@intutic/gate 2.9.1 → 3.0.1

package/dist/dsh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dsh.d.ts","sourceRoot":"","sources":["../src/dsh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAGH,OAAO,EAAE,IAAI,EAAW,MAAM,WAAW,CAAA;AACzC,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,WAAW,CAAA;AAItD;0CAC0C;AAC1C,eAAO,MAAM,WAAW,uBAAuB,CAAA;AAE/C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED;wEACwE;AACxE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAEtB;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,CACA,KAAK,EAAE,mBAAmB,EAC1B,QAAQ,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,kBAAkB,CAAC,GACzG,MAAM,OAAO,CAAA;CACjB;AAED;;;;oCAIoC;AACpC,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;0EACsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;oDAGoD;AACpD,eAAO,MAAM,MAAM,UAAY,CAAA;AAwC/B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,IAAI,GACT,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAoBlG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,GAAE,aAAkB,GAAG,IAAI,CAY9E;AAED;;;;;oEAKoE;;;;;;AACpE,wBAAmD"}
+{"version":3,"file":"dsh.d.ts","sourceRoot":"","sources":["../src/dsh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAGH,OAAO,EAAE,IAAI,EAAW,MAAM,WAAW,CAAA;AACzC,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,WAAW,CAAA;AAItD;0CAC0C;AAC1C,eAAO,MAAM,WAAW,uBAAuB,CAAA;AAE/C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED;wEACwE;AACxE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAEtB;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,CACA,KAAK,EAAE,mBAAmB,EAC1B,QAAQ,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,kBAAkB,CAAC,GACzG,MAAM,OAAO,CAAA;CACjB;AAED;;;;oCAIoC;AACpC,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;0EACsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;oDAGoD;AACpD,eAAO,MAAM,MAAM,UAAY,CAAA;AAwC/B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,IAAI,GACT,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAyBlG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,GAAE,aAAkB,GAAG,IAAI,CAY9E;AAED;;;;;oEAKoE;;;;;;AACpE,wBAAmD"}

package/dist/dsh.js

@@ -90,7 +90,7 @@
 import { randomUUID } from 'node:crypto';
 import { Gate, install } from './gate.js';
 import { GateClient } from './client.js';
-import { IntuticGateRefusal } from './errors.js';
+import { IntuticGateEscalation, IntuticGateRefusal } from './errors.js';
 /** The Cordis Plugin id this module registers as. Shown in dsh's own plugin
  *  diagnostics/`--dump-config` output. */
 export const PLUGIN_NAME = 'intutic-governance';
@@ -157,6 +157,11 @@ export function createPreExecuteListener(gate) {
             await gate.guard(exec.name, renderDshToolInput(exec.arguments));
         }
         catch (err) {
+            // A decide rule that could not decide asks the user through dsh's
+            // approval, which denies when no approval service is mounted.
+            if (err instanceof IntuticGateEscalation) {
+                return { kind: 'ask', reason: err.reason };
+            }
             if (err instanceof IntuticGateRefusal) {
                 return { kind: 'deny', reason: err.message };
             }

package/dist/dsh.js.map

@@ -1 +1 @@
-{"version":3,"file":"dsh.js","sourceRoot":"","sources":["../src/dsh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD;0CAC0C;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAA;AA4C/C;;;oDAGoD;AACpD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;AAE/B;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,IAAa;IACvC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,OAAO,IAAiB,CAAA;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,gBAAgB,CAAC,MAAqB;IAC7C,OAAO,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,UAAU,EAAE,CAAA;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAU;IAEV,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAA;YAC9C,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,+CAA+C,MAAM,8DAA8D;aAC5H,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,gEAAgE;QAChE,oEAAoE;QACpE,gCAAgC;QAChC,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,KAAK,CAAC,GAAsB,EAAE,SAAwB,EAAE;IACtE,IAAI,MAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEb,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;oEAKoE;AACpE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA"}
+{"version":3,"file":"dsh.js","sourceRoot":"","sources":["../src/dsh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEvE;0CAC0C;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAA;AA4C/C;;;oDAGoD;AACpD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;AAE/B;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,IAAa;IACvC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,OAAO,IAAiB,CAAA;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,gBAAgB,CAAC,MAAqB;IAC7C,OAAO,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,UAAU,EAAE,CAAA;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAU;IAEV,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,8DAA8D;YAC9D,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;YAC5C,CAAC;YACD,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAA;YAC9C,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,+CAA+C,MAAM,8DAA8D;aAC5H,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,gEAAgE;QAChE,oEAAoE;QACpE,gCAAgC;QAChC,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,KAAK,CAAC,GAAsB,EAAE,SAAwB,EAAE;IACtE,IAAI,MAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEb,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;oEAKoE;AACpE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA"}

package/dist/errors.d.ts

@@ -17,6 +17,7 @@
  * Open WebUI filter and the Python SDK raise — so harnesses and log scrapers
  * that already recognise that prefix recognise this refusal too.
  */
+import type { RefusalEvidence, RefusalScope } from './refusalDetail.js';
 /** Base class for every error this package throws. */
 export declare class GateError extends Error {
     constructor(message: string);
@@ -31,7 +32,7 @@ export declare class GateConnectionError extends GateError {
  * `packages/shared-types/fixtures/refusal-codes.json` (`gate`) by a test, as
  * the Python gate's list and the gate SDK reference are.
  */
-export declare const GATE_REFUSAL_CODES: readonly ["SSO_GROUP", "SNAPSHOT", "HELD", "SERVER_BLOCKED", "SERVER_HELD", "SERVER_NOT_APPROVED", "TOOL_DISABLED", "SERVER_NOT_ALLOWED", "POLICY_SNAPSHOT_UNVERIFIED", "SOP_RULE", "HOOK_GATE", "INSUFFICIENT_SCOPE", "COMMAND_TOO_LARGE", "CHAOS_FAULT", "E_UNPINNED_LATEST", "E_UNPINNED_TAG", "E_UNKNOWN_REGISTRY", "E_UNKNOWN_IMAGE", "E_DIGEST_MISMATCH", "E_MANIFEST_UNPARSEABLE", "WORKFLOW_SANDBOX", "NO_GATE"];
+export declare const GATE_REFUSAL_CODES: readonly ["SSO_GROUP", "SNAPSHOT", "HELD", "PREREQUISITE_UNMET", "OUT_OF_SCOPE", "OFF_PLAN", "PLAN_NOT_APPROVED", "SERVER_BLOCKED", "SERVER_HELD", "SERVER_NOT_APPROVED", "TOOL_DISABLED", "SERVER_NOT_ALLOWED", "POLICY_SNAPSHOT_UNVERIFIED", "SOP_RULE", "HOOK_GATE", "INSUFFICIENT_SCOPE", "COMMAND_TOO_LARGE", "CHAOS_FAULT", "E_UNPINNED_LATEST", "E_UNPINNED_TAG", "E_UNKNOWN_REGISTRY", "E_UNKNOWN_IMAGE", "E_DIGEST_MISMATCH", "E_MANIFEST_UNPARSEABLE", "DECIDE_REFUSED", "DECIDE_ESCALATED", "GOVERNANCE_UNAVAILABLE", "WORKFLOW_SANDBOX", "NO_GATE"];
 export type GateRefusalCode = (typeof GATE_REFUSAL_CODES)[number];
 /**
  * Raised when a tool call must not run.
@@ -44,7 +45,18 @@ export declare class IntuticGateRefusal extends GateError {
     readonly reason: string;
     readonly code: GateRefusalCode;
     readonly incidentId: string | undefined;
-    constructor(reason: string, code: GateRefusalCode, incidentId?: string);
+    /**
+     * Where the refusal applies, so a retry can stay out of it (paths, tools,
+     * step, detector, rule), bounded as refusalDetail.ts says. Undefined when
+     * the refusal names none, and always in an OPAQUE workspace.
+     */
+    readonly scope: RefusalScope | undefined;
+    /** What the refuser saw, bounded; undefined when nothing, and in OPAQUE. */
+    readonly evidence: RefusalEvidence[] | undefined;
+    constructor(reason: string, code: GateRefusalCode, incidentId?: string, detail?: {
+        scope?: RefusalScope;
+        evidence?: RefusalEvidence[];
+    });
 }
 /**
  * Raised when a hold rule stopped the call to ask a person first (`code`
@@ -61,4 +73,16 @@ export declare class IntuticGateHold extends IntuticGateRefusal {
     readonly holdId: string | undefined;
     constructor(reason: string, holdId: string | undefined);
 }
+/**
+ * Raised when a decide rule could not decide the call and a person should
+ * (`code` `DECIDE_ESCALATED`): the answers fell between its bands, or the
+ * option orders disagreed. A subclass, so a caller that stops on every
+ * refusal stops on this too; one that can ask its user (dsh's approval) asks
+ * with `reason` and runs the call only on a yes. `ruleId` names the rule
+ * (`decide.<ruleRef>`), and is `undefined` in an OPAQUE workspace.
+ */
+export declare class IntuticGateEscalation extends IntuticGateRefusal {
+    readonly ruleId: string | undefined;
+    constructor(reason: string, ruleId: string | undefined);
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,sDAAsD;AACtD,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,kEAAkE;AAClE,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,0ZA+BrB,CAAA;AAEV,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEjE;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,SAAS;IAC/C,SAAgB,MAAM,EAAE,MAAM,CAAA;IAC9B,SAAgB,IAAI,EAAE,eAAe,CAAA;IACrC,SAAgB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;gBAElC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;CAOvE;AAED;;;;;;;;;;GAUG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;IACrD,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;gBAE9B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAMvD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEvE,sDAAsD;AACtD,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,kEAAkE;AAClE,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,iiBA0CrB,CAAA;AAEV,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEjE;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,SAAS;IAC/C,SAAgB,MAAM,EAAE,MAAM,CAAA;IAC9B,SAAgB,IAAI,EAAE,eAAe,CAAA;IACrC,SAAgB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9C;;;;OAIG;IACH,SAAgB,KAAK,EAAE,YAAY,GAAG,SAAS,CAAA;IAC/C,4EAA4E;IAC5E,SAAgB,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,CAAA;gBAE3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAA;KAAE;CASxI;AAED;;;;;;;;;;GAUG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;IACrD,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;gBAE9B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAMvD;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAsB,SAAQ,kBAAkB;IAC3D,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;gBAE9B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAKvD"}

package/dist/errors.js

@@ -41,6 +41,12 @@ export const GATE_REFUSAL_CODES = [
     'SSO_GROUP',
     'SNAPSHOT',
     'HELD',
+    // Tier R, the snapshot's rule records (gateRuleRecord.ts): a qualified
+    // requires_before, scope_paths_mode: enforce, plan_approval.
+    'PREREQUISITE_UNMET',
+    'OUT_OF_SCOPE',
+    'OFF_PLAN',
+    'PLAN_NOT_APPROVED',
     // The MCP server registry and allowlist, from the policy snapshot or the
     // control plane's hook gate.
     'SERVER_BLOCKED',
@@ -65,6 +71,11 @@ export const GATE_REFUSAL_CODES = [
     'E_UNKNOWN_IMAGE',
     'E_DIGEST_MISMATCH',
     'E_MANIFEST_UNPARSEABLE',
+    // A decide rule (the Decide tier, after every deterministic tier allowed
+    // the call): refused, escalated with no way to ask, or its engine unavailable.
+    'DECIDE_REFUSED',
+    'DECIDE_ESCALATED',
+    'GOVERNANCE_UNAVAILABLE',
     // The Workflow DevKit adapter (workflow.ts), before any tier runs.
     'WORKFLOW_SANDBOX',
     'NO_GATE',
@@ -80,12 +91,22 @@ export class IntuticGateRefusal extends GateError {
     reason;
     code;
     incidentId;
-    constructor(reason, code, incidentId) {
+    /**
+     * Where the refusal applies, so a retry can stay out of it (paths, tools,
+     * step, detector, rule), bounded as refusalDetail.ts says. Undefined when
+     * the refusal names none, and always in an OPAQUE workspace.
+     */
+    scope;
+    /** What the refuser saw, bounded; undefined when nothing, and in OPAQUE. */
+    evidence;
+    constructor(reason, code, incidentId, detail) {
         super(`[Intutic Governance] BLOCKED: ${reason}`);
         this.name = 'IntuticGateRefusal';
         this.reason = reason;
         this.code = code;
         this.incidentId = incidentId;
+        this.scope = detail?.scope;
+        this.evidence = detail?.evidence;
     }
 }
 /**
@@ -108,4 +129,20 @@ export class IntuticGateHold extends IntuticGateRefusal {
         this.holdId = holdId;
     }
 }
+/**
+ * Raised when a decide rule could not decide the call and a person should
+ * (`code` `DECIDE_ESCALATED`): the answers fell between its bands, or the
+ * option orders disagreed. A subclass, so a caller that stops on every
+ * refusal stops on this too; one that can ask its user (dsh's approval) asks
+ * with `reason` and runs the call only on a yes. `ruleId` names the rule
+ * (`decide.<ruleRef>`), and is `undefined` in an OPAQUE workspace.
+ */
+export class IntuticGateEscalation extends IntuticGateRefusal {
+    ruleId;
+    constructor(reason, ruleId) {
+        super(reason, 'DECIDE_ESCALATED');
+        this.name = 'IntuticGateEscalation';
+        this.ruleId = ruleId;
+    }
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,sDAAsD;AACtD,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;IACzB,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,WAAW;IACX,UAAU;IACV,MAAM;IACN,yEAAyE;IACzE,6BAA6B;IAC7B,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,qEAAqE;IACrE,4BAA4B;IAC5B,UAAU;IACV,WAAW;IACX,+DAA+D;IAC/D,oBAAoB;IACpB,uEAAuE;IACvE,mBAAmB;IACnB,0EAA0E;IAC1E,+DAA+D;IAC/D,aAAa;IACb,mBAAmB;IACnB,gBAAgB;IAChB,oBAAoB;IACpB,iBAAiB;IACjB,mBAAmB;IACnB,wBAAwB;IACxB,mEAAmE;IACnE,kBAAkB;IAClB,SAAS;CACD,CAAA;AAIV;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/B,MAAM,CAAQ;IACd,IAAI,CAAiB;IACrB,UAAU,CAAoB;IAE9C,YAAY,MAAc,EAAE,IAAqB,EAAE,UAAmB;QACpE,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IACrC,MAAM,CAAoB;IAE1C,YAAY,MAAc,EAAE,MAA0B;QACpD,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,OAAO,GAAG,8BAA8B,MAAM,EAAE,CAAA;QACrD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,sDAAsD;AACtD,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;IACzB,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,WAAW;IACX,UAAU;IACV,MAAM;IACN,uEAAuE;IACvE,6DAA6D;IAC7D,oBAAoB;IACpB,cAAc;IACd,UAAU;IACV,mBAAmB;IACnB,yEAAyE;IACzE,6BAA6B;IAC7B,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,qEAAqE;IACrE,4BAA4B;IAC5B,UAAU;IACV,WAAW;IACX,+DAA+D;IAC/D,oBAAoB;IACpB,uEAAuE;IACvE,mBAAmB;IACnB,0EAA0E;IAC1E,+DAA+D;IAC/D,aAAa;IACb,mBAAmB;IACnB,gBAAgB;IAChB,oBAAoB;IACpB,iBAAiB;IACjB,mBAAmB;IACnB,wBAAwB;IACxB,yEAAyE;IACzE,+EAA+E;IAC/E,gBAAgB;IAChB,kBAAkB;IAClB,wBAAwB;IACxB,mEAAmE;IACnE,kBAAkB;IAClB,SAAS;CACD,CAAA;AAIV;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/B,MAAM,CAAQ;IACd,IAAI,CAAiB;IACrB,UAAU,CAAoB;IAC9C;;;;OAIG;IACa,KAAK,CAA0B;IAC/C,4EAA4E;IAC5D,QAAQ,CAA+B;IAEvD,YAAY,MAAc,EAAE,IAAqB,EAAE,UAAmB,EAAE,MAA+D;QACrI,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,EAAE,KAAK,CAAA;QAC1B,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAA;IAClC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IACrC,MAAM,CAAoB;IAE1C,YAAY,MAAc,EAAE,MAA0B;QACpD,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,OAAO,GAAG,8BAA8B,MAAM,EAAE,CAAA;QACrD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,kBAAkB;IAC3C,MAAM,CAAoB;IAE1C,YAAY,MAAc,EAAE,MAA0B;QACpD,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF"}

package/dist/gate.d.ts

@@ -9,15 +9,40 @@
  * PreToolUse hook for them. This package is that enforcement point: the
  * missing adapter, written against Intutic's own published gate contract.
  *
- * Six tiers, in order — identical precedence to the Python SDK:
+ * Eight tiers, in order — identical precedence to the Python SDK:
  *
  *   A0  SSO group policy  from the policy snapshot       unknown groups refused
  *   A1  policy snapshot   port of intuticGate()          fails CLOSED
+ *   R   rule records      the snapshot's @rule records   fails CLOSED (a rule failure)
  *   M   MCP registry      from the policy snapshot       unverified snapshot admits none
  *   A3  SOP rules         authored in the product        fails OPEN (A2 covers it)
  *   A2  image integrity   local check                    fails CLOSED
+ *   D   decide rules      the self-hosted decide engine  fails CLOSED when enforcing
  *   B   POST /hook-gate   control-plane check             fail posture set by GateClient
  *
+ * Tier R evaluates the snapshot's `@rule` records (gateRuleRecord.ts,
+ * a byte-identical copy of `@intutic/shared-types`' module): a qualified
+ * `requires_before: action:run_tests[ok] -> X` refuses X with
+ * `PREREQUISITE_UNMET` unless the latest test run this gate recorded for the
+ * session ({@link Gate.recordOutcome}, which {@link wrapTool} calls) passed
+ * and no file changed since; `scope_paths_mode: enforce` refuses a file
+ * change outside the scope with `OUT_OF_SCOPE`; `plan_approval:` refuses
+ * with `PLAN_NOT_APPROVED` until the session's plan is approved
+ * (`GET /api/v1/plans/session/:id`, cached {@link PLAN_CACHE_MS}), and under
+ * `strict` a tool off the plan with `OFF_PLAN`. A plan that cannot be read
+ * refuses whatever `failClosed` says: rule failures always fail closed.
+ *
+ * Tier D runs only on a call every deterministic tier allowed: the snapshot's
+ * decide rules on the tool, asked of the self-hosted engine configured in
+ * `~/.intutic/decide/engine.json` and `INTUTIC_DECIDE_*`, within
+ * `INTUTIC_DECIDE_BUDGET_MS` (default {@link DECIDE_BUDGET_MS}). A rule refuses
+ * with `DECIDE_REFUSED`; one that cannot decide throws
+ * {@link IntuticGateEscalation} (`DECIDE_ESCALATED`), which a caller that can
+ * ask its user turns into a question; an engine that cannot answer refuses an
+ * enforcing rule with `GOVERNANCE_UNAVAILABLE` and lets a shadow rule's call
+ * on (decideEvaluate.ts, a byte-identical copy of `@intutic/shared-types`'
+ * module, holds the protections).
+ *
  * Tier M applies the workspace's MCP server registry and `mcpAllowedServers`
  * list to an `mcp__<server>__<tool>` call, from the snapshot's
  * `@mcp_registry` and `@mcp_allowlist` records, with the decision, codes,
@@ -81,6 +106,27 @@ import { GateClient } from './client.js';
 import * as imagecheck from './imagecheck.js';
 import * as snapshot from './snapshot.js';
 import * as soprules from './soprules.js';
+/**
+ * Whether this gate evaluates the decide rules a snapshot carries (Tier D).
+ * Only a gate that does skips a decide rule's fallback line, and only when
+ * the rule's record decoded; otherwise the fallback line refuses its tools,
+ * as in a gate that reads no `@decide` records.
+ */
+export declare const CAN_EVALUATE_DECIDE = true;
+/**
+ * Whether this gate evaluates the `@rule` records a snapshot carries (Tier
+ * R). Only a gate that does skips a record's fallback line, and only when
+ * the record decoded.
+ */
+export declare const CAN_EVALUATE_RULE_RECORDS = true;
+/** How long Tier R keeps a session's plan before reading it again. */
+export declare const PLAN_CACHE_MS = 30000;
+/** What a tool call's result says about how it went, for {@link Gate.recordOutcome}. */
+export interface ToolOutcome {
+    exitCode?: number | null;
+    isError?: boolean | null;
+    output?: string | null;
+}
 /** Tools that cannot change anything. They still get the local snapshot check
  *  (Tier A1), but skip the remote gate call (Tier B). */
 export declare const READ_ONLY_TOOLS: ReadonlySet<string>;
@@ -146,6 +192,10 @@ export declare class Gate {
     /** The SOP register said the workspace is OPAQUE (read with its rules). */
     private _registerOpaque;
     private _chaos;
+    /** The outcome state of each session (testOutcome.ts), by session id, in memory. */
+    private _outcomes;
+    /** Each session's plan, as Tier R last read it. */
+    private _plans;
     constructor(cfg?: GateConfig, client?: GateClient | null);
     private allowlistAbs;
     getSnapshot(): snapshot.Snapshot;
@@ -205,6 +255,40 @@ export declare class Gate {
     guard(toolName: string, toolInput: ToolInput): Promise<void>;
     /** The tiers: throws to refuse, resolves to allow. `note` collects a chaos run's record of the call. */
     private decide;
+    /**
+     * Records how a call that ran went, for Tier R. A test run
+     * (`action:run_tests`) records its outcome (testOutcome.ts: the exit code,
+     * else one read from `output`, the error flag and the runner summaries);
+     * any other call marks earlier outcomes as no longer adjacent, and a call
+     * that changed files (`isFileWriteCall`, scopeMatch.ts) makes an earlier pass stale.
+     * Kept in memory per {@link GateClient.sessionId}; with no session id
+     * nothing is kept, and a qualified rule stays unmet. {@link wrapTool} calls
+     * this after every call it ran.
+     */
+    recordOutcome(toolName: string, toolInput: ToolInput, result?: ToolOutcome): void;
+    /** The session's plan, read at most every {@link PLAN_CACHE_MS}. */
+    private sessionPlan;
+    /**
+     * Tier R. Throws {@link IntuticGateRefusal} when an enforcing rule record
+     * refuses the call (`PREREQUISITE_UNMET`, `OUT_OF_SCOPE`, `OFF_PLAN`,
+     * `PLAN_NOT_APPROVED`), with the refusal's scope; each shadow record's
+     * finding is reported as `tool_would_block` and the call goes on.
+     */
+    private guardRules;
+    /**
+     * Tier D. Throws when a decide rule on this tool refuses the call
+     * ({@link IntuticGateRefusal}, `DECIDE_REFUSED` or `GOVERNANCE_UNAVAILABLE`)
+     * or could not decide it ({@link IntuticGateEscalation}). Each shadow rule's
+     * finding is recorded; the call goes on.
+     */
+    private guardDecide;
+    /**
+     * Appends the call's decide record to `~/.intutic/logs/decide-<date>.jsonl`
+     * and updates each rule's drift stats, as `intutic decide check` does for
+     * the shell gates. Never throws: a log that cannot be written never
+     * changes the decision.
+     */
+    private logDecide;
     /**
      * Throws when the workspace's MCP server registry or allowlist refuses an
      * `mcp__<server>__<tool>` call: the registry first, as every gate orders

package/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAUH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAGzC;yDACyD;AACzD,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAM9C,CAAA;AAEF,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,OAAO,CAAA;CACrB;AAaD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAoB/C;;;;;;GAMG;AACH,qBAAa,IAAI;IACf,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;IAClC,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,OAAO,CAAsC;IACrD;8EAC0E;IAC1E,OAAO,CAAC,SAAS,CAAkC;IACnD,2EAA2E;IAC3E,OAAO,CAAC,eAAe,CAAQ;IAC/B,OAAO,CAAC,MAAM,CAA0B;gBAE5B,GAAG,GAAE,UAAe,EAAE,MAAM,GAAE,UAAU,GAAG,IAAW;IAKlE,OAAO,CAAC,YAAY;IAOpB,WAAW,IAAI,QAAQ,CAAC,QAAQ;IAOhC;;;;;;;OAOG;IACH,SAAS,IAAI,UAAU,CAAC,WAAW;IAwBnC;;;;;;OAMG;IACG,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IA+BhD;;;;;OAKG;IACH,OAAO,CAAC,KAAK;IAIb;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;YAOA,IAAI;IAclB;;;;OAIG;YACW,wBAAwB;IAStC,2FAA2F;IAC3F,OAAO,CAAC,KAAK;IAgBb,+FAA+F;IAC/F,OAAO,CAAC,WAAW;IAoBnB;;;;;;;;;OASG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BlE,wGAAwG;YAC1F,MAAM;IA4JpB;;;;;OAKG;YACW,QAAQ;IAkCtB;;;;OAIG;YACW,IAAI;CAqBnB;AAiCD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuGG;AAiBH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAiBzC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAGzC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAA;AAEvC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAA;AAE7C,sEAAsE;AACtE,eAAO,MAAM,aAAa,QAAS,CAAA;AAEnC,wFAAwF;AACxF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAoDD;yDACyD;AACzD,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAM9C,CAAA;AAEF,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,UAAU,cAAc;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,OAAO,CAAA;CACrB;AAaD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAoB/C;;;;;;GAMG;AACH,qBAAa,IAAI;IACf,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;IAClC,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,OAAO,CAAsC;IACrD;8EAC0E;IAC1E,OAAO,CAAC,SAAS,CAAkC;IACnD,2EAA2E;IAC3E,OAAO,CAAC,eAAe,CAAQ;IAC/B,OAAO,CAAC,MAAM,CAA0B;IACxC,oFAAoF;IACpF,OAAO,CAAC,SAAS,CAAkC;IACnD,mDAAmD;IACnD,OAAO,CAAC,MAAM,CAA0D;gBAE5D,GAAG,GAAE,UAAe,EAAE,MAAM,GAAE,UAAU,GAAG,IAAW;IAKlE,OAAO,CAAC,YAAY;IAOpB,WAAW,IAAI,QAAQ,CAAC,QAAQ;IAUhC;;;;;;;OAOG;IACH,SAAS,IAAI,UAAU,CAAC,WAAW;IAwBnC;;;;;;OAMG;IACG,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IA+BhD;;;;;OAKG;IACH,OAAO,CAAC,KAAK;IAIb;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;YAOA,IAAI;IAclB;;;;OAIG;YACW,wBAAwB;IAgBtC,2FAA2F;IAC3F,OAAO,CAAC,KAAK;IAgBb,+FAA+F;IAC/F,OAAO,CAAC,WAAW;IAoBnB;;;;;;;;;OASG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BlE,wGAAwG;YAC1F,MAAM;IAwKpB;;;;;;;;;OASG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAE,WAAgB,GAAG,IAAI;IAcrF,oEAAoE;YACtD,WAAW;IAWzB;;;;;OAKG;YACW,UAAU;IA6BxB;;;;;OAKG;YACW,WAAW;IAsCzB;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAkCjB;;;;;OAKG;YACW,QAAQ;IAkCtB;;;;OAIG;YACW,IAAI;CAqBnB;AA4CD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA"}