@intutic/sync-daemon 1.9.0 → 1.10.1

package/dist/lib/policySnapshot.js

@@ -0,0 +1,637 @@
+/**
+ * policySnapshot.ts — ships workspace policy *to* the machine, so the gate does
+ * not have to ship the decision off it.
+ *
+ * # Why
+ *
+ * TD-307: `POST /api/v1/hook-gate` was called by two of thirteen gates, so DLP,
+ * `BLOCK:` SOPs, SSO policy and promoted findings reached two of thirteen. The
+ * obvious repair — route the other eleven through the gate — is the wrong one:
+ * those eleven enforce locally and **fail closed**, the two network callers were
+ * the only ones that **fail open**, and the gate's allow path is five or six
+ * sequential Postgres round-trips. Routing everyone through it would trade
+ * fail-closed for fail-open and put a control-plane outage on every `Bash`.
+ *
+ * Almost none of that decision needs the network. So the daemon resolves policy
+ * once per sync cycle and writes it here; every gate reads a local file.
+ *
+ * # Two tiers, one invariant
+ *
+ * The **static floor** (`staticFloorPatterns()`) is compiled into each gate and
+ * always enforced. The **dynamic tier** is this file, and it is *additive only*:
+ *
+ * > For every harness and every snapshot state, the set of calls blocked after
+ * > this change is a superset of the set blocked before.
+ *
+ * That is what makes the failure modes tractable. A missing or corrupt snapshot
+ * costs only rules that, for eleven of the thirteen gates, did not exist at all
+ * before — so degrading returns to yesterday's behaviour rather than opening a
+ * new hole. It is also why an absent snapshot does **not** fail closed: that
+ * would brick every agent on every machine at install time, to replace
+ * protection the floor already provides.
+ *
+ * # Where it lives, and why that matters
+ *
+ * `~/.intutic/hooks/policy-snapshot.{json,rules}`. The directory is load-bearing:
+ * `.intutic/hooks` is already in `UNIVERSAL_PROTECTED_PATHS`, so all thirteen
+ * gates refuse an agent's attempt to write the snapshot on day one, with no new
+ * entry and no new code.
+ *
+ * # The ` WHERE ` clause survives this pipeline now
+ *
+ * A SOP titled `BLOCK:^shell$ WHERE kubectl\s+apply(?!.*@sha256:):reason`
+ * resolves to `{toolPattern, argPattern}` at `GET /api/v1/policy/resolve`
+ * (the demo doctor's "argPattern served" check proves that half). This module
+ * used to be where the other half died: `ResolvedPolicy` did not declare
+ * `argPattern`, `toGuardPattern` did not carry it, and the rule reached all
+ * twelve tool-call gates as "block `shell` unconditionally" — simultaneously
+ * failing to enforce the argument condition and re-manufacturing the exact
+ * over-blocking (`make test` refused) the WHERE grammar was invented to
+ * eliminate. It now travels: verbatim in the JSON's `sopRules` and `rules`,
+ * base64-encoded in the `.rules` projection's seventh column (see
+ * `RULES_COLUMNS` in gateBody.ts for the encoding contract), and every gate
+ * family conditions a name-matched rule on it before firing.
+ *
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createHash } from 'node:crypto';
+import { createLogger } from '@intutic/logger';
+import { toRulesLine, GATE_VERSION, RULES_COLUMNS } from '../harness/gateBody.js';
+import { DESTRUCTIVE_COMMAND_PATTERNS, SKILL_SURFACE_PATTERNS, assertPortableEre, } from '../harness/protectedPaths.js';
+const log = createLogger('sync-policy-snapshot');
+/** Directory every gate looks in. Inside `.intutic/hooks`, which is already
+ *  protected — see the module note. */
+export const DEFAULT_SNAPSHOT_DIR = path.join(os.homedir(), '.intutic', 'hooks');
+export const SNAPSHOT_JSON = 'policy-snapshot.json';
+export const SNAPSHOT_RULES = 'policy-snapshot.rules';
+/**
+ * Whether the destructive tier ships as `block` or as `warn`.
+ *
+ * `warn`. These seven patterns qualify for `block` on the merits — every one is
+ * unrecoverable without a reinstall or a backup — but they have never run
+ * against real developer traffic, and they would land on thirteen harnesses at
+ * once. A false positive here does not merely annoy: the fastest workaround
+ * available to a blocked developer is `chflags nouchg` on the hook, which is the
+ * exact bypass `GOVERNANCE_BYPASS_PATTERNS` exists to stop. Shipping too hard
+ * manufactures our own adversary.
+ *
+ * So they ride the advisory tier first and earn promotion from
+ * `tool_flagged` telemetry — the same discipline `sslGateEvaluator.ts` follows
+ * for SSL enforcement, and the same one `packages/proxy/src/plugins/anomaly`
+ * states as the promotion rule. Flipping this constant is the promotion, and it
+ * belongs in a commit alongside the measurement that licenses it.
+ *
+ * Shipping them *through the snapshot* rather than compiling them into the gate
+ * is the other half: the set we are least sure about is the set we can retract
+ * in one sync cycle instead of one release.
+ */
+export const DESTRUCTIVE_TIER_SEVERITY = 'warn';
+/**
+ * Whether the skill-directory-write tier ships as `block` or as `warn`.
+ *
+ * `block` — deliberately not following `DESTRUCTIVE_TIER_SEVERITY`'s warn-first
+ * ramp, because the thing that ramp is buying time for does not exist on this
+ * surface. `DESTRUCTIVE_COMMAND_PATTERNS` rides at `warn` because those seven
+ * families are unmeasured against real developer traffic and a false positive
+ * has a real cost (see that constant's own comment). `SKILL_SURFACE_PATTERNS`
+ * is not that kind of rule: it does not run `scanSkillContent` or judge
+ * anything about what a skill file says, only WHERE a write's target path
+ * points — `.agents/skills/**` or `.claude/skills/**`, a deterministic,
+ * zero-ambiguity match. TD-358 (`docs/TECH_DEBT.md`) says this about exactly
+ * that distinction: "Path-matching is the one exception, and it is not
+ * actually an exception to the measurement requirement — it never needed
+ * one." There is no false-positive rate to earn a promotion by measuring,
+ * because there is nothing probabilistic here to measure in the first place.
+ *
+ * The second half of the argument is what `warn` actually buys on this
+ * surface, and the answer is nothing. `SECRET_CONTENT_PATTERNS`
+ * (`harness/protectedPaths.ts`) skips the warn-first ramp for the same reason
+ * and states the principle this constant now follows: "A warn that lets the
+ * write proceed IS the incident." A poisoned skill file written under
+ * warn-only is not a near-miss sitting in telemetry waiting for a human to
+ * notice — it is a file on disk that the very next agent session loads and
+ * trusts as instructions, the same way it trusts its own system prompt. Warn
+ * logs the write and lets it land anyway, so there is no window in which the
+ * advisory tier protected anything. That is what makes this different from
+ * `DESTRUCTIVE_COMMAND_PATTERNS`: a destructive *command*'s warn tier buys a
+ * chance for a human to notice before the damage is done; a skill file, once
+ * written, already is the damage.
+ *
+ * Shipped *through the snapshot* rather than promoted in place in
+ * `staticFloorPatterns()`, for the same operational reason
+ * `DESTRUCTIVE_TIER_SEVERITY` is: the rollout, not the mechanism, is the thing
+ * still short on field time, and the snapshot channel is what makes it
+ * retractable in one sync cycle instead of one release if that turns out
+ * wrong. `staticFloorPatterns()` keeps its two `SKILL_SURFACE_PATTERNS`
+ * entries at `warn` — unchanged by this constant — as the degraded-mode
+ * baseline for a workspace with no snapshot, or an invalid one; this constant
+ * is what promotes the steady state to `block` everywhere a valid snapshot has
+ * landed. Flipping it back to `'warn'` is the retraction, exactly as it is for
+ * `DESTRUCTIVE_TIER_SEVERITY`.
+ */
+export const SKILL_SURFACE_TIER_SEVERITY = 'block';
+/**
+ * Tool names used to detect a rule that blocks everything.
+ *
+ * A pattern matching all of these is a catch-all whatever it looks like, so this
+ * catches `.*`, `.+`, `[A-Za-z]*` and anything else someone reaches for — rather
+ * than a denylist of the three spellings we happened to think of.
+ */
+const CANARY_TOOLS = [
+    'Bash', 'Read', 'Write', 'Edit', 'Glob', 'Grep', 'Task', 'WebFetch',
+    'NotebookEdit', 'TodoWrite', 'run_command', 'str_replace_editor',
+    // M3: two `mcp__<server>__<tool>`-shaped canaries, so a rule that is
+    // scoped to one MCP server (e.g. `mcp__github__.*`) is exercised against
+    // this same threshold check as every other tool-name pattern, and a rule
+    // that reaches all the way into MCP-tool-shaped names (not just the
+    // native tool names above) is still caught as a catch-all.
+    'mcp__github__create_issue', 'mcp__filesystem__read_file',
+];
+/**
+ * Strips a repeated character from one end of a string, in linear time.
+ *
+ * `s.replace(/\$+$/, '')` is the obvious spelling and it is quadratic. The
+ * quantifier is greedy and the anchor is at the *end*, so on a string that does
+ * not finish with the character, every start offset consumes the whole run and
+ * then backtracks through it: measured on `'$'.repeat(n) + 'a'`, 20 KB took
+ * 130 ms and 80 KB took 2 seconds. A string that *does* end with it matches at
+ * the first offset and returns instantly, which is why the obvious test for
+ * this passes — CodeQL flagged all three call sites as `js/polynomial-redos`.
+ *
+ * Two of them run over `toolPattern`, which arrives from the control plane and
+ * is authored per workspace, on the path that decides whether a policy rule
+ * ships to the blocking gate.
+ */
+function stripEnd(s, ch) {
+    let end = s.length;
+    while (end > 0 && s[end - 1] === ch)
+        end -= 1;
+    return s.slice(0, end);
+}
+/** The same, from the front. Anchored at the start, so this one is linear. */
+function stripStart(s, ch) {
+    let i = 0;
+    while (i < s.length && s[i] === ch)
+        i += 1;
+    return s.slice(i);
+}
+/**
+ * Decides whether a control-plane rule is safe to put on a blocking path.
+ *
+ * Returns the reason for rejection, or `null` if the rule is fine. Rejections
+ * are logged rather than thrown: one bad SOP must not cost the workspace every
+ * other rule.
+ */
+export function validateRule(toolPattern, ruleId) {
+    const raw = (toolPattern ?? '').trim();
+    if (!raw)
+        return 'empty toolPattern';
+    // Anchors are meaningless once wrapped for token matching, and are the most
+    // common thing a SOP author writes out of habit.
+    const stripped = stripEnd(stripStart(raw, '^'), '$');
+    if (!stripped)
+        return 'toolPattern was only anchors';
+    const wrapped = ` (${stripped}) `;
+    try {
+        assertPortableEre(wrapped, ruleId);
+    }
+    catch (err) {
+        return `not portable across grep and JS — ${err instanceof Error ? err.message : String(err)}`;
+    }
+    let re;
+    try {
+        re = new RegExp(wrapped);
+    }
+    catch {
+        return 'does not compile';
+    }
+    // A threshold rather than "matches all of them". `[A-Za-z]*` matches ten of
+    // these fourteen — it misses only the four with an underscore — and shipping
+    // it to a blocking path would stop essentially every tool call. Requiring a
+    // clean sweep would have let it through on a technicality.
+    //
+    // The ratio is 0.7, not 0.8, and that is a deliberate M3 adjustment, not a
+    // drive-by tweak. Before M3, CANARY_TOOLS held 12 entries, 2 of them
+    // underscored (`run_command`, `str_replace_editor`), so `[A-Za-z]*` hit 10 of
+    // 12 (83%) — above an 0.8 threshold, correctly rejected. M3 added two more
+    // *underscored* canaries (`mcp__github__create_issue`,
+    // `mcp__filesystem__read_file`, both required by name — see CANARY_TOOLS)
+    // without adding any non-underscored ones, so the same `[A-Za-z]*` pattern
+    // now hits 10 of 14 (71%): still every alphabetic-only tool name there is,
+    // but under an unchanged 0.8 threshold that stops being "a catch-all" and
+    // starts being "accepted" — silently weakening a case
+    // `harnessProtectedPaths`... `policySnapshot.test.ts` pins by name. Lowering
+    // the ratio to 0.7 keeps the absolute hit-count threshold at 10 (`Math.ceil`
+    // of both 12*0.8 and 14*0.7), so `[A-Za-z]*` is rejected exactly as before —
+    // the ratio moved so the THRESHOLD would not.
+    const hits = CANARY_TOOLS.filter((t) => re.test(` ${t} `)).length;
+    const limit = Math.ceil(CANARY_TOOLS.length * 0.7);
+    if (hits >= limit) {
+        return (`matches ${hits} of ${CANARY_TOOLS.length} common tool names — this is a ` +
+            `catch-all and would block the workspace`);
+    }
+    return null;
+}
+/** Converts one resolved SOP rule into a gate pattern, or null if unusable. */
+function toGuardPattern(rule, shadow) {
+    // Only `block`. The control plane also emits `{toolPattern: '.*', action:
+    // 'warn'}` for every HIGH/CRITICAL-risk SOP (evaluate.ts) — a live landmine
+    // for anything that ships rules to a blocking path, and the reason this filter
+    // is the first line rather than an afterthought.
+    //
+    // One exception (LLD #71): a rule the control plane projects from a cited
+    // policy guardrail in SHADOW carries `origin: 'guardrail'` and `action:
+    // 'warn'`. It ships at severity `warn` — the gate logs `tool_flagged` and
+    // allows — so the rule can earn its evidence. That is the documented meaning
+    // of `warn` ("has not earned the right to block yet"), and it is still
+    // additive: a warn rule blocks nothing. `validateRule` below still applies,
+    // so a catch-all guardrail is refused the same way.
+    //
+    // And `require_approval` (a `REQUIRE_APPROVAL:` SOP title): shipped at
+    // severity `hold` since gate body v8. Refuses like block, records the call
+    // for review, and an approved bypass lets the exact call through once.
+    const guardrail = rule.origin === 'guardrail';
+    const hold = rule.action === 'require_approval';
+    if (rule.action !== 'block' && !hold && !(guardrail && rule.action === 'warn'))
+        return null;
+    const why = validateRule(rule.toolPattern, rule.id);
+    if (why) {
+        log.warn({ action: 'policy_rule_rejected', ruleId: rule.id, toolPattern: rule.toolPattern, reason: why }, `Policy rule rejected and NOT shipped to the gate: ${why}`);
+        return null;
+    }
+    // The ` WHERE ` clause travels with the rule. It is validated only for JS
+    // compilability — it is a JS regex matched against serialized tool input,
+    // never a grep pattern, so `validateRule`'s portable-ERE discipline does not
+    // apply to it. One that does not compile is stripped (the rule ships
+    // name-only, today's behaviour) and logged, NOT dropped with its rule: the
+    // clause narrows a block, so losing the clause must widen enforcement, and
+    // losing the rule would open it.
+    let argPattern;
+    if (rule.argPattern) {
+        try {
+            new RegExp(rule.argPattern);
+            argPattern = rule.argPattern;
+        }
+        catch {
+            log.warn({ action: 'policy_rule_arg_pattern_dropped', ruleId: rule.id, argPattern: rule.argPattern }, 'argPattern does not compile as a JS RegExp — rule shipped name-only');
+        }
+    }
+    const stripped = stripEnd(stripStart(rule.toolPattern.trim(), '^'), '$');
+    return {
+        id: `sop.${rule.id}`,
+        // Wrapped in spaces so the pattern matches a whole tool token: the gate
+        // tests against a space-padded string, so ` (Bash) ` matches the tool `Bash`
+        // and not a tool called `BashHistory`.
+        source: ` (${stripped}) `,
+        subject: 'tool',
+        // `shadow`, not `warn`. Both allow the call, but they mean different
+        // things: `warn` is "this rule has not earned the right to block yet",
+        // `shadow` is "this rule is certain and the workspace asked us not to act".
+        // Collapsing them makes a SILENT_LOG rollout unmeasurable, because you
+        // cannot tell which flags would have been blocks. A guardrail in SHADOW
+        // is the one rule that ships as `warn` on purpose (see above); under
+        // SILENT_LOG it demotes to `shadow` with everything else.
+        severity: shadow
+            ? 'shadow'
+            : hold
+                ? 'hold'
+                : rule.action === 'warn'
+                    ? 'warn'
+                    : 'block',
+        reason: hold
+            ? `Held for human review: ${rule.reason || `SOP ${rule.id}`}`
+            : rule.reason || `Blocked by SOP ${rule.id}`,
+        rationale: guardrail
+            ? 'Projected from a cited policy guardrail by the control plane (LLD #71).'
+            : hold
+                ? 'Resolved from a REQUIRE_APPROVAL: SOP title by the control plane.'
+                : 'Resolved from a BLOCK: SOP title by the control plane.',
+        matches: [],
+        notMatches: [],
+        ...(argPattern ? { argPattern } : {}),
+    };
+}
+/** Fetches resolved policy for the workspace. Returns null on any failure —
+ *  the caller keeps the previous snapshot rather than replacing it with nothing. */
+export async function fetchResolvedPolicy(opts) {
+    const url = `${stripEnd(opts.controlPlaneUrl, '/')}/api/v1/policy/resolve` +
+        `?workspaceId=${encodeURIComponent(opts.workspaceId)}`;
+    try {
+        const res = await fetch(url, {
+            headers: { Authorization: `Bearer ${opts.apiKey}` },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!res.ok) {
+            log.warn({ action: 'policy_fetch_failed', status: res.status }, 'Policy resolve returned non-OK');
+            return null;
+        }
+        const body = (await res.json());
+        if (typeof body !== 'object' || body === null)
+            return null;
+        const rec = body;
+        const rules = Array.isArray(rec.sopRules) ? rec.sopRules : [];
+        return {
+            workspaceId: typeof rec.workspaceId === 'string' ? rec.workspaceId : opts.workspaceId,
+            interventionMode: typeof rec.interventionMode === 'string' ? rec.interventionMode : 'TRANSPARENT',
+            sopRules: rules.filter((r) => {
+                if (typeof r !== 'object' || r === null)
+                    return false;
+                const x = r;
+                return (typeof x.id === 'string' &&
+                    typeof x.toolPattern === 'string' &&
+                    typeof x.action === 'string' &&
+                    // Optional, but if present it must be a string — a non-string here
+                    // would flow into `new RegExp` and the base64 encoder downstream.
+                    (x.argPattern === undefined || typeof x.argPattern === 'string'));
+            }),
+            // `allowedServers` — the exact field name `evaluate.ts` and
+            // `lib/mcpCuration.ts` both use. Absent or wrongly-typed degrades to
+            // `[]`, same as `sopRules` above: unrestricted, not a fetch failure.
+            mcpAllowedServers: Array.isArray(rec.allowedServers)
+                ? rec.allowedServers.filter((s) => typeof s === 'string')
+                : [],
+            sqlDropStrictBlock: rec.sqlDropStrictBlock === true,
+        };
+    }
+    catch (err) {
+        log.warn({ action: 'policy_fetch_failed', err }, 'Policy resolve unreachable');
+        return null;
+    }
+}
+/**
+ * SILENT_LOG means observe, do not intervene (docs/guides/policies.md: the
+ * call is permitted to run, the trace is tagged for audit). It demotes the
+ * dynamic tier to the advisory severity — it does NOT reach the static floor,
+ * which stays enforced. If one settings string could disarm the floor, the
+ * floor would not be a floor.
+ *
+ * This used to compare against 'SHADOW', a value intervention_mode_type
+ * (TRANSPARENT|OPAQUE|SILENT_LOG — packages/db/src/enums.ts) can never
+ * produce, so the observe-only branch was dead and a SILENT_LOG workspace
+ * shipped fully-blocking snapshots.
+ *
+ * Extracted so `buildSnapshotRules` and `writePolicySnapshot`'s `#mcpservers`
+ * header compute "is this workspace observe-only" the same way once, rather
+ * than as two copies of the comparison that could drift.
+ */
+function isSilentLogMode(policy) {
+    return policy.interventionMode.toUpperCase() === 'SILENT_LOG';
+}
+/**
+ * Drops MCP server names that would corrupt the comma-joined `#mcpservers`
+ * `.rules` header line — a name carrying a comma would be misread as two
+ * server names, and a tab or other whitespace would collide with the
+ * `.rules` file's own column separator the moment anyone looked at the line
+ * next to a rule row. Logged, not silently dropped: a server an operator
+ * configured and then watched vanish from enforcement needs to know why,
+ * the same discipline `validateRule` follows for a rejected SOP pattern.
+ */
+function sanitizeMcpServerNames(names) {
+    const out = [];
+    // Defensive against a caller that built a ResolvedPolicy by hand without
+    // TypeScript actually checking it — this repo's test files are outside
+    // `tsconfig.json`'s `include`, so `tsc --noEmit` does not catch a test
+    // constructing one with `mcpAllowedServers` omitted, and a JS consumer of
+    // this exported function is not checked at all. `Array.isArray` costs
+    // nothing on the real path, where `fetchResolvedPolicy` already guarantees
+    // an array.
+    if (!Array.isArray(names))
+        return out;
+    for (const raw of names) {
+        if (typeof raw !== 'string')
+            continue;
+        const name = raw.trim();
+        if (!name)
+            continue;
+        if (/[\s,]/.test(name)) {
+            log.warn({ action: 'mcp_server_name_rejected', name: raw }, 'MCP server name contains whitespace or a comma — dropped rather than corrupting the .rules #mcpservers header');
+            continue;
+        }
+        out.push(name);
+    }
+    return out;
+}
+/** Builds the rule set a snapshot would carry, without writing it. Exported so
+ *  a test can assert the contents rather than re-deriving them. */
+export function buildSnapshotRules(policy, localHoldTokens = []) {
+    // `shadow` names the advisory GuardPattern severity these rules are demoted
+    // to; the workspace-level trigger is intervention mode SILENT_LOG.
+    const shadow = isSilentLogMode(policy);
+    const sopRules = policy.sopRules
+        .map((r) => toGuardPattern(r, shadow))
+        .filter((r) => r !== null);
+    const localHolds = [...new Set(localHoldTokens.map((t) => t.trim()).filter(Boolean))]
+        .map((t) => localHoldPattern(t, shadow))
+        .filter((r) => r !== null);
+    const destructive = DESTRUCTIVE_COMMAND_PATTERNS.map((p) => {
+        // Wave 7 (audit-remediation): `destructive.sql_drop` is a per-rule
+        // override, evaluated BEFORE the tier-wide ramp below — it was never
+        // part of `DESTRUCTIVE_TIER_SEVERITY`'s promotion (its own static
+        // `severity` is `'warn'`, not `'block'`, so that ternary never reaches
+        // it), and this flag is opt-in per workspace, not evidence-gated the way
+        // the six-pattern ramp is. Shadow mode still wins over both: SILENT_LOG
+        // means observe-only across the whole dynamic tier, no exceptions.
+        if (p.id === 'destructive.sql_drop' && !shadow && policy.sqlDropStrictBlock) {
+            return { ...p, severity: 'block' };
+        }
+        return {
+            ...p,
+            // A `warn` pattern stays `warn` regardless; only the `block` ones are held
+            // back by the tier gate.
+            severity: shadow
+                ? 'shadow'
+                : p.severity === 'block'
+                    ? DESTRUCTIVE_TIER_SEVERITY
+                    : 'warn',
+        };
+    });
+    // The snapshot-delivered promotion of the skill-directory-write floor rules
+    // to `block` — see SKILL_SURFACE_TIER_SEVERITY. `.tier` suffixed onto the
+    // floor's own id (`skill_surface.agents_skills_write` ->
+    // `skill_surface.agents_skills_write.tier`) so this entry can never collide
+    // with `staticFloorPatterns()`'s compiled-in copy of the same pattern: both
+    // are meant to be present and matching the same path at once, one warn (the
+    // degraded-mode baseline) and one block (the steady state), and
+    // `assertGuardTableSane`'s uniqueness check would reject an accidental
+    // duplicate id the moment either table tried to load. Mirrors the
+    // destructive tier's own shadow handling: SILENT_LOG means observe, don't
+    // act, on the dynamic tier only — the floor's warn rule is unaffected
+    // either way.
+    const skillSurface = SKILL_SURFACE_PATTERNS.map((p) => ({
+        ...p,
+        id: `${p.id}.tier`,
+        severity: shadow ? 'shadow' : SKILL_SURFACE_TIER_SEVERITY,
+    }));
+    return [...sopRules, ...localHolds, ...destructive, ...skillSurface];
+}
+/**
+ * A local `review_before:` token as a hold rule. `action:*` tokens match the
+ * gate's action subject (the tokens it classifies a shell command to);
+ * anything else is a tool name. Case-insensitive, as the bespoke Claude Code
+ * hold was. A token that is not a plain identifier is refused with a log line
+ * rather than escaped into a regex nobody can read back.
+ */
+function localHoldPattern(token, shadow) {
+    if (!/^[A-Za-z0-9_:.-]+$/.test(token)) {
+        log.warn({ action: 'local_hold_token_rejected', token }, 'review_before token is not a plain identifier — not shipped to the gate');
+        return null;
+    }
+    // The identifier check above already excludes every metacharacter; the
+    // full escape is still applied so the pattern is safe by construction and
+    // not by the guard three lines up.
+    const source = ` (${token.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}) `;
+    return {
+        id: `sop.local.review_before.${token}`,
+        source,
+        subject: token.startsWith('action:') ? 'action' : 'tool',
+        ignoreCase: true,
+        severity: shadow ? 'shadow' : 'hold',
+        reason: `Held for human review: ${token} — declared in review_before:`,
+        rationale: 'A local SOP or the workspace settings asked to see this action before it runs.',
+        matches: [],
+        notMatches: [],
+    };
+}
+/**
+ * Writes the snapshot atomically.
+ *
+ * Two artifacts from one source: the canonical JSON, and a tab-separated
+ * `.rules` projection so the five bash gates need no JSON parser on the decision
+ * path. Both carry the same digest, so a test — and the gate — can tell that the
+ * projection really came from the JSON.
+ */
+export async function writePolicySnapshot(policy, snapshotDir = DEFAULT_SNAPSHOT_DIR, localHoldTokens = []) {
+    const rules = buildSnapshotRules(policy, localHoldTokens);
+    const lines = rules.map(toRulesLine);
+    const digest = createHash('sha256').update(lines.join('\n')).digest('hex').slice(0, 32);
+    // One timestamp shared by both artifacts. Two `new Date()` calls would put
+    // different values in the JSON and the .rules, so a reader comparing them
+    // would see drift that is not there.
+    const generatedAt = new Date().toISOString();
+    // M3: the per-server MCP allowlist, sanitised once and reused for both
+    // artifacts so the JSON and the `.rules` header can never disagree about
+    // which names survived. Severity follows SILENT_LOG the same way the
+    // dynamic tier's rules do: certain, just not acted on.
+    //
+    // Deliberately OUTSIDE `lines`/`digest` above — the digest covers RULE lines
+    // only, matching the trust model the `#workspace` header already has (parsed
+    // and integrity-checked by workspace-id comparison, not by the digest). A
+    // `#mcpservers` header is the same kind of metadata line, not a rule, so it
+    // must not change what `lines.join('\n')` hashes to.
+    const mcpServers = sanitizeMcpServerNames(policy.mcpAllowedServers);
+    const mcpSeverity = isSilentLogMode(policy) ? 'shadow' : 'block';
+    await fs.mkdir(snapshotDir, { recursive: true });
+    const json = JSON.stringify({
+        _comment: 'Intutic policy snapshot — auto-generated. DO NOT EDIT.',
+        version: 1,
+        /**
+         * Which emitted evaluator these rules were compiled for.
+         *
+         * The `.rules` column layout and the normalisation contract are part of
+         * the gate body, not of this file, so a snapshot is only meaningful to a
+         * gate of the same generation. Recording it here is what lets a support
+         * conversation start from "which gate wrote this" instead of guessing —
+         * and it is the reason `GATE_VERSION` exists at all rather than being a
+         * constant nothing reads.
+         */
+        gateVersion: GATE_VERSION,
+        workspaceId: policy.workspaceId,
+        generatedAt,
+        interventionMode: policy.interventionMode,
+        digest,
+        // M3: sanitised, not `policy.mcpAllowedServers` verbatim — a name this
+        // module rejected for the `.rules` header must not silently survive in
+        // the JSON, or the two artifacts would disagree about what is enforced.
+        // Empty means unrestricted, same convention as `allowedServers` at the
+        // control plane (`readMcpCurationSettings`).
+        mcpAllowedServers: mcpServers,
+        /**
+         * The resolve response verbatim, alongside the gate projection below.
+         *
+         * These two are **not** interchangeable and the difference has teeth.
+         * `rules` is a *gate artifact*: patterns rewritten into space-padded EREs,
+         * `warn` and `require_approval` already discarded, ids prefixed `sop.`.
+         * `sopRules` is what the control plane actually said — `{id, toolPattern,
+         * action, reason}`, every action.
+         *
+         * Carrying both exists because the MCP proxy's policy cache consumes
+         * `{toolPattern, action}` and its `isSopRule` guard drops anything else.
+         * Feeding it `rules` would pass the outer parse and then silently yield
+         * *zero* enforceable rules — a cache that reports entries and enforces
+         * nothing, which is worse than the cold fetch it replaced. This field is
+         * what makes seeding safe; see `seedFromSnapshot` in policyCache.ts.
+         */
+        sopRules: policy.sopRules,
+        rules: rules.map((r) => ({
+            id: r.id,
+            source: r.source,
+            subject: r.subject ?? 'any',
+            severity: r.severity,
+            ignoreCase: r.ignoreCase === true,
+            reason: r.reason,
+            // Plain text here; base64 only in the `.rules` projection, where a tab
+            // separator forces the encoding. JSON needs no such armour.
+            ...(r.argPattern ? { argPattern: r.argPattern } : {}),
+        })),
+    }, null, 2);
+    // `#generated` is not decoration. Without it the five bash gates and the
+    // Python one physically cannot compute the snapshot's age from the file they
+    // read — only the JSON carries a timestamp, and they never open the JSON. A
+    // snapshot from last year enforced identically to one written a second ago,
+    // and nothing anywhere could say so.
+    // `#mcpservers <severity> <comma-joined-server-names>` — OMITTED entirely
+    // when the (sanitised) list is empty. This is the mandatory-mechanism/
+    // opt-in-effect split M3 is built on: the header-parsing and per-call
+    // allowlist check ship to every gate unconditionally, but they are a no-op
+    // until a workspace actually configures `mcpAllowedServers` — and "no
+    // header line" is how a v6 gate (and, for forward-compat, a hypothetical
+    // v5-reading-a-v6-file) tells "unrestricted" apart from "restricted to
+    // zero servers", which would otherwise block every MCP call by omission.
+    const mcpHeader = mcpServers.length > 0 ? `#mcpservers ${mcpSeverity} ${mcpServers.join(',')}\n` : '';
+    const rulesText = `# Intutic policy snapshot (projection of ${SNAPSHOT_JSON}) — DO NOT EDIT.\n` +
+        `# Columns: ${RULES_COLUMNS.join('\t')}\n` +
+        `#digest ${digest}\n` +
+        `#workspace ${policy.workspaceId}\n` +
+        `#generated ${generatedAt}\n` +
+        mcpHeader +
+        lines.join('\n') +
+        '\n';
+    await writeAtomic(path.join(snapshotDir, SNAPSHOT_JSON), json);
+    await writeAtomic(path.join(snapshotDir, SNAPSHOT_RULES), rulesText);
+    log.debug({ action: 'policy_snapshot_written', digest, ruleCount: rules.length, dir: snapshotDir }, 'Policy snapshot refreshed');
+    return { digest, ruleCount: rules.length };
+}
+async function writeAtomic(target, content) {
+    const tmp = target + '.tmp';
+    await fs.writeFile(tmp, content, { encoding: 'utf-8' });
+    // 0444: the daemon replaces this by rename, so it never needs write access to
+    // the file itself, and a read-only file is one more small obstacle to an agent
+    // editing it in place. The real protection is that every gate refuses to touch
+    // `.intutic/hooks` at all.
+    await fs.chmod(tmp, 0o444);
+    await fs.rename(tmp, target);
+}
+/**
+ * Fetch and write in one call. Safe to run on every sync cycle.
+ *
+ * Never throws: policy refresh must not be able to take down the sync loop. A
+ * failed fetch leaves the previous snapshot in place, which is the correct
+ * degradation — stale rules stay enforced. If they expired into permissiveness,
+ * "kill the daemon and wait" would be a supported way to disarm governance.
+ */
+export async function refreshPolicySnapshot(opts) {
+    const policy = await fetchResolvedPolicy(opts);
+    if (!policy)
+        return null;
+    try {
+        return await writePolicySnapshot(policy, opts.snapshotDir ?? DEFAULT_SNAPSHOT_DIR, opts.localHoldTokens ?? []);
+    }
+    catch (err) {
+        log.warn({ action: 'policy_snapshot_write_failed', err }, 'Could not write policy snapshot');
+        return null;
+    }
+}
+//# sourceMappingURL=policySnapshot.js.map

package/dist/lib/policySnapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policySnapshot.js","sourceRoot":"","sources":["../../src/lib/policySnapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACjF,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,GAElB,MAAM,8BAA8B,CAAA;AAErC,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAA;AAEhD;uCACuC;AACvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,sBAAsB,CAAA;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAA;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAqB,MAAM,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqB,OAAO,CAAA;AA6DpE;;;;;;GAMG;AACH,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU;IACnE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,oBAAoB;IAChE,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE,2DAA2D;IAC3D,2BAA2B,EAAE,4BAA4B;CAC1D,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,QAAQ,CAAC,CAAS,EAAE,EAAU;IACrC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,IAAI,CAAC,CAAA;IAC7C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,CAAS,EAAE,EAAU;IACvC,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,CAAC,IAAI,CAAC,CAAA;IAC1C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,MAAc;IAC9D,MAAM,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,mBAAmB,CAAA;IAEpC,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IACpD,IAAI,CAAC,QAAQ;QAAE,OAAO,8BAA8B,CAAA;IAEpD,MAAM,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAA;IACjC,IAAI,CAAC;QACH,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IAChG,CAAC;IAED,IAAI,EAAU,CAAA;IACd,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,2DAA2D;IAC3D,EAAE;IACF,2EAA2E;IAC3E,qEAAqE;IACrE,8EAA8E;IAC9E,2EAA2E;IAC3E,uDAAuD;IACvD,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,sDAAsD;IACtD,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;IAClD,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QAClB,OAAO,CACL,WAAW,IAAI,OAAO,YAAY,CAAC,MAAM,iCAAiC;YAC1E,yCAAyC,CAC1C,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CACrB,IAAwC,EACxC,MAAe;IAEf,0EAA0E;IAC1E,4EAA4E;IAC5E,+EAA+E;IAC/E,iDAAiD;IACjD,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,uEAAuE;IACvE,4EAA4E;IAC5E,oDAAoD;IACpD,EAAE;IACF,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,KAAK,WAAW,CAAA;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,kBAAkB,CAAA;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAE3F,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACnD,IAAI,GAAG,EAAE,CAAC;QACR,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,EAC/F,qDAAqD,GAAG,EAAE,CAC3D,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,qEAAqE;IACrE,2EAA2E;IAC3E,2EAA2E;IAC3E,iCAAiC;IACjC,IAAI,UAA8B,CAAA;IAClC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAC3B,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,iCAAiC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAC3F,qEAAqE,CACtE,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IACxE,OAAO;QACL,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE;QACpB,wEAAwE;QACxE,6EAA6E;QAC7E,uCAAuC;QACvC,MAAM,EAAE,KAAK,QAAQ,IAAI;QACzB,OAAO,EAAE,MAAM;QACf,qEAAqE;QACrE,uEAAuE;QACvE,4EAA4E;QAC5E,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,0DAA0D;QAC1D,QAAQ,EAAE,MAAM;YACd,CAAC,CAAE,QAAqC;YACxC,CAAC,CAAC,IAAI;gBACJ,CAAC,CAAE,MAAmC;gBACtC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM;oBACtB,CAAC,CAAE,MAAmC;oBACtC,CAAC,CAAC,OAAO;QACf,MAAM,EAAE,IAAI;YACV,CAAC,CAAC,0BAA0B,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE;YAC7D,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,kBAAkB,IAAI,CAAC,EAAE,EAAE;QAC9C,SAAS,EAAE,SAAS;YAClB,CAAC,CAAC,yEAAyE;YAC3E,CAAC,CAAC,IAAI;gBACJ,CAAC,CAAC,mEAAmE;gBACrE,CAAC,CAAC,wDAAwD;QAC9D,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,EAAE;QACd,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAA;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA2B;IAE3B,MAAM,GAAG,GACP,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,wBAAwB;QAC9D,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAA;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAA;YACjG,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAA;QAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC1D,MAAM,GAAG,GAAG,IAA+B,CAAA;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7D,OAAO;YACL,WAAW,EAAE,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW;YACrF,gBAAgB,EAAE,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa;YACjG,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAA2C,EAAE;gBACpE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,KAAK,CAAA;gBACrD,MAAM,CAAC,GAAG,CAA4B,CAAA;gBACtC,OAAO,CACL,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;oBACxB,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;oBACjC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAC5B,mEAAmE;oBACnE,kEAAkE;oBAClE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CACjE,CAAA;YACH,CAAC,CAAC;YACF,4DAA4D;YAC5D,qEAAqE;YACrE,qEAAqE;YACrE,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBAClD,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACtE,CAAC,CAAC,EAAE;YACN,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,KAAK,IAAI;SACpD,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,eAAe,CAAC,MAAsB;IAC7C,OAAO,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,YAAY,CAAA;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,KAAwB;IACtD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,YAAY;IACZ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAA;IACrC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAQ;QACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,GAAG,EAAE,EACjD,+GAA+G,CAChH,CAAA;YACD,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,kBAAkB,CAAC,MAAsB,EAAE,kBAAqC,EAAE;IAChG,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAEtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAE/C,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;SAClF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAE/C,MAAM,WAAW,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACzD,mEAAmE;QACnE,qEAAqE;QACrE,kEAAkE;QAClE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAAC,CAAC,EAAE,KAAK,sBAAsB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5E,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAgB,EAAE,CAAA;QAC7C,CAAC;QACD,OAAO;YACL,GAAG,CAAC;YACJ,2EAA2E;YAC3E,yBAAyB;YACzB,QAAQ,EACN,MAAM;gBACJ,CAAC,CAAE,QAAqC;gBACxC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO;oBACtB,CAAC,CAAC,yBAAyB;oBAC3B,CAAC,CAAE,MAAgB;SAC1B,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,0EAA0E;IAC1E,yDAAyD;IACzD,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,gEAAgE;IAChE,uEAAuE;IACvE,kEAAkE;IAClE,0EAA0E;IAC1E,sEAAsE;IACtE,cAAc;IACd,MAAM,YAAY,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,GAAG,CAAC;QACJ,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,OAAO;QAClB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAE,QAAqC,CAAC,CAAC,CAAC,2BAA2B;KACxF,CAAC,CAAC,CAAA;IAEH,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,EAAE,GAAG,YAAY,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAe;IACtD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,yEAAyE,CAAC,CAAA;QACnI,OAAO,IAAI,CAAA;IACb,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,mCAAmC;IACnC,MAAM,MAAM,GAAG,KAAK,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAA;IACpE,OAAO;QACL,EAAE,EAAE,2BAA2B,KAAK,EAAE;QACtC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;QACxD,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;QACpC,MAAM,EAAE,0BAA0B,KAAK,+BAA+B;QACtE,SAAS,EAAE,gFAAgF;QAC3F,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,EAAE;KACf,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,cAAsB,oBAAoB,EAC1C,kBAAqC,EAAE;IAEvC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACvF,2EAA2E;IAC3E,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAE5C,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,uDAAuD;IACvD,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACnE,MAAM,WAAW,GAAuB,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;IAEpF,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEhD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CACzB;QACE,QAAQ,EAAE,wDAAwD;QAClE,OAAO,EAAE,CAAC;QACV;;;;;;;;;WASG;QACH,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW;QACX,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,MAAM;QACN,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,6CAA6C;QAC7C,iBAAiB,EAAE,UAAU;QAC7B;;;;;;;;;;;;;;;WAeG;QACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK;YAC3B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,uEAAuE;YACvE,4DAA4D;YAC5D,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;KACJ,EACD,IAAI,EACJ,CAAC,CACF,CAAA;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,qCAAqC;IACrC,0EAA0E;IAC1E,uEAAuE;IACvE,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAErG,MAAM,SAAS,GACb,4CAA4C,aAAa,oBAAoB;QAC7E,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC1C,WAAW,MAAM,IAAI;QACrB,cAAc,MAAM,CAAC,WAAW,IAAI;QACpC,cAAc,WAAW,IAAI;QAC7B,SAAS;QACT,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAChB,IAAI,CAAA;IAEN,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAA;IAC9D,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,SAAS,CAAC,CAAA;IAEpE,GAAG,CAAC,KAAK,CACP,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,EACxF,2BAA2B,CAC5B,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,OAAe;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,MAAM,CAAA;IAC3B,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACvD,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,2BAA2B;IAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC1B,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,IAAI,oBAAoB,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAA;IAChH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAA;QAC5F,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}