@lannguyensi/harness 0.38.0 → 0.40.0

package/dist/io/read-regular-file.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Result of a symlink-rejecting regular-file read. The kinds are deliberately
+ * fine-grained because the gate readers need to keep their distinct deny
+ * details (missing vs symlink vs not-regular) and one caller treats
+ * exists-but-unreadable as "existence already satisfied the gate".
+ */
+export type RegularFileRead = {
+    kind: "ok";
+    content: string;
+} | {
+    kind: "missing";
+} | {
+    kind: "symlink";
+} | {
+    kind: "not-regular";
+} | {
+    kind: "unreadable";
+};
+/**
+ * Read a marker/verdict file as utf8, refusing symlinks and non-regular
+ * files. lstat (NOT stat): defense-in-depth against a symlink at the marker
+ * path pointing at an arbitrary target the agent controls. In today's threat
+ * model the agent has no Edit / Write / Bash path to plant such a symlink
+ * (the same PreToolUse hook gates all three), but the gate contract is to
+ * assume the agent is hostile, so the lstat reject is cheap insurance
+ * (agent-tasks/d39f160e).
+ *
+ * This is THE shared implementation for every gate-marker read; a future
+ * defensive fix (e.g. closing the lstat/read race with O_NOFOLLOW, ENOTDIR
+ * handling) belongs here and nowhere else.
+ */
+export declare function readRegularFileRejectingSymlink(filePath: string): RegularFileRead;

package/dist/io/read-regular-file.js

@@ -0,0 +1,34 @@
+import * as fs from "node:fs";
+/**
+ * Read a marker/verdict file as utf8, refusing symlinks and non-regular
+ * files. lstat (NOT stat): defense-in-depth against a symlink at the marker
+ * path pointing at an arbitrary target the agent controls. In today's threat
+ * model the agent has no Edit / Write / Bash path to plant such a symlink
+ * (the same PreToolUse hook gates all three), but the gate contract is to
+ * assume the agent is hostile, so the lstat reject is cheap insurance
+ * (agent-tasks/d39f160e).
+ *
+ * This is THE shared implementation for every gate-marker read; a future
+ * defensive fix (e.g. closing the lstat/read race with O_NOFOLLOW, ENOTDIR
+ * handling) belongs here and nowhere else.
+ */
+export function readRegularFileRejectingSymlink(filePath) {
+    let stat;
+    try {
+        stat = fs.lstatSync(filePath);
+    }
+    catch {
+        return { kind: "missing" };
+    }
+    if (stat.isSymbolicLink())
+        return { kind: "symlink" };
+    if (!stat.isFile())
+        return { kind: "not-regular" };
+    try {
+        return { kind: "ok", content: fs.readFileSync(filePath, "utf8") };
+    }
+    catch {
+        return { kind: "unreadable" };
+    }
+}
+//# sourceMappingURL=read-regular-file.js.map

package/dist/io/read-regular-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-regular-file.js","sourceRoot":"","sources":["../../src/io/read-regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAe9B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAAC,QAAgB;IAC9D,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;AACH,CAAC"}

package/dist/policies/index.d.ts

@@ -1,5 +1,5 @@
 export { buildRecordHint, evaluateRequires, RequiresEvaluationError, type EvaluateRequiresOptions, type LedgerEntry, type RequiresEvaluation, type RequiresTrace, } from "./requires.js";
 export { parseDurationSeconds, InvalidDurationError } from "./duration.js";
 export { parseLedgerTimestamp } from "./timestamp.js";
-export { queryLedgerByTag, type LedgerClientOptions, type LedgerQueryResult, type QueryLedgerOptions, } from "./ledger-client.js";
+export { openLedgerSession, queryLedgerByTag, type LedgerClientOptions, type LedgerQueryResult, type LedgerSession, type LedgerSessionCallResult, type LedgerSessionQuery, type QueryLedgerOptions, } from "./ledger-client.js";
 export { validateExtractGrammar, parseExtractExpression, evaluateExtract, substituteTemplate, ExtractGrammarError, type ExtractBuiltins, type ExtractEventContext, type ExtractEvaluation, type ExtractPath, type ExtractSegment, type ExtractTraceEntry, type ExtractTraceSource, type SubstituteTemplateResult, } from "./extract.js";

package/dist/policies/index.js

@@ -1,6 +1,6 @@
 export { buildRecordHint, evaluateRequires, RequiresEvaluationError, } from "./requires.js";
 export { parseDurationSeconds, InvalidDurationError } from "./duration.js";
 export { parseLedgerTimestamp } from "./timestamp.js";
-export { queryLedgerByTag, } from "./ledger-client.js";
+export { openLedgerSession, queryLedgerByTag, } from "./ledger-client.js";
 export { validateExtractGrammar, parseExtractExpression, evaluateExtract, substituteTemplate, ExtractGrammarError, } from "./extract.js";
 //# sourceMappingURL=index.js.map

package/dist/policies/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,GAKxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,gBAAgB,GAIjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,GASpB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,uBAAuB,GAKxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GAOjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,GASpB,MAAM,cAAc,CAAC"}

package/dist/policies/ledger-client.d.ts

@@ -36,4 +36,45 @@ export type LedgerQueryResult = {
     kind: "degraded";
     reason: string;
 };
+/** Arguments to `LedgerSession.querySummary` — per-call, unlike the
+ *  connection-scoped `LedgerClientOptions`. */
+export interface LedgerSessionQuery {
+    sessionId: string;
+    sinceIso?: string;
+    contentPrefix?: string;
+}
+/**
+ * Result of a generic `LedgerSession.callTool` round-trip. Three-way so a
+ * caller can distinguish a server-side JSON-RPC error (retryable with a
+ * different payload — the `policy_decision` → `fact` fallback) from a
+ * degraded transport (spawn failure / exit / timeout — nothing to retry).
+ */
+export type LedgerSessionCallResult = {
+    status: "ok";
+    payload: unknown;
+} | {
+    status: "error";
+    errorMessage: string;
+} | {
+    status: "degraded";
+    reason: string;
+};
+/**
+ * One grounding-mcp connection serving multiple calls.
+ *
+ * The PreToolUse runtime gate evaluates K policies per tool event, and each
+ * used to spawn its own subprocess for the query plus a second one for the
+ * audit record — 2K sequential spawns per event, the fail-open-under-load
+ * risk the 2026-07-01 review flagged against the 30s hook budget. A session
+ * spawns ONE subprocess lazily on first use, performs the initialize
+ * handshake once, and multiplexes every subsequent `ledger_summary` /
+ * `ledger_add` over the same stdio pipe. `dispose()` terminates the child;
+ * the owner (e.g. the intercept CLI wrapper) MUST call it when done.
+ */
+export interface LedgerSession {
+    querySummary(query: LedgerSessionQuery): Promise<LedgerQueryResult>;
+    callTool(name: string, args: Record<string, unknown>): Promise<LedgerSessionCallResult>;
+    dispose(): void;
+}
+export declare function openLedgerSession(opts: LedgerClientOptions): LedgerSession;
 export declare function queryLedgerByTag(opts: QueryLedgerOptions): Promise<LedgerQueryResult>;

package/dist/policies/ledger-client.js

@@ -9,7 +9,7 @@
 // evidence ledger is unreachable, policy evaluation defaults to
 // enforcement: warn-equivalent behaviour".
 import { spawn } from "node:child_process";
-import { expandHome } from "../runtime/expand-home.js";
+import { expandHome, expandHomeInEnv } from "../runtime/expand-home.js";
 import { POLICY_DECISION_TYPE } from "../runtime/ledger-record.js";
 import { VERSION } from "../version.js";
 const DEFAULT_TIMEOUT_MS = 5_000;
@@ -91,7 +91,11 @@ function startSubprocess(opts) {
     try {
         child = spawn(exe, args, {
             cwd: opts.cwd,
-            env: { ...process.env, ...(opts.mcpEnv ?? {}) },
+            // Defense-in-depth parity with `recordPolicyDecision`
+            // (agent-tasks/973596d7): expand leading `~/` in env values so a
+            // manifest that bypassed validate cannot scatter cwd-relative
+            // `./~/…` paths through the query path either.
+            env: { ...process.env, ...(expandHomeInEnv(opts.mcpEnv) ?? {}) },
             stdio: ["pipe", "pipe", "pipe"],
         });
     }
@@ -170,14 +174,16 @@ function startSubprocess(opts) {
         child.once("error", done);
     });
     function timeoutPromise() {
-        return new Promise((resolve) => {
-            const t = setTimeout(() => {
-                timers.delete(t);
+        let timer;
+        const promise = new Promise((resolve) => {
+            timer = setTimeout(() => {
+                timers.delete(timer);
                 resolve("timeout");
             }, timeoutMs);
-            t.unref();
-            timers.add(t);
+            timer.unref();
+            timers.add(timer);
         });
+        return { promise, timer };
     }
     function send(id, method, params) {
         return new Promise((resolve) => {
@@ -192,8 +198,23 @@ function startSubprocess(opts) {
             }
         });
     }
-    function call(id, method, params) {
-        return Promise.race([send(id, method, params), exitPromise, timeoutPromise()]);
+    async function call(id, method, params) {
+        const timeout = timeoutPromise();
+        try {
+            return await Promise.race([
+                send(id, method, params),
+                exitPromise,
+                timeout.promise,
+            ]);
+        }
+        finally {
+            // A pooled session issues many calls on one subprocess; without
+            // settling-time cleanup the timer set and pending map grow O(calls)
+            // until dispose. Keep both O(in-flight) instead.
+            clearTimeout(timeout.timer);
+            timers.delete(timeout.timer);
+            pending.delete(id);
+        }
     }
     function notify(method, params = {}) {
         try {
@@ -239,9 +260,9 @@ function startSubprocess(opts) {
  * caller falls back to client-side filtering instead of speculatively
  * including args that an old server would reject.
  */
-async function detectLedgerSummaryArgs(ctl, _timeoutMs) {
+async function detectLedgerSummaryArgs(ctl, requestId) {
     const fallback = new Set(["sessionId"]);
-    const result = await ctl.call(2, "tools/list", {});
+    const result = await ctl.call(requestId, "tools/list", {});
     if (result === "exit" || result === "timeout")
         return fallback;
     if (result.error)
@@ -293,94 +314,178 @@ function extractToolPayload(result) {
     }
     return null;
 }
-export async function queryLedgerByTag(opts) {
+export function openLedgerSession(opts) {
     const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const start = startSubprocess(opts);
-    if (!start.ok)
-        return { kind: "degraded", reason: start.reason };
-    const ctl = start.ctl;
-    try {
-        const initResult = await ctl.call(1, "initialize", {
-            protocolVersion: "2024-11-05",
-            capabilities: {},
-            clientInfo: { name: "harness-policies", version: VERSION },
-        });
-        if (initResult === "exit") {
-            return {
-                kind: "degraded",
-                reason: `grounding-mcp ${exitDiagnostic(ctl)}`,
-            };
-        }
-        if (initResult === "timeout") {
-            return {
-                kind: "degraded",
-                reason: `grounding-mcp timeout after ${timeoutMs}ms`,
-            };
-        }
-        if (initResult.error) {
-            return {
-                kind: "degraded",
-                reason: `grounding-mcp initialize error: ${initResult.error.message ?? "unknown"}`,
-            };
-        }
-        ctl.notify("notifications/initialized");
-        // Phase 5 #5 — capability detection only when we actually want to
-        // push a filter server-side. Older grounding-mcp builds accept only
-        // `sessionId` on `ledger_summary`; harness spawns a binary path
-        // chosen by the operator, so we cannot assume a version. Skipping
-        // tools/list when no filter is requested keeps the unfiltered hot
-        // path one round-trip fewer.
-        const wantsFilter = opts.sinceIso !== undefined || opts.contentPrefix !== undefined;
-        const supportedArgs = wantsFilter
-            ? await detectLedgerSummaryArgs(ctl, timeoutMs)
-            : new Set(["sessionId"]);
-        const callArgs = { sessionId: opts.sessionId };
-        if (opts.sinceIso !== undefined && supportedArgs.has("sinceIso")) {
-            callArgs.sinceIso = opts.sinceIso;
+    let ctl = null;
+    let startFailure = null;
+    // Resolves to null on success, or the degraded reason. Cached so the
+    // handshake happens exactly once per session; a failed init stays failed
+    // (retrying per call would reintroduce the very fan-out this removes).
+    let initPromise = null;
+    // Session-level timeout latch: once ANY call times out, every subsequent
+    // call short-circuits to degraded without a new round-trip. Without this
+    // a slow-but-responsive server could cost timeoutMs PER call — with K
+    // policies each awaiting a record on the enforcement critical path,
+    // ~(K+1)×timeoutMs can still blow the 30s hook budget the pooling exists
+    // to protect. The latch bounds total session timeout cost at ~1×timeoutMs.
+    // Ledger calls are best-effort by contract (degraded never blocks), so
+    // giving up on a server that already blew one deadline is the intended
+    // fail-open direction, not a new failure mode.
+    let timedOut = false;
+    let nextId = 1;
+    function ensureStarted() {
+        if (ctl !== null || startFailure !== null)
+            return ctl;
+        const start = startSubprocess(opts);
+        if (!start.ok) {
+            startFailure = start.reason;
+            return null;
         }
-        if (opts.contentPrefix !== undefined && supportedArgs.has("contentPrefix")) {
-            callArgs.contentPrefix = opts.contentPrefix;
-        }
-        const callResult = await ctl.call(3, "tools/call", {
-            name: "ledger_summary",
-            arguments: callArgs,
+        ctl = start.ctl;
+        return ctl;
+    }
+    function ensureInitialized() {
+        if (initPromise !== null)
+            return initPromise;
+        initPromise = (async () => {
+            const c = ensureStarted();
+            if (c === null)
+                return startFailure;
+            const initResult = await c.call(nextId++, "initialize", {
+                protocolVersion: "2024-11-05",
+                capabilities: {},
+                clientInfo: { name: "harness-policies", version: VERSION },
+            });
+            if (initResult === "exit")
+                return `grounding-mcp ${exitDiagnostic(c)}`;
+            if (initResult === "timeout") {
+                timedOut = true;
+                return `grounding-mcp timeout after ${timeoutMs}ms`;
+            }
+            if (initResult.error) {
+                return `grounding-mcp initialize error: ${initResult.error.message ?? "unknown"}`;
+            }
+            c.notify("notifications/initialized");
+            return null;
+        })();
+        return initPromise;
+    }
+    const latchedReason = () => `grounding-mcp timed out earlier in this session (${timeoutMs}ms); skipping further ledger calls`;
+    return {
+        async querySummary(query) {
+            if (timedOut)
+                return { kind: "degraded", reason: latchedReason() };
+            const initError = await ensureInitialized();
+            if (initError !== null)
+                return { kind: "degraded", reason: initError };
+            const c = ctl;
+            // Phase 5 #5 — capability detection only when we actually want to
+            // push a filter server-side. Older grounding-mcp builds accept only
+            // `sessionId` on `ledger_summary`; harness spawns a binary path
+            // chosen by the operator, so we cannot assume a version. Skipping
+            // tools/list when no filter is requested keeps the unfiltered hot
+            // path one round-trip fewer.
+            const wantsFilter = query.sinceIso !== undefined || query.contentPrefix !== undefined;
+            const supportedArgs = wantsFilter
+                ? await detectLedgerSummaryArgs(c, nextId++)
+                : new Set(["sessionId"]);
+            const callArgs = { sessionId: query.sessionId };
+            if (query.sinceIso !== undefined && supportedArgs.has("sinceIso")) {
+                callArgs.sinceIso = query.sinceIso;
+            }
+            if (query.contentPrefix !== undefined &&
+                supportedArgs.has("contentPrefix")) {
+                callArgs.contentPrefix = query.contentPrefix;
+            }
+            const callResult = await c.call(nextId++, "tools/call", {
+                name: "ledger_summary",
+                arguments: callArgs,
+            });
+            if (callResult === "exit") {
+                return {
+                    kind: "degraded",
+                    reason: `grounding-mcp ${exitDiagnostic(c)}`,
+                };
+            }
+            if (callResult === "timeout") {
+                timedOut = true;
+                return {
+                    kind: "degraded",
+                    reason: `grounding-mcp timeout after ${timeoutMs}ms`,
+                };
+            }
+            if (callResult.error) {
+                return {
+                    kind: "degraded",
+                    reason: `ledger_summary error: ${callResult.error.message ?? "unknown"}`,
+                };
+            }
+            const payload = extractToolPayload(callResult.result);
+            if (payload === null) {
+                return {
+                    kind: "degraded",
+                    reason: "ledger_summary returned no parseable payload",
+                };
+            }
+            const entries = flattenSummary(payload);
+            if (entries === null) {
+                return {
+                    kind: "degraded",
+                    reason: "ledger_summary payload missing `entries` shape",
+                };
+            }
+            return { kind: "ok", entries };
+        },
+        async callTool(name, args) {
+            if (timedOut)
+                return { status: "degraded", reason: latchedReason() };
+            const initError = await ensureInitialized();
+            if (initError !== null)
+                return { status: "degraded", reason: initError };
+            const c = ctl;
+            const result = await c.call(nextId++, "tools/call", {
+                name,
+                arguments: args,
+            });
+            if (result === "exit") {
+                return { status: "degraded", reason: `grounding-mcp ${exitDiagnostic(c)}` };
+            }
+            if (result === "timeout") {
+                timedOut = true;
+                return {
+                    status: "degraded",
+                    reason: `grounding-mcp timeout after ${timeoutMs}ms`,
+                };
+            }
+            if (result.error) {
+                return {
+                    status: "error",
+                    errorMessage: result.error.message ?? "unknown",
+                };
+            }
+            return { status: "ok", payload: extractToolPayload(result.result) };
+        },
+        dispose() {
+            ctl?.cleanup();
+        },
+    };
+}
+export async function queryLedgerByTag(opts) {
+    // One-shot convenience wrapper: open a session, run the single summary
+    // query, tear the subprocess down. Callers with more than one ledger
+    // round-trip per event (the runtime intercept) hold a session instead.
+    const session = openLedgerSession(opts);
+    try {
+        return await session.querySummary({
+            sessionId: opts.sessionId,
+            ...(opts.sinceIso !== undefined && { sinceIso: opts.sinceIso }),
+            ...(opts.contentPrefix !== undefined && {
+                contentPrefix: opts.contentPrefix,
+            }),
         });
-        if (callResult === "exit") {
-            return {
-                kind: "degraded",
-                reason: `grounding-mcp ${exitDiagnostic(ctl)}`,
-            };
-        }
-        if (callResult === "timeout") {
-            return {
-                kind: "degraded",
-                reason: `grounding-mcp timeout after ${timeoutMs}ms`,
-            };
-        }
-        if (callResult.error) {
-            return {
-                kind: "degraded",
-                reason: `ledger_summary error: ${callResult.error.message ?? "unknown"}`,
-            };
-        }
-        const payload = extractToolPayload(callResult.result);
-        if (payload === null) {
-            return {
-                kind: "degraded",
-                reason: "ledger_summary returned no parseable payload",
-            };
-        }
-        const entries = flattenSummary(payload);
-        if (entries === null) {
-            return {
-                kind: "degraded",
-                reason: "ledger_summary payload missing `entries` shape",
-            };
-        }
-        return { kind: "ok", entries };
     }
     finally {
-        ctl.cleanup();
+        session.dispose();
     }
 }
 //# sourceMappingURL=ledger-client.js.map

package/dist/policies/ledger-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"ledger-client.js","sourceRoot":"","sources":["../../src/policies/ledger-client.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,gEAAgE;AAChE,0DAA0D;AAC1D,0EAA0E;AAC1E,wEAAwE;AACxE,gEAAgE;AAChE,2CAA2C;AAE3C,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AA0DjC,SAAS,cAAc,CACrB,GAAmB,EACnB,UAAmB;IAEnB,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,GAAG,CAAC,SAAS;QACf,CAAC,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;YAClC,CAAC,CAAC,GAAG,CAAC,UAAU;YAChB,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,kEAAkE;IAClE,kEAAkE;IAClE,2CAA2C;IAC3C,MAAM,IAAI,GACR,UAAU,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/D,SAAS;QACT,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,cAAc,GAA2B;IAC7C,KAAK,EAAE,MAAM;IACb,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,SAAS;IACnB,eAAe,EAAE,oBAAoB;CACtC,CAAC;AAEF,SAAS,cAAc,CAAC,OAAgB;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,OAAgC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,OAAkC,CAAC;IACnD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAqB,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAoBD,SAAS,eAAe,CACtB,IAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAEvD,IAAI,KAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;YAC/C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,+BAAgC,GAAa,CAAC,OAAO,EAAE;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,SAAS,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC3B,yDAAyD;IAC3D,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,GAAiB,IAAI,CAAC;IACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,wBAAwB;QACxB,UAAU,GAAG,GAAG,CAAC;QACjB,aAAa,GAAG,IAAI,CAAC;QACrB,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,aAAa,GAAG,IAAI,CAAC;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,qEAAqE;QACrE,mEAAmE;QACnE,0EAA0E;QAC1E,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACpC,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;oBAChD,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;wBAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBACpC,IAAI,OAAO,EAAE,CAAC;4BACZ,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;4BACvB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;YACD,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAClD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,SAAS,cAAc;QACrB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;gBACxB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjB,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,CAAC,CAAC,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,IAAI,CACX,EAAU,EACV,MAAc,EACd,MAA+B;QAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACrE,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,CAC9D,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,IAAI,CACX,EAAU,EACV,MAAc,EACd,MAA+B;QAE/B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,SAAS,MAAM,CAAC,MAAc,EAAE,SAAkC,EAAE;QAClE,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrE,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,SAAS,OAAO;QACd,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,EAAE;YACH,KAAK;YACL,SAAS;YACT,OAAO;YACP,IAAI;YACJ,MAAM;YACN,MAAM,EAAE,GAAG,EAAE,CAAC,aAAa;YAC3B,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;YACxB,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU;YAC5B,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU;YAC5B,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,uBAAuB,CACpC,GAAe,EACf,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC/D,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAyC,CAAC;IAC3D,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,IAAiD,CAAC;QAC5D,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB;YAAE,SAAS;QAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,WAAmD,CAAC;QACrE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC3E,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAqC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,GAAe;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAC7B,IAAI,GAAG;QAAE,OAAO,iBAAiB,GAAG,CAAC,OAAO,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;IACnF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjF,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,GAAG,MAA4D,CAAC;IACvE,IAAI,CAAC,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,CAAC,CAAC,iBAAiB,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,KAA2C,CAAC;YACtD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpD,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,4BAA4B;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAwB;IAExB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAEjE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE;YACjD,eAAe,EAAE,YAAY;YAC7B,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE;SAC3D,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,iBAAiB,cAAc,CAAC,GAAG,CAAC,EAAE;aAC/C,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,+BAA+B,SAAS,IAAI;aACrD,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,mCACN,UAAU,CAAC,KAAK,CAAC,OAAO,IAAI,SAC9B,EAAE;aACH,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAExC,kEAAkE;QAClE,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,6BAA6B;QAC7B,MAAM,WAAW,GACf,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC;QAClE,MAAM,aAAa,GAAG,WAAW;YAC/B,CAAC,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC;YAC/C,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAA4B,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACxE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACpC,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3E,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QAC9C,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE;YACjD,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,iBAAiB,cAAc,CAAC,GAAG,CAAC,EAAE;aAC/C,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,+BAA+B,SAAS,IAAI;aACrD,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,yBAAyB,UAAU,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE;aACzE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,8CAA8C;aACvD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,gDAAgD;aACzD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"ledger-client.js","sourceRoot":"","sources":["../../src/policies/ledger-client.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,gEAAgE;AAChE,0DAA0D;AAC1D,0EAA0E;AAC1E,wEAAwE;AACxE,gEAAgE;AAChE,2CAA2C;AAE3C,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AA0DjC,SAAS,cAAc,CACrB,GAAmB,EACnB,UAAmB;IAEnB,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,GAAG,CAAC,SAAS;QACf,CAAC,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;YAClC,CAAC,CAAC,GAAG,CAAC,UAAU;YAChB,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,kEAAkE;IAClE,kEAAkE;IAClE,2CAA2C;IAC3C,MAAM,IAAI,GACR,UAAU,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/D,SAAS;QACT,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,cAAc,GAA2B;IAC7C,KAAK,EAAE,MAAM;IACb,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,SAAS;IACnB,eAAe,EAAE,oBAAoB;CACtC,CAAC;AAEF,SAAS,cAAc,CAAC,OAAgB;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,OAAgC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,OAAkC,CAAC;IACnD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAqB,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAoBD,SAAS,eAAe,CACtB,IAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAEvD,IAAI,KAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,sDAAsD;YACtD,iEAAiE;YACjE,8DAA8D;YAC9D,+CAA+C;YAC/C,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE;YAChE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,+BAAgC,GAAa,CAAC,OAAO,EAAE;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,SAAS,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC3B,yDAAyD;IAC3D,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,GAAiB,IAAI,CAAC;IACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,wBAAwB;QACxB,UAAU,GAAG,GAAG,CAAC;QACjB,aAAa,GAAG,IAAI,CAAC;QACrB,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,aAAa,GAAG,IAAI,CAAC;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,qEAAqE;QACrE,mEAAmE;QACnE,0EAA0E;QAC1E,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACpC,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;oBAChD,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;wBAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBACpC,IAAI,OAAO,EAAE,CAAC;4BACZ,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;4BACvB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;YACD,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAClD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,SAAS,cAAc;QACrB,IAAI,KAAsB,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;YACjD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrB,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,SAAS,IAAI,CACX,EAAU,EACV,MAAc,EACd,MAA+B;QAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACrE,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,CAC9D,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,IAAI,CACjB,EAAU,EACV,MAAc,EACd,MAA+B;QAE/B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC;gBACxB,WAAW;gBACX,OAAO,CAAC,OAAO;aAChB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,gEAAgE;YAChE,oEAAoE;YACpE,iDAAiD;YACjD,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,SAAS,MAAM,CAAC,MAAc,EAAE,SAAkC,EAAE;QAClE,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrE,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,SAAS,OAAO;QACd,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,EAAE;YACH,KAAK;YACL,SAAS;YACT,OAAO;YACP,IAAI;YACJ,MAAM;YACN,MAAM,EAAE,GAAG,EAAE,CAAC,aAAa;YAC3B,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;YACxB,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU;YAC5B,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU;YAC5B,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,uBAAuB,CACpC,GAAe,EACf,SAAiB;IAEjB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC/D,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAyC,CAAC;IAC3D,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,IAAiD,CAAC;QAC5D,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB;YAAE,SAAS;QAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,WAAmD,CAAC;QACrE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC3E,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAqC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,GAAe;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAC7B,IAAI,GAAG;QAAE,OAAO,iBAAiB,GAAG,CAAC,OAAO,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;IACnF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjF,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,GAAG,MAA4D,CAAC;IACvE,IAAI,CAAC,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,CAAC,CAAC,iBAAiB,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,KAA2C,CAAC;YACtD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpD,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,4BAA4B;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AA0CD,MAAM,UAAU,iBAAiB,CAAC,IAAyB;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,IAAI,GAAG,GAAsB,IAAI,CAAC;IAClC,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,WAAW,GAAkC,IAAI,CAAC;IACtD,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,+CAA+C;IAC/C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,SAAS,aAAa;QACpB,IAAI,GAAG,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QACtD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QAChB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS,iBAAiB;QACxB,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO,WAAW,CAAC;QAC7C,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,YAAY,CAAC;YACpC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE;gBACtD,eAAe,EAAE,YAAY;gBAC7B,YAAY,EAAE,EAAE;gBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE;aAC3D,CAAC,CAAC;YACH,IAAI,UAAU,KAAK,MAAM;gBAAE,OAAO,iBAAiB,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,+BAA+B,SAAS,IAAI,CAAC;YACtD,CAAC;YACD,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO,mCAAmC,UAAU,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;YACpF,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,aAAa,GAAG,GAAW,EAAE,CACjC,oDAAoD,SAAS,oCAAoC,CAAC;IAEpG,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,KAAyB;YAC1C,IAAI,QAAQ;gBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,GAAI,CAAC;YAEf,kEAAkE;YAClE,oEAAoE;YACpE,gEAAgE;YAChE,kEAAkE;YAClE,kEAAkE;YAClE,6BAA6B;YAC7B,MAAM,WAAW,GACf,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;YACpE,MAAM,aAAa,GAAG,WAAW;gBAC/B,CAAC,CAAC,MAAM,uBAAuB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;gBAC5C,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAA4B,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClE,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;YACrC,CAAC;YACD,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;gBACjC,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,EAClC,CAAC;gBACD,QAAQ,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;YAC/C,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE;gBACtD,IAAI,EAAE,gBAAgB;gBACtB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,iBAAiB,cAAc,CAAC,CAAC,CAAC,EAAE;iBAC7C,CAAC;YACJ,CAAC;YACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,+BAA+B,SAAS,IAAI;iBACrD,CAAC;YACJ,CAAC;YACD,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,yBAAyB,UAAU,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE;iBACzE,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,8CAA8C;iBACvD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,gDAAgD;iBACzD,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACjC,CAAC;QAED,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,IAA6B;YAE7B,IAAI,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC;YACrE,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACzE,MAAM,CAAC,GAAG,GAAI,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE;gBAClD,IAAI;gBACJ,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO;oBACL,MAAM,EAAE,UAAU;oBAClB,MAAM,EAAE,+BAA+B,SAAS,IAAI;iBACrD,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS;iBAChD,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtE,CAAC;QAED,OAAO;YACL,GAAG,EAAE,OAAO,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAwB;IAExB,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,YAAY,CAAC;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;gBACtC,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/policy-packs/builtin/solution-acceptance-runtime.d.ts

@@ -81,9 +81,10 @@ export declare function verdictPathFor(dir: string, id: string): string;
 export declare function resolveExplicitVerdictId(env?: NodeJS.ProcessEnv): string | null;
 /**
  * Read + validate the verdict marker for `id`, or null when it is absent,
- * unparseable, a symlink, or not a regular file. The lstat + symlink reject
- * mirrors `checkApprovalMarker`: defense-in-depth against a symlink planted
- * at the marker path pointing at agent-controlled content.
+ * unparseable, a symlink, or not a regular file. The symlink-rejecting read
+ * is the shared `src/io/read-regular-file.ts` helper (same defense-in-depth
+ * as `checkApprovalMarker` against a symlink planted at the marker path
+ * pointing at agent-controlled content).
  */
 export declare function readVerdict(dir: string, id: string): Verdict | null;
 export interface GateResult {

package/dist/policy-packs/builtin/solution-acceptance-runtime.js

@@ -42,9 +42,9 @@
 // write primitive is closed by marker signing, a cross-repo follow-up that
 // already touches the producer. This module must NOT claim the residual is
 // fully closed.
-import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { readRegularFileRejectingSymlink } from "../../io/read-regular-file.js";
 export const PACK_NAME = "solution-acceptance";
 /**
  * agent-tasks MCP verbs that mark a completion boundary. The gate fires on
@@ -160,9 +160,10 @@ export function resolveExplicitVerdictId(env = process.env) {
 }
 /**
  * Read + validate the verdict marker for `id`, or null when it is absent,
- * unparseable, a symlink, or not a regular file. The lstat + symlink reject
- * mirrors `checkApprovalMarker`: defense-in-depth against a symlink planted
- * at the marker path pointing at agent-controlled content.
+ * unparseable, a symlink, or not a regular file. The symlink-rejecting read
+ * is the shared `src/io/read-regular-file.ts` helper (same defense-in-depth
+ * as `checkApprovalMarker` against a symlink planted at the marker path
+ * pointing at agent-controlled content).
  */
 export function readVerdict(dir, id) {
     let p;
@@ -172,24 +173,14 @@ export function readVerdict(dir, id) {
     catch {
         return null; // invalid id
     }
-    let stat;
-    try {
-        stat = fs.lstatSync(p);
-    }
-    catch {
-        return null;
-    }
-    if (stat.isSymbolicLink() || !stat.isFile())
+    // Shared symlink-rejecting read (src/io/read-regular-file.ts); every
+    // non-ok kind (missing / symlink / not-regular / unreadable) closes the
+    // gate via null, matching the pre-extraction behavior.
+    const read = readRegularFileRejectingSymlink(p);
+    if (read.kind !== "ok")
         return null;
-    let raw;
-    try {
-        raw = fs.readFileSync(p, "utf8");
-    }
-    catch {
-        return null;
-    }
     try {
-        const parsed = JSON.parse(raw);
+        const parsed = JSON.parse(read.content);
         if (typeof parsed.id !== "string" ||
             typeof parsed.head !== "string" ||
             typeof parsed.ready !== "boolean") {