@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/cli/delegate/index.js

@@ -1,443 +0,0 @@
-// `harness delegate`: slice 3 of docs/decisions/2026-08-27-ug-auto-mode-approval.md
-// ("`claude -p` child processes", "Delegation marker shape", "TTL, cwd,
-// and subagents"), acceptance criterion 1.
-//
-// Issues a signed delegation for a headless `claude -p` child session,
-// bound to an already-approved PARENT session. The delegation is a
-// PRE-AUTHORIZATION, not an approval (key one of the ADR's two-key
-// design): it supplies the trusted signal and the parent linkage; the
-// child's own Understanding Report (key two) is still checked, and its
-// auto-marker still minted, by the child's own PreToolUse hook: nothing
-// here opens a gate.
-//
-// `issueDelegation` is an in-process function, never calling
-// `process.exit`, so the smoke runner (a future consumer, ADR "TTL, cwd,
-// and subagents": "The harness smoke runner ... is the natural first
-// consumer") and tests can call it directly. The CLI wiring in
-// `src/cli/index.ts` is a thin wrapper: flag parsing, one CLI-level
-// usage check with the exact ADR-specified message, and printing the
-// result in the approve CLI's line style.
-//
-// PARENT SESSION RESOLUTION mirrors `harness approve understanding`
-// exactly (flag > $CLAUDE_CODE_SESSION_ID > $CLAUDE_SESSION_ID >
-// $CODEX_SESSION_ID > staged .pending-approval), via the same
-// `resolveApprovalSessionId` helper, with NO newest-report fallback
-// (delegation has no report of its own to guess a session from).
-//
-// LEDGER SOURCE: the ledger fact this verb writes uses its own fixed
-// source tag `harness-delegate-cli` (ADR "Audit and doctor"), distinct
-// from `harness approve understanding`'s `harness-approve-understanding`.
-// Reused directly: the approve CLI's `writeLedgerTag` now takes `source`
-// as an additive parameter (default unchanged, so `approveUnderstanding`'s
-// own call is unaffected) so this verb does not re-implement the same
-// findGroundingMcp + addLedgerFact shape `branch-protection.ts` already
-// carries its own independent copy of. There is no actor field to stamp
-// on a delegation and no `--approved-by` flag to override the source:
-// the delegation's signed `approvedBy` string is the packed
-// `delegated:<parent>;cwd=...;task=...;expires=...` tuple
-// (delegation-markers.ts), which has no room for one, and the ADR rules
-// out adding a new required signed field (a `SIGNING_ALG` bump; only an
-// optional field left out of the payload when absent, like `claimTaskId`,
-// keeps the old bytes).
-//
-// REPORT FALLBACK (`--report <path>`): binds the launcher-supplied
-// report by BOTH its content (`reportContentHash`) and its path
-// (`reportPathHash`, via the same `hashDelegationCwd` the cwd binding
-// uses, so both sides of the delegation hash paths the same way). The
-// path bound is NOT the operator's original `--report` argument: this
-// verb COPIES the file (mode 0600) to the conventional location
-// `delegationReportPathFor` derives from the child session id
-// (`harness.generated/.delegation-reports/<child-sid>.md`) and hashes
-// THAT path instead. The child's PreToolUse hook has no channel to learn
-// an arbitrary operator-chosen path, so binding the original path would
-// leave the hook unable to derive it, exactly the gap agent-tasks
-// 49d1ee41 closes; the conventional path is the one location both the
-// writer here and the hook can compute from nothing but a session id.
-// The copy step never silently overwrites a DIFFERENT file already
-// staged there (see `report-conflict` below): the conventional location
-// is per-child, not per-delegation, so re-delegating the same child with
-// a changed report is a caller error to surface loudly, not a quiet
-// clobber of whatever the hook may already be mid-verification against.
-import * as fs from "node:fs";
-import { parseReport } from "@lannguyensi/understanding-gate";
-import { sha256Hex, signingKeyExists, signingKeyPathFor } from "../../runtime/approval-signing.js";
-import { atomicWriteFile } from "../../io/atomic-write.js";
-import { resolveGeneratedDir } from "../../runtime/pending-approval.js";
-import { resolveApprovalSessionId } from "../../runtime/session-id.js";
-import { checkSessionApprovalMarker, delegationReportPathFor, hashDelegationCwd, parseApprovalLifecycle, writeDelegationMarker, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
-import { readRegularFileRejectingSymlink } from "../../io/read-regular-file.js";
-import { resolveMode, toPackageMode } from "../../policy-packs/builtin/understanding-before-execution.js";
-import { loadDeclaredUnderstandingPack, writeLedgerTag } from "../approve/understanding.js";
-import { resolvePaths } from "../loader.js";
-/** Default delegation lifetime when neither `--ttl` nor the pack's `approval_lifecycle.max_age` is set (ADR "TTL, cwd, and subagents"). */
-export const DEFAULT_DELEGATION_TTL_SECONDS = 3600;
-/** Default ledger `source` tag for the audit-only fact this verb writes (ADR "Audit and doctor"). */
-export const DEFAULT_DELEGATE_LEDGER_SOURCE = "harness-delegate-cli";
-/** Ceiling for an explicit `--ttl` when the applied pack sets no `approval_lifecycle.max_age` (L4 fix, agent-tasks 37ad0b05: an unbounded `--ttl` would otherwise let a caller mint a delegation that outlives any lifetime the pack's own policy intends). */
-export const MAX_DELEGATION_TTL_SECONDS = 24 * 60 * 60;
-/** Same 8-4-4-4-12 hex shape the session-id helpers already validate a Claude Code session id against (`session-id.ts`'s `SESSION_TRANSCRIPT_RE`), case-insensitive. */
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/** The exact usage message the ADR pins for a delegation with no binding (AC 1). Shared so the CLI's early usage check and this function's own refusal read identically. */
-export const NO_BINDING_MESSAGE = "a delegation must bind a cwd or a task";
-/** The `understanding-delegated:<child-sid>:<parent-sid>` ledger fact content (ADR "Audit and doctor"). */
-export function delegationLedgerFactFor(childSessionId, parentSessionId) {
-    return `understanding-delegated:${childSessionId}:${parentSessionId}`;
-}
-/** Control characters rejected from a raw `--task` value, mirroring the `CONTROL_CHARS` check `delegation-markers.ts` already runs on `parentSessionId` (not exported, so mirrored rather than imported). */
-const TASK_ID_CONTROL_CHARS = /[\x00-\x1f\x7f]/;
-/**
- * Validate a raw `--task` value before it ever reaches
- * `writeDelegationMarker` (L1 fix, agent-tasks 37ad0b05: an unvalidated
- * `--task` used to surface downstream as an opaque `write-failed`, or
- * silently rebind, depending on the value). Mirrors
- * `delegation-markers.ts`'s own (unexported) `rejectUnsafeSegmentValue`:
- * empty, or carrying a `;`/`=` segment delimiter, both corrupt the
- * packed `approvedBy` encoding, plus the reserved unbound literal
- * `"-"` (would silently round-trip as "no task bound") and a control
- * character. Returns a detail string on a rejected value, `null` on a
- * safe one.
- */
-function validateTaskId(taskId) {
-    if (taskId.length === 0) {
-        return "--task must not be empty";
-    }
-    if (taskId === "-") {
-        return '--task must not be the reserved unbound literal "-"';
-    }
-    if (taskId.includes(";") || taskId.includes("=")) {
-        return `--task must not contain a delegation-segment delimiter (";" or "="): ${JSON.stringify(taskId)}`;
-    }
-    if (TASK_ID_CONTROL_CHARS.test(taskId)) {
-        return `--task must not contain a control character: ${JSON.stringify(taskId)}`;
-    }
-    return null;
-}
-/**
- * Issue a signed delegation marker for a `claude -p` child session. Never
- * calls `process.exit`; every failure mode is a `{ ok: false }` result
- * with a distinct `reason` (ADR slice plan format rule: every refusal is
- * a block with a distinct diagnostic, never a fall-through to allow).
- *
- * Consumption is Claude Code only: the Codex adapter has no delegation
- * consumer (`hook-codex-pre-tool-use.ts` reads neither `.delegations/` nor
- * a child report through this mechanism), so a Codex session can never be
- * the delegated CHILD of this verb. Issuing is a separate question and is
- * NOT restricted the same way: the parent-session resolution below reads
- * `$CODEX_SESSION_ID` like any other tier, and the parent-marker check
- * that follows accepts any validly signed marker regardless of which
- * hook minted it, so a Codex session holding one can be the delegating
- * PARENT of a Claude `-p` child today. Both are a decided platform
- * boundary, not an oversight, see the "Platform scope" amendment in
- * `docs/decisions/2026-08-27-ug-auto-mode-approval.md` and gap 14 in
- * `docs/okf/codex-adapter-parity-gaps.md`.
- */
-export async function issueDelegation(opts) {
-    if (!UUID_RE.test(opts.childSessionId)) {
-        return {
-            ok: false,
-            reason: "invalid-child-session",
-            detail: `--child-session must be a UUID (8-4-4-4-12 hex, case-insensitive): got ${JSON.stringify(opts.childSessionId)}`,
-        };
-    }
-    if (opts.cwd === undefined && opts.taskId === undefined) {
-        return { ok: false, reason: "no-binding", detail: NO_BINDING_MESSAGE };
-    }
-    // L3 fix (agent-tasks 37ad0b05): an empty `--cwd` used to fall through
-    // uncaught, and `hashDelegationCwd("")` -> `path.resolve("")` silently
-    // rebinds it to the issuer's OWN cwd rather than refusing. Caught here,
-    // alongside the no-binding check, before either value reaches a hash.
-    if (opts.cwd !== undefined && opts.cwd.length === 0) {
-        return {
-            ok: false,
-            reason: "invalid-cwd",
-            detail: "--cwd must not be empty (an empty value would silently rebind to the issuer's own cwd via path.resolve)",
-        };
-    }
-    if (opts.taskId !== undefined) {
-        const taskError = validateTaskId(opts.taskId);
-        if (taskError !== null) {
-            return { ok: false, reason: "invalid-task", detail: taskError };
-        }
-    }
-    const generatedDir = opts.generatedDir ??
-        resolveGeneratedDir({
-            ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
-            manifestPath: resolvePaths(opts).base,
-        });
-    // Signing-key precheck FIRST, before resolving or checking the parent
-    // marker at all. `checkApprovalMarker`'s own read path (via
-    // `verifyMarkerSignature` -> `getOrCreateSigningKey`) self-heals a
-    // missing key by CREATING one as a side effect of verification, that
-    // is correct for the gate's read side (delegation-markers.ts's own
-    // doc comment on `verifyDelegation` explains why), but it would mean
-    // this precheck could never observe a genuinely absent key if it ran
-    // after the parent-marker check: by the time that check returns, a
-    // key would already exist again. Checking here, before either
-    // resolveApprovalSessionId or checkApprovalMarker touches the
-    // filesystem, is what keeps "no operator signing key" a real,
-    // independently reachable refusal rather than one only writeDelegationMarker's
-    // own (necessarily later) precheck could ever see.
-    if (!signingKeyExists(generatedDir)) {
-        return {
-            ok: false,
-            reason: "signing-key-absent",
-            detail: `no operator signing key at ${signingKeyPathFor(generatedDir)}; refusing to delegate (key creation is an operator-side act, never a side effect of delegating)`,
-        };
-    }
-    // Parent session resolution: exactly the `harness approve
-    // understanding` precedence chain (flag > $CLAUDE_CODE_SESSION_ID >
-    // $CLAUDE_SESSION_ID > $CODEX_SESSION_ID > staged .pending-approval),
-    // with NO 6th-tier newest-report fallback: a delegation has no report
-    // of its own to guess a parent session from, and guessing the PARENT
-    // wrong here would mint a pre-authorization under the wrong identity.
-    const resolvedParent = resolveApprovalSessionId({
-        session: opts.parentSessionId,
-        generatedDir,
-    });
-    const parentSessionId = resolvedParent.sessionId;
-    if (parentSessionId === "") {
-        return {
-            ok: false,
-            reason: "parent-session-unresolved",
-            detail: "no parent session id available. Pass --session-id <id>, or set one of " +
-                "$CLAUDE_CODE_SESSION_ID / $CLAUDE_SESSION_ID / $CODEX_SESSION_ID, or run " +
-                "`harness preflight` (or trip the gate once) so harness.generated/.pending-approval is staged.",
-        };
-    }
-    // Manifest: best-effort, exactly like the approve CLI (shared via
-    // `loadDeclaredUnderstandingPack`, agent-tasks 37ad0b05). A load
-    // failure here degrades the TTL default (falls back to the hardcoded
-    // default below) and the ledger write (audit-only, never a refusal)
-    // but never blocks issuing the delegation itself.
-    const { manifest, manifestLoadError, declaredPack } = loadDeclaredUnderstandingPack(opts);
-    const lifecycle = parseApprovalLifecycle(declaredPack.config["approval_lifecycle"]);
-    // Key one of the ADR's two-key design: the parent must already carry a
-    // valid, unexpired, signed approval marker. Same session-marker check
-    // the gate itself runs (`checkSessionApprovalMarker`: signature,
-    // `max_age`, and, outside `mode: session`, the task binding of task
-    // 5018c0c4, so a parent approval granted for another task does not
-    // count), same `max_age` bound.
-    const parentCheck = checkSessionApprovalMarker(generatedDir, parentSessionId, {
-        ...(lifecycle.maxAgeMs !== undefined ? { maxAgeMs: lifecycle.maxAgeMs } : {}),
-        ...(opts.now !== undefined ? { now: opts.now } : {}),
-        taskBinding: !lifecycle.legacyMode,
-    });
-    if (!parentCheck.matched) {
-        const reason = parentCheck.forged
-            ? "parent-marker-forged"
-            : parentCheck.expired
-                ? "parent-marker-expired"
-                : "parent-marker-missing";
-        return { ok: false, reason, detail: parentCheck.detail };
-    }
-    const now = opts.now ?? new Date();
-    // L2/L4 fix (agent-tasks 37ad0b05): an explicit `--ttl` is validated
-    // and clamped BEFORE it can reach `expiresAt`. `ttlSeconds <= 0` (or
-    // non-finite) used to mint a delegation that is already expired
-    // (L2); an unbounded `--ttl` used to let a caller mint one that
-    // outlives the applied pack's own `approval_lifecycle.max_age` (L4,
-    // or the 24h default ceiling when the pack sets none). Only an
-    // EXPLICIT `--ttl` is checked here: the computed default below (from
-    // `max_age` or the hardcoded default) is by construction already
-    // within whichever ceiling would apply to it.
-    let ttlSeconds;
-    if (opts.ttlSeconds !== undefined) {
-        if (!Number.isFinite(opts.ttlSeconds) || opts.ttlSeconds <= 0) {
-            return {
-                ok: false,
-                reason: "invalid-ttl",
-                detail: `--ttl must resolve to a positive, finite number of seconds; got ${opts.ttlSeconds}`,
-            };
-        }
-        const ceilingSeconds = lifecycle.maxAgeMs !== undefined
-            ? Math.round(lifecycle.maxAgeMs / 1_000)
-            : MAX_DELEGATION_TTL_SECONDS;
-        if (opts.ttlSeconds > ceilingSeconds) {
-            return {
-                ok: false,
-                reason: "ttl-above-max-age",
-                detail: lifecycle.maxAgeMs !== undefined
-                    ? `--ttl (${opts.ttlSeconds}s) exceeds the applied pack's approval_lifecycle.max_age (${ceilingSeconds}s)`
-                    : `--ttl (${opts.ttlSeconds}s) exceeds the default ${ceilingSeconds}s (24h) ceiling; set approval_lifecycle.max_age to raise it`,
-            };
-        }
-        ttlSeconds = opts.ttlSeconds;
-    }
-    else {
-        ttlSeconds =
-            lifecycle.maxAgeMs !== undefined
-                ? Math.round(lifecycle.maxAgeMs / 1_000)
-                : DEFAULT_DELEGATION_TTL_SECONDS;
-    }
-    const expiresAt = new Date(now.getTime() + ttlSeconds * 1_000).toISOString();
-    // Fallback shape: bind the launcher-supplied report by BOTH its
-    // content and its path (delegation-markers.ts, "Delegation marker
-    // shape" table: half a binding is worse than none). The path bound is
-    // the CONVENTIONAL copy this verb writes, not the operator's original
-    // `--report` argument (module header, "REPORT FALLBACK").
-    let reportPathHash;
-    let reportContentHash;
-    if (opts.reportPath !== undefined) {
-        const read = readRegularFileRejectingSymlink(opts.reportPath);
-        if (read.kind !== "ok") {
-            return {
-                ok: false,
-                reason: "report-unreadable",
-                detail: `--report ${opts.reportPath} could not be read (${read.kind})`,
-            };
-        }
-        reportContentHash = sha256Hex(read.content);
-        // Validate parseability NOW, with the SAME parser AND the SAME
-        // gap-fill mode `persistStdinReport` applies when the child's hook
-        // later tries to mint from this report (`stdin-report.ts`'s own
-        // `parseReport` call, `mode: toPackageMode(resolveMode(declared).mode)`
-        // at hook-pre-tool-use.ts). A hardcoded `"fast_confirm"` here would
-        // let a short-form report pass staging and then fail persist under
-        // an operator's actually-configured `grill_me`, blocking the child
-        // with no retry available (see below). Refusing an unparseable
-        // `--report` file here, before anything is signed or staged, matters
-        // because a failure caught only at mint time is not cheaply
-        // retryable: the adoption ledger records the report's content hash
-        // as spent BEFORE `persistStdinReport` even runs, so a bad report
-        // permanently spends that content hash, and this verb's own
-        // `report-conflict` refusal then blocks re-staging different content
-        // at the same conventional path until the file is removed by hand.
-        // Catching it here costs nothing and needs no manual cleanup.
-        const parsed = parseReport(read.content, {
-            taskId: opts.childSessionId,
-            createdAt: now.toISOString(),
-            mode: toPackageMode(resolveMode(declaredPack).mode),
-            riskLevel: "medium",
-        });
-        if (!parsed.ok) {
-            const summary = parsed.error.message.length > 0
-                ? parsed.error.message
-                : `${parsed.error.reason}${parsed.error.missing.length > 0 ? ` (missing: ${parsed.error.missing.join(", ")})` : ""}`;
-            return {
-                ok: false,
-                reason: "report-unparseable",
-                detail: `--report ${opts.reportPath} did not parse: ${summary}`,
-            };
-        }
-        // Stage the conventional copy the child's hook will read back from.
-        // Never a silent overwrite: a DIFFERENT file already staged there
-        // (a stale copy from an earlier `--report` targeting the same
-        // child session id, or anything else) is a refusal, not a clobber.
-        // An IDENTICAL file already staged there is left as-is (idempotent
-        // re-delegation of the same child with the same report).
-        const conventionalPath = delegationReportPathFor(generatedDir, opts.childSessionId);
-        const existingAtConventional = readRegularFileRejectingSymlink(conventionalPath);
-        if (existingAtConventional.kind === "symlink" || existingAtConventional.kind === "not-regular") {
-            return {
-                ok: false,
-                reason: "report-conflict",
-                detail: `${conventionalPath} exists and is not a plain file; refusing to write the launcher-supplied report through it`,
-            };
-        }
-        if (existingAtConventional.kind === "unreadable") {
-            return {
-                ok: false,
-                reason: "report-conflict",
-                detail: `${conventionalPath} exists but could not be read (I/O error); refusing to overwrite it without first confirming its content matches`,
-            };
-        }
-        if (existingAtConventional.kind === "ok" && existingAtConventional.content !== read.content) {
-            return {
-                ok: false,
-                reason: "report-conflict",
-                detail: `a different report is already staged at ${conventionalPath} for child session ${opts.childSessionId}; refusing to overwrite it (no silent overwrite). Remove it first if the new --report content is intentional.`,
-            };
-        }
-        if (existingAtConventional.kind === "missing") {
-            try {
-                atomicWriteFile(conventionalPath, read.content, { mode: 0o600 });
-            }
-            catch (err) {
-                return {
-                    ok: false,
-                    reason: "write-failed",
-                    detail: `could not stage the launcher-supplied report at ${conventionalPath}: ${err instanceof Error ? err.message : String(err)}`,
-                };
-            }
-        }
-        else {
-            // `existingAtConventional.kind === "ok"` with matching content:
-            // already staged, nothing to WRITE, but the pack doc promises mode
-            // 0600 for the conventional copy unconditionally, not only on
-            // first write, so a pre-existing identical file left at a looser
-            // mode by something other than this verb is still brought to 0600
-            // on restage.
-            try {
-                fs.chmodSync(conventionalPath, 0o600);
-            }
-            catch (err) {
-                return {
-                    ok: false,
-                    reason: "write-failed",
-                    detail: `could not set mode 0600 on the already-staged report at ${conventionalPath}: ${err instanceof Error ? err.message : String(err)}`,
-                };
-            }
-        }
-        reportPathHash = hashDelegationCwd(conventionalPath);
-    }
-    const cwdHash = opts.cwd !== undefined ? hashDelegationCwd(opts.cwd) : null;
-    const taskId = opts.taskId !== undefined ? opts.taskId : null;
-    const writeResult = writeDelegationMarker({
-        generatedDir,
-        childSessionId: opts.childSessionId,
-        parentSessionId,
-        cwdHash,
-        taskId,
-        expiresAt,
-        ...(reportPathHash !== undefined ? { reportPathHash } : {}),
-        ...(reportContentHash !== undefined ? { reportContentHash } : {}),
-        now,
-    });
-    if (!writeResult.ok) {
-        if (writeResult.reason === "signing-key-absent") {
-            return { ok: false, reason: "signing-key-absent", detail: writeResult.detail };
-        }
-        if (writeResult.reason === "invalid-input") {
-            // Reachable: a malformed raw parent session id (`--session-id`, or
-            // a value read from $CLAUDE_CODE_SESSION_ID / $CLAUDE_SESSION_ID /
-            // $CODEX_SESSION_ID / a staged .pending-approval) still reaches
-            // `buildDelegationApprovedBy`'s `rejectMalformedSessionId` /
-            // `rejectUnsafeSegmentValue` checks on `parentSessionId`
-            // unvalidated by this function. `--task` no longer reaches this
-            // branch: its own value is now validated (the `invalid-task`
-            // refusal above) before `writeDelegationMarker` is ever called.
-            // Mapped to its own reason rather than folded into "write-failed",
-            // so a malformed parent session id fails closed with a diagnostic
-            // distinct from a genuine I/O write failure.
-            return { ok: false, reason: "invalid-input", detail: writeResult.detail };
-        }
-        return { ok: false, reason: "write-failed", detail: writeResult.detail };
-    }
-    const ledgerContent = delegationLedgerFactFor(opts.childSessionId, parentSessionId);
-    let ledgerResult;
-    if (opts.ledgerAdd) {
-        ledgerResult = await opts.ledgerAdd(opts.childSessionId, ledgerContent);
-    }
-    else if (manifest) {
-        ledgerResult = await writeLedgerTag(manifest, opts.childSessionId, ledgerContent, {}, DEFAULT_DELEGATE_LEDGER_SOURCE);
-    }
-    else {
-        ledgerResult = {
-            ok: false,
-            reason: manifestLoadError
-                ? `manifest unreadable (${manifestLoadError}); skipped ledger write`
-                : "manifest unreadable; skipped ledger write",
-        };
-    }
-    return {
-        ok: true,
-        filePath: writeResult.filePath,
-        parentSessionId,
-        childSessionId: opts.childSessionId,
-        expiresAt,
-        ledgerFact: ledgerResult.ok
-            ? { written: true }
-            : { written: false, reason: ledgerResult.reason },
-    };
-}
-//# sourceMappingURL=index.js.map

package/dist/cli/delegate/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/delegate/index.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wEAAwE;AACxE,2CAA2C;AAC3C,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,mEAAmE;AACnE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,qBAAqB;AACrB,EAAE;AACF,6DAA6D;AAC7D,yEAAyE;AACzE,qEAAqE;AACrE,+DAA+D;AAC/D,oEAAoE;AACpE,qEAAqE;AACrE,0CAA0C;AAC1C,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,8DAA8D;AAC9D,oEAAoE;AACpE,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,4DAA4D;AAC5D,0DAA0D;AAC1D,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,wBAAwB;AACxB,EAAE;AACF,mEAAmE;AACnE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,8DAA8D;AAC9D,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,kEAAkE;AAClE,sEAAsE;AACtE,sEAAsE;AACtE,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AACzE,oEAAoE;AACpE,wEAAwE;AAExE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE1G,OAAO,EAAE,6BAA6B,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAEhE,2IAA2I;AAC3I,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,qGAAqG;AACrG,MAAM,CAAC,MAAM,8BAA8B,GAAG,sBAAsB,CAAC;AAErE,+PAA+P;AAC/P,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEvD,wKAAwK;AACxK,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,4KAA4K;AAC5K,MAAM,CAAC,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AA0D3E,2GAA2G;AAC3G,MAAM,UAAU,uBAAuB,CAAC,cAAsB,EAAE,eAAuB;IACrF,OAAO,2BAA2B,cAAc,IAAI,eAAe,EAAE,CAAC;AACxE,CAAC;AAED,6MAA6M;AAC7M,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,wEAAwE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1G,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,gDAAgD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA4B;IAE5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE,0EAA0E,IAAI,CAAC,SAAS,CAC9F,IAAI,CAAC,cAAc,CACpB,EAAE;SACJ,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACzE,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,yGAAyG;SAC5G,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,mBAAmB,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI;SACtC,CAAC,CAAC;IAEL,sEAAsE;IACtE,4DAA4D;IAC5D,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,mEAAmE;IACnE,8DAA8D;IAC9D,8DAA8D;IAC9D,8DAA8D;IAC9D,+EAA+E;IAC/E,mDAAmD;IACnD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,8BAA8B,iBAAiB,CACrD,YAAY,CACb,kGAAkG;SACpG,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,cAAc,GAAG,wBAAwB,CAAC;QAC9C,OAAO,EAAE,IAAI,CAAC,eAAe;QAC7B,YAAY;KACb,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,cAAc,CAAC,SAAS,CAAC;IACjD,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2BAA2B;YACnC,MAAM,EACJ,wEAAwE;gBACxE,2EAA2E;gBAC3E,+FAA+F;SAClG,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,kDAAkD;IAClD,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,sBAAsB,CACrC,YAAY,CAAC,MAAkC,CAAC,oBAAoB,CAAC,CACvE,CAAC;IAEF,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,oEAAoE;IACpE,mEAAmE;IACnE,gCAAgC;IAChC,MAAM,WAAW,GAAG,0BAA0B,CAAC,YAAY,EAAE,eAAe,EAAE;QAC5E,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,WAAW,EAAE,CAAC,SAAS,CAAC,UAAU;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAiC,WAAW,CAAC,MAAM;YAC7D,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,WAAW,CAAC,OAAO;gBACnB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,uBAAuB,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,gEAAgE;IAChE,oEAAoE;IACpE,+DAA+D;IAC/D,qEAAqE;IACrE,iEAAiE;IACjE,8CAA8C;IAC9C,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,mEAAmE,IAAI,CAAC,UAAU,EAAE;aAC7F,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAClB,SAAS,CAAC,QAAQ,KAAK,SAAS;YAC9B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC;YACxC,CAAC,CAAC,0BAA0B,CAAC;QACjC,IAAI,IAAI,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;YACrC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EACJ,SAAS,CAAC,QAAQ,KAAK,SAAS;oBAC9B,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,6DAA6D,cAAc,IAAI;oBAC1G,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,0BAA0B,cAAc,6DAA6D;aACrI,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,UAAU;YACR,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACxC,CAAC,CAAC,8BAA8B,CAAC;IACvC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAE7E,gEAAgE;IAChE,kEAAkE;IAClE,sEAAsE;IACtE,sEAAsE;IACtE,0DAA0D;IAC1D,IAAI,cAAkC,CAAC;IACvC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,YAAY,IAAI,CAAC,UAAU,uBAAuB,IAAI,CAAC,IAAI,GAAG;aACvE,CAAC;QACJ,CAAC;QACD,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE5C,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,wEAAwE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,mEAAmE;QACnE,+DAA+D;QAC/D,qEAAqE;QACrE,4DAA4D;QAC5D,mEAAmE;QACnE,kEAAkE;QAClE,4DAA4D;QAC5D,qEAAqE;QACrE,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE;YACvC,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC;YACnD,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,OAAO,GACX,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAC7B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO;gBACtB,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GACpB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EACvF,EAAE,CAAC;YACT,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,oBAAoB;gBAC5B,MAAM,EAAE,YAAY,IAAI,CAAC,UAAU,mBAAmB,OAAO,EAAE;aAChE,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,8DAA8D;QAC9D,mEAAmE;QACnE,mEAAmE;QACnE,yDAAyD;QACzD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACpF,MAAM,sBAAsB,GAAG,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;QACjF,IAAI,sBAAsB,CAAC,IAAI,KAAK,SAAS,IAAI,sBAAsB,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC/F,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,GAAG,gBAAgB,4FAA4F;aACxH,CAAC;QACJ,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,GAAG,gBAAgB,kHAAkH;aAC9I,CAAC;QACJ,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,KAAK,IAAI,IAAI,sBAAsB,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5F,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,2CAA2C,gBAAgB,sBAAsB,IAAI,CAAC,cAAc,+GAA+G;aAC5N,CAAC;QACJ,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,cAAc;oBACtB,MAAM,EAAE,mDAAmD,gBAAgB,KACzE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,gEAAgE;YAChE,mEAAmE;YACnE,8DAA8D;YAC9D,iEAAiE;YACjE,kEAAkE;YAClE,cAAc;YACd,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,cAAc;oBACtB,MAAM,EAAE,2DAA2D,gBAAgB,KACjF,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,cAAc,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9D,MAAM,WAAW,GAAG,qBAAqB,CAAC;QACxC,YAAY;QACZ,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,eAAe;QACf,OAAO;QACP,MAAM;QACN,SAAS;QACT,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,IAAI,WAAW,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC3C,mEAAmE;YACnE,mEAAmE;YACnE,gEAAgE;YAChE,6DAA6D;YAC7D,yDAAyD;YACzD,gEAAgE;YAChE,6DAA6D;YAC7D,gEAAgE;YAChE,mEAAmE;YACnE,kEAAkE;YAClE,6CAA6C;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACpF,IAAI,YAA0D,CAAC;IAC/D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,YAAY,GAAG,MAAM,cAAc,CACjC,QAAQ,EACR,IAAI,CAAC,cAAc,EACnB,aAAa,EACb,EAAE,EACF,8BAA8B,CAC/B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,YAAY,GAAG;YACb,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB;gBACvB,CAAC,CAAC,wBAAwB,iBAAiB,yBAAyB;gBACpE,CAAC,CAAC,2CAA2C;SAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,SAAS;QACT,UAAU,EAAE,YAAY,CAAC,EAAE;YACzB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;YACnB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;KACpD,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/auto-approve-mode.d.ts

@@ -1,37 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-export interface AutoApproveModeWarning {
-    /**
-     * The RESOLVED effective mode (`resolveModeFromConfig(pack).mode`);
-     * never the literal `pack.config.mode` value. Always a recognised
-     * Mode literal (the resolver always returns one, defaulting to
-     * `grill_me` when `config.mode` is absent or unrecognised).
-     */
-    mode: string;
-    /** Rendered as the `⚠` line itself. */
-    message: string;
-    /**
-     * Indented detail lines rendered directly under {@link message} by
-     * `format.ts`, mirroring `understandingModeEnv`'s detail-line idiom.
-     */
-    detail: string[];
-}
-/**
- * Pure: manifest in, a warning out (or `undefined` when there is nothing
- * to flag). Only fires when:
- *   - the `understanding-before-execution` pack is declared AND enabled
- *     (a pack that never runs has no live auto-approve path to warn
- *     about, mirrors the enabled-gate `understanding-mode-env.ts` and
- *     `ug-auto-approvals.ts` use);
- *   - `config.auto_approve` parses as a valid opt-in block (schema
- *     validation already rejects a malformed block at lint time, so a
- *     manifest that reaches doctor with an unparseable block has
- *     already failed loud elsewhere; this mirrors that same fail-closed
- *     "not opted in" reading rather than re-deriving a second opinion);
- *   - the RESOLVED effective mode (`resolveModeFromConfig(pack).mode`)
- *     is not `"grill_me"`. An absent or unrecognised `config.mode`
- *     resolves to `grill_me` (`DEFAULT_MODE`) and therefore never fires
- *     this warning, see the module header for why that resolved value,
- *     not the literal config key, is what the auto path's report
- *     actually carries.
- */
-export declare function checkAutoApproveMode(manifest: Manifest): AutoApproveModeWarning | undefined;

package/dist/cli/doctor/auto-approve-mode.js

@@ -1,80 +0,0 @@
-// Doctor advisory (agent-tasks abfad738, follow-up of ADR
-// docs/decisions/2026-08-27-ug-auto-mode-approval.md slice 1): warn when
-// an operator has opted into the hook-written signed auto-marker path
-// (`policy_packs[understanding-before-execution].config.auto_approve`)
-// without also pairing it with `mode: grill_me`.
-//
-// Why this matters: the auto-approval path's report precondition reuses
-// `validatePersistedReport` (`src/cli/approve/understanding.ts`), which
-// only enforces the report's `mode` field when it is `grill_me`.
-// Outside that mode, report validation is structural only (the report
-// exists and belongs to the session, not that its contents reflect any
-// real understanding exchange). Both the ADR (recommendation 4) and the
-// pack doc recommend pairing `auto_approve` with `grill_me` for exactly
-// this reason. Nothing surfaced the gap before this check: an operator
-// who opts a non-grill_me mode into `auto_approve` gets no signal that
-// the auto path's report gate has degraded to a near-no-op.
-//
-// Deliberately advisory, never an error: `auto_approve` outside
-// `grill_me` is a real, if weaker, gate (the permission-mode allowlist
-// and the signed marker still apply), not a misconfiguration.
-//
-// This check reads `resolveModeFromConfig(pack).mode`, the same
-// GENERATION-path resolver `checkUnderstandingModeEnvDivergence` and
-// `resolveBuiltinDefaultConfig` use, NOT `pack.config.mode` verbatim.
-// A missing `config.mode` resolves to `DEFAULT_MODE` (`grill_me`), and
-// that resolved value is what the generated Stop-hook command actually
-// passes as `UNDERSTANDING_GATE_MODE`, so a report written under an
-// unset `mode` genuinely carries `grill_me` and IS the strict check;
-// there is no gap to warn about. An unrecognised `config.mode` literal
-// also resolves to `grill_me` this same way, with its own warning
-// already surfaced elsewhere (`resolveModeFromConfig`'s `warning`
-// return, consumed by `harness validate` / other doctor checks); this
-// check does not duplicate that.
-//
-// A session-level `UNDERSTANDING_GATE_MODE` env override that diverges
-// from the resolved `config.mode` is a SEPARATE gap, already covered by
-// `checkUnderstandingModeEnvDivergence` (`understanding-mode-env.ts`)'s
-// own advisory line, this check only ever reads the manifest, never
-// `process.env`.
-import { resolveModeFromConfig } from "../../policy-packs/builtin/understanding-before-execution.js";
-import { parseAutoApprove } from "../../policy-packs/builtin/understanding-before-execution/index.js";
-import { findEnabledUnderstandingPack } from "./understanding-mode-env.js";
-/**
- * Pure: manifest in, a warning out (or `undefined` when there is nothing
- * to flag). Only fires when:
- *   - the `understanding-before-execution` pack is declared AND enabled
- *     (a pack that never runs has no live auto-approve path to warn
- *     about, mirrors the enabled-gate `understanding-mode-env.ts` and
- *     `ug-auto-approvals.ts` use);
- *   - `config.auto_approve` parses as a valid opt-in block (schema
- *     validation already rejects a malformed block at lint time, so a
- *     manifest that reaches doctor with an unparseable block has
- *     already failed loud elsewhere; this mirrors that same fail-closed
- *     "not opted in" reading rather than re-deriving a second opinion);
- *   - the RESOLVED effective mode (`resolveModeFromConfig(pack).mode`)
- *     is not `"grill_me"`. An absent or unrecognised `config.mode`
- *     resolves to `grill_me` (`DEFAULT_MODE`) and therefore never fires
- *     this warning, see the module header for why that resolved value,
- *     not the literal config key, is what the auto path's report
- *     actually carries.
- */
-export function checkAutoApproveMode(manifest) {
-    const pack = findEnabledUnderstandingPack(manifest);
-    if (!pack)
-        return undefined;
-    const autoApprove = parseAutoApprove(pack.config["auto_approve"]);
-    if (autoApprove === null)
-        return undefined;
-    const { mode } = resolveModeFromConfig(pack);
-    if (mode === "grill_me")
-        return undefined;
-    return {
-        mode,
-        message: `auto_approve is configured with mode ${mode} (policy_packs[understanding-before-execution].config.mode); report validation is structural only outside grill_me`,
-        detail: [
-            "set config.mode: grill_me, or accept the weaker report gate; see docs/policy-packs/understanding-before-execution.md",
-        ],
-    };
-}
-//# sourceMappingURL=auto-approve-mode.js.map

package/dist/cli/doctor/auto-approve-mode.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auto-approve-mode.js","sourceRoot":"","sources":["../../../src/cli/doctor/auto-approve-mode.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,iDAAiD;AACjD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,iEAAiE;AACjE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,4DAA4D;AAC5D,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,8DAA8D;AAC9D,EAAE;AACF,gEAAgE;AAChE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,iCAAiC;AACjC,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,oEAAoE;AACpE,iBAAiB;AAEjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,8DAA8D,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oEAAoE,CAAC;AAEtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAmB3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,MAAM,IAAI,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAClE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAE3C,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAE1C,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,wCAAwC,IAAI,oHAAoH;QACzK,MAAM,EAAE;YACN,sHAAsH;SACvH;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor/bypass-without-auto-approve.d.ts

@@ -1,38 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-export interface BypassWithoutAutoApproveFinding {
-    /** The newest observed session that tripped this finding. */
-    sessionId: string;
-    /** That observation's `observedAt` (ISO). */
-    observedAt: string;
-    /** Rendered as the `⚠` line itself. */
-    message: string;
-    /**
-     * Indented detail lines rendered directly under {@link message},
-     * mirroring the other advisory checks' idiom. Ends with the exact
-     * `auto_approve` snippet (the same one `harness init` ships and
-     * `harness pack upgrade understanding-before-execution` inserts, see
-     * auto-approve-default.ts) and names the upgrade command.
-     */
-    detail: string[];
-}
-/**
- * Pure(-ish): manifest + `generatedDir` in, a finding out (or
- * `undefined` when there is nothing to flag). Only fires when:
- *   - the `understanding-before-execution` pack is declared AND enabled
- *     (mirrors every sibling advisory's gate: a pack that never runs
- *     has no auto-approve path to be missing);
- *   - at least one of the newest `recentSessions` hook-written
- *     observations records `permissionMode === "bypassPermissions"`;
- *   - `auto_approve` does NOT cover that combination today: either the
- *     block is absent/malformed (`parseAutoApprove` returns `null`), or
- *     `bypassPermissions` is not in `when`, or `claude-code` is not in
- *     `harnesses` (an operator who opted Codex in alone, dropping
- *     Claude Code, still has this exact gap on the Claude Code side).
- *
- * Reports the NEWEST qualifying observation only: this is a "you have
- * at least one gap" flag, not a per-session audit; `ugAutoApprovals`
- * already owns the full listing idiom for that.
- */
-export declare function checkBypassWithoutAutoApprove(manifest: Manifest, generatedDir: string, opts: {
-    recentSessions: number;
-}): BypassWithoutAutoApproveFinding | undefined;