@intutic/gate 2.9.1 → 3.0.1

package/dist/index.d.ts

@@ -10,22 +10,31 @@
 export { classify, isDeploy, isTest, touchesInfra } from './actions.js';
 export { GateClient } from './client.js';
 export type { GateClientOptions, GateResponse } from './client.js';
-export { GateError, GateConnectionError, IntuticGateHold, IntuticGateRefusal, GATE_REFUSAL_CODES } from './errors.js';
+export { GateError, GateConnectionError, IntuticGateEscalation, IntuticGateHold, IntuticGateRefusal, GATE_REFUSAL_CODES } from './errors.js';
 export type { GateRefusalCode } from './errors.js';
 export { canonicalJson, holdKey, holdMessage } from './hold.js';
 export { COMMAND_SIZE_LIMIT, ARGUMENTS_SIZE_LIMIT, GATE_DEADLINE_MS } from './limits.js';
-export { Gate, READ_ONLY_TOOLS, install, active } from './gate.js';
-export type { GateConfig, ToolInput } from './gate.js';
+export { Gate, READ_ONLY_TOOLS, CAN_EVALUATE_RULE_RECORDS, PLAN_CACHE_MS, install, active } from './gate.js';
+export type { GateConfig, ToolInput, ToolOutcome } from './gate.js';
+export type { GateRuleCode, GateRuleKind, GateRuleRecord } from './gateRuleRecord.js';
+export type { RefusalEvidence, RefusalScope } from './refusalDetail.js';
+export type { LaneClass } from './lanes.js';
 export { intuticHeaders } from './headers.js';
 export type { IntuticHeadersOptions } from './headers.js';
 export { checkCommand, checkImages, checkWrittenManifest, isDeployCommand, isPinned, manifestPathsFromCommand, parseImageRef, verdictReason, } from './imagecheck.js';
 export type { ImagePolicy, ImageRef, ImageRefusalCode, Verdict as ImageVerdict } from './imagecheck.js';
 export { Snapshot, evaluate, guardDisabledFromEnv, loadSnapshot, snapshotPath, SEV_BLOCK, SEV_HOLD, SEV_SHADOW, SEV_WARN, } from './snapshot.js';
-export type { Decision, Rule, RuleSubject, Severity, SnapshotState } from './snapshot.js';
+export type { Decision, LoadSnapshotOptions, Rule, RuleSubject, Severity, SnapshotState } from './snapshot.js';
 export type { SsoGroupClearance, SsoGroupPolicy, SsoGroupRecord } from './ssoGroups.js';
 export type { McpAllowlistRecord, McpRegistryRecord } from './mcpRegistryRecord.js';
+export type { DecidePin, DecideRecord, DecideStamp } from './decideRecord.js';
+export type { DecideBand, DecideQuestion, DecideRule } from './decide.js';
+export { decide } from './decideApi.js';
+export { DecideEngineError } from './decideEngine.js';
+export type { DecideEngineConfig, DecideEngineErrorCode } from './decideEngine.js';
+export type { DecideSdkAnswer, DecideSdkOptions, DecideSdkResult } from './decideSdk.js';
 export { firstMatch, parseRules, ruleMatches, serialiseToolInput, supportsArgPatterns, fetchRules, fetchRegister, parseRegister, ACTION_BLOCK, ACTION_WARN, ACTION_APPROVAL, } from './soprules.js';
 export type { SopRegister, SopRule } from './soprules.js';
-export { wrapTool, wrapTools } from './wrapTools.js';
+export { toolOutcomeOf, wrapTool, wrapTools } from './wrapTools.js';
 export type { AnyFn, ExecutableTool, WrapToolOptions } from './wrapTools.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAElE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACrH,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE/D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAExF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEvG,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAEzF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEvF,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAEnF,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,aAAa,EACb,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAEzD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACpD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAElE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC5I,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE/D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAExF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,yBAAyB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAC5G,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACnE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACrF,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACvE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEvG,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,QAAQ,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE9G,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEvF,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAEnF,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC7E,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAClF,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAExF,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,aAAa,EACb,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAEzD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACnE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/index.js

@@ -9,13 +9,15 @@
  */
 export { classify, isDeploy, isTest, touchesInfra } from './actions.js';
 export { GateClient } from './client.js';
-export { GateError, GateConnectionError, IntuticGateHold, IntuticGateRefusal, GATE_REFUSAL_CODES } from './errors.js';
+export { GateError, GateConnectionError, IntuticGateEscalation, IntuticGateHold, IntuticGateRefusal, GATE_REFUSAL_CODES } from './errors.js';
 export { canonicalJson, holdKey, holdMessage } from './hold.js';
 export { COMMAND_SIZE_LIMIT, ARGUMENTS_SIZE_LIMIT, GATE_DEADLINE_MS } from './limits.js';
-export { Gate, READ_ONLY_TOOLS, install, active } from './gate.js';
+export { Gate, READ_ONLY_TOOLS, CAN_EVALUATE_RULE_RECORDS, PLAN_CACHE_MS, install, active } from './gate.js';
 export { intuticHeaders } from './headers.js';
 export { checkCommand, checkImages, checkWrittenManifest, isDeployCommand, isPinned, manifestPathsFromCommand, parseImageRef, verdictReason, } from './imagecheck.js';
 export { Snapshot, evaluate, guardDisabledFromEnv, loadSnapshot, snapshotPath, SEV_BLOCK, SEV_HOLD, SEV_SHADOW, SEV_WARN, } from './snapshot.js';
+export { decide } from './decideApi.js';
+export { DecideEngineError } from './decideEngine.js';
 export { firstMatch, parseRules, ruleMatches, serialiseToolInput, supportsArgPatterns, fetchRules, fetchRegister, parseRegister, ACTION_BLOCK, ACTION_WARN, ACTION_APPROVAL, } from './soprules.js';
-export { wrapTool, wrapTools } from './wrapTools.js';
+export { toolOutcomeOf, wrapTool, wrapTools } from './wrapTools.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAGrH,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE/D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAExF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG7C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;AAOtB,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,aAAa,EACb,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAG5I,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE/D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAExF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,yBAAyB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAM5G,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG7C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,UAAU,EACV,QAAQ,GACT,MAAM,eAAe,CAAA;AAStB,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAIrD,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,aAAa,EACb,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/lanes.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Reversibility lanes: every action token's class, the tokens a
+ * set of SOPs and the workspace close, and the hold rules a closed token
+ * compiles to.
+ *
+ * | Class | Tokens |
+ * |---|---|
+ * | `reversible_contained` | `run_tests`, `secret_read`, `pii_export` |
+ * | `reversible_wide` | `deploy`, `release`, `db_write`, `http_post`, `migrate`, `prod_write` |
+ * | `irreversible` | `publish`, `destroy`, `force_push`, `payment` |
+ *
+ * Only `irreversible` and `reversible_wide` can be closed. A closed token is
+ * held for a person (the existing hold, decision and bypass path), never
+ * refused outright, except with no control plane, where a hold compiles to a
+ * block because nobody could approve it.
+ *
+ * {@link laneHoldTokens} is the rule (`collect_lane_holds` in the proxy's
+ * sops.rs mirrors it):
+ *
+ * 1. each applicable SOP that declares `closed_lanes:` closes the tokens of
+ *    the classes it lists, plus every `reversible_wide` token when its
+ *    `risk_tier` is HIGH or CRITICAL, minus its own top-level `open_actions:`;
+ * 2. the workspace setting `closedLanes` closes its classes for everyone,
+ *    and `open_actions:` does not reopen them;
+ * 3. the union.
+ *
+ * `risk_tier` alone closes nothing.
+ *
+ * Self-contained, so `@intutic/gate` keeps a byte-identical copy. The Python
+ * port is in `intutic_clawde/gate/actions.py`; `fixtures/lane-vectors.json`
+ * holds the ports and the proxy's `token_class()` equal.
+ *
+ * @module
+ */
+/** A token's reversibility class. */
+export type LaneClass = 'irreversible' | 'reversible_wide' | 'reversible_contained';
+/** The classes `closed_lanes:` and `closedLanes` may name. */
+export type ClosableLane = 'irreversible' | 'reversible_wide';
+export declare const CLOSABLE_LANES: readonly ClosableLane[];
+/** Every action token's class, in the order of `ACTION_TOKENS` (guardrailIr.ts). */
+export declare const TOKEN_CLASS: Readonly<Record<string, LaneClass>>;
+/**
+ * The phrases a phrase-subject hold rule matches a token by: the classifier's
+ * needles (gate-js `actions.ts`, held equal by a test). A token with none
+ * (`secret_read` and `pii_export` read path fragments) is held by its action
+ * subject only. `force_push` is a compound (the `git push` phrase and a
+ * whole-word `--force` or `-f`); its phrases here are the partial form an
+ * older gate can match.
+ */
+export declare const LANE_PHRASES: Readonly<Record<string, readonly string[]>>;
+/** A token's class, or null for a tool name or an unknown token. */
+export declare function tokenLane(token: string): LaneClass | null;
+/** The tokens of one class, in {@link TOKEN_CLASS} order. */
+export declare function tokensOfClass(cls: LaneClass): string[];
+/** The strongest class among `tokens` (irreversible, then reversible_wide, then reversible_contained), or null when none has one. The decide log's `lane`. */
+export declare function laneOf(tokens: readonly string[]): LaneClass | null;
+/** One applicable SOP as {@link laneHoldTokens} reads it: its parsed `closed_lanes:`, top-level `open_actions:` and `risk_tier:`. */
+export interface LaneSop {
+    closedLanes: readonly string[];
+    openActions: readonly string[];
+    /** `LOW`, `MEDIUM`, `HIGH` or `CRITICAL` in any case; null or absent when unstated. */
+    riskTier?: string | null;
+}
+/**
+ * The tokens held for review: each SOP's closed classes (and, at HIGH or
+ * CRITICAL, `reversible_wide`) minus its own `open_actions:`, united with
+ * the workspace's `closedLanes`. In {@link TOKEN_CLASS} order, each once. An
+ * unknown class closes nothing (the parser already reported it).
+ */
+export declare function laneHoldTokens(input: {
+    sops: readonly LaneSop[];
+    workspaceLanes?: readonly string[] | null;
+}): string[];
+/** A lane hold rule's id: `sop.lane.<class>.<token>`. */
+export declare function laneHoldRuleId(token: string): string;
+/** A revert hold rule's id: `revert.<subject>`. */
+export declare function revertHoldRuleId(subject: string): string;
+/** One snapshot rule a token's hold compiles to; the writer adds the id, severity, reason and rationale. */
+export interface HoldPatternSpec {
+    subject: 'phrase' | 'action';
+    source: string;
+    ignoreCase: boolean;
+}
+/**
+ * The snapshot rules that hold `token`, all under one id so one approval
+ * covers each: the `phrase` rule over its phrases, which every gate since
+ * v12 reads (so a gate whose classifier predates the token still holds it);
+ * and, for a token whose phrases cannot express it (`force_push`'s
+ * compound, `destroy`'s `rm -rf` outside the tree, the path-fragment
+ * tokens), an `action` rule a v23 classifier matches. `force_push` lists the
+ * action rule first, and its phrase rule is the partial form.
+ */
+export declare function laneHoldPatterns(token: string): HoldPatternSpec[];
+//# sourceMappingURL=lanes.d.ts.map

package/dist/lanes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lanes.d.ts","sourceRoot":"","sources":["../src/lanes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,qCAAqC;AACrC,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,iBAAiB,GAAG,sBAAsB,CAAA;AACnF,8DAA8D;AAC9D,MAAM,MAAM,YAAY,GAAG,cAAc,GAAG,iBAAiB,CAAA;AAC7D,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAAwC,CAAA;AAE1F,oFAAoF;AACpF,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAc3D,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAYpE,CAAA;AAED,oEAAoE;AACpE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEzD;AAED,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,CAEtD;AAED,8JAA8J;AAC9J,wBAAgB,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,CASlE;AAED,qIAAqI;AACrI,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,SAAS,OAAO,EAAE,CAAC;IAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;CAAE,GAAG,MAAM,EAAE,CAiBvH;AAED,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,4GAA4G;AAC5G,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,OAAO,CAAA;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,EAAE,CAOjE"}

package/dist/lanes.js

@@ -0,0 +1,150 @@
+/**
+ * Reversibility lanes: every action token's class, the tokens a
+ * set of SOPs and the workspace close, and the hold rules a closed token
+ * compiles to.
+ *
+ * | Class | Tokens |
+ * |---|---|
+ * | `reversible_contained` | `run_tests`, `secret_read`, `pii_export` |
+ * | `reversible_wide` | `deploy`, `release`, `db_write`, `http_post`, `migrate`, `prod_write` |
+ * | `irreversible` | `publish`, `destroy`, `force_push`, `payment` |
+ *
+ * Only `irreversible` and `reversible_wide` can be closed. A closed token is
+ * held for a person (the existing hold, decision and bypass path), never
+ * refused outright, except with no control plane, where a hold compiles to a
+ * block because nobody could approve it.
+ *
+ * {@link laneHoldTokens} is the rule (`collect_lane_holds` in the proxy's
+ * sops.rs mirrors it):
+ *
+ * 1. each applicable SOP that declares `closed_lanes:` closes the tokens of
+ *    the classes it lists, plus every `reversible_wide` token when its
+ *    `risk_tier` is HIGH or CRITICAL, minus its own top-level `open_actions:`;
+ * 2. the workspace setting `closedLanes` closes its classes for everyone,
+ *    and `open_actions:` does not reopen them;
+ * 3. the union.
+ *
+ * `risk_tier` alone closes nothing.
+ *
+ * Self-contained, so `@intutic/gate` keeps a byte-identical copy. The Python
+ * port is in `intutic_clawde/gate/actions.py`; `fixtures/lane-vectors.json`
+ * holds the ports and the proxy's `token_class()` equal.
+ *
+ * @module
+ */
+export const CLOSABLE_LANES = ['irreversible', 'reversible_wide'];
+/** Every action token's class, in the order of `ACTION_TOKENS` (guardrailIr.ts). */
+export const TOKEN_CLASS = {
+    'action:deploy': 'reversible_wide',
+    'action:publish': 'irreversible',
+    'action:release': 'reversible_wide',
+    'action:db_write': 'reversible_wide',
+    'action:secret_read': 'reversible_contained',
+    'action:http_post': 'reversible_wide',
+    'action:pii_export': 'reversible_contained',
+    'action:run_tests': 'reversible_contained',
+    'action:migrate': 'reversible_wide',
+    'action:prod_write': 'reversible_wide',
+    'action:destroy': 'irreversible',
+    'action:force_push': 'irreversible',
+    'action:payment': 'irreversible',
+};
+/**
+ * The phrases a phrase-subject hold rule matches a token by: the classifier's
+ * needles (gate-js `actions.ts`, held equal by a test). A token with none
+ * (`secret_read` and `pii_export` read path fragments) is held by its action
+ * subject only. `force_push` is a compound (the `git push` phrase and a
+ * whole-word `--force` or `-f`); its phrases here are the partial form an
+ * older gate can match.
+ */
+export const LANE_PHRASES = {
+    'action:deploy': ['git push', 'kubectl apply', 'kubectl rollout', 'helm upgrade', 'helm install', 'terraform apply', 'docker push', 'serverless deploy', 'fly deploy', 'vercel deploy', 'gcloud run deploy', 'aws deploy', 'aws s3 sync', 'eb deploy'],
+    'action:publish': ['npm publish', 'pnpm publish', 'yarn publish', 'cargo publish', 'twine upload', 'poetry publish', 'gem push', 'docker manifest push'],
+    'action:release': ['gh release create', 'git tag', 'npm version', 'cargo release', 'goreleaser release', 'semantic-release'],
+    'action:db_write': ['insert into', 'update ', 'delete from', 'drop table', 'drop database', 'drop schema', 'truncate ', 'alter table'],
+    'action:http_post': ['curl -x post', 'curl --request post', 'curl -d ', 'curl --data', 'wget --post', 'http post'],
+    'action:run_tests': ['npm test', 'npm run test', 'pnpm test', 'pnpm run test', 'yarn test', 'cargo test', 'go test', 'pytest', 'python -m pytest', 'vitest', 'jest', 'mocha', 'rspec', 'phpunit', 'make test', 'gradle test', 'mvn test', 'dotnet test', 'bazel test', 'tox'],
+    'action:migrate': ['prisma migrate deploy', 'prisma db push', 'alembic upgrade', 'alembic downgrade', 'rails db:migrate', 'rake db:migrate', 'manage.py migrate', 'flyway migrate', 'liquibase update', 'knex migrate:latest', 'sequelize db:migrate'],
+    'action:prod_write': ['--prod', 'rails_env=production', 'node_env=production', '--context prod', '--namespace production', '-n production', '--environment production', '--stage prod'],
+    'action:destroy': ['terraform destroy', 'kubectl delete', 'helm uninstall', 'helm delete', 'drop table', 'drop database', 'drop schema', 'truncate ', 'aws s3 rb', 'aws s3 rm'],
+    'action:force_push': ['git push --force', 'git push -f'],
+    'action:payment': ['api.stripe.com/v1/charges', 'api.stripe.com/v1/payment_intents', 'api.stripe.com/v1/transfers', 'api.stripe.com/v1/payouts', 'api.stripe.com/v1/refunds', 'stripe charges create', 'stripe payment_intents create', 'stripe transfers create', 'stripe payouts create', 'api-m.paypal.com/v2/payments', 'api.paypal.com/v1/payments'],
+};
+/** A token's class, or null for a tool name or an unknown token. */
+export function tokenLane(token) {
+    return Object.prototype.hasOwnProperty.call(TOKEN_CLASS, token) ? TOKEN_CLASS[token] : null;
+}
+/** The tokens of one class, in {@link TOKEN_CLASS} order. */
+export function tokensOfClass(cls) {
+    return Object.keys(TOKEN_CLASS).filter((t) => TOKEN_CLASS[t] === cls);
+}
+/** The strongest class among `tokens` (irreversible, then reversible_wide, then reversible_contained), or null when none has one. The decide log's `lane`. */
+export function laneOf(tokens) {
+    let best = null;
+    for (const t of tokens) {
+        const c = tokenLane(t);
+        if (c === 'irreversible')
+            return c;
+        if (c === 'reversible_wide')
+            best = c;
+        else if (c === 'reversible_contained' && best === null)
+            best = c;
+    }
+    return best;
+}
+/**
+ * The tokens held for review: each SOP's closed classes (and, at HIGH or
+ * CRITICAL, `reversible_wide`) minus its own `open_actions:`, united with
+ * the workspace's `closedLanes`. In {@link TOKEN_CLASS} order, each once. An
+ * unknown class closes nothing (the parser already reported it).
+ */
+export function laneHoldTokens(input) {
+    const held = {};
+    for (const sop of input.sops) {
+        if (sop.closedLanes.length === 0)
+            continue;
+        const tier = (sop.riskTier ?? '').toUpperCase();
+        const classes = sop.closedLanes.slice();
+        if (tier === 'HIGH' || tier === 'CRITICAL')
+            classes.push('reversible_wide');
+        for (const token of Object.keys(TOKEN_CLASS)) {
+            const c = TOKEN_CLASS[token];
+            if (c !== 'reversible_contained' && classes.indexOf(c) !== -1 && sop.openActions.indexOf(token) === -1)
+                held[token] = true;
+        }
+    }
+    for (const token of Object.keys(TOKEN_CLASS)) {
+        const c = TOKEN_CLASS[token];
+        if (c !== 'reversible_contained' && (input.workspaceLanes ?? []).indexOf(c) !== -1)
+            held[token] = true;
+    }
+    return Object.keys(TOKEN_CLASS).filter((t) => held[t] === true);
+}
+/** A lane hold rule's id: `sop.lane.<class>.<token>`. */
+export function laneHoldRuleId(token) {
+    return 'sop.lane.' + (tokenLane(token) ?? 'unknown') + '.' + token;
+}
+/** A revert hold rule's id: `revert.<subject>`. */
+export function revertHoldRuleId(subject) {
+    return 'revert.' + subject;
+}
+/**
+ * The snapshot rules that hold `token`, all under one id so one approval
+ * covers each: the `phrase` rule over its phrases, which every gate since
+ * v12 reads (so a gate whose classifier predates the token still holds it);
+ * and, for a token whose phrases cannot express it (`force_push`'s
+ * compound, `destroy`'s `rm -rf` outside the tree, the path-fragment
+ * tokens), an `action` rule a v23 classifier matches. `force_push` lists the
+ * action rule first, and its phrase rule is the partial form.
+ */
+export function laneHoldPatterns(token) {
+    const action = { subject: 'action', source: ' (' + token.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + ') ', ignoreCase: true };
+    const phrases = Object.prototype.hasOwnProperty.call(LANE_PHRASES, token) ? LANE_PHRASES[token] : [];
+    const phrase = phrases.length > 0 ? { subject: 'phrase', source: phrases.join('|'), ignoreCase: true } : null;
+    if (token === 'action:force_push')
+        return [action, phrase];
+    if (token === 'action:destroy')
+        return [phrase, action];
+    return phrase ? [phrase] : [action];
+}
+//# sourceMappingURL=lanes.js.map

package/dist/lanes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lanes.js","sourceRoot":"","sources":["../src/lanes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAMH,MAAM,CAAC,MAAM,cAAc,GAA4B,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;AAE1F,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAwC;IAC9D,eAAe,EAAE,iBAAiB;IAClC,gBAAgB,EAAE,cAAc;IAChC,gBAAgB,EAAE,iBAAiB;IACnC,iBAAiB,EAAE,iBAAiB;IACpC,oBAAoB,EAAE,sBAAsB;IAC5C,kBAAkB,EAAE,iBAAiB;IACrC,mBAAmB,EAAE,sBAAsB;IAC3C,kBAAkB,EAAE,sBAAsB;IAC1C,gBAAgB,EAAE,iBAAiB;IACnC,mBAAmB,EAAE,iBAAiB;IACtC,gBAAgB,EAAE,cAAc;IAChC,mBAAmB,EAAE,cAAc;IACnC,gBAAgB,EAAE,cAAc;CACjC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAgD;IACvE,eAAe,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,CAAC;IACtP,gBAAgB,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,sBAAsB,CAAC;IACxJ,gBAAgB,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,CAAC;IAC5H,iBAAiB,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,CAAC;IACtI,kBAAkB,EAAE,CAAC,cAAc,EAAE,qBAAqB,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,CAAC;IAClH,kBAAkB,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC;IAC7Q,gBAAgB,EAAE,CAAC,uBAAuB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,sBAAsB,CAAC;IACtP,mBAAmB,EAAE,CAAC,QAAQ,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,eAAe,EAAE,0BAA0B,EAAE,cAAc,CAAC;IACvL,gBAAgB,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC;IAC/K,mBAAmB,EAAE,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACxD,gBAAgB,EAAE,CAAC,2BAA2B,EAAE,mCAAmC,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,+BAA+B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,4BAA4B,CAAC;CAC1V,CAAA;AAED,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9F,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAA;AACvE,CAAC;AAED,8JAA8J;AAC9J,MAAM,UAAU,MAAM,CAAC,MAAyB;IAC9C,IAAI,IAAI,GAAqB,IAAI,CAAA;IACjC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,CAAC,KAAK,cAAc;YAAE,OAAO,CAAC,CAAA;QAClC,IAAI,CAAC,KAAK,iBAAiB;YAAE,IAAI,GAAG,CAAC,CAAA;aAChC,IAAI,CAAC,KAAK,sBAAsB,IAAI,IAAI,KAAK,IAAI;YAAE,IAAI,GAAG,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAA8E;IAC3G,MAAM,IAAI,GAAyB,EAAE,CAAA;IACrC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC1C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,CAAA;QACvC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC3E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAE,CAAA;YAC7B,IAAI,CAAC,KAAK,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;QAC5H,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAE,CAAA;QAC7B,IAAI,CAAC,KAAK,sBAAsB,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;IACxG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;AACjE,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,WAAW,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,GAAG,GAAG,KAAK,CAAA;AACpE,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,SAAS,GAAG,OAAO,CAAA;AAC5B,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,MAAM,GAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IAC3I,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACrG,MAAM,MAAM,GAA2B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACrI,IAAI,KAAK,KAAK,mBAAmB;QAAE,OAAO,CAAC,MAAM,EAAE,MAAO,CAAC,CAAA;IAC3D,IAAI,KAAK,KAAK,gBAAgB;QAAE,OAAO,CAAC,MAAO,EAAE,MAAM,CAAC,CAAA;IACxD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AACrC,CAAC"}

package/dist/limits.d.ts

@@ -17,6 +17,12 @@ export declare const HOOK_TIMEOUT_SECONDS = 10;
 export declare const GATE_DEADLINE_MARGIN_MS = 1000;
 /** How long the hook script the sandbox bootstrap writes may run, from process start, before it refuses. */
 export declare const GATE_DEADLINE_MS: number;
+/**
+ * How long the decide tier may spend on one call unless
+ * `INTUTIC_DECIDE_BUDGET_MS` says otherwise: a JavaScript hook gate's budget
+ * under a 10 s timeout (`DECIDE_SDK_BUDGET_MS` in gateLimits.ts).
+ */
+export declare const DECIDE_BUDGET_MS = 7300;
 /**
  * Why a call is too large to evaluate, or null. Counts the command and the
  * compact JSON of the arguments in UTF-8 bytes; arguments that do not

package/dist/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,QAAa,CAAA;AAE5C,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,QAAc,CAAA;AAE/C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAEtC,uHAAuH;AACvH,eAAO,MAAM,uBAAuB,OAAO,CAAA;AAE3C,4GAA4G;AAC5G,eAAO,MAAM,gBAAgB,QAAwD,CAAA;AAErF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAsBjF"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,QAAa,CAAA;AAE5C,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,QAAc,CAAA;AAE/C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAEtC,uHAAuH;AACvH,eAAO,MAAM,uBAAuB,OAAO,CAAA;AAE3C,4GAA4G;AAC5G,eAAO,MAAM,gBAAgB,QAAwD,CAAA;AAErF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,OAAO,CAAA;AAEpC;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAsBjF"}

package/dist/limits.js

@@ -17,6 +17,12 @@ export const HOOK_TIMEOUT_SECONDS = 10;
 export const GATE_DEADLINE_MARGIN_MS = 1000;
 /** How long the hook script the sandbox bootstrap writes may run, from process start, before it refuses. */
 export const GATE_DEADLINE_MS = HOOK_TIMEOUT_SECONDS * 1000 - GATE_DEADLINE_MARGIN_MS;
+/**
+ * How long the decide tier may spend on one call unless
+ * `INTUTIC_DECIDE_BUDGET_MS` says otherwise: a JavaScript hook gate's budget
+ * under a 10 s timeout (`DECIDE_SDK_BUDGET_MS` in gateLimits.ts).
+ */
+export const DECIDE_BUDGET_MS = 7300;
 /**
  * Why a call is too large to evaluate, or null. Counts the command and the
  * compact JSON of the arguments in UTF-8 bytes; arguments that do not

package/dist/limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAA;AAE5C,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAA;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAEtC,uHAAuH;AACvH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAE3C,4GAA4G;AAC5G,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,IAAI,GAAG,uBAAuB,CAAA;AAErF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,SAAkB;IAChE,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvD,IAAI,YAAY,GAAG,kBAAkB,EAAE,CAAC;QACtC,OAAO,CACL,qCAAqC,YAAY,oBAAoB,kBAAkB,QAAQ;YAC/F,wDAAwD,CACzD,CAAA;IACH,CAAC;IACD,IAAI,IAAwB,CAAA;IAC5B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC9E,IAAI,aAAa,GAAG,oBAAoB,EAAE,CAAC;QACzC,OAAO,CACL,6CAA6C,aAAa,mBAAmB;YAC7E,GAAG,oBAAoB,kEAAkE,CAC1F,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAA;AAE5C,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAA;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAEtC,uHAAuH;AACvH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAE3C,4GAA4G;AAC5G,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,IAAI,GAAG,uBAAuB,CAAA;AAErF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAEpC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,SAAkB;IAChE,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACvD,IAAI,YAAY,GAAG,kBAAkB,EAAE,CAAC;QACtC,OAAO,CACL,qCAAqC,YAAY,oBAAoB,kBAAkB,QAAQ;YAC/F,wDAAwD,CACzD,CAAA;IACH,CAAC;IACD,IAAI,IAAwB,CAAA;IAC5B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC9E,IAAI,aAAa,GAAG,oBAAoB,EAAE,CAAC;QACzC,OAAO,CACL,6CAA6C,aAAa,mBAAmB;YAC7E,GAAG,oBAAoB,kEAAkE,CAC1F,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/refusalDetail.d.ts

@@ -0,0 +1,58 @@
+/**
+ * What a refusal says about where to retry: its `scope` (the
+ * paths, tools, step, detector or rule it concerns) and its `evidence` (what
+ * the refuser saw), bounded the same way on every surface.
+ *
+ * - Each list holds at most {@link REFUSAL_DETAIL_MAX_ITEMS} items, and each
+ *   string at most {@link REFUSAL_DETAIL_MAX_CHARS} characters (code points),
+ *   with C0 control characters (U+0000 to U+001F) removed first. A string
+ *   that is empty after that is dropped; an empty list is left out; a scope
+ *   with nothing left is null.
+ * - In an OPAQUE workspace both are dropped, and so is the stderr retry line:
+ *   only the refusal code survives, as with the reason
+ *   (`OPAQUE_REFUSAL_MESSAGE`). SILENT_LOG behaves as TRANSPARENT.
+ *
+ * Self-contained, so `@intutic/gate` keeps a byte-identical copy. The Python
+ * port is `intutic_clawde/gate/refusal_detail.py`, the Rust one is in the
+ * proxy's `refusal.rs`; all run `fixtures/refusal-detail-vectors.json`.
+ *
+ * @module
+ */
+/** Where a refusal applies, so a retry can stay out of it. */
+export interface RefusalScope {
+    paths?: string[];
+    tools?: string[];
+    step?: string;
+    detector?: string;
+    rule?: string;
+}
+/** One thing the refuser saw. */
+export interface RefusalEvidence {
+    kind: string;
+    detail: string;
+}
+export declare const REFUSAL_DETAIL_MAX_ITEMS = 8;
+export declare const REFUSAL_DETAIL_MAX_CHARS = 256;
+/** The stderr line an exit-code harness prints after the reason. */
+export declare const RETRY_SCOPE_PREFIX = "[Intutic] Retry scope: ";
+/** A scope bounded as the module doc says, keys in a fixed order; null when nothing is left. */
+export declare function boundRefusalScope(scope: unknown): RefusalScope | null;
+/** Evidence bounded: at most 8 items, each with a `kind` and a `detail` that survive bounding. */
+export declare function boundRefusalEvidence(evidence: unknown): RefusalEvidence[];
+/**
+ * The detail a refusal carries in `mode` (an intervention mode): nothing in
+ * OPAQUE; otherwise the bounded scope and evidence, each left out when empty.
+ */
+export declare function refusalDetailForMode(mode: string | null | undefined, scope: unknown, evidence: unknown): {
+    scope?: RefusalScope;
+    evidence?: RefusalEvidence[];
+};
+/**
+ * The stderr line an exit-code harness gets after the reason:
+ * `[Intutic] Retry scope: <paths, else tools, comma-separated>`, or null when
+ * the scope names neither, or in OPAQUE.
+ */
+export declare function retryScopeLine(mode: string | null | undefined, scope: unknown): string | null;
+/** The functions above as JavaScript source, for the hook gates to embed. */
+export declare const REFUSAL_DETAIL_JS_SOURCE: string;
+//# sourceMappingURL=refusalDetail.d.ts.map

package/dist/refusalDetail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusalDetail.d.ts","sourceRoot":"","sources":["../src/refusalDetail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;CACf;AAED,eAAO,MAAM,wBAAwB,IAAI,CAAA;AACzC,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAC3C,oEAAoE;AACpE,eAAO,MAAM,kBAAkB,4BAA4B,CAAA;AAuB3D,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAerE;AAED,kGAAkG;AAClG,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,eAAe,EAAE,CAWzE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG;IAAE,KAAK,CAAC,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAA;CAAE,CAQ/J;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAK7F;AAED,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB,QAExB,CAAA"}

package/dist/refusalDetail.js

@@ -0,0 +1,121 @@
+/**
+ * What a refusal says about where to retry: its `scope` (the
+ * paths, tools, step, detector or rule it concerns) and its `evidence` (what
+ * the refuser saw), bounded the same way on every surface.
+ *
+ * - Each list holds at most {@link REFUSAL_DETAIL_MAX_ITEMS} items, and each
+ *   string at most {@link REFUSAL_DETAIL_MAX_CHARS} characters (code points),
+ *   with C0 control characters (U+0000 to U+001F) removed first. A string
+ *   that is empty after that is dropped; an empty list is left out; a scope
+ *   with nothing left is null.
+ * - In an OPAQUE workspace both are dropped, and so is the stderr retry line:
+ *   only the refusal code survives, as with the reason
+ *   (`OPAQUE_REFUSAL_MESSAGE`). SILENT_LOG behaves as TRANSPARENT.
+ *
+ * Self-contained, so `@intutic/gate` keeps a byte-identical copy. The Python
+ * port is `intutic_clawde/gate/refusal_detail.py`, the Rust one is in the
+ * proxy's `refusal.rs`; all run `fixtures/refusal-detail-vectors.json`.
+ *
+ * @module
+ */
+export const REFUSAL_DETAIL_MAX_ITEMS = 8;
+export const REFUSAL_DETAIL_MAX_CHARS = 256;
+/** The stderr line an exit-code harness prints after the reason. */
+export const RETRY_SCOPE_PREFIX = '[Intutic] Retry scope: ';
+/** `s` without C0 control characters, cut to 256 code points; null when nothing is left or it is not a string. */
+function refusalDetailText(s) {
+    if (typeof s !== 'string')
+        return null;
+    // eslint-disable-next-line no-control-regex -- removing control characters is the point
+    const clean = Array.from(s.replace(/[\u0000-\u001f]/g, ''));
+    if (clean.length === 0)
+        return null;
+    return clean.slice(0, 256).join('');
+}
+/** A list of strings, bounded: the first 8 that survive {@link refusalDetailText}. */
+function refusalDetailList(v) {
+    if (!Array.isArray(v))
+        return null;
+    const out = [];
+    for (const item of v) {
+        if (out.length >= 8)
+            break;
+        const t = refusalDetailText(item);
+        if (t !== null)
+            out.push(t);
+    }
+    return out.length > 0 ? out : null;
+}
+/** A scope bounded as the module doc says, keys in a fixed order; null when nothing is left. */
+export function boundRefusalScope(scope) {
+    if (scope === null || typeof scope !== 'object' || Array.isArray(scope))
+        return null;
+    const s = scope;
+    const out = {};
+    const paths = refusalDetailList(s.paths);
+    if (paths)
+        out.paths = paths;
+    const tools = refusalDetailList(s.tools);
+    if (tools)
+        out.tools = tools;
+    const step = refusalDetailText(s.step);
+    if (step !== null)
+        out.step = step;
+    const detector = refusalDetailText(s.detector);
+    if (detector !== null)
+        out.detector = detector;
+    const rule = refusalDetailText(s.rule);
+    if (rule !== null)
+        out.rule = rule;
+    return Object.keys(out).length > 0 ? out : null;
+}
+/** Evidence bounded: at most 8 items, each with a `kind` and a `detail` that survive bounding. */
+export function boundRefusalEvidence(evidence) {
+    const out = [];
+    if (!Array.isArray(evidence))
+        return out;
+    for (const item of evidence) {
+        if (out.length >= 8)
+            break;
+        if (item === null || typeof item !== 'object' || Array.isArray(item))
+            continue;
+        const kind = refusalDetailText(item.kind);
+        const detail = refusalDetailText(item.detail);
+        if (kind !== null && detail !== null)
+            out.push({ kind, detail });
+    }
+    return out;
+}
+/**
+ * The detail a refusal carries in `mode` (an intervention mode): nothing in
+ * OPAQUE; otherwise the bounded scope and evidence, each left out when empty.
+ */
+export function refusalDetailForMode(mode, scope, evidence) {
+    if (mode === 'OPAQUE')
+        return {};
+    const out = {};
+    const s = boundRefusalScope(scope);
+    if (s)
+        out.scope = s;
+    const e = boundRefusalEvidence(evidence);
+    if (e.length > 0)
+        out.evidence = e;
+    return out;
+}
+/**
+ * The stderr line an exit-code harness gets after the reason:
+ * `[Intutic] Retry scope: <paths, else tools, comma-separated>`, or null when
+ * the scope names neither, or in OPAQUE.
+ */
+export function retryScopeLine(mode, scope) {
+    if (mode === 'OPAQUE')
+        return null;
+    const s = boundRefusalScope(scope);
+    const items = s?.paths ?? s?.tools;
+    return items ? '[Intutic] Retry scope: ' + items.join(', ') : null;
+}
+/** The functions above as JavaScript source, for the hook gates to embed. */
+export const REFUSAL_DETAIL_JS_SOURCE = [refusalDetailText, refusalDetailList, boundRefusalScope, boundRefusalEvidence, refusalDetailForMode, retryScopeLine]
+    .map((fn) => fn.toString().replace(/\bexports\./g, ''))
+    .join('\n');
+//# sourceMappingURL=refusalDetail.js.map

package/dist/refusalDetail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusalDetail.js","sourceRoot":"","sources":["../src/refusalDetail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiBH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AACzC,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAC3C,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAA;AAE3D,kHAAkH;AAClH,SAAS,iBAAiB,CAAC,CAAU;IACnC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACtC,wFAAwF;IACxF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAA;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACrC,CAAC;AAED,sFAAsF;AACtF,SAAS,iBAAiB,CAAC,CAAU;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;YAAE,MAAK;QAC1B,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,MAAM,GAAG,GAAiB,EAAE,CAAA;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACxC,IAAI,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAA;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACxC,IAAI,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAA;IAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,IAAI,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,QAAQ,KAAK,IAAI;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC9C,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,IAAI,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,oBAAoB,CAAC,QAAiB;IACpD,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;YAAE,MAAK;QAC1B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC9E,MAAM,IAAI,GAAG,iBAAiB,CAAE,IAAgC,CAAC,IAAI,CAAC,CAAA;QACtE,MAAM,MAAM,GAAG,iBAAiB,CAAE,IAAgC,CAAC,MAAM,CAAC,CAAA;QAC1E,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA+B,EAAE,KAAc,EAAE,QAAiB;IACrG,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAChC,MAAM,GAAG,GAA2D,EAAE,CAAA;IACtE,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,CAAC;QAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAA;IACpB,MAAM,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAA;IAClC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAA+B,EAAE,KAAc;IAC5E,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,CAAA;IAClC,OAAO,KAAK,CAAC,CAAC,CAAC,yBAAyB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACpE,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,cAAc,CAAC;KAC1J,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;KACtD,IAAI,CAAC,IAAI,CAAC,CAAA"}