@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/cli/explain-policy.d.ts

@@ -1,135 +0,0 @@
-import { type DeletionTargetVerdict, type EnvironmentResolution, type RiskProfile, type WhenClauseResult } from "../runtime/index.js";
-import type { Manifest } from "../schema/index.js";
-import { type EventInputSeams } from "./event-input.js";
-import { type LoaderOptions } from "./loader.js";
-export interface ExplainPolicyOptions extends EventInputSeams, LoaderOptions {
-    /** Path to the tool-event JSON file (the `--event` argument). */
-    eventPath: string;
-    /** Emit JSON instead of YAML. */
-    json?: boolean;
-    /** Inject the resolved manifest (tests); bypasses `loadManifest`. */
-    manifest?: Manifest;
-    /** Inject env vars for `env_var_patterns` (tests); defaults to `process.env`. */
-    env?: Record<string, string | undefined>;
-    /** Inject the kube context (tests); bypasses `~/.kube/config`. */
-    kubeContext?: string;
-    /** Inject the kube namespace (tests); bypasses `~/.kube/config`. */
-    kubeNamespace?: string;
-    /**
-     * cwd `session_start_preflight.setup`'s per-repo project layer is
-     * derived from when `opts.project` is absent (task c88461c1, review
-     * round 2, decision D-021b): the same `deriveProjectName` helper
-     * `harness session-start preflight` and `harness doctor` also feed
-     * their own `loadManifest` call from, so all three consumers agree on
-     * which project layer applies to a given cwd instead of `explain-
-     * policy` silently reporting the base/machine value for a repo whose
-     * producer is actually reading a project layer. Defaults to
-     * `process.cwd()`; tests inject a fixture repo dir to stay hermetic
-     * against the real cwd.
-     */
-    cwd?: string;
-}
-/**
- * Which resolved layer decided `session_start_preflight.setup` (task
- * c88461c1): "project" when the resolved project-override layer
- * itself declares the key, "machine" when a resolved machine-override
- * layer declares it (and no project layer does), "base" otherwise
- * (the base manifest, or the schema default when nothing declares the
- * key at all). Mirrors the loader's own last-wins precedence
- * (`applyLayers(baseRaw, ...machineLayers, projectLayer)`,
- * `src/overrides/merge.ts`): the project layer is checked first since
- * it is the highest-precedence layer, then machine layers from the
- * last-applied (highest-precedence) one back to the first.
- *
- * "unresolvable" (task c88461c1, review round 3 residual; task
- * `1c4eb3ea` of the batch-44 follow-up run): the cwd-derived project-scoped SECOND
- * load itself threw (a malformed project layer, an unreadable file).
- * Deliberately NOT "base": the base/machine values were never actually
- * re-read on this path (the plain load above them; see the round-3
- * comment this residual corrected), so attributing the result to
- * "base" would claim a value the base layer may not carry. `setup`
- * degrades to `false` alongside it, matching the producer's own
- * `setupEnabled` catch (`src/cli/session-start/index.ts`), so the two
- * agree on a scoped-load failure instead of only on a healthy load.
- */
-export type SessionStartPreflightLayerSource = "base" | "machine" | "project" | "unresolvable";
-interface ExplainPolicyProjection {
-    policy: string;
-    description: string;
-    trigger: {
-        event: string;
-        match?: string;
-        path_match?: string;
-        bash_match?: string;
-        matched: boolean;
-    };
-    classifier: RiskProfile;
-    environment: EnvironmentResolution;
-    /**
-     * Which parts of the hook's evaluation this verb mirrors and which it
-     * deliberately does not (task 7c3919a2). `envelope_enrichment` lists the
-     * Bash-prefix merges shared with `harness policy intercept`;
-     * `not_evaluated` lists what the hook does that this hypothetical,
-     * read-free verb does not.
-     */
-    parity: {
-        envelope_enrichment: string[];
-        not_evaluated: string[];
-    };
-    /** Static deletion-target verdict (task d03af8f6); null when the
-     *  event's command is not a recognized deletion verb. */
-    deletion_target: DeletionTargetVerdict | null;
-    /**
-     * Resolved `session_start_preflight` config (task 30183330), shown
-     * only when the explained policy is one of the init-generated
-     * `preflight-before-*` gates (name starts with `preflight-before-`):
-     * this is the knob that decides whether the `harness session-start
-     * preflight` / `harness preflight` producer passes `--setup` to the
-     * `preflight run` invocation whose `ready:true` result these policies
-     * gate on. Omitted for every other policy; it has no bearing on
-     * their evaluation (review round 3 residual; task `1c4eb3ea`: the
-     * scoped SECOND load below this field's assignment site runs ONLY
-     * when this condition is already true, so a policy this block is
-     * never rendered for never pays for that extra load either).
-     * `source` (task c88461c1) names which resolved layer decided the
-     * value: `"base"` (also covers an injected `opts.manifest`, which
-     * carries no per-layer provenance to attribute), `"machine"`,
-     * `"project"` (the cwd-derived per-repo layer), or `"unresolvable"`
-     * (review round 3 residual; task `1c4eb3ea`: the scoped load itself
-     * threw, `setup` degrades to `false` alongside it). This function
-     * derives that project name itself, from `opts.cwd`, via the SAME
-     * `deriveProjectName` helper `harness session-start preflight` feeds
-     * through `LoaderOptions.project` (review round 2, decision D-021b:
-     * without this, an operator running `explain-policy` with no
-     * `--project` in a repo that DOES have a project layer would see the
-     * base/machine value while the producer itself reads the project
-     * layer, see src/cli/session-start/index.ts).
-     */
-    session_start_preflight?: {
-        setup: boolean;
-        source: SessionStartPreflightLayerSource;
-    };
-    when: {
-        declared: false;
-    } | {
-        declared: true;
-        matched: boolean;
-        clauses: WhenClauseResult[];
-        unclassifiedFallback: boolean;
-    };
-    /** trigger AND when — would this policy fire on this event? */
-    applies: boolean;
-}
-export interface ExplainPolicyResult {
-    output: string;
-    projection: ExplainPolicyProjection;
-}
-/**
- * Explain whether `policyName` applies to the event at `opts.eventPath`.
- *
- * Throws `HarnessExitError(EX_USAGE)` when the named policy is not
- * declared in the manifest, and `HarnessExitError(EX_NOINPUT)` (via
- * `loadEventEnvelope`) when the event file is missing or malformed.
- */
-export declare function explainPolicy(policyName: string, opts: ExplainPolicyOptions): ExplainPolicyResult;
-export {};

package/dist/cli/explain-policy.js

@@ -1,266 +0,0 @@
-// Phase 7 #5 — `harness explain-policy` CLI entrypoint.
-//
-// Risk Gate debug verb: given a policy name and a tool-event JSON file,
-// explain whether the policy would APPLY to that event, and why. A
-// policy applies only when its `trigger:` matches AND — when declared —
-// every `when:` clause holds against the enriched Action Envelope. This
-// verb shows both verdicts side by side: the trigger match, the Risk
-// Classifier profile, the resolved environment, and a per-clause `when:`
-// breakdown, so an operator authoring a risk policy sees exactly which
-// clause admitted an action or held it back.
-//
-// Distinct from `harness explain <policy> --trace`: that replays the
-// LAST recorded decision from the evidence ledger; `explain-policy`
-// evaluates a hypothetical event live and reads nothing from the ledger.
-import * as fs from "node:fs";
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
-import { buildActionEnvelope, classifyRisk, deriveProjectName, evaluateWhen, policyMatchesEvent, resolveDeletionTarget, resolveEnvironment, resolveKubeContext, } from "../runtime/index.js";
-import { extractShellCommand } from "../runtime/tool-name-aliases.js";
-import { DEFAULT_SAFE_DELETION_ROOTS } from "../schema/risk.js";
-import { resolveBashPrefixEnrichment } from "./policy/risk-envelope-enrichment.js";
-import { loadEventEnvelope } from "./event-input.js";
-import { EX_USAGE, HarnessExitError } from "./exit-codes.js";
-import { loadManifest } from "./loader.js";
-/**
- * Does `filePath`'s raw YAML explicitly declare `session_start_preflight.setup`?
- *
- * "Declare" means KEY PRESENCE, not "holds a boolean" (review round 2,
- * finding: a tombstone, `session_start_preflight: null` or `{setup:
- * null}`, both honoured by `mergeValue` in src/overrides/merge.ts as
- * "delete whatever a lower layer set, falling back to the schema
- * default", is exactly as much a deliberate declaration by THIS layer
- * as `setup: true`/`false` is; it just resolves to a different final
- * value. Attributing a tombstoned layer's decision to whichever lower
- * layer happens to also declare the key (or to "base" when none does)
- * would name the WRONG layer as the one that decided the merged
- * result.
- */
-function layerDeclaresSetup(filePath) {
-    try {
-        const raw = fs.readFileSync(filePath, "utf8");
-        const parsed = parseYaml(raw);
-        if (parsed === null || typeof parsed !== "object")
-            return false;
-        if (!("session_start_preflight" in parsed))
-            return false;
-        const block = parsed.session_start_preflight;
-        if (block === null)
-            return true; // whole-block tombstone
-        if (typeof block !== "object" || Array.isArray(block))
-            return false;
-        return "setup" in block;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Re-reads the resolved layer files (independent of the already-merged
- * `manifest` object, which no longer carries per-layer provenance once
- * `applyLayers` has folded them together) to attribute the decided
- * `session_start_preflight.setup` value to the layer that set it.
- */
-function resolveSessionStartPreflightSource(resolved) {
-    if (resolved.projectLayer !== null && layerDeclaresSetup(resolved.projectLayer)) {
-        return "project";
-    }
-    for (let i = resolved.machineLayers.length - 1; i >= 0; i--) {
-        if (layerDeclaresSetup(resolved.machineLayers[i]))
-            return "machine";
-    }
-    return "base";
-}
-/**
- * Explain whether `policyName` applies to the event at `opts.eventPath`.
- *
- * Throws `HarnessExitError(EX_USAGE)` when the named policy is not
- * declared in the manifest, and `HarnessExitError(EX_NOINPUT)` (via
- * `loadEventEnvelope`) when the event file is missing or malformed.
- */
-export function explainPolicy(policyName, opts) {
-    // `resolved` is only available on the real `loadManifest(opts)` path:
-    // an injected `opts.manifest` already IS the merged result and
-    // carries no per-layer provenance, so `session_start_preflight.source`
-    // falls back to "base" in that case (see the field's doc comment).
-    //
-    // PLAIN load (task c88461c1, review round 3, decision D-028): every
-    // check this verb performs against `manifest` below -- finding the
-    // named policy, trigger matching, the Risk Classifier, environment
-    // resolution, deletion-target resolution, and the `when:` evaluation
-    // -- reads the base/machine/explicit-`--project` manifest only, an
-    // explicit `opts.project` still wins outright but NOTHING is derived
-    // from cwd here. This mirrors `harness policy intercept`
-    // (src/cli/policy/intercept.ts) and `harness dry-run`
-    // (src/cli/dry-run.ts), the two enforcement-facing verbs that decide
-    // a policy's real trigger verdict: neither ever consults a derived
-    // project layer, so this manifest must not either, or an operator's
-    // "would this apply" answer could disagree with what actually
-    // enforces. Only `session_start_preflight.setup` (and its `source`
-    // attribution) below get a project-scoped SECOND load: routing a
-    // derived layer through THIS one, unrelated load would let it
-    // silently reach the policy engine this verb evaluates, for zero
-    // benefit to the one key that needs it.
-    let manifest;
-    let resolvedPaths;
-    if (opts.manifest) {
-        manifest = opts.manifest;
-    }
-    else {
-        const loaded = loadManifest(opts);
-        manifest = loaded.manifest;
-        resolvedPaths = loaded.resolved;
-    }
-    const policy = manifest.policies.find((p) => p.name === policyName);
-    if (!policy) {
-        const available = manifest.policies.map((p) => p.name).join(", ") || "(none)";
-        throw new HarnessExitError(`no policy named "${policyName}" declared; available: ${available}`, EX_USAGE);
-    }
-    // `session_start_preflight.setup` / `source` (task c88461c1, review
-    // round 2 decision D-021b; scope narrowed to this one key, review
-    // round 3 decision D-028; gated on the name-prefix check below,
-    // review round 3 residual, task `1c4eb3ea`): an explicit
-    // `opts.project` still wins outright; otherwise derive the project
-    // name from `opts.cwd` (defaulting to `process.cwd()`) via the SAME
-    // `deriveProjectName` the two other producers reach through
-    // `resolveScopedProjectName` (src/runtime/git-context.ts; this verb keeps
-    // its own copy with an `undefined` fallback, task f1eb1c5c), so this
-    // verb's `setup`/`source` reflect the layer the producer would read for
-    // this cwd, WITHOUT letting that derived layer reach the policy evaluation above. An injected
-    // `opts.manifest` carries no per-layer provenance to re-derive from
-    // and always reports "base" (unchanged from before this task).
-    //
-    // ONLY COMPUTED FOR `preflight-before-*` POLICIES (moved behind this
-    // check, review round 3 residual, task `1c4eb3ea`): the block below
-    // is rendered into the projection ONLY for those policies (see
-    // `ExplainPolicyProjection.session_start_preflight`'s doc comment),
-    // so a caller explaining any OTHER policy no longer pays for a
-    // second manifest load whose result it can never see.
-    let sessionStartPreflightSetup = false;
-    let sessionStartPreflightSource = "base";
-    if (policy.name.startsWith("preflight-before-")) {
-        sessionStartPreflightSetup = manifest.session_start_preflight.setup;
-        sessionStartPreflightSource = resolvedPaths
-            ? resolveSessionStartPreflightSource(resolvedPaths)
-            : "base";
-        if (!opts.manifest) {
-            try {
-                const scoped = loadManifest({
-                    ...opts,
-                    project: opts.project ?? deriveProjectName(opts.cwd ?? process.cwd()) ?? undefined,
-                });
-                sessionStartPreflightSetup = scoped.manifest.session_start_preflight.setup;
-                sessionStartPreflightSource = resolveSessionStartPreflightSource(scoped.resolved);
-            }
-            catch {
-                // Review round 3 residual, task `1c4eb3ea`: degrade to
-                // setup:false / source:"unresolvable" rather than keeping the
-                // plain load's values, matching the producer's own
-                // `setupEnabled` catch (`src/cli/session-start/index.ts`),
-                // which degrades to `setup: false` on the identical failure
-                // instead of falling back to a base/machine value it never
-                // actually re-read on this path. "base" would misattribute
-                // the result to a layer this function never consulted here.
-                sessionStartPreflightSetup = false;
-                sessionStartPreflightSource = "unresolvable";
-            }
-        }
-    }
-    const { event, envelope: baseEnvelope } = loadEventEnvelope(opts.eventPath, opts, "explain-policy");
-    // Kube seams resolve together: if either is injected, skip the
-    // `~/.kube/config` read entirely — same contract as `resolve-env`.
-    const kube = opts.kubeContext !== undefined || opts.kubeNamespace !== undefined
-        ? { context: opts.kubeContext ?? "", namespace: opts.kubeNamespace ?? "" }
-        : resolveKubeContext();
-    // Envelope enrichment shared with `harness policy intercept` (task
-    // 7c3919a2): the leading Bash prefix (inline `VAR=value`, `cd <path>
-    // &&`, `git switch|checkout <branch> &&`) is parsed and merged into
-    // the resolver inputs by the SAME helper the hook uses, so this verb
-    // cannot report `unknown` for a command the hook resolves to
-    // `production`. Only the envelope enrichment is shared; this verb
-    // still reads no ledger or evidence.
-    const enrichment = resolveBashPrefixEnrichment({
-        event,
-        manifest,
-        cwd: baseEnvelope.runtime.cwd,
-        cwdGitContext: {
-            repo: baseEnvelope.session.repo,
-            branch: baseEnvelope.session.branch,
-            sha: "",
-        },
-        env: opts.env ?? process.env,
-        kubeContext: kube.context,
-        kubeNamespace: kube.namespace,
-        user: baseEnvelope.runtime.user,
-        host: baseEnvelope.runtime.host,
-        now: new Date(baseEnvelope.timestamp),
-    });
-    const envelope = enrichment.git.repo === baseEnvelope.session.repo &&
-        enrichment.git.branch === baseEnvelope.session.branch
-        ? baseEnvelope
-        : buildActionEnvelope(event, {
-            cwd: baseEnvelope.runtime.cwd,
-            git: enrichment.git,
-            user: baseEnvelope.runtime.user,
-            host: baseEnvelope.runtime.host,
-            now: new Date(baseEnvelope.timestamp),
-        });
-    const classifier = classifyRisk(envelope, manifest.risk.classifiers);
-    const environment = resolveEnvironment(envelope, manifest.environments.resolvers, {
-        env: enrichment.env,
-        kubeContext: kube.context,
-        kubeNamespace: kube.namespace,
-    });
-    // Static deletion-target resolution (task d03af8f6) — same "raw
-    // command only, no ambient cwd/env" contract as the runtime's own
-    // `enrichEnvelope`. See `deletion-target-resolve.ts`.
-    const explainShellCommand = extractShellCommand({ raw_input: envelope.raw_input });
-    const deletionTarget = explainShellCommand === null
-        ? null
-        : resolveDeletionTarget(explainShellCommand, manifest.risk.safe_deletion_roots ?? DEFAULT_SAFE_DELETION_ROOTS);
-    const triggerMatched = policyMatchesEvent(policy, event);
-    const whenEval = policy.when !== undefined
-        ? evaluateWhen(policy.when, { risk: classifier, environment, deletionTarget })
-        : undefined;
-    const projection = {
-        policy: policy.name,
-        description: policy.description,
-        trigger: {
-            event: policy.trigger.event,
-            ...(policy.trigger.match !== undefined && { match: policy.trigger.match }),
-            ...(policy.trigger.path_match !== undefined && {
-                path_match: policy.trigger.path_match,
-            }),
-            ...(policy.trigger.bash_match !== undefined && {
-                bash_match: policy.trigger.bash_match,
-            }),
-            matched: triggerMatched,
-        },
-        classifier,
-        environment,
-        parity: {
-            envelope_enrichment: ["inline_env", "cd_git_context", "branch_switch_upgrade"],
-            not_evaluated: ["ledger_requires", "kubectl_target"],
-        },
-        deletion_target: deletionTarget,
-        ...(policy.name.startsWith("preflight-before-") && {
-            session_start_preflight: {
-                setup: sessionStartPreflightSetup,
-                source: sessionStartPreflightSource,
-            },
-        }),
-        when: whenEval
-            ? {
-                declared: true,
-                matched: whenEval.matched,
-                clauses: whenEval.clauses,
-                unclassifiedFallback: whenEval.unclassifiedFallback,
-            }
-            : { declared: false },
-        applies: triggerMatched && (whenEval ? whenEval.matched : true),
-    };
-    const output = opts.json
-        ? `${JSON.stringify(projection, null, 2)}\n`
-        : stringifyYaml(projection, { lineWidth: 0 });
-    return { output, projection };
-}
-//# sourceMappingURL=explain-policy.js.map

package/dist/cli/explain-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"explain-policy.js","sourceRoot":"","sources":["../../src/cli/explain-policy.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,yEAAyE;AAEzE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,GAKnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAA0C,MAAM,aAAa,CAAC;AAuDnF;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAiD,CAAC;QAC9E,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,CAAC,CAAC,yBAAyB,IAAI,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,uBAAuB,CAAC;QAC7C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpE,OAAO,OAAO,IAAK,KAAiC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,kCAAkC,CACzC,QAAuB;IAEvB,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5D,IAAI,kBAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,SAAS,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAwED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IAA0B;IAE1B,sEAAsE;IACtE,+DAA+D;IAC/D,uEAAuE;IACvE,mEAAmE;IACnE,EAAE;IACF,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,yDAAyD;IACzD,sDAAsD;IACtD,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,8DAA8D;IAC9D,mEAAmE;IACnE,iEAAiE;IACjE,8DAA8D;IAC9D,iEAAiE;IACjE,wCAAwC;IACxC,IAAI,QAAkB,CAAC;IACvB,IAAI,aAAwC,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,UAAU,0BAA0B,SAAS,EAAE,EACnE,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,kEAAkE;IAClE,gEAAgE;IAChE,yDAAyD;IACzD,mEAAmE;IACnE,oEAAoE;IACpE,4DAA4D;IAC5D,0EAA0E;IAC1E,qEAAqE;IACrE,wEAAwE;IACxE,8FAA8F;IAC9F,oEAAoE;IACpE,+DAA+D;IAC/D,EAAE;IACF,qEAAqE;IACrE,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,+DAA+D;IAC/D,sDAAsD;IACtD,IAAI,0BAA0B,GAAG,KAAK,CAAC;IACvC,IAAI,2BAA2B,GAAqC,MAAM,CAAC;IAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAChD,0BAA0B,GAAG,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACpE,2BAA2B,GAAG,aAAa;YACzC,CAAC,CAAC,kCAAkC,CAAC,aAAa,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC;QACX,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,YAAY,CAAC;oBAC1B,GAAG,IAAI;oBACP,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,SAAS;iBACnF,CAAC,CAAC;gBACH,0BAA0B,GAAG,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC;gBAC3E,2BAA2B,GAAG,kCAAkC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpF,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,8DAA8D;gBAC9D,mDAAmD;gBACnD,2DAA2D;gBAC3D,4DAA4D;gBAC5D,2DAA2D;gBAC3D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,0BAA0B,GAAG,KAAK,CAAC;gBACnC,2BAA2B,GAAG,cAAc,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,iBAAiB,CACzD,IAAI,CAAC,SAAS,EACd,IAAI,EACJ,gBAAgB,CACjB,CAAC;IAEF,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAChE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE;QAC1E,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAE3B,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,6DAA6D;IAC7D,kEAAkE;IAClE,qCAAqC;IACrC,MAAM,UAAU,GAAG,2BAA2B,CAAC;QAC7C,KAAK;QACL,QAAQ;QACR,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;QAC7B,aAAa,EAAE;YACb,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI;YAC/B,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM;YACnC,GAAG,EAAE,EAAE;SACR;QACD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC5B,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,aAAa,EAAE,IAAI,CAAC,SAAS;QAC7B,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI;QAC/B,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI;QAC/B,GAAG,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,QAAQ,GACZ,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,OAAO,CAAC,IAAI;QACjD,UAAU,CAAC,GAAG,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,MAAM;QACnD,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE;YACzB,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;YAC7B,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI;YAC/B,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI;YAC/B,GAAG,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;SACtC,CAAC,CAAC;IAET,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,kBAAkB,CACpC,QAAQ,EACR,QAAQ,CAAC,YAAY,CAAC,SAAS,EAC/B;QACE,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,aAAa,EAAE,IAAI,CAAC,SAAS;KAC9B,CACF,CAAC;IAEF,gEAAgE;IAChE,kEAAkE;IAClE,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,cAAc,GAClB,mBAAmB,KAAK,IAAI;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,qBAAqB,CACnB,mBAAmB,EACnB,QAAQ,CAAC,IAAI,CAAC,mBAAmB,IAAI,2BAA2B,CACjE,CAAC;IAER,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QAC9E,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,UAAU,GAA4B;QAC1C,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;YAC3B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,OAAO,EAAE,cAAc;SACxB;QACD,UAAU;QACV,WAAW;QACX,MAAM,EAAE;YACN,mBAAmB,EAAE,CAAC,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,CAAC;YAC9E,aAAa,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;SACrD;QACD,eAAe,EAAE,cAAc;QAC/B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI;YACjD,uBAAuB,EAAE;gBACvB,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EAAE,2BAA2B;aACpC;SACF,CAAC;QACF,IAAI,EAAE,QAAQ;YACZ,CAAC,CAAC;gBACE,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;aACpD;YACH,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvB,OAAO,EAAE,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;KAChE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}

package/dist/cli/explain.d.ts

@@ -1,31 +0,0 @@
-import { type LedgerQueryResult } from "../policies/index.js";
-import { type PolicyDecisionPayload } from "../io/ledger-record.js";
-import { type ResolveReadSessionOptions } from "../runtime/session-id.js";
-import { type LoaderOptions } from "./loader.js";
-export type ExplainDecisionFilter = PolicyDecisionPayload["outcome"];
-export interface ExplainOptions extends LoaderOptions {
-    json?: boolean;
-    trace?: boolean;
-    /** Session whose audit log to inspect for `--trace`. */
-    sessionId?: string;
-    /**
-     * Read-path session resolution overrides (tests). When `sessionId` is
-     * not given, `resolveReadSessionId` discovers the live session from
-     * the newest Claude Code transcript; this seam lets tests stub that
-     * scan so they stay hermetic.
-     */
-    sessionDiscovery?: ResolveReadSessionOptions;
-    /**
-     * When true, ignore the policy-name argument and trace the most recent
-     * decision recorded in the ledger (any policy). Implies --trace.
-     */
-    last?: boolean;
-    /** When `last` is set, only consider decisions of this outcome. */
-    decisionFilter?: ExplainDecisionFilter;
-    /** Override the ledger fetcher (tests). */
-    fetchLedger?: (sessionId: string) => Promise<LedgerQueryResult>;
-}
-export interface ExplainResult {
-    output: string;
-}
-export declare function explain(policyName: string | undefined, opts?: ExplainOptions): Promise<ExplainResult>;

package/dist/cli/explain.js

@@ -1,159 +0,0 @@
-import { stringify as stringifyYaml } from "yaml";
-import { buildRecordHint, queryLedgerByTag, } from "../policies/index.js";
-import { decisionSortKey, decodeLedgerContent, } from "../io/ledger-record.js";
-import { resolveReadSessionId, } from "../runtime/session-id.js";
-import { EX_FAIL, EX_USAGE, HarnessExitError } from "./exit-codes.js";
-import { loadManifest } from "./loader.js";
-function defaultFetcher(opts) {
-    return async (sessionId) => {
-        const { manifest } = loadManifest(opts);
-        const server = manifest.tools.mcp.find((m) => m.name === "grounding-mcp");
-        if (!server) {
-            return { kind: "degraded", reason: "grounding-mcp not declared in manifest" };
-        }
-        const command = Array.isArray(server.command)
-            ? server.command
-            : server.command.trim().split(/\s+/);
-        return queryLedgerByTag({
-            mcpCommand: command,
-            ...(server.env && { mcpEnv: server.env }),
-            sessionId,
-            timeoutMs: server.health?.timeout_ms ?? 5_000,
-        });
-    };
-}
-function decodeAll(entries) {
-    const out = [];
-    for (const entry of entries) {
-        const payload = decodeLedgerContent(entry.content);
-        if (!payload)
-            continue;
-        out.push({ entry, payload });
-    }
-    return out;
-}
-function selectLatestForPolicy(entries, policyName) {
-    const matches = decodeAll(entries).filter((d) => d.payload.name === policyName);
-    if (matches.length === 0)
-        return null;
-    matches.sort((a, b) => decisionSortKey(b.entry, b.payload) - decisionSortKey(a.entry, a.payload));
-    return matches[0];
-}
-function selectLatestAny(entries, decisionFilter) {
-    const matches = decodeAll(entries).filter((d) => decisionFilter === undefined || d.payload.outcome === decisionFilter);
-    if (matches.length === 0)
-        return null;
-    matches.sort((a, b) => decisionSortKey(b.entry, b.payload) - decisionSortKey(a.entry, a.payload));
-    return matches[0];
-}
-export async function explain(policyName, opts = {}) {
-    const { manifest } = loadManifest(opts);
-    if (opts.last) {
-        const sessionId = resolveReadSessionId(opts.sessionId, opts.sessionDiscovery);
-        const fetch = opts.fetchLedger ?? defaultFetcher(opts);
-        const result = await fetch(sessionId);
-        if (result.kind === "degraded") {
-            throw new HarnessExitError(`cannot read audit log: ${result.reason}`, EX_FAIL);
-        }
-        const latest = selectLatestAny(result.entries, opts.decisionFilter);
-        if (!latest) {
-            const filterSuffix = opts.decisionFilter ? ` with outcome \`${opts.decisionFilter}\`` : "";
-            throw new HarnessExitError(`no recorded policy decisions${filterSuffix} for session \`${sessionId}\`; the ledger may be empty or grounding-mcp is unreachable`, EX_FAIL);
-        }
-        return { output: renderTrace(latest, manifest, sessionId, opts.json) };
-    }
-    if (policyName === undefined) {
-        throw new HarnessExitError("policy name is required (or pass --last to trace the most recent decision)", EX_USAGE);
-    }
-    const policy = manifest.policies.find((p) => p.name === policyName);
-    if (!policy) {
-        const available = manifest.policies.map((p) => p.name).join(", ") || "(none)";
-        throw new HarnessExitError(`no policy named "${policyName}" declared; available: ${available}`, EX_USAGE);
-    }
-    if (!opts.trace) {
-        // `operator_only: true` policies (task 2cc73f55) declare no
-        // `requires:` at all: there is no ledger contract to show, and no
-        // hint to build — the policy is an unconditional deny, full stop.
-        const projection = {
-            name: policy.name,
-            description: policy.description,
-            trigger: policy.trigger,
-            ...(policy.requires !== undefined && { requires: policy.requires }),
-            // toSatisfy mirrors the deny-time hint surfaced by `harness policy
-            // intercept`, so a contributor reading the policy under `harness
-            // explain <policy>` sees the same contract a blocked operator
-            // sees in Claude Code. Built from the un-substituted ledger_tag
-            // template (e.g. `review:${PR_NUMBER}`) so it reads as the policy
-            // contract, not a specific event's instance.
-            ...(policy.requires !== undefined && {
-                toSatisfy: buildRecordHint(policy.requires, policy.requires.ledger_tag),
-            }),
-            ...(policy.operator_only === true && {
-                toSatisfy: "none — operator_only: true is an unconditional deny; no in-session evidence can ever satisfy it",
-            }),
-            hook: policy.hook,
-            enforcement: policy.enforcement,
-            note: "run with --trace to see the last evaluation's full decision trail",
-        };
-        const output = opts.json
-            ? `${JSON.stringify(projection, null, 2)}\n`
-            : stringifyYaml(projection, { lineWidth: 0 });
-        return { output };
-    }
-    const sessionId = resolveReadSessionId(opts.sessionId, opts.sessionDiscovery);
-    const fetch = opts.fetchLedger ?? defaultFetcher(opts);
-    const result = await fetch(sessionId);
-    if (result.kind === "degraded") {
-        throw new HarnessExitError(`cannot read audit log: ${result.reason}`, EX_FAIL);
-    }
-    const latest = selectLatestForPolicy(result.entries, policyName);
-    if (!latest) {
-        throw new HarnessExitError(`no recorded evaluations for policy \`${policyName}\` in session \`${sessionId}\`; ` +
-            `the policy may not have fired yet, grounding-mcp is unreachable, or the ` +
-            `decisions landed under a different session (pass --session <id>)`, EX_FAIL);
-    }
-    return { output: renderTrace(latest, manifest, sessionId, opts.json) };
-}
-function renderTrace(latest, manifest, sessionId, json) {
-    const policy = manifest.policies.find((p) => p.name === latest.payload.name);
-    const trigger = policy?.trigger;
-    const projection = {
-        name: latest.payload.name,
-        decision: latest.payload.outcome,
-        enforcement: latest.payload.enforcement,
-        reason: latest.payload.reason,
-        ledgerTag: latest.payload.ledgerTag,
-        evaluatedAt: latest.payload.evaluatedAt,
-        triggerMatched: {
-            event: trigger?.event ?? "(unknown: policy not declared in current manifest)",
-            ...(trigger?.match !== undefined && { match: trigger.match }),
-            ...(trigger?.bash_match !== undefined && { bashMatch: trigger.bash_match }),
-        },
-        ...(latest.payload.risk && { classifier: latest.payload.risk }),
-        ...(latest.payload.environment && {
-            environment: latest.payload.environment,
-        }),
-        extract: latest.payload.extractValues,
-        ...(latest.payload.requiresEval && { requiresEval: latest.payload.requiresEval }),
-        ...(policy?.requires !== undefined && {
-            toSatisfy: buildRecordHint(policy.requires, latest.payload.ledgerTag),
-        }),
-        // operator_only: true (task 2cc73f55) — no requires: to build a hint
-        // from; the policy is an unconditional deny.
-        ...(policy?.operator_only === true && {
-            toSatisfy: "none — operator_only: true is an unconditional deny; no in-session evidence can ever satisfy it",
-        }),
-        // M7: surface the fail-closed unclassified flag in the trace so an
-        // operator can distinguish a real critical-severity deny from a
-        // fail-closed unclassified one via `explain --trace [--json]`.
-        // Absent when the payload lacks the field (pre-M7 rows or genuine hits).
-        ...(latest.payload.whenUnclassifiedFallback === true && {
-            whenUnclassifiedFallback: true,
-        }),
-        ledgerQuery: { verb: "ledger_summary", sessionId },
-    };
-    return json
-        ? `${JSON.stringify(projection, null, 2)}\n`
-        : stringifyYaml(projection, { lineWidth: 0 });
-}
-//# sourceMappingURL=explain.js.map

package/dist/cli/explain.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"explain.js","sourceRoot":"","sources":["../../src/cli/explain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EACL,eAAe,EACf,gBAAgB,GAGjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAqE/D,SAAS,cAAc,CAAC,IAAoB;IAC1C,OAAO,KAAK,EAAE,SAAiB,EAA8B,EAAE;QAC7D,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,gBAAgB,CAAC;YACtB,UAAU,EAAE,OAAO;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YACzC,SAAS;YACT,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK;SAC9C,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAID,SAAS,SAAS,CAAC,OAAsB;IACvC,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAsB,EACtB,UAAkB;IAElB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CACpF,CAAC;IACF,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CACtB,OAAsB,EACtB,cAAsC;IAEtC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,cAAc,CAC5E,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CACpF,CAAC;IACF,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,UAA8B,EAC9B,OAAuB,EAAE;IAEzB,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CACxB,0BAA0B,MAAM,CAAC,MAAM,EAAE,EACzC,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,YAAY,kBAAkB,SAAS,6DAA6D,EACnI,OAAO,CACR,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CACxB,4EAA4E,EAC5E,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,UAAU,0BAA0B,SAAS,EAAE,EACnE,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,4DAA4D;QAC5D,kEAAkE;QAClE,kEAAkE;QAClE,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnE,mEAAmE;YACnE,iEAAiE;YACjE,8DAA8D;YAC9D,gEAAgE;YAChE,kEAAkE;YAClE,6CAA6C;YAC7C,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI;gBACnC,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;aACxE,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI;gBACnC,SAAS,EACP,iGAAiG;aACpG,CAAC;YACF,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,mEAAmE;SAC1E,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;YACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;YAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,gBAAgB,CACxB,0BAA0B,MAAM,CAAC,MAAM,EAAE,EACzC,OAAO,CACR,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,UAAU,mBAAmB,SAAS,MAAM;YAClF,0EAA0E;YAC1E,kEAAkE,EACpE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAClB,MAAe,EACf,QAAqD,EACrD,SAAiB,EACjB,IAAyB;IAEzB,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC;IAChC,MAAM,UAAU,GAAoB;QAClC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;QAChC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;QACvC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAC7B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;QACnC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;QACvC,cAAc,EAAE;YACd,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,oDAAoD;YAC7E,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,EAAE,UAAU,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;SAC5E;QACD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI;YAChC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;SACxC,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;QACrC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACjF,GAAG,CAAC,MAAM,EAAE,QAAQ,KAAK,SAAS,IAAI;YACpC,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;SACtE,CAAC;QACF,qEAAqE;QACrE,6CAA6C;QAC7C,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,IAAI;YACpC,SAAS,EACP,iGAAiG;SACpG,CAAC;QACF,mEAAmE;QACnE,gEAAgE;QAChE,+DAA+D;QAC/D,yEAAyE;QACzE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,KAAK,IAAI,IAAI;YACtD,wBAAwB,EAAE,IAAI;SAC/B,CAAC;QACF,WAAW,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE;KACnD,CAAC;IAEF,OAAO,IAAI;QACT,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC"}