npm - @lannguyensi/harness - Versions diffs - 0.39.0 → 0.41.0 - Mend

@lannguyensi/harness 0.39.0 → 0.41.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (127) hide show

package/CHANGELOG.md +59 -0
package/dist/cli/approve/stdin-report.d.ts +42 -0
package/dist/cli/approve/stdin-report.js +143 -0
package/dist/cli/approve/stdin-report.js.map +1 -0
package/dist/cli/approve/understanding.d.ts +20 -0
package/dist/cli/approve/understanding.js +44 -0
package/dist/cli/approve/understanding.js.map +1 -1
package/dist/cli/diff/git.d.ts +5 -0
package/dist/cli/diff/git.js +25 -3
package/dist/cli/diff/git.js.map +1 -1
package/dist/cli/doctor/codex.d.ts +8 -0
package/dist/cli/doctor/codex.js +8 -1
package/dist/cli/doctor/codex.js.map +1 -1
package/dist/cli/doctor/format.js +23 -11
package/dist/cli/doctor/format.js.map +1 -1
package/dist/cli/doctor/index.d.ts +36 -0
package/dist/cli/doctor/index.js +131 -29
package/dist/cli/doctor/index.js.map +1 -1
package/dist/cli/doctor/types.d.ts +26 -0
package/dist/cli/dry-run.js +5 -0
package/dist/cli/dry-run.js.map +1 -1
package/dist/cli/explain.js +16 -3
package/dist/cli/explain.js.map +1 -1
package/dist/cli/index.js +109 -6
package/dist/cli/index.js.map +1 -1
package/dist/cli/init/composer.js +10 -31
package/dist/cli/init/composer.js.map +1 -1
package/dist/cli/init/index.d.ts +18 -0
package/dist/cli/init/index.js +28 -2
package/dist/cli/init/index.js.map +1 -1
package/dist/cli/init/interactive.d.ts +8 -0
package/dist/cli/init/interactive.js +22 -1
package/dist/cli/init/interactive.js.map +1 -1
package/dist/cli/init/profiles.d.ts +2 -2
package/dist/cli/init/profiles.js +11 -2
package/dist/cli/init/profiles.js.map +1 -1
package/dist/cli/init/templates.d.ts +1 -1
package/dist/cli/init/templates.js +174 -4
package/dist/cli/init/templates.js.map +1 -1
package/dist/cli/list.js +3 -1
package/dist/cli/list.js.map +1 -1
package/dist/cli/pack/approve-escape.d.ts +19 -0
package/dist/cli/pack/approve-escape.js +120 -0
package/dist/cli/pack/approve-escape.js.map +1 -0
package/dist/cli/pack/hook-bootstrap.d.ts +24 -0
package/dist/cli/pack/hook-bootstrap.js +47 -1
package/dist/cli/pack/hook-bootstrap.js.map +1 -1
package/dist/cli/pack/hook-branch-protection.js +9 -1
package/dist/cli/pack/hook-branch-protection.js.map +1 -1
package/dist/cli/pack/hook-codex-post-tool-use.d.ts +25 -0
package/dist/cli/pack/hook-codex-post-tool-use.js +160 -0
package/dist/cli/pack/hook-codex-post-tool-use.js.map +1 -0
package/dist/cli/pack/hook-codex-pre-tool-use.d.ts +1 -0
package/dist/cli/pack/hook-codex-pre-tool-use.js +43 -10
package/dist/cli/pack/hook-codex-pre-tool-use.js.map +1 -1
package/dist/cli/pack/hook-codex-stop.js +1 -8
package/dist/cli/pack/hook-codex-stop.js.map +1 -1
package/dist/cli/pack/hook-post-tool-use.js +16 -131
package/dist/cli/pack/hook-post-tool-use.js.map +1 -1
package/dist/cli/pack/hook-pre-tool-use.js +69 -26
package/dist/cli/pack/hook-pre-tool-use.js.map +1 -1
package/dist/cli/pack/hook-stay-in-scope.js +63 -20
package/dist/cli/pack/hook-stay-in-scope.js.map +1 -1
package/dist/cli/pack/hook-track-active-claim.js +33 -9
package/dist/cli/pack/hook-track-active-claim.js.map +1 -1
package/dist/cli/pack/index.d.ts +2 -1
package/dist/cli/pack/index.js +2 -1
package/dist/cli/pack/index.js.map +1 -1
package/dist/cli/pack/mutate.d.ts +19 -0
package/dist/cli/pack/mutate.js +38 -0
package/dist/cli/pack/mutate.js.map +1 -1
package/dist/cli/pack/reseed.d.ts +19 -0
package/dist/cli/pack/reseed.js +118 -0
package/dist/cli/pack/reseed.js.map +1 -0
package/dist/cli/pack/understanding-report-schema-hint.js +12 -1
package/dist/cli/pack/understanding-report-schema-hint.js.map +1 -1
package/dist/cli/pause/index.js +12 -3
package/dist/cli/pause/index.js.map +1 -1
package/dist/cli/session-start/index.d.ts +14 -0
package/dist/cli/session-start/index.js +42 -2
package/dist/cli/session-start/index.js.map +1 -1
package/dist/cli/validate/checks.js +8 -0
package/dist/cli/validate/checks.js.map +1 -1
package/dist/policy-packs/builtin/branch-protection-runtime.d.ts +4 -2
package/dist/policy-packs/builtin/branch-protection-runtime.js +4 -2
package/dist/policy-packs/builtin/branch-protection-runtime.js.map +1 -1
package/dist/policy-packs/builtin/branch-protection.d.ts +10 -1
package/dist/policy-packs/builtin/branch-protection.js +17 -0
package/dist/policy-packs/builtin/branch-protection.js.map +1 -1
package/dist/policy-packs/builtin/understanding-before-execution-runtime.d.ts +197 -24
package/dist/policy-packs/builtin/understanding-before-execution-runtime.js +342 -40
package/dist/policy-packs/builtin/understanding-before-execution-runtime.js.map +1 -1
package/dist/policy-packs/builtin/understanding-before-execution.d.ts +26 -1
package/dist/policy-packs/builtin/understanding-before-execution.js +302 -17
package/dist/policy-packs/builtin/understanding-before-execution.js.map +1 -1
package/dist/policy-packs/registry.d.ts +22 -1
package/dist/policy-packs/registry.js +19 -2
package/dist/policy-packs/registry.js.map +1 -1
package/dist/policy-packs/ux-compare.d.ts +14 -0
package/dist/policy-packs/ux-compare.js +58 -0
package/dist/policy-packs/ux-compare.js.map +1 -0
package/dist/policy-packs/ux-drift-check.d.ts +27 -0
package/dist/policy-packs/ux-drift-check.js +78 -0
package/dist/policy-packs/ux-drift-check.js.map +1 -0
package/dist/probes/mcp.d.ts +13 -0
package/dist/probes/mcp.js +57 -0
package/dist/probes/mcp.js.map +1 -1
package/dist/runtime/approval-signing.d.ts +82 -0
package/dist/runtime/approval-signing.js +275 -0
package/dist/runtime/approval-signing.js.map +1 -0
package/dist/runtime/intercept.js +62 -5
package/dist/runtime/intercept.js.map +1 -1
package/dist/runtime/ledger-add.js +5 -1
package/dist/runtime/ledger-add.js.map +1 -1
package/dist/runtime/pause-sentinel.js +14 -3
package/dist/runtime/pause-sentinel.js.map +1 -1
package/dist/runtime/recovery-git-commit.d.ts +22 -0
package/dist/runtime/recovery-git-commit.js +284 -0
package/dist/runtime/recovery-git-commit.js.map +1 -0
package/dist/runtime/tool-name-aliases.d.ts +1 -0
package/dist/runtime/tool-name-aliases.js +7 -1
package/dist/runtime/tool-name-aliases.js.map +1 -1
package/dist/schema/index.d.ts +53 -42
package/dist/schema/policies.d.ts +56 -44
package/dist/schema/policies.js +79 -9
package/dist/schema/policies.js.map +1 -1
package/package.json +2 -1

package/dist/cli/init/interactive.js CHANGED Viewed

@@ -590,6 +590,12 @@ export async function runInteractive(opts = {}) {
         if (homeArg !== undefined) {
             initOpts.homeDir = homeArg;
         }
+        // Task 7f8fb4bc: reuse the dependency-check PATH override (when a
+        // test supplies one) for `init()`'s own post-write bin-resolution
+        // check, so the two checks agree on what's "installed" for this run.
+        if (opts.dependencyPathEnv !== undefined) {
+            initOpts.pathEnv = opts.dependencyPathEnv;
+        }
         const initResult = await init(initOpts);
         stdout(initResult.stdout);
         const tailResult = await runPostInitTail({
@@ -645,6 +651,17 @@ async function runPostInitTail(t) {
         stderr(`\nValidate reported errors. Fix the manifest before running \`harness apply\`.\n`);
         return { aborted: false, profile, init: initResult, validateClean };
     }
+    // Bin-resolution check (task 7f8fb4bc): validate() only checks the
+    // manifest's shape, not whether the binaries it declares actually
+    // resolve. A binary that installed successfully but landed under a npm
+    // global bin dir NOT on PATH (the dogfood incident this task fixes)
+    // passes validate cleanly and only used to surface as an opaque
+    // `harness doctor` crash later. `init()` itself already ran this check
+    // against the just-written manifest (threaded through `pathEnv` above)
+    // and folded any findings into `initResult.stderr`, printed at the top
+    // of this function — read its verdict here rather than re-running the
+    // check a second time with different (test-injection) plumbing.
+    const binResolutionClean = initResult.binResolutionErrorCount === 0;
     if (profile === "team" || profile === "full") {
         // Reminder splits at the "Not using agent-tasks?" paragraph because
         // Full ships review-before-merge-bash + review-subagent-before-pr-create-bash
@@ -718,7 +735,7 @@ async function runPostInitTail(t) {
             `  codex:       harness apply --runtime codex --install --codex-config ${codexConfigPath}`,
             "",
         ].join("\n"));
-        return { aborted: false, profile, init: initResult, validateClean, applies: [] };
+        return { aborted: false, profile, init: initResult, validateClean, binResolutionClean, applies: [] };
     }
     if (selectedRuntimes.length > 1) {
         stderr("\nMulti-runtime wiring: harness.lock will reflect the last-applied runtime; re-run `harness apply --runtime <name>` to refresh drift baselines.\n");
@@ -744,6 +761,7 @@ async function runPostInitTail(t) {
         profile,
         init: initResult,
         validateClean,
+        binResolutionClean,
         applies,
     };
     if (legacyApply !== undefined)
@@ -883,6 +901,9 @@ async function runCustomProfile(rc) {
     const homeArg = harnessHomeArg(opts);
     if (homeArg !== undefined)
         initOpts.homeDir = homeArg;
+    // Task 7f8fb4bc: see the named-profile path above for rationale.
+    if (opts.dependencyPathEnv !== undefined)
+        initOpts.pathEnv = opts.dependencyPathEnv;
     const initResult = await init(initOpts);
     stdout(initResult.stdout);
     return await runPostInitTail({

package/dist/cli/init/interactive.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"interactive.js","sourceRoot":"","sources":["../../../src/cli/init/interactive.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,sEAAsE;AACtE,4DAA4D;AAC5D,EAAE;AACF,gBAAgB;AAChB,EAAE;AACF,wEAAwE;AACxE,kEAAkE;AAClE,4DAA4D;AAC5D,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,mDAAmD;AACnD,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,2EAA2E;AAC3E,oEAAoE;AACpE,uEAAuE;AACvE,4DAA4D;AAE5D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EACL,MAAM,GAIP,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAmB,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAoB,MAAM,mBAAmB,CAAC;AACnF,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,cAAc,GAGf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,GAKd,MAAM,eAAe,CAAC;AA0FvB,MAAM,eAAe,GAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAEjF,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,cAAc,CAAC,IAA2B;IACjD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAkB;IAC5C,MAAM,KAAK,GAAa,CAAC,oBAAoB,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC5F,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7F,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAsB;IACpD,kEAAkE;IAClE,iEAAiE;IACjE,8BAA8B;IAC9B,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAkB;IAChD,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAAC,CAA8B;IACzD,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,cAAc,CAAC;AAC1C,CAAC;AAWD,KAAK,UAAU,WAAW,CAAC,CAAkB;IAC3C,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,uDAAuD;IACvD,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,CAAC,CAAC,OAAO,iDAAiD,EAC1E,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QAChC,iEAAiE;QACjE,iEAAiE;QACjE,6CAA6C;QAC7C,iEAAiE;QACjE,iEAAiE;QACjE,8DAA8D;QAC9D,gEAAgE;QAChE,8DAA8D;QAC9D,6DAA6D;QAC7D,oDAAoD;QACpD,MAAM,SAAS,GAAgC;YAC7C,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,MAAM,EAAE,CAAC,CAAC,kBAAkB;YAC5B,KAAK,EAAE,IAAI;YACX,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;SAC1B,CAAC;QACF,qEAAqE;QACrE,kEAAkE;QAClE,uDAAuD;QACvD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,kBAAkB;gBAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBACtC,iEAAiE;gBACjE,wDAAwD;gBACxD,+DAA+D;gBAC/D,8DAA8D;gBAC9D,iEAAiE;gBACjE,6CAA6C;gBAC7C,MAAM,QAAQ,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;gBAC7D,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,UAAU,GAAG,QAAQ,IAAI,CAAC,CAAC;gBACpD,CAAC,CAAC,MAAM,CACN,yCAAyC,CAAC,CAAC,UAAU,sDAAsD,CAC5G,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,6DAA6D;gBAC7D,yDAAyD;gBACzD,8DAA8D;gBAC9D,MAAM,YAAY,GAAG,0BAA0B,CAAC,CAAC,kBAAkB,4BAA4B,CAAC;gBAChG,CAAC,CAAC,MAAM,CACN,4BAA4B,CAAC,CAAC,kBAAkB,cAAc,CAAC,CAAC,OAAO,yBAAyB,YAAY,IAAI,CACjH,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,YAAY;gBAAE,CAAC,CAAC,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC;YACvE,MAAM,OAAO,GAAwB,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;gBACxC,OAAO,CAAC,YAAY,GAAG,0BAA0B,CAAC,CAAC,kBAAkB,4BAA4B,CAAC;YACpG,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,YAAY,GAAG,0BAA0B,CAAC,CAAC,kBAAkB,4BAA4B,CAAC;YAChG,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,kBAAkB,KAAK,OAAO,IAAI,CAAC,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,wDAAwD,YAAY,IAAI,CAAC,CAAC;YACnF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,SAAS,GAAgC;QAC7C,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,CAAC,CAAC,eAAe;KACnC,CAAC;IACF,kEAAkE;IAClE,oEAAoE;IACpE,wCAAwC;IACxC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;QAC5E,CAAC,CAAC,MAAM,CAAC,+BAA+B,kBAAkB,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC;YAClC,CAAC,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;YAC/D,IAAI,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;gBACpC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,kBAAkB,CAAC,UAAU,IAAI,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,YAAY;YAAE,CAAC,CAAC,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,0DAA0D,CAAC,CAAC,eAAe,EAAE,CAAC;QACnG,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,0DAA0D,CAAC,CAAC,eAAe,EAAE,CAAC;QACnG,CAAC,CAAC,MAAM,CAAC,sCAAsC,OAAO,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,MAAM,CAAC,yBAAyB,YAAY,IAAI,CAAC,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AASD;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,oBAAoB,CACjC,CAA2B;IAE3B,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACvC,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,oFAAoF;YACpF,kBAAkB,KAAK,CAAC,OAAO,EAAE;YACjC,iFAAiF;YACjF,oEAAoE;YACpE,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACpE,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,6CAA6C,KAAK,CAAC,IAAI,6BAA6B;YACpF,2EAA2E;YAC3E,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,iDAAiD;IACjD,CAAC,CAAC,MAAM,CACN;QACE,EAAE;QACF,qEAAqE;QACrE,4EAA4E;QAC5E,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,sDAAsD;gBAC5D,KAAK,EAAE,OAAO;gBACd,WAAW,EAAE,sFAAsF;aACpG;YACD;gBACE,IAAI,EAAE,qDAAqD;gBAC3D,KAAK,EAAE,MAAM;gBACb,WAAW,EAAE,+DAA+D;aAC7E;YACD;gBACE,IAAI,EAAE,6DAA6D;gBACnE,KAAK,EAAE,OAAO;gBACd,WAAW,EAAE,wFAAwF;aACtG;SACF;KACF,CAAC,CAA+B,CAAC;IAElC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,+CAA+C;YAC/C,qDAAqD;YACrD,2DAA2D;YAC3D,yCAAyC;YACzC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,iEAAiE;YACjE,kDAAkD;YAClD,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,aAAa;IACb,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,iEAAiE;YACjE,8EAA8E;YAC9E,mCAAmC;YACnC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,2CAA2C;IAC3C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,CAAC,CAAC,MAAM,CAAC,0EAA0E,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,sEAAsE;YACtE,mBAAmB,OAAO,CAAC,IAAI,EAAE;YACjC,kFAAkF;YAClF,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,IAAc;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,IAAI,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAWD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,KAAK,UAAU,yBAAyB,CAAC,CAAgC;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,mBAAmB,GAAG,GAAS,EAAE;QACrC,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,kHAAkH;YAClH,+DAA+D;YAC/D,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/B,OAAO,EACL,yIAAyI;YAC3I,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,6DAA6D;QAC7D,iEAAiE;QACjE,sEAAsE;QACtE,8DAA8D;QAC9D,kEAAkE;QAClE,iEAAiE;QACjE,WAAW;QACX,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,mBAAmB,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,mBAAmB,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,CAAC,CAAC,MAAM,CAAC,4EAA4E,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,IAAI,eAAe,CAAC;IAC7C,IAAI,MAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;QACpE,qEAAqE;QACrE,yDAAyD;QACzD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,+CAA+C,OAAO,IAAI;YAC1D,iFAAiF;YACjF,kCAAkC;YAClC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,oEAAoE,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IACD,CAAC,CAAC,MAAM,CACN;QACE,EAAE;QACF,uCAAuC,MAAM,CAAC,IAAI,GAAG;QACrD,iFAAiF;QACjF,kCAAkC;QAClC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CACxB,+CAAgD,GAAa,CAAC,OAAO,EAAE,EACvE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;gBACtC,OAAO,EAAE,gCAAgC,SAAS,CAAC,QAAQ,CAAC,IAAI,iBAAiB;gBACjF,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,8CAA8C,CAAC,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC;YACpC,OAAO,EAAE,sBAAsB;YAC/B,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,wDAAwD;oBAC9D,KAAK,EAAE,MAAM;oBACb,WAAW,EAAE,sEAAsE;iBACpF;gBACD;oBACE,IAAI,EAAE,6DAA6D;oBACnE,KAAK,EAAE,MAAM;oBACb,WAAW,EACT,iOAAiO;iBACpO;gBACD;oBACE,IAAI,EAAE,6EAA6E;oBACnF,KAAK,EAAE,MAAM;oBACb,WAAW,EACT,iPAAiP;iBACpP;gBACD;oBACE,IAAI,EAAE,2CAA2C;oBACjD,KAAK,EAAE,QAAQ;oBACf,WAAW,EACT,6HAA6H;iBAChI;aACF;SACF,CAAC,CAAkB,CAAC;QAErB,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,OAAO,MAAM,gBAAgB,CAAC;gBAC5B,SAAS;gBACT,OAAO;gBACP,MAAM;gBACN,MAAM;gBACN,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QAED,IAAI,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;gBACpC,OAAO,EACL,+VAA+V;gBACjW,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,wEAAwE,CAAC,CAAC;gBACjF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,gEAAgE;QAChE,MAAM,SAAS,GAAG,iBAAiB,CACjC,OAAO,EACP,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAChF,CAAC;QACF,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;gBACvC,OAAO,EAAE,WAAW,SAAS,CAAC,eAAe,CAAC,MAAM,uCAAuC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;gBACnI,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CACJ;oBACE,EAAE;oBACF,qDAAqD;oBACrD,iCAAiC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBACtE,2CAA2C;oBAC3C,EAAE;iBACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,CAAC,sBAAsB,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,SAAS,CAAC,eAAe,EACzB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CACtD,CAAC;YACF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,CACJ;oBACE,EAAE;oBACF,+BAA+B,aAAa,CAAC,QAAQ,yBAAyB;oBAC9E,wFAAwF;oBACxF,yCAAyC;oBACzC,EAAE;iBACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,CAAC,aAAa,aAAa,CAAC,SAAS,CAAC,MAAM,6BAA6B,CAAC,CAAC;QACnF,CAAC;QAED,iEAAiE;QACjE,gEAAgE;QAChE,gEAAgE;QAChE,mBAAmB;QACnB,MAAM,yBAAyB,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,wBAAwB,CACjD,CAAC;QACF,IAAI,yBAAyB,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC;gBAC5C,OAAO;gBACP,MAAM;gBACN,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC5D,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;YACpC,OAAO,EAAE,mEAAmE;YAC5E,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC5B,MAAM,CAAC,yCAAyC,CAAC,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACzC,OAAO,EAAE,yBAAyB,SAAS,CAAC,QAAQ,CAAC,IAAI,GAAG;YAC5D,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,wCAAwC,CAAC,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAED,iEAAiE;QACjE,mEAAmE;QACnE,iEAAiE;QACjE,qEAAqE;QACrE,+DAA+D;QAC/D,oEAAoE;QACpE,mCAAmC;QACnC,MAAM,QAAQ,GAA6E;YACzF,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;SACjE,CAAC;QACF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QAC7B,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAE1B,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC;YACvC,UAAU;YACV,OAAO;YACP,SAAS;YACT,OAAO;YACP,MAAM;YACN,IAAI;SACL,CAAC,CAAC;QAEH,8DAA8D;QAC9D,qDAAqD;QACrD,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,qEAAqE;QACrE,6DAA6D;QAC7D,yDAAyD;QACzD,MAAM,yBAAyB,CAAC;YAC9B,OAAO;YACP,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;YACtC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,gEAAgE,CAAC,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAWD;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,CAAmB;IAChD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,UAAU,CAAC,MAAM;QAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC;IACzC,MAAM,CAAC,uBAAuB,CAAC,CAAC,UAAU,cAAc,CAAC,CAAC,YAAY,eAAe,CAAC,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,CAAC,kFAAkF,CAAC,CAAC;QAC3F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC7C,oEAAoE;QACpE,8EAA8E;QAC9E,kEAAkE;QAClE,kEAAkE;QAClE,MAAM,IAAI,GAAG;YACX,EAAE;YACF,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,kEAAkE;YAClE,EAAE;SACH,CAAC;QACF,MAAM,IAAI,GACR,OAAO,KAAK,MAAM;YAChB,CAAC,CAAC;gBACE,6DAA6D;gBAC7D,oEAAoE;gBACpE,0DAA0D;aAC3D;YACH,CAAC,CAAC;gBACE,uEAAuE;gBACvE,sEAAsE;gBACtE,sEAAsE;gBACtE,0DAA0D;gBAC1D,qDAAqD;aACtD,CAAC;QACR,MAAM,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,SAAS;IACT,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAClC,aAAa,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,EACnF,eAAe,CAChB,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,YAAY,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,EACjF,aAAa,CACd,CAAC;IAEF,MAAM,WAAW,GAAoF;QACnG;YACE,IAAI,EAAE,8BAA8B,kBAAkB,EAAE;YACxD,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,mBAAmB,CAAC,aAAa,CAAC,IAAI,aAAa,KAAK,SAAS;SAC3E;QACD;YACE,IAAI,EAAE,sDAAsD,eAAe,gBAAgB;YAC3F,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,mBAAmB,CAAC,YAAY,CAAC;SAC3C;KACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC;QAC/C,OAAO,EAAE,iGAAiG;QAC1G,OAAO,EAAE;YACP,GAAG,WAAW;YACd,+DAA+D;YAC/D,iEAAiE;YACjE,0DAA0D;YAC1D;gBACE,IAAI,EAAE,iEAAiE;gBACvE,KAAK,EAAE,UAA6B;gBACpC,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,iCAAiC;aAC5C;SACF;KACF,CAAC,CAAsB,CAAC;IAEzB,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,CACJ;YACE,EAAE;YACF,mEAAmE;YACnE,yCAAyC,kBAAkB,UAAU;YACrE,yEAAyE,eAAe,EAAE;YAC1F,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnF,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,CACJ,mJAAmJ,CACpJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAsC;YAClD,OAAO;YACP,UAAU,EAAE,UAAU,CAAC,IAAI;YAC3B,kBAAkB;YAClB,eAAe;YACf,MAAM;SACP,CAAC;QACF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS;YAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,EAAE,KAAK,CAAC;IAC5E,MAAM,MAAM,GAAsB;QAChC,OAAO,EAAE,KAAK;QACd,OAAO;QACP,IAAI,EAAE,UAAU;QAChB,aAAa;QACb,OAAO;KACR,CAAC;IACF,IAAI,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,EAAiB;IAC/C,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACxD,MAAM,OAAO,GAAkB,QAAQ,CAAC;IAExC,8DAA8D;IAC9D,gEAAgE;IAChE,kEAAkE;IAClE,wBAAwB;IACxB,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE;QACvC,iEAAiE;QACjE,mEAAmE;QACnE,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC;QACpC,OAAO,EAAE,2BAA2B;QACpC,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,CAAC,CAAC,GAAG;YACZ,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;KACJ,CAAC,CAAoB,CAAC;IAEvB,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,oCAAoC;QAC7C,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,CAAC,CAAC,GAAG;YACZ,OAAO,EACL,CAAC,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;SACvF,CAAC,CAAC;KACJ,CAAC,CAAmB,CAAC;IAEtB,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC;QACvC,OAAO,EAAE,iCAAiC;QAC1C,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,CAAC,CAAC,GAAG;YACZ,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;KACJ,CAAC,CAAsB,CAAC;IAEzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,CACJ;YACE,EAAE;YACF,oFAAoF;YACpF,iFAAiF;YACjF,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,mBAAmB,CACnC,UAAU,EACV,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAChF,CAAC;IACF,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACvC,OAAO,EAAE,WAAW,SAAS,CAAC,eAAe,CAAC,MAAM,uCAAuC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;YACnI,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CACJ;gBACE,EAAE;gBACF,qDAAqD;gBACrD,iCAAiC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACtE,2CAA2C;gBAC3C,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,sBAAsB,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,SAAS,CAAC,eAAe,EACzB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CACtD,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,CACJ;gBACE,EAAE;gBACF,+BAA+B,aAAa,CAAC,QAAQ,yBAAyB;gBAC9E,wFAAwF;gBACxF,yCAAyC;gBACzC,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,aAAa,aAAa,CAAC,SAAS,CAAC,MAAM,6BAA6B,CAAC,CAAC;IACnF,CAAC;IAED,gEAAgE;IAChE,2DAA2D;IAC3D,MAAM,+BAA+B,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAC7D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,wBAAwB,CACjD,CAAC;IACF,IAAI,+BAA+B,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC;YAC5C,OAAO;YACP,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAChC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,WAAW,EAC1C,UAAU,EACV,WAAW,EACX,QAAQ,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;QACpC,OAAO,EAAE,mEAAmE;QAC5E,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,yCAAyC,CAAC,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,SAAS,GAAoB,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;QACzC,OAAO,EAAE,kCAAkC,SAAS,CAAC,QAAQ,CAAC,IAAI,GAAG;QACrE,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,wCAAwC,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAgF;QAC5F,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,YAAY,EAAE,QAAQ;QACtB,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;KACjE,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS;QAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAE1B,OAAO,MAAM,eAAe,CAAC;QAC3B,UAAU;QACV,OAAO;QACP,SAAS;QACT,OAAO;QACP,MAAM;QACN,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}
1	+ {"version":3,"file":"interactive.js","sourceRoot":"","sources":["../../../src/cli/init/interactive.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,sEAAsE;AACtE,4DAA4D;AAC5D,EAAE;AACF,gBAAgB;AAChB,EAAE;AACF,wEAAwE;AACxE,kEAAkE;AAClE,4DAA4D;AAC5D,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,mDAAmD;AACnD,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,2EAA2E;AAC3E,oEAAoE;AACpE,uEAAuE;AACvE,4DAA4D;AAE5D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EACL,MAAM,GAIP,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAmB,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAoB,MAAM,mBAAmB,CAAC;AACnF,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,cAAc,GAGf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,GAKd,MAAM,eAAe,CAAC;AAkGvB,MAAM,eAAe,GAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAEjF,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,cAAc,CAAC,IAA2B;IACjD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAkB;IAC5C,MAAM,KAAK,GAAa,CAAC,oBAAoB,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC5F,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7F,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAsB;IACpD,kEAAkE;IAClE,iEAAiE;IACjE,8BAA8B;IAC9B,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAkB;IAChD,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAAC,CAA8B;IACzD,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,cAAc,CAAC;AAC1C,CAAC;AAWD,KAAK,UAAU,WAAW,CAAC,CAAkB;IAC3C,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,uDAAuD;IACvD,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACzD,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,CAAC,CAAC,OAAO,iDAAiD,EAC1E,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QAChC,iEAAiE;QACjE,iEAAiE;QACjE,6CAA6C;QAC7C,iEAAiE;QACjE,iEAAiE;QACjE,8DAA8D;QAC9D,gEAAgE;QAChE,8DAA8D;QAC9D,6DAA6D;QAC7D,oDAAoD;QACpD,MAAM,SAAS,GAAgC;YAC7C,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,MAAM,EAAE,CAAC,CAAC,kBAAkB;YAC5B,KAAK,EAAE,IAAI;YACX,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;SAC1B,CAAC;QACF,qEAAqE;QACrE,kEAAkE;QAClE,uDAAuD;QACvD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,kBAAkB;gBAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBACtC,iEAAiE;gBACjE,wDAAwD;gBACxD,+DAA+D;gBAC/D,8DAA8D;gBAC9D,iEAAiE;gBACjE,6CAA6C;gBAC7C,MAAM,QAAQ,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;gBAC7D,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,UAAU,GAAG,QAAQ,IAAI,CAAC,CAAC;gBACpD,CAAC,CAAC,MAAM,CACN,yCAAyC,CAAC,CAAC,UAAU,sDAAsD,CAC5G,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,6DAA6D;gBAC7D,yDAAyD;gBACzD,8DAA8D;gBAC9D,MAAM,YAAY,GAAG,0BAA0B,CAAC,CAAC,kBAAkB,4BAA4B,CAAC;gBAChG,CAAC,CAAC,MAAM,CACN,4BAA4B,CAAC,CAAC,kBAAkB,cAAc,CAAC,CAAC,OAAO,yBAAyB,YAAY,IAAI,CACjH,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,YAAY;gBAAE,CAAC,CAAC,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC;YACvE,MAAM,OAAO,GAAwB,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;gBACxC,OAAO,CAAC,YAAY,GAAG,0BAA0B,CAAC,CAAC,kBAAkB,4BAA4B,CAAC;YACpG,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,YAAY,GAAG,0BAA0B,CAAC,CAAC,kBAAkB,4BAA4B,CAAC;YAChG,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,kBAAkB,KAAK,OAAO,IAAI,CAAC,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,wDAAwD,YAAY,IAAI,CAAC,CAAC;YACnF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,SAAS,GAAgC;QAC7C,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,CAAC,CAAC,eAAe;KACnC,CAAC;IACF,kEAAkE;IAClE,oEAAoE;IACpE,wCAAwC;IACxC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;QAC5E,CAAC,CAAC,MAAM,CAAC,+BAA+B,kBAAkB,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC;YAClC,CAAC,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;YAC/D,IAAI,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;gBACpC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,kBAAkB,CAAC,UAAU,IAAI,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,YAAY;YAAE,CAAC,CAAC,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,0DAA0D,CAAC,CAAC,eAAe,EAAE,CAAC;QACnG,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,0DAA0D,CAAC,CAAC,eAAe,EAAE,CAAC;QACnG,CAAC,CAAC,MAAM,CAAC,sCAAsC,OAAO,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,MAAM,CAAC,yBAAyB,YAAY,IAAI,CAAC,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AASD;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,oBAAoB,CACjC,CAA2B;IAE3B,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACvC,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,oFAAoF;YACpF,kBAAkB,KAAK,CAAC,OAAO,EAAE;YACjC,iFAAiF;YACjF,oEAAoE;YACpE,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACpE,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,6CAA6C,KAAK,CAAC,IAAI,6BAA6B;YACpF,2EAA2E;YAC3E,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,iDAAiD;IACjD,CAAC,CAAC,MAAM,CACN;QACE,EAAE;QACF,qEAAqE;QACrE,4EAA4E;QAC5E,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,sDAAsD;gBAC5D,KAAK,EAAE,OAAO;gBACd,WAAW,EAAE,sFAAsF;aACpG;YACD;gBACE,IAAI,EAAE,qDAAqD;gBAC3D,KAAK,EAAE,MAAM;gBACb,WAAW,EAAE,+DAA+D;aAC7E;YACD;gBACE,IAAI,EAAE,6DAA6D;gBACnE,KAAK,EAAE,OAAO;gBACd,WAAW,EAAE,wFAAwF;aACtG;SACF;KACF,CAAC,CAA+B,CAAC;IAElC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,+CAA+C;YAC/C,qDAAqD;YACrD,2DAA2D;YAC3D,yCAAyC;YACzC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,iEAAiE;YACjE,kDAAkD;YAClD,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,aAAa;IACb,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,iEAAiE;YACjE,8EAA8E;YAC9E,mCAAmC;YACnC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,2CAA2C;IAC3C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,CAAC,CAAC,MAAM,CAAC,0EAA0E,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,sEAAsE;YACtE,mBAAmB,OAAO,CAAC,IAAI,EAAE;YACjC,kFAAkF;YAClF,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,IAAc;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,IAAI,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAWD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,KAAK,UAAU,yBAAyB,CAAC,CAAgC;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,mBAAmB,GAAG,GAAS,EAAE;QACrC,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,kHAAkH;YAClH,+DAA+D;YAC/D,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/B,OAAO,EACL,yIAAyI;YAC3I,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,6DAA6D;QAC7D,iEAAiE;QACjE,sEAAsE;QACtE,8DAA8D;QAC9D,kEAAkE;QAClE,iEAAiE;QACjE,WAAW;QACX,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,mBAAmB,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,mBAAmB,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,CAAC,CAAC,MAAM,CAAC,4EAA4E,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,IAAI,eAAe,CAAC;IAC7C,IAAI,MAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;QACpE,qEAAqE;QACrE,yDAAyD;QACzD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,MAAM,CACN;YACE,EAAE;YACF,+CAA+C,OAAO,IAAI;YAC1D,iFAAiF;YACjF,kCAAkC;YAClC,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,oEAAoE,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IACD,CAAC,CAAC,MAAM,CACN;QACE,EAAE;QACF,uCAAuC,MAAM,CAAC,IAAI,GAAG;QACrD,iFAAiF;QACjF,kCAAkC;QAClC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CACxB,+CAAgD,GAAa,CAAC,OAAO,EAAE,EACvE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;gBACtC,OAAO,EAAE,gCAAgC,SAAS,CAAC,QAAQ,CAAC,IAAI,iBAAiB;gBACjF,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,8CAA8C,CAAC,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC;YACpC,OAAO,EAAE,sBAAsB;YAC/B,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,wDAAwD;oBAC9D,KAAK,EAAE,MAAM;oBACb,WAAW,EAAE,sEAAsE;iBACpF;gBACD;oBACE,IAAI,EAAE,6DAA6D;oBACnE,KAAK,EAAE,MAAM;oBACb,WAAW,EACT,iOAAiO;iBACpO;gBACD;oBACE,IAAI,EAAE,6EAA6E;oBACnF,KAAK,EAAE,MAAM;oBACb,WAAW,EACT,iPAAiP;iBACpP;gBACD;oBACE,IAAI,EAAE,2CAA2C;oBACjD,KAAK,EAAE,QAAQ;oBACf,WAAW,EACT,6HAA6H;iBAChI;aACF;SACF,CAAC,CAAkB,CAAC;QAErB,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,OAAO,MAAM,gBAAgB,CAAC;gBAC5B,SAAS;gBACT,OAAO;gBACP,MAAM;gBACN,MAAM;gBACN,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QAED,IAAI,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;gBACpC,OAAO,EACL,+VAA+V;gBACjW,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,wEAAwE,CAAC,CAAC;gBACjF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,gEAAgE;QAChE,MAAM,SAAS,GAAG,iBAAiB,CACjC,OAAO,EACP,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAChF,CAAC;QACF,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;gBACvC,OAAO,EAAE,WAAW,SAAS,CAAC,eAAe,CAAC,MAAM,uCAAuC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;gBACnI,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CACJ;oBACE,EAAE;oBACF,qDAAqD;oBACrD,iCAAiC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBACtE,2CAA2C;oBAC3C,EAAE;iBACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,CAAC,sBAAsB,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,SAAS,CAAC,eAAe,EACzB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CACtD,CAAC;YACF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,CACJ;oBACE,EAAE;oBACF,+BAA+B,aAAa,CAAC,QAAQ,yBAAyB;oBAC9E,wFAAwF;oBACxF,yCAAyC;oBACzC,EAAE;iBACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,CAAC,aAAa,aAAa,CAAC,SAAS,CAAC,MAAM,6BAA6B,CAAC,CAAC;QACnF,CAAC;QAED,iEAAiE;QACjE,gEAAgE;QAChE,gEAAgE;QAChE,mBAAmB;QACnB,MAAM,yBAAyB,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,wBAAwB,CACjD,CAAC;QACF,IAAI,yBAAyB,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC;gBAC5C,OAAO;gBACP,MAAM;gBACN,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC5D,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;YACpC,OAAO,EAAE,mEAAmE;YAC5E,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC5B,MAAM,CAAC,yCAAyC,CAAC,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACzC,OAAO,EAAE,yBAAyB,SAAS,CAAC,QAAQ,CAAC,IAAI,GAAG;YAC5D,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,wCAAwC,CAAC,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAED,iEAAiE;QACjE,mEAAmE;QACnE,iEAAiE;QACjE,qEAAqE;QACrE,+DAA+D;QAC/D,oEAAoE;QACpE,mCAAmC;QACnC,MAAM,QAAQ,GAKV;YACF,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;SACjE,CAAC;QACF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QAC7B,CAAC;QACD,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACzC,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC5C,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAE1B,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC;YACvC,UAAU;YACV,OAAO;YACP,SAAS;YACT,OAAO;YACP,MAAM;YACN,IAAI;SACL,CAAC,CAAC;QAEH,8DAA8D;QAC9D,qDAAqD;QACrD,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,qEAAqE;QACrE,6DAA6D;QAC7D,yDAAyD;QACzD,MAAM,yBAAyB,CAAC;YAC9B,OAAO;YACP,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;YACtC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,gEAAgE,CAAC,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAWD;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,CAAmB;IAChD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,UAAU,CAAC,MAAM;QAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC;IACzC,MAAM,CAAC,uBAAuB,CAAC,CAAC,UAAU,cAAc,CAAC,CAAC,YAAY,eAAe,CAAC,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,CAAC,kFAAkF,CAAC,CAAC;QAC3F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IACtE,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,uEAAuE;IACvE,oEAAoE;IACpE,gEAAgE;IAChE,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,kBAAkB,GAAG,UAAU,CAAC,uBAAuB,KAAK,CAAC,CAAC;IAEpE,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC7C,oEAAoE;QACpE,8EAA8E;QAC9E,kEAAkE;QAClE,kEAAkE;QAClE,MAAM,IAAI,GAAG;YACX,EAAE;YACF,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,kEAAkE;YAClE,EAAE;SACH,CAAC;QACF,MAAM,IAAI,GACR,OAAO,KAAK,MAAM;YAChB,CAAC,CAAC;gBACE,6DAA6D;gBAC7D,oEAAoE;gBACpE,0DAA0D;aAC3D;YACH,CAAC,CAAC;gBACE,uEAAuE;gBACvE,sEAAsE;gBACtE,sEAAsE;gBACtE,0DAA0D;gBAC1D,qDAAqD;aACtD,CAAC;QACR,MAAM,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,+DAA+D;IAC/D,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,SAAS;IACT,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAClC,aAAa,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,EACnF,eAAe,CAChB,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,YAAY,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,EACjF,aAAa,CACd,CAAC;IAEF,MAAM,WAAW,GAAoF;QACnG;YACE,IAAI,EAAE,8BAA8B,kBAAkB,EAAE;YACxD,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,mBAAmB,CAAC,aAAa,CAAC,IAAI,aAAa,KAAK,SAAS;SAC3E;QACD;YACE,IAAI,EAAE,sDAAsD,eAAe,gBAAgB;YAC3F,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,mBAAmB,CAAC,YAAY,CAAC;SAC3C;KACF,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC;QAC/C,OAAO,EAAE,iGAAiG;QAC1G,OAAO,EAAE;YACP,GAAG,WAAW;YACd,+DAA+D;YAC/D,iEAAiE;YACjE,0DAA0D;YAC1D;gBACE,IAAI,EAAE,iEAAiE;gBACvE,KAAK,EAAE,UAA6B;gBACpC,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,iCAAiC;aAC5C;SACF;KACF,CAAC,CAAsB,CAAC;IAEzB,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,CACJ;YACE,EAAE;YACF,mEAAmE;YACnE,yCAAyC,kBAAkB,UAAU;YACrE,yEAAyE,eAAe,EAAE;YAC1F,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACvG,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,CACJ,mJAAmJ,CACpJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAsC;YAClD,OAAO;YACP,UAAU,EAAE,UAAU,CAAC,IAAI;YAC3B,kBAAkB;YAClB,eAAe;YACf,MAAM;SACP,CAAC;QACF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS;YAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,EAAE,KAAK,CAAC;IAC5E,MAAM,MAAM,GAAsB;QAChC,OAAO,EAAE,KAAK;QACd,OAAO;QACP,IAAI,EAAE,UAAU;QAChB,aAAa;QACb,kBAAkB;QAClB,OAAO;KACR,CAAC;IACF,IAAI,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,EAAiB;IAC/C,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACxD,MAAM,OAAO,GAAkB,QAAQ,CAAC;IAExC,8DAA8D;IAC9D,gEAAgE;IAChE,kEAAkE;IAClE,wBAAwB;IACxB,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE;QACvC,iEAAiE;QACjE,mEAAmE;QACnE,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC;QACpC,OAAO,EAAE,2BAA2B;QACpC,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,CAAC,CAAC,GAAG;YACZ,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;KACJ,CAAC,CAAoB,CAAC;IAEvB,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,oCAAoC;QAC7C,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,CAAC,CAAC,GAAG;YACZ,OAAO,EACL,CAAC,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;SACvF,CAAC,CAAC;KACJ,CAAC,CAAmB,CAAC;IAEtB,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC;QACvC,OAAO,EAAE,iCAAiC;QAC1C,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,CAAC,CAAC,GAAG;YACZ,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;KACJ,CAAC,CAAsB,CAAC;IAEzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,CACJ;YACE,EAAE;YACF,oFAAoF;YACpF,iFAAiF;YACjF,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,mBAAmB,CACnC,UAAU,EACV,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAChF,CAAC;IACF,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACvC,OAAO,EAAE,WAAW,SAAS,CAAC,eAAe,CAAC,MAAM,uCAAuC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;YACnI,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CACJ;gBACE,EAAE;gBACF,qDAAqD;gBACrD,iCAAiC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACtE,2CAA2C;gBAC3C,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,sBAAsB,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,SAAS,CAAC,eAAe,EACzB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CACtD,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,CACJ;gBACE,EAAE;gBACF,+BAA+B,aAAa,CAAC,QAAQ,yBAAyB;gBAC9E,wFAAwF;gBACxF,yCAAyC;gBACzC,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,aAAa,aAAa,CAAC,SAAS,CAAC,MAAM,6BAA6B,CAAC,CAAC;IACnF,CAAC;IAED,gEAAgE;IAChE,2DAA2D;IAC3D,MAAM,+BAA+B,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAC7D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,wBAAwB,CACjD,CAAC;IACF,IAAI,+BAA+B,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC;YAC5C,OAAO;YACP,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAChC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,WAAW,EAC1C,UAAU,EACV,WAAW,EACX,QAAQ,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;QACpC,OAAO,EAAE,mEAAmE;QAC5E,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,yCAAyC,CAAC,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,SAAS,GAAoB,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;QACzC,OAAO,EAAE,kCAAkC,SAAS,CAAC,QAAQ,CAAC,IAAI,GAAG;QACrE,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,wCAAwC,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAMV;QACF,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,YAAY,EAAE,QAAQ;QACtB,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;KACjE,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS;QAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;IACtD,iEAAiE;IACjE,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACpF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAE1B,OAAO,MAAM,eAAe,CAAC;QAC3B,UAAU;QACV,OAAO;QACP,SAAS;QACT,OAAO;QACP,MAAM;QACN,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/init/profiles.d.ts CHANGED Viewed

@@ -1,2 +1,2 @@
-export declare const SOLO_TEMPLATE = "# ~/.harness/harness.yaml (legacy: ~/.claude/harness.yaml)\n#\n# Bootstrapped by `harness init --template solo`.\n#\n# Single-operator profile: memory-router for cross-conversation memory\n# routing + understanding-before-execution policy pack to force an\n# explicit interpretation confirmation before any write-capable tool\n# fires. No agent-tasks loop (use --template team if you want PR\n# review-gating).\n#\n# Adapt the paths under `command:` to your install layout, or move\n# host-specific paths to ~/.harness/machines/<host>.harness.overrides.yaml.\n\nversion: 1\n\ngrounding:\n  session:\n    auto_start: true\n    id_format: \"gs-{repo}-{rand:8}\"\n  evidence_ledger:\n    path: ~/.evidence-ledger/ledger.db\n    retention_days: 90\n\ntools:\n  builtin:\n    known: [Read, Edit, Write, Bash, Agent, Skill, TaskCreate, Glob, Grep]\n\nmemory:\n  directories:\n    - path: ~/.claude/projects/{project}/memory\n      scope: project\n  router:\n    # `memory-router-user-prompt-submit` is the published bin from\n    # `@lannguyensi/memory-router`. `harness init` offers to\n    # `npm i -g` it for you; doctor expects it on PATH.\n    command: [memory-router-user-prompt-submit]\n    enabled: true\n  retention:\n    staleness_days: 180\n    broken_refs: warn\n  scopes:\n    default: project\n    allowed: [project, user]\n\npolicy_packs:\n  - name: understanding-before-execution\n    source: builtin\n    enabled: true\n    description: Force agents to expose their task interpretation and wait for explicit human approval before any write-capable tool fires.\n    config:\n      mode: grill_me\n      # ux (agent-tasks/60bc93e5): replaces the legacy engine-vocabulary\n      # deny envelope with the plain-language { cannot, required, run }\n      # shape. Engine details still land in stderr for operator audit;\n      # the agent only sees this.\n      ux:\n        cannot: \"You cannot use write-capable tools yet.\"\n        required:\n          - \"an approved Understanding Report for this session\"\n        run:\n          - \"Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan, Prior Art (state what you searched for an existing solution and what you found, with an explicit adopt-or-build judgment)\"\n          - \"Run `harness approve understanding` (bare, no pipes, chaining, or redirection) and approve the prompt\"\n      # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,\n      # v0.18.0+): expire the approval marker on task-completion\n      # boundaries. Solo wires no agent-tasks MCP, so\n      # `expire_on_tool_match` would be dead weight; we list Bash\n      # boundaries instead (PR merges via gh-cli, pushes to the\n      # protected branch). Operators on other CLIs override this list\n      # with their own regexes. `max_age` is the safety net for\n      # sessions that never hit a listed command. Opt out entirely\n      # with `approval_lifecycle: { mode: session }`.\n      approval_lifecycle:\n        expire_on_bash_match:\n          - '^gh pr (merge|close)\\b'\n          - '^git push origin (master|main)\\b'\n        max_age: 1h\n";
-export declare const TEAM_TEMPLATE = "# ~/.harness/harness.yaml (legacy: ~/.claude/harness.yaml)\n#\n# Bootstrapped by `harness init --template team`.\n#\n# Solo profile + agent-tasks MCP + the review-before-merge policy. Block\n# pull_requests_merge MCP calls unless a ledger entry tagged\n# review:<pr-number> exists for the current grounding session, the\n# standard team workflow where every PR gets a review-subagent pass\n# before it can land.\n#\n# Adapt the paths under `command:` to your install layout, or move\n# host-specific paths to ~/.harness/machines/<host>.harness.overrides.yaml.\n\nversion: 1\n\ngrounding:\n  session:\n    auto_start: true\n    id_format: \"gs-{repo}-{rand:8}\"\n  evidence_ledger:\n    path: ~/.evidence-ledger/ledger.db\n    retention_days: 90\n\ntools:\n  mcp:\n    - name: agent-tasks\n      # Zero-setup entry: `@agent-tasks/mcp-bridge` exposes the\n      # `agent-tasks-mcp-bridge` binary on PATH after\n      # `npm i -g @agent-tasks/mcp-bridge`. The bridge owns token\n      # storage (OS keychain or file fallback) and defaults the base\n      # URL to https://agent-tasks.opentriologue.ai, so no env is\n      # required here. Override with `AGENT_TASKS_BASE_URL` /\n      # `AGENT_TASKS_TOKEN` if you self-host or want explicit creds.\n      command: [agent-tasks-mcp-bridge]\n      health:\n        verb: projects_list\n        timeout_ms: 5000\n      enabled: true\n    - name: grounding-mcp\n      # `grounding-mcp` bin is published in `@lannguyensi/grounding-mcp`.\n      # `harness init` offers to `npm i -g` it for you. No env is set:\n      # the bundled default resolves to `~/.evidence-ledger/ledger.db`\n      # via os.homedir() at startup. Passing a literal tilde in env\n      # bypasses shell expansion and creates rogue cwd-relative DB files\n      # (see agent-tasks/42d224a6 incident).\n      command: [grounding-mcp]\n      health:\n        verb: ledger_status\n        timeout_ms: 5000\n      enabled: true\n  builtin:\n    known: [Read, Edit, Write, Bash, Agent, Skill, TaskCreate, Glob, Grep]\n\nmemory:\n  directories:\n    - path: ~/.claude/projects/{project}/memory\n      scope: project\n  router:\n    # `memory-router-user-prompt-submit` is the published bin from\n    # `@lannguyensi/memory-router`. `harness init` offers to\n    # `npm i -g` it for you; doctor expects it on PATH.\n    command: [memory-router-user-prompt-submit]\n    enabled: true\n  retention:\n    staleness_days: 180\n    broken_refs: warn\n  scopes:\n    default: project\n    allowed: [project, user]\n\nhooks:\n  - name: require-review-evidence\n    event: PreToolUse\n    match: \"mcp__agent-tasks__pull_requests_merge\"\n    # The built-in `harness policy intercept` CLI verb is the generic\n    # deny-on-missing-evidence hook entrypoint. It reads the tool event\n    # JSON on stdin, evaluates all policies whose triggers match, emits\n    # Claude Code's deny envelope on block. Using it here removes the\n    # need to ship a per-policy shell script under ~/.claude/hooks/ for\n    # the team setup; operators with custom logic can swap in their own\n    # script path.\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\npolicies:\n  - name: review-before-merge\n    description: Block PR merges unless a ledger entry tagged review:<pr-number> exists for this session.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_merge\"\n      extract:\n        PR_NUMBER: \"toolArgs.prNumber\"\n    requires:\n      ledger_tag: \"review:${PR_NUMBER}\"\n    hook: require-review-evidence\n    enforcement: block\n    # producers: documents the intended evidence flow (see\n    # docs/writing-custom-policies.md, \"The trust model\"): this is a\n    # deliberate process gate \u2014 the agent records the review subagent's\n    # verdict itself, so against the agent the gate is advisory by design.\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: Spawn a review subagent against the PR diff, capture its verdict, then persist a ledger entry tagged with the PR number.\n    ux:\n      cannot: \"You cannot merge PR #${PR_NUMBER} yet.\"\n      required:\n        - \"a recorded review of PR #${PR_NUMBER}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\" }'\n\npolicy_packs:\n  - name: understanding-before-execution\n    source: builtin\n    enabled: true\n    description: Force agents to expose their task interpretation and wait for explicit human approval before any write-capable tool fires.\n    config:\n      mode: grill_me\n      # ux (agent-tasks/60bc93e5): same shape as Solo's pack ux.\n      ux:\n        cannot: \"You cannot use write-capable tools yet.\"\n        required:\n          - \"an approved Understanding Report for this session\"\n        run:\n          - \"Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan, Prior Art (state what you searched for an existing solution and what you found, with an explicit adopt-or-build judgment)\"\n          - \"Run `harness approve understanding` (bare, no pipes, chaining, or redirection) and approve the prompt\"\n      # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,\n      # v0.18.0+): expire the approval marker on task-completion\n      # boundaries. Team wires agent-tasks, so the MCP task verbs are\n      # the primary boundary; the Bash list catches operators who use\n      # gh-cli in parallel (hybrid workflow). `max_age` is the safety\n      # net. Opt out entirely with\n      # `approval_lifecycle: { mode: session }`.\n      approval_lifecycle:\n        expire_on_tool_match:\n          - mcp__agent-tasks__task_finish\n          - mcp__agent-tasks__task_abandon\n          - mcp__agent-tasks__pull_requests_merge\n          - mcp__agent-tasks__tasks_transition\n        expire_on_bash_match:\n          - '^gh pr (merge|close)\\b'\n          - '^git push origin (master|main)\\b'\n        max_age: 4h\n";
+export declare const SOLO_TEMPLATE = "# ~/.harness/harness.yaml (legacy: ~/.claude/harness.yaml)\n#\n# Bootstrapped by `harness init --template solo`.\n#\n# Single-operator profile: memory-router for cross-conversation memory\n# routing + understanding-before-execution policy pack to force an\n# explicit interpretation confirmation before any write-capable tool\n# fires. No agent-tasks loop (use --template team if you want PR\n# review-gating).\n#\n# Adapt the paths under `command:` to your install layout, or move\n# host-specific paths to ~/.harness/machines/<host>.harness.overrides.yaml.\n\nversion: 1\n\ngrounding:\n  session:\n    auto_start: true\n    id_format: \"gs-{repo}-{rand:8}\"\n  evidence_ledger:\n    path: ~/.evidence-ledger/ledger.db\n    retention_days: 90\n\ntools:\n  builtin:\n    known: [Read, Edit, Write, Bash, Agent, Skill, TaskCreate, Glob, Grep]\n\nmemory:\n  directories:\n    - path: ~/.claude/projects/{project}/memory\n      scope: project\n  router:\n    # `memory-router-user-prompt-submit` is the published bin from\n    # `@lannguyensi/memory-router`. `harness init` offers to\n    # `npm i -g` it for you; doctor expects it on PATH.\n    command: [memory-router-user-prompt-submit]\n    enabled: true\n  retention:\n    staleness_days: 180\n    broken_refs: warn\n  scopes:\n    default: project\n    allowed: [project, user]\n\npolicy_packs:\n  - name: understanding-before-execution\n    source: builtin\n    enabled: true\n    description: Force agents to expose their task interpretation and wait for explicit human approval before any write-capable tool fires.\n    config:\n      mode: grill_me\n      # ux (agent-tasks/60bc93e5): replaces the legacy engine-vocabulary\n      # deny envelope with the plain-language { cannot, required, run }\n      # shape. Engine details still land in stderr for operator audit;\n      # the agent only sees this.\n      #\n      # KEEP IN SYNC (task 68b9ad9c): this text must match\n      # defaultUx(\"grill_me\") in\n      # src/policy-packs/builtin/understanding-before-execution.ts \u2014 that\n      # function is what `harness pack reseed` / `harness doctor`'s\n      # divergence warning treat as \"the shipped template\". Pinned by\n      # tests/cli/init-templates-ux-parity.test.ts.\n      ux:\n        cannot: \"You cannot use write-capable tools yet.\"\n        required:\n          - \"an approved Understanding Report for this session\"\n        run:\n          - \"Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan, Prior Art (state what you searched for an existing solution and what you found, with an explicit adopt-or-build judgment)\"\n          - \"Run `harness approve understanding` with the report attached as a quoted heredoc (harness approve understanding <<'UNDERSTANDING_REPORT' ...report... UNDERSTANDING_REPORT) so it is persisted for audit, then approve the prompt; the heredoc is the only extra shell shape the gate allows (no pipes, chaining, or other redirection)\"\n      # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,\n      # v0.18.0+): expire the approval marker on task-completion\n      # boundaries. Solo wires no agent-tasks MCP, so\n      # `expire_on_tool_match` would be dead weight; we list Bash\n      # boundaries instead (PR merges via gh-cli, pushes to the\n      # protected branch). Operators on other CLIs override this list\n      # with their own regexes. `max_age` is the safety net for\n      # sessions that never hit a listed command. Opt out entirely\n      # with `approval_lifecycle: { mode: session }`.\n      approval_lifecycle:\n        expire_on_bash_match:\n          - '^gh pr (merge|close)\\b'\n          - '^git push origin (master|main)\\b'\n        max_age: 1h\n";
+export declare const TEAM_TEMPLATE = "# ~/.harness/harness.yaml (legacy: ~/.claude/harness.yaml)\n#\n# Bootstrapped by `harness init --template team`.\n#\n# Solo profile + agent-tasks MCP + the review-before-merge policy. Block\n# pull_requests_merge MCP calls unless a ledger entry tagged\n# review:<pr-number> exists for the current grounding session, the\n# standard team workflow where every PR gets a review-subagent pass\n# before it can land.\n#\n# Adapt the paths under `command:` to your install layout, or move\n# host-specific paths to ~/.harness/machines/<host>.harness.overrides.yaml.\n\nversion: 1\n\ngrounding:\n  session:\n    auto_start: true\n    id_format: \"gs-{repo}-{rand:8}\"\n  evidence_ledger:\n    path: ~/.evidence-ledger/ledger.db\n    retention_days: 90\n\ntools:\n  mcp:\n    - name: agent-tasks\n      # Zero-setup entry: `@agent-tasks/mcp-bridge` exposes the\n      # `agent-tasks-mcp-bridge` binary on PATH after\n      # `npm i -g @agent-tasks/mcp-bridge`. The bridge owns token\n      # storage (OS keychain or file fallback) and defaults the base\n      # URL to https://agent-tasks.opentriologue.ai, so no env is\n      # required here. Override with `AGENT_TASKS_BASE_URL` /\n      # `AGENT_TASKS_TOKEN` if you self-host or want explicit creds.\n      command: [agent-tasks-mcp-bridge]\n      health:\n        verb: projects_list\n        timeout_ms: 5000\n      enabled: true\n    - name: grounding-mcp\n      # `grounding-mcp` bin is published in `@lannguyensi/grounding-mcp`.\n      # `harness init` offers to `npm i -g` it for you. No env is set:\n      # the bundled default resolves to `~/.evidence-ledger/ledger.db`\n      # via os.homedir() at startup. Passing a literal tilde in env\n      # bypasses shell expansion and creates rogue cwd-relative DB files\n      # (see agent-tasks/42d224a6 incident).\n      command: [grounding-mcp]\n      health:\n        verb: ledger_status\n        timeout_ms: 5000\n      enabled: true\n  builtin:\n    known: [Read, Edit, Write, Bash, Agent, Skill, TaskCreate, Glob, Grep]\n\nmemory:\n  directories:\n    - path: ~/.claude/projects/{project}/memory\n      scope: project\n  router:\n    # `memory-router-user-prompt-submit` is the published bin from\n    # `@lannguyensi/memory-router`. `harness init` offers to\n    # `npm i -g` it for you; doctor expects it on PATH.\n    command: [memory-router-user-prompt-submit]\n    enabled: true\n  retention:\n    staleness_days: 180\n    broken_refs: warn\n  scopes:\n    default: project\n    allowed: [project, user]\n\nhooks:\n  - name: require-review-evidence\n    event: PreToolUse\n    match: \"mcp__agent-tasks__pull_requests_merge\"\n    # The built-in `harness policy intercept` CLI verb is the generic\n    # deny-on-missing-evidence hook entrypoint. It reads the tool event\n    # JSON on stdin, evaluates all policies whose triggers match, emits\n    # Claude Code's deny envelope on block. Using it here removes the\n    # need to ship a per-policy shell script under ~/.claude/hooks/ for\n    # the team setup; operators with custom logic can swap in their own\n    # script path.\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\npolicies:\n  - name: review-before-merge\n    description: Block PR merges unless a ledger entry tagged review:<pr-number> exists for this session.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_merge\"\n      extract:\n        PR_NUMBER: \"toolArgs.prNumber\"\n    requires:\n      ledger_tag: \"review:${PR_NUMBER}\"\n    hook: require-review-evidence\n    enforcement: block\n    # producers: documents the intended evidence flow (see\n    # docs/writing-custom-policies.md, \"The trust model\"): this is a\n    # deliberate process gate \u2014 the agent records the review subagent's\n    # verdict itself, so against the agent the gate is advisory by design.\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: Spawn a review subagent against the PR diff, capture its verdict, then persist a ledger entry tagged with the PR number.\n    ux:\n      cannot: \"You cannot merge PR #${PR_NUMBER} yet.\"\n      required:\n        - \"a recorded review of PR #${PR_NUMBER}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\" }'\n\npolicy_packs:\n  - name: understanding-before-execution\n    source: builtin\n    enabled: true\n    description: Force agents to expose their task interpretation and wait for explicit human approval before any write-capable tool fires.\n    config:\n      mode: grill_me\n      # ux (agent-tasks/60bc93e5): same shape as Solo's pack ux.\n      # KEEP IN SYNC (task 68b9ad9c): see the identical note on Solo's\n      # copy above \u2014 must match defaultUx(\"grill_me\").\n      ux:\n        cannot: \"You cannot use write-capable tools yet.\"\n        required:\n          - \"an approved Understanding Report for this session\"\n        run:\n          - \"Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan, Prior Art (state what you searched for an existing solution and what you found, with an explicit adopt-or-build judgment)\"\n          - \"Run `harness approve understanding` with the report attached as a quoted heredoc (harness approve understanding <<'UNDERSTANDING_REPORT' ...report... UNDERSTANDING_REPORT) so it is persisted for audit, then approve the prompt; the heredoc is the only extra shell shape the gate allows (no pipes, chaining, or other redirection)\"\n      # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,\n      # v0.18.0+): expire the approval marker on task-completion\n      # boundaries. Team wires agent-tasks, so the MCP task verbs are\n      # the primary boundary; the Bash list catches operators who use\n      # gh-cli in parallel (hybrid workflow). `max_age` is the safety\n      # net. Opt out entirely with\n      # `approval_lifecycle: { mode: session }`.\n      approval_lifecycle:\n        expire_on_tool_match:\n          - mcp__agent-tasks__task_finish\n          - mcp__agent-tasks__task_abandon\n          - mcp__agent-tasks__pull_requests_merge\n          - mcp__agent-tasks__tasks_transition\n        expire_on_bash_match:\n          - '^gh pr (merge|close)\\b'\n          - '^git push origin (master|main)\\b'\n        max_age: 4h\n";

package/dist/cli/init/profiles.js CHANGED Viewed

@@ -72,13 +72,20 @@ policy_packs:
       # deny envelope with the plain-language { cannot, required, run }
       # shape. Engine details still land in stderr for operator audit;
       # the agent only sees this.
+      #
+      # KEEP IN SYNC (task 68b9ad9c): this text must match
+      # defaultUx("grill_me") in
+      # src/policy-packs/builtin/understanding-before-execution.ts — that
+      # function is what \`harness pack reseed\` / \`harness doctor\`'s
+      # divergence warning treat as "the shipped template". Pinned by
+      # tests/cli/init-templates-ux-parity.test.ts.
       ux:
         cannot: "You cannot use write-capable tools yet."
         required:
           - "an approved Understanding Report for this session"
         run:
           - "Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan, Prior Art (state what you searched for an existing solution and what you found, with an explicit adopt-or-build judgment)"
-          - "Run \`harness approve understanding\` (bare, no pipes, chaining, or redirection) and approve the prompt"
+          - "Run \`harness approve understanding\` with the report attached as a quoted heredoc (harness approve understanding <<'UNDERSTANDING_REPORT' ...report... UNDERSTANDING_REPORT) so it is persisted for audit, then approve the prompt; the heredoc is the only extra shell shape the gate allows (no pipes, chaining, or other redirection)"
       # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,
       # v0.18.0+): expire the approval marker on task-completion
       # boundaries. Solo wires no agent-tasks MCP, so
@@ -215,13 +222,15 @@ policy_packs:
     config:
       mode: grill_me
       # ux (agent-tasks/60bc93e5): same shape as Solo's pack ux.
+      # KEEP IN SYNC (task 68b9ad9c): see the identical note on Solo's
+      # copy above — must match defaultUx("grill_me").
       ux:
         cannot: "You cannot use write-capable tools yet."
         required:
           - "an approved Understanding Report for this session"
         run:
           - "Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan, Prior Art (state what you searched for an existing solution and what you found, with an explicit adopt-or-build judgment)"
-          - "Run \`harness approve understanding\` (bare, no pipes, chaining, or redirection) and approve the prompt"
+          - "Run \`harness approve understanding\` with the report attached as a quoted heredoc (harness approve understanding <<'UNDERSTANDING_REPORT' ...report... UNDERSTANDING_REPORT) so it is persisted for audit, then approve the prompt; the heredoc is the only extra shell shape the gate allows (no pipes, chaining, or other redirection)"
       # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,
       # v0.18.0+): expire the approval marker on task-completion
       # boundaries. Team wires agent-tasks, so the MCP task verbs are

package/dist/cli/init/profiles.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../src/cli/init/profiles.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,uEAAuE;AACvE,yCAAyC;AACzC,EAAE;AACF,sEAAsE;AACtE,kEAAkE;AAClE,kEAAkE;AAClE,kEAAkE;AAClE,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,kEAAkE;AAClE,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AAEzE,MAAM,CAAC,MAAM,aAAa,GAAG~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4E5B~~,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiJ5B~~,CAAC"}
1	+ {"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../src/cli/init/profiles.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,uEAAuE;AACvE,yCAAyC;AACzC,EAAE;AACF,sEAAsE;AACtE,kEAAkE;AAClE,kEAAkE;AAClE,kEAAkE;AAClE,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,kEAAkE;AAClE,gDAAgD;AAChD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AAEzE,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmF5B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmJ5B,CAAC"}

package/dist/cli/init/templates.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
 export declare const MINIMAL_TEMPLATE = "# ~/.harness/harness.yaml (legacy: ~/.claude/harness.yaml)\n#\n# Bootstrapped by `harness init --template minimal`.\n#\n# This is the empty-but-valid manifest. Run `harness validate` to confirm it\n# parses, then add entries under the five top-level keys:\n#\n#   grounding:  evidence-ledger + claim-gate config (see docs/ARCHITECTURE.md \u00A72)\n#   tools:      mcp / cli / skills / builtin inventory   (\u00A73)\n#   memory:     directories, retention, scopes           (\u00A74)\n#   hooks:      event-bound shell commands               (\u00A75)\n#   policies:   named rules that bind hooks to triggers  (\u00A76)\n#\n# Phase 2 verbs to add entries safely: `harness add mcp <name> ...`,\n# `harness add cli`, `harness add hook`, `harness add skill`.\n# Per-machine overrides live at ~/.harness/machines/<discriminator>.harness.overrides.yaml\n# (ARCHITECTURE.md \u00A78) for paths that vary per host.\n#\n# Docs: https://github.com/LanNguyenSi/harness\n\nversion: 1\n";
-export declare const FULL_TEMPLATE = "# ~/.harness/harness.yaml (legacy: ~/.claude/harness.yaml)\n#\n# Bootstrapped by `harness init --template full`. The reference manifest:\n# every example policy from docs/examples/full-manifest.yaml wired through\n# the generic `harness policy intercept` engine, so no external shell\n# scripts under ~/.claude/hooks/ are required.\n#\n# Canonical source for the policy + policy_packs sections is\n# docs/examples/full-manifest.yaml. A parity vitest\n# (tests/cli/init-full-template-parity.test.ts) fails the build if the\n# two diverge on policy names or load-bearing fields.\n#\n# What you still need on PATH (the wizard offers to `npm i -g` these on\n# init): agent-tasks-mcp-bridge, grounding-mcp, memory-router-*,\n# understanding-gate-claude-*.\n\nversion: 1\n\ngrounding:\n  session:\n    auto_start: true\n    id_format: \"gs-{repo}-{rand:8}\"\n  evidence_ledger:\n    path: ~/.evidence-ledger/ledger.db\n    retention_days: 90\n  policies_source: ~/.claude/harness.d/policies/claim-gate.yaml\n\ntools:\n  mcp:\n    # codebase-oracle (the Pandora RAG MCP server) is intentionally NOT\n    # in the Full default. It is published as\n    # `@lannguyensi/codebase-oracle` and works fine standalone, but it\n    # is an opinionated workflow add-on (multi-repo semantic search)\n    # rather than infrastructure harness itself assumes. Operators who\n    # want it wire it explicitly:\n    #   npm i -g @lannguyensi/codebase-oracle\n    #   harness add mcp codebase-oracle --command codebase-oracle,mcp\n    # Set ORACLE_SCAN_ROOT (absolute path; tilde is not expanded by the\n    # MCP env block) and OPENAI_API_KEY (or switch providers via\n    # ORACLE_LLM_PROVIDER) before the first call.\n    - name: agent-tasks\n      # Zero-setup entry: `@agent-tasks/mcp-bridge` exposes the\n      # `agent-tasks-mcp-bridge` binary on PATH. The bridge owns token\n      # storage and defaults to the hosted backend; override with\n      # `AGENT_TASKS_BASE_URL` / `AGENT_TASKS_TOKEN` for self-hosted.\n      # `min_version` floor: 0.6.0 added the `--version` short-circuit\n      # the doctor probe needs (PR agent-tasks/240, release-cut PR 241).\n      # Bump the floor whenever a fix you depend on lands; loose floors\n      # are fine, the point is the drift signal not pinning a specific cut.\n      command: [agent-tasks-mcp-bridge]\n      min_version: \"0.6.0\"\n      health:\n        verb: projects_list\n        timeout_ms: 5000\n      enabled: true\n    - name: grounding-mcp\n      # Published bin from `@lannguyensi/grounding-mcp`. No env is set:\n      # the bundled default resolves to `~/.evidence-ledger/ledger.db`\n      # via os.homedir() at startup. Passing a literal tilde in env\n      # bypasses shell expansion and creates rogue cwd-relative DB files\n      # (see agent-tasks/42d224a6 incident). `min_version` floor: 0.2.0\n      # added the `--version` short-circuit the doctor probe needs (PR\n      # agent-grounding/76, release-cut PR 77).\n      command: [grounding-mcp]\n      min_version: \"0.2.0\"\n      health:\n        verb: ledger_status\n        timeout_ms: 5000\n      enabled: true\n\n  cli:\n    - name: gh\n      binary: gh\n      required: true\n\n  skills:\n    enabled:\n      - simplify\n      - init\n      - review\n      - security-review\n    source_dirs:\n      - ~/.claude/skills\n\n  builtin:\n    known: [Read, Edit, Write, Bash, Agent, Skill, TaskCreate, Glob, Grep]\n\nmemory:\n  directories:\n    - path: ~/.claude/projects/{project}/memory\n      scope: project\n  router:\n    # Published bin from `@lannguyensi/memory-router`.\n    # `min_version` floor: 0.3.0 added the `--version` short-circuit\n    # the doctor probe needs (PR agent-memory/40, release-cut PR 41).\n    command: [memory-router-user-prompt-submit]\n    min_version: \"0.3.0\"\n    enabled: true\n  retention:\n    staleness_days: 180\n    broken_refs: warn\n  scopes:\n    default: project\n    allowed: [project, user]\n\n# All PreToolUse hooks share the generic `harness policy intercept` CLI\n# entrypoint. The engine reads the tool event on stdin, evaluates whichever\n# policy below has a matching trigger (`match` + optional `bash_match`),\n# and emits Claude Code's deny envelope when the required ledger tag is\n# absent. No external shell scripts are required.\n#\n# The `git-preflight` SessionStart hook is the producer side of the\n# `preflight-before-*` policies: `harness session-start preflight` runs\n# agent-preflight against the session cwd and, on a ready:true result,\n# records `preflight:${REPO}` to the evidence ledger. It needs the\n# `preflight` binary on PATH (`npm i -g @lannguyensi/agent-preflight`); when\n# that is absent the hook logs to stderr and exits 0, so the session is\n# never broken \u2014 the preflight gates just stay closed until a tag is\n# produced some other way.\nhooks:\n  - name: git-preflight\n    event: SessionStart\n    command: harness session-start preflight\n    blocking: false\n    # 70s budget gives the wrapped preflight (default 60s) headroom plus\n    # ledger-write time. Was 30s through v0.17.4, but a healthy preflight\n    # on a medium-size repo takes ~28s and the old 25s wrapper ceiling\n    # blew through it. Bumped together with DEFAULT_PREFLIGHT_TIMEOUT_MS\n    # (agent-tasks/7265599e).\n    budget_ms: 70000\n    # Floor at agent-preflight 0.2.0, the release that makes secret\n    # detection git-aware and diff-scoped: a gitignored+untracked .env,\n    # a .md doc, a non-git dir, or a secret in a tracked file the branch\n    # never touched is a non-blocking warn, not a hard fail. Pre-0.2.0\n    # installs hard-fail preflight on the normal correct state (a\n    # gitignored .env holding real credentials), so this SessionStart\n    # producer never writes a preflight: tag and the preflight-before-*\n    # policies stay closed forever on any repo with a local .env. (0.1.1\n    # had already fixed the wrapper-script \"tool not installed\" false\n    # positive.) version_command points at the source-of-truth preflight\n    # binary, not at the `harness session-start preflight` wrapper.\n    min_version: \"0.2.0\"\n    version_command: [\"preflight\", \"--version\"]\n\n  - name: require-review-evidence\n    event: PreToolUse\n    match: \"mcp__agent-tasks__pull_requests_merge\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  # Tool-agnostic parallel of require-review-evidence for operators on the\n  # gh-cli workflow (`gh pr merge`) instead of agent-tasks MCP. Same generic\n  # `harness policy intercept` entrypoint; the matching review-before-merge-bash\n  # policy below picks up the trigger. A PolicyTrigger can only AND-match one\n  # surface (MCP tool-name OR Bash command), so two parallel definitions are\n  # the minimum-scope way to cover both PR surfaces without bumping the schema.\n  - name: require-review-evidence-bash\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr merge\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-dogfood-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*(npm publish\\b|git( -C \\S+)* tag v)'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-preflight-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* (status|log|diff|branch)\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 1000\n\n  - name: require-review-subagent-evidence\n    event: PreToolUse\n    match: \"mcp__agent-tasks__pull_requests_create\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  # Bash-surface parallel of require-review-subagent-evidence for operators\n  # who open PRs with `gh pr create` instead of agent-tasks MCP. The matching\n  # review-subagent-before-pr-create-bash policy below tags by branch\n  # (`review-subagent:${BRANCH}`) because no task UUID is in `gh pr create`\n  # arguments; the working branch is the closest stable handle for \"the\n  # PR-in-progress\" at this point in the cycle.\n  - name: require-review-subagent-evidence-bash\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr create\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-preflight-push-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* push\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 1000\n\n  # risk-gate (Phase 7 #6): the Risk Gate enforcement hook. The\n  # gate-prod-destructive policies below reference it. Same generic\n  # `harness policy intercept` entrypoint as every other policy hook;\n  # the interceptor builds the Action Envelope, classifies risk against\n  # `risk.classifiers[]`, resolves the environment against\n  # `environments.resolvers[]`, and evaluates the policies' `when:`.\n  - name: risk-gate\n    event: PreToolUse\n    match: \"Bash\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\npolicies:\n  - name: review-before-merge\n    description: Block PR merges unless a ledger entry tagged review:<pr-number> exists for this session.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_merge\"\n      extract:\n        PR_NUMBER: \"toolArgs.prNumber\"\n    requires:\n      ledger_tag: \"review:${PR_NUMBER}\"\n    hook: require-review-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: Spawn a review subagent against the PR diff, capture its verdict, then persist a ledger entry tagged with the PR number. The content should be self-contained enough for an auditor to read without re-opening the chat.\n    ux:\n      cannot: \"You cannot merge PR #${PR_NUMBER} yet.\"\n      required:\n        - \"a recorded review of PR #${PR_NUMBER}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\" }'\n\n  # Bash-surface parallel of review-before-merge for operators on the gh-cli\n  # workflow. Two scope notes:\n  #   1. Tag shape: `review:${BRANCH}` instead of `review:${PR_NUMBER}`. The\n  #      `gh pr merge` invocation can target the PR by number, by URL, or by\n  #      the current branch (default), and PR_NUMBER is not extractable from\n  #      `tool_input.command` with today's JSONPath-only extract DSL. BRANCH\n  #      is the stable identifier the producer can record at review time.\n  #   2. This sits ALONGSIDE review-before-merge \u2014 not as a replacement. An\n  #      operator using both surfaces (e.g. agent-tasks MCP for most repos\n  #      + gh-cli for a quick hotfix) will have both gates active, each with\n  #      its own tag shape, which is semantically honest.\n  - name: review-before-merge-bash\n    description: Block `gh pr merge` unless a ledger entry tagged review:<branch> exists for this session.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr merge\\b'\n    requires:\n      ledger_tag: \"review:${BRANCH}\"\n    hook: require-review-evidence-bash\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${BRANCH} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: Spawn a review subagent against the branch diff, capture its verdict, then persist a ledger entry tagged with the branch name. Mirror of the review-before-merge producer for the gh-cli surface.\n    ux:\n      cannot: \"You cannot merge the PR for branch ${BRANCH} via `gh pr merge` yet.\"\n      required:\n        - \"a recorded review of the PR for branch ${BRANCH}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review:${BRANCH} \u2014 <verdict + key findings + nits>\" }'\n\n  - name: dogfood-before-release\n    description: Block npm publish / git tag v* without a recent dogfood ledger entry.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*(npm publish\\b|git( -C \\S+)* tag v)'\n    requires:\n      ledger_tag: \"dogfood:${SESSION_ID}\"\n      within: 24h\n    hook: require-dogfood-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"dogfood:${SESSION_ID} \u2014 <end-to-end smoke summary against the live system>\", source:\"manual smoke test\"}'\n        description: Before tagging or publishing, run the release path end-to-end against the live system (not just unit tests) and persist the result as a session-tagged ledger entry. Document what you exercised (install, CLI happy path, MCP handshake, etc.) so a future auditor can tell whether the smoke covered the change.\n    ux:\n      cannot: \"You cannot publish a release yet.\"\n      required:\n        - \"an end-to-end dogfood run in this session\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"dogfood:${SESSION_ID} \u2014 <end-to-end smoke summary>\" }'\n\n  - name: two-reviewers-required\n    description: At least two distinct reviewer ledger entries must exist for the PR.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_merge\"\n      extract:\n        PR_NUMBER: \"toolArgs.prNumber\"\n    requires:\n      ledger_tag: \"review:${PR_NUMBER}\"\n      count:\n        min: 2\n    hook: require-review-evidence\n    enforcement: warn\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review (reviewer 2)\"}'\n        description: Same shape as review-before-merge but TWO DISTINCT reviewer entries must exist before the gate is satisfied (count.min 2). Distinguish reviewers by source so the count is honest. Warn-level enforcement, so the agent CAN merge with one reviewer but should consider spawning a second for load-bearing changes.\n\n  - name: preflight-before-investigation\n    description: Block investigative git reads (status/log/diff/branch) when agent-preflight has not run recently with ready:true for the current repo.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* (status|log|diff|branch)\\b'\n    requires:\n      ledger_tag: \"preflight:${REPO}\"\n      within: 1h\n    hook: require-preflight-evidence\n    enforcement: block\n    producers:\n      - kind: bash\n        command: harness session-start preflight\n        description: Runs agent-preflight against the current cwd; on ready:true, records preflight:${REPO} to the ledger. Standard producer.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"preflight:${REPO}\", source:\"manual\"}'\n        description: Direct ledger write. Use when the Bash hook is locked down (e.g. understanding-gate active) or when the standard producer is unavailable.\n    ux:\n      cannot: \"You cannot investigate this repository yet.\"\n      required:\n        - \"verified repository preflight\"\n        - \"an approved Understanding Report, if the Understanding Gate is still active (it blocks `harness preflight` itself)\"\n      run:\n        - \"harness preflight\"\n\n  - name: review-subagent-before-pr-create\n    description: Block agent-tasks PR creation unless a review-subagent ledger entry tagged for this task already exists. Forces the rigorous review BEFORE the PR opens, not after.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_create\"\n      extract:\n        TASK_ID: \"toolArgs.taskId\"\n    requires:\n      ledger_tag: \"review-subagent:${TASK_ID}\"\n    hook: require-review-subagent-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review-subagent:${TASK_ID} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: After running a review subagent against the staged diff, persist its verdict + load-bearing findings as a ledger entry tagged with the task UUID. The content should be self-contained enough to audit later without re-reading the chat.\n    ux:\n      cannot: \"You cannot open a pull request for task ${TASK_ID} yet.\"\n      required:\n        - \"a completed review-subagent pass on this task\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review-subagent:${TASK_ID} \u2014 <verdict + key findings + nits>\" }'\n\n  # Bash-surface parallel of review-subagent-before-pr-create. Tag shape is\n  # `review-subagent:${BRANCH}` because TASK_ID is an agent-tasks-only\n  # concept; for the gh-cli workflow the working branch is the closest stable\n  # handle for \"the PR-in-progress\" at this point. Same rationale as\n  # review-before-merge-bash: sits alongside the MCP variant, not as a\n  # replacement.\n  - name: review-subagent-before-pr-create-bash\n    description: Block `gh pr create` unless a review-subagent ledger entry tagged review-subagent:<branch> exists for this session. Forces the rigorous review BEFORE the PR opens.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr create\\b'\n    requires:\n      ledger_tag: \"review-subagent:${BRANCH}\"\n    hook: require-review-subagent-evidence-bash\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review-subagent:${BRANCH} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: After running a review subagent against the staged diff for the working branch, persist its verdict + load-bearing findings as a ledger entry tagged with the branch name. Mirror of the review-subagent-before-pr-create producer for the gh-cli surface.\n    ux:\n      cannot: \"You cannot open a pull request for branch ${BRANCH} via `gh pr create` yet.\"\n      required:\n        - \"a completed review-subagent pass on branch ${BRANCH}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review-subagent:${BRANCH} \u2014 <verdict + key findings + nits>\" }'\n\n  - name: preflight-before-push\n    description: Block git push unless a fresh preflight ledger entry exists for the current branch. Catches the stale-checkout class of incident at the last reversible step.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* push\\b'\n    requires:\n      ledger_tag: \"preflight:${BRANCH}\"\n      within: 10m\n      # at_head:true lets a preflight at the current HEAD satisfy the\n      # gate at any age (the standard producer writes head:<sha> into\n      # the tag content). The 10m window remains the freshness ceiling\n      # for the head-mismatch case (operator switched branch, preflight\n      # predates HEAD shift, runtime couldn't resolve a sha).\n      at_head: true\n    hook: require-preflight-push-evidence\n    enforcement: block\n    producers:\n      - kind: bash\n        command: harness session-start preflight\n        description: Runs agent-preflight against the current cwd; on ready:true, records preflight:${BRANCH} ready:true confidence:<n> head:<sha> to the ledger. Standard producer.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"preflight:${BRANCH} head:<full-sha> \u2014 <summary of what is on the branch + smoke results>\", source:\"manual\"}'\n        description: Direct ledger write. Include head:<full-sha> if you want the entry to count under at_head; the branch is the WIP review surface and the content should summarise what is staged + the smoke evidence so a reviewer can audit later without re-reading the chat.\n    ux:\n      cannot: \"You cannot push branch ${BRANCH} yet.\"\n      required:\n        - \"a preflight for ${BRANCH} at the current HEAD (any age) OR any preflight within the last 10 minutes. Re-run `harness preflight` if you committed since the last preflight AND it has been more than 10 minutes.\"\n        - \"if solution-acceptance is enabled, a ready HEAD-pinned verdict at the SAME commit too (run `solution_evaluate`). `git push` trips both gates, so commit first if the tree is dirty, then satisfy both at one HEAD.\"\n        - \"an approved Understanding Report, if the Understanding Gate is still active (it blocks `harness preflight` itself)\"\n      run:\n        - \"harness preflight\"\n\n  # Phase 7 Risk Gate \u2014 the canonical built-in worked example. These two\n  # policies, with the dangerous-shell classifier and production-signals\n  # resolver below, are the Risk Gate's default stance: a destructive\n  # shell action whose target environment resolves to production is\n  # gated before the runtime fires it. Both fire ONLY when the\n  # environment resolves to production (a main / release branch, a\n  # prod-looking DATABASE_URL, or a prod kube context); on an ordinary\n  # feature branch the environment is unknown and neither fires. Ordered\n  # deny-first so a critical action (which also matches the high\n  # threshold) gets the hard-deny envelope. See docs/risk-gate.md.\n  - name: gate-prod-destructive\n    description: Deny critical-severity destructive shell actions against a production target.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n    when:\n      risk.severity_at_least: critical\n      environment.name: production\n    requires:\n      ledger_tag: \"risk-override:${SESSION_ID}\"\n    hook: risk-gate\n    enforcement: block\n    # Operator-in-the-loop gate: the override tag is written by the\n    # operator verb (ask semantics), not by the agent. See\n    # writing-custom-policies.md, tripwire 4 (the trust model).\n    producers:\n      - kind: ask\n        command: harness approve risk --force <reason>\n        description: Deliberate operator override for a critical production mutation; run from the operator shell.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"risk-override:${SESSION_ID} \u2014 operator-authorized <reason>\", source:\"operator\"}'\n        description: Recovery path if the approve verb is unavailable; only meaningful when the OPERATOR authorizes the content.\n    ux:\n      cannot: \"You cannot run this critical destructive action against production.\"\n      required:\n        - \"a deliberate operator override: a critical production mutation has no benign reading\"\n      run:\n        - \"Choose a non-destructive alternative, or run the command yourself outside the agent.\"\n        - \"Operator override (deliberate): run `harness approve risk --force <reason>` from your own shell (`! ` prefix in Claude Code, with --i-am-the-operator to acknowledge a non-TTY invocation).\"\n        - \"Session-wide kill switch: run `harness pause --for <duration>` instead (every gate silences until the sentinel expires or `harness resume` runs).\"\n  - name: gate-prod-destructive-approval\n    description: Require operator approval for high-severity destructive shell actions against a production target.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n    when:\n      risk.severity_at_least: high\n      environment.name: production\n    requires:\n      ledger_tag: \"risk-approved:${SESSION_ID}\"\n    hook: risk-gate\n    enforcement: require_approval\n    producers:\n      - kind: ask\n        command: harness approve risk\n        description: Operator approves this Risk Gate decision from their own shell.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"risk-approved:${SESSION_ID} \u2014 operator-authorized\", source:\"operator\"}'\n        description: Recovery path if the approve verb is unavailable; only meaningful when the OPERATOR authorizes the content.\n    ux:\n      cannot: \"You cannot run this destructive production action yet.\"\n      required:\n        - \"operator approval of this Risk Gate decision\"\n      run:\n        - \"harness approve risk\"\n\n# Full inherits the Solo/Team understanding-gate stack: the Stop hook\n# persists each Understanding Report and the PreToolUse pre-tool-use\n# blocker refuses Edit/Write/Bash until the report is approved. Drop\n# this block if you want the reference policies above without the\n# baseline gate.\npolicy_packs:\n  - name: understanding-before-execution\n    source: builtin\n    enabled: true\n    description: Force agents to expose their task interpretation and wait for explicit human approval before any write-capable tool fires.\n    config:\n      mode: grill_me\n      # Producers (agent-tasks/25bced52): rendered into the gate's deny\n      # envelope by the same engine as policy producers. Constraint at\n      # this layer: at-least-one `ask`. Post-v0.14.0 the gate signal\n      # is a filesystem marker and the mcp ledger_add path no longer\n      # satisfies the gate; the canonical unblock surface is the\n      # operator-approval prompt.\n      producers:\n        - kind: ask\n          command: harness approve understanding\n          description: \"Bare command, no pipes or chaining. The hook recognises it via isEscapeCommand and emits permissionDecision:ask; the operator's go on that prompt IS the gate approval. Golden path.\"\n        - kind: bash\n          command: harness approve understanding\n          description: Same command from any un-hooked terminal (operator only, not reachable from inside the gated session). Writes the canonical marker at harness.generated/.approvals/${SESSION_ID}.\n      # ux (agent-tasks/e48e3b45): replaces the legacy engine-vocabulary\n      # deny envelope with the plain-language { cannot, required, run }\n      # shape. Engine details (the BLOCK reason naming session id /\n      # marker / report state) still land in stderr for operator audit;\n      # the agent only sees this.\n      ux:\n        cannot: \"You cannot use write-capable tools yet.\"\n        required:\n          - \"an approved Understanding Report for this session\"\n        run:\n          - \"Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan, Prior Art (state what you searched for an existing solution and what you found, with an explicit adopt-or-build judgment)\"\n          - \"Run `harness approve understanding` (bare, no pipes, chaining, or redirection) and approve the prompt\"\n      # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,\n      # v0.18.0+): expire the approval marker on task-completion\n      # boundaries so a multi-task session re-prompts for an\n      # Understanding Report between tasks. Without this the legacy\n      # \"one approval per session\" contract lets a stale interpretation\n      # drive the next task's edits.\n      #\n      # Full ships both boundary kinds: the agent-tasks MCP verbs for\n      # operators on that workflow, plus a Bash regex list for hybrid\n      # operators who also use gh-cli for PR mechanics. `max_age` is\n      # the safety net. Operators who prefer the legacy per-session\n      # behaviour opt out with `approval_lifecycle: { mode: session }`.\n      # Operators on other task systems override the matchers.\n      approval_lifecycle:\n        expire_on_tool_match:\n          - mcp__agent-tasks__task_finish\n          - mcp__agent-tasks__task_abandon\n          - mcp__agent-tasks__pull_requests_merge\n          - mcp__agent-tasks__tasks_transition\n        expire_on_bash_match:\n          - '^gh pr (merge|close)\\b'\n          - '^git push origin (master|main)\\b'\n        max_age: 4h\n\n  # branch-protection (agent-tasks/2fdc5bbe, default-enabled since v0.17.2):\n  # blocks Write/Edit (claude-code) or apply_patch (codex) on protected\n  # branches (default: master, main, develop). Complements\n  # preflight-before-push, which fires at the LAST reversible step;\n  # branch-protection fires at the FIRST source mutation, catching the\n  # \"forgot to branch off master\" pattern earlier in the cycle.\n  #\n  # Two satisfying signals: a fresh `branch:non-protected:<branch>` tag\n  # from the SessionStart producer (`harness session-start branch-check`),\n  # or the operator-only override marker written by\n  # `harness approve branch-protection --session <id>` for deliberate\n  # protected-branch edits (version bumps, CI workflow patches, hotfixes).\n  # A branch-protection-ack ledger tag is no longer a sufficient override\n  # on its own (it is agent-writable); the marker file is the trusted signal.\n  #\n  # Fails closed (any load / parse / ledger error refuses). Disable by\n  # setting `enabled: false` or removing this entry if your workflow\n  # routinely edits master directly. Override the protected list via\n  # `config.protected_branches`. Full reference:\n  # docs/policy-packs/branch-protection.md.\n  - name: branch-protection\n    source: builtin\n    enabled: true\n    description: Block Write/Edit on protected branches (master, main, develop) at the first source mutation.\n    config:\n      # ux (agent-tasks/9806d4f8): replaces the legacy\n      # \"branch-protection: refusing ...\" envelope with the\n      # plain-language { cannot, required, run } shape. Engine details\n      # (the BLOCK reason naming session id / freshness window) stay\n      # on stderr for operator audit.\n      ux:\n        cannot: \"You cannot edit files on protected branch ${BRANCH} yet.\"\n        required:\n          - \"a checkout of a non-protected branch (current `${BRANCH}` is protected)\"\n        run:\n          - \"git checkout -b feat/<your-task>\"\n          - \"harness session-start branch-check\"\n\n  # solution-acceptance (harness cc43c7a4): Verifier-gated Done. Gates the\n  # task-finishing tools (agent-tasks completion verbs + git push / gh pr\n  # merge) on a ready, HEAD-pinned verdict that the grounding-mcp producer\n  # (solution_evaluate) derives from a real preflight run, plus an\n  # anti-forgery write-guard on the verdict marker. DISABLED by default: it\n  # is a hard completion-gate and needs grounding-mcp (>= 0.3.2) under\n  # tools.mcp plus the preflight binary on PATH. Flip enabled: true once the\n  # producer is wired and you want completion earned, not claimed. The pack\n  # emits its own instructions.md on apply; harness validate warns if you\n  # enable it without the producer.\n  - name: solution-acceptance\n    source: builtin\n    enabled: false\n    description: Gate task completion on a ready, HEAD-pinned solution-acceptance verdict earned from a real preflight run.\n\n# Phase 7 Risk Gate vocabulary. The dangerous-shell classifier and\n# production-signals resolver feed the gate-prod-destructive policies\n# above: `harness policy intercept` builds the Action Envelope,\n# classifies the action against `risk.classifiers[]`, resolves the\n# target environment against `environments.resolvers[]`, and evaluates\n# each policy's `when:` clauses against the result. Full design and the\n# decision model: docs/risk-gate.md.\nrisk:\n  classifiers:\n    - name: dangerous-shell\n      tool: Bash\n      patterns:\n        - pattern: 'rm\\s+-rf\\s+(/|/var|/data|/mnt|~)'\n          categories: [destructive, data_loss]\n          severity: critical\n        - pattern: 'DROP\\s+TABLE|TRUNCATE\\s+TABLE|DELETE\\s+FROM'\n          categories: [destructive, data_loss]\n          severity: high\n        - pattern: 'kubectl\\s+delete\\s+(namespace|deployment|statefulset|pvc)'\n          categories: [destructive, infrastructure_change]\n          severity: high\n        - pattern: 'terraform\\s+destroy'\n          categories: [destructive, infrastructure_change]\n          severity: critical\n\nenvironments:\n  resolvers:\n    - name: production-signals\n      environment: production\n      signals:\n        branch_patterns: [main, \"release/*\"]\n        env_var_patterns:\n          - var: DATABASE_URL\n            patterns: [prod, production]\n        kube_context_patterns: [\".*prod.*\"]\n        kube_namespace_patterns: [prod, production]\n";
+export declare const FULL_TEMPLATE = "# ~/.harness/harness.yaml (legacy: ~/.claude/harness.yaml)\n#\n# Bootstrapped by `harness init --template full`. The reference manifest:\n# every example policy from docs/examples/full-manifest.yaml wired through\n# the generic `harness policy intercept` engine, so no external shell\n# scripts under ~/.claude/hooks/ are required.\n#\n# Canonical source for the policy + policy_packs sections is\n# docs/examples/full-manifest.yaml. A parity vitest\n# (tests/cli/init-full-template-parity.test.ts) fails the build if the\n# two diverge on policy names or load-bearing fields.\n#\n# What you still need on PATH (the wizard offers to `npm i -g` these on\n# init): agent-tasks-mcp-bridge, grounding-mcp, memory-router-*,\n# understanding-gate-claude-*.\n\nversion: 1\n\ngrounding:\n  session:\n    auto_start: true\n    id_format: \"gs-{repo}-{rand:8}\"\n  evidence_ledger:\n    path: ~/.evidence-ledger/ledger.db\n    retention_days: 90\n  policies_source: ~/.claude/harness.d/policies/claim-gate.yaml\n\ntools:\n  mcp:\n    # codebase-oracle (the Pandora RAG MCP server) is intentionally NOT\n    # in the Full default. It is published as\n    # `@lannguyensi/codebase-oracle` and works fine standalone, but it\n    # is an opinionated workflow add-on (multi-repo semantic search)\n    # rather than infrastructure harness itself assumes. Operators who\n    # want it wire it explicitly:\n    #   npm i -g @lannguyensi/codebase-oracle\n    #   harness add mcp codebase-oracle --command codebase-oracle,mcp\n    # Set ORACLE_SCAN_ROOT (absolute path; tilde is not expanded by the\n    # MCP env block) and OPENAI_API_KEY (or switch providers via\n    # ORACLE_LLM_PROVIDER) before the first call.\n    - name: agent-tasks\n      # Zero-setup entry: `@agent-tasks/mcp-bridge` exposes the\n      # `agent-tasks-mcp-bridge` binary on PATH. The bridge owns token\n      # storage and defaults to the hosted backend; override with\n      # `AGENT_TASKS_BASE_URL` / `AGENT_TASKS_TOKEN` for self-hosted.\n      # `min_version` floor: 0.6.0 added the `--version` short-circuit\n      # the doctor probe needs (PR agent-tasks/240, release-cut PR 241).\n      # Bump the floor whenever a fix you depend on lands; loose floors\n      # are fine, the point is the drift signal not pinning a specific cut.\n      command: [agent-tasks-mcp-bridge]\n      min_version: \"0.6.0\"\n      health:\n        verb: projects_list\n        timeout_ms: 5000\n      enabled: true\n    - name: grounding-mcp\n      # Published bin from `@lannguyensi/grounding-mcp`. No env is set:\n      # the bundled default resolves to `~/.evidence-ledger/ledger.db`\n      # via os.homedir() at startup. Passing a literal tilde in env\n      # bypasses shell expansion and creates rogue cwd-relative DB files\n      # (see agent-tasks/42d224a6 incident). `min_version` floor: 0.2.0\n      # added the `--version` short-circuit the doctor probe needs (PR\n      # agent-grounding/76, release-cut PR 77).\n      command: [grounding-mcp]\n      min_version: \"0.2.0\"\n      health:\n        verb: ledger_status\n        timeout_ms: 5000\n      enabled: true\n\n  cli:\n    - name: gh\n      binary: gh\n      required: true\n\n  skills:\n    enabled:\n      - simplify\n      - init\n      - review\n      - security-review\n    source_dirs:\n      - ~/.claude/skills\n\n  builtin:\n    known: [Read, Edit, Write, Bash, Agent, Skill, TaskCreate, Glob, Grep]\n\nmemory:\n  directories:\n    - path: ~/.claude/projects/{project}/memory\n      scope: project\n  router:\n    # Published bin from `@lannguyensi/memory-router`.\n    # `min_version` floor: 0.3.0 added the `--version` short-circuit\n    # the doctor probe needs (PR agent-memory/40, release-cut PR 41).\n    command: [memory-router-user-prompt-submit]\n    min_version: \"0.3.0\"\n    enabled: true\n  retention:\n    staleness_days: 180\n    broken_refs: warn\n  scopes:\n    default: project\n    allowed: [project, user]\n\n# All PreToolUse hooks share the generic `harness policy intercept` CLI\n# entrypoint. The engine reads the tool event on stdin, evaluates whichever\n# policy below has a matching trigger (`match` + optional `bash_match`),\n# and emits Claude Code's deny envelope when the required ledger tag is\n# absent. No external shell scripts are required.\n#\n# The `git-preflight` SessionStart hook is the producer side of the\n# `preflight-before-*` policies: `harness session-start preflight` runs\n# agent-preflight against the session cwd and, on a ready:true result,\n# records `preflight:${REPO}` to the evidence ledger. It needs the\n# `preflight` binary on PATH (`npm i -g @lannguyensi/agent-preflight`); when\n# that is absent the hook logs to stderr and exits 0, so the session is\n# never broken \u2014 the preflight gates just stay closed until a tag is\n# produced some other way.\nhooks:\n  - name: git-preflight\n    event: SessionStart\n    command: harness session-start preflight\n    blocking: false\n    # 70s budget gives the wrapped preflight (default 60s) headroom plus\n    # ledger-write time. Was 30s through v0.17.4, but a healthy preflight\n    # on a medium-size repo takes ~28s and the old 25s wrapper ceiling\n    # blew through it. Bumped together with DEFAULT_PREFLIGHT_TIMEOUT_MS\n    # (agent-tasks/7265599e).\n    budget_ms: 70000\n    # Floor at agent-preflight 0.2.0, the release that makes secret\n    # detection git-aware and diff-scoped: a gitignored+untracked .env,\n    # a .md doc, a non-git dir, or a secret in a tracked file the branch\n    # never touched is a non-blocking warn, not a hard fail. Pre-0.2.0\n    # installs hard-fail preflight on the normal correct state (a\n    # gitignored .env holding real credentials), so this SessionStart\n    # producer never writes a preflight: tag and the preflight-before-*\n    # policies stay closed forever on any repo with a local .env. (0.1.1\n    # had already fixed the wrapper-script \"tool not installed\" false\n    # positive.) version_command points at the source-of-truth preflight\n    # binary, not at the `harness session-start preflight` wrapper.\n    min_version: \"0.2.0\"\n    version_command: [\"preflight\", \"--version\"]\n\n  - name: require-review-evidence\n    event: PreToolUse\n    match: \"mcp__agent-tasks__pull_requests_merge\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  # Tool-agnostic parallel of require-review-evidence for operators on the\n  # gh-cli workflow (`gh pr merge`) instead of agent-tasks MCP. Same generic\n  # `harness policy intercept` entrypoint; the matching review-before-merge-bash\n  # policy below picks up the trigger. A PolicyTrigger can only AND-match one\n  # surface (MCP tool-name OR Bash command), so two parallel definitions are\n  # the minimum-scope way to cover both PR surfaces without bumping the schema.\n  - name: require-review-evidence-bash\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr merge\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-dogfood-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*(npm publish\\b|git( -C \\S+)* tag v)'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-preflight-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* (status|log|diff|branch)\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 1000\n\n  - name: require-review-subagent-evidence\n    event: PreToolUse\n    match: \"mcp__agent-tasks__pull_requests_create\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  # Bash-surface parallel of require-review-subagent-evidence for operators\n  # who open PRs with `gh pr create` instead of agent-tasks MCP. The matching\n  # review-subagent-before-pr-create-bash policy below tags by branch\n  # (`review-subagent:${BRANCH}`) because no task UUID is in `gh pr create`\n  # arguments; the working branch is the closest stable handle for \"the\n  # PR-in-progress\" at this point in the cycle.\n  - name: require-review-subagent-evidence-bash\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr create\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  - name: require-preflight-push-evidence\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* push\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 1000\n\n  # deny-kill-switch-bash / deny-session-env-strip-bash / deny-sentinel-write-bash\n  # (task cf1fde6d): `harness pause` / `harness resume` refuse to run inside an\n  # agent shell in CODE, but that CLI check is a speed bump, not a boundary: a\n  # Claude Code `! `-prefixed shell inherits this session's env AND its non-TTY\n  # stdin, so it is indistinguishable from an agent Bash call and trips the same\n  # check the agent would trip (verified live; see\n  # docs/okf/pause-vs-gate-kill-switch.md). The actual enforcement point that\n  # runs BEFORE the agent's Bash executes is this PreToolUse deny-policy layer.\n  # These three hooks/policies below deny, from Bash: the kill-switch verbs\n  # themselves, the env-stripping wrappers that would otherwise defeat\n  # `refuseIfAgentShell`, and direct writes to the unsigned pause sentinel file.\n  - name: deny-kill-switch-bash\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S*\\s+)*(?:npx\\s+|\\S*/)?harness\\s+([\"\\x27]?)(?:pause|resume|gate\\s+([\"\\x27]?)(?:disable|enable)\\4)\\3(?![\\w-])'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 1000\n\n  - name: deny-session-env-strip-bash\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S*\\s+)*(env\\b[^;\\n|&]*-u\\s*(CLAUDE_CODE_SESSION_ID|CLAUDE_SESSION_ID|CODEX_SESSION_ID)\\b|env\\b[^;\\n|&]*--unset(?:=|\\s+)(CLAUDE_CODE_SESSION_ID|CLAUDE_SESSION_ID|CODEX_SESSION_ID)\\b|unset\\s+(\\S+\\s+)*(CLAUDE_CODE_SESSION_ID|CLAUDE_SESSION_ID|CODEX_SESSION_ID)\\b|(CLAUDE_CODE_SESSION_ID|CLAUDE_SESSION_ID|CODEX_SESSION_ID)=(?=\\s))'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 1000\n\n  # Known gap, deliberately not faked as coverage: this only catches the\n  # obvious shell shapes (`> .harness-paused`, `tee .harness-paused`,\n  # `cp ... .harness-paused`). A regex over the raw command string cannot\n  # see through a heredoc, `sh -c '...'`, `bash -lc`, `eval`,\n  # `python -c`, base64-decoded payloads, an fs.write call inside a script\n  # file the agent creates and then executes, a symlink swap, or the\n  # sentinel-write equivalents of `cp`/`>` done via `mv`, `ln`,\n  # `install`, or `dd`. These are NOT covered on purpose (regex whack-a-\n  # mole against every file-write-capable tool does not meaningfully close\n  # this class); closing it for real needs either signing the sentinel\n  # (HMAC) or a filesystem-level write guard, neither of which is in scope\n  # here; both are noted as follow-ups.\n  - name: deny-sentinel-write-bash\n    event: PreToolUse\n    match: \"Bash\"\n    bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S*\\s+)*(tee|cp)\\b[^;\\n|&]*\\.harness-paused\\b|>{1,2}\\s*\\S*\\.harness-paused\\b'\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 1000\n\n  # risk-gate (Phase 7 #6): the Risk Gate enforcement hook. The\n  # gate-prod-destructive policies below reference it. Same generic\n  # `harness policy intercept` entrypoint as every other policy hook;\n  # the interceptor builds the Action Envelope, classifies risk against\n  # `risk.classifiers[]`, resolves the environment against\n  # `environments.resolvers[]`, and evaluates the policies' `when:`.\n  - name: risk-gate\n    event: PreToolUse\n    match: \"Bash\"\n    command: harness policy intercept\n    blocking: hard\n    budget_ms: 2000\n\n  # Optional: runtime-reality drift gate (NOT enabled by default).\n  # Blocks destructive runtime commands (compose down/restart, systemctl,\n  # kill/pkill, ./deploy-*) when the live process state has drifted from what\n  # your expectations file says should be running. Left COMMENTED on purpose:\n  # the hook is host-coupled and, without RUNTIME_REALITY_KEYWORD + an\n  # expectations file + RUNTIME_REALITY_PROBE_CMD, degrades silently to allow,\n  # a no-op that looks like protection. To arm it, uncomment the entry and\n  # fill in the three env values. The expectations-file format and how to\n  # install the probe are documented in docs/runtime-reality-hook.md.\n  #\n  # - name: runtime-reality\n  #   event: PreToolUse\n  #   command: >-\n  #     RUNTIME_REALITY_KEYWORD=<your-stack>\n  #     RUNTIME_REALITY_EXPECTATIONS_DIR=$HOME/.runtime-reality/expectations\n  #     RUNTIME_REALITY_PROBE_CMD=\"node $HOME/.runtime-reality/probes/runtime-reality-docker-probe.mjs\"\n  #     harness pack hook runtime-reality\n  #   blocking: hard\n  #   description: Block destructive runtime commands on critical process drift\n\npolicies:\n  - name: review-before-merge\n    description: Block PR merges unless a ledger entry tagged review:<pr-number> exists for this session.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_merge\"\n      extract:\n        PR_NUMBER: \"toolArgs.prNumber\"\n    requires:\n      ledger_tag: \"review:${PR_NUMBER}\"\n    hook: require-review-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: Spawn a review subagent against the PR diff, capture its verdict, then persist a ledger entry tagged with the PR number. The content should be self-contained enough for an auditor to read without re-opening the chat.\n    ux:\n      cannot: \"You cannot merge PR #${PR_NUMBER} yet.\"\n      required:\n        - \"a recorded review of PR #${PR_NUMBER}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\" }'\n\n  # Bash-surface parallel of review-before-merge for operators on the gh-cli\n  # workflow. Two scope notes:\n  #   1. Tag shape: `review:${BRANCH}` instead of `review:${PR_NUMBER}`. The\n  #      `gh pr merge` invocation can target the PR by number, by URL, or by\n  #      the current branch (default), and PR_NUMBER is not extractable from\n  #      `tool_input.command` with today's JSONPath-only extract DSL. BRANCH\n  #      is the stable identifier the producer can record at review time.\n  #   2. This sits ALONGSIDE review-before-merge \u2014 not as a replacement. An\n  #      operator using both surfaces (e.g. agent-tasks MCP for most repos\n  #      + gh-cli for a quick hotfix) will have both gates active, each with\n  #      its own tag shape, which is semantically honest.\n  - name: review-before-merge-bash\n    description: Block `gh pr merge` unless a ledger entry tagged review:<branch> exists for this session.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr merge\\b'\n    requires:\n      ledger_tag: \"review:${BRANCH}\"\n    hook: require-review-evidence-bash\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${BRANCH} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: Spawn a review subagent against the branch diff, capture its verdict, then persist a ledger entry tagged with the branch name. Mirror of the review-before-merge producer for the gh-cli surface.\n    ux:\n      cannot: \"You cannot merge the PR for branch ${BRANCH} via `gh pr merge` yet.\"\n      required:\n        - \"a recorded review of the PR for branch ${BRANCH}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review:${BRANCH} \u2014 <verdict + key findings + nits>\" }'\n\n  - name: dogfood-before-release\n    description: Block npm publish / git tag v* without a recent dogfood ledger entry.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*(npm publish\\b|git( -C \\S+)* tag v)'\n    requires:\n      ledger_tag: \"dogfood:${SESSION_ID}\"\n      within: 24h\n    hook: require-dogfood-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"dogfood:${SESSION_ID} \u2014 <end-to-end smoke summary against the live system>\", source:\"manual smoke test\"}'\n        description: Before tagging or publishing, run the release path end-to-end against the live system (not just unit tests) and persist the result as a session-tagged ledger entry. Document what you exercised (install, CLI happy path, MCP handshake, etc.) so a future auditor can tell whether the smoke covered the change.\n    ux:\n      cannot: \"You cannot publish a release yet.\"\n      required:\n        - \"an end-to-end dogfood run in this session\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"dogfood:${SESSION_ID} \u2014 <end-to-end smoke summary>\" }'\n\n  - name: two-reviewers-required\n    description: At least two distinct reviewer ledger entries must exist for the PR.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_merge\"\n      extract:\n        PR_NUMBER: \"toolArgs.prNumber\"\n    requires:\n      ledger_tag: \"review:${PR_NUMBER}\"\n      count:\n        min: 2\n    hook: require-review-evidence\n    enforcement: warn\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review:${PR_NUMBER} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review (reviewer 2)\"}'\n        description: Same shape as review-before-merge but TWO DISTINCT reviewer entries must exist before the gate is satisfied (count.min 2). Distinguish reviewers by source so the count is honest. Warn-level enforcement, so the agent CAN merge with one reviewer but should consider spawning a second for load-bearing changes.\n\n  - name: preflight-before-investigation\n    description: Block investigative git reads (status/log/diff/branch) when agent-preflight has not run recently with ready:true for the current repo.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* (status|log|diff|branch)\\b'\n    requires:\n      ledger_tag: \"preflight:${REPO}\"\n      within: 1h\n    hook: require-preflight-evidence\n    enforcement: block\n    producers:\n      - kind: bash\n        command: harness session-start preflight\n        description: Runs agent-preflight against the current cwd; on ready:true, records preflight:${REPO} to the ledger. Standard producer.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"preflight:${REPO}\", source:\"manual\"}'\n        description: Direct ledger write. Use when the Bash hook is locked down (e.g. understanding-gate active) or when the standard producer is unavailable.\n    ux:\n      cannot: \"You cannot investigate this repository yet.\"\n      required:\n        - \"verified repository preflight\"\n        - \"an approved Understanding Report, if the Understanding Gate is still active (it blocks `harness preflight` itself)\"\n      run:\n        - \"harness preflight\"\n\n  - name: review-subagent-before-pr-create\n    description: Block agent-tasks PR creation unless a review-subagent ledger entry tagged for this task already exists. Forces the rigorous review BEFORE the PR opens, not after.\n    trigger:\n      event: PreToolUse\n      match: \"mcp__agent-tasks__pull_requests_create\"\n      extract:\n        TASK_ID: \"toolArgs.taskId\"\n    requires:\n      ledger_tag: \"review-subagent:${TASK_ID}\"\n    hook: require-review-subagent-evidence\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review-subagent:${TASK_ID} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: After running a review subagent against the staged diff, persist its verdict + load-bearing findings as a ledger entry tagged with the task UUID. The content should be self-contained enough to audit later without re-reading the chat.\n    ux:\n      cannot: \"You cannot open a pull request for task ${TASK_ID} yet.\"\n      required:\n        - \"a completed review-subagent pass on this task\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review-subagent:${TASK_ID} \u2014 <verdict + key findings + nits>\" }'\n\n  # Bash-surface parallel of review-subagent-before-pr-create. Tag shape is\n  # `review-subagent:${BRANCH}` because TASK_ID is an agent-tasks-only\n  # concept; for the gh-cli workflow the working branch is the closest stable\n  # handle for \"the PR-in-progress\" at this point. Same rationale as\n  # review-before-merge-bash: sits alongside the MCP variant, not as a\n  # replacement.\n  - name: review-subagent-before-pr-create-bash\n    description: Block `gh pr create` unless a review-subagent ledger entry tagged review-subagent:<branch> exists for this session. Forces the rigorous review BEFORE the PR opens.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*gh pr create\\b'\n    requires:\n      ledger_tag: \"review-subagent:${BRANCH}\"\n    hook: require-review-subagent-evidence-bash\n    enforcement: block\n    producers:\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"review-subagent:${BRANCH} \u2014 <verdict + key findings + nits>\", source:\"Agent(general-purpose) review\"}'\n        description: After running a review subagent against the staged diff for the working branch, persist its verdict + load-bearing findings as a ledger entry tagged with the branch name. Mirror of the review-subagent-before-pr-create producer for the gh-cli surface.\n    ux:\n      cannot: \"You cannot open a pull request for branch ${BRANCH} via `gh pr create` yet.\"\n      required:\n        - \"a completed review-subagent pass on branch ${BRANCH}\"\n      run:\n        - 'mcp__agent-grounding__ledger_add { sessionId: \"${SESSION_ID}\", type: \"fact\", content: \"review-subagent:${BRANCH} \u2014 <verdict + key findings + nits>\" }'\n\n  - name: preflight-before-push\n    description: Block git push unless a fresh preflight ledger entry exists for the current branch. Catches the stale-checkout class of incident at the last reversible step.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S+\\s+)*git( -C \\S+)* push\\b'\n    requires:\n      ledger_tag: \"preflight:${BRANCH}\"\n      within: 10m\n      # at_head:true lets a preflight at the current HEAD satisfy the\n      # gate at any age (the standard producer writes head:<sha> into\n      # the tag content). The 10m window remains the freshness ceiling\n      # for the head-mismatch case (operator switched branch, preflight\n      # predates HEAD shift, runtime couldn't resolve a sha).\n      at_head: true\n    hook: require-preflight-push-evidence\n    enforcement: block\n    producers:\n      - kind: bash\n        command: harness session-start preflight\n        description: Runs agent-preflight against the current cwd; on ready:true, records preflight:${BRANCH} ready:true confidence:<n> head:<sha> to the ledger. Standard producer.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"preflight:${BRANCH} head:<full-sha> \u2014 <summary of what is on the branch + smoke results>\", source:\"manual\"}'\n        description: Direct ledger write. Include head:<full-sha> if you want the entry to count under at_head; the branch is the WIP review surface and the content should summarise what is staged + the smoke evidence so a reviewer can audit later without re-reading the chat.\n    ux:\n      cannot: \"You cannot push branch ${BRANCH} yet.\"\n      required:\n        - \"a preflight for ${BRANCH} at the current HEAD (any age) OR any preflight within the last 10 minutes. Re-run `harness preflight` if you committed since the last preflight AND it has been more than 10 minutes.\"\n        - \"if solution-acceptance is enabled, a ready HEAD-pinned verdict at the SAME commit too (run `solution_evaluate`). `git push` trips both gates, so commit first if the tree is dirty, then satisfy both at one HEAD.\"\n        - \"an approved Understanding Report, if the Understanding Gate is still active (it blocks `harness preflight` itself)\"\n      run:\n        - \"harness preflight\"\n\n  # Phase 7 Risk Gate \u2014 the canonical built-in worked example. These two\n  # policies, with the dangerous-shell classifier and production-signals\n  # resolver below, are the Risk Gate's default stance: a destructive\n  # shell action whose target environment resolves to production is\n  # gated before the runtime fires it. Both fire ONLY when the\n  # environment resolves to production (a main / release branch, a\n  # prod-looking DATABASE_URL, or a prod kube context); on an ordinary\n  # feature branch the environment is unknown and neither fires. Ordered\n  # deny-first so a critical action (which also matches the high\n  # threshold) gets the hard-deny envelope. See docs/risk-gate.md.\n  - name: gate-prod-destructive\n    description: Deny critical-severity destructive shell actions against a production target.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n    when:\n      risk.severity_at_least: critical\n      environment.name: production\n    requires:\n      ledger_tag: \"risk-override:${SESSION_ID}\"\n    hook: risk-gate\n    enforcement: block\n    # Operator-in-the-loop gate: the override tag is written by the\n    # operator verb (ask semantics), not by the agent. See\n    # writing-custom-policies.md, tripwire 4 (the trust model).\n    producers:\n      - kind: ask\n        command: harness approve risk --force <reason>\n        description: Deliberate operator override for a critical production mutation; run from the operator shell.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"risk-override:${SESSION_ID} \u2014 operator-authorized <reason>\", source:\"operator\"}'\n        description: Recovery path if the approve verb is unavailable; only meaningful when the OPERATOR authorizes the content.\n    ux:\n      cannot: \"You cannot run this critical destructive action against production.\"\n      required:\n        - \"a deliberate operator override: a critical production mutation has no benign reading\"\n      run:\n        - \"Choose a non-destructive alternative, or ask the OPERATOR to run the command themselves, outside the agent.\"\n        - \"Operator override (deliberate): the OPERATOR runs `harness approve risk --force <reason>` from their own shell (`! ` prefix in Claude Code, with --i-am-the-operator to acknowledge a non-TTY invocation).\"\n        - \"Session-wide kill switch: the OPERATOR runs `harness pause --for <duration>` instead, from a terminal outside this agent session (every gate silences until the sentinel expires or `harness resume` runs); you cannot run `harness pause`/`harness resume` yourself, that is denied at the Bash-tool level.\"\n  - name: gate-prod-destructive-approval\n    description: Require operator approval for high-severity destructive shell actions against a production target.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n    when:\n      risk.severity_at_least: high\n      environment.name: production\n    requires:\n      ledger_tag: \"risk-approved:${SESSION_ID}\"\n    hook: risk-gate\n    enforcement: require_approval\n    producers:\n      - kind: ask\n        command: harness approve risk\n        description: Operator approves this Risk Gate decision from their own shell.\n      - kind: mcp\n        verb: mcp__agent-grounding__ledger_add\n        example: '{sessionId:\"${SESSION_ID}\", type:\"fact\", content:\"risk-approved:${SESSION_ID} \u2014 operator-authorized\", source:\"operator\"}'\n        description: Recovery path if the approve verb is unavailable; only meaningful when the OPERATOR authorizes the content.\n    ux:\n      cannot: \"You cannot run this destructive production action yet.\"\n      required:\n        - \"operator approval of this Risk Gate decision\"\n      run:\n        - \"harness approve risk\"\n\n  # deny-kill-switch-bypass / deny-session-env-strip / deny-pause-sentinel-forgery\n  # (task cf1fde6d): `harness pause`/`harness resume` refuse to run inside an\n  # agent shell in CODE, but that CLI check (refuseIfAgentShell / refuseIfNonTTY\n  # in src/cli/pause/index.ts) is a speed bump, not a boundary: a Claude Code\n  # `! `-prefixed shell inherits this session's env AND its non-TTY stdin, so\n  # it is indistinguishable from an agent Bash call and trips the same checks\n  # (verified live; docs/okf/pause-vs-gate-kill-switch.md). This PreToolUse\n  # layer is the enforcement point that actually runs BEFORE the agent's Bash\n  # executes.\n  #\n  # UPDATE (task 2cc73f55, closes the gap the HONESTY NOTE below used to\n  # document): these three now declare `operator_only: true` instead of a\n  # requires.ledger_tag. Every requires:-based policy in this engine is, by\n  # construction, satisfiable by the SAME agent it gates: nothing stops it\n  # from calling mcp__agent-grounding__ledger_add with content matching the\n  # tag for its own session before running the denied command, which used to\n  # flip deny to allow (src/runtime/intercept.ts, the satisfied-requires\n  # branch). `operator_only: true` closes that specific hole: the policy\n  # declares NO requires: at all, and intercept() short-circuits to an\n  # unconditional deny before the requires pipeline runs \u2014 no ledger query,\n  # no template substitution, so no ledger write, marker file, or flag can\n  # ever flip it to allow. See docs/writing-custom-policies.md tripwire 4 and\n  # the \"Operator-only unconditional deny\" section for the schema contract,\n  # and tests/cli/init-full-template-kill-switch-deny.test.ts for a test that\n  # forges every ledger-evidence shape available to intercept() and asserts\n  # the block holds.\n  #\n  # RESIDUAL GAP (still open, out of scope for task 2cc73f55): bash_match is\n  # still a regex over the raw command string, matched BEFORE evaluation ever\n  # reaches operator_only:, so it still cannot see through a heredoc,\n  # `sh -c '...'`, `eval`, a base64-decoded payload, or a script file the\n  # agent writes and then executes \u2014 an agent that defeats the TRIGGER match\n  # never reaches this deny at all. That is a bash_match coverage gap, not a\n  # requires-satisfaction gap, and is unrelated to the fix here (see PR #341\n  # for the known uncoverable shapes). `harness validate` no longer warns\n  # \"declares no producers\" on these three (checkPolicySelfAttestation now\n  # recognises operator_only: true as correct-by-construction).\n  - name: deny-kill-switch-bypass\n    description: Deny harness pause, harness resume, harness gate disable, and harness gate enable from the agent's Bash tool. These are operator-only kill switches.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S*\\s+)*(?:npx\\s+|\\S*/)?harness\\s+([\"\\x27]?)(?:pause|resume|gate\\s+([\"\\x27]?)(?:disable|enable)\\4)\\3(?![\\w-])'\n    operator_only: true\n    hook: deny-kill-switch-bash\n    enforcement: block\n    ux:\n      cannot: \"You cannot run `harness pause`, `harness resume`, `harness gate disable`, or `harness gate enable`.\"\n      required:\n        - \"the OPERATOR to run this from a terminal genuinely outside your agent session, not a `! `-prefixed Claude Code shell, which inherits this session's env and stdin and does not count\"\n      run:\n        - \"Stop. Explain to the operator what you were trying to do and why, and let THEM decide whether to pause/resume/toggle a gate from their own terminal. This is the only way to unblock this gate: it is an unconditional deny (operator_only: true) that no in-session evidence \u2014 a ledger write, a marker file, a flag \u2014 can ever satisfy; the only remaining gap is bash_match's regex coverage of exotic shell shapes, not this evaluation (see docs/okf/pause-vs-gate-kill-switch.md).\"\n\n  - name: deny-session-env-strip\n    description: Deny Bash attempts to strip or unset the agent-session env vars that harness pause/resume check ($CLAUDE_CODE_SESSION_ID, $CLAUDE_SESSION_ID, $CODEX_SESSION_ID). Closes the one-liner that otherwise defeats refuseIfAgentShell.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S*\\s+)*(env\\b[^;\\n|&]*-u\\s*(CLAUDE_CODE_SESSION_ID|CLAUDE_SESSION_ID|CODEX_SESSION_ID)\\b|env\\b[^;\\n|&]*--unset(?:=|\\s+)(CLAUDE_CODE_SESSION_ID|CLAUDE_SESSION_ID|CODEX_SESSION_ID)\\b|unset\\s+(\\S+\\s+)*(CLAUDE_CODE_SESSION_ID|CLAUDE_SESSION_ID|CODEX_SESSION_ID)\\b|(CLAUDE_CODE_SESSION_ID|CLAUDE_SESSION_ID|CODEX_SESSION_ID)=(?=\\s))'\n    operator_only: true\n    hook: deny-session-env-strip-bash\n    enforcement: block\n    ux:\n      cannot: \"You cannot strip or unset your own agent-session id env vars from Bash.\"\n      required:\n        - \"no legitimate reason from inside this session: stripping $CLAUDE_CODE_SESSION_ID / $CLAUDE_SESSION_ID / $CODEX_SESSION_ID is recognised as an attempt to defeat the harness pause/resume agent-shell check\"\n      run:\n        - \"Stop. If you believe you have a legitimate reason to run a command without one of these env vars set, ask the OPERATOR to do it from their own terminal instead. This gate is an unconditional deny (operator_only: true); see docs/okf/pause-vs-gate-kill-switch.md for the honest trust model and the residual bash_match coverage gap.\"\n\n  - name: deny-pause-sentinel-forgery\n    description: Deny Bash writes (redirect, tee, cp) to the harness pause sentinel file (.harness-paused). The sentinel is unsigned JSON; a forged file silences every gate exactly like a real operator pause. Reads (cat, stat) are unaffected.\n    trigger:\n      event: PreToolUse\n      match: \"Bash\"\n      bash_match: '(^|\\n|;|\\||&&|\\()\\s*(\\w+=\\S*\\s+)*(tee|cp)\\b[^;\\n|&]*\\.harness-paused\\b|>{1,2}\\s*\\S*\\.harness-paused\\b'\n    operator_only: true\n    hook: deny-sentinel-write-bash\n    enforcement: block\n    ux:\n      cannot: \"You cannot write to the harness pause sentinel file (.harness-paused).\"\n      required:\n        - \"the OPERATOR to run `harness pause`/`harness resume` themselves, from a terminal outside your agent session, never a direct write to the sentinel file\"\n      run:\n        - \"Stop. Do not write, redirect, tee, or copy anything to .harness-paused. Ask the OPERATOR to run harness pause / harness resume themselves if the session genuinely needs gates silenced. This gate is an unconditional deny (operator_only: true); see docs/okf/pause-vs-gate-kill-switch.md for the honest trust model and the residual bash_match coverage gap.\"\n\n# Full inherits the Solo/Team understanding-gate stack: the Stop hook\n# persists each Understanding Report and the PreToolUse pre-tool-use\n# blocker refuses Edit/Write/Bash until the report is approved. Drop\n# this block if you want the reference policies above without the\n# baseline gate.\npolicy_packs:\n  - name: understanding-before-execution\n    source: builtin\n    enabled: true\n    description: Force agents to expose their task interpretation and wait for explicit human approval before any write-capable tool fires.\n    config:\n      mode: grill_me\n      # Producers (agent-tasks/25bced52): rendered into the gate's deny\n      # envelope by the same engine as policy producers. Constraint at\n      # this layer: at-least-one `ask`. Post-v0.14.0 the gate signal\n      # is a filesystem marker and the mcp ledger_add path no longer\n      # satisfies the gate; the canonical unblock surface is the\n      # operator-approval prompt.\n      #\n      # KEEP IN SYNC (task 68b9ad9c): this text must match\n      # defaultProducers() in\n      # src/policy-packs/builtin/understanding-before-execution.ts \u2014\n      # that function is what `harness pack reseed` and `harness doctor`'s\n      # divergence warning treat as \"the shipped template\". A wording fix\n      # landed here without updating defaultProducers() would make reseed\n      # silently pull operators BACK to the stale wording. Pinned by\n      # tests/cli/init-templates-ux-parity.test.ts.\n      producers:\n        - kind: ask\n          command: harness approve understanding\n          description: \"Bare command, no pipes or chaining. The hook recognises it via isEscapeCommand and emits permissionDecision:ask; the operator's go on that prompt IS the gate approval. Golden path.\"\n        - kind: bash\n          command: harness approve understanding\n          description: Same command from any un-hooked terminal (operator only, not reachable from inside the gated session). Writes the canonical marker at harness.generated/.approvals/${SESSION_ID}.\n      # ux (agent-tasks/e48e3b45): replaces the legacy engine-vocabulary\n      # deny envelope with the plain-language { cannot, required, run }\n      # shape. Engine details (the BLOCK reason naming session id /\n      # marker / report state) still land in stderr for operator audit;\n      # the agent only sees this.\n      #\n      # KEEP IN SYNC (task 68b9ad9c): see the producers: comment above \u2014\n      # same rationale applies here, against defaultUx(\"grill_me\") in the\n      # same builtin module.\n      ux:\n        cannot: \"You cannot use write-capable tools yet.\"\n        required:\n          - \"an approved Understanding Report for this session\"\n        run:\n          - \"Write an Understanding Report covering: Current Understanding, Intended Outcome, Derived Todos, Acceptance Criteria, Assumptions, Open Questions, Out Of Scope, Risks, Verification Plan, Prior Art (state what you searched for an existing solution and what you found, with an explicit adopt-or-build judgment)\"\n          - \"Run `harness approve understanding` with the report attached as a quoted heredoc (harness approve understanding <<'UNDERSTANDING_REPORT' ...report... UNDERSTANDING_REPORT) so it is persisted for audit, then approve the prompt; the heredoc is the only extra shell shape the gate allows (no pipes, chaining, or other redirection)\"\n      # approval_lifecycle (agent-tasks/d8ee60ca + harness/f54e0ecb,\n      # v0.18.0+): expire the approval marker on task-completion\n      # boundaries so a multi-task session re-prompts for an\n      # Understanding Report between tasks. Without this the legacy\n      # \"one approval per session\" contract lets a stale interpretation\n      # drive the next task's edits.\n      #\n      # Full ships both boundary kinds: the agent-tasks MCP verbs for\n      # operators on that workflow, plus a Bash regex list for hybrid\n      # operators who also use gh-cli for PR mechanics. `max_age` is\n      # the safety net. Operators who prefer the legacy per-session\n      # behaviour opt out with `approval_lifecycle: { mode: session }`.\n      # Operators on other task systems override the matchers.\n      approval_lifecycle:\n        expire_on_tool_match:\n          - mcp__agent-tasks__task_finish\n          - mcp__agent-tasks__task_abandon\n          - mcp__agent-tasks__pull_requests_merge\n          - mcp__agent-tasks__tasks_transition\n        expire_on_bash_match:\n          - '^gh pr (merge|close)\\b'\n          - '^git push origin (master|main)\\b'\n        max_age: 4h\n\n  # branch-protection (agent-tasks/2fdc5bbe, default-enabled since v0.17.2):\n  # blocks Write/Edit (claude-code) or apply_patch (codex) on protected\n  # branches (default: master, main, develop). Complements\n  # preflight-before-push, which fires at the LAST reversible step;\n  # branch-protection fires at the FIRST source mutation, catching the\n  # \"forgot to branch off master\" pattern earlier in the cycle.\n  #\n  # Two satisfying signals: a fresh `branch:non-protected:<branch>` tag\n  # from the SessionStart producer (`harness session-start branch-check`),\n  # or the operator-only override marker written by\n  # `harness approve branch-protection --session <id>` for deliberate\n  # protected-branch edits (version bumps, CI workflow patches, hotfixes).\n  # A branch-protection-ack ledger tag is no longer a sufficient override\n  # on its own (it is agent-writable); the marker file is the trusted signal.\n  #\n  # Fails closed (any load / parse / ledger error refuses). Disable by\n  # setting `enabled: false` or removing this entry if your workflow\n  # routinely edits master directly. Override the protected list via\n  # `config.protected_branches`. Full reference:\n  # docs/policy-packs/branch-protection.md.\n  - name: branch-protection\n    source: builtin\n    enabled: true\n    description: Block Write/Edit on protected branches (master, main, develop) at the first source mutation.\n    config:\n      # ux (agent-tasks/9806d4f8): replaces the legacy\n      # \"branch-protection: refusing ...\" envelope with the\n      # plain-language { cannot, required, run } shape. Engine details\n      # (the BLOCK reason naming session id / freshness window) stay\n      # on stderr for operator audit.\n      #\n      # KEEP IN SYNC (task 68b9ad9c): this text must match defaultUx() in\n      # src/policy-packs/builtin/branch-protection.ts \u2014 see the identical\n      # note on the understanding-before-execution pack above for why.\n      # Pinned by tests/cli/init-templates-ux-parity.test.ts.\n      ux:\n        cannot: \"You cannot edit files on protected branch ${BRANCH} yet.\"\n        required:\n          - \"a checkout of a non-protected branch (current `${BRANCH}` is protected)\"\n        run:\n          - \"git checkout -b feat/<your-task>\"\n          - \"harness session-start branch-check\"\n\n  # solution-acceptance (harness cc43c7a4): Verifier-gated Done. Gates the\n  # task-finishing tools (agent-tasks completion verbs + git push / gh pr\n  # merge) on a ready, HEAD-pinned verdict that the grounding-mcp producer\n  # (solution_evaluate) derives from a real preflight run, plus an\n  # anti-forgery write-guard on the verdict marker. DISABLED by default: it\n  # is a hard completion-gate and needs grounding-mcp (>= 0.3.2) under\n  # tools.mcp plus the preflight binary on PATH. Flip enabled: true once the\n  # producer is wired and you want completion earned, not claimed. The pack\n  # emits its own instructions.md on apply; harness validate warns if you\n  # enable it without the producer.\n  - name: solution-acceptance\n    source: builtin\n    enabled: false\n    description: Gate task completion on a ready, HEAD-pinned solution-acceptance verdict earned from a real preflight run.\n\n# Phase 7 Risk Gate vocabulary. The dangerous-shell classifier and\n# production-signals resolver feed the gate-prod-destructive policies\n# above: `harness policy intercept` builds the Action Envelope,\n# classifies the action against `risk.classifiers[]`, resolves the\n# target environment against `environments.resolvers[]`, and evaluates\n# each policy's `when:` clauses against the result. Full design and the\n# decision model: docs/risk-gate.md.\nrisk:\n  classifiers:\n    - name: dangerous-shell\n      tool: Bash\n      patterns:\n        - pattern: 'rm\\s+-rf\\s+(/|/var|/data|/mnt|~)'\n          categories: [destructive, data_loss]\n          severity: critical\n        - pattern: 'DROP\\s+TABLE|TRUNCATE\\s+TABLE|DELETE\\s+FROM'\n          categories: [destructive, data_loss]\n          severity: high\n        - pattern: 'kubectl\\s+delete\\s+(namespace|deployment|statefulset|pvc)'\n          categories: [destructive, infrastructure_change]\n          severity: high\n        - pattern: 'terraform\\s+destroy'\n          categories: [destructive, infrastructure_change]\n          severity: critical\n\nenvironments:\n  resolvers:\n    - name: production-signals\n      environment: production\n      signals:\n        branch_patterns: [main, \"release/*\"]\n        env_var_patterns:\n          - var: DATABASE_URL\n            patterns: [prod, production]\n        kube_context_patterns: [\".*prod.*\"]\n        kube_namespace_patterns: [prod, production]\n";
 export type TemplateName = "minimal" | "full" | "solo" | "team";
 export declare function getTemplate(name: TemplateName): string;