@lannguyensi/harness 0.51.0 → 0.52.0

package/dist/cli/smoke/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/smoke/index.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,8DAA8D;AAC9D,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,+BAA+B;AAE/B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EACL,oBAAoB,EACpB,cAAc,GAIf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAA+C,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAsB,MAAM,oBAAoB,CAAC;AAkD1E,SAAS,gBAAgB,CAAC,IAAkB;IAC1C,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,4BAA4B;IAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CACxB,6CAA6C,GAAG,EAAE,EAClD,cAAc,CACf,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;IACvC,CAAC;IACD,MAAM,IAAI,gBAAgB,CACxB,kBAAkB,GAAG,yDAAyD,EAC9E,cAAc,CACf,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAkB;IAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,EACzC,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,gBAAgB,CACxB,iEAAiE,EACjE,QAAQ,CACT,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAEjC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAgC;QAC7C,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,IAAI;KACZ,CAAC;IACF,IAAI,IAAI,CAAC,UAAU;QAAE,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAC5D,IAAI,IAAI,CAAC,OAAO;QAAE,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IACnD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAC/C,sEAAsE;IACtE,kEAAkE;IAClE,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;QAC/B,cAAc;QACd,mBAAmB;QACnB,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,gBAAgB,CACxB,8CAA8C,WAAW,CAAC,OAAO,oCAAoC,EACrG,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAE3C,MAAM,OAAO,GAAqB;QAChC,SAAS;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY;QACZ,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS;KACV,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;IAE7D,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CACxB,uCAAwC,GAAa,CAAC,OAAO,EAAE,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAExE,kEAAkE;IAClE,4DAA4D;IAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,iCAAiC;YAC3C,MAAM,EAAE,uBAAuB,SAAS,IAAI;YAC5C,MAAM,EAAE,sCAAsC,SAAS,uDAAuD;SAC/G,CAAC,CAAC;IACL,CAAC;IACD,oEAAoE;IACpE,mEAAmE;IACnE,gEAAgE;IAChE,mEAAmE;IACnE,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,SAAS,CAAC,QAAQ;QACnB,SAAS,CAAC,QAAQ,KAAK,IAAI;QAC3B,SAAS,CAAC,QAAQ,KAAK,CAAC;QACxB,OAAO,CAAC,MAAM,KAAK,IAAI,EACvB,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,sCAAsC;YAChD,MAAM,EAAE,iBAAiB,SAAS,CAAC,QAAQ,kCAAkC;YAC7E,MAAM,EACJ,gCAAgC,SAAS,CAAC,QAAQ,0BAA0B;gBAC5E,2FAA2F;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACrD,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY;QACZ,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,OAAO;QACP,cAAc,EAAE,SAAS,CAAC,QAAQ;QAClC,cAAc,EAAE,SAAS,CAAC,QAAQ;QAClC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,QAAQ;QACR,UAAU,EAAE,SAAS,CAAC,IAAI;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC;IACxG,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,iBAAiB,EAAE,CAAC,CAAC;IACtF,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/smoke/index.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,8DAA8D;AAC9D,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,+BAA+B;AAE/B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EACL,oBAAoB,EACpB,cAAc,GAIf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAA+C,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAsB,MAAM,oBAAoB,CAAC;AAkE1E,SAAS,gBAAgB,CAAC,IAAkB;IAC1C,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,4BAA4B;IAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CACxB,6CAA6C,GAAG,EAAE,EAClD,cAAc,CACf,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;IACvC,CAAC;IACD,MAAM,IAAI,gBAAgB,CACxB,kBAAkB,GAAG,yDAAyD,EAC9E,cAAc,CACf,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAkB;IAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,EACzC,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,gBAAgB,CACxB,iEAAiE,EACjE,QAAQ,CACT,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAEjC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAgC;QAC7C,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,IAAI;KACZ,CAAC;IACF,IAAI,IAAI,CAAC,UAAU;QAAE,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAC5D,IAAI,IAAI,CAAC,OAAO;QAAE,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IACnD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAC/C,sEAAsE;IACtE,kEAAkE;IAClE,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;QAC/B,cAAc;QACd,mBAAmB;QACnB,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,gBAAgB,CACxB,8CAA8C,WAAW,CAAC,OAAO,oCAAoC,EACrG,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAE3C,kEAAkE;IAClE,oEAAoE;IACpE,iEAAiE;IACjE,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,oCAAoC;IACpC,EAAE;IACF,kEAAkE;IAClE,sEAAsE;IACtE,8DAA8D;IAC9D,oEAAoE;IACpE,gEAAgE;IAChE,kEAAkE;IAClE,sDAAsD;IACtD,EAAE;IACF,oEAAoE;IACpE,iEAAiE;IACjE,qEAAqE;IACrE,4DAA4D;IAC5D,oEAAoE;IACpE,6DAA6D;IAC7D,6CAA6C;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,eAAe,CAAC;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChD,MAAM,cAAc,GAA0C;YAC5D,cAAc,EAAE,SAAS;YACzB,GAAG,EAAE,QAAQ;YACb,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;SAC7C,CAAC;QACF,IAAI,IAAI,CAAC,UAAU;YAAE,cAAc,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACjE,IAAI,IAAI,CAAC,OAAO;YAAE,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;YACnE,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBACxB,WAAW,CACT,iBAAiB,gBAAgB,CAAC,QAAQ,WAAW,gBAAgB,CAAC,cAAc,YAAY,gBAAgB,CAAC,eAAe,aAAa,gBAAgB,CAAC,SAAS,KAAK,CAC7K,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,WAAW,CACT,wBAAwB,gBAAgB,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,KAAK,CACjF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,WAAW,CAAC,+BAA+B,OAAO,KAAK,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAqB;QAChC,SAAS;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY;QACZ,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS;KACV,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;IAE7D,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CACxB,uCAAwC,GAAa,CAAC,OAAO,EAAE,EAC/D,cAAc,CACf,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAExE,kEAAkE;IAClE,4DAA4D;IAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,iCAAiC;YAC3C,MAAM,EAAE,uBAAuB,SAAS,IAAI;YAC5C,MAAM,EAAE,sCAAsC,SAAS,uDAAuD;SAC/G,CAAC,CAAC;IACL,CAAC;IACD,oEAAoE;IACpE,mEAAmE;IACnE,gEAAgE;IAChE,mEAAmE;IACnE,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,SAAS,CAAC,QAAQ;QACnB,SAAS,CAAC,QAAQ,KAAK,IAAI;QAC3B,SAAS,CAAC,QAAQ,KAAK,CAAC;QACxB,OAAO,CAAC,MAAM,KAAK,IAAI,EACvB,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,sCAAsC;YAChD,MAAM,EAAE,iBAAiB,SAAS,CAAC,QAAQ,kCAAkC;YAC7E,MAAM,EACJ,gCAAgC,SAAS,CAAC,QAAQ,0BAA0B;gBAC5E,2FAA2F;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACrD,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY;QACZ,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,OAAO;QACP,cAAc,EAAE,SAAS,CAAC,QAAQ;QAClC,cAAc,EAAE,SAAS,CAAC,QAAQ;QAClC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,QAAQ;QACR,UAAU,EAAE,SAAS,CAAC,IAAI;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC;IACxG,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,iBAAiB,EAAE,CAAC,CAAC;IACtF,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/auto-approve.d.ts

@@ -67,6 +67,37 @@ export declare const AUTO_APPROVE_HARNESS_VALUES: readonly ["claude-code", "code
  * visible config edit.
  */
 export declare const DEFAULT_AUTO_APPROVE_HARNESSES: readonly string[];
+/**
+ * What `auto_approve.report_scan.max_wait` resolves to when the key is
+ * ABSENT: the bound the child's PreToolUse hook waits for its own
+ * Understanding Report to reach the session transcript before it blocks
+ * (ADR "Report capture under `-p`", slice 3 acceptance criterion 3).
+ *
+ * The value is measured, not guessed: under `claude -p` the report is
+ * absent from the transcript at the instant PreToolUse fires and lands
+ * some time later, on a lag that scales with report length, so the
+ * bound is set from the real end-to-end runs (a full-length grill_me
+ * report), not only the shorter probe reports that first-guessed 500ms.
+ * The measurement and the retuning derivation are both in
+ * `docs/okf/understanding-gate-auto-mode-signals.md` ("Chosen
+ * `report_scan.max_wait` default" section), from
+ * `dogfood/ug-auto-mode-signals/`.
+ *
+ * ONE named constant on purpose: the hook, the schema default and every
+ * test read this symbol, so re-tuning the bound against a new
+ * measurement is a one-line change with no literal to hunt down.
+ */
+export declare const DEFAULT_REPORT_SCAN_MAX_WAIT_MS = 2000;
+/**
+ * Hard ceiling for `auto_approve.report_scan.max_wait`. A larger value
+ * is a `harness validate` schema error AND a runtime parse failure (which
+ * fails the whole `auto_approve` block closed), so no configuration can
+ * make a PreToolUse hook sit on a session for an arbitrary time. 5 s is
+ * an order of magnitude above the measured worst-case flush, which is
+ * generous for a bound whose only job is to cover a transcript write
+ * already in flight.
+ */
+export declare const REPORT_SCAN_MAX_WAIT_CEILING_MS = 5000;
 /** Parsed, validated `auto_approve` pack-config block. */
 export interface AutoApproveConfig {
     /** Allowlist of `permission_mode` payload literals eligible for auto-approval. */
@@ -78,7 +109,45 @@ export interface AutoApproveConfig {
      * fails the whole block closed rather than defaulting.
      */
     harnesses: string[];
+    /**
+     * The transcript-poll bound for the slice 3 delegation path. Always
+     * present: an absent `report_scan` block resolves to
+     * {@link DEFAULT_REPORT_SCAN_MAX_WAIT_MS}, and every malformed shape
+     * fails the whole `auto_approve` block closed, like every other key
+     * here.
+     */
+    reportScan: {
+        maxWaitMs: number;
+    };
 }
+export type ReportScanMaxWaitParse = {
+    ok: true;
+    maxWaitMs: number;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Parse `auto_approve.report_scan.max_wait` into milliseconds.
+ *
+ * Duration grammar: the pack's SHARED parser
+ * ({@link parseDurationSeconds}, the same one `approval_lifecycle.max_age`
+ * uses), plus an `<n>ms` shorthand it does not model. The extension is
+ * not cosmetic: this bound is a transcript-flush allowance measured in
+ * tens of milliseconds, so a second-granularity grammar could not express
+ * the values the measurement actually argues for, and widening
+ * `parseDurationSeconds` itself would change the grammar of every
+ * `within:` / `max_age:` / `--since` value in the repo for one key's sake.
+ *
+ * Both bounds are errors, never clamps: zero or negative (a bound that
+ * would disable the poll while the block still claimed to have one) and
+ * anything above {@link REPORT_SCAN_MAX_WAIT_CEILING_MS} (a bound that
+ * could park a PreToolUse hook). Returning a RESULT rather than throwing
+ * keeps the two consumers symmetric: the zod schema turns it into a
+ * `harness validate` diagnostic, the runtime parser into one stderr line
+ * and a fail-closed `null`.
+ */
+export declare function parseReportScanMaxWait(raw: unknown): ReportScanMaxWaitParse;
 /**
  * Parse the optional `auto_approve` pack-config block
  * (docs/decisions/2026-08-27-ug-auto-mode-approval.md, "Option A").
@@ -114,8 +183,13 @@ export declare function parseAutoApprove(raw: unknown, stderr?: {
  * folding, no substring, no wildcards. `mode` absent, empty, or not a
  * string means no auto-approval, and `cfg === null` (block absent or
  * malformed) means no auto-approval regardless of `mode`.
+ *
+ * Takes only the `when` slice of the config rather than the whole block:
+ * this predicate reads exactly one field, and saying so in the signature
+ * keeps it honest as the block grows further keys (`harnesses`,
+ * `report_scan`) that have nothing to do with mode membership.
  */
-export declare function permissionModeAllowed(cfg: AutoApproveConfig | null, mode: unknown): boolean;
+export declare function permissionModeAllowed(cfg: Pick<AutoApproveConfig, "when"> | null, mode: unknown): boolean;
 /**
  * Per-harness opt-in membership, the same exact-string-equality
  * discipline {@link permissionModeAllowed} applies to `when`. `cfg ===
@@ -133,4 +207,4 @@ export declare function permissionModeAllowed(cfg: AutoApproveConfig | null, mod
  * {@link CODEX_HARNESS} which still has exactly one consumer and stays a
  * direct import.
  */
-export declare function harnessAllowed(cfg: AutoApproveConfig | null, harness: unknown): boolean;
+export declare function harnessAllowed(cfg: Pick<AutoApproveConfig, "harnesses"> | null, harness: unknown): boolean;

package/dist/policy-packs/builtin/understanding-before-execution/auto-approve.js

@@ -15,6 +15,13 @@
 // documents. The PreToolUse hook (auto-path condition checks) and
 // `harness doctor` (auto-approval listing) are the consumers; both
 // land in later slice-1 tasks and import from here.
+//
+// Slice 3 (agent-tasks 37ad0b05) adds `report_scan.max_wait`: the bound
+// of the child's transcript poll under `claude -p` ("Report capture
+// under `-p`" in the ADR). It lives in this block because it tunes the
+// same opt-in path, and it is parsed here rather than at the hook so
+// the lint-time schema and the runtime hook agree on one parser.
+import { InvalidDurationError, parseDurationSeconds } from "../../../policies/index.js";
 /**
  * Prefix every auto-minted marker's `approvedBy` carries, distinguishing
  * it from a human `harness approve understanding` marker (which carries
@@ -97,7 +104,105 @@ export const AUTO_APPROVE_HARNESS_VALUES = [CLAUDE_CODE_HARNESS, CODEX_HARNESS];
  * visible config edit.
  */
 export const DEFAULT_AUTO_APPROVE_HARNESSES = [CLAUDE_CODE_HARNESS];
-const KNOWN_AUTO_APPROVE_KEYS = new Set(["when", "harnesses", "require_report"]);
+/**
+ * What `auto_approve.report_scan.max_wait` resolves to when the key is
+ * ABSENT: the bound the child's PreToolUse hook waits for its own
+ * Understanding Report to reach the session transcript before it blocks
+ * (ADR "Report capture under `-p`", slice 3 acceptance criterion 3).
+ *
+ * The value is measured, not guessed: under `claude -p` the report is
+ * absent from the transcript at the instant PreToolUse fires and lands
+ * some time later, on a lag that scales with report length, so the
+ * bound is set from the real end-to-end runs (a full-length grill_me
+ * report), not only the shorter probe reports that first-guessed 500ms.
+ * The measurement and the retuning derivation are both in
+ * `docs/okf/understanding-gate-auto-mode-signals.md` ("Chosen
+ * `report_scan.max_wait` default" section), from
+ * `dogfood/ug-auto-mode-signals/`.
+ *
+ * ONE named constant on purpose: the hook, the schema default and every
+ * test read this symbol, so re-tuning the bound against a new
+ * measurement is a one-line change with no literal to hunt down.
+ */
+export const DEFAULT_REPORT_SCAN_MAX_WAIT_MS = 2_000;
+/**
+ * Hard ceiling for `auto_approve.report_scan.max_wait`. A larger value
+ * is a `harness validate` schema error AND a runtime parse failure (which
+ * fails the whole `auto_approve` block closed), so no configuration can
+ * make a PreToolUse hook sit on a session for an arbitrary time. 5 s is
+ * an order of magnitude above the measured worst-case flush, which is
+ * generous for a bound whose only job is to cover a transcript write
+ * already in flight.
+ */
+export const REPORT_SCAN_MAX_WAIT_CEILING_MS = 5_000;
+const KNOWN_AUTO_APPROVE_KEYS = new Set([
+    "when",
+    "harnesses",
+    "require_report",
+    "report_scan",
+]);
+/** The only key `auto_approve.report_scan` accepts. */
+const KNOWN_REPORT_SCAN_KEYS = new Set(["max_wait"]);
+/** Sub-second shorthand the shared duration parser does not model. */
+const MILLISECOND_SHORTHAND = /^(\d+)ms$/;
+/**
+ * Parse `auto_approve.report_scan.max_wait` into milliseconds.
+ *
+ * Duration grammar: the pack's SHARED parser
+ * ({@link parseDurationSeconds}, the same one `approval_lifecycle.max_age`
+ * uses), plus an `<n>ms` shorthand it does not model. The extension is
+ * not cosmetic: this bound is a transcript-flush allowance measured in
+ * tens of milliseconds, so a second-granularity grammar could not express
+ * the values the measurement actually argues for, and widening
+ * `parseDurationSeconds` itself would change the grammar of every
+ * `within:` / `max_age:` / `--since` value in the repo for one key's sake.
+ *
+ * Both bounds are errors, never clamps: zero or negative (a bound that
+ * would disable the poll while the block still claimed to have one) and
+ * anything above {@link REPORT_SCAN_MAX_WAIT_CEILING_MS} (a bound that
+ * could park a PreToolUse hook). Returning a RESULT rather than throwing
+ * keeps the two consumers symmetric: the zod schema turns it into a
+ * `harness validate` diagnostic, the runtime parser into one stderr line
+ * and a fail-closed `null`.
+ */
+export function parseReportScanMaxWait(raw) {
+    if (typeof raw !== "string" || raw.trim().length === 0) {
+        return {
+            ok: false,
+            reason: `expected a duration string like "500ms", "1500ms" or "2s", got ${typeof raw === "string" ? "an empty string" : typeof raw}`,
+        };
+    }
+    const trimmed = raw.trim();
+    let maxWaitMs;
+    const ms = MILLISECOND_SHORTHAND.exec(trimmed);
+    if (ms) {
+        maxWaitMs = Number.parseInt(ms[1], 10);
+    }
+    else {
+        try {
+            maxWaitMs = parseDurationSeconds(trimmed) * 1_000;
+        }
+        catch (err) {
+            return {
+                ok: false,
+                reason: err instanceof InvalidDurationError ? err.message : String(err),
+            };
+        }
+    }
+    if (!Number.isFinite(maxWaitMs) || maxWaitMs <= 0) {
+        return {
+            ok: false,
+            reason: `must be greater than zero, got ${JSON.stringify(trimmed)}`,
+        };
+    }
+    if (maxWaitMs > REPORT_SCAN_MAX_WAIT_CEILING_MS) {
+        return {
+            ok: false,
+            reason: `must not exceed the ${REPORT_SCAN_MAX_WAIT_CEILING_MS}ms hard ceiling (a PreToolUse hook must never park a session), got ${JSON.stringify(trimmed)}`,
+        };
+    }
+    return { ok: true, maxWaitMs };
+}
 /**
  * Parse the optional `auto_approve` pack-config block
  * (docs/decisions/2026-08-27-ug-auto-mode-approval.md, "Option A").
@@ -176,12 +281,39 @@ export function parseAutoApprove(raw, stderr, label = "harness pack hook") {
         }
         harnesses = seen;
     }
+    // `report_scan`: absent means the measured default
+    // ({@link DEFAULT_REPORT_SCAN_MAX_WAIT_MS}). Present means an object
+    // carrying exactly `max_wait` and nothing else, parsed and
+    // range-checked by `parseReportScanMaxWait`. Anything else fails the
+    // WHOLE block closed, like every other malformed shape here, so a
+    // typo'd bound can never silently fall back to the default while the
+    // operator believes they tuned it.
+    const reportScanRaw = obj["report_scan"];
+    let reportScanMaxWaitMs = DEFAULT_REPORT_SCAN_MAX_WAIT_MS;
+    if (reportScanRaw !== undefined) {
+        if (reportScanRaw === null || typeof reportScanRaw !== "object" || Array.isArray(reportScanRaw)) {
+            stderr?.write(`${label}: config.auto_approve.report_scan ignored (expected object, got ${reportScanRaw === null ? "null" : Array.isArray(reportScanRaw) ? "array" : typeof reportScanRaw})\n`);
+            return null;
+        }
+        const reportScanObj = reportScanRaw;
+        const unknownScanKeys = Object.keys(reportScanObj).filter((k) => !KNOWN_REPORT_SCAN_KEYS.has(k));
+        if (unknownScanKeys.length > 0) {
+            stderr?.write(`${label}: config.auto_approve.report_scan ignored (unknown key(s): ${unknownScanKeys.join(", ")})\n`);
+            return null;
+        }
+        const maxWait = parseReportScanMaxWait(reportScanObj["max_wait"]);
+        if (!maxWait.ok) {
+            stderr?.write(`${label}: config.auto_approve.report_scan.max_wait ignored (${maxWait.reason})\n`);
+            return null;
+        }
+        reportScanMaxWaitMs = maxWait.maxWaitMs;
+    }
     const requireReport = obj["require_report"];
     if (requireReport !== true) {
         stderr?.write(`${label}: config.auto_approve ignored (require_report must be true, got ${requireReport === false ? "false" : typeof requireReport})\n`);
         return null;
     }
-    return { when, harnesses };
+    return { when, harnesses, reportScan: { maxWaitMs: reportScanMaxWaitMs } };
 }
 /**
  * ADR "Additional hardening to specify" item 2: `when` is an allowlist
@@ -189,6 +321,11 @@ export function parseAutoApprove(raw, stderr, label = "harness pack hook") {
  * folding, no substring, no wildcards. `mode` absent, empty, or not a
  * string means no auto-approval, and `cfg === null` (block absent or
  * malformed) means no auto-approval regardless of `mode`.
+ *
+ * Takes only the `when` slice of the config rather than the whole block:
+ * this predicate reads exactly one field, and saying so in the signature
+ * keeps it honest as the block grows further keys (`harnesses`,
+ * `report_scan`) that have nothing to do with mode membership.
  */
 export function permissionModeAllowed(cfg, mode) {
     if (cfg === null)

package/dist/policy-packs/builtin/understanding-before-execution/auto-approve.js.map

@@ -1 +1 @@
-{"version":3,"file":"auto-approve.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/auto-approve.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,oEAAoE;AACpE,8DAA8D;AAC9D,8DAA8D;AAC9D,oEAAoE;AACpE,oEAAoE;AACpE,EAAE;AACF,iEAAiE;AACjE,gEAAgE;AAChE,sEAAsE;AACtE,qEAAqE;AACrE,kEAAkE;AAClE,mEAAmE;AACnE,oDAAoD;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAEpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,GAAG,uBAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACxD,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAmB;IACrD,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,+BAA+B,SAAS,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAU,CAAC;AAEzF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB,CAAC,mBAAmB,CAAC,CAAC;AAevF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAY,EACZ,MAA0C,EAC1C,KAAK,GAAG,mBAAmB;IAE3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,uDAAuD,OAAO,GAAG,KAAK,CAC/E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,kDAAkD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,0EACN,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,OAClD,KAAK,CACN,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,mFAAmF,OAAO,CAAC,KAAK,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,2DAA2D;IAC3D,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,SAAS,GAAa,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC9D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,0EAA0E,2BAA2B,CAAC,IAAI,CAChH,KAAK,CACN,SAAS,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,YAAY,KAAK,CACjF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAU,CAAC,EAAE,CAAC;gBAC/E,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,uEAAuE,2BAA2B,CAAC,IAAI,CAC7G,IAAI,CACL,SAAS,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAC3D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,6DAA6D,CAAC,MAAM,CAC7E,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;QACD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,mEACN,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,aAC7C,KAAK,CACN,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAA6B,EAAE,IAAa;IAChF,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,GAA6B,EAAE,OAAgB;IAC5E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"auto-approve.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/auto-approve.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,oEAAoE;AACpE,8DAA8D;AAC9D,8DAA8D;AAC9D,oEAAoE;AACpE,oEAAoE;AACpE,EAAE;AACF,iEAAiE;AACjE,gEAAgE;AAChE,sEAAsE;AACtE,qEAAqE;AACrE,kEAAkE;AAClE,mEAAmE;AACnE,oDAAoD;AACpD,EAAE;AACF,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,iEAAiE;AAEjE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAExF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAEpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,GAAG,uBAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACxD,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAmB;IACrD,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,+BAA+B,SAAS,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAU,CAAC;AAEzF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB,CAAC,mBAAmB,CAAC,CAAC;AAEvF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAuBrD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,MAAM;IACN,WAAW;IACX,gBAAgB;IAChB,aAAa;CACd,CAAC,CAAC;AAEH,uDAAuD;AACvD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AAErD,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAM1C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kEACN,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,GACvD,EAAE;SACH,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,SAAiB,CAAC;IACtB,MAAM,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,EAAE,EAAE,CAAC;QACP,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,SAAS,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kCAAkC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;SACpE,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,+BAA+B,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uBAAuB,+BAA+B,sEAAsE,IAAI,CAAC,SAAS,CAChJ,OAAO,CACR,EAAE;SACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAY,EACZ,MAA0C,EAC1C,KAAK,GAAG,mBAAmB;IAE3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,uDAAuD,OAAO,GAAG,KAAK,CAC/E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,kDAAkD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,0EACN,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,OAClD,KAAK,CACN,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,mFAAmF,OAAO,CAAC,KAAK,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,2DAA2D;IAC3D,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,SAAS,GAAa,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAC9D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,0EAA0E,2BAA2B,CAAC,IAAI,CAChH,KAAK,CACN,SAAS,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,YAAY,KAAK,CACjF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAU,CAAC,EAAE,CAAC;gBAC/E,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,uEAAuE,2BAA2B,CAAC,IAAI,CAC7G,IAAI,CACL,SAAS,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAC3D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,6DAA6D,CAAC,MAAM,CAC7E,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;QACD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,mDAAmD;IACnD,qEAAqE;IACrE,2DAA2D;IAC3D,qEAAqE;IACrE,kEAAkE;IAClE,qEAAqE;IACrE,mCAAmC;IACnC,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,mBAAmB,GAAG,+BAA+B,CAAC;IAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,aAAa,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAChG,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,mEACN,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,aACpF,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,aAAwC,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CACtC,CAAC;QACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,8DAA8D,eAAe,CAAC,IAAI,CACxF,IAAI,CACL,KAAK,CACP,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,uDAAuD,OAAO,CAAC,MAAM,KAAK,CACnF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,mEACN,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,aAC7C,KAAK,CACN,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAA2C,EAC3C,IAAa;IAEb,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAgD,EAChD,OAAgB;IAEhB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/delegation-markers.d.ts

@@ -0,0 +1,223 @@
+/** Directory holding delegation markers, a sibling of `.approvals/` under `generatedDir`. */
+export declare const DELEGATION_MARKER_DIRNAME = ".delegations";
+/**
+ * The signed markerId for a child session: `delegation-<child-sid>`.
+ * Binding it into the signed payload is what stops a validly signed
+ * delegation from being copied onto another child id, or onto a session
+ * marker's id, and still verifying (`task-markers.ts` precedent).
+ */
+export declare function delegationMarkerIdFor(childSessionId: string): string;
+/**
+ * Filesystem path of a child session's delegation marker. Rejects a
+ * malformed session id the same way `approvalMarkerPathFor` does (the
+ * value lands in a `path.join` verbatim).
+ */
+export declare function delegationMarkerPathFor(generatedDir: string, childSessionId: string): string;
+/**
+ * sha256 hex of a filesystem path, canonicalized through `realpathSync`
+ * when the path exists and through `path.resolve` when it does not.
+ *
+ * The canonicalization is the point, not an optimization: the parent
+ * writing the delegation and the child reporting its cwd routinely spell
+ * the same directory differently (on macOS `os.tmpdir()` hands out
+ * `/var/folders/...` while the process reports `/private/var/folders/...`,
+ * because `/var` is a symlink), and an uncanonicalized comparison would
+ * refuse a perfectly legitimate delegation. Falling back to `resolve` for
+ * a non-existent path keeps the function total: a path that cannot be
+ * canonicalized still hashes deterministically, and a delegation bound to
+ * it simply will not match a cwd that resolves elsewhere.
+ *
+ * Named for its primary use; the fallback shape hashes the launcher-
+ * supplied report file's PATH with the same function, so that WHERE the
+ * parent put the report is part of what was signed.
+ */
+export declare function hashDelegationCwd(targetPath: string): string;
+/** The bindings packed into a delegation's `approvedBy` string. */
+export interface DelegationApprovedByFields {
+    parentSessionId: string;
+    /** sha256 of the child's expected cwd, or `null` for a task-only delegation. */
+    cwdHash: string | null;
+    /** The task id the child is delegated for, or `null` for a cwd-only delegation. */
+    taskId: string | null;
+    /** ISO-8601 instant at which the delegation stops being valid. */
+    expiresAt: string;
+    /** sha256 of the launcher-supplied report file's PATH; present only in the fallback shape. */
+    reportPathHash?: string;
+}
+/**
+ * Build the `approvedBy` string a delegation signs:
+ * `delegated:<parent>;cwd=<sha256|->;task=<id|->;expires=<iso>` plus
+ * `;report=<sha256>` in the fallback shape.
+ *
+ * Throws on any input that would corrupt the encoding (an empty value, a
+ * value carrying a `;` or `=` delimiter or a control character, a
+ * malformed parent session id (`rejectMalformedSessionId`), a cwd/report
+ * hash that is not a sha256 digest, a non-ISO expiry, or the literal `-`
+ * as a task id, which would round-trip as "no task bound"). A silently
+ * mis-encoded delegation would be signed and then read back with
+ * different bindings than the caller intended, so this fails loudly at
+ * the only place that can still tell the difference.
+ */
+export declare function buildDelegationApprovedBy(fields: DelegationApprovedByFields): string;
+/** Bindings read back out of a delegation's `approvedBy` string. */
+export interface ParsedDelegationApprovedBy {
+    parentSessionId: string;
+    /** `null` when the delegation binds no cwd (`cwd=-`). */
+    cwdHash: string | null;
+    /** `null` when the delegation binds no task (`task=-`). */
+    taskId: string | null;
+    expiresAt: string;
+    /** Present only in the fallback shape. */
+    reportPathHash?: string;
+}
+export type DelegationApprovedByParse = {
+    ok: true;
+    value: ParsedDelegationApprovedBy;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Strict inverse of {@link buildDelegationApprovedBy}. All four of
+ * `delegated`, `cwd`, `task` and `expires` are required and `report` is
+ * optional; a missing, duplicated, unknown, empty or malformed segment is
+ * an error RESULT, never a default. Segment order is not enforced (the
+ * signature already pins the exact bytes), but every other deviation is
+ * refused: this string is the only place a delegation's bindings live, so
+ * "read it partially and assume the rest" is the one failure mode that
+ * would quietly widen a delegation past what the parent signed.
+ */
+export declare function parseDelegationApprovedBy(approvedBy: unknown): DelegationApprovedByParse;
+export interface WriteDelegationMarkerOptions {
+    generatedDir: string;
+    /** Session id of the `claude -p` child this delegation authorizes. Becomes the file name. */
+    childSessionId: string;
+    /** Session id of the already-approved parent issuing the delegation. */
+    parentSessionId: string;
+    /** {@link hashDelegationCwd} of the child's expected cwd, or `null` for a task-only delegation. */
+    cwdHash: string | null;
+    /** Task id the child is delegated for, or `null` for a cwd-only delegation. */
+    taskId: string | null;
+    /** ISO-8601 instant the delegation expires at. */
+    expiresAt: string;
+    /** Fallback shape: {@link hashDelegationCwd} of the launcher-supplied report file's path. */
+    reportPathHash?: string;
+    /** Fallback shape: sha256 of that file's CONTENT. Omitted (written as `null`) in the base shape. */
+    reportContentHash?: string;
+    /** Override the issue timestamp for deterministic tests. */
+    now?: Date;
+}
+export type WriteDelegationMarkerResult = {
+    ok: true;
+    filePath: string;
+    markerId: string;
+    approvedAt: string;
+    approvedBy: string;
+} | {
+    ok: false;
+    reason: "signing-key-absent" | "invalid-input" | "write-failed";
+    detail: string;
+};
+/**
+ * Write a signed delegation marker through the shared `signMarker` path,
+ * under markerId `delegation-<child-sid>`, at
+ * `<generatedDir>/.delegations/<child-sid>`. Atomic and mode 0600, like
+ * every other marker write.
+ *
+ * NEVER CREATES THE SIGNING KEY. `signMarker` -> `getOrCreateSigningKey`
+ * treats a missing key as a case to REPAIR, generating one and signing
+ * with it; key creation is an operator-side act (`harness init`,
+ * `harness approve`), and a delegation minted on a machine that never had
+ * a key would be a marker signed by whoever asked for it. So this
+ * prechecks `signingKeyExists` and returns `signing-key-absent` without
+ * reaching the write path at all (ADR threat model (b) item 5, the same
+ * rule slice 1's auto path follows).
+ *
+ * Returns a result rather than throwing, for every failure mode: the
+ * callers are a CLI verb and, later, a hook, and both must fail closed
+ * with a diagnostic instead of unwinding.
+ *
+ * Deliberately does NOT refuse a delegation that binds neither cwd nor
+ * task. That refusal belongs to the issuing verb (ADR slice 3 acceptance
+ * criterion 1) and to `verifyDelegation`, which reports `no_binding`;
+ * keeping the writer able to produce one is what lets the test suite
+ * exercise that verifier branch against a genuinely signed artifact
+ * rather than a hand-rolled fake.
+ */
+export declare function writeDelegationMarker(opts: WriteDelegationMarkerOptions): WriteDelegationMarkerResult;
+/**
+ * Why a delegation was refused. Every value is reachable and distinct;
+ * there is no "unknown" bucket and no branch that falls through to
+ * allow.
+ */
+export type DelegationRefusalReason = 
+/** No delegation file for this child session (also: a child session id that cannot name a file). */
+"missing"
+/** The file exists but its integrity cannot be established right now: symlink, non-regular, I/O error, or an unavailable signing key. Not a claim of tampering. */
+ | "unreadable"
+/** A file was there and its signature does not verify against `delegation-<child-sid>`: unsigned, wrong alg, tampered, or copied from another child's delegation. */
+ | "forged"
+/** Validly signed, but its `approvedBy` bindings cannot be read in full. */
+ | "unparseable" | "expired" | "cwd_mismatch" | "task_mismatch"
+/** Binds neither a cwd nor a task, so it would authorize the child anywhere, for anything. */
+ | "no_binding"
+/** Fallback shape: the launcher report is not at the path the parent signed. */
+ | "report_path_mismatch"
+/** Fallback shape: the launcher report's content is not what the parent signed (including a report that cannot be read). */
+ | "report_content_mismatch";
+export type DelegationVerification = {
+    ok: true;
+    parentSessionId: string;
+    expiresAt: string;
+    boundCwdHash: string | null;
+    boundTaskId: string | null;
+    reportPathHash?: string;
+} | {
+    ok: false;
+    reason: DelegationRefusalReason;
+    detail: string;
+};
+export interface VerifyDelegationOptions {
+    generatedDir: string;
+    /** The child session whose delegation is being checked. */
+    childSessionId: string;
+    /** The child's actual cwd, or `null` when the caller has none to offer. */
+    cwd: string | null;
+    /** The child's actual task id, or `null` when the caller has none to offer. */
+    taskId: string | null;
+    /** Fallback shape: the launcher-supplied report file the parent bound. */
+    launcherReportPath?: string;
+    /** Override "now" for deterministic tests. */
+    now?: Date;
+}
+/**
+ * Gate-side: is there a valid, unexpired, matching delegation for this
+ * child session? Checks, in order (ADR slice 3 acceptance criterion 2):
+ *
+ *   1. the file is present and JSON-readable,
+ *   2. its signature verifies against markerId `delegation-<child-sid>`,
+ *   3. its `approvedBy` segments parse in full,
+ *   4. it binds at least one of cwd / task,
+ *   5. it has not expired,
+ *   6. the bound cwd hash-matches the caller's cwd,
+ *   7. the bound task equals the caller's task,
+ *   8. in the fallback shape, the launcher report sits at the bound path
+ *      AND hashes to the bound content.
+ *
+ * Reads only `.delegations/`; an artifact in `.approvals/` is `missing`
+ * here, whatever it contains.
+ *
+ * NEVER CREATES THE SIGNING KEY, on the READ path either.
+ * `verifyMarkerSignature` obtains the key through
+ * `getOrCreateSigningKey`, which treats a missing key as a case to
+ * REPAIR and generates one; on a machine the operator never initialized
+ * that would make a mere gate-time read perform the operator-side act of
+ * minting the key. It cannot make a foreign-signed delegation verify, but
+ * it does leave a key behind that every LATER write path would then
+ * happily sign with, so the never-create rule applies here exactly as it
+ * does to `writeDelegationMarker` and to slice 1's auto path. An absent
+ * key is reported as `unreadable` (we could not check, not "we checked
+ * and it is a forgery"), the same class `verifyMarkerSignature`'s own
+ * `key-unavailable` lands in below.
+ */
+export declare function verifyDelegation(opts: VerifyDelegationOptions): DelegationVerification;