@intutic/mcp-governance-proxy 2.2.0 → 2.3.0

package/dist/wasm/runner.d.ts

@@ -8,20 +8,25 @@
  * ## Divergences from the Rust runner (all recorded as TD entries)
  *
  * - **Fuel: the same 1,000,000-instruction budget, metered a different
- *   way.** V8 has no fuel hook, so `fuel.ts` rewrites each rule at load to
- *   count its own instructions and trap when the budget runs out (TD-440).
- *   A rule that exhausts it fails open for that call, as under Wasmtime.
- * - **50ms per-rule deadline, not 5ms.** Fuel bounds the guest's own work;
- *   the deadline is the backstop for everything else, and it races a
- *   `postMessage` round trip that pays IPC overhead the in-process Wasmtime
- *   call never did. 50ms, not 5ms, keeps that overhead from
- *   false-positiving a legitimate rule under normal load.
+ *   way.** V8 has no fuel hook, so `wasmFuel.ts` (shared-types) rewrites each rule at load to
+ *   count its own instructions and trap when the budget runs out.
+ *   A rule that exhausts it reaches no verdict, as under Wasmtime.
+ * - **The deadline is a backstop, not the limit.** Fuel is the limit: it is
+ *   deterministic, so a rule within budget is never refused because the
+ *   machine is busy. The deadline catches what fuel cannot see — a bulk
+ *   `memory.fill` costs one instruction whatever its length, a host call
+ *   costs none — and it races a `postMessage` round trip that the
+ *   in-process Wasmtime call never pays. See {@link EVALUATE_TIMEOUT_MS}.
  * - **Guest memory ceiling: the same 16MB, enforced a different way.**
  *   `runner.rs` sets a `StoreLimits` cap; V8 has no such hook, but it does
  *   enforce the maximum a module declares, so `worker.ts` rewrites the
  *   module's memory section to declare 16MB as its maximum before compiling
- *   (`memoryCap.ts`). A `memory.grow` past it returns -1 as it would under
- *   Wasmtime. Not a divergence any more; TD-440 records how it got here.
+ *   (`wasmMemoryCap.ts`). A `memory.grow` past it returns -1 as it would under
+ *   Wasmtime. Not a divergence any more.
+ * - **Rego rules (OPA builds) run through `@intutic/shared-types`' Rego
+ *   host**, with their own instruction budget (`wasmFuel.ts`'s
+ *   `REGO_FUEL_BUDGET`) and deadline (`REGO_EVALUATE_TIMEOUT_MS`), and
+ *   reply with a decision instead of a verdict code — a hold has none.
  * - **`read_referenced_file` is served from a pre-read table**
  *   (`referencedFiles.ts`, the port of `referenced_files.rs`), prefetched
  *   once per `evaluate()` only when a loaded rule imports the function and
@@ -32,6 +37,39 @@
  */
 import { type CompileBridge, type CompileOutcome } from './loader.js';
 import { type WasmContextInput } from './context.js';
+/**
+ * A native rule's deadline: a backstop for stalls the instruction budget
+ * cannot see, set well above the time any rule within budget takes on a busy
+ * machine, because a rule that reaches no verdict refuses the call.
+ *
+ * Measured on a 14-core machine, idle and with 100 busy threads (about the
+ * oversubscription of a 4-vCPU CI runner running every package's suite): the
+ * 1,000,000-instruction budget runs out in at most 2 ms either way, and a
+ * worker round trip for a 60 KB context takes at most 0.5 ms idle and 3.9 ms
+ * loaded. The Rego round trip below shows the loaded machine also stalls a
+ * thread for hundreds of milliseconds, which is what one second covers.
+ */
+export declare const EVALUATE_TIMEOUT_MS = 1000;
+/**
+ * A Rego rule's deadline, on the same reasoning with the Rego budget
+ * (`REGO_FUEL_BUDGET`): the destructive-shell example on the largest input
+ * (64 KB) takes at most 6 ms idle and 430 ms loaded, round trip included, and
+ * a loop using up the whole budget takes up to 350 ms idle and 4.4 s loaded.
+ * Ten seconds is over twice that, so on a loaded machine the budget still
+ * stops a runaway rule first, and only a stall fuel cannot see waits this long.
+ */
+export declare const REGO_EVALUATE_TIMEOUT_MS = 10000;
+/**
+ * Consecutive per-rule runaways (a timeout, or the instruction budget running
+ * out) before that rule is quarantined until the next rescan.
+ */
+export declare const MAX_CONSECUTIVE_RUNAWAYS = 3;
+/**
+ * Why a rule reached no verdict, in the one word a refusal and a log line use
+ * — the Rust proxy's `limits::Stop` — plus `quarantined`: not evaluated at
+ * all, after {@link MAX_CONSECUTIVE_RUNAWAYS} runaways in a row.
+ */
+export type RuleStop = 'deadline' | 'budget' | 'error' | 'result' | 'quarantined';
 export type WasmVerdict = {
     code: 'allow';
 } | {
@@ -42,14 +80,33 @@ export type WasmVerdict = {
     code: 'reask';
     reason: string;
     ruleId: string;
+}
+/** A Rego rule's `hold`: the interceptor puts the call through the decisions API. */
+ | {
+    code: 'hold';
+    reason: string;
+    ruleId: string;
+    riskTier?: string;
+}
+/**
+ * A rule reached no verdict: the call is refused as `GOVERNANCE_UNAVAILABLE`,
+ * whatever the proxy's fail setting (see {@link WasmRunner.evaluate}).
+ */
+ | {
+    code: 'unavailable';
+    reason: string;
+    ruleId: string;
+    stop: RuleStop;
 };
 export declare class WasmRunner implements CompileBridge {
     private readonly loader;
     private worker;
     private nextRequestId;
     private pending;
-    private consecutiveTimeouts;
-    private disabledRuleIds;
+    private consecutiveRunaways;
+    /** The worker replacing one that missed a deadline, while its rules recompile. */
+    private respawning;
+    private quarantined;
     constructor(dirOverride?: string);
     /** The resolved local rules directory, for logging. */
     getDir(): string;
@@ -63,27 +120,54 @@ export declare class WasmRunner implements CompileBridge {
     remove(ruleId: string): void;
     /**
      * Rescans `~/.intutic/wasm/` and (re)compiles anything changed. Also
-     * clears every rule's disabled-by-timeout status — "disable that rule
-     * until the next policy-driven rescan" is this call.
+     * releases every quarantined rule — "quarantined until the next
+     * policy-driven rescan" is this call.
      */
     rescan(): Promise<void>;
-    /** Terminates the worker and respawns a fresh one, resending every currently-loaded rule's bytes so its module cache is rebuilt. */
+    /**
+     * Replaces the worker, resending every currently-loaded rule's bytes so the
+     * new one's module cache is rebuilt, without waiting for the old one to stop.
+     *
+     * `Worker.terminate()` can take seconds: V8 stops a guest only at an
+     * interrupt check, and a loop around a bulk `memory.fill` reaches one
+     * rarely — measured, 1.5 s on an idle machine and 16 s on a loaded one. The
+     * call that missed its deadline is refused at the deadline; the old worker
+     * stops whenever V8 gets to it, and the next evaluation waits only for the
+     * new worker's recompile (`respawning`, about 50 ms for three Rego rules).
+     */
     private respawnWorker;
     /**
-     * Evaluates every currently loaded, non-disabled rule (priority order)
-     * against one context, mirroring `registry.rs`'s `evaluate_inner`:
-     * short-circuit on the first block, carry the first reask through in case
-     * a later, higher-priority rule still blocks, `allow` when nothing fired
-     * or every loaded rule was fail-open (timeout/trap/unmapped code).
+     * Evaluates every currently loaded rule (priority order) against one
+     * context, as `registry.rs`'s `evaluate_inner` does: short-circuit on the
+     * first block, carry the first hold and reask through in case a later rule
+     * still blocks, `allow` when nothing fired.
+     *
+     * A rule that reaches no verdict — its deadline, its instruction budget, a
+     * trap or other error, or a result that is not a verdict — refuses the call
+     * (`unavailable`), whatever `mcpProxyFailBehavior` or
+     * `INTUTIC_MCP_FAIL_OPEN` say. That setting exists for control-plane
+     * outages, which an agent cannot cause; a rule's timeout an agent can cause
+     * by padding its input, so it must never become an allow. The refusal
+     * outranks a hold and a reask, since neither an approval nor a retry can
+     * clear a call a rule never judged; a later rule's block still wins,
+     * because it says what is wrong with the call.
+     *
+     * A quarantined rule (see {@link countRunaway}) refuses at once, without
+     * anything being evaluated, until the next rescan.
      */
     evaluate(input: WasmContextInput): Promise<WasmVerdict>;
     /**
-     * The referenced-files table for this evaluation (TD-441). With no
+     * The referenced-files table for this evaluation. With no
      * `INTUTIC_WASM_MANIFEST_ROOT` the table is empty and every read refuses.
      */
     private prefetchReferencedFiles;
-    /** One rule's evaluation, raced against `EVALUATE_TIMEOUT_MS`. `null` means fail-open (timeout, worker error, or guest trap). */
+    /** One rule's evaluation, raced against its deadline: its answer, or why it reached none. */
     private evaluateOne;
+    /**
+     * Counts one runaway (deadline or budget) against `ruleId`, quarantining
+     * the rule at {@link MAX_CONSECUTIVE_RUNAWAYS} in a row. Logged once, at the
+     * transition; what a quarantined rule means for a call is `evaluate`'s.
+     */
     private countRunaway;
     /** Terminates the worker. Safe to call even if one was never spawned. */
     shutdown(): Promise<void>;

package/dist/wasm/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,OAAO,EAA8B,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAqBtE,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAyCrD,qBAAa,UAAW,YAAW,aAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,aAAa,CAAI;IACzB,OAAO,CAAC,OAAO,CAAkC;IACjD,OAAO,CAAC,mBAAmB,CAA4B;IACvD,OAAO,CAAC,eAAe,CAAoB;gBAE/B,WAAW,CAAC,EAAE,MAAM;IAIhC,uDAAuD;IACvD,MAAM,IAAI,MAAM;IAIhB,yGAAyG;IACzG,gBAAgB,IAAI,MAAM,EAAE;IAI5B,OAAO,CAAC,YAAY;IAmBpB,gFAAgF;IAChF,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,OAAO;IAQT,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAmBzE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ5B;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B,oIAAoI;YACtH,aAAa;IAqB3B;;;;;;OAMG;IACG,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;IAuD7D;;;OAGG;YACW,uBAAuB;IAUrC,iIAAiI;YACnH,WAAW;IA+CzB,OAAO,CAAC,YAAY;IAYpB,yEAAyE;IACnE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAUhC;AAWD,YAAY,EAAE,gBAAgB,EAAE,CAAA"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAOH,OAAO,EAA8B,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAKtF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,OAAQ,CAAA;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAA;AAM9C;;;GAGG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAA;AAEjF,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACnD,qFAAqF;GACnF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE;AACrE;;;GAGG;GACD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAoD3E,qBAAa,UAAW,YAAW,aAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,aAAa,CAAI;IACzB,OAAO,CAAC,OAAO,CAAkC;IACjD,OAAO,CAAC,mBAAmB,CAA4B;IACvD,kFAAkF;IAClF,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,WAAW,CAAoB;gBAE3B,WAAW,CAAC,EAAE,MAAM;IAIhC,uDAAuD;IACvD,MAAM,IAAI,MAAM;IAIhB,yGAAyG;IACzG,gBAAgB,IAAI,MAAM,EAAE;IAI5B,OAAO,CAAC,YAAY;IAmBpB,gFAAgF;IAChF,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,OAAO;IAQT,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0BzE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ5B;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAO7B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IA0BrB;;;;;;;;;;;;;;;;;;OAkBG;IACG,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;IA2G7D;;;OAGG;YACW,uBAAuB;IAUrC,6FAA6F;YAC/E,WAAW;IA8DzB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAYpB,yEAAyE;IACnE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAUhC;AAyBD,YAAY,EAAE,gBAAgB,EAAE,CAAA"}

package/dist/wasm/runner.js

@@ -8,20 +8,25 @@
  * ## Divergences from the Rust runner (all recorded as TD entries)
  *
  * - **Fuel: the same 1,000,000-instruction budget, metered a different
- *   way.** V8 has no fuel hook, so `fuel.ts` rewrites each rule at load to
- *   count its own instructions and trap when the budget runs out (TD-440).
- *   A rule that exhausts it fails open for that call, as under Wasmtime.
- * - **50ms per-rule deadline, not 5ms.** Fuel bounds the guest's own work;
- *   the deadline is the backstop for everything else, and it races a
- *   `postMessage` round trip that pays IPC overhead the in-process Wasmtime
- *   call never did. 50ms, not 5ms, keeps that overhead from
- *   false-positiving a legitimate rule under normal load.
+ *   way.** V8 has no fuel hook, so `wasmFuel.ts` (shared-types) rewrites each rule at load to
+ *   count its own instructions and trap when the budget runs out.
+ *   A rule that exhausts it reaches no verdict, as under Wasmtime.
+ * - **The deadline is a backstop, not the limit.** Fuel is the limit: it is
+ *   deterministic, so a rule within budget is never refused because the
+ *   machine is busy. The deadline catches what fuel cannot see — a bulk
+ *   `memory.fill` costs one instruction whatever its length, a host call
+ *   costs none — and it races a `postMessage` round trip that the
+ *   in-process Wasmtime call never pays. See {@link EVALUATE_TIMEOUT_MS}.
  * - **Guest memory ceiling: the same 16MB, enforced a different way.**
  *   `runner.rs` sets a `StoreLimits` cap; V8 has no such hook, but it does
  *   enforce the maximum a module declares, so `worker.ts` rewrites the
  *   module's memory section to declare 16MB as its maximum before compiling
- *   (`memoryCap.ts`). A `memory.grow` past it returns -1 as it would under
- *   Wasmtime. Not a divergence any more; TD-440 records how it got here.
+ *   (`wasmMemoryCap.ts`). A `memory.grow` past it returns -1 as it would under
+ *   Wasmtime. Not a divergence any more.
+ * - **Rego rules (OPA builds) run through `@intutic/shared-types`' Rego
+ *   host**, with their own instruction budget (`wasmFuel.ts`'s
+ *   `REGO_FUEL_BUDGET`) and deadline (`REGO_EVALUATE_TIMEOUT_MS`), and
+ *   reply with a decision instead of a verdict code — a hold has none.
  * - **`read_referenced_file` is served from a pre-read table**
  *   (`referencedFiles.ts`, the port of `referenced_files.rs`), prefetched
  *   once per `evaluate()` only when a loaded rule imports the function and
@@ -35,22 +40,39 @@ import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { createStderrLogger as createLogger } from '../stderrLog.js';
 import { WasmLoader, resolveWasmDir } from './loader.js';
-import { buildWasmContext } from './context.js';
+import { buildRegoInput, buildWasmContext } from './context.js';
 import { prefetch, resolveRoot, ReferencedFiles } from './referencedFiles.js';
 const log = createLogger('mcp-proxy-wasm-runner');
 /**
- * Per-rule evaluation deadline. See this module's doc comment for why this
- * is 50ms rather than `runner.rs`'s 5ms.
+ * A native rule's deadline: a backstop for stalls the instruction budget
+ * cannot see, set well above the time any rule within budget takes on a busy
+ * machine, because a rule that reaches no verdict refuses the call.
+ *
+ * Measured on a 14-core machine, idle and with 100 busy threads (about the
+ * oversubscription of a 4-vCPU CI runner running every package's suite): the
+ * 1,000,000-instruction budget runs out in at most 2 ms either way, and a
+ * worker round trip for a 60 KB context takes at most 0.5 ms idle and 3.9 ms
+ * loaded. The Rego round trip below shows the loaded machine also stalls a
+ * thread for hundreds of milliseconds, which is what one second covers.
+ */
+export const EVALUATE_TIMEOUT_MS = 1_000;
+/**
+ * A Rego rule's deadline, on the same reasoning with the Rego budget
+ * (`REGO_FUEL_BUDGET`): the destructive-shell example on the largest input
+ * (64 KB) takes at most 6 ms idle and 430 ms loaded, round trip included, and
+ * a loop using up the whole budget takes up to 350 ms idle and 4.4 s loaded.
+ * Ten seconds is over twice that, so on a loaded machine the budget still
+ * stops a runaway rule first, and only a stall fuel cannot see waits this long.
  */
-const EVALUATE_TIMEOUT_MS = 50;
+export const REGO_EVALUATE_TIMEOUT_MS = 10_000;
 /** Generous — compilation is not guest-controlled per evaluation, but a
  *  pathological file must not hang a rescan forever. */
 const COMPILE_TIMEOUT_MS = 3_000;
 /**
  * Consecutive per-rule runaways (a timeout, or the instruction budget running
- * out) before that rule is disabled until the next rescan.
+ * out) before that rule is quarantined until the next rescan.
  */
-const MAX_CONSECUTIVE_TIMEOUTS = 3;
+export const MAX_CONSECUTIVE_RUNAWAYS = 3;
 /**
  * Resolves the worker script to spawn.
  *
@@ -89,8 +111,10 @@ export class WasmRunner {
     worker = null;
     nextRequestId = 1;
     pending = new Map();
-    consecutiveTimeouts = new Map();
-    disabledRuleIds = new Set();
+    consecutiveRunaways = new Map();
+    /** The worker replacing one that missed a deadline, while its rules recompile. */
+    respawning = null;
+    quarantined = new Set();
     constructor(dirOverride) {
         this.loader = new WasmLoader(resolveWasmDir(dirOverride));
     }
@@ -145,33 +169,49 @@ export class WasmRunner {
         const id = this.allocId();
         const reply = await this.send({ type: 'compile', id, ruleId, bytes: toArrayBuffer(bytes) }, COMPILE_TIMEOUT_MS);
         if (!reply)
-            return { ok: false, error: `compile timed out after ${COMPILE_TIMEOUT_MS}ms` };
+            return { ok: false, reason: 'load_error', error: `compile timed out after ${COMPILE_TIMEOUT_MS}ms` };
         if (!reply.ok) {
             const fallback = reply.unsupportedImports && reply.unsupportedImports.length > 0
                 ? `imports ${reply.unsupportedImports.join(', ')}, which this proxy does not provide`
                 : 'unknown compile error';
-            return { ok: false, error: reply.error ?? fallback, unsupportedImports: reply.unsupportedImports };
+            return {
+                ok: false,
+                reason: reply.reason ?? 'load_error',
+                error: reply.error ?? fallback,
+                unsupportedImports: reply.unsupportedImports,
+            };
         }
-        return { ok: true, readsReferencedFiles: reply.readsReferencedFiles ?? false };
+        return { ok: true, readsReferencedFiles: reply.readsReferencedFiles ?? false, rego: reply.rego ?? false };
     }
     remove(ruleId) {
         this.ensureWorker().postMessage({ type: 'remove', ruleId });
-        this.consecutiveTimeouts.delete(ruleId);
-        this.disabledRuleIds.delete(ruleId);
+        this.consecutiveRunaways.delete(ruleId);
+        this.quarantined.delete(ruleId);
     }
     // ── Rescan (driven by the existing policy-tick timer — see policy.ts) ──
     /**
      * Rescans `~/.intutic/wasm/` and (re)compiles anything changed. Also
-     * clears every rule's disabled-by-timeout status — "disable that rule
-     * until the next policy-driven rescan" is this call.
+     * releases every quarantined rule — "quarantined until the next
+     * policy-driven rescan" is this call.
      */
     async rescan() {
+        await this.respawning;
         await this.loader.rescan(this);
-        this.disabledRuleIds.clear();
-        this.consecutiveTimeouts.clear();
+        this.quarantined.clear();
+        this.consecutiveRunaways.clear();
     }
-    /** Terminates the worker and respawns a fresh one, resending every currently-loaded rule's bytes so its module cache is rebuilt. */
-    async respawnWorker() {
+    /**
+     * Replaces the worker, resending every currently-loaded rule's bytes so the
+     * new one's module cache is rebuilt, without waiting for the old one to stop.
+     *
+     * `Worker.terminate()` can take seconds: V8 stops a guest only at an
+     * interrupt check, and a loop around a bulk `memory.fill` reaches one
+     * rarely — measured, 1.5 s on an idle machine and 16 s on a loaded one. The
+     * call that missed its deadline is refused at the deadline; the old worker
+     * stops whenever V8 gets to it, and the next evaluation waits only for the
+     * new worker's recompile (`respawning`, about 50 ms for three Rego rules).
+     */
+    respawnWorker() {
         const old = this.worker;
         this.worker = null;
         if (old) {
@@ -182,34 +222,97 @@ export class WasmRunner {
                 entry.resolve({ ok: false, error: 'worker terminated' });
                 this.pending.delete(id);
             }
-            await old.terminate();
+            old.terminate().catch((err) => {
+                log.warn({ action: 'wasm_worker_terminate_error', err: err.message }, 'WASM worker did not terminate cleanly');
+            });
         }
         // Force-reload every currently-known file into the new worker — its
         // module cache started empty. `force: true` mirrors this loader's own
         // "worker cache was lost, nothing on disk moved" case.
-        await this.loader.rescan(this, true);
+        const respawning = this.loader.rescan(this, true).finally(() => {
+            if (this.respawning === respawning)
+                this.respawning = null;
+        });
+        this.respawning = respawning;
     }
     // ── Evaluation ───────────────────────────────────────────────────────
     /**
-     * Evaluates every currently loaded, non-disabled rule (priority order)
-     * against one context, mirroring `registry.rs`'s `evaluate_inner`:
-     * short-circuit on the first block, carry the first reask through in case
-     * a later, higher-priority rule still blocks, `allow` when nothing fired
-     * or every loaded rule was fail-open (timeout/trap/unmapped code).
+     * Evaluates every currently loaded rule (priority order) against one
+     * context, as `registry.rs`'s `evaluate_inner` does: short-circuit on the
+     * first block, carry the first hold and reask through in case a later rule
+     * still blocks, `allow` when nothing fired.
+     *
+     * A rule that reaches no verdict — its deadline, its instruction budget, a
+     * trap or other error, or a result that is not a verdict — refuses the call
+     * (`unavailable`), whatever `mcpProxyFailBehavior` or
+     * `INTUTIC_MCP_FAIL_OPEN` say. That setting exists for control-plane
+     * outages, which an agent cannot cause; a rule's timeout an agent can cause
+     * by padding its input, so it must never become an allow. The refusal
+     * outranks a hold and a reask, since neither an approval nor a retry can
+     * clear a call a rule never judged; a later rule's block still wins,
+     * because it says what is wrong with the call.
+     *
+     * A quarantined rule (see {@link countRunaway}) refuses at once, without
+     * anything being evaluated, until the next rescan.
      */
     async evaluate(input) {
-        const rules = this.loader.getRules().filter((r) => !this.disabledRuleIds.has(r.ruleId));
+        const rules = this.loader.getRules();
+        const held = rules.find((r) => this.quarantined.has(r.ruleId));
+        if (held) {
+            return {
+                code: 'unavailable',
+                stop: 'quarantined',
+                ruleId: held.ruleId,
+                reason: noVerdictReason(held.ruleId, 'quarantined', `it is quarantined after ${MAX_CONSECUTIVE_RUNAWAYS} runaway evaluations in a row (deadline or budget), until the next rescan`),
+            };
+        }
         if (rules.length === 0)
             return { code: 'allow' };
-        const contextBytes = Buffer.from(JSON.stringify(buildWasmContext(input)));
+        // Each built once, and only if a rule of that kind is loaded.
+        let contextBytes;
+        let regoBytes;
+        const bytesFor = (rego) => rego
+            ? (regoBytes ??= Buffer.from(buildRegoInput(input)))
+            : (contextBytes ??= Buffer.from(JSON.stringify(buildWasmContext(input))));
         let pendingReask = null;
+        let pendingHold = null;
+        let unavailable = null;
         // Read once per evaluation, before any rule runs, so the per-rule
         // deadline covers guest execution only — and only when a rule will ask.
         const files = rules.some((r) => r.readsReferencedFiles) ? await this.prefetchReferencedFiles(input) : undefined;
         for (const rule of rules) {
-            const result = await this.evaluateOne(rule.ruleId, contextBytes, rule.readsReferencedFiles ? files : undefined);
-            if (result === null)
-                continue; // fail-open ALLOW for this rule (timeout, trap, or worker error)
+            const outcome = await this.evaluateOne(rule.ruleId, bytesFor(rule.rego), rule.rego ? REGO_EVALUATE_TIMEOUT_MS : EVALUATE_TIMEOUT_MS, rule.readsReferencedFiles ? files : undefined);
+            const failure = 'stop' in outcome ? outcome : undefinedVerdict(outcome);
+            if (failure) {
+                const quarantinedNow = this.quarantined.has(rule.ruleId);
+                const detail = quarantinedNow
+                    ? `${failure.detail}; it is now quarantined until the next rescan, after ${MAX_CONSECUTIVE_RUNAWAYS} runaway evaluations in a row`
+                    : failure.detail;
+                log.warn({ action: 'wasm_rule_no_verdict', ruleId: rule.ruleId, stop: failure.stop }, `WASM rule reached no verdict: ${detail} — refusing`);
+                if (!unavailable) {
+                    unavailable = {
+                        code: 'unavailable',
+                        stop: failure.stop,
+                        ruleId: rule.ruleId,
+                        reason: noVerdictReason(rule.ruleId, failure.stop, detail),
+                    };
+                }
+                continue;
+            }
+            const result = outcome;
+            if ('decision' in result) {
+                // A Rego rule. Same ordering as the native codes below: a block ends
+                // it, and a hold waits for a person, so it outranks a reask.
+                const reason = result.reason ?? 'Refused by Rego policy';
+                if (result.decision === 'deny')
+                    return { code: 'block', reason, ruleId: rule.ruleId };
+                if (result.decision === 'hold' && !pendingHold) {
+                    pendingHold = { code: 'hold', reason, ruleId: rule.ruleId, ...(result.riskTier ? { riskTier: result.riskTier } : {}) };
+                }
+                if (result.decision === 'reask' && !pendingReask)
+                    pendingReask = { code: 'reask', reason, ruleId: rule.ruleId };
+                continue;
+            }
             switch (result.code) {
                 case 0:
                     break; // Bypass — try the next rule
@@ -235,15 +338,12 @@ export class WasmRunner {
                         };
                     }
                     break;
-                default:
-                    log.warn({ action: 'wasm_unmapped_verdict', ruleId: rule.ruleId, code: result.code }, 'WASM rule returned an unmapped verdict code; allowing. Valid codes are 0 (allow), 1 (block), 3 (reask).');
-                    break;
             }
         }
-        return pendingReask ?? { code: 'allow' };
+        return unavailable ?? pendingHold ?? pendingReask ?? { code: 'allow' };
     }
     /**
-     * The referenced-files table for this evaluation (TD-441). With no
+     * The referenced-files table for this evaluation. With no
      * `INTUTIC_WASM_MANIFEST_ROOT` the table is empty and every read refuses.
      */
     async prefetchReferencedFiles(input) {
@@ -256,48 +356,57 @@ export class WasmRunner {
         }
         return files.toTable();
     }
-    /** One rule's evaluation, raced against `EVALUATE_TIMEOUT_MS`. `null` means fail-open (timeout, worker error, or guest trap). */
-    async evaluateOne(ruleId, contextBytes, files) {
+    /** One rule's evaluation, raced against its deadline: its answer, or why it reached none. */
+    async evaluateOne(ruleId, contextBytes, timeoutMs, files) {
+        // A worker replaced after a missed deadline has its rules only once they
+        // recompile; an evaluation sent before then would find none.
+        await this.respawning;
         const id = this.allocId();
-        const reply = await this.send({ type: 'evaluate', id, ruleId, bytes: toArrayBuffer(contextBytes), ...(files ? { files } : {}) }, EVALUATE_TIMEOUT_MS);
+        const reply = await this.send({ type: 'evaluate', id, ruleId, bytes: toArrayBuffer(contextBytes), ...(files ? { files } : {}) }, timeoutMs);
         if (reply === null) {
-            // Timed out. Mirrors `runner.rs`'s `Err(_) => Bypass` — this call
-            // fails open — plus the MCP-specific per-rule consecutive-timeout
-            // disable ladder the task calls for.
-            log.warn({ action: 'wasm_evaluate_timeout', ruleId, timeoutMs: EVALUATE_TIMEOUT_MS }, 'WASM rule evaluation timed out — failing open');
-            // terminate + lazily respawn: the NEXT evaluate() call pays the
-            // respawn cost via ensureWorker()/rescan(force); triggered here so a
-            // wedged worker does not keep timing out every rule behind it in this
-            // same evaluate() loop.
-            await this.respawnWorker();
+            // Timed out: `runner.rs`'s deadline, plus this proxy's quarantine. The
+            // worker is replaced so a wedged one does not time out every rule
+            // behind it; this call does not wait for that (see respawnWorker).
+            this.respawnWorker();
             this.countRunaway(ruleId);
-            return null;
+            return { stop: 'deadline', detail: `it ran past its ${timeoutMs} ms deadline` };
         }
         if (!reply.ok && reply.fuelExhausted) {
             // The budget trapped the guest, so the worker is healthy: no respawn,
-            // but the same disable ladder as a timeout, since it is the same
+            // but the same quarantine count as a timeout, since it is the same
             // runaway rule caught sooner.
-            log.warn({ action: 'wasm_evaluate_fuel_exhausted', ruleId }, 'WASM rule ran out of its instruction budget — failing open');
             this.countRunaway(ruleId);
-            return null;
+            return { stop: 'budget', detail: 'it used up its instruction budget' };
         }
         if (!reply.ok) {
-            // Worker-reported failure: a guest trap (including one following an
-            // `abort` call) or an internal error. Fail-open ALLOW for this call,
-            // never a crash — matches the task's explicit instruction.
-            log.warn({ action: 'wasm_evaluate_error', ruleId, err: reply.error }, 'WASM rule evaluation failed — failing open');
-            return null;
+            // A guest trap (including one following an `abort` call), a result
+            // that is not a decision, or an internal error — never a crash.
+            return reply.notADecision
+                ? { stop: 'result', detail: reply.error ?? 'it returned a result that is not a decision' }
+                : { stop: 'error', detail: `it failed while running: ${reply.error ?? 'unknown error'}` };
+        }
+        // A clean reply resets this rule's runaway streak.
+        this.consecutiveRunaways.delete(ruleId);
+        if (reply.decision) {
+            return {
+                decision: reply.decision,
+                ...(reply.reason ? { reason: reply.reason } : {}),
+                ...(reply.riskTier ? { riskTier: reply.riskTier } : {}),
+            };
         }
-        // A clean reply resets this rule's timeout streak.
-        this.consecutiveTimeouts.delete(ruleId);
         return { code: reply.code ?? -1, reason: reply.reason };
     }
+    /**
+     * Counts one runaway (deadline or budget) against `ruleId`, quarantining
+     * the rule at {@link MAX_CONSECUTIVE_RUNAWAYS} in a row. Logged once, at the
+     * transition; what a quarantined rule means for a call is `evaluate`'s.
+     */
     countRunaway(ruleId) {
-        const attempts = (this.consecutiveTimeouts.get(ruleId) ?? 0) + 1;
-        this.consecutiveTimeouts.set(ruleId, attempts);
-        if (attempts >= MAX_CONSECUTIVE_TIMEOUTS) {
-            this.disabledRuleIds.add(ruleId);
-            log.warn({ action: 'wasm_rule_disabled', ruleId, consecutiveRunaways: attempts }, 'WASM rule disabled after consecutive timeouts or budget exhaustion — will retry on the next policy-driven rescan');
+        const runaways = (this.consecutiveRunaways.get(ruleId) ?? 0) + 1;
+        this.consecutiveRunaways.set(ruleId, runaways);
+        if (runaways >= MAX_CONSECUTIVE_RUNAWAYS && !this.quarantined.has(ruleId)) {
+            this.quarantined.add(ruleId);
+            log.warn({ action: 'wasm_rule_quarantined', ruleId, consecutiveRunaways: runaways }, 'WASM rule quarantined after consecutive timeouts or budget exhaustion — retried on the next policy-driven rescan');
         }
     }
     /** Terminates the worker. Safe to call even if one was never spawned. */
@@ -313,6 +422,17 @@ export class WasmRunner {
             await worker.terminate();
     }
 }
+/** A native code that is not a verdict: the rule reached none. */
+function undefinedVerdict(result) {
+    if ('decision' in result || [0, 1, 2, 3].includes(result.code))
+        return null;
+    return { stop: 'result', detail: `it returned ${result.code}, which is not a verdict code (0 allow, 1 block, 3 reask)` };
+}
+/** The refusal an agent reads when a rule reached no verdict: which rule, and why. */
+function noVerdictReason(ruleId, stop, detail) {
+    return (`Custom rule ${ruleId} reached no verdict (${stop}): ${detail}. Tool call blocked: a ` +
+        `rule that cannot decide never allows.`);
+}
 function toArrayBuffer(bytes) {
     // Structured-clone (postMessage) needs an ArrayBuffer, not a Node Buffer
     // view that may share a larger underlying pool — slice guarantees the

package/dist/wasm/runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAA2C,MAAM,aAAa,CAAA;AACjG,OAAO,EAAE,gBAAgB,EAAyB,MAAM,cAAc,CAAA;AACtE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAA6B,MAAM,sBAAsB,CAAA;AAExG,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD;;;GAGG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B;wDACwD;AACxD,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEhC;;;GAGG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAYlC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAA;IAClG,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,UAAU,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9E,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AACnE,CAAC;AAED,MAAM,OAAO,UAAU;IACJ,MAAM,CAAY;IAC3B,MAAM,GAAkB,IAAI,CAAA;IAC5B,aAAa,GAAG,CAAC,CAAA;IACjB,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IACzC,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/C,eAAe,GAAG,IAAI,GAAG,EAAU,CAAA;IAE3C,YAAY,WAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAA;IAC3D,CAAC;IAED,uDAAuD;IACvD,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAC7B,CAAC;IAED,yGAAyG;IACzG,gBAAgB;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACpD,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAA;QACnC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,gBAAgB,EAAE,CAAA;QAC5C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC9E,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAkC,EAAE,EAAE;YAC1D,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;gBAAE,OAAM;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtC,IAAI,CAAC,KAAK;gBAAE,OAAM,CAAC,gCAAgC;YACnD,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC3B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACpB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAA;QAC1F,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IACxE,IAAI,CAAI,GAA6C,EAAE,SAAiB;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC,CAAA;gBACxC,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC,EAAE,SAAS,CAAC,CAAA;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YACjF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,OAAO;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAA;QAC7B,IAAI,CAAC,aAAa,IAAI,CAAC,CAAA;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,yEAAyE;IAEzE,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,KAAiB;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAK1B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAA;QACpF,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,kBAAkB,IAAI,EAAE,CAAA;QAC1F,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,QAAQ,GACZ,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,WAAW,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;gBACrF,CAAC,CAAC,uBAAuB,CAAA;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAA;QACpG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,KAAK,EAAE,CAAA;IAChF,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3D,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;IAED,0EAA0E;IAE1E;;;;OAIG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAA;QAC5B,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAA;IAClC,CAAC;IAED,oIAAoI;IAC5H,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,IAAI,GAAG,EAAE,CAAC;YACR,kEAAkE;YAClE,0CAA0C;YAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBACzB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;gBACxD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACzB,CAAC;YACD,MAAM,GAAG,CAAC,SAAS,EAAE,CAAA;QACvB,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,uDAAuD;QACvD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACtC,CAAC;IAED,wEAAwE;IAExE;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAuB;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QACvF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QAEhD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACzE,IAAI,YAAY,GAA6D,IAAI,CAAA;QAEjF,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAE/G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YAC/G,IAAI,MAAM,KAAK,IAAI;gBAAE,SAAQ,CAAC,iEAAiE;YAE/F,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,CAAC;oBACJ,MAAK,CAAC,6BAA6B;gBACrC,KAAK,CAAC;oBACJ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wCAAwC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBAClH,KAAK,CAAC;oBACJ,gEAAgE;oBAChE,+DAA+D;oBAC/D,2DAA2D;oBAC3D,oCAAoC;oBACpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC1D,+GAA+G,CAChH,CAAA;oBACD,OAAO;wBACL,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wDAAwD;wBACjF,MAAM,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAA;gBACH,KAAK,CAAC;oBACJ,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,YAAY,GAAG;4BACb,IAAI,EAAE,OAAO;4BACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,2DAA2D;4BACpF,MAAM,EAAE,IAAI,CAAC,MAAM;yBACpB,CAAA;oBACH,CAAC;oBACD,MAAK;gBACP;oBACE,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAC3E,yGAAyG,CAC1G,CAAA;oBACD,MAAK;YACT,CAAC;QACH,CAAC;QAED,OAAO,YAAY,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CAAC,KAAuB;QAC3D,MAAM,IAAI,GAAG,WAAW,EAAE,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAA;QACnD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;QACpG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,0CAA0C,CAAC,CAAA;QACtJ,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC;IAED,iIAAiI;IACzH,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,YAAoB,EACpB,KAA4B;QAE5B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAC3B,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACjG,mBAAmB,CACpB,CAAA;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,kEAAkE;YAClE,kEAAkE;YAClE,qCAAqC;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,+CAA+C,CAAC,CAAA;YACtI,gEAAgE;YAChE,qEAAqE;YACrE,sEAAsE;YACtE,wBAAwB;YACxB,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;YAC1B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACrC,sEAAsE;YACtE,iEAAiE;YACjE,8BAA8B;YAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,MAAM,EAAE,EAAE,4DAA4D,CAAC,CAAA;YAC1H,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,2DAA2D;YAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,4CAA4C,CAAC,CAAA;YACnH,OAAO,IAAI,CAAA;QACb,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IACzD,CAAC;IAEO,YAAY,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAChE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9C,IAAI,QAAQ,IAAI,wBAAwB,EAAE,CAAC;YACzC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAChC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EACvE,kHAAkH,CACnH,CAAA;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;YACvD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACzB,CAAC;QACD,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,SAAS,EAAE,CAAA;IACtC,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,yEAAyE;IACzE,sEAAsE;IACtE,+DAA+D;IAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAA;AACjG,CAAC"}
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAA2C,MAAM,aAAa,CAAA;AACjG,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAyB,MAAM,cAAc,CAAA;AACtF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAA6B,MAAM,sBAAsB,CAAA;AAExG,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAA;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AAE9C;wDACwD;AACxD,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEhC;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAqCzC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAA;IAClG,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,UAAU,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9E,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AACnE,CAAC;AAED,MAAM,OAAO,UAAU;IACJ,MAAM,CAAY;IAC3B,MAAM,GAAkB,IAAI,CAAA;IAC5B,aAAa,GAAG,CAAC,CAAA;IACjB,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IACzC,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvD,kFAAkF;IAC1E,UAAU,GAAyB,IAAI,CAAA;IACvC,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IAEvC,YAAY,WAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAA;IAC3D,CAAC;IAED,uDAAuD;IACvD,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAC7B,CAAC;IAED,yGAAyG;IACzG,gBAAgB;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACpD,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAA;QACnC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,gBAAgB,EAAE,CAAA;QAC5C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC9E,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAkC,EAAE,EAAE;YAC1D,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;gBAAE,OAAM;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtC,IAAI,CAAC,KAAK;gBAAE,OAAM,CAAC,gCAAgC;YACnD,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC3B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACpB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAA;QAC1F,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IACxE,IAAI,CAAI,GAA6C,EAAE,SAAiB;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC,CAAA;gBACxC,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC,EAAE,SAAS,CAAC,CAAA;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YACjF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,OAAO;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAA;QAC7B,IAAI,CAAC,aAAa,IAAI,CAAC,CAAA;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,yEAAyE;IAEzE,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,KAAiB;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAO1B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAA;QACpF,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,2BAA2B,kBAAkB,IAAI,EAAE,CAAA;QAChH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,QAAQ,GACZ,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,WAAW,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;gBACrF,CAAC,CAAC,uBAAuB,CAAA;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,YAAY;gBACpC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ;gBAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;aAC7C,CAAA;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,CAAA;IAC3G,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3D,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;IAED,0EAA0E;IAE1E;;;;OAIG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,UAAU,CAAA;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAA;QACxB,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAA;IAClC,CAAC;IAED;;;;;;;;;;OAUG;IACK,aAAa;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,IAAI,GAAG,EAAE,CAAC;YACR,kEAAkE;YAClE,0CAA0C;YAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBACzB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;gBACxD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACzB,CAAC;YACD,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,uCAAuC,CAAC,CAAA;YAC3H,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,uDAAuD;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7D,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;gBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;QAC5D,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;IAED,wEAAwE;IAExE;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAuB;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QAC9D,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,eAAe,CACrB,IAAI,CAAC,MAAM,EACX,aAAa,EACb,2BAA2B,wBAAwB,2EAA2E,CAC/H;aACF,CAAA;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QAEhD,8DAA8D;QAC9D,IAAI,YAAgC,CAAA;QACpC,IAAI,SAA6B,CAAA;QACjC,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAU,EAAE,CACzC,IAAI;YACF,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7E,IAAI,YAAY,GAA6D,IAAI,CAAA;QACjF,IAAI,WAAW,GAA+E,IAAI,CAAA;QAClG,IAAI,WAAW,GAAyD,IAAI,CAAA;QAE5E,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAE/G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CACpC,IAAI,CAAC,MAAM,EACX,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EACnB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,mBAAmB,EAC1D,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC9C,CAAA;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;YACvE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACxD,MAAM,MAAM,GAAG,cAAc;oBAC3B,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,wDAAwD,wBAAwB,+BAA+B;oBAClI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAA;gBAClB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAC3E,iCAAiC,MAAM,aAAa,CACrD,CAAA;gBACD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,WAAW,GAAG;wBACZ,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;qBAC3D,CAAA;gBACH,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,MAAM,MAAM,GAAG,OAAqB,CAAA;YAEpC,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;gBACzB,qEAAqE;gBACrE,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,wBAAwB,CAAA;gBACxD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBACrF,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC/C,WAAW,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;gBACxH,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,YAAY;oBAAE,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBAC/G,SAAQ;YACV,CAAC;YAED,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,CAAC;oBACJ,MAAK,CAAC,6BAA6B;gBACrC,KAAK,CAAC;oBACJ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wCAAwC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBAClH,KAAK,CAAC;oBACJ,gEAAgE;oBAChE,+DAA+D;oBAC/D,2DAA2D;oBAC3D,oCAAoC;oBACpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC1D,+GAA+G,CAChH,CAAA;oBACD,OAAO;wBACL,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wDAAwD;wBACjF,MAAM,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAA;gBACH,KAAK,CAAC;oBACJ,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,YAAY,GAAG;4BACb,IAAI,EAAE,OAAO;4BACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,2DAA2D;4BACpF,MAAM,EAAE,IAAI,CAAC,MAAM;yBACpB,CAAA;oBACH,CAAC;oBACD,MAAK;YACT,CAAC;QACH,CAAC;QAED,OAAO,WAAW,IAAI,WAAW,IAAI,YAAY,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACxE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CAAC,KAAuB;QAC3D,MAAM,IAAI,GAAG,WAAW,EAAE,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAA;QACnD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;QACpG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,0CAA0C,CAAC,CAAA;QACtJ,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC;IAED,6FAA6F;IACrF,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,YAAoB,EACpB,SAAiB,EACjB,KAA4B;QAE5B,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,IAAI,CAAC,UAAU,CAAA;QACrB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAW3B,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACjG,SAAS,CACV,CAAA;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,uEAAuE;YACvE,kEAAkE;YAClE,mEAAmE;YACnE,IAAI,CAAC,aAAa,EAAE,CAAA;YACpB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,SAAS,cAAc,EAAE,CAAA;QACjF,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACrC,sEAAsE;YACtE,mEAAmE;YACnE,8BAA8B;YAC9B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAA;QACxE,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,mEAAmE;YACnE,gEAAgE;YAChE,OAAO,KAAK,CAAC,YAAY;gBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,6CAA6C,EAAE;gBAC1F,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,4BAA4B,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE,EAAE,CAAA;QAC7F,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IACzD,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAChE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9C,IAAI,QAAQ,IAAI,wBAAwB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC5B,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAC1E,kHAAkH,CACnH,CAAA;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;YACvD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACzB,CAAC;QACD,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,SAAS,EAAE,CAAA;IACtC,CAAC;CACF;AAED,kEAAkE;AAClE,SAAS,gBAAgB,CAAC,MAAkB;IAC1C,IAAI,UAAU,IAAI,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,MAAM,CAAC,IAAI,2DAA2D,EAAE,CAAA;AAC1H,CAAC;AAED,sFAAsF;AACtF,SAAS,eAAe,CAAC,MAAc,EAAE,IAAc,EAAE,MAAc;IACrE,OAAO,CACL,eAAe,MAAM,wBAAwB,IAAI,MAAM,MAAM,yBAAyB;QACtF,uCAAuC,CACxC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,yEAAyE;IACzE,sEAAsE;IACtE,+DAA+D;IAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAA;AACjG,CAAC"}