const title = entry.ir.title ?? entry.sopTitle;
+    if (report.error === 'budget_skip' && report.outcome !== 'allow') {
+        return `Needs a person: ${title} — the decide engine cannot answer rule ${entry.ir.id} within this call's time budget`;
+    }
+    if (report.outcome === 'unavailable') {
+        return `GOVERNANCE_UNAVAILABLE — the decide engine could not evaluate rule ${entry.ir.id} (${title}): ${report.error ?? 'unavailable'}`;
+    }
+    if (report.code === 'DECIDE_REFUSED')
+        return `Decide rule ${entry.ir.id} (${title}) refused this call`;
+    return `Needs a person: ${title} — ${unknownQuestions(entry, report.answers).join(' ')}`;
+}
+/**
+ * The decision a gate acts on for a call's evaluation of `rules` (the records
+ * it passed in), with the reason it refuses or asks with.
+ */
+export function decideDecision(ev, rules) {
+    const call = ev.call;
+    if (call.outcome === 'allow')
+        return { outcome: 'allow', code: null, ruleId: null, via: null, reason: '' };
+    const ruleId = call.ruleRef === null ? null : `decide.${call.ruleRef}`;
+    const entry = rules.find((r) => r.ref === call.ruleRef);
+    const report = ev.rules.find((r) => r.ref === call.ruleRef);
+    const reason = entry && report
+        ? decideRuleReason(report, entry)
+        : `GOVERNANCE_UNAVAILABLE — ${call.reason ?? 'the decide rules for this call could not be evaluated'}`;
+    return { outcome: call.outcome, code: call.code, ruleId, via: call.outcome === 'escalate' ? call.via ?? 'ask' : null, reason };
+}
+/**
+ * The evaluated shadow rules that would have refused, escalated or found the
+ * engine unavailable: what a gate records, while the call goes on.
+ */
+export function decideShadowFindings(ev, rules) {
+    const out = [];
+    for (const report of ev.rules) {
+        if (report.effective !== 'shadow' || report.outcome === 'allow')
+            continue;
+        const entry = rules.find((r) => r.ref === report.ref);
+        if (entry)
+            out.push({ ruleId: `decide.${report.ref}`, reason: decideRuleReason(report, entry) });
+    }
+    return out;
+}
+/**
+ * The decision when the evaluation itself could not run or finish (the CLI
+ * failed, the budget ran out): refuse with GOVERNANCE_UNAVAILABLE, under the
+ * first matched rule its snapshot record stamped `enforce`, unless every rule
+ * on the tool is stamped `shadow`, which allows.
+ */
+export function decideUnavailableDecision(rules, tool, why) {
+    const matched = rules.filter((r) => r.ir.on === 'tool_call' && (r.ir.tools ?? []).includes(tool));
+    const enforcing = matched.find((r) => r.rollout === 'enforce');
+    if (!enforcing)
+        return { outcome: 'allow', code: null, ruleId: null, via: null, reason: '' };
+    return { outcome: 'refuse', code: 'GOVERNANCE_UNAVAILABLE', ruleId: `decide.${enforcing.ref}`, via: null, reason: `GOVERNANCE_UNAVAILABLE — ${why}` };
+}
+// ---------------------------------------------------------------------------
+// As source
+// ---------------------------------------------------------------------------
+/**
+ * This module as JavaScript source, for the hook gates to embed. The
+ * embedding scope supplies what it imports from `decide.ts`
+ * (`DECIDE_DEFAULT_BAND`, `decideAtoms`, `decideCallOutcome`,
+ * `decideOptions`, `decideRuleHash`, `decideRuleOutcome`, `selectDecideRules`,
+ * `validateDecideRule`) and `decideEngine.ts` (`buildDecideToolCallState`,
+ * `DecideEngineError`, `decideEngineErrorOutcome`, `runDecideCanary`). A
+ * test holds the list to the functions this file declares.
+ */
+export const DECIDE_EVALUATE_JS_SOURCE = decideModuleSource([
+    `const DECIDE_CANARY_TTL_MS = ${DECIDE_CANARY_TTL_MS};`,
+    `const DECIDE_CANARY_FILE = ${JSON.stringify(DECIDE_CANARY_FILE)};`,
+    `const CANARY_ENTRIES_MAX = ${CANARY_ENTRIES_MAX};`,
+    `const ALLOW = ${JSON.stringify(ALLOW)};`,
+    decideEffectiveRollout,
+    decideCanaryFresh,
+    canaryEntry,
+    createDecideCanaryFileStore,
+    errorCode,
+    decideRuleCalls,
+    decideRuleEstimateMs,
+    decideStoredQ95Ms,
+    decideVerdictInOrder,
+    evaluateDecideCall,
+    evaluateDecideRules,
+    unknownQuestions,
+    decideRuleReason,
+    decideDecision,
+    decideShadowFindings,
+    decideUnavailableDecision,
+]);
+/**
+ * Every decide module a hook gate needs, as one JavaScript function
+ * expression: called with the gate's `sha256(text)` (hex), it returns the
+ * snapshot decoders (`format`, `record`), the engine (`resolveConfig`,
+ * `createEngine`, `EngineError`), the canary cache (`canaryStore(file, fs)`),
+ * the tier (`evaluate`, `decision`, `shadowFindings`, `unavailable`,
+ * `storedQ95`, the p95 an engine.json holds, and `verdictInOrder`, the order
+ * of evidence of the loops, graphs and gates release), and the decide log
+ * (`writeLog`, `logEngine`, `logDeps`).
+ * Each module has a scope of its own, since their private helpers share
+ * names, and receives what it imports as parameters.
+ */
+export const DECIDE_GATE_JS_SOURCE = `(function (sha256) {
+const decide = (function () {
+${DECIDE_JS_SOURCE}
+${DECIDE_RECORD_JS_SOURCE}
+  return { choiceOrders, DECIDE_DEFAULT_BAND, decideAtoms, decideCallOutcome, decideOptions, decideRuleHash, decideRuleOutcome,
+    selectDecideRules, validateDecideRule, decodeSnapshotFormatRecord, decodeDecideRecord, bandValue, choiceAtoms,
+    decideQuestionBand, parseWhen };
+})();
+const guard = (function () {
+${DECIDE_HOST_GUARD_JS_SOURCE}
+  return { checkSelfHostedDecisionHost };
+})();
+const engine = (function (choiceOrders, checkSelfHostedDecisionHost) {
+${DECIDE_ENGINE_JS_SOURCE}
+  return { DecideEngineError, resolveDecideEngineConfig, createDecideEngine, buildDecideToolCallState, decideEngineErrorOutcome, runDecideCanary,
+    decideCanonicalJson };
+})(decide.choiceOrders, guard.checkSelfHostedDecisionHost);
+const evaluate = (function (DECIDE_DEFAULT_BAND, decideAtoms, decideCallOutcome, decideOptions, decideRuleHash, decideRuleOutcome,
+    selectDecideRules, validateDecideRule, buildDecideToolCallState, DecideEngineError, decideEngineErrorOutcome, runDecideCanary) {
+${DECIDE_EVALUATE_JS_SOURCE}
+  return { createDecideCanaryFileStore, evaluateDecideCall, decideDecision, decideShadowFindings, decideUnavailableDecision, decideStoredQ95Ms,
+    decideVerdictInOrder };
+})(decide.DECIDE_DEFAULT_BAND, decide.decideAtoms, decide.decideCallOutcome, decide.decideOptions, decide.decideRuleHash,
+  decide.decideRuleOutcome, decide.selectDecideRules, decide.validateDecideRule, engine.buildDecideToolCallState,
+  engine.DecideEngineError, engine.decideEngineErrorOutcome, engine.runDecideCanary);
+const log = (function (bandValue, choiceAtoms, decideOptions, decideQuestionBand, parseWhen, validateDecideRule, buildDecideToolCallState,
+    decideCanonicalJson) {
+${DECIDE_LOG_JS_SOURCE}
+  return { writeDecideCallLog, decideLogEngine, decideLogDeps };
+})(decide.bandValue, decide.choiceAtoms, decide.decideOptions, decide.decideQuestionBand, decide.parseWhen, decide.validateDecideRule,
+  engine.buildDecideToolCallState, engine.decideCanonicalJson);
+const check = function (ir) {
+  const v = decide.validateDecideRule(ir);
+  return v.ok ? decide.decideRuleHash(v.rule, sha256) : null;
+};
+return {
+  format: decide.decodeSnapshotFormatRecord,
+  record: function (line) { return decide.decodeDecideRecord(line, check); },
+  EngineError: engine.DecideEngineError,
+  resolveConfig: engine.resolveDecideEngineConfig,
+  createEngine: engine.createDecideEngine,
+  canaryStore: evaluate.createDecideCanaryFileStore,
+  evaluate: evaluate.evaluateDecideCall,
+  decision: evaluate.decideDecision,
+  shadowFindings: evaluate.decideShadowFindings,
+  unavailable: evaluate.decideUnavailableDecision,
+  storedQ95: evaluate.decideStoredQ95Ms,
+  verdictInOrder: evaluate.decideVerdictInOrder,
+  writeLog: log.writeDecideCallLog,
+  logEngine: log.decideLogEngine,
+  logDeps: log.decideLogDeps,
+};
+})`;
+//# sourceMappingURL=decideEvaluate.js.map

package/dist/decideEvaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decideEvaluate.js","sourceRoot":"","sources":["../src/decideEvaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GAMnB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,uBAAuB,EAAuD,MAAM,mBAAmB,CAAA;AAChH,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,GAMhB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAgBrD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAoI,EACpI,WAA0B;IAE1B,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;IAC7F,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;IACzI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;IACtF,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;IAC/E,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAA;IACjE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;AAClH,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,oDAAoD;AACpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAA;AAC3C,qDAAqD;AACrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAC/C,oEAAoE;AACpE,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAkB7B,6GAA6G;AAC7G,MAAM,UAAU,iBAAiB,CAAC,KAA+B,EAAE,KAAa;IAC9E,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,IAAI,GAAG,oBAAoB,CAAA;AACvG,CAAC;AAUD,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACpD,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IACvE,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC5G,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACxG,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,EAAE,UAAU,EAAE,CAAC,CAAC,UAAoB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAA;AAC7K,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,EAAkB;IAC1E,MAAM,OAAO,GAAG,GAAwB,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAuC,CAAA;YAC3F,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,CAAA;YACzD,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAA0B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC,CAAA;IACD,OAAO;QACL,IAAI,CAAC,GAAG,EAAE,WAAW;YACnB,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,IAAI,IAAI,CAAA;QACtF,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAA;YAC1I,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;YAC7C,IAAI,GAAG,IAAI,GAAG,KAAK,IAAI;gBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5E,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;YAC9E,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAChF,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC;AAiFD,MAAM,KAAK,GAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AAEzG,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAA;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAmC,EAAE,MAAiD;IACzH,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,MAAM,CAAA;IACrC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAA;AACnD,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,iJAAiJ;AACjJ,MAAM,UAAU,eAAe,CAAC,IAAgB;IAC9C,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjH,OAAO,CAAC,CAAA;AACV,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,IAAgB,EAAE,KAAa,EAAE,QAAgB;IACpF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;AACrF,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,MAAM,CAAC,GAAG,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAgC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IACjI,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA0B,EAAE,IAAwB;IAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAA;IAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO;QAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC5F,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IAC1D,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,UAAU,GAAsB,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAClC,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAChF,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,IAAI,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;;YAClG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAA;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAEtC,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,IAAI,IAAI,CAAA;IAC7C,MAAM,OAAO,GAAuB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvD,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QACxF,MAAM,GAAG,GAAG,sBAAsB,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;QAC1D,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;QACxD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,aAAsB,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC9J,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;QAC7F,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;QACvG,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;IACpF,CAAC,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,CAAA;IACvC,uFAAuF;IACvF,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAA;IAC7H,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC/B,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,mBAAmB,CAAC,KAA0B,EAAE,IAAwB;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAChC,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC,CAAC,uCAAuC,CAAA;QAChK,OAAO;YACL,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE;YACzE,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI;SACb,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAEpG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,YAAY,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IAC5E,IAAI,WAAW,GAAiC,IAAI,CAAC,MAAM,YAAY,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IAClH,IAAI,QAAQ,GAA+B,IAAI,CAAA;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAClC,yEAAyE;QACzE,mCAAmC;QACnC,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QACxF,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QAC5B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,sBAAsB,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAC,EAAE,CAAA;IACxF,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,iBAAiB,CACjC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,EACrH,KAAK,CAAC,IAAI,CACX,CAAA;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACvG,CAAC;IAGD,MAAM,OAAO,GAAG,KAAK,EAAE,CAA2B,EAAkB,EAAE;QACpE,IAAI,CAAC,MAAM,IAAI,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,IAAI,gBAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QAC/G,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QAC/E,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACrB,MAAM,SAAS,GAAyB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/E,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAE,CAAA;YAC/B,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;QACrI,CAAC,CAAC,CAAA;QACF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,wBAAwB,CAAC;gBACrC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ;gBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzG,CAAC,CAAA;YACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;YAChE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QACpE,CAAC;IACH,CAAC,CAAA;IAED,IAAI,MAAM,GAA+B,IAAI,CAAA;IAC7C,uEAAuE;IACvE,uEAAuE;IACvE,8BAA8B;IAC9B,IAAI,SAAS,GAA0C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5E,IAAI,MAAM,IAAI,CAAC,WAAW,IAAI,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAA;QAChC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,GAAG,QAAQ,CAAA;QACnB,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAC5D,CAAC,CAAC,EAAE,EAAE;gBACJ,IAAI,CAAC;oBACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;gBACzJ,CAAC;gBAAC,MAAM,CAAC;oBACP,kEAAkE;gBACpE,CAAC;gBACD,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAA;YACtC,CAAC,EACD,CAAC,GAAY,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CACjC,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACrH,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,WAAW,IAAI,QAAQ;QAAE,MAAM,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IAEnJ,MAAM,OAAO,GAAuB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACb,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACnB,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAA;QAC7D,MAAM,GAAG,GAAG,sBAAsB,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACnD,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;QAC1H,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,uEAAuE;YACvE,qDAAqD;YACrD,MAAM,KAAK,GAAG,WAAW,KAAK,eAAe,IAAI,CAAC,CAAC,KAAK,IAAI,wBAAwB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAA;YACvI,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACzF,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,IAAI,wBAAwB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,aAAa,EAAE,CAAC;YACnE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAClG,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACpH,MAAM,MAAM,GAAsC,EAAE,CAAA;QACpD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAA;QAC9G,yEAAyE;QACzE,wBAAwB;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAA;QACnB,MAAM,QAAQ,GAA0B,GAAG,EAAE,QAAQ;YACnD,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,mBAAmB,EAAE;YACpH,CAAC,CAAC,IAAI,CAAA;QACR,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QACjE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;IACtG,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAC9I,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC3G,CAAC;AAkBD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAsB,EAAE,OAA4C;IAC5F,MAAM,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACtC,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAA;IACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAsC,EAAE,CAAA;QACpD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAA;QACtG,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACpC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAA;YACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QACtD,CAAC,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,MAAwB,EAAE,KAAsB;IACxE,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAA;IAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjE,OAAO,mBAAmB,KAAK,2CAA2C,KAAK,CAAC,EAAE,CAAC,EAAE,iCAAiC,CAAA;IACxH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,sEAAsE,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,KAAK,MAAM,MAAM,CAAC,KAAK,IAAI,aAAa,EAAE,CAAA;IACzI,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,eAAe,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,KAAK,qBAAqB,CAAA;IACtG,OAAO,mBAAmB,KAAK,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,EAAoB,EAAE,KAAiC;IACpF,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAA;IACpB,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC1G,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,EAAE,CAAA;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3D,MAAM,MAAM,GACV,KAAK,IAAI,MAAM;QACb,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC;QACjC,CAAC,CAAC,4BAA4B,IAAI,CAAC,MAAM,IAAI,uDAAuD,EAAE,CAAA;IAC1G,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;AAChI,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAoB,EAAE,KAAiC;IAC1F,MAAM,GAAG,GAA8C,EAAE,CAAA;IACzD,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,SAAQ;QACzE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAA;QACrD,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;IAClG,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAiC,EAAE,IAAY,EAAE,GAAW;IACpG,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACjG,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAA;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC5F,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,UAAU,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,GAAG,EAAE,EAAE,CAAA;AACvJ,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;IAC1D,gCAAgC,oBAAoB,GAAG;IACvD,8BAA8B,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,GAAG;IACnE,8BAA8B,kBAAkB,GAAG;IACnD,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG;IACzC,sBAAsB;IACtB,iBAAiB;IACjB,WAAW;IACX,2BAA2B;IAC3B,SAAS;IACT,eAAe;IACf,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,yBAAyB;CAC1B,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;EAEnC,gBAAgB;EAChB,uBAAuB;;;;;;EAMvB,2BAA2B;;;;EAI3B,uBAAuB;;;;;;EAMvB,yBAAyB;;;;;;;;EAQzB,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBnB,CAAA"}

package/dist/decideHostGuard.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The self-hosted guard on a decide engine's URL.
+ *
+ * A decide engine sees every tool call a rule asks about, so it must run on
+ * hardware the user controls. The guard judges the literal URL, with no DNS
+ * lookup: loopback and private addresses pass, a name passes only when it is
+ * `localhost`, ends in `.local`, or is listed in
+ * `INTUTIC_SELF_HOSTED_DECISION_HOSTS`, and the hosted decision APIs are
+ * refused even when listed.
+ *
+ * The parser is deliberately narrower than WHATWG's: a URL with anything but
+ * printable ASCII, a backslash, a percent sign, a query or a fragment is
+ * refused rather than normalised, so every HTTP client reaches the host the
+ * guard judged.
+ *
+ * Byte-identical copy in `packages/gate-js/src/`; the Python
+ * (`intutic_clawde/gate/decide_engine.py`) and Rust (`proxy/src/decide/guard.rs`)
+ * guards run the same `fixtures/decide-engine-vectors.json` host cases.
+ *
+ * @module
+ */
+/** Hosted decision APIs, matched on the host or any subdomain of it. */
+export declare const DECIDE_HOSTED_DENYLIST: readonly ["typesafe.ai", "fastino.ai", "api.openai.com", "openai.azure.com", "services.ai.azure.com", "gateway.ai.cloudflare.com", "ai-gateway.vercel.sh", "api.fireworks.ai", "api.perplexity.ai", "cloud.databricks.com", "azuredatabricks.net"];
+export type DecideHostVerdict = {
+    ok: true;
+    host: string;
+    reason: 'loopback' | 'private' | 'listed';
+} | {
+    ok: false;
+    host: string;
+    reason: 'scheme' | 'bad_url' | 'credentials' | 'denylist' | 'decision_path' | 'not_listed';
+};
+export declare class DecideHostRefusedError extends Error {
+    readonly verdict: Extract<DecideHostVerdict, {
+        ok: false;
+    }>;
+    readonly code: "host_refused";
+    constructor(verdict: Extract<DecideHostVerdict, {
+        ok: false;
+    }>);
+}
+/**
+ * Judges a decide engine's base URL. `listed` is the value of
+ * `INTUTIC_SELF_HOSTED_DECISION_HOSTS` (a comma list).
+ */
+export declare function checkSelfHostedDecisionHost(url: string, listed?: string): DecideHostVerdict;
+/** As {@link checkSelfHostedDecisionHost}, throwing {@link DecideHostRefusedError}; returns the host. */
+export declare function assertSelfHostedDecisionHost(url: string, listed?: string): string;
+/**
+ * {@link checkSelfHostedDecisionHost} as JavaScript source, with the
+ * constants and helpers it reads, for the hook gates to embed. A CommonJS
+ * build names an exported constant `exports.X` inside a function; the source
+ * defines each as a plain `X`, so that prefix is dropped.
+ */
+export declare const DECIDE_HOST_GUARD_JS_SOURCE: string;
+//# sourceMappingURL=decideHostGuard.d.ts.map

package/dist/decideHostGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decideHostGuard.d.ts","sourceRoot":"","sources":["../src/decideHostGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,oPAYzB,CAAA;AAKV,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;CAAE,GACrE;IACE,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,eAAe,GAAG,YAAY,CAAA;CAC3F,CAAA;AAEL,qBAAa,sBAAuB,SAAQ,KAAK;IAEnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,EAAE,EAAE,KAAK,CAAA;KAAE,CAAC;IADvE,QAAQ,CAAC,IAAI,EAAG,cAAc,CAAS;gBAClB,OAAO,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,EAAE,EAAE,KAAK,CAAA;KAAE,CAAC;CAIxE;AAiED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,iBAAiB,CA2C3F;AAED,yGAAyG;AACzG,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAIjF;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,QAM5B,CAAA"}