@intutic/mcp-governance-proxy 2.2.0 → 2.4.0

package/dist/wasm/runner.js

@@ -1,27 +1,40 @@
 /**
  * wasm/runner.ts — WasmRunner: owns the one dedicated `worker_threads`
- * Worker (worker.ts), the local-rules loader (loader.ts), and the
- * evaluate-all-rules union logic ported from
- * `packages/proxy/src/wasm/registry.rs`'s `evaluate_inner` (most-restrictive-
- * wins, short-circuit on a block, carry the first reask through).
+ * Worker (worker.ts), the local-rules loader (loader.ts), the workspace's
+ * control-plane rules (cloudRules.ts), and the evaluate-all-rules union logic
+ * ported from `packages/proxy/src/wasm/registry.rs`'s `evaluate_inner`
+ * (most-restrictive-wins, short-circuit on a block, carry the first reask
+ * through).
+ *
+ * Both sources run as one list in priority order, lower first; on a tie a
+ * control-plane rule runs before a local one, as in `registry.rs`. Local rules
+ * are `local:<file name>`; a control-plane rule keeps the control plane's id,
+ * the one the LLM proxy and the dashboard name it by. A control-plane rule in
+ * `SHADOW` mode is evaluated like any other and logged, and never decides the
+ * call — not even when it reaches no verdict.
  *
  * ## Divergences from the Rust runner (all recorded as TD entries)
  *
  * - **Fuel: the same 1,000,000-instruction budget, metered a different
- *   way.** V8 has no fuel hook, so `fuel.ts` rewrites each rule at load to
- *   count its own instructions and trap when the budget runs out (TD-440).
- *   A rule that exhausts it fails open for that call, as under Wasmtime.
- * - **50ms per-rule deadline, not 5ms.** Fuel bounds the guest's own work;
- *   the deadline is the backstop for everything else, and it races a
- *   `postMessage` round trip that pays IPC overhead the in-process Wasmtime
- *   call never did. 50ms, not 5ms, keeps that overhead from
- *   false-positiving a legitimate rule under normal load.
+ *   way.** V8 has no fuel hook, so `wasmFuel.ts` (shared-types) rewrites each rule at load to
+ *   count its own instructions and trap when the budget runs out.
+ *   A rule that exhausts it reaches no verdict, as under Wasmtime.
+ * - **The deadline is a backstop, not the limit.** Fuel is the limit: it is
+ *   deterministic, so a rule within budget is never refused because the
+ *   machine is busy. The deadline catches what fuel cannot see — a bulk
+ *   `memory.fill` costs one instruction whatever its length, a host call
+ *   costs none — and it races a `postMessage` round trip that the
+ *   in-process Wasmtime call never pays. See {@link EVALUATE_TIMEOUT_MS}.
  * - **Guest memory ceiling: the same 16MB, enforced a different way.**
  *   `runner.rs` sets a `StoreLimits` cap; V8 has no such hook, but it does
  *   enforce the maximum a module declares, so `worker.ts` rewrites the
  *   module's memory section to declare 16MB as its maximum before compiling
- *   (`memoryCap.ts`). A `memory.grow` past it returns -1 as it would under
- *   Wasmtime. Not a divergence any more; TD-440 records how it got here.
+ *   (`wasmMemoryCap.ts`). A `memory.grow` past it returns -1 as it would under
+ *   Wasmtime. Not a divergence any more.
+ * - **Rego rules (OPA builds) run through `@intutic/shared-types`' Rego
+ *   host**, with their own instruction budget (`wasmFuel.ts`'s
+ *   `REGO_FUEL_BUDGET`) and deadline (`REGO_EVALUATE_TIMEOUT_MS`), and
+ *   reply with a decision instead of a verdict code — a hold has none.
  * - **`read_referenced_file` is served from a pre-read table**
  *   (`referencedFiles.ts`, the port of `referenced_files.rs`), prefetched
  *   once per `evaluate()` only when a loaded rule imports the function and
@@ -35,22 +48,39 @@ import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { createStderrLogger as createLogger } from '../stderrLog.js';
 import { WasmLoader, resolveWasmDir } from './loader.js';
-import { buildWasmContext } from './context.js';
+import { buildRegoInput, buildWasmContext } from './context.js';
 import { prefetch, resolveRoot, ReferencedFiles } from './referencedFiles.js';
 const log = createLogger('mcp-proxy-wasm-runner');
 /**
- * Per-rule evaluation deadline. See this module's doc comment for why this
- * is 50ms rather than `runner.rs`'s 5ms.
+ * A native rule's deadline: a backstop for stalls the instruction budget
+ * cannot see, set well above the time any rule within budget takes on a busy
+ * machine, because a rule that reaches no verdict refuses the call.
+ *
+ * Measured on a 14-core machine, idle and with 100 busy threads (about the
+ * oversubscription of a 4-vCPU CI runner running every package's suite): the
+ * 1,000,000-instruction budget runs out in at most 2 ms either way, and a
+ * worker round trip for a 60 KB context takes at most 0.5 ms idle and 3.9 ms
+ * loaded. The Rego round trip below shows the loaded machine also stalls a
+ * thread for hundreds of milliseconds, which is what one second covers.
  */
-const EVALUATE_TIMEOUT_MS = 50;
+export const EVALUATE_TIMEOUT_MS = 1_000;
+/**
+ * A Rego rule's deadline, on the same reasoning with the Rego budget
+ * (`REGO_FUEL_BUDGET`): the destructive-shell example on the largest input
+ * (64 KB) takes at most 6 ms idle and 430 ms loaded, round trip included, and
+ * a loop using up the whole budget takes up to 350 ms idle and 4.4 s loaded.
+ * Ten seconds is over twice that, so on a loaded machine the budget still
+ * stops a runaway rule first, and only a stall fuel cannot see waits this long.
+ */
+export const REGO_EVALUATE_TIMEOUT_MS = 10_000;
 /** Generous — compilation is not guest-controlled per evaluation, but a
  *  pathological file must not hang a rescan forever. */
 const COMPILE_TIMEOUT_MS = 3_000;
 /**
  * Consecutive per-rule runaways (a timeout, or the instruction budget running
- * out) before that rule is disabled until the next rescan.
+ * out) before that rule is quarantined until the next rescan.
  */
-const MAX_CONSECUTIVE_TIMEOUTS = 3;
+export const MAX_CONSECUTIVE_RUNAWAYS = 3;
 /**
  * Resolves the worker script to spawn.
  *
@@ -85,22 +115,73 @@ function workerScriptSpec() {
     return { url, execArgv: isSource ? ['--import', 'tsx/esm'] : [] };
 }
 export class WasmRunner {
+    cloud;
     loader;
     worker = null;
     nextRequestId = 1;
     pending = new Map();
-    consecutiveTimeouts = new Map();
-    disabledRuleIds = new Set();
-    constructor(dirOverride) {
+    consecutiveRunaways = new Map();
+    /** The worker replacing one that missed a deadline, while its rules recompile. */
+    respawning = null;
+    quarantined = new Set();
+    /**
+     * @param dirOverride - the local rules directory (see `resolveWasmDir`).
+     * @param cloud - the workspace's control-plane rules; absent where there is
+     *   no control plane to fetch them from (tests, local-only use).
+     */
+    constructor(dirOverride, cloud) {
+        this.cloud = cloud;
         this.loader = new WasmLoader(resolveWasmDir(dirOverride));
     }
     /** The resolved local rules directory, for logging. */
     getDir() {
         return this.loader.getDir();
     }
-    /** Currently loaded rule ids (`local:<file name>`), priority order — observability for callers/tests. */
+    /** Currently loaded rule ids, in evaluation order — observability for callers/tests. */
     getLoadedRuleIds() {
-        return this.loader.getRules().map((r) => r.ruleId);
+        return this.activeRules().map((r) => r.ruleId);
+    }
+    /**
+     * Every loaded rule in evaluation order: by priority, and on a tie the
+     * control-plane rules first (a stable sort over cloud-then-local, as
+     * `registry.rs` sorts).
+     */
+    activeRules() {
+        const cloud = (this.cloud?.getRules() ?? []).map((r) => ({
+            ruleId: r.ruleId,
+            priority: r.priority,
+            rego: r.rego,
+            readsReferencedFiles: r.readsReferencedFiles,
+            shadow: r.mode === 'SHADOW',
+        }));
+        const local = this.loader.getRules().map((r) => ({
+            ruleId: r.ruleId,
+            priority: r.priority,
+            rego: r.rego,
+            readsReferencedFiles: r.readsReferencedFiles,
+            shadow: false,
+        }));
+        return [...cloud, ...local].sort((a, b) => a.priority - b.priority);
+    }
+    /**
+     * Brings the control-plane rules in line with the descriptors the policy
+     * carries. `undefined` — no policy from the control plane yet — leaves them
+     * as they are. See `CloudRuleSet.sync` for when this waits.
+     */
+    async syncCloudRules(descriptors) {
+        if (!this.cloud || !descriptors)
+            return;
+        await this.respawning;
+        await this.cloud.sync(descriptors, this);
+    }
+    /**
+     * Whether the workspace's control-plane rules are known: a descriptor list
+     * has been applied (or this runner has no control plane to ask). Until then,
+     * a call is judged without them, which the interceptor allows only under
+     * the fail-open setting.
+     */
+    cloudRulesLoaded() {
+        return !this.cloud || this.cloud.isLoaded();
     }
     ensureWorker() {
         if (this.worker)
@@ -145,33 +226,53 @@ export class WasmRunner {
         const id = this.allocId();
         const reply = await this.send({ type: 'compile', id, ruleId, bytes: toArrayBuffer(bytes) }, COMPILE_TIMEOUT_MS);
         if (!reply)
-            return { ok: false, error: `compile timed out after ${COMPILE_TIMEOUT_MS}ms` };
+            return { ok: false, reason: 'load_error', error: `compile timed out after ${COMPILE_TIMEOUT_MS}ms` };
         if (!reply.ok) {
             const fallback = reply.unsupportedImports && reply.unsupportedImports.length > 0
                 ? `imports ${reply.unsupportedImports.join(', ')}, which this proxy does not provide`
                 : 'unknown compile error';
-            return { ok: false, error: reply.error ?? fallback, unsupportedImports: reply.unsupportedImports };
+            return {
+                ok: false,
+                reason: reply.reason ?? 'load_error',
+                error: reply.error ?? fallback,
+                unsupportedImports: reply.unsupportedImports,
+            };
         }
-        return { ok: true, readsReferencedFiles: reply.readsReferencedFiles ?? false };
+        return { ok: true, readsReferencedFiles: reply.readsReferencedFiles ?? false, rego: reply.rego ?? false };
     }
     remove(ruleId) {
         this.ensureWorker().postMessage({ type: 'remove', ruleId });
-        this.consecutiveTimeouts.delete(ruleId);
-        this.disabledRuleIds.delete(ruleId);
+        this.replaced(ruleId);
+    }
+    /** A control-plane rule's version changed: the old version's runaways do not count against the new one. */
+    replaced(ruleId) {
+        this.consecutiveRunaways.delete(ruleId);
+        this.quarantined.delete(ruleId);
     }
     // ── Rescan (driven by the existing policy-tick timer — see policy.ts) ──
     /**
      * Rescans `~/.intutic/wasm/` and (re)compiles anything changed. Also
-     * clears every rule's disabled-by-timeout status — "disable that rule
-     * until the next policy-driven rescan" is this call.
+     * releases every quarantined rule — "quarantined until the next
+     * policy-driven rescan" is this call.
      */
     async rescan() {
+        await this.respawning;
         await this.loader.rescan(this);
-        this.disabledRuleIds.clear();
-        this.consecutiveTimeouts.clear();
+        this.quarantined.clear();
+        this.consecutiveRunaways.clear();
     }
-    /** Terminates the worker and respawns a fresh one, resending every currently-loaded rule's bytes so its module cache is rebuilt. */
-    async respawnWorker() {
+    /**
+     * Replaces the worker, resending every currently-loaded rule's bytes so the
+     * new one's module cache is rebuilt, without waiting for the old one to stop.
+     *
+     * `Worker.terminate()` can take seconds: V8 stops a guest only at an
+     * interrupt check, and a loop around a bulk `memory.fill` reaches one
+     * rarely — measured, 1.5 s on an idle machine and 16 s on a loaded one. The
+     * call that missed its deadline is refused at the deadline; the old worker
+     * stops whenever V8 gets to it, and the next evaluation waits only for the
+     * new worker's recompile (`respawning`, about 50 ms for three Rego rules).
+     */
+    respawnWorker() {
         const old = this.worker;
         this.worker = null;
         if (old) {
@@ -182,34 +283,117 @@ export class WasmRunner {
                 entry.resolve({ ok: false, error: 'worker terminated' });
                 this.pending.delete(id);
             }
-            await old.terminate();
+            old.terminate().catch((err) => {
+                log.warn({ action: 'wasm_worker_terminate_error', err: err.message }, 'WASM worker did not terminate cleanly');
+            });
         }
         // Force-reload every currently-known file into the new worker — its
         // module cache started empty. `force: true` mirrors this loader's own
-        // "worker cache was lost, nothing on disk moved" case.
-        await this.loader.rescan(this, true);
+        // "worker cache was lost, nothing on disk moved" case. The control-plane
+        // rules recompile from the bytes they were fetched with.
+        const respawning = Promise.all([this.loader.rescan(this, true), this.cloud?.reload(this)])
+            .then(() => undefined)
+            .finally(() => {
+            if (this.respawning === respawning)
+                this.respawning = null;
+        });
+        this.respawning = respawning;
     }
     // ── Evaluation ───────────────────────────────────────────────────────
     /**
-     * Evaluates every currently loaded, non-disabled rule (priority order)
-     * against one context, mirroring `registry.rs`'s `evaluate_inner`:
-     * short-circuit on the first block, carry the first reask through in case
-     * a later, higher-priority rule still blocks, `allow` when nothing fired
-     * or every loaded rule was fail-open (timeout/trap/unmapped code).
+     * Evaluates every currently loaded rule (priority order) against one
+     * context, as `registry.rs`'s `evaluate_inner` does: short-circuit on the
+     * first block, carry the first hold and reask through in case a later rule
+     * still blocks, `allow` when nothing fired.
+     *
+     * A rule that reaches no verdict — its deadline, its instruction budget, a
+     * trap or other error, or a result that is not a verdict — refuses the call
+     * (`unavailable`), whatever `mcpProxyFailBehavior` or
+     * `INTUTIC_MCP_FAIL_OPEN` say. That setting exists for control-plane
+     * outages, which an agent cannot cause; a rule's timeout an agent can cause
+     * by padding its input, so it must never become an allow. The refusal
+     * outranks a hold and a reask, since neither an approval nor a retry can
+     * clear a call a rule never judged; a later rule's block still wins,
+     * because it says what is wrong with the call.
+     *
+     * A quarantined rule (see {@link countRunaway}) refuses at once, without
+     * anything being evaluated, until the next rescan.
+     *
+     * A `SHADOW` rule is evaluated in its place and decides nothing: what it
+     * would have done, a refusal for reaching no verdict included, leaves the
+     * call as the other rules decide it. Each evaluation is appended to
+     * `shadowOut`, the evidence promotion out of shadow is judged on, and a
+     * would-act is logged. A quarantined one is skipped, and reported as
+     * nothing, since nothing ran.
      */
-    async evaluate(input) {
-        const rules = this.loader.getRules().filter((r) => !this.disabledRuleIds.has(r.ruleId));
+    async evaluate(input, shadowOut) {
+        const rules = this.activeRules();
+        const held = rules.find((r) => !r.shadow && this.quarantined.has(r.ruleId));
+        if (held) {
+            return {
+                code: 'unavailable',
+                stop: 'quarantined',
+                ruleId: held.ruleId,
+                reason: noVerdictReason(held.ruleId, 'quarantined', `it is quarantined after ${MAX_CONSECUTIVE_RUNAWAYS} runaway evaluations in a row (deadline or budget), until the next rescan`),
+            };
+        }
         if (rules.length === 0)
             return { code: 'allow' };
-        const contextBytes = Buffer.from(JSON.stringify(buildWasmContext(input)));
+        // Each built once, and only if a rule of that kind is loaded.
+        let contextBytes;
+        let regoBytes;
+        const bytesFor = (rego) => rego
+            ? (regoBytes ??= Buffer.from(buildRegoInput(input)))
+            : (contextBytes ??= Buffer.from(JSON.stringify(buildWasmContext(input))));
         let pendingReask = null;
+        let pendingHold = null;
+        let unavailable = null;
         // Read once per evaluation, before any rule runs, so the per-rule
         // deadline covers guest execution only — and only when a rule will ask.
         const files = rules.some((r) => r.readsReferencedFiles) ? await this.prefetchReferencedFiles(input) : undefined;
         for (const rule of rules) {
-            const result = await this.evaluateOne(rule.ruleId, contextBytes, rule.readsReferencedFiles ? files : undefined);
-            if (result === null)
-                continue; // fail-open ALLOW for this rule (timeout, trap, or worker error)
+            if (rule.shadow && this.quarantined.has(rule.ruleId))
+                continue;
+            const outcome = await this.evaluateOne(rule.ruleId, bytesFor(rule.rego), rule.rego ? REGO_EVALUATE_TIMEOUT_MS : EVALUATE_TIMEOUT_MS, rule.readsReferencedFiles ? files : undefined);
+            const failure = 'stop' in outcome ? outcome : undefinedVerdict(outcome);
+            if (rule.shadow) {
+                // A rule that reached no verdict would have refused the call, so it
+                // counts as acting, as the LLM proxy counts its `Unavailable`.
+                const wouldDo = failure ? `no verdict (${failure.stop}): ${failure.detail}` : describeResult(outcome);
+                logShadow(rule.ruleId, wouldDo);
+                shadowOut?.push({ ruleId: rule.ruleId, wouldAct: wouldDo !== undefined });
+                continue;
+            }
+            if (failure) {
+                const quarantinedNow = this.quarantined.has(rule.ruleId);
+                const detail = quarantinedNow
+                    ? `${failure.detail}; it is now quarantined until the next rescan, after ${MAX_CONSECUTIVE_RUNAWAYS} runaway evaluations in a row`
+                    : failure.detail;
+                log.warn({ action: 'wasm_rule_no_verdict', ruleId: rule.ruleId, stop: failure.stop }, `WASM rule reached no verdict: ${detail} — refusing`);
+                if (!unavailable) {
+                    unavailable = {
+                        code: 'unavailable',
+                        stop: failure.stop,
+                        ruleId: rule.ruleId,
+                        reason: noVerdictReason(rule.ruleId, failure.stop, detail),
+                    };
+                }
+                continue;
+            }
+            const result = outcome;
+            if ('decision' in result) {
+                // A Rego rule. Same ordering as the native codes below: a block ends
+                // it, and a hold waits for a person, so it outranks a reask.
+                const reason = result.reason ?? 'Refused by Rego policy';
+                if (result.decision === 'deny')
+                    return { code: 'block', reason, ruleId: rule.ruleId };
+                if (result.decision === 'hold' && !pendingHold) {
+                    pendingHold = { code: 'hold', reason, ruleId: rule.ruleId, ...(result.riskTier ? { riskTier: result.riskTier } : {}) };
+                }
+                if (result.decision === 'reask' && !pendingReask)
+                    pendingReask = { code: 'reask', reason, ruleId: rule.ruleId };
+                continue;
+            }
             switch (result.code) {
                 case 0:
                     break; // Bypass — try the next rule
@@ -235,15 +419,12 @@ export class WasmRunner {
                         };
                     }
                     break;
-                default:
-                    log.warn({ action: 'wasm_unmapped_verdict', ruleId: rule.ruleId, code: result.code }, 'WASM rule returned an unmapped verdict code; allowing. Valid codes are 0 (allow), 1 (block), 3 (reask).');
-                    break;
             }
         }
-        return pendingReask ?? { code: 'allow' };
+        return unavailable ?? pendingHold ?? pendingReask ?? { code: 'allow' };
     }
     /**
-     * The referenced-files table for this evaluation (TD-441). With no
+     * The referenced-files table for this evaluation. With no
      * `INTUTIC_WASM_MANIFEST_ROOT` the table is empty and every read refuses.
      */
     async prefetchReferencedFiles(input) {
@@ -256,48 +437,57 @@ export class WasmRunner {
         }
         return files.toTable();
     }
-    /** One rule's evaluation, raced against `EVALUATE_TIMEOUT_MS`. `null` means fail-open (timeout, worker error, or guest trap). */
-    async evaluateOne(ruleId, contextBytes, files) {
+    /** One rule's evaluation, raced against its deadline: its answer, or why it reached none. */
+    async evaluateOne(ruleId, contextBytes, timeoutMs, files) {
+        // A worker replaced after a missed deadline has its rules only once they
+        // recompile; an evaluation sent before then would find none.
+        await this.respawning;
         const id = this.allocId();
-        const reply = await this.send({ type: 'evaluate', id, ruleId, bytes: toArrayBuffer(contextBytes), ...(files ? { files } : {}) }, EVALUATE_TIMEOUT_MS);
+        const reply = await this.send({ type: 'evaluate', id, ruleId, bytes: toArrayBuffer(contextBytes), ...(files ? { files } : {}) }, timeoutMs);
         if (reply === null) {
-            // Timed out. Mirrors `runner.rs`'s `Err(_) => Bypass` — this call
-            // fails open — plus the MCP-specific per-rule consecutive-timeout
-            // disable ladder the task calls for.
-            log.warn({ action: 'wasm_evaluate_timeout', ruleId, timeoutMs: EVALUATE_TIMEOUT_MS }, 'WASM rule evaluation timed out — failing open');
-            // terminate + lazily respawn: the NEXT evaluate() call pays the
-            // respawn cost via ensureWorker()/rescan(force); triggered here so a
-            // wedged worker does not keep timing out every rule behind it in this
-            // same evaluate() loop.
-            await this.respawnWorker();
+            // Timed out: `runner.rs`'s deadline, plus this proxy's quarantine. The
+            // worker is replaced so a wedged one does not time out every rule
+            // behind it; this call does not wait for that (see respawnWorker).
+            this.respawnWorker();
             this.countRunaway(ruleId);
-            return null;
+            return { stop: 'deadline', detail: `it ran past its ${timeoutMs} ms deadline` };
         }
         if (!reply.ok && reply.fuelExhausted) {
             // The budget trapped the guest, so the worker is healthy: no respawn,
-            // but the same disable ladder as a timeout, since it is the same
+            // but the same quarantine count as a timeout, since it is the same
             // runaway rule caught sooner.
-            log.warn({ action: 'wasm_evaluate_fuel_exhausted', ruleId }, 'WASM rule ran out of its instruction budget — failing open');
             this.countRunaway(ruleId);
-            return null;
+            return { stop: 'budget', detail: 'it used up its instruction budget' };
         }
         if (!reply.ok) {
-            // Worker-reported failure: a guest trap (including one following an
-            // `abort` call) or an internal error. Fail-open ALLOW for this call,
-            // never a crash — matches the task's explicit instruction.
-            log.warn({ action: 'wasm_evaluate_error', ruleId, err: reply.error }, 'WASM rule evaluation failed — failing open');
-            return null;
+            // A guest trap (including one following an `abort` call), a result
+            // that is not a decision, or an internal error — never a crash.
+            return reply.notADecision
+                ? { stop: 'result', detail: reply.error ?? 'it returned a result that is not a decision' }
+                : { stop: 'error', detail: `it failed while running: ${reply.error ?? 'unknown error'}` };
+        }
+        // A clean reply resets this rule's runaway streak.
+        this.consecutiveRunaways.delete(ruleId);
+        if (reply.decision) {
+            return {
+                decision: reply.decision,
+                ...(reply.reason ? { reason: reply.reason } : {}),
+                ...(reply.riskTier ? { riskTier: reply.riskTier } : {}),
+            };
         }
-        // A clean reply resets this rule's timeout streak.
-        this.consecutiveTimeouts.delete(ruleId);
         return { code: reply.code ?? -1, reason: reply.reason };
     }
+    /**
+     * Counts one runaway (deadline or budget) against `ruleId`, quarantining
+     * the rule at {@link MAX_CONSECUTIVE_RUNAWAYS} in a row. Logged once, at the
+     * transition; what a quarantined rule means for a call is `evaluate`'s.
+     */
     countRunaway(ruleId) {
-        const attempts = (this.consecutiveTimeouts.get(ruleId) ?? 0) + 1;
-        this.consecutiveTimeouts.set(ruleId, attempts);
-        if (attempts >= MAX_CONSECUTIVE_TIMEOUTS) {
-            this.disabledRuleIds.add(ruleId);
-            log.warn({ action: 'wasm_rule_disabled', ruleId, consecutiveRunaways: attempts }, 'WASM rule disabled after consecutive timeouts or budget exhaustion — will retry on the next policy-driven rescan');
+        const runaways = (this.consecutiveRunaways.get(ruleId) ?? 0) + 1;
+        this.consecutiveRunaways.set(ruleId, runaways);
+        if (runaways >= MAX_CONSECUTIVE_RUNAWAYS && !this.quarantined.has(ruleId)) {
+            this.quarantined.add(ruleId);
+            log.warn({ action: 'wasm_rule_quarantined', ruleId, consecutiveRunaways: runaways }, 'WASM rule quarantined after consecutive timeouts or budget exhaustion — retried on the next policy-driven rescan');
         }
     }
     /** Terminates the worker. Safe to call even if one was never spawned. */
@@ -313,6 +503,31 @@ export class WasmRunner {
             await worker.terminate();
     }
 }
+/** What a rule's answer would do to the call, for the shadow log; `undefined` when it allows. */
+function describeResult(result) {
+    if ('decision' in result)
+        return result.decision === 'allow' ? undefined : result.decision;
+    if (result.code === 0)
+        return undefined;
+    return result.code === 3 ? 'reask' : 'block';
+}
+/** A shadowed rule's outcome, logged when it would have acted. */
+function logShadow(ruleId, wouldDo) {
+    if (wouldDo === undefined)
+        return;
+    log.info({ action: 'wasm_shadow_would_act', ruleId, shadowed: true, verdict: wouldDo }, 'WASM rule would have acted; shadow mode, call unchanged');
+}
+/** A native code that is not a verdict: the rule reached none. */
+function undefinedVerdict(result) {
+    if ('decision' in result || [0, 1, 2, 3].includes(result.code))
+        return null;
+    return { stop: 'result', detail: `it returned ${result.code}, which is not a verdict code (0 allow, 1 block, 3 reask)` };
+}
+/** The refusal an agent reads when a rule reached no verdict: which rule, and why. */
+function noVerdictReason(ruleId, stop, detail) {
+    return (`Custom rule ${ruleId} reached no verdict (${stop}): ${detail}. Tool call blocked: a ` +
+        `rule that cannot decide never allows.`);
+}
 function toArrayBuffer(bytes) {
     // Structured-clone (postMessage) needs an ArrayBuffer, not a Node Buffer
     // view that may share a larger underlying pool — slice guarantees the

package/dist/wasm/runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAA2C,MAAM,aAAa,CAAA;AACjG,OAAO,EAAE,gBAAgB,EAAyB,MAAM,cAAc,CAAA;AACtE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAA6B,MAAM,sBAAsB,CAAA;AAExG,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD;;;GAGG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B;wDACwD;AACxD,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEhC;;;GAGG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAYlC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAA;IAClG,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,UAAU,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9E,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AACnE,CAAC;AAED,MAAM,OAAO,UAAU;IACJ,MAAM,CAAY;IAC3B,MAAM,GAAkB,IAAI,CAAA;IAC5B,aAAa,GAAG,CAAC,CAAA;IACjB,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IACzC,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/C,eAAe,GAAG,IAAI,GAAG,EAAU,CAAA;IAE3C,YAAY,WAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAA;IAC3D,CAAC;IAED,uDAAuD;IACvD,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAC7B,CAAC;IAED,yGAAyG;IACzG,gBAAgB;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACpD,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAA;QACnC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,gBAAgB,EAAE,CAAA;QAC5C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC9E,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAkC,EAAE,EAAE;YAC1D,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;gBAAE,OAAM;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtC,IAAI,CAAC,KAAK;gBAAE,OAAM,CAAC,gCAAgC;YACnD,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC3B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACpB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAA;QAC1F,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IACxE,IAAI,CAAI,GAA6C,EAAE,SAAiB;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC,CAAA;gBACxC,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC,EAAE,SAAS,CAAC,CAAA;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YACjF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,OAAO;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAA;QAC7B,IAAI,CAAC,aAAa,IAAI,CAAC,CAAA;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,yEAAyE;IAEzE,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,KAAiB;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAK1B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAA;QACpF,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,kBAAkB,IAAI,EAAE,CAAA;QAC1F,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,QAAQ,GACZ,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,WAAW,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;gBACrF,CAAC,CAAC,uBAAuB,CAAA;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAA;QACpG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,KAAK,EAAE,CAAA;IAChF,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3D,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;IAED,0EAA0E;IAE1E;;;;OAIG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAA;QAC5B,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAA;IAClC,CAAC;IAED,oIAAoI;IAC5H,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,IAAI,GAAG,EAAE,CAAC;YACR,kEAAkE;YAClE,0CAA0C;YAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBACzB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;gBACxD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACzB,CAAC;YACD,MAAM,GAAG,CAAC,SAAS,EAAE,CAAA;QACvB,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,uDAAuD;QACvD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACtC,CAAC;IAED,wEAAwE;IAExE;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAuB;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QACvF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QAEhD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACzE,IAAI,YAAY,GAA6D,IAAI,CAAA;QAEjF,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAE/G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YAC/G,IAAI,MAAM,KAAK,IAAI;gBAAE,SAAQ,CAAC,iEAAiE;YAE/F,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,CAAC;oBACJ,MAAK,CAAC,6BAA6B;gBACrC,KAAK,CAAC;oBACJ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wCAAwC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBAClH,KAAK,CAAC;oBACJ,gEAAgE;oBAChE,+DAA+D;oBAC/D,2DAA2D;oBAC3D,oCAAoC;oBACpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC1D,+GAA+G,CAChH,CAAA;oBACD,OAAO;wBACL,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wDAAwD;wBACjF,MAAM,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAA;gBACH,KAAK,CAAC;oBACJ,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,YAAY,GAAG;4BACb,IAAI,EAAE,OAAO;4BACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,2DAA2D;4BACpF,MAAM,EAAE,IAAI,CAAC,MAAM;yBACpB,CAAA;oBACH,CAAC;oBACD,MAAK;gBACP;oBACE,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAC3E,yGAAyG,CAC1G,CAAA;oBACD,MAAK;YACT,CAAC;QACH,CAAC;QAED,OAAO,YAAY,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CAAC,KAAuB;QAC3D,MAAM,IAAI,GAAG,WAAW,EAAE,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAA;QACnD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;QACpG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,0CAA0C,CAAC,CAAA;QACtJ,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC;IAED,iIAAiI;IACzH,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,YAAoB,EACpB,KAA4B;QAE5B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAC3B,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACjG,mBAAmB,CACpB,CAAA;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,kEAAkE;YAClE,kEAAkE;YAClE,qCAAqC;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,+CAA+C,CAAC,CAAA;YACtI,gEAAgE;YAChE,qEAAqE;YACrE,sEAAsE;YACtE,wBAAwB;YACxB,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;YAC1B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACrC,sEAAsE;YACtE,iEAAiE;YACjE,8BAA8B;YAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,MAAM,EAAE,EAAE,4DAA4D,CAAC,CAAA;YAC1H,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,2DAA2D;YAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,4CAA4C,CAAC,CAAA;YACnH,OAAO,IAAI,CAAA;QACb,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IACzD,CAAC;IAEO,YAAY,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAChE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9C,IAAI,QAAQ,IAAI,wBAAwB,EAAE,CAAC;YACzC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAChC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EACvE,kHAAkH,CACnH,CAAA;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;YACvD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACzB,CAAC;QACD,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,SAAS,EAAE,CAAA;IACtC,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,yEAAyE;IACzE,sEAAsE;IACtE,+DAA+D;IAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAA;AACjG,CAAC"}
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/wasm/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAkD,MAAM,aAAa,CAAA;AAExG,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAyB,MAAM,cAAc,CAAA;AACtF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAA6B,MAAM,sBAAsB,CAAA;AAExG,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAA;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AAE9C;wDACwD;AACxD,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEhC;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AA0DzC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAA;IAClG,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,UAAU,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9E,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AACnE,CAAC;AAED,MAAM,OAAO,UAAU;IAiBF;IAhBF,MAAM,CAAY;IAC3B,MAAM,GAAkB,IAAI,CAAA;IAC5B,aAAa,GAAG,CAAC,CAAA;IACjB,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IACzC,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvD,kFAAkF;IAC1E,UAAU,GAAyB,IAAI,CAAA;IACvC,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IAEvC;;;;OAIG;IACH,YACE,WAAoB,EACH,KAAoB;QAApB,UAAK,GAAL,KAAK,CAAe;QAErC,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAA;IAC3D,CAAC;IAED,uDAAuD;IACvD,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAC7B,CAAC;IAED,wFAAwF;IACxF,gBAAgB;QACd,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAChD,CAAC;IAED;;;;OAIG;IACK,WAAW;QACjB,MAAM,KAAK,GAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrE,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;YAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ;SAC5B,CAAC,CAAC,CAAA;QACH,MAAM,KAAK,GAAiB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7D,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;YAC5C,MAAM,EAAE,KAAK;SACd,CAAC,CAAC,CAAA;QACH,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,WAAsD;QACzE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW;YAAE,OAAM;QACvC,MAAM,IAAI,CAAC,UAAU,CAAA;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;IAED;;;;;OAKG;IACH,gBAAgB;QACd,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC7C,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAA;QACnC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,gBAAgB,EAAE,CAAA;QAC5C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC9E,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAkC,EAAE,EAAE;YAC1D,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;gBAAE,OAAM;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtC,IAAI,CAAC,KAAK;gBAAE,OAAM,CAAC,gCAAgC;YACnD,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC3B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACpB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAA;QAC1F,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IACxE,IAAI,CAAI,GAA6C,EAAE,SAAiB;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC,CAAA;gBACxC,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC,EAAE,SAAS,CAAC,CAAA;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YACjF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,OAAO;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAA;QAC7B,IAAI,CAAC,aAAa,IAAI,CAAC,CAAA;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,yEAAyE;IAEzE,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,KAAiB;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAO1B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAA;QACpF,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,2BAA2B,kBAAkB,IAAI,EAAE,CAAA;QAChH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,QAAQ,GACZ,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,WAAW,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;gBACrF,CAAC,CAAC,uBAAuB,CAAA;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,YAAY;gBACpC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ;gBAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;aAC7C,CAAA;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,CAAA;IAC3G,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAED,2GAA2G;IAC3G,QAAQ,CAAC,MAAc;QACrB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;IAED,0EAA0E;IAE1E;;;;OAIG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,UAAU,CAAA;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAA;QACxB,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAA;IAClC,CAAC;IAED;;;;;;;;;;OAUG;IACK,aAAa;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,IAAI,GAAG,EAAE,CAAC;YACR,kEAAkE;YAClE,0CAA0C;YAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBACzB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;gBACxD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACzB,CAAC;YACD,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,uCAAuC,CAAC,CAAA;YAC3H,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;aACvF,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACrB,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;gBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;QAC5D,CAAC,CAAC,CAAA;QACJ,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;IAED,wEAAwE;IAExE;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAuB,EAAE,SAA0B;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3E,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,eAAe,CACrB,IAAI,CAAC,MAAM,EACX,aAAa,EACb,2BAA2B,wBAAwB,2EAA2E,CAC/H;aACF,CAAA;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QAEhD,8DAA8D;QAC9D,IAAI,YAAgC,CAAA;QACpC,IAAI,SAA6B,CAAA;QACjC,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAU,EAAE,CACzC,IAAI;YACF,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7E,IAAI,YAAY,GAA6D,IAAI,CAAA;QACjF,IAAI,WAAW,GAA+E,IAAI,CAAA;QAClG,IAAI,WAAW,GAAyD,IAAI,CAAA;QAE5E,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAE/G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAQ;YAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CACpC,IAAI,CAAC,MAAM,EACX,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EACnB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,mBAAmB,EAC1D,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC9C,CAAA;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;YACvE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,+DAA+D;gBAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,OAAqB,CAAC,CAAA;gBACnH,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAC/B,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC,CAAA;gBACzE,SAAQ;YACV,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACxD,MAAM,MAAM,GAAG,cAAc;oBAC3B,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,wDAAwD,wBAAwB,+BAA+B;oBAClI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAA;gBAClB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAC3E,iCAAiC,MAAM,aAAa,CACrD,CAAA;gBACD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,WAAW,GAAG;wBACZ,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;qBAC3D,CAAA;gBACH,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,MAAM,MAAM,GAAG,OAAqB,CAAA;YAEpC,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;gBACzB,qEAAqE;gBACrE,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,wBAAwB,CAAA;gBACxD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBACrF,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC/C,WAAW,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;gBACxH,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,YAAY;oBAAE,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBAC/G,SAAQ;YACV,CAAC;YAED,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,CAAC;oBACJ,MAAK,CAAC,6BAA6B;gBACrC,KAAK,CAAC;oBACJ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wCAAwC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBAClH,KAAK,CAAC;oBACJ,gEAAgE;oBAChE,+DAA+D;oBAC/D,2DAA2D;oBAC3D,oCAAoC;oBACpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC1D,+GAA+G,CAChH,CAAA;oBACD,OAAO;wBACL,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wDAAwD;wBACjF,MAAM,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAA;gBACH,KAAK,CAAC;oBACJ,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,YAAY,GAAG;4BACb,IAAI,EAAE,OAAO;4BACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,2DAA2D;4BACpF,MAAM,EAAE,IAAI,CAAC,MAAM;yBACpB,CAAA;oBACH,CAAC;oBACD,MAAK;YACT,CAAC;QACH,CAAC;QAED,OAAO,WAAW,IAAI,WAAW,IAAI,YAAY,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACxE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CAAC,KAAuB;QAC3D,MAAM,IAAI,GAAG,WAAW,EAAE,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAA;QACnD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;QACpG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,0CAA0C,CAAC,CAAA;QACtJ,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC;IAED,6FAA6F;IACrF,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,YAAoB,EACpB,SAAiB,EACjB,KAA4B;QAE5B,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,IAAI,CAAC,UAAU,CAAA;QACrB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAW3B,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACjG,SAAS,CACV,CAAA;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,uEAAuE;YACvE,kEAAkE;YAClE,mEAAmE;YACnE,IAAI,CAAC,aAAa,EAAE,CAAA;YACpB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,SAAS,cAAc,EAAE,CAAA;QACjF,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACrC,sEAAsE;YACtE,mEAAmE;YACnE,8BAA8B;YAC9B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAA;QACxE,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,mEAAmE;YACnE,gEAAgE;YAChE,OAAO,KAAK,CAAC,YAAY;gBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,6CAA6C,EAAE;gBAC1F,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,4BAA4B,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE,EAAE,CAAA;QAC7F,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IACzD,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAChE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9C,IAAI,QAAQ,IAAI,wBAAwB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC5B,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAC1E,kHAAkH,CACnH,CAAA;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;YACvD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACzB,CAAC;QACD,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,SAAS,EAAE,CAAA;IACtC,CAAC;CACF;AAED,iGAAiG;AACjG,SAAS,cAAc,CAAC,MAAkB;IACxC,IAAI,UAAU,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAA;IAC1F,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;AAC9C,CAAC;AAED,kEAAkE;AAClE,SAAS,SAAS,CAAC,MAAc,EAAE,OAA2B;IAC5D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAM;IACjC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAC7E,yDAAyD,CAC1D,CAAA;AACH,CAAC;AAED,kEAAkE;AAClE,SAAS,gBAAgB,CAAC,MAAkB;IAC1C,IAAI,UAAU,IAAI,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,MAAM,CAAC,IAAI,2DAA2D,EAAE,CAAA;AAC1H,CAAC;AAED,sFAAsF;AACtF,SAAS,eAAe,CAAC,MAAc,EAAE,IAAc,EAAE,MAAc;IACrE,OAAO,CACL,eAAe,MAAM,wBAAwB,IAAI,MAAM,MAAM,yBAAyB;QACtF,uCAAuC,CACxC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,yEAAyE;IACzE,sEAAsE;IACtE,+DAA+D;IAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAA;AACjG,CAAC"}

package/dist/wasm/watch.js

@@ -1,6 +1,6 @@
 /**
  * Watch the local rules directory and call back, debounced, when a `.wasm`
- * file appears, changes or goes away (TD-442).
+ * file appears, changes or goes away.
  *
  * The rescan rides the 60-second policy tick (`policy.ts` `start(onTick)`)
  * and no second timer was wanted. A filesystem watcher is not a timer: it

package/dist/wasm/worker.d.ts

@@ -10,23 +10,27 @@
  * happen to share a rule.
  *
  * Protocol (see `runner.ts` for the main-thread side):
- *   compile  { type:'compile',  id, ruleId, bytes }  -> { type:'compile-result',  id, ruleId, ok, unsupportedImports?, readsReferencedFiles?, error? }
+ *   compile  { type:'compile',  id, ruleId, bytes }  -> { type:'compile-result',  id, ruleId, ok, reason?, unsupportedImports?, readsReferencedFiles?, rego?, error? }
  *   remove   { type:'remove', ruleId }                  (no reply)
- *   evaluate { type:'evaluate', id, ruleId, bytes, files? } -> { type:'evaluate-result', id, ruleId, ok, code?, reason?, error? }
+ *   evaluate { type:'evaluate', id, ruleId, bytes, files? } -> { type:'evaluate-result', id, ruleId, ok, code?, decision?, reason?, riskTier?, error?, fuelExhausted?, notADecision? }
  *
- * `files` is the per-evaluation referenced-files table (TD-441), posted only
+ * A Rego rule (an OPA build, `@intutic/shared-types`' Rego host) is compiled
+ * and evaluated here too; its `evaluate` bytes are the Rego input document and
+ * its reply carries `decision` instead of `code`.
+ *
+ * `files` is the per-evaluation referenced-files table, posted only
  * to a rule that imports `read_referenced_file`; it is rebuilt here into the
  * host-import state, so the main thread never shares memory with the guest.
  *
  * A guest `abort` call is inert (hostImports.ts logs and returns); an
  * uncaught exception or trap during instantiation/evaluation is caught here
- * and reported as `ok:false` — the caller (runner.ts) treats that as
- * fail-open ALLOW, exactly like a timeout, never a crash.
+ * and reported as `ok:false` — the caller (runner.ts) treats that as a rule
+ * that reached no verdict, exactly like a timeout, never a crash.
  *
  * @module
  */
 /**
- * Guest memory ceiling, `runner.rs`'s 16MB `StoreLimits` (TD-440). Enforced at
+ * Guest memory ceiling, `runner.rs`'s 16MB `StoreLimits`. Enforced at
  * load by `capDeclaredMemory`: the module's own memory is rewritten to declare
  * this as its maximum, so V8 refuses any `memory.grow` past it (the call
  * returns -1) instead of growing. A module whose initial size is already over

package/dist/wasm/worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/wasm/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AASH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QAAmB,CAAA"}
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/wasm/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAyBH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QAAmB,CAAA"}