@lannguyensi/harness 0.63.0 → 0.64.0

package/dist/cli/uninstall/register.js

@@ -0,0 +1,169 @@
+import * as fs from "node:fs";
+import { EX_FAIL, HarnessExitError } from "../exit-codes.js";
+import { uninstall, UninstallError } from "./index.js";
+export function registerUninstall(program, io) {
+    const { stdout, stderr } = io;
+    program
+        .command("uninstall")
+        .description("Clean teardown of a harness installation. Inventories harness-owned " +
+        "state (manifest, lock, harness.generated/, .understanding-gate/ under " +
+        "the state root; hook groups and mcpServers in ~/.claude/settings.json) " +
+        "and prints it. With --apply, removes it after writing a reversible " +
+        "settings.json backup + snapshot. " +
+        "settings.json.pre-harness-<TS> backups are listed but never deleted, " +
+        "so the operator can hand them to --restore-from <path> (atomic restore " +
+        "from that file) or `rm` them manually.")
+        .option("--apply", "execute the teardown (default: dry-run listing only)")
+        .option("--restore-from <path>", "atomic restore: copy this file over settings.json instead of selective removal (implies --apply)")
+        .option("--home <path>", "override ~/.claude/ (settings home; without --state it also overrides the state root, for tests / non-default installs)")
+        .option("--state <path>", "override the harness state root (default: ~/.harness/, legacy fallback ~/.claude/)")
+        .option("--settings <path>", "override ~/.claude/settings.json")
+        .action(async (options) => {
+        const cliOpts = {};
+        if (options.apply)
+            cliOpts.apply = true;
+        if (options.restoreFrom)
+            cliOpts.restoreFrom = options.restoreFrom;
+        if (options.home)
+            cliOpts.homeDir = options.home;
+        if (options.state)
+            cliOpts.stateDir = options.state;
+        if (options.settings)
+            cliOpts.settingsPath = options.settings;
+        try {
+            const result = await uninstall(cliOpts);
+            const inv = result.inventory;
+            if (result.mode === "list") {
+                const nothing = inv.manifestPath === null &&
+                    inv.lockPath === null &&
+                    inv.generatedDir === null &&
+                    inv.gateStateDir === null &&
+                    inv.hookGroups.length === 0 &&
+                    inv.mcpServers.length === 0 &&
+                    inv.mcpRegistryServers.length === 0 &&
+                    inv.preHarnessBackups.length === 0;
+                const rootsLabel = inv.stateDir === inv.homeDir
+                    ? inv.homeDir
+                    : `${inv.stateDir} (state) + ${inv.homeDir} (settings)`;
+                if (nothing) {
+                    stdout(`no harness install found under ${rootsLabel}; nothing to do.\n`);
+                    for (const w of inv.warnings)
+                        stderr(`warning: ${w}\n`);
+                    return;
+                }
+                stdout(`harness install under ${rootsLabel}:\n`);
+                if (inv.manifestPath)
+                    stdout(`  manifest:  ${inv.manifestPath}\n`);
+                if (inv.lockPath)
+                    stdout(`  lock:      ${inv.lockPath}\n`);
+                if (inv.generatedDir)
+                    stdout(`  generated: ${inv.generatedDir}/\n`);
+                if (inv.gateStateDir)
+                    stdout(`  gate:      ${inv.gateStateDir}/ (understanding-gate state)\n`);
+                if (inv.hookGroups.length > 0) {
+                    stdout(`  hook groups in ${inv.settingsPath}:\n`);
+                    for (const g of inv.hookGroups) {
+                        const matcherLabel = g.matcher === null ? "(no matcher)" : JSON.stringify(g.matcher);
+                        stdout(`    ${g.event}[${g.index}] matcher=${matcherLabel}: ${g.description}\n`);
+                    }
+                }
+                if (inv.mcpServers.length > 0) {
+                    stdout(`  mcpServers in ${inv.settingsPath}: ${inv.mcpServers.join(", ")}\n`);
+                }
+                if (inv.mcpRegistryServers.length > 0) {
+                    stdout(`  mcpServers registered in the claude CLI user-scope registry (${inv.mcpRegistryPath}): ` +
+                        `${inv.mcpRegistryServers.join(", ")}\n`);
+                }
+                if (inv.preHarnessBackups.length > 0) {
+                    stdout(`  pre-harness backups:\n`);
+                    for (const b of inv.preHarnessBackups)
+                        stdout(`    ${b}\n`);
+                    stdout(`\n  Restore from one of these with: harness uninstall --restore-from <path>\n`);
+                }
+                stdout(`\nPass --apply to remove the above. This is a dry-run.\n`);
+                for (const w of inv.warnings)
+                    stderr(`warning: ${w}\n`);
+                return;
+            }
+            if (result.mode === "restore") {
+                stdout(`restored ${inv.settingsPath} from ${result.restoredFrom}.\n`);
+                stdout(`backup:   ${result.backupPath}\n`);
+                stdout(`snapshot: ${result.snapshotPath}\n`);
+                if (result.removedFiles.length > 0) {
+                    stdout(`removed:\n`);
+                    for (const f of result.removedFiles)
+                        stdout(`  ${f}\n`);
+                }
+                if (result.mcpRegistryRemovals.length > 0) {
+                    stdout(`claude mcp remove (user scope, ${inv.mcpRegistryPath}):\n`);
+                    for (const r of result.mcpRegistryRemovals)
+                        stdout(`  ${r.name}: ${r.status}\n`);
+                }
+                stdout(`\nTo finish: \`npm uninstall -g @lannguyensi/harness\` (uninstall does not touch the npm install).\n`);
+                for (const w of inv.warnings)
+                    stderr(`warning: ${w}\n`);
+                return;
+            }
+            // apply
+            if (result.backupPath !== null && result.snapshotPath !== null) {
+                stdout(`mutated ${inv.settingsPath}:\n`);
+                if (inv.hookGroups.length > 0) {
+                    stdout(`  removed ${inv.hookGroups.length} hook group(s): `);
+                    stdout(inv.hookGroups.map((g) => `${g.event}[${g.index}]`).join(", "));
+                    stdout(`\n`);
+                }
+                if (inv.mcpServers.length > 0) {
+                    stdout(`  removed mcpServers: ${inv.mcpServers.join(", ")}\n`);
+                }
+                stdout(`backup:   ${result.backupPath}\n`);
+                stdout(`snapshot: ${result.snapshotPath}\n`);
+            }
+            if (result.removedFiles.length > 0) {
+                stdout(`removed from disk:\n`);
+                for (const f of result.removedFiles)
+                    stdout(`  ${f}\n`);
+                // Explicit kept-list: name whatever survives under the state
+                // root (machines/ + projects/ override layers are
+                // operator-authored; foreign files are not ours to judge) so
+                // the operator never has to discover residue by accident.
+                try {
+                    const residue = fs
+                        .readdirSync(inv.stateDir)
+                        .filter((name) => !name.startsWith("settings.json"));
+                    if (residue.length > 0) {
+                        stdout(`kept under ${inv.stateDir}: ${residue.join(", ")} (not removed; operator-authored or out of scope)\n`);
+                    }
+                }
+                catch {
+                    /* state root itself may be gone or unreadable; nothing to report */
+                }
+            }
+            if (result.mcpRegistryRemovals.length > 0) {
+                stdout(`claude mcp remove (user scope, ${inv.mcpRegistryPath}):\n`);
+                for (const r of result.mcpRegistryRemovals)
+                    stdout(`  ${r.name}: ${r.status}\n`);
+            }
+            if (result.backupPath === null &&
+                result.snapshotPath === null &&
+                result.removedFiles.length === 0 &&
+                result.mcpRegistryRemovals.length === 0) {
+                const rootsLabel = inv.stateDir === inv.homeDir
+                    ? inv.homeDir
+                    : `${inv.stateDir} (state) + ${inv.homeDir} (settings)`;
+                stdout(`no harness install found under ${rootsLabel}; nothing to remove.\n`);
+            }
+            else {
+                stdout(`\nTo finish: \`npm uninstall -g @lannguyensi/harness\` (uninstall does not touch the npm install).\n`);
+            }
+            for (const w of inv.warnings)
+                stderr(`warning: ${w}\n`);
+        }
+        catch (err) {
+            if (err instanceof UninstallError) {
+                throw new HarnessExitError(err.message, EX_FAIL);
+            }
+            throw err;
+        }
+    });
+}
+//# sourceMappingURL=register.js.map

package/dist/cli/uninstall/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/cli/uninstall/register.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,UAAU,iBAAiB,CAC/B,OAAgB,EAChB,EAAgE;IAEhE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC9B,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CACV,sEAAsE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,mCAAmC;QACnC,uEAAuE;QACvE,yEAAyE;QACzE,wCAAwC,CAC3C;SACA,MAAM,CAAC,SAAS,EAAE,sDAAsD,CAAC;SACzE,MAAM,CACL,uBAAuB,EACvB,kGAAkG,CACnG;SACA,MAAM,CACL,eAAe,EACf,yHAAyH,CAC1H;SACA,MAAM,CACL,gBAAgB,EAChB,oFAAoF,CACrF;SACA,MAAM,CAAC,mBAAmB,EAAE,kCAAkC,CAAC;SAC/D,MAAM,CAAC,KAAK,EAAE,OAAoG,EAAE,EAAE;QACrH,MAAM,OAAO,GAAoC,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QACxC,IAAI,OAAO,CAAC,WAAW;YAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACnE,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;QACpD,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;YAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,OAAO,GACX,GAAG,CAAC,YAAY,KAAK,IAAI;oBACzB,GAAG,CAAC,QAAQ,KAAK,IAAI;oBACrB,GAAG,CAAC,YAAY,KAAK,IAAI;oBACzB,GAAG,CAAC,YAAY,KAAK,IAAI;oBACzB,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;oBAC3B,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;oBAC3B,GAAG,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;oBACnC,GAAG,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;gBACrC,MAAM,UAAU,GACd,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO;oBAC1B,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,cAAc,GAAG,CAAC,OAAO,aAAa,CAAC;gBAC5D,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,CAAC,kCAAkC,UAAU,oBAAoB,CAAC,CAAC;oBACzE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;wBAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBACxD,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,yBAAyB,UAAU,KAAK,CAAC,CAAC;gBACjD,IAAI,GAAG,CAAC,YAAY;oBAAE,MAAM,CAAC,gBAAgB,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC;gBACnE,IAAI,GAAG,CAAC,QAAQ;oBAAE,MAAM,CAAC,gBAAgB,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;gBAC3D,IAAI,GAAG,CAAC,YAAY;oBAAE,MAAM,CAAC,gBAAgB,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC;gBACpE,IAAI,GAAG,CAAC,YAAY;oBAAE,MAAM,CAAC,gBAAgB,GAAG,CAAC,YAAY,gCAAgC,CAAC,CAAC;gBAC/F,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,CAAC,oBAAoB,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC;oBAClD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;wBAC/B,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;wBACrF,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,aAAa,YAAY,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;oBACnF,CAAC;gBACH,CAAC;gBACD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,CAAC,mBAAmB,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChF,CAAC;gBACD,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtC,MAAM,CACJ,kEAAkE,GAAG,CAAC,eAAe,KAAK;wBACxF,GAAG,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC3C,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrC,MAAM,CAAC,0BAA0B,CAAC,CAAC;oBACnC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,iBAAiB;wBAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC5D,MAAM,CACJ,+EAA+E,CAChF,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,0DAA0D,CAAC,CAAC;gBACnE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;oBAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,YAAY,GAAG,CAAC,YAAY,SAAS,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC;gBACtE,MAAM,CAAC,aAAa,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;gBAC3C,MAAM,CAAC,aAAa,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;gBAC7C,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,CAAC,YAAY,CAAC,CAAC;oBACrB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY;wBAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1D,CAAC;gBACD,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,kCAAkC,GAAG,CAAC,eAAe,MAAM,CAAC,CAAC;oBACpE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB;wBAAE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;gBACnF,CAAC;gBACD,MAAM,CACJ,sGAAsG,CACvG,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;oBAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,QAAQ;YACR,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC/D,MAAM,CAAC,WAAW,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC;gBACzC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,CAAC,aAAa,GAAG,CAAC,UAAU,CAAC,MAAM,kBAAkB,CAAC,CAAC;oBAC7D,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBACvE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACf,CAAC;gBACD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,CAAC,yBAAyB,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,CAAC,aAAa,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;gBAC3C,MAAM,CAAC,aAAa,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY;oBAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxD,6DAA6D;gBAC7D,kDAAkD;gBAClD,6DAA6D;gBAC7D,0DAA0D;gBAC1D,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,EAAE;yBACf,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;yBACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;oBACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,MAAM,CACJ,cAAc,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qDAAqD,CACvG,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;gBACtE,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,kCAAkC,GAAG,CAAC,eAAe,MAAM,CAAC,CAAC;gBACpE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YACnF,CAAC;YACD,IACE,MAAM,CAAC,UAAU,KAAK,IAAI;gBAC1B,MAAM,CAAC,YAAY,KAAK,IAAI;gBAC5B,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBAChC,MAAM,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EACvC,CAAC;gBACD,MAAM,UAAU,GACd,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO;oBAC1B,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,cAAc,GAAG,CAAC,OAAO,aAAa,CAAC;gBAC5D,MAAM,CAAC,kCAAkC,UAAU,wBAAwB,CAAC,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACN,MAAM,CACJ,sGAAsG,CACvG,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;gBAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts

@@ -11,5 +11,5 @@ export { diff, diffManifests, formatDiff, type Change, type ChangeKind, type Dif
 export { format as formatDoctor } from "./cli/doctor/format.js";
 export { RealMcpProbe, type McpProbe, type McpProbeResult } from "./probes/mcp.js";
 export { inspectMemory, type MemoryReport, type StaleMemory } from "./probes/memory.js";
-export { intercept, recordPolicyDecision, payloadFromDecision, encodeLedgerContent, decodeLedgerContent, type ClaudeDenyJson, type InterceptOptions, type InterceptResult, type LedgerClient, type LedgerRecordOptions, type PolicyDecision, type PolicyDecisionPayload, type PolicyOutcome, type ToolEvent, } from "./runtime/index.js";
+export { intercept, recordPolicyDecision, payloadFromDecision, encodeLedgerContent, decodeLedgerContent, type ClaudeDenyJson, type InterceptOptions, type InterceptResult, type LedgerClient, type LedgerRecordOptions, type ForeignTarget, type PolicyDecision, type PolicyDecisionPayload, type PolicyOutcome, type ToolEvent, } from "./runtime/index.js";
 export { evaluateRequires, RequiresEvaluationError, parseDurationSeconds, InvalidDurationError, validateExtractGrammar, parseExtractExpression, evaluateExtract, substituteTemplate, ExtractGrammarError, queryLedgerByTag, type LedgerClientOptions, type LedgerQueryResult, type QueryLedgerOptions, type EvaluateRequiresOptions, type LedgerEntry, type RequiresEvaluation, type RequiresTrace, type ExtractBuiltins, type ExtractEventContext, type ExtractEvaluation, type ExtractPath, type ExtractSegment, type ExtractTraceEntry, type ExtractTraceSource, type SubstituteTemplateResult, } from "./policies/index.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAA0D,MAAM,mBAAmB,CAAC;AAC/G,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAsB,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAmB,MAAM,yBAAyB,CAAC;AACjH,OAAO,EAAE,MAAM,EAAsB,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAwD,MAAM,eAAe,CAAC;AAC3G,OAAO,EAAE,OAAO,EAA2C,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAmE,MAAM,qBAAqB,CAAC;AACvI,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAsC,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAuC,MAAM,oBAAoB,CAAC;AACxF,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GAUpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GAgBjB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAA0D,MAAM,mBAAmB,CAAC;AAC/G,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAsB,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAmB,MAAM,yBAAyB,CAAC;AACjH,OAAO,EAAE,MAAM,EAAsB,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAwD,MAAM,eAAe,CAAC;AAC3G,OAAO,EAAE,OAAO,EAA2C,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAmE,MAAM,qBAAqB,CAAC;AACvI,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAsC,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAuC,MAAM,oBAAoB,CAAC;AACxF,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GAWpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GAgBjB,MAAM,qBAAqB,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/inflight-records.js

@@ -296,9 +296,23 @@ export function verifyInflightRecord(generatedDir, sessionId, agentId, opts = {}
     // differently-cased sibling's record; its signature — recomputed from
     // the REQUESTED, case-variant id — would then fail to verify and be
     // classified forged, even though nothing was tampered with. A
-    // case-variant request simply names no record; `readdirSync` lists
-    // literal entry names regardless of the filesystem's own case
-    // sensitivity, so this is the one check that can tell the two apart.
+    // case-variant request simply names no record.
+    //
+    // The check is a direct lookup of the one entry, never a listing of
+    // the session directory: the directory holds only what its writers put
+    // there, and a listing costs time in proportion to its size (see the
+    // CHANGELOG entry for task aa6f6570) inside a hook whose 15 s budget the runtime
+    // treats as an allow when it is exceeded. `lstat` says whether the
+    // entry exists (a missing entry, or any error, reads as "no record":
+    // fail closed); `realpath.native` then returns the entry's name as the
+    // filesystem stores it (the true on-disk case on a case-insensitive
+    // volume), so a case-variant request is told apart from the exact one
+    // without reading the directory. A symlink entry skips that step on
+    // purpose (its realpath is the link target's name, not its own): the
+    // read below refuses it as a symlink either way. A filesystem whose
+    // `realpath` does not report the stored case lets a case-variant
+    // request through to the signature check, which fails it as forged:
+    // still not a match, only a less precise diagnostic.
     //
     // ONLY the agentId segment gets this exact-entry check. The sessionId
     // segment (the `sessionDir` lstat above) inherits whatever the
@@ -313,20 +327,31 @@ export function verifyInflightRecord(generatedDir, sessionId, agentId, opts = {}
     // section for the write side that never produces one anyway: session
     // ids are runtime-generated UUIDs, not operator-chosen strings, so a
     // case collision is not a realistic write-time input).
-    let sessionEntries;
+    const noExactEntry = {
+        matched: false,
+        forged: false,
+        stale: false,
+        detail: `no in-flight record at ${filePath} (no exact entry named ${JSON.stringify(agentId)} in ${sessionDir})`,
+    };
+    let entryStat;
     try {
-        sessionEntries = fs.readdirSync(sessionDir);
+        entryStat = fs.lstatSync(filePath);
     }
-    catch {
+    catch (err) {
+        if (err.code === "ENOENT")
+            return noExactEntry;
         return { matched: false, forged: false, stale: false, detail: `no in-flight record at ${filePath}` };
     }
-    if (!sessionEntries.includes(agentId)) {
-        return {
-            matched: false,
-            forged: false,
-            stale: false,
-            detail: `no in-flight record at ${filePath} (no exact entry named ${JSON.stringify(agentId)} in ${sessionDir})`,
-        };
+    if (!entryStat.isSymbolicLink()) {
+        let storedName;
+        try {
+            storedName = path.basename(fs.realpathSync.native(filePath));
+        }
+        catch {
+            return { matched: false, forged: false, stale: false, detail: `no in-flight record at ${filePath}` };
+        }
+        if (storedName !== agentId)
+            return noExactEntry;
     }
     const read = readRegularFileRejectingSymlink(filePath);
     if (read.kind === "missing") {

package/dist/policy-packs/builtin/understanding-before-execution/inflight-records.js.map

@@ -1 +1 @@
-{"version":3,"file":"inflight-records.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/inflight-records.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,yEAAyE;AACzE,4DAA4D;AAC5D,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,iEAAiE;AACjE,qEAAqE;AACrE,sEAAsE;AACtE,gEAAgE;AAChE,8DAA8D;AAC9D,+DAA+D;AAC/D,oEAAoE;AACpE,qBAAqB;AACrB,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,oEAAoE;AACpE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,oBAAoB;AACpB,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,EAAE;AACF,oEAAoE;AACpE,wDAAwD;AACxD,qEAAqE;AACrE,gFAAgF;AAChF,kEAAkE;AAClE,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,+DAA+D;AAC/D,iEAAiE;AACjE,oEAAoE;AACpE,gEAAgE;AAChE,mEAAmE;AACnE,kEAAkE;AAClE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,gEAAgE;AAChE,uEAAuE;AACvE,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,sEAAsE;AACtE,sCAAsC;AACtC,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,yEAAyE;AACzE,iEAAiE;AACjE,mEAAmE;AACnE,sEAAsE;AACtE,sCAAsC;AAEtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAG3F,gHAAgH;AAChH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAEnD,wHAAwH;AACxH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnE,yEAAyE;AACzE,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAE9C;;;;;;;;;GASG;AACH,MAAM,WAAW,GAAG,oCAAoC,CAAC;AAEzD,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,yGAAyG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CACnI,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,OAAe;IACpE,OAAO,GAAG,yBAAyB,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,SAAiB,EAAE,OAAe;IAC5F,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC9E,CAAC;AAKD;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,qEAAqE;AACrE,MAAM,uBAAuB,GAAG,oEAAoE,CAAC;AAErG;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAC9B,UAAkB;IAElB,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;IAC1C,OAAO,EAAE,SAAS,EAAE,SAAmB,EAAE,YAAY,EAAE,YAAoC,EAAE,CAAC;AAChG,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,oFAAoF;SAC7F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,oIAAoI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;SAC7K,CAAC;IACJ,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAyB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE;QACrD,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,YAAY,IAAI,CAAC,SAAS,WAAW,YAAY,EAAE;QAC/D,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS;QACT,YAAY;QACZ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;QAChC,GAAG,MAAM;KACV,CAAC;IACF,IAAI,CAAC;QACH,eAAe,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,OAAoC,EAAE;IAEtC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,mDACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;SACH,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,uEAAuE;IACvE,4DAA4D;IAC5D,sEAAsE;IACtE,uEAAuE;IACvE,gEAAgE;IAChE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACxC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0BAA0B,QAAQ,KAAK,GAAG,4BAA4B;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,gEAAgE;IAChE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,8DAA8D;IAC9D,mEAAmE;IACnE,8DAA8D;IAC9D,qEAAqE;IACrE,EAAE;IACF,sEAAsE;IACtE,+DAA+D;IAC/D,kEAAkE;IAClE,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,qEAAqE;IACrE,qEAAqE;IACrE,uDAAuD;IACvD,IAAI,cAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,cAAc,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,0BAA0B,QAAQ,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,UAAU,GAAG;SAChH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uDAAuD,QAAQ,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,gDAAgD,QAAQ,EAAE;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,sGAAsG;SAC9I,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uCAAuC,QAAQ,EAAE;SAC1D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAiC,CAAC;IAE/C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,IAAI,YAAY,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,4DAA4D;YAC5D,iEAAiE;YACjE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,QAAQ,2BAA2B,YAAY,CAAC,MAAM,EAAE;aACxF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,8CAA8C,YAAY,CAAC,MAAM,KAAK,QAAQ,GAAG;SAC1F,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,aAAa,KAAK,SAAS,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,uBAAuB,QAAQ,gDAAgD,IAAI,CAAC,SAAS,CAC3F,aAAa,CACd,aAAa,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,cAAc,SAAS,IAAI,OAAO,GAAG;SACjF,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,sEAAsE;IACtE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAW,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,yDAAyD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;SAC7H,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,yDAAyD;IACzD,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,mFAAmF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG;SACjM,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,mEAAmE;IACnE,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,aAAa,IAAI,QAAQ,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;QAC5G,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,2EAA2E,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG;SACnP,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,+BAA+B,CAAC;IAE1E,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,IAAI,YAAY,GAAG,KAAK,GAAG,uBAAuB,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,uBAAuB,QAAQ,uBAAuB,uBAAuB,GAAG,MAAM,uCAAuC,UAAU,EAAE;SAClJ,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,SAAS;IACT,IAAI,KAAK,GAAG,YAAY,GAAG,YAAY,EAAE,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,uBAAuB,QAAQ,0BAA0B,UAAU,EAAE;SAC9E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,mCAAmC,OAAO,KAAK,QAAQ,CAAC,SAAS,aAAa,QAAQ,CAAC,YAAY,iBAAiB,UAAU,EAAE;KACzI,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,SAAiB,EAAE,OAAe;IAC1F,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;AACH,CAAC;AAkBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,GAAU,EACV,YAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,qBAAqB,GAAG,YAAY,IAAI,+BAA+B,CAAC;IAE9E,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,cAA2B,CAAC;IAChC,IAAI,CAAC;QACH,cAAc,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,QAAQ,GAAqD,EAAE,CAAC;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,wBAAwB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,IAAI,YAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,YAAY,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAiC,CAAC;YAC/C,iEAAiE;YACjE,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,8CAA8C;YAC9C,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3F,MAAM,YAAY,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7E,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAChC,+DAA+D;YAC/D,kEAAkE;YAClE,iEAAiE;YACjE,4BAA4B;YAC5B,IAAI,KAAK,GAAG,YAAY,GAAG,qBAAqB,IAAI,YAAY,GAAG,KAAK,GAAG,uBAAuB,EAAE,CAAC;gBACnG,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"inflight-records.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/inflight-records.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,yEAAyE;AACzE,4DAA4D;AAC5D,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,iEAAiE;AACjE,qEAAqE;AACrE,sEAAsE;AACtE,gEAAgE;AAChE,8DAA8D;AAC9D,+DAA+D;AAC/D,oEAAoE;AACpE,qBAAqB;AACrB,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,oEAAoE;AACpE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,oBAAoB;AACpB,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,EAAE;AACF,oEAAoE;AACpE,wDAAwD;AACxD,qEAAqE;AACrE,gFAAgF;AAChF,kEAAkE;AAClE,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,+DAA+D;AAC/D,iEAAiE;AACjE,oEAAoE;AACpE,gEAAgE;AAChE,mEAAmE;AACnE,kEAAkE;AAClE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,gEAAgE;AAChE,uEAAuE;AACvE,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,sEAAsE;AACtE,sCAAsC;AACtC,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,yEAAyE;AACzE,iEAAiE;AACjE,mEAAmE;AACnE,sEAAsE;AACtE,sCAAsC;AAEtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAG3F,gHAAgH;AAChH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAEnD,wHAAwH;AACxH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnE,yEAAyE;AACzE,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAE9C;;;;;;;;;GASG;AACH,MAAM,WAAW,GAAG,oCAAoC,CAAC;AAEzD,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,yGAAyG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CACnI,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,OAAe;IACpE,OAAO,GAAG,yBAAyB,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,SAAiB,EAAE,OAAe;IAC5F,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC9E,CAAC;AAKD;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,qEAAqE;AACrE,MAAM,uBAAuB,GAAG,oEAAoE,CAAC;AAErG;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAC9B,UAAkB;IAElB,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;IAC1C,OAAO,EAAE,SAAS,EAAE,SAAmB,EAAE,YAAY,EAAE,YAAoC,EAAE,CAAC;AAChG,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,oFAAoF;SAC7F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,oIAAoI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;SAC7K,CAAC;IACJ,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAyB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE;QACrD,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,YAAY,IAAI,CAAC,SAAS,WAAW,YAAY,EAAE;QAC/D,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS;QACT,YAAY;QACZ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;QAChC,GAAG,MAAM;KACV,CAAC;IACF,IAAI,CAAC;QACH,eAAe,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,OAAoC,EAAE;IAEtC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,mDACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;SACH,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,uEAAuE;IACvE,4DAA4D;IAC5D,sEAAsE;IACtE,uEAAuE;IACvE,gEAAgE;IAChE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACxC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0BAA0B,QAAQ,KAAK,GAAG,4BAA4B;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,gEAAgE;IAChE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,8DAA8D;IAC9D,+CAA+C;IAC/C,EAAE;IACF,oEAAoE;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,iFAAiF;IACjF,mEAAmE;IACnE,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,iEAAiE;IACjE,oEAAoE;IACpE,qDAAqD;IACrD,EAAE;IACF,sEAAsE;IACtE,+DAA+D;IAC/D,kEAAkE;IAClE,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,qEAAqE;IACrE,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,YAAY,GAA+B;QAC/C,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,0BAA0B,QAAQ,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,UAAU,GAAG;KAChH,CAAC;IACF,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,YAAY,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC;QAChC,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC;QACvG,CAAC;QACD,IAAI,UAAU,KAAK,OAAO;YAAE,OAAO,YAAY,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uDAAuD,QAAQ,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,gDAAgD,QAAQ,EAAE;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,sGAAsG;SAC9I,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uCAAuC,QAAQ,EAAE;SAC1D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAiC,CAAC;IAE/C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,IAAI,YAAY,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,4DAA4D;YAC5D,iEAAiE;YACjE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,QAAQ,2BAA2B,YAAY,CAAC,MAAM,EAAE;aACxF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,8CAA8C,YAAY,CAAC,MAAM,KAAK,QAAQ,GAAG;SAC1F,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,aAAa,KAAK,SAAS,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,uBAAuB,QAAQ,gDAAgD,IAAI,CAAC,SAAS,CAC3F,aAAa,CACd,aAAa,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,cAAc,SAAS,IAAI,OAAO,GAAG;SACjF,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,sEAAsE;IACtE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAW,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,yDAAyD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;SAC7H,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,yDAAyD;IACzD,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,mFAAmF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG;SACjM,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,mEAAmE;IACnE,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,aAAa,IAAI,QAAQ,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;QAC5G,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,QAAQ,2EAA2E,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG;SACnP,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,+BAA+B,CAAC;IAE1E,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,IAAI,YAAY,GAAG,KAAK,GAAG,uBAAuB,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,uBAAuB,QAAQ,uBAAuB,uBAAuB,GAAG,MAAM,uCAAuC,UAAU,EAAE;SAClJ,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,SAAS;IACT,IAAI,KAAK,GAAG,YAAY,GAAG,YAAY,EAAE,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,uBAAuB,QAAQ,0BAA0B,UAAU,EAAE;SAC9E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,mCAAmC,OAAO,KAAK,QAAQ,CAAC,SAAS,aAAa,QAAQ,CAAC,YAAY,iBAAiB,UAAU,EAAE;KACzI,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,SAAiB,EAAE,OAAe;IAC1F,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;AACH,CAAC;AAkBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,GAAU,EACV,YAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,qBAAqB,GAAG,YAAY,IAAI,+BAA+B,CAAC;IAE9E,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,cAA2B,CAAC;IAChC,IAAI,CAAC;QACH,cAAc,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,QAAQ,GAAqD,EAAE,CAAC;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,wBAAwB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,IAAI,YAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,YAAY,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAiC,CAAC;YAC/C,iEAAiE;YACjE,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,8CAA8C;YAC9C,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3F,MAAM,YAAY,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7E,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAChC,+DAA+D;YAC/D,kEAAkE;YAClE,iEAAiE;YACjE,4BAA4B;YAC5B,IAAI,KAAK,GAAG,YAAY,GAAG,qBAAqB,IAAI,YAAY,GAAG,KAAK,GAAG,uBAAuB,EAAE,CAAC;gBACnG,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/lifecycle.d.ts

@@ -10,8 +10,8 @@ export interface ApprovalLifecycle {
 }
 /**
  * Parse the optional `approval_lifecycle` block from a pack config.
- * Best-effort: malformed values fall back to the default (no expiry,
- * legacyMode=false) and write a one-line warning to the supplied
+ * Best-effort: malformed values fall back to the default (the
+ * DEFAULT_BOUNDARY_TOOL_NAMES tool boundary, legacyMode=false) and write a one-line warning to the supplied
  * stderr. The PreToolUse / PostToolUse hooks must keep working even
  * when the operator typed a typo in the YAML.
  */

package/dist/policy-packs/builtin/understanding-before-execution/lifecycle.js

@@ -4,24 +4,31 @@
 // src/policy-packs/builtin/understanding-before-execution/index.ts for
 // the re-exported public surface.
 import { InvalidDurationError, parseDurationSeconds } from "../../../policies/index.js";
-const DEFAULT_LIFECYCLE = {
-    expireOnToolMatch: [],
-    expireOnBashMatch: [],
-    legacyMode: false,
-};
+import { DEFAULT_BOUNDARY_TOOL_NAMES } from "../../../runtime/task-providers/agent-tasks.js";
+/**
+ * Fresh default lifecycle (never a shared mutable object): the default
+ * tool-boundary list, no bash patterns, no TTL.
+ */
+function defaultLifecycle() {
+    return {
+        expireOnToolMatch: [...DEFAULT_BOUNDARY_TOOL_NAMES],
+        expireOnBashMatch: [],
+        legacyMode: false,
+    };
+}
 /**
  * Parse the optional `approval_lifecycle` block from a pack config.
- * Best-effort: malformed values fall back to the default (no expiry,
- * legacyMode=false) and write a one-line warning to the supplied
+ * Best-effort: malformed values fall back to the default (the
+ * DEFAULT_BOUNDARY_TOOL_NAMES tool boundary, legacyMode=false) and write a one-line warning to the supplied
  * stderr. The PreToolUse / PostToolUse hooks must keep working even
  * when the operator typed a typo in the YAML.
  */
 export function parseApprovalLifecycle(raw, stderr) {
     if (raw === undefined || raw === null)
-        return DEFAULT_LIFECYCLE;
+        return defaultLifecycle();
     if (typeof raw !== "object" || Array.isArray(raw)) {
         stderr?.write(`harness pack hook: config.approval_lifecycle ignored (expected object, got ${typeof raw})\n`);
-        return DEFAULT_LIFECYCLE;
+        return defaultLifecycle();
     }
     const obj = raw;
     if (obj["mode"] === "session") {
@@ -33,16 +40,22 @@ export function parseApprovalLifecycle(raw, stderr) {
             legacyMode: true,
         };
     }
-    const expireOnToolMatch = [];
+    let expireOnToolMatch = [];
     const list = obj["expire_on_tool_match"];
-    if (Array.isArray(list)) {
+    if (list === undefined) {
+        expireOnToolMatch = [...DEFAULT_BOUNDARY_TOOL_NAMES];
+    }
+    else if (Array.isArray(list)) {
         for (const v of list) {
             if (typeof v === "string" && v.length > 0)
                 expireOnToolMatch.push(v);
         }
     }
-    else if (list !== undefined) {
-        stderr?.write(`harness pack hook: config.approval_lifecycle.expire_on_tool_match ignored (expected string[], got ${typeof list})\n`);
+    else {
+        // A malformed value falls back to the default list, as the generator
+        // does when it resolves the emitted matcher.
+        expireOnToolMatch = [...DEFAULT_BOUNDARY_TOOL_NAMES];
+        stderr?.write(`harness pack hook: config.approval_lifecycle.expire_on_tool_match ignored (expected string[], got ${typeof list}), using the default boundary tools\n`);
     }
     const expireOnBashMatch = [];
     const bashList = obj["expire_on_bash_match"];

package/dist/policy-packs/builtin/understanding-before-execution/lifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/lifecycle.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,mEAAmE;AACnE,+DAA+D;AAC/D,uEAAuE;AACvE,kCAAkC;AAElC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAiDxF,MAAM,iBAAiB,GAAsB;IAC3C,iBAAiB,EAAE,EAAE;IACrB,iBAAiB,EAAE,EAAE;IACrB,UAAU,EAAE,KAAK;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAY,EACZ,MAA8C;IAE9C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,iBAAiB,CAAC;IAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,KAAK,CACX,8EAA8E,OAAO,GAAG,KAAK,CAC9F,CAAC;QACF,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO;YACL,iBAAiB,EAAE,EAAE;YACrB,iBAAiB,EAAE,EAAE;YACrB,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC3C,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,EAAE,KAAK,CACX,qGAAqG,OAAO,IAAI,KAAK,CACtH,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACtD,IAAI,CAAC;gBACH,iBAAiB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,EAAE,KAAK,CACX,qFAAqF,CAAC,OAAQ,GAAa,CAAC,OAAO,IAAI,CACxH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,KAAK,CACX,qGAAqG,OAAO,QAAQ,KAAK,CAC1H,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO;QACL,iBAAiB;QACjB,iBAAiB;QACjB,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,UAAU,EAAE,KAAK;KAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAClB,SAAkB,EAClB,MAA8C;IAE9C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,OAAO,oBAAoB,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5E,MAAM,EAAE,KAAK,CAAC,iEAAiE,GAAG,IAAI,CAAC,CAAC;YACxF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,EAAE,KAAK,CACX,yGAAyG,OAAO,SAAS,KAAK,CAC/H,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/lifecycle.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,mEAAmE;AACnE,+DAA+D;AAC/D,uEAAuE;AACvE,kCAAkC;AAElC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAoD7F;;;GAGG;AACH,SAAS,gBAAgB;IACvB,OAAO;QACL,iBAAiB,EAAE,CAAC,GAAG,2BAA2B,CAAC;QACnD,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,KAAK;KAClB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAY,EACZ,MAA8C;IAE9C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,gBAAgB,EAAE,CAAC;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,KAAK,CACX,8EAA8E,OAAO,GAAG,KAAK,CAC9F,CAAC;QACF,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO;YACL,iBAAiB,EAAE,EAAE;YACrB,iBAAiB,EAAE,EAAE;YACrB,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC3C,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,GAAa,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,iBAAiB,GAAG,CAAC,GAAG,2BAA2B,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,6CAA6C;QAC7C,iBAAiB,GAAG,CAAC,GAAG,2BAA2B,CAAC,CAAC;QACrD,MAAM,EAAE,KAAK,CACX,qGAAqG,OAAO,IAAI,uCAAuC,CACxJ,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACtD,IAAI,CAAC;gBACH,iBAAiB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,EAAE,KAAK,CACX,qFAAqF,CAAC,OAAQ,GAAa,CAAC,OAAO,IAAI,CACxH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,KAAK,CACX,qGAAqG,OAAO,QAAQ,KAAK,CAC1H,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO;QACL,iBAAiB;QACjB,iBAAiB;QACjB,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,UAAU,EAAE,KAAK;KAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAClB,SAAkB,EAClB,MAA8C;IAE9C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,OAAO,oBAAoB,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5E,MAAM,EAAE,KAAK,CAAC,iEAAiE,GAAG,IAAI,CAAC,CAAC;YACxF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,EAAE,KAAK,CACX,yGAAyG,OAAO,SAAS,KAAK,CAC/H,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/policy-packs/builtin/understanding-before-execution/persisted-reports.d.ts

@@ -523,16 +523,21 @@ export type ApprovedReportHashVerification = {
  * (bytes read or the floor, whichever is larger, whatever the read returned):
  * past the budget the check denies with the mismatch reason (fail closed).
  * That bounds the entries opened (8192) and the bytes read (about 32 MiB, the
- * last file read may add up to the 1 MiB per-file cap). Three costs remain.
- * A legitimate approval whose report sits behind that much newer report data
- * (by name, descending) is denied; re-approving writes a new, newest report
- * and recovers only when the newer entries are real reports: planted `*.json`
- * names that sort after the timestamped report names (for example names
- * starting with a letter) stay newer than any new report and keep denying
- * until removed. The `readdir` plus name sort of the directory itself are not
- * charged, so a directory of millions of entries still costs that listing
- * before this scan starts (the scan runs when a signed marker is present). The
- * hash scan is not the whole hook: the other full-directory reads on it (the
+ * last file read may add up to the 1 MiB per-file cap). The directory listing
+ * is bounded as well ({@link listDirNamesBounded}, one entry at a time): past
+ * {@link MAX_HOOK_LISTING_ENTRIES} `*.json` entries, or twice that many entries
+ * of any name, the check opens nothing and denies with a reason that names the
+ * bound and the remedy (fail closed), so the listing cost is bounded by that
+ * count however many names are planted. Two costs remain. A legitimate
+ * approval whose report sits behind that much newer report data (by name,
+ * descending) is denied; re-approving writes a new, newest report and recovers
+ * only when the newer entries are real reports: planted `*.json` names that
+ * sort after the timestamped report names (for example names starting with a
+ * letter) stay newer than any new report and keep denying until removed (the
+ * same holds past the entry bound, where the scan does not start at all).
+ * A reports directory with more entries than the bound is denied even when the
+ * approved report is among them, until entries are removed by hand. The hash
+ * scan is not the whole hook: the other full-directory reads on it (the
  * evidence read, the auto-approval listing, the delegation lookup and the
  * parse-error lookup) list the directory entry by entry and stop once
  * {@link MAX_HOOK_LISTING_ENTRIES} entries are crossed, and charge the entries

package/dist/policy-packs/builtin/understanding-before-execution/persisted-reports.js

@@ -824,22 +824,34 @@ export function canonicalReportHashOfFile(filePath, opts = {}) {
  * and `MIN_SCAN_ENTRY_COST_BYTES`; once the charges reach `MAX_HASH_SCAN_BYTES`
  * with a wanted hash still unfound the scan stops and sets `budgetExhausted`,
  * so the number of entries opened and the bytes read (about 32 MiB, the last
- * file read may add up to the per-file cap) are both bounded by the budget,
- * however many entries the directory holds. The `readdir` and the name sort
- * of the directory itself are outside the budget. The evidence read a refused
- * marker falls through to has its own entry bound
- * ({@link MAX_HOOK_LISTING_ENTRIES}).
+ * file read may add up to the per-file cap) are both bounded by the budget.
+ *
+ * The directory is listed through {@link listDirNamesBounded}, one entry at a
+ * time, so the listing is bounded too: it stops as soon as it has seen more
+ * than {@link MAX_HOOK_LISTING_ENTRIES} `*.json` names, or twice that many
+ * entries of any name, and then no entry is opened and the scan sets
+ * `truncated` (the caller denies: fail closed). Within those bounds the
+ * selection is unchanged: every `*.json` name, newest first (descending byte
+ * order), within the byte budget. Planted names that sort after the report
+ * names are read first, so they spend the budget before the real report is
+ * reached once they and the other entries add up to 32 MiB of charges; past
+ * the entry bound the scan does not start. Either way it denies, never
+ * allows.
  */
 function scanReportHashes(dir, wanted) {
-    const scan = { files: 0, matched: new Set(), budgetExhausted: false };
-    let names;
-    try {
-        names = fs.readdirSync(dir);
-    }
-    catch {
+    const scan = {
+        files: 0,
+        matched: new Set(),
+        budgetExhausted: false,
+        truncated: false,
+    };
+    const listed = listDirNamesBounded(dir, ".json", MAX_HOOK_LISTING_ENTRIES);
+    if (listed.truncated) {
+        scan.truncated = true;
         return scan;
     }
-    names = names.filter((name) => name.endsWith(".json")).sort().reverse();
+    // Ascending byte order from the listing; the scan takes the newest name first.
+    const names = listed.names.reverse();
     let hashedBytes = 0; // budget charged so far, see the charge below
     for (const name of names) {
         scan.files += 1;
@@ -903,16 +915,21 @@ function scanReportHashes(dir, wanted) {
  * (bytes read or the floor, whichever is larger, whatever the read returned):
  * past the budget the check denies with the mismatch reason (fail closed).
  * That bounds the entries opened (8192) and the bytes read (about 32 MiB, the
- * last file read may add up to the 1 MiB per-file cap). Three costs remain.
- * A legitimate approval whose report sits behind that much newer report data
- * (by name, descending) is denied; re-approving writes a new, newest report
- * and recovers only when the newer entries are real reports: planted `*.json`
- * names that sort after the timestamped report names (for example names
- * starting with a letter) stay newer than any new report and keep denying
- * until removed. The `readdir` plus name sort of the directory itself are not
- * charged, so a directory of millions of entries still costs that listing
- * before this scan starts (the scan runs when a signed marker is present). The
- * hash scan is not the whole hook: the other full-directory reads on it (the
+ * last file read may add up to the 1 MiB per-file cap). The directory listing
+ * is bounded as well ({@link listDirNamesBounded}, one entry at a time): past
+ * {@link MAX_HOOK_LISTING_ENTRIES} `*.json` entries, or twice that many entries
+ * of any name, the check opens nothing and denies with a reason that names the
+ * bound and the remedy (fail closed), so the listing cost is bounded by that
+ * count however many names are planted. Two costs remain. A legitimate
+ * approval whose report sits behind that much newer report data (by name,
+ * descending) is denied; re-approving writes a new, newest report and recovers
+ * only when the newer entries are real reports: planted `*.json` names that
+ * sort after the timestamped report names (for example names starting with a
+ * letter) stay newer than any new report and keep denying until removed (the
+ * same holds past the entry bound, where the scan does not start at all).
+ * A reports directory with more entries than the bound is denied even when the
+ * approved report is among them, until entries are removed by hand. The hash
+ * scan is not the whole hook: the other full-directory reads on it (the
  * evidence read, the auto-approval listing, the delegation lookup and the
  * parse-error lookup) list the directory entry by entry and stop once
  * {@link MAX_HOOK_LISTING_ENTRIES} entries are crossed, and charge the entries
@@ -951,6 +968,18 @@ export function verifyApprovedReportHash(reportsDir, primary, fallback = null) {
         wanted.add(fallback.reportContentHash);
     }
     const scan = scanReportHashes(reportsDir, wanted);
+    if (scan.truncated) {
+        // Checked before the "no report file" allow below: a directory too large
+        // to list holds report files the gate did not read, so it is not empty.
+        const truncatedKinds = fallback !== null
+            ? `${primary.kind} and ${fallback.kind} approval markers were`
+            : `${primary.kind} approval marker was`;
+        return {
+            ok: false,
+            detail: `no report in the reports directory could be checked against the content the ${truncatedKinds} signed for ` +
+                `(the reports directory ${reportsDir} ${ENTRIES_TRUNCATED_DETAIL})`,
+        };
+    }
     if (scan.files === 0 || scan.matched.has(primary.reportContentHash)) {
         return { ok: true, kind: primary.kind };
     }