@intutic/mcp-governance-proxy 2.2.0 → 2.4.0

package/dist/wasm/referencedFiles.js

@@ -1,6 +1,6 @@
 /**
  * wasm/referencedFiles.ts — The MCP-side resolver behind the
- * `read_referenced_file` host import (TD-441). A 1:1 port of
+ * `read_referenced_file` host import. A 1:1 port of
  * `packages/proxy/src/wasm/referenced_files.rs`: same constants, same error
  * codes, same candidate-token rules, same six guards, same realpath
  * confinement. Where the two differ it is stated at the site.
@@ -56,6 +56,14 @@ export const ERR_NOT_FOUND = -3;
 export const ERR_TOO_LARGE = -4;
 export const ERR_BUFFER_TOO_SMALL = -5;
 export const ERR_BUDGET = -6;
+/**
+ * Not read, and not because the call never named it: the tool calls name
+ * more manifests than the host reads (`MAX_REFERENCED_FILES`), or carry a
+ * command longer than it scans, and this path is not among those read. Kept
+ * apart from `ERR_REFUSED` so decoy paths cannot make the manifest that
+ * matters look like one the call never named.
+ */
+export const ERR_NOT_READ = -7;
 /** Host calls one evaluation may make, charged before argument validation. */
 export const MAX_READS_PER_EVALUATION = 64;
 /** The operator-configured root. Unset means the capability is off. */
@@ -69,17 +77,23 @@ const COMMAND_ARG_KEYS = ['command', 'cmd', 'script'];
  */
 export class ReferencedFiles {
     entries;
-    constructor(entries) {
+    pastLimits;
+    constructor(entries, pastLimits) {
         this.entries = entries;
+        this.pastLimits = pastLimits;
     }
     static empty() {
-        return new ReferencedFiles([]);
+        return new ReferencedFiles([], false);
     }
     static fromTable(table) {
-        return new ReferencedFiles(table ? table.map(([t, o]) => [t, o]) : []);
+        return new ReferencedFiles(table ? table.entries.map(([t, o]) => [t, o]) : [], table?.pastLimits ?? false);
     }
     toTable() {
-        return this.entries.map(([t, o]) => [t, o]);
+        return { entries: this.entries.map(([t, o]) => [t, o]), pastLimits: this.pastLimits };
+    }
+    /** The same entries, recording whether the request named more than was read. */
+    withPastLimits(pastLimits) {
+        return new ReferencedFiles(this.entries, pastLimits);
     }
     isEmpty() {
         return this.entries.length === 0;
@@ -91,7 +105,7 @@ export class ReferencedFiles {
     lookup(requested) {
         const hit = this.entries.find(([t]) => t === requested);
         if (!hit)
-            return { ok: false, code: ERR_REFUSED };
+            return { ok: false, code: this.pastLimits ? ERR_NOT_READ : ERR_REFUSED };
         const o = hit[1];
         switch (o.kind) {
             case 'content':
@@ -107,8 +121,11 @@ export class ReferencedFiles {
     /** Operator-facing reason. Never handed to the guest. */
     refusalReason(requested) {
         const hit = this.entries.find(([t]) => t === requested);
-        if (!hit)
-            return "not referenced by this request's tool calls";
+        if (!hit) {
+            return this.pastLimits
+                ? 'not read: the request names more files, or a longer command, than the host reads'
+                : "not referenced by this request's tool calls";
+        }
         const o = hit[1];
         switch (o.kind) {
             case 'refused':
@@ -150,10 +167,11 @@ export function resolveRoot(env = process.env) {
 }
 /**
  * Guard 1 and 2: every manifest-shaped path the tool calls literally name,
- * deduped, capped at `MAX_REFERENCED_FILES`, in first-seen order.
+ * deduped, capped at `MAX_REFERENCED_FILES`, in first-seen order, and whether
+ * they named more than that.
  */
 export function candidateTokens(toolCalls) {
-    const out = [];
+    const out = { tokens: [], pastLimits: false };
     for (const call of toolCalls) {
         const args = call.arguments;
         if (typeof args !== 'object' || args === null || Array.isArray(args))
@@ -167,19 +185,17 @@ export function candidateTokens(toolCalls) {
         for (const key of COMMAND_ARG_KEYS) {
             const value = map[key];
             if (typeof value === 'string') {
+                if (value.length > MAX_COMMAND_SCAN_BYTES)
+                    out.pastLimits = true;
                 const scanned = value.length > MAX_COMMAND_SCAN_BYTES ? value.slice(0, MAX_COMMAND_SCAN_BYTES) : value;
                 for (const token of shellTokens(scanned))
                     consider(token, out);
             }
         }
-        if (out.length >= MAX_REFERENCED_FILES)
-            break;
     }
     return out;
 }
 function consider(raw, out) {
-    if (out.length >= MAX_REFERENCED_FILES)
-        return;
     const trimmed = raw.replace(/^["']+|["']+$/g, '');
     // `--values=charts/prod.yaml` is one shell word carrying one path. Only
     // option-shaped words are split, so a filename that legitimately contains
@@ -190,9 +206,13 @@ function consider(raw, out) {
         candidate = trimmed.slice(eq + 1);
     if (candidate.length === 0 || Buffer.byteLength(candidate) > MAX_GUEST_PATH_BYTES || !hasManifestExtension(candidate))
         return;
-    if (out.includes(candidate))
+    if (out.tokens.includes(candidate))
+        return;
+    if (out.tokens.length >= MAX_REFERENCED_FILES) {
+        out.pastLimits = true;
         return;
-    out.push(candidate);
+    }
+    out.tokens.push(candidate);
 }
 function hasManifestExtension(token) {
     const ext = path.extname(token);
@@ -249,9 +269,12 @@ export async function readTokens(tokens, root) {
     }
     catch (err) {
         log.warn({ action: 'wasm_manifest_root_unresolvable', root, err: err instanceof Error ? err.message : String(err) }, `${MANIFEST_ROOT_ENV} does not resolve — every referenced-file read will be refused`);
-        return ReferencedFiles.fromTable(tokens.map((t) => [t, { kind: 'refused', why: 'the configured manifest root does not resolve' }]));
+        return ReferencedFiles.fromTable({
+            entries: tokens.map((t) => [t, { kind: 'refused', why: 'the configured manifest root does not resolve' }]),
+            pastLimits: false,
+        });
     }
-    const table = [];
+    const entries = [];
     for (const token of tokens) {
         const outcome = await readOne(canonicalRoot, token);
         if (outcome.kind === 'content') {
@@ -268,9 +291,9 @@ export async function readTokens(tokens, root) {
         else {
             log.debug({ action: 'wasm_referenced_file_withheld', path: token, reason: describeOutcome(outcome) }, 'referenced file withheld from WASM rules');
         }
-        table.push([token, outcome]);
+        entries.push([token, outcome]);
     }
-    return ReferencedFiles.fromTable(table);
+    return ReferencedFiles.fromTable({ entries, pastLimits: false });
 }
 function describeOutcome(o) {
     switch (o.kind) {
@@ -284,9 +307,13 @@ function describeOutcome(o) {
             return 'readable';
     }
 }
+/** `readTokens` for a request's candidates, keeping whether it named more than was read. */
+export async function readCandidates(candidates, root) {
+    return (await readTokens(candidates.tokens, root)).withPastLimits(candidates.pastLimits);
+}
 /** Convenience for callers with tool calls in hand. */
 export function prefetch(toolCalls, root) {
-    return readTokens(candidateTokens(toolCalls), root);
+    return readCandidates(candidateTokens(toolCalls), root);
 }
 /**
  * Guards 3–6 on one candidate. Ordered so nothing touches the filesystem

package/dist/wasm/referencedFiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"referencedFiles.js","sourceRoot":"","sources":["../../src/wasm/referencedFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEpE,MAAM,GAAG,GAAG,YAAY,CAAC,iCAAiC,CAAC,CAAA;AAE3D,iFAAiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,CAAA;AACnD,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAA;AACrC,wCAAwC;AACxC,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAA;AACxC,2DAA2D;AAC3D,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAA;AAExC,4EAA4E;AAC5E,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAA;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,CAAA;AAC7B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,CAAA;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,CAAA;AAC/B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,CAAA;AACtC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,CAAA;AAE5B,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAA;AAE1C,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,4BAA4B,CAAA;AAE7D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAE3F,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,CAAU,CAAA;AACxH,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAA;AAiB9D;;;GAGG;AACH,MAAM,OAAO,eAAe;IACW;IAArC,YAAqC,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;IAAG,CAAC;IAEtE,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,eAAe,CAAC,EAAE,CAAC,CAAA;IAChC,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAuC;QACtD,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM,CAAA;IACpE,CAAC;IAED,mEAAmE;IACnE,MAAM,CAAC,SAAiB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAChB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;YACrC,KAAK,WAAW;gBACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;YAC3C,KAAK,WAAW;gBACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;YAC3C,KAAK,SAAS;gBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,aAAa,CAAC,SAAiB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,6CAA6C,CAAA;QAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAChB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,OAAO,CAAC,CAAC,GAAG,CAAA;YACd,KAAK,WAAW;gBACd,OAAO,gBAAgB,CAAA;YACzB,KAAK,WAAW;gBACd,OAAO,sBAAsB,CAAA;YAC/B,KAAK,SAAS;gBACZ,OAAO,UAAU,CAAA;QACrB,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,QAAQ;QACN,OAAO,IAAI,CAAC,OAAO;aAChB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,SAAS;oBACZ,OAAO,GAAG,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAA;gBACpD,KAAK,SAAS;oBACZ,OAAO,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,GAAG,CAAA;gBACpC,KAAK,WAAW;oBACd,OAAO,GAAG,CAAC,eAAe,CAAA;gBAC5B,KAAK,WAAW;oBACd,OAAO,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,SAAS,CAAA;YAC/C,CAAC;QACH,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACtE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,SAAkC;IAChE,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAA;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC9E,MAAM,GAAG,GAAG,IAA+B,CAAA;QAC3C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;gBACtG,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,CAAC;oBAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,oBAAoB;YAAE,MAAK;IAC/C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAa;IAC1C,IAAI,GAAG,CAAC,MAAM,IAAI,oBAAoB;QAAE,OAAM;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;IACjD,wEAAwE;IACxE,0EAA0E;IAC1E,wDAAwD;IACxD,IAAI,SAAS,GAAG,OAAO,CAAA;IACvB,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IACxE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,oBAAoB,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC;QAAE,OAAM;IAC7H,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAM;IACnC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IACtB,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,KAAK,GAAkB,IAAI,CAAA;IAC/B,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACjB,OAAO,GAAG,EAAE,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAA;;gBACzB,OAAO,IAAI,EAAE,CAAA;YAClB,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,GAAG,EAAE,CAAA;QACZ,CAAC;aAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,CAAA;QACT,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAA;IACP,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAyB,EAAE,IAAY;IACtE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,KAAK,EAAE,CAAA;IAEvD,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,aAAqB,CAAA;IACzB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iCAAiC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1G,GAAG,iBAAiB,gEAAgE,CACrF,CAAA;QACD,OAAO,eAAe,CAAC,SAAS,CAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,+CAA+C,EAAE,CAAC,CAAC,CAClG,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAyB,EAAE,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,KAAK,CACP;gBACE,MAAM,EAAE,8BAA8B;gBACtC,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;gBAC3B,kEAAkE;gBAClE,+DAA+D;gBAC/D,aAAa;gBACb,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACpF,EACD,uCAAuC,CACxC,CAAA;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CACP,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,EAC1F,0CAA0C,CAC3C,CAAA;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,GAAG,CAAA;QACd,KAAK,WAAW;YACd,OAAO,gBAAgB,CAAA;QACzB,KAAK,WAAW;YACd,OAAO,sBAAsB,CAAA;QAC/B,KAAK,SAAS;YACZ,OAAO,UAAU,CAAA;IACrB,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,QAAQ,CAAC,SAAkC,EAAE,IAAY;IACvE,OAAO,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;AACrD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CAAC,aAAqB,EAAE,KAAa;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,iCAAiC,EAAE,CAAA;IAElH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAA;IACtF,sEAAsE;IACtE,qCAAqC;IACrC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,gCAAgC,EAAE,CAAA;IAE3H,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IAE/E,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAA;IAC1D,CAAC;IAED,IAAI,QAAQ,KAAK,aAAa,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,+CAA+C,EAAE,CAAA;IAClF,CAAC;IAED,IAAI,IAA0C,CAAA;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAA;IAC5E,IAAI,IAAI,CAAC,IAAI,GAAG,yBAAyB;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IAExF,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,MAAqB,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAA;QACzD,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC,CAAA;YAC9E,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAK;YAC1B,KAAK,IAAI,SAAS,CAAA;QACpB,CAAC;QACD,IAAI,KAAK,GAAG,yBAAyB;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAChF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAA;IACtD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ,CAAA;AAChG,CAAC"}
+{"version":3,"file":"referencedFiles.js","sourceRoot":"","sources":["../../src/wasm/referencedFiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEpE,MAAM,GAAG,GAAG,YAAY,CAAC,iCAAiC,CAAC,CAAA;AAE3D,iFAAiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,CAAA;AACnD,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAA;AACrC,wCAAwC;AACxC,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAA;AACxC,2DAA2D;AAC3D,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAA;AAExC,4EAA4E;AAC5E,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAA;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,CAAA;AAC7B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,CAAA;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,CAAA;AAC/B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,CAAA;AACtC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,CAAA;AAC5B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAA;AAE9B,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAA;AAE1C,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,4BAA4B,CAAA;AAE7D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAE3F,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,CAAU,CAAA;AACxH,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAA;AA6B9D;;;GAGG;AACH,MAAM,OAAO,eAAe;IAEP;IACA;IAFnB,YACmB,OAAiC,EACjC,UAAmB;QADnB,YAAO,GAAP,OAAO,CAA0B;QACjC,eAAU,GAAV,UAAU,CAAS;IACnC,CAAC;IAEJ,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAuC;QACtD,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,IAAI,KAAK,CAAC,CAAA;IAC5G,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;IACvF,CAAC;IAED,gFAAgF;IAChF,cAAc,CAAC,UAAmB;QAChC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM,CAAA;IACpE,CAAC;IAED,mEAAmE;IACnE,MAAM,CAAC,SAAiB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAClF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAChB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;YACrC,KAAK,WAAW;gBACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;YAC3C,KAAK,WAAW;gBACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;YAC3C,KAAK,SAAS;gBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,aAAa,CAAC,SAAiB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;QACvD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,UAAU;gBACpB,CAAC,CAAC,kFAAkF;gBACpF,CAAC,CAAC,6CAA6C,CAAA;QACnD,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAChB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,OAAO,CAAC,CAAC,GAAG,CAAA;YACd,KAAK,WAAW;gBACd,OAAO,gBAAgB,CAAA;YACzB,KAAK,WAAW;gBACd,OAAO,sBAAsB,CAAA;YAC/B,KAAK,SAAS;gBACZ,OAAO,UAAU,CAAA;QACrB,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,QAAQ;QACN,OAAO,IAAI,CAAC,OAAO;aAChB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,SAAS;oBACZ,OAAO,GAAG,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAA;gBACpD,KAAK,SAAS;oBACZ,OAAO,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,GAAG,CAAA;gBACpC,KAAK,WAAW;oBACd,OAAO,GAAG,CAAC,eAAe,CAAA;gBAC5B,KAAK,WAAW;oBACd,OAAO,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,SAAS,CAAA;YAC/C,CAAC;QACH,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACtE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,SAAkC;IAChE,MAAM,GAAG,GAAe,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IACzD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAA;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC9E,MAAM,GAAG,GAAG,IAA+B,CAAA;QAC3C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;YACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,sBAAsB;oBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAA;gBAChE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;gBACtG,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,CAAC;oBAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAe;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;IACjD,wEAAwE;IACxE,0EAA0E;IAC1E,wDAAwD;IACxD,IAAI,SAAS,GAAG,OAAO,CAAA;IACvB,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IACxE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,oBAAoB,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC;QAAE,OAAM;IAC7H,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAM;IAC1C,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC9C,GAAG,CAAC,UAAU,GAAG,IAAI,CAAA;QACrB,OAAM;IACR,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IACtB,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,KAAK,GAAkB,IAAI,CAAA;IAC/B,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACjB,OAAO,GAAG,EAAE,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAA;;gBACzB,OAAO,IAAI,EAAE,CAAA;YAClB,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,GAAG,EAAE,CAAA;QACZ,CAAC;aAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,CAAA;QACT,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAA;IACP,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAyB,EAAE,IAAY;IACtE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,KAAK,EAAE,CAAA;IAEvD,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,aAAqB,CAAA;IACzB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iCAAiC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1G,GAAG,iBAAiB,gEAAgE,CACrF,CAAA;QACD,OAAO,eAAe,CAAC,SAAS,CAAC;YAC/B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,+CAA+C,EAAE,CAAC,CAAC;YAC1G,UAAU,EAAE,KAAK;SAClB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,OAAO,GAA6B,EAAE,CAAA;IAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,KAAK,CACP;gBACE,MAAM,EAAE,8BAA8B;gBACtC,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;gBAC3B,kEAAkE;gBAClE,+DAA+D;gBAC/D,aAAa;gBACb,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACpF,EACD,uCAAuC,CACxC,CAAA;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CACP,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,EAC1F,0CAA0C,CAC3C,CAAA;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,eAAe,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,GAAG,CAAA;QACd,KAAK,WAAW;YACd,OAAO,gBAAgB,CAAA;QACzB,KAAK,WAAW;YACd,OAAO,sBAAsB,CAAA;QAC/B,KAAK,SAAS;YACZ,OAAO,UAAU,CAAA;IACrB,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAsB,EAAE,IAAY;IACvE,OAAO,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAC1F,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,QAAQ,CAAC,SAAkC,EAAE,IAAY;IACvE,OAAO,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CAAC,aAAqB,EAAE,KAAa;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,iCAAiC,EAAE,CAAA;IAElH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAA;IACtF,sEAAsE;IACtE,qCAAqC;IACrC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,gCAAgC,EAAE,CAAA;IAE3H,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IAE/E,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAA;IAC1D,CAAC;IAED,IAAI,QAAQ,KAAK,aAAa,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,+CAA+C,EAAE,CAAA;IAClF,CAAC;IAED,IAAI,IAA0C,CAAA;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAA;IAC5E,IAAI,IAAI,CAAC,IAAI,GAAG,yBAAyB;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IAExF,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,MAAqB,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,yBAAyB,GAAG,CAAC,CAAC,CAAA;QACzD,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC,CAAA;YAC9E,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAK;YAC1B,KAAK,IAAI,SAAS,CAAA;QACpB,CAAC;QACD,IAAI,KAAK,GAAG,yBAAyB;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAChF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAA;IACtD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ,CAAA;AAChG,CAAC"}

package/dist/wasm/runner.d.ts

@@ -1,27 +1,40 @@
 /**
  * wasm/runner.ts — WasmRunner: owns the one dedicated `worker_threads`
- * Worker (worker.ts), the local-rules loader (loader.ts), and the
- * evaluate-all-rules union logic ported from
- * `packages/proxy/src/wasm/registry.rs`'s `evaluate_inner` (most-restrictive-
- * wins, short-circuit on a block, carry the first reask through).
+ * Worker (worker.ts), the local-rules loader (loader.ts), the workspace's
+ * control-plane rules (cloudRules.ts), and the evaluate-all-rules union logic
+ * ported from `packages/proxy/src/wasm/registry.rs`'s `evaluate_inner`
+ * (most-restrictive-wins, short-circuit on a block, carry the first reask
+ * through).
+ *
+ * Both sources run as one list in priority order, lower first; on a tie a
+ * control-plane rule runs before a local one, as in `registry.rs`. Local rules
+ * are `local:<file name>`; a control-plane rule keeps the control plane's id,
+ * the one the LLM proxy and the dashboard name it by. A control-plane rule in
+ * `SHADOW` mode is evaluated like any other and logged, and never decides the
+ * call — not even when it reaches no verdict.
  *
  * ## Divergences from the Rust runner (all recorded as TD entries)
  *
  * - **Fuel: the same 1,000,000-instruction budget, metered a different
- *   way.** V8 has no fuel hook, so `fuel.ts` rewrites each rule at load to
- *   count its own instructions and trap when the budget runs out (TD-440).
- *   A rule that exhausts it fails open for that call, as under Wasmtime.
- * - **50ms per-rule deadline, not 5ms.** Fuel bounds the guest's own work;
- *   the deadline is the backstop for everything else, and it races a
- *   `postMessage` round trip that pays IPC overhead the in-process Wasmtime
- *   call never did. 50ms, not 5ms, keeps that overhead from
- *   false-positiving a legitimate rule under normal load.
+ *   way.** V8 has no fuel hook, so `wasmFuel.ts` (shared-types) rewrites each rule at load to
+ *   count its own instructions and trap when the budget runs out.
+ *   A rule that exhausts it reaches no verdict, as under Wasmtime.
+ * - **The deadline is a backstop, not the limit.** Fuel is the limit: it is
+ *   deterministic, so a rule within budget is never refused because the
+ *   machine is busy. The deadline catches what fuel cannot see — a bulk
+ *   `memory.fill` costs one instruction whatever its length, a host call
+ *   costs none — and it races a `postMessage` round trip that the
+ *   in-process Wasmtime call never pays. See {@link EVALUATE_TIMEOUT_MS}.
  * - **Guest memory ceiling: the same 16MB, enforced a different way.**
  *   `runner.rs` sets a `StoreLimits` cap; V8 has no such hook, but it does
  *   enforce the maximum a module declares, so `worker.ts` rewrites the
  *   module's memory section to declare 16MB as its maximum before compiling
- *   (`memoryCap.ts`). A `memory.grow` past it returns -1 as it would under
- *   Wasmtime. Not a divergence any more; TD-440 records how it got here.
+ *   (`wasmMemoryCap.ts`). A `memory.grow` past it returns -1 as it would under
+ *   Wasmtime. Not a divergence any more.
+ * - **Rego rules (OPA builds) run through `@intutic/shared-types`' Rego
+ *   host**, with their own instruction budget (`wasmFuel.ts`'s
+ *   `REGO_FUEL_BUDGET`) and deadline (`REGO_EVALUATE_TIMEOUT_MS`), and
+ *   reply with a decision instead of a verdict code — a hold has none.
  * - **`read_referenced_file` is served from a pre-read table**
  *   (`referencedFiles.ts`, the port of `referenced_files.rs`), prefetched
  *   once per `evaluate()` only when a loaded rule imports the function and
@@ -30,8 +43,43 @@
  *
  * @module
  */
-import { type CompileBridge, type CompileOutcome } from './loader.js';
+import type { WasmRuleDescriptor } from '@intutic/shared-types';
+import { type CompileOutcome } from './loader.js';
+import type { CloudRuleBridge, CloudRuleSet } from './cloudRules.js';
 import { type WasmContextInput } from './context.js';
+/**
+ * A native rule's deadline: a backstop for stalls the instruction budget
+ * cannot see, set well above the time any rule within budget takes on a busy
+ * machine, because a rule that reaches no verdict refuses the call.
+ *
+ * Measured on a 14-core machine, idle and with 100 busy threads (about the
+ * oversubscription of a 4-vCPU CI runner running every package's suite): the
+ * 1,000,000-instruction budget runs out in at most 2 ms either way, and a
+ * worker round trip for a 60 KB context takes at most 0.5 ms idle and 3.9 ms
+ * loaded. The Rego round trip below shows the loaded machine also stalls a
+ * thread for hundreds of milliseconds, which is what one second covers.
+ */
+export declare const EVALUATE_TIMEOUT_MS = 1000;
+/**
+ * A Rego rule's deadline, on the same reasoning with the Rego budget
+ * (`REGO_FUEL_BUDGET`): the destructive-shell example on the largest input
+ * (64 KB) takes at most 6 ms idle and 430 ms loaded, round trip included, and
+ * a loop using up the whole budget takes up to 350 ms idle and 4.4 s loaded.
+ * Ten seconds is over twice that, so on a loaded machine the budget still
+ * stops a runaway rule first, and only a stall fuel cannot see waits this long.
+ */
+export declare const REGO_EVALUATE_TIMEOUT_MS = 10000;
+/**
+ * Consecutive per-rule runaways (a timeout, or the instruction budget running
+ * out) before that rule is quarantined until the next rescan.
+ */
+export declare const MAX_CONSECUTIVE_RUNAWAYS = 3;
+/**
+ * Why a rule reached no verdict, in the one word a refusal and a log line use
+ * — the Rust proxy's `limits::Stop` — plus `quarantined`: not evaluated at
+ * all, after {@link MAX_CONSECUTIVE_RUNAWAYS} runaways in a row.
+ */
+export type RuleStop = 'deadline' | 'budget' | 'error' | 'result' | 'quarantined';
 export type WasmVerdict = {
     code: 'allow';
 } | {
@@ -42,48 +90,138 @@ export type WasmVerdict = {
     code: 'reask';
     reason: string;
     ruleId: string;
+}
+/** A Rego rule's `hold`: the interceptor puts the call through the decisions API. */
+ | {
+    code: 'hold';
+    reason: string;
+    ruleId: string;
+    riskTier?: string;
+}
+/**
+ * A rule reached no verdict: the call is refused as `GOVERNANCE_UNAVAILABLE`,
+ * whatever the proxy's fail setting (see {@link WasmRunner.evaluate}).
+ */
+ | {
+    code: 'unavailable';
+    reason: string;
+    ruleId: string;
+    stop: RuleStop;
 };
-export declare class WasmRunner implements CompileBridge {
+/**
+ * One shadowed rule's outcome on one call, as the LLM proxy reports it on a
+ * trace (`registry.rs`'s `ShadowReport`): the bypasses are reported too,
+ * because they are the denominator promotion divides by.
+ */
+export interface ShadowReport {
+    ruleId: string;
+    /** False when the rule allowed the call; true for a block, a reask, a hold, or no verdict. */
+    wouldAct: boolean;
+}
+export declare class WasmRunner implements CloudRuleBridge {
+    private readonly cloud?;
     private readonly loader;
     private worker;
     private nextRequestId;
     private pending;
-    private consecutiveTimeouts;
-    private disabledRuleIds;
-    constructor(dirOverride?: string);
+    private consecutiveRunaways;
+    /** The worker replacing one that missed a deadline, while its rules recompile. */
+    private respawning;
+    private quarantined;
+    /**
+     * @param dirOverride - the local rules directory (see `resolveWasmDir`).
+     * @param cloud - the workspace's control-plane rules; absent where there is
+     *   no control plane to fetch them from (tests, local-only use).
+     */
+    constructor(dirOverride?: string, cloud?: CloudRuleSet | undefined);
     /** The resolved local rules directory, for logging. */
     getDir(): string;
-    /** Currently loaded rule ids (`local:<file name>`), priority order — observability for callers/tests. */
+    /** Currently loaded rule ids, in evaluation order — observability for callers/tests. */
     getLoadedRuleIds(): string[];
+    /**
+     * Every loaded rule in evaluation order: by priority, and on a tie the
+     * control-plane rules first (a stable sort over cloud-then-local, as
+     * `registry.rs` sorts).
+     */
+    private activeRules;
+    /**
+     * Brings the control-plane rules in line with the descriptors the policy
+     * carries. `undefined` — no policy from the control plane yet — leaves them
+     * as they are. See `CloudRuleSet.sync` for when this waits.
+     */
+    syncCloudRules(descriptors: readonly WasmRuleDescriptor[] | undefined): Promise<void>;
+    /**
+     * Whether the workspace's control-plane rules are known: a descriptor list
+     * has been applied (or this runner has no control plane to ask). Until then,
+     * a call is judged without them, which the interceptor allows only under
+     * the fail-open setting.
+     */
+    cloudRulesLoaded(): boolean;
     private ensureWorker;
     /** Send one message and wait for its correlated reply, or `null` on timeout. */
     private send;
     private allocId;
     compile(ruleId: string, bytes: Uint8Array): Promise<CompileOutcome>;
     remove(ruleId: string): void;
+    /** A control-plane rule's version changed: the old version's runaways do not count against the new one. */
+    replaced(ruleId: string): void;
     /**
      * Rescans `~/.intutic/wasm/` and (re)compiles anything changed. Also
-     * clears every rule's disabled-by-timeout status — "disable that rule
-     * until the next policy-driven rescan" is this call.
+     * releases every quarantined rule — "quarantined until the next
+     * policy-driven rescan" is this call.
      */
     rescan(): Promise<void>;
-    /** Terminates the worker and respawns a fresh one, resending every currently-loaded rule's bytes so its module cache is rebuilt. */
+    /**
+     * Replaces the worker, resending every currently-loaded rule's bytes so the
+     * new one's module cache is rebuilt, without waiting for the old one to stop.
+     *
+     * `Worker.terminate()` can take seconds: V8 stops a guest only at an
+     * interrupt check, and a loop around a bulk `memory.fill` reaches one
+     * rarely — measured, 1.5 s on an idle machine and 16 s on a loaded one. The
+     * call that missed its deadline is refused at the deadline; the old worker
+     * stops whenever V8 gets to it, and the next evaluation waits only for the
+     * new worker's recompile (`respawning`, about 50 ms for three Rego rules).
+     */
     private respawnWorker;
     /**
-     * Evaluates every currently loaded, non-disabled rule (priority order)
-     * against one context, mirroring `registry.rs`'s `evaluate_inner`:
-     * short-circuit on the first block, carry the first reask through in case
-     * a later, higher-priority rule still blocks, `allow` when nothing fired
-     * or every loaded rule was fail-open (timeout/trap/unmapped code).
+     * Evaluates every currently loaded rule (priority order) against one
+     * context, as `registry.rs`'s `evaluate_inner` does: short-circuit on the
+     * first block, carry the first hold and reask through in case a later rule
+     * still blocks, `allow` when nothing fired.
+     *
+     * A rule that reaches no verdict — its deadline, its instruction budget, a
+     * trap or other error, or a result that is not a verdict — refuses the call
+     * (`unavailable`), whatever `mcpProxyFailBehavior` or
+     * `INTUTIC_MCP_FAIL_OPEN` say. That setting exists for control-plane
+     * outages, which an agent cannot cause; a rule's timeout an agent can cause
+     * by padding its input, so it must never become an allow. The refusal
+     * outranks a hold and a reask, since neither an approval nor a retry can
+     * clear a call a rule never judged; a later rule's block still wins,
+     * because it says what is wrong with the call.
+     *
+     * A quarantined rule (see {@link countRunaway}) refuses at once, without
+     * anything being evaluated, until the next rescan.
+     *
+     * A `SHADOW` rule is evaluated in its place and decides nothing: what it
+     * would have done, a refusal for reaching no verdict included, leaves the
+     * call as the other rules decide it. Each evaluation is appended to
+     * `shadowOut`, the evidence promotion out of shadow is judged on, and a
+     * would-act is logged. A quarantined one is skipped, and reported as
+     * nothing, since nothing ran.
      */
-    evaluate(input: WasmContextInput): Promise<WasmVerdict>;
+    evaluate(input: WasmContextInput, shadowOut?: ShadowReport[]): Promise<WasmVerdict>;
     /**
-     * The referenced-files table for this evaluation (TD-441). With no
+     * The referenced-files table for this evaluation. With no
      * `INTUTIC_WASM_MANIFEST_ROOT` the table is empty and every read refuses.
      */
     private prefetchReferencedFiles;
-    /** One rule's evaluation, raced against `EVALUATE_TIMEOUT_MS`. `null` means fail-open (timeout, worker error, or guest trap). */
+    /** One rule's evaluation, raced against its deadline: its answer, or why it reached none. */
     private evaluateOne;
+    /**
+     * Counts one runaway (deadline or budget) against `ruleId`, quarantining
+     * the rule at {@link MAX_CONSECUTIVE_RUNAWAYS} in a row. Logged once, at the
+     * transition; what a quarantined rule means for a call is `evaluate`'s.
+     */
     private countRunaway;
     /** Terminates the worker. Safe to call even if one was never spawned. */
     shutdown(): Promise<void>;

package/dist/wasm/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,OAAO,EAA8B,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAqBtE,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAyCrD,qBAAa,UAAW,YAAW,aAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,aAAa,CAAI;IACzB,OAAO,CAAC,OAAO,CAAkC;IACjD,OAAO,CAAC,mBAAmB,CAA4B;IACvD,OAAO,CAAC,eAAe,CAAoB;gBAE/B,WAAW,CAAC,EAAE,MAAM;IAIhC,uDAAuD;IACvD,MAAM,IAAI,MAAM;IAIhB,yGAAyG;IACzG,gBAAgB,IAAI,MAAM,EAAE;IAI5B,OAAO,CAAC,YAAY;IAmBpB,gFAAgF;IAChF,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,OAAO;IAQT,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAmBzE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ5B;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B,oIAAoI;YACtH,aAAa;IAqB3B;;;;;;OAMG;IACG,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;IAuD7D;;;OAGG;YACW,uBAAuB;IAUrC,iIAAiI;YACnH,WAAW;IA+CzB,OAAO,CAAC,YAAY;IAYpB,yEAAyE;IACnE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAUhC;AAWD,YAAY,EAAE,gBAAgB,EAAE,CAAA"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAMH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAyD,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AACxG,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAKtF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,OAAQ,CAAA;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAA;AAM9C;;;GAGG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAA;AAEjF,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACnD,qFAAqF;GACnF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE;AACrE;;;GAGG;GACD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAa3E;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,8FAA8F;IAC9F,QAAQ,EAAE,OAAO,CAAA;CAClB;AAmDD,qBAAa,UAAW,YAAW,eAAe;IAiB9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAhBzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,aAAa,CAAI;IACzB,OAAO,CAAC,OAAO,CAAkC;IACjD,OAAO,CAAC,mBAAmB,CAA4B;IACvD,kFAAkF;IAClF,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,WAAW,CAAoB;IAEvC;;;;OAIG;gBAED,WAAW,CAAC,EAAE,MAAM,EACH,KAAK,CAAC,EAAE,YAAY,YAAA;IAKvC,uDAAuD;IACvD,MAAM,IAAI,MAAM;IAIhB,wFAAwF;IACxF,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAkBnB;;;;OAIG;IACG,cAAc,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3F;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO;IAI3B,OAAO,CAAC,YAAY;IAmBpB,gFAAgF;IAChF,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,OAAO;IAQT,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0BzE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAK5B,2GAA2G;IAC3G,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAO9B;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAO7B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IA6BrB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,QAAQ,CAAC,KAAK,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAoHzF;;;OAGG;YACW,uBAAuB;IAUrC,6FAA6F;YAC/E,WAAW;IA8DzB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAYpB,yEAAyE;IACnE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAUhC;AAyCD,YAAY,EAAE,gBAAgB,EAAE,CAAA"}