@monoes/monomindcli 2.11.8 → 2.11.10

package/dist/src/orgrt/policy-git.js

@@ -6,8 +6,14 @@ import { shellSegments } from './shell-scan.js';
 // word `show` etc. could appear anywhere in a longer name. `remote` is
 // deliberately read-level only for inspection — `remote add`/`set-url` mutate
 // config, but redirecting a remote is inert unless push is also permitted.
-const GIT_READ_CMDS = /^(status|log|diff|show|branch|tag|remote|rev-parse|ls-files|ls-tree|blame|shortlog|describe|cat-file|for-each-ref|rev-list|grep|worktree)$/;
-const GIT_COMMIT_CMDS = /^(add|commit|rm|mv|restore|reset|stash|cherry-pick|rebase|merge|revert|apply|checkout|switch|clean|gc|prune)$/;
+// The anchoring is also what makes `cherry` safe to list next to `cherry-pick`
+// (#299): `^cherry$` cannot match the token `cherry-pick`.
+const GIT_READ_CMDS = /^(status|log|diff|show|branch|tag|remote|rev-parse|ls-files|ls-tree|blame|shortlog|describe|cat-file|for-each-ref|rev-list|grep|worktree|merge-base|show-ref|name-rev|cherry|range-diff|check-ignore|check-attr|count-objects|var|ls-remote)$/;
+// #300: `stash` is deliberately NOT here — unlike every other entry, it is
+// not worktree-local (refs/stash lives in the common git dir), so it gets
+// its own unconditional branch in checkGitPolicy, before this regex is ever
+// tested. See that branch's comment for why.
+const GIT_COMMIT_CMDS = /^(add|commit|rm|mv|restore|reset|cherry-pick|rebase|merge|revert|apply|checkout|switch|clean|gc|prune)$/;
 const GIT_PUSH_CMDS = /^(push|fetch|pull|clone|remote-add|submodule)$/;
 /** `git config` writes change .git/config, which every worktree of the repo
  *  shares — `git config user.name x` rewrites the commit identity repo-wide
@@ -50,6 +56,88 @@ function gitConfigIsWrite(args) {
         return true;
     return positional.length !== 1; // a bare `name` reads; `name value` (or nothing parseable) writes
 }
+/** Subcommands whose mode depends on their first positional, resolved at scan
+ *  time into a `<sub>:read` token the way `config` already is (#299). An
+ *  expansion may hide the verb, so any arg containing shell metacharacters is
+ *  treated as the mutating form — same fail-closed rule as gitConfigIsWrite.
+ *  Deliberately case-sensitive, matching git's own case-sensitive subcommand
+ *  dispatch: `git stash sHoW` is not `show` to git either — it falls through
+ *  to the default write (`stash push`), so leaving it unmatched by a
+ *  lowercase-only pattern tracks git, not luck. */
+const GIT_SUB_READ_ARGS = {
+    stash: /^(list|show)$/, // allowlist: bare `git stash` IS `stash push`
+};
+/** `git reflog` (git 2.55.0, `man git-reflog`) — the full verb set is show
+ *  (default), list, exists, write, delete, drop, expire; read: show/list/
+ *  exists, write: write/delete/drop/expire:
+ *    usage: git reflog [show] [<log-options>] [<ref>]
+ *       or: git reflog list
+ *       or: git reflog exists <ref>
+ *       or: git reflog write <ref> <old-oid> <new-oid> <message>
+ *       or: git reflog delete [--rewrite] [--updateref] [--dry-run|-n] [--verbose] <ref>@{<specifier>}...
+ *       or: git reflog drop [--all [--single-worktree] | <refs>...]
+ *       or: git reflog expire [--expire=<time>] [--expire-unreachable=<time>] [--rewrite] [--updateref] [--stale-fix] [--dry-run|-n] [--verbose] [--all [--single-worktree] | <refs>...]
+ *  (audited #299 review round 2, git 2.55.0 — re-audit against `man
+ *  git-reflog` if this ever needs revisiting, but see below for why it
+ *  shouldn't need to.)
+ *
+ *  This is an ALLOWLIST, not a deny-list of the four write verbs, and that
+ *  is deliberate: a deny-list fails OPEN the day a git version a role
+ *  actually runs adds or renames a verb we haven't enumerated — and we
+ *  cannot validate an end user's installed git from our own CI. (A runtime
+ *  `git reflog -h` guard was tried and rejected for the same reason: it
+ *  would only ever validate the git that runs our tests, which is never the
+ *  git whose version drift is the risk.) An allowlist fails CLOSED instead:
+ *  any positional this function doesn't specifically recognize as read-safe
+ *  is denied, regardless of which git produced it.
+ *
+ *  Accepted cost: `git reflog HEAD` / `git reflog my-branch` are denied here
+ *  even though real git treats an unrecognized reflog argv[0] as a <ref> (an
+ *  implicit `show`) — a small, bounded reintroduction of #299's own
+ *  over-denial class. It is self-documenting (the deny message names the
+ *  working form, `git reflog show <ref>`) and bounded, which is the trade a
+ *  security boundary should take over an unbounded silent under-denial on a
+ *  git version nobody here has run.
+ *
+ *  Round 2's first cut allowed as soon as args[0] started with '-', which
+ *  reintroduced the exact dependency the allowlist exists to remove: it
+ *  trusted THIS git's parser to keep ignoring everything after an unknown
+ *  leading option, so `git reflog --all expire` went DENY→ALLOW even though
+ *  no positional past args[0] was ever examined. reflogIsRead requires EVERY
+ *  token to be option-shaped before falling back to the default `show`. */
+function reflogIsRead(args) {
+    if (args.some((a) => /[$`{}*?[]/.test(a)))
+        return false; // fail closed
+    // EVERY token must be option-shaped, not just the first — cmd_reflog only
+    // ever honours the verb at argv[0] (OPT_SUBCOMMAND), so `git reflog --all
+    // expire` parses as `show --all expire` on git 2.55.0, not `expire --all`.
+    // A prefix check (allow as soon as args[0] starts with '-') let `--all
+    // expire`, `-n drop --all` and `-- expire` all through as false reads
+    // (#299 review round 2) — exactly the "trust this git's parser" dependency
+    // this allowlist exists to remove. `[].every(...)` is vacuously true, so
+    // this also covers the bare `git reflog` case with no separate branch.
+    if (args.every((a) => a.startsWith('-')))
+        return true; // options only (or none) -> targets the default `show`
+    return /^(show|list|exists)$/.test(args[0]);
+}
+function refineSub(sub, args) {
+    if (sub === 'reflog')
+        return reflogIsRead(args) ? 'reflog:read' : 'reflog';
+    const readPattern = GIT_SUB_READ_ARGS[sub];
+    if (!readPattern)
+        return sub;
+    if (args.some((a) => /[$`{}*?[]/.test(a)))
+        return sub; // fail closed
+    // ALLOWLIST direction (stash): git's cmd_stash dispatches on argv[0] ONLY
+    // (see `man git-stash`'s SYNOPSIS) — it does NOT skip leading options to
+    // find its subcommand. `git stash -- list` and `git stash -k list` are
+    // `stash push` (a WRITE) with "list" as a pathspec/value, not
+    // `stash list`. Skipping leading options here previously let both through
+    // as false reads onto the stash stack shared across every worktree (#299
+    // review round 1 — this is the exact mistake i-300 exists to guard
+    // against, so getting it right here matters doubly).
+    return readPattern.test(args[0] ?? '') ? `${sub}:read` : sub;
+}
 /** git options that swallow the NEXT token as their value, so the token after
  *  them is never the subcommand. `--git-dir=x` style needs no entry — the value
  *  rides in the same token. */
@@ -175,7 +263,7 @@ function gitSubcommands(cmd) {
                 subs.push(gitConfigIsWrite(tokens.slice(j + 1)) ? 'config' : 'config:read');
                 continue;
             }
-            subs.push(sub);
+            subs.push(refineSub(sub, tokens.slice(j + 1)));
         }
     }
     return { subs };
@@ -194,11 +282,41 @@ export function checkGitPolicy(cmd, level) {
     if (level === 'none')
         return `git commands are not allowed for this role (policy.git: none)`;
     for (const sub of gitCalls) {
-        if (GIT_READ_CMDS.test(sub) || sub === 'config:read')
+        // `<sub>:read` tokens are minted by the scanner for args-aware subcommands
+        // (config, stash, reflog) and can never collide with a real subcommand
+        // token — GIT_SUBCOMMAND_SHAPE forbids ':'.
+        if (GIT_READ_CMDS.test(sub) || sub.endsWith(':read'))
             continue; // always allowed at 'read' and above
         if (sub === 'config') {
             return `git config write denied (policy.git: ${level} — .git/config is shared by every worktree; writes require policy.git: 'push'. Use \`git -c key=value <cmd>\` for a one-off setting)`;
         }
+        if (sub === 'reflog') {
+            // Unrefined 'reflog' means reflogIsRead() rejected it — either an
+            // explicit write verb (write/delete/drop/expire) or a positional this
+            // allowlist doesn't recognize (see reflogIsRead's comment for why an
+            // unrecognized positional is denied rather than treated as a <ref>).
+            // Not in GIT_COMMIT_CMDS, so — same as any unrecognized subcommand —
+            // this only denies at 'read'; 'commit' and 'push' fall through below.
+            if (level === 'read') {
+                return `git reflog denied (policy.git: read — only \`git reflog\` (bare, or with log options like \`-5\`/\`--all\`), \`show\`, \`list\` and \`exists\` are read; write a specific ref explicitly, e.g. \`git reflog show <ref>\`, or use policy.git: 'commit' or 'push' for write/delete/drop/expire)`;
+            }
+            continue;
+        }
+        // #300: refs/stash lives in the COMMON git dir, so one stack is shared by
+        // the main checkout and every linked worktree — `stash` is not
+        // worktree-local like the rest of GIT_COMMIT_CMDS. A role's `stash pop`
+        // can resolve against an entry the owner pushed and destroy uncommitted
+        // work (observed 2026-09-18). Denied unconditionally below 'push' rather
+        // than only in a linked worktree: the main checkout shares the same
+        // stack, so cwd is not the boundary (and gitCommonDir() is a blocking
+        // execFileSync we don't want on every Bash decision anyway). Must sit
+        // BEFORE the GIT_COMMIT_CMDS test below: `stash` was removed from that
+        // regex, so without this branch the token falls through to the unknown-
+        // subcommand rule, which denies at 'read' but ALLOWS at 'commit' —
+        // shipping nothing while every read-level test still passes.
+        if (sub === 'stash') {
+            return `git stash denied (policy.git: ${level} — the stash stack is shared by every worktree of this repo, including the owner's, so a stash/pop can collide with work you cannot see; it requires policy.git: 'push'). To save and restore your own changes instead: \`git diff > /tmp/x.patch\` then \`git apply -R\`, or make a scratch worktree at the base SHA. \`git stash list\` and \`git stash show\` are still allowed.`;
+        }
         if (GIT_PUSH_CMDS.test(sub)) {
             return `git ${sub} denied (policy.git: ${level} — push-level commands require policy.git: 'push')`;
         }

package/dist/src/orgrt/policy-git.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-git.js","sourceRoot":"","sources":["../../../src/orgrt/policy-git.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,8EAA8E;AAC9E,+EAA+E;AAC/E,uEAAuE;AACvE,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,aAAa,GACjB,4IAA4I,CAAC;AAC/I,MAAM,eAAe,GACnB,+GAA+G,CAAC;AAClH,MAAM,aAAa,GAAG,gDAAgD,CAAC;AAEvE;;;;;;;;;;;oCAWoC;AACpC,MAAM,qBAAqB,GACzB,6EAA6E,CAAC;AAChF,MAAM,oBAAoB,GACxB,0IAA0I,CAAC;AAC7I,MAAM,qBAAqB,GAAG,uCAAuC,CAAC;AACtE,SAAS,gBAAgB,CAAC,IAAc;IACtC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,MAAM;QACR,CAAC;QACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC9C,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC,EAAE,CAAC,CAAC,+BAA+B;aACjC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,+EAA+E;IAC/E,IAAI,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,kDAAkD,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9F,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,kEAAkE;AACpG,CAAC;AAED;;+BAE+B;AAC/B,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,IAAI;IACJ,IAAI;IACJ,WAAW;IACX,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;CACf,CAAC,CAAC;AAEH;;;;kEAIkE;AAClE,MAAM,oBAAoB,GACxB,wFAAwF,CAAC;AAE3F;;;uDAGuD;AACvD,MAAM,aAAa,GACjB,gOAAgO,CAAC;AACnO;+CAC+C;AAC/C,MAAM,WAAW,GAAG,mDAAmD,CAAC;AAExE;4EAC4E;AAC5E,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AACD,MAAM,UAAU,GAAG,+BAA+B,CAAC;AAEnD,yEAAyE;AACzE,MAAM,OAAO,GAAG,oBAAoB,CAAC;AACrC;0EAC0E;AAC1E,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AACjD;kEACkE;AAClE,MAAM,YAAY,GAChB,gFAAgF,CAAC;AAEnF;;;;;;;;;;;;;GAaG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,wDAAwD;QACxD,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;YACvC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,IAAI,GAAG,EAAE,CAAC;QAC/F,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,2CAA2C,EAAE,CAAC;YAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,yCAAyC,EAAE,CAAC;YAC5E,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,sDAAsD,EAAE,CAAC;QAC3F,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,uBAAuB;gBACtD,MAAM,QAAQ,GACZ,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,cAAc;oBAChC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;oBACf,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;wBAC7B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC;wBACjC,CAAC,CAAC,SAAS,CAAC;gBAClB,IAAI,QAAQ,KAAK,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC7E,OAAO;wBACL,IAAI;wBACJ,MAAM,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iCAAiC;qBAC5E,CAAC;gBACJ,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/B,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC,CAAC,cAAc;gBAChB,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B;YACpC,CAAC;YACD,uEAAuE;YACvE,6DAA6D;YAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;YAClD,8EAA8E;YAC9E,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM;gBAAE,SAAS;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;gBACjC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,GAAG,GAAG,EAAE,CAAC;YACjE,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,uFAAuF;gBACvF,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,KAA0C;IAE1C,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACvF,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvD,4EAA4E;IAC5E,4EAA4E;IAC5E,gCAAgC;IAChC,IAAI,MAAM;QACR,OAAO,mBAAmB,MAAM,kBAAkB,KAAK,4DAA4D,CAAC;IACtH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;IAE5E,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,+DAA+D,CAAC;IAE7F,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,aAAa;YAAE,SAAS,CAAC,qCAAqC;QAErG,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,OAAO,wCAAwC,KAAK,sIAAsI,CAAC;QAC7L,CAAC;QAED,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,OAAO,GAAG,wBAAwB,KAAK,oDAAoD,CAAC;QACrG,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,KAAK,KAAK,MAAM;gBAClB,OAAO,OAAO,GAAG,uFAAuF,CAAC;YAC3G,SAAS;QACX,CAAC;QACD,uEAAuE;QACvE,IAAI,KAAK,KAAK,MAAM;YAClB,OAAO,OAAO,GAAG,yDAAyD,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"policy-git.js","sourceRoot":"","sources":["../../../src/orgrt/policy-git.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,8EAA8E;AAC9E,+EAA+E;AAC/E,uEAAuE;AACvE,8EAA8E;AAC9E,2EAA2E;AAC3E,+EAA+E;AAC/E,2DAA2D;AAC3D,MAAM,aAAa,GACjB,+OAA+O,CAAC;AAClP,2EAA2E;AAC3E,0EAA0E;AAC1E,4EAA4E;AAC5E,6CAA6C;AAC7C,MAAM,eAAe,GACnB,yGAAyG,CAAC;AAC5G,MAAM,aAAa,GAAG,gDAAgD,CAAC;AAEvE;;;;;;;;;;;oCAWoC;AACpC,MAAM,qBAAqB,GACzB,6EAA6E,CAAC;AAChF,MAAM,oBAAoB,GACxB,0IAA0I,CAAC;AAC7I,MAAM,qBAAqB,GAAG,uCAAuC,CAAC;AACtE,SAAS,gBAAgB,CAAC,IAAc;IACtC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,MAAM;QACR,CAAC;QACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC9C,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC,EAAE,CAAC,CAAC,+BAA+B;aACjC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,+EAA+E;IAC/E,IAAI,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,kDAAkD,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9F,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,kEAAkE;AACpG,CAAC;AAED;;;;;;;mDAOmD;AACnD,MAAM,iBAAiB,GAA2B;IAChD,KAAK,EAAE,eAAe,EAAE,8CAA8C;CACvE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAqC2E;AAC3E,SAAS,YAAY,CAAC,IAAc;IAClC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,cAAc;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,uDAAuD;IAC9G,OAAO,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAc;IAC5C,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3E,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,cAAc;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,8DAA8D;IAC9D,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnE,qDAAqD;IACrD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;AAC/D,CAAC;AAED;;+BAE+B;AAC/B,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,IAAI;IACJ,IAAI;IACJ,WAAW;IACX,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;CACf,CAAC,CAAC;AAEH;;;;kEAIkE;AAClE,MAAM,oBAAoB,GACxB,wFAAwF,CAAC;AAE3F;;;uDAGuD;AACvD,MAAM,aAAa,GACjB,gOAAgO,CAAC;AACnO;+CAC+C;AAC/C,MAAM,WAAW,GAAG,mDAAmD,CAAC;AAExE;4EAC4E;AAC5E,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AACD,MAAM,UAAU,GAAG,+BAA+B,CAAC;AAEnD,yEAAyE;AACzE,MAAM,OAAO,GAAG,oBAAoB,CAAC;AACrC;0EAC0E;AAC1E,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AACjD;kEACkE;AAClE,MAAM,YAAY,GAChB,gFAAgF,CAAC;AAEnF;;;;;;;;;;;;;GAaG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,wDAAwD;QACxD,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;YACvC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,IAAI,GAAG,EAAE,CAAC;QAC/F,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,2CAA2C,EAAE,CAAC;YAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,yCAAyC,EAAE,CAAC;YAC5E,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,sDAAsD,EAAE,CAAC;QAC3F,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,uBAAuB;gBACtD,MAAM,QAAQ,GACZ,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,cAAc;oBAChC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;oBACf,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;wBAC7B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC;wBACjC,CAAC,CAAC,SAAS,CAAC;gBAClB,IAAI,QAAQ,KAAK,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC7E,OAAO;wBACL,IAAI;wBACJ,MAAM,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iCAAiC;qBAC5E,CAAC;gBACJ,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/B,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC,CAAC,cAAc;gBAChB,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B;YACpC,CAAC;YACD,uEAAuE;YACvE,6DAA6D;YAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;YAClD,8EAA8E;YAC9E,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM;gBAAE,SAAS;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;gBACjC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,GAAG,GAAG,EAAE,CAAC;YACjE,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,uFAAuF;gBACvF,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,KAA0C;IAE1C,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACvF,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvD,4EAA4E;IAC5E,4EAA4E;IAC5E,gCAAgC;IAChC,IAAI,MAAM;QACR,OAAO,mBAAmB,MAAM,kBAAkB,KAAK,4DAA4D,CAAC;IACtH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;IAE5E,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,+DAA+D,CAAC;IAE7F,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,2EAA2E;QAC3E,uEAAuE;QACvE,4CAA4C;QAC5C,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS,CAAC,qCAAqC;QAErG,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,OAAO,wCAAwC,KAAK,sIAAsI,CAAC;QAC7L,CAAC;QAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,+RAA+R,CAAC;YACzS,CAAC;YACD,SAAS;QACX,CAAC;QAED,0EAA0E;QAC1E,+DAA+D;QAC/D,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,oEAAoE;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,6DAA6D;QAC7D,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,OAAO,iCAAiC,KAAK,qXAAqX,CAAC;QACra,CAAC;QAED,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,OAAO,GAAG,wBAAwB,KAAK,oDAAoD,CAAC;QACrG,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,KAAK,KAAK,MAAM;gBAClB,OAAO,OAAO,GAAG,uFAAuF,CAAC;YAC3G,SAAS;QACX,CAAC;QACD,uEAAuE;QACvE,IAAI,KAAK,KAAK,MAAM;YAClB,OAAO,OAAO,GAAG,yDAAyD,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/orgrt/policy.d.ts

@@ -39,11 +39,23 @@ export declare class PolicyEngine {
     policy: RolePolicy;
     private bus;
     private cwd;
+    /** #303: extra roots the file tools may touch beyond cwd — the role's
+     *  temp dir, the org root, and any `policy.sandbox.allowWrite` entries
+     *  (file-roots.ts's `fileToolRoots()`, computed by the daemon). Deny
+     *  lists (file-roots.ts's `fileToolDenied()`) still apply inside every
+     *  root, cwd included — see the deny pass below. */
+    private roots;
     private used;
     /** ORG-7: accumulated USD cost for this role, mirrors `used` (tokens). */
     private usedUsd;
     private toolContext;
-    constructor(role: string, policy: RolePolicy, bus: OrgBus, cwd: string);
+    constructor(role: string, policy: RolePolicy, bus: OrgBus, cwd: string, 
+    /** #303: extra roots the file tools may touch beyond cwd — the role's
+     *  temp dir, the org root, and any `policy.sandbox.allowWrite` entries
+     *  (file-roots.ts's `fileToolRoots()`, computed by the daemon). Deny
+     *  lists (file-roots.ts's `fileToolDenied()`) still apply inside every
+     *  root, cwd included — see the deny pass below. */
+    roots?: string[]);
     /** Wire provider prefixes and trace source (daemon, M1). */
     setToolContext(ctx: PolicyToolContext): void;
     /** Hot reload (`org reload`): replace the role's policy. Budget ceilings the

package/dist/src/orgrt/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/orgrt/policy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC,OAAO,EAAE,KAAK,UAAU,EAAgC,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC5D;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAgD1C,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED;;;mFAGmF;AACnF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,CASA;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA6BjD;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC;kFAC8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAClC,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAC7D;AAID,qBAAa,YAAY;IAMrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACd,MAAM,EAAE,UAAU;IACzB,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,GAAG;IARb,OAAO,CAAC,IAAI,CAAK;IACjB,0EAA0E;IAC1E,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,WAAW,CAAyB;IAC5C,YACW,IAAI,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACjB;IAEJ,4DAA4D;IAC5D,cAAc,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,CAE3C;IAED;;4BAEwB;IACxB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAMnC;IAED,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAE7B;IACD,IAAI,KAAK,IAAI,MAAM,CAElB;IACD,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAE7B;IACD,IAAI,UAAU,IAAI,OAAO,CAExB;IAED,gFAAgF;IAChF,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjC;IACD,IAAI,QAAQ,IAAI,MAAM,CAErB;IACD,gFAAgF;IAChF,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjC;IACD;;wEAEoE;IACpE,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED;;;yEAGqE;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiK7F;CACF;AAED;;2EAE2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOvE;AA4BD;0CAC0C;AAC1C,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE1F"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/orgrt/policy.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,KAAK,UAAU,EAAgC,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC5D;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAgD1C,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED;;;mFAGmF;AACnF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,CASA;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA6BjD;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC;kFAC8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAClC,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAC7D;AAID,qBAAa,YAAY;IAMrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACd,MAAM,EAAE,UAAU;IACzB,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,GAAG;IACX;;;;wDAIoD;IACpD,OAAO,CAAC,KAAK;IAdf,OAAO,CAAC,IAAI,CAAK;IACjB,0EAA0E;IAC1E,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,WAAW,CAAyB;IAC5C,YACW,IAAI,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM;IACnB;;;;wDAIoD;IAC5C,KAAK,GAAE,MAAM,EAAO,EAC1B;IAEJ,4DAA4D;IAC5D,cAAc,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,CAE3C;IAED;;4BAEwB;IACxB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAMnC;IAED,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAE7B;IACD,IAAI,KAAK,IAAI,MAAM,CAElB;IACD,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAE7B;IACD,IAAI,UAAU,IAAI,OAAO,CAExB;IAED,gFAAgF;IAChF,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjC;IACD,IAAI,QAAQ,IAAI,MAAM,CAErB;IACD,gFAAgF;IAChF,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjC;IACD;;wEAEoE;IACpE,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED;;;yEAGqE;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqM7F;CACF;AAED;;2EAE2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOvE;AAwCD;0CAC0C;AAC1C,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE1F"}

package/dist/src/orgrt/policy.js

@@ -1,6 +1,8 @@
 // packages/@monomind/cli/src/orgrt/policy.ts
 import { realpathSync } from 'node:fs';
-import { basename, dirname, join, relative, resolve, sep } from 'node:path';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { fileToolDenied } from './file-roots.js';
 import { checkGitPolicy } from './policy-git.js';
 import { TOOL_RESULT_OUTPUT_MAX_CHARS } from './types.js';
 const WRITE_TOOLS = new Set(['Write', 'Edit', 'NotebookEdit']);
@@ -109,15 +111,23 @@ export class PolicyEngine {
     policy;
     bus;
     cwd;
+    roots;
     used = 0;
     /** ORG-7: accumulated USD cost for this role, mirrors `used` (tokens). */
     usedUsd = 0;
     toolContext = {};
-    constructor(role, policy, bus, cwd) {
+    constructor(role, policy, bus, cwd, 
+    /** #303: extra roots the file tools may touch beyond cwd — the role's
+     *  temp dir, the org root, and any `policy.sandbox.allowWrite` entries
+     *  (file-roots.ts's `fileToolRoots()`, computed by the daemon). Deny
+     *  lists (file-roots.ts's `fileToolDenied()`) still apply inside every
+     *  root, cwd included — see the deny pass below. */
+    roots = []) {
         this.role = role;
         this.policy = policy;
         this.bus = bus;
         this.cwd = cwd;
+        this.roots = roots;
     }
     /** Wire provider prefixes and trace source (daemon, M1). */
     setToolContext(ctx) {
@@ -254,12 +264,10 @@ export class PolicyEngine {
             if (p !== null) {
                 // SEC: compare REAL paths — a symlink inside the scope pointing outside
                 // the workdir (or at an out-of-scope file) passed the lexical check.
-                const rel = relative(realPath(this.cwd), realPath(resolve(this.cwd, p)));
-                // #291: naming only the rejected path leaves the role guessing another
-                // absolute path — it never learns the root it is confined to. Name the
-                // boundary and how paths resolve so the next turn can be correct.
-                if (rel.startsWith('..'))
-                    return deny(`path escapes org workdir: ${p} (org workdir: ${this.cwd} — paths are resolved relative to that directory; retry with a path inside it)`);
+                // Resolved once and reused below: the root check, the deny pass and
+                // the .git check (#258) all key off the same real path.
+                const real = realPath(resolve(this.cwd, p));
+                const realCwd = realPath(this.cwd);
                 // fileWrite/fileRead globs are always authored with '/' separators (POSIX
                 // convention, matches every example in types.ts and the skill docs) — but
                 // path.relative()/path.resolve() return '\'-separated paths on Windows, and
@@ -267,16 +275,46 @@ export class PolicyEngine {
                 // normalizing, every glob with a '/' in it silently fails to match on
                 // Windows and a role with ANY fileWrite/fileRead scope narrower than the
                 // unrestricted ['**'] default is denied on every single call.
+                const rel = relative(realCwd, real);
                 const relPosix = rel.split(sep).join('/');
-                if (!globs.some((g) => globToRegExp(g).test(relPosix)))
+                const realPosix = real.split(sep).join('/');
+                // #303: an absolute fileRead/fileWrite glob is an explicit, author-
+                // written grant — it authorizes a path on its own, independent of
+                // cwd/roots, the same way `policy.sandbox.allowWrite` does for Bash.
+                const grantedByAbsoluteGlob = globs.some((g) => isAbsolute(g) && globToRegExp(g).test(realPosix));
+                if (!grantedByAbsoluteGlob) {
+                    // #303: beyond cwd, a role may also reach $TMPDIR, the org root, and
+                    // any operator-granted policy.sandbox.allowWrite entries — the same
+                    // roots the Bash sandbox already treats as writable (file-roots.ts).
+                    // $HOME is deliberately never one of them; see file-roots.ts's doc
+                    // comment.
+                    const realRoots = uniq([realCwd, ...this.roots.map(realPath)]);
+                    // #291: naming only the rejected path leaves the role guessing another
+                    // absolute path — it never learns the roots it is confined to. Name
+                    // the boundary and how paths resolve so the next turn can be correct.
+                    if (!realRoots.some((root) => isWithin(root, real)))
+                        return deny(`path escapes every root this role may use: ${p} (roots: ${realRoots.join(', ')} — paths are resolved relative to org workdir ${this.cwd}; retry with a path inside one of them)`);
+                }
+                // #303: a widened root must not make credential stores, guard-undoing
+                // config, sockets, or the XDG runtime dir reachable — today they are
+                // unreachable purely because they sit outside cwd, an accident that
+                // vanishes the moment another root admits them (e.g. allowWrite:
+                // [$HOME]). Runs for READ_TOOLS too, unlike the .git check below,
+                // which is write-only.
+                const deniedHit = fileToolDenied(homedir(), process.env).find((d) => isWithin(realPath(d), real));
+                if (deniedHit)
+                    return deny(`path ${p} resolves inside ${deniedHit}, which no role may touch regardless of scope, root, or allowWrite (credential store, guard config, socket, or runtime dir)`);
+                if (!grantedByAbsoluteGlob &&
+                    !globs.some((g) => !isAbsolute(g) && globToRegExp(g).test(relPosix)))
                     return deny(`path ${rel} outside ${WRITE_TOOLS.has(tool) ? 'write' : 'read'} scope — role ${this.role} may use ${globs.join(', ')} (relative to org workdir ${this.cwd})`);
                 // #258: Write/Edit run in-process, so the OS sandbox never sees them —
                 // without this a 'read' role could write refs and objects straight into
                 // .git, and a 'commit' role could rewrite the shared identity (#250) or
-                // the hooks that enforce its own level.
+                // the hooks that enforce its own level. Still fires for a path admitted
+                // via a root other than cwd (#303) — it does not depend on `rel`.
                 if (WRITE_TOOLS.has(tool)) {
                     const gitLevel = this.policy.git ?? 'read';
-                    const segments = realPath(resolve(this.cwd, p)).split(sep);
+                    const segments = real.split(sep);
                     const at = segments.lastIndexOf('.git');
                     const inGit = segments[at + 1];
                     if (gitLevel !== 'push' &&
@@ -318,6 +356,17 @@ export function webDomainMatches(pattern, host) {
     }
     return host === pattern || host.endsWith(`.${pattern}`);
 }
+const uniq = (xs) => [...new Set(xs)];
+/** #303: is `target` equal to, or nested under, `container`? Both must
+ *  already be `realPath()`-resolved — this is a plain string comparison, not
+ *  a filesystem check, so a symlink escape must be resolved before this
+ *  runs, never lexically. */
+function isWithin(container, target) {
+    if (container === target)
+        return true;
+    const withSep = container.endsWith(sep) ? container : container + sep;
+    return target.startsWith(withSep);
+}
 /** realpath of `p`, resolving through the nearest EXISTING ancestor when the
  *  target itself doesn't exist yet (a Write into a symlinked directory), and
  *  falling back to the lexical path when nothing on it exists. */

package/dist/src/orgrt/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/orgrt/policy.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE5E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAmB,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAM3E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAC/D;;;4DAG4D;AAC5D,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AACrD;uFACuF;AACvF,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC;;mEAEmE;AACnE,MAAM,cAAc,GAClB,6JAA6J,CAAC;AAChK;;;;sEAIsE;AACtE,MAAM,eAAe,GAA4B;IAC/C,CAAC,6EAA6E,EAAE,YAAY,CAAC;IAC7F,CAAC,wCAAwC,EAAE,cAAc,CAAC;IAC1D,CAAC,mCAAmC,EAAE,cAAc,CAAC;IACrD,CAAC,+BAA+B,EAAE,YAAY,CAAC;IAC/C,CAAC,+BAA+B,EAAE,YAAY,CAAC;IAC/C,CAAC,iCAAiC,EAAE,YAAY,CAAC;IACjD,CAAC,uBAAuB,EAAE,YAAY,CAAC;IACvC,CAAC,iCAAiC,EAAE,YAAY,CAAC;IACjD,CAAC,2BAA2B,EAAE,YAAY,CAAC;IAC3C,CAAC,iEAAiE,EAAE,YAAY,CAAC;IACjF,wDAAwD;IACxD;QACE,yGAAyG;QACzG,cAAc;KACf;IACD,uEAAuE;IACvE;QACE,wJAAwJ;QACxJ,cAAc;KACf;IACD,+CAA+C;IAC/C,CAAC,iDAAiD,EAAE,eAAe,CAAC;CACrE,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,eAAe;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;mFAGmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAK9C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,4BAA4B;QAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACtD,OAAO;QACL,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,4BAA4B,CAAC,cAAc;QACrE,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI,CAAC,MAAM;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YAC9B,GAAG,IAAI,UAAU,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,GAAG,IAAI,OAAO,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAChC,CAAC;AAWD,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC,MAAM,OAAO,YAAY;IAMZ,IAAI;IACN,MAAM;IACL,GAAG;IACH,GAAG;IARL,IAAI,GAAG,CAAC,CAAC;IACjB,0EAA0E;IAClE,OAAO,GAAG,CAAC,CAAC;IACZ,WAAW,GAAsB,EAAE,CAAC;IAC5C,YACW,IAAY,EACd,MAAkB,EACjB,GAAW,EACX,GAAW;oBAHV,IAAI;sBACN,MAAM;mBACL,GAAG;mBACH,GAAG;IACV,CAAC;IAEJ,4DAA4D;IAC5D,cAAc,CAAC,GAAsB;QACnC,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;IACzB,CAAC;IAED;;4BAEwB;IACxB,YAAY,CAAC,IAAgB;QAC3B,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;SAChB,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;IACtB,CAAC;IACD,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,mEAAmE;IACnE,QAAQ,CAAC,MAAc;QACrB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;IACrB,CAAC;IACD,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;IAC7E,CAAC;IAED,gFAAgF;IAChF,WAAW,CAAC,OAAe;QACzB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;IAC1B,CAAC;IACD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,gFAAgF;IAChF,WAAW,CAAC,OAAe;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IACD;;wEAEoE;IACpE,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1E,CAAC;IAED;;;yEAGqE;IACrE,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,KAA8B,EAAE,MAAe;QACxE,MAAM,SAAS,GAAG,GAA4B,EAAE;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC;YACzC,OAAO;gBACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAY,EAAE;YACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI;gBACJ,QAAQ,EAAE,MAAM;gBAChB,MAAM;gBACN,IAAI,EAAE,SAAS,EAAE;aAClB,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,MAAM,EAAE,EAAE,CAAC;QACjE,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAa,EAAE;YAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI;gBACJ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,SAAS,EAAE;aAClB,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACjE,2EAA2E;gBAC3E,0EAA0E;gBAC1E,0EAA0E;gBAC1E,uEAAuE;gBACvE,uEAAuE;gBACvE,yEAAyE;gBACzE,wEAAwE;gBACxE,MAAM,OAAO,GACX,IAAI,KAAK,OAAO;oBAChB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;oBACjC,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,kBAAkB;oBAC1C,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC3C,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;oBAC9B,CAAC,CAAC,SAAS,CAAC;gBAChB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;oBAC7B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACpD,CAAC,CAAC;QAEF,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC;YACnC,OAAO,IAAI,CACT,GAAG,IAAI,oIAAoI,CAC5I,CAAC;QACJ,IAAI,IAAI,CAAC,UAAU;YACjB,OAAO,IAAI,CAAC,2BAA2B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,aAAa;YACpB,OAAO,IAAI,CAAC,0BAA0B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3F,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC;YAChF,OAAO,IAAI,CAAC,QAAQ,IAAI,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IACE,IAAI,CAAC,MAAM,CAAC,UAAU;YACtB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAC7B,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAE9E,OAAO,IAAI,CACT,QAAQ,IAAI,8BAA8B,IAAI,CAAC,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtG,CAAC;QAEJ,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;gBACjC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAC7D,MAAM,CAAC,GACL,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;gBACjC,CAAC,CAAC,KAAK,CAAC,SAAS;gBACjB,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAC9B,CAAC,CAAC,KAAK,CAAC,IAAI;oBACZ,CAAC,CAAC,IAAI,CAAC;YACb,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChC,uEAAuE;gBACvE,mEAAmE;gBACnE,qEAAqE;gBACrE,uEAAuE;gBACvE,OAAO,IAAI,CACT,GAAG,IAAI,mCAAmC,IAAI,CAAC,IAAI,MAAM,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,wEAAwE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,GAAG,GAAG,CAClO,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,wEAAwE;gBACxE,qEAAqE;gBACrE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzE,uEAAuE;gBACvE,uEAAuE;gBACvE,kEAAkE;gBAClE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;oBACtB,OAAO,IAAI,CACT,6BAA6B,CAAC,kBAAkB,IAAI,CAAC,GAAG,gFAAgF,CACzI,CAAC;gBACJ,0EAA0E;gBAC1E,0EAA0E;gBAC1E,4EAA4E;gBAC5E,2EAA2E;gBAC3E,sEAAsE;gBACtE,yEAAyE;gBACzE,8DAA8D;gBAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACpD,OAAO,IAAI,CACT,QAAQ,GAAG,YAAY,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,iBAAiB,IAAI,CAAC,IAAI,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,GAAG,GAAG,CAC9J,CAAC;gBACJ,uEAAuE;gBACvE,wEAAwE;gBACxE,wEAAwE;gBACxE,wCAAwC;gBACxC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC;oBAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC3D,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;oBACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC/B,IACE,QAAQ,KAAK,MAAM;wBACnB,EAAE,KAAK,CAAC,CAAC;wBACT,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,CAAC;wBAElE,OAAO,IAAI,CACT,eAAe,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,QAAQ,GAAG,CACxF,CAAC;gBACN,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC;YAC3C,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,SAAS;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACnC,OAAO,IAAI,CAAC,gCAAgC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBACvE,OAAO,IAAI,CACT,UAAU,IAAI,IAAI,GAAG,yCAAyC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChG,CAAC;YACN,CAAC;YACD,kEAAkE;QACpE,CAAC;QAED,OAAO,KAAK,EAAE,CAAC;IACjB,CAAC;CACF;AAED;;2EAE2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAY;IAC5D,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;kEAEkE;AAClE,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AACD;0CAC0C;AAC1C,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AACD,SAAS,SAAS,CAAC,KAA8B;IAC/C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,yDAAyD;QACzF,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/orgrt/policy.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAmB,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAM3E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAC/D;;;4DAG4D;AAC5D,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AACrD;uFACuF;AACvF,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC;;mEAEmE;AACnE,MAAM,cAAc,GAClB,6JAA6J,CAAC;AAChK;;;;sEAIsE;AACtE,MAAM,eAAe,GAA4B;IAC/C,CAAC,6EAA6E,EAAE,YAAY,CAAC;IAC7F,CAAC,wCAAwC,EAAE,cAAc,CAAC;IAC1D,CAAC,mCAAmC,EAAE,cAAc,CAAC;IACrD,CAAC,+BAA+B,EAAE,YAAY,CAAC;IAC/C,CAAC,+BAA+B,EAAE,YAAY,CAAC;IAC/C,CAAC,iCAAiC,EAAE,YAAY,CAAC;IACjD,CAAC,uBAAuB,EAAE,YAAY,CAAC;IACvC,CAAC,iCAAiC,EAAE,YAAY,CAAC;IACjD,CAAC,2BAA2B,EAAE,YAAY,CAAC;IAC3C,CAAC,iEAAiE,EAAE,YAAY,CAAC;IACjF,wDAAwD;IACxD;QACE,yGAAyG;QACzG,cAAc;KACf;IACD,uEAAuE;IACvE;QACE,wJAAwJ;QACxJ,cAAc;KACf;IACD,+CAA+C;IAC/C,CAAC,iDAAiD,EAAE,eAAe,CAAC;CACrE,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,eAAe;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;mFAGmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAK9C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,4BAA4B;QAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACtD,OAAO;QACL,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,4BAA4B,CAAC,cAAc;QACrE,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI,CAAC,MAAM;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YAC9B,GAAG,IAAI,UAAU,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,GAAG,IAAI,OAAO,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAChC,CAAC;AAWD,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC,MAAM,OAAO,YAAY;IAMZ,IAAI;IACN,MAAM;IACL,GAAG;IACH,GAAG;IAMH,KAAK;IAdP,IAAI,GAAG,CAAC,CAAC;IACjB,0EAA0E;IAClE,OAAO,GAAG,CAAC,CAAC;IACZ,WAAW,GAAsB,EAAE,CAAC;IAC5C,YACW,IAAY,EACd,MAAkB,EACjB,GAAW,EACX,GAAW;IACnB;;;;wDAIoD;IAC5C,KAAK,GAAa,EAAE;oBATnB,IAAI;sBACN,MAAM;mBACL,GAAG;mBACH,GAAG;qBAMH,KAAK;IACZ,CAAC;IAEJ,4DAA4D;IAC5D,cAAc,CAAC,GAAsB;QACnC,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;IACzB,CAAC;IAED;;4BAEwB;IACxB,YAAY,CAAC,IAAgB;QAC3B,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;SAChB,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;IACtB,CAAC;IACD,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,mEAAmE;IACnE,QAAQ,CAAC,MAAc;QACrB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;IACrB,CAAC;IACD,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;IAC7E,CAAC;IAED,gFAAgF;IAChF,WAAW,CAAC,OAAe;QACzB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;IAC1B,CAAC;IACD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,gFAAgF;IAChF,WAAW,CAAC,OAAe;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IACD;;wEAEoE;IACpE,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1E,CAAC;IAED;;;yEAGqE;IACrE,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,KAA8B,EAAE,MAAe;QACxE,MAAM,SAAS,GAAG,GAA4B,EAAE;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC;YACzC,OAAO;gBACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAY,EAAE;YACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI;gBACJ,QAAQ,EAAE,MAAM;gBAChB,MAAM;gBACN,IAAI,EAAE,SAAS,EAAE;aAClB,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,MAAM,EAAE,EAAE,CAAC;QACjE,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAa,EAAE;YAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI;gBACJ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,SAAS,EAAE;aAClB,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACjE,2EAA2E;gBAC3E,0EAA0E;gBAC1E,0EAA0E;gBAC1E,uEAAuE;gBACvE,uEAAuE;gBACvE,yEAAyE;gBACzE,wEAAwE;gBACxE,MAAM,OAAO,GACX,IAAI,KAAK,OAAO;oBAChB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;oBACjC,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,kBAAkB;oBAC1C,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC3C,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;oBAC9B,CAAC,CAAC,SAAS,CAAC;gBAChB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;oBAC7B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACpD,CAAC,CAAC;QAEF,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC;YACnC,OAAO,IAAI,CACT,GAAG,IAAI,oIAAoI,CAC5I,CAAC;QACJ,IAAI,IAAI,CAAC,UAAU;YACjB,OAAO,IAAI,CAAC,2BAA2B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,aAAa;YACpB,OAAO,IAAI,CAAC,0BAA0B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3F,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC;YAChF,OAAO,IAAI,CAAC,QAAQ,IAAI,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IACE,IAAI,CAAC,MAAM,CAAC,UAAU;YACtB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAC7B,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAE9E,OAAO,IAAI,CACT,QAAQ,IAAI,8BAA8B,IAAI,CAAC,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtG,CAAC;QAEJ,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;gBACjC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAC7D,MAAM,CAAC,GACL,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;gBACjC,CAAC,CAAC,KAAK,CAAC,SAAS;gBACjB,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAC9B,CAAC,CAAC,KAAK,CAAC,IAAI;oBACZ,CAAC,CAAC,IAAI,CAAC;YACb,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChC,uEAAuE;gBACvE,mEAAmE;gBACnE,qEAAqE;gBACrE,uEAAuE;gBACvE,OAAO,IAAI,CACT,GAAG,IAAI,mCAAmC,IAAI,CAAC,IAAI,MAAM,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,wEAAwE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,GAAG,GAAG,CAClO,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,wEAAwE;gBACxE,qEAAqE;gBACrE,oEAAoE;gBACpE,wDAAwD;gBACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnC,0EAA0E;gBAC1E,0EAA0E;gBAC1E,4EAA4E;gBAC5E,2EAA2E;gBAC3E,sEAAsE;gBACtE,yEAAyE;gBACzE,8DAA8D;gBAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC5C,oEAAoE;gBACpE,kEAAkE;gBAClE,qEAAqE;gBACrE,MAAM,qBAAqB,GAAG,KAAK,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CACxD,CAAC;gBACF,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBAC3B,qEAAqE;oBACrE,oEAAoE;oBACpE,qEAAqE;oBACrE,mEAAmE;oBACnE,WAAW;oBACX,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;oBAC/D,uEAAuE;oBACvE,oEAAoE;oBACpE,sEAAsE;oBACtE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;wBACjD,OAAO,IAAI,CACT,8CAA8C,CAAC,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD,IAAI,CAAC,GAAG,yCAAyC,CAClL,CAAC;gBACN,CAAC;gBACD,sEAAsE;gBACtE,qEAAqE;gBACrE,oEAAoE;gBACpE,iEAAiE;gBACjE,kEAAkE;gBAClE,uBAAuB;gBACvB,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAC5B,CAAC;gBACF,IAAI,SAAS;oBACX,OAAO,IAAI,CACT,QAAQ,CAAC,oBAAoB,SAAS,6HAA6H,CACpK,CAAC;gBACJ,IACE,CAAC,qBAAqB;oBACtB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAEpE,OAAO,IAAI,CACT,QAAQ,GAAG,YAAY,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,iBAAiB,IAAI,CAAC,IAAI,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,GAAG,GAAG,CAC9J,CAAC;gBACJ,uEAAuE;gBACvE,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,kEAAkE;gBAClE,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC;oBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;oBACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC/B,IACE,QAAQ,KAAK,MAAM;wBACnB,EAAE,KAAK,CAAC,CAAC;wBACT,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,CAAC;wBAElE,OAAO,IAAI,CACT,eAAe,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,QAAQ,GAAG,CACxF,CAAC;gBACN,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC;YAC3C,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,SAAS;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACnC,OAAO,IAAI,CAAC,gCAAgC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBACvE,OAAO,IAAI,CACT,UAAU,IAAI,IAAI,GAAG,yCAAyC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChG,CAAC;YACN,CAAC;YACD,kEAAkE;QACpE,CAAC;QAED,OAAO,KAAK,EAAE,CAAC;IACjB,CAAC;CACF;AAED;;2EAE2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAY;IAC5D,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,EAAY,EAAY,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAE1D;;;6BAG6B;AAC7B,SAAS,QAAQ,CAAC,SAAiB,EAAE,MAAc;IACjD,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;IACtE,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;kEAEkE;AAClE,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AACD;0CAC0C;AAC1C,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AACD,SAAS,SAAS,CAAC,KAA8B;IAC/C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,yDAAyD;QACzF,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/orgrt/reporting.d.ts

@@ -20,17 +20,73 @@ export interface RunSummary {
     crashes: string[];
     /** Roles terminated by our own stop signal (exit 143), not real crashes. */
     cutShort: string[];
+    /** #302: only ever set from a status event with reason 'org-complete' —
+     *  i.e. only when a boss's org_complete call was actually ALLOWED (a
+     *  refusal never emits that event). `status`/`summary` are the boss's own
+     *  claim. */
     outcome: {
         status: string;
         summary: string;
         by: string;
     } | null;
+    /** #302: recorded TOP-LEVEL, a sibling of `outcome` rather than nested
+     *  inside it — deliberately, per review: `outcome` is null on every
+     *  non-org_complete stop path (idle watchdog, manual stop, a scheduled
+     *  deadline, ...), the same way `crashes`/`cutShort` are top-level so they
+     *  survive a stop that never produces an `outcome`. Only ever set alongside
+     *  a genuine `outcome: 'partial'` (the only shape `blocker` accompanies —
+     *  `checkCompletion` never lets a bare/invalid blocker through), so in
+     *  practice it appears exactly when `outcome` does; the point is that a
+     *  renderer must not have to reach INTO `outcome` to find it, and a future
+     *  path that wants to record an attempted-but-refused blocker claim can
+     *  populate this independently of whether `outcome` ever gets set. */
+    blocker?: string;
+    blockerDetail?: string;
+    /** #302 truth gate: how the run actually ended, from the 'org-stopped'
+     *  event `finishStop` always emits — the UNIVERSAL choke point every stop
+     *  path funnels through (`stopOrg` → `finishStop`; `stopAll` fans out to
+     *  `stopOrg`), so this is set correctly regardless of which of the many
+     *  call sites triggered the stop: 'org-complete' for a boss's own,
+     *  gate-checked call; 'idle-stop' | 'failed-start' | 'scheduled-deadline' |
+     *  'boss-restart' | 'boss-restart-exhausted' for an automated path that
+     *  ends the run without boss consent; undefined for a bare manual
+     *  `org stop`/shutdown. (A process-level crash is recorded separately, in
+     *  runtime.json only, by `persistCrashStateAll` — it never reaches this
+     *  event at all, since the process has no time left for a graceful stop.
+     *  KNOWN, REASONED GAP — an 11th path: `org mark-complete` (org.ts) also
+     *  writes `closedBy: 'mark-complete'` directly to runtime.json, with a
+     *  bare writeFileSync, and only runs once the daemon's pid is already
+     *  gone. It never touches the bus or calls stopOrg/finishStop, so this
+     *  RunSummary field — and `runnableTasksAtStop` — are simply absent for
+     *  that run: there is no history.jsonl entry for it at all, since a
+     *  SIGKILLed daemon never ran finishStop's history-append either. This is
+     *  arguably correct (there is no stop to record if it never ran), but the
+     *  absence is deliberate, not an oversight — a renderer must not assume
+     *  every `closedBy` on runtime.json came from this truth gate.)
+     *  Renderers MUST consult this before ever describing a run as
+     *  "completed" — outcome alone is not enough, since a run that never
+     *  called org_complete has a null outcome regardless of why it stopped. */
+    closedBy?: string;
+    /** #302: `org_tasks` entries still non-terminal at the moment this run
+     *  stopped — 0 for a DAG-less run or one that finished every task. */
+    runnableTasksAtStop: number;
     roles: Record<string, RoleStats>;
     totalTokens: number;
     totalCostUsd: number;
 }
 /** Aggregate one run's bus events into a summary. */
 export declare function summarizeRun(events: BusEvent[]): RunSummary;
+/** #302 truth gate: the one-word-ish outcome label a renderer may print for a
+ *  run, honest about how it actually ended. A run with a genuine outcome (an
+ *  ALLOWED org_complete call) reports that claim's status. Otherwise, a real
+ *  crash wins (unchanged from before this item); otherwise an automated stop
+ *  path's own recorded cause is reported, with the runnable-task count if any
+ *  work was left outstanding — NEVER a plain "completed" for those, which is
+ *  the exact misreading #302 exists to close (an idle-stopped run with a full
+ *  backlog previously rendered identically to one whose boss finished
+ *  cleanly). Only a bare manual stop with no crash and no automated cause
+ *  falls back to "completed", same as before this item. */
+export declare function describeRunOutcome(s: RunSummary): string;
 /** run directories for an org, newest first (by name — run-YYYYMMDDHHMMSS-xxxx sorts naturally). */
 export declare function listRunDirs(cwd: string, org: string): string[];
 export declare function readRunEvents(cwd: string, org: string, run: string): BusEvent[];

package/dist/src/orgrt/reporting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reporting.d.ts","sourceRoot":"","sources":["../../../src/orgrt/reporting.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAWD,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAsE3D;AAED,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAO9D;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,EAAE,CAc/E;AAED,gGAAgG;AAChG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAclE;AAID,kBAAkB;AAClB,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED,0BAA0B;AAC1B,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,0DAA0D;AAC1D,wBAAgB,WAAW,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAsB/C"}
+{"version":3,"file":"reporting.d.ts","sourceRoot":"","sources":["../../../src/orgrt/reporting.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;iBAGa;IACb,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChE;;;;;;;;;;0EAUsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;+EAuB2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;0EACsE;IACtE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAWD,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAwF3D;AAED;;;;;;;;;2DAS2D;AAC3D,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAQxD;AAED,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAO9D;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,EAAE,CAc/E;AAED,gGAAgG;AAChG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAclE;AAID,kBAAkB;AAClB,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED,0BAA0B;AAC1B,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,0DAA0D;AAC1D,wBAAgB,WAAW,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAsB/C"}

package/dist/src/orgrt/reporting.js

@@ -27,6 +27,7 @@ export function summarizeRun(events) {
         crashes: [],
         cutShort: [],
         outcome: null,
+        runnableTasksAtStop: 0,
         roles: {},
         totalTokens: 0,
         totalCostUsd: 0,
@@ -79,15 +80,53 @@ export function summarizeRun(events) {
                 if (e.reason === 'terminated-by-stop' && e.from) {
                     s.cutShort.push(e.from);
                 }
-                const d = e.data;
-                if (e.reason === 'org-complete' && d?.outcome)
-                    s.outcome = { status: d.outcome, summary: d.summary ?? '', by: e.from ?? '' };
+                if (e.reason === 'org-complete') {
+                    const d = e.data;
+                    if (d?.outcome)
+                        s.outcome = { status: d.outcome, summary: d.summary ?? '', by: e.from ?? '' };
+                    // Top-level, not nested in `outcome` — see RunSummary's doc comment.
+                    if (d?.blocker)
+                        s.blocker = d.blocker;
+                    if (d?.blockerDetail)
+                        s.blockerDetail = d.blockerDetail;
+                }
+                // #302 truth gate: finishStop always emits exactly one of these per
+                // run, regardless of which of the five stop paths fired — read it
+                // unconditionally rather than only for a particular reason, so a
+                // future stop path that forgets to set closedBy still shows up here
+                // as undefined instead of silently vanishing.
+                if (e.reason === 'org-stopped') {
+                    const d = e.data;
+                    s.closedBy = d?.closedBy;
+                    s.runnableTasksAtStop = d?.runnableTasks ?? 0;
+                }
                 break;
             }
         }
     }
     return s;
 }
+/** #302 truth gate: the one-word-ish outcome label a renderer may print for a
+ *  run, honest about how it actually ended. A run with a genuine outcome (an
+ *  ALLOWED org_complete call) reports that claim's status. Otherwise, a real
+ *  crash wins (unchanged from before this item); otherwise an automated stop
+ *  path's own recorded cause is reported, with the runnable-task count if any
+ *  work was left outstanding — NEVER a plain "completed" for those, which is
+ *  the exact misreading #302 exists to close (an idle-stopped run with a full
+ *  backlog previously rendered identically to one whose boss finished
+ *  cleanly). Only a bare manual stop with no crash and no automated cause
+ *  falls back to "completed", same as before this item. */
+export function describeRunOutcome(s) {
+    if (s.outcome)
+        return s.outcome.status;
+    if (s.crashes.length)
+        return 'crashed';
+    if (s.closedBy && s.closedBy !== 'org-complete') {
+        const pending = s.runnableTasksAtStop > 0 ? ` (${s.runnableTasksAtStop} task(s) left)` : '';
+        return `${s.closedBy}${pending}`;
+    }
+    return 'completed';
+}
 /** run directories for an org, newest first (by name — run-YYYYMMDDHHMMSS-xxxx sorts naturally). */
 export function listRunDirs(cwd, org) {
     const base = join(cwd, ORG_DIR, org);

package/dist/src/orgrt/reporting.js.map

@@ -1 +1 @@
-{"version":3,"file":"reporting.js","sourceRoot":"","sources":["../../../src/orgrt/reporting.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA8BrC,MAAM,SAAS,GAAG,GAAc,EAAE,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC;IACf,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,CAAC;IACd,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,KAAK;CACf,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,MAAM,CAAC,GAAe;QACpB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE;QACzB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,CAAC;QACX,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;KAChB,CAAC;IACF,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,IAAI,GAAG,CAAC,EAAsB,EAAa,EAAE;QACjD,MAAM,GAAG,GAAG,EAAE,IAAI,UAAU,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBAC5B,MAAM;YACR,KAAK,MAAM;gBACT,CAAC,CAAC,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBAC3E,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;oBAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;;oBACjD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBACjC,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChE,MAAM;YACR,KAAK,OAAO,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,MAAM,CAAE,CAAC,CAAC,IAAwC,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;gBAChF,MAAM,IAAI,GAAG,MAAM,CAAE,CAAC,CAAC,IAA0C,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;gBAClF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;gBACnB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;oBAClB,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC;gBACzB,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,OAAO;gBACV,IAAI,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACvB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC9B,CAAC;gBACD,MAAM;YACR,KAAK,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,CAAC,MAAM,KAAK,oBAAoB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBAChD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAC,IAA0D,CAAC;gBACvE,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,EAAE,OAAO;oBAC3C,CAAC,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBAChF,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACnC,IAAI,EAAE;SACN,OAAO,EAAE,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;IACjE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAa,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAe,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,+EAA+E;AAC/E,kEAAkE;AAClE,kBAAkB;AAClB,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC;AACxD,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AACzE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,WAAW,CAAC,CAAW;IACrC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;IAC3B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACxG,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9F,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,OAAO,IAAI,KAAM,CAAC,CAAC,IAAwC,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC;QAC/F,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvD,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C;YACE,OAAO,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,CAAC,GAAG,GAAG,EAAU,EAAE;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC,CAAC"}
+{"version":3,"file":"reporting.js","sourceRoot":"","sources":["../../../src/orgrt/reporting.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA2ErC,MAAM,SAAS,GAAG,GAAc,EAAE,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC;IACf,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,CAAC;IACd,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,KAAK;CACf,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,MAAM,CAAC,GAAe;QACpB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE;QACzB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE;QACzB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,CAAC;QACX,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAI;QACb,mBAAmB,EAAE,CAAC;QACtB,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;KAChB,CAAC;IACF,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,IAAI,GAAG,CAAC,EAAsB,EAAa,EAAE;QACjD,MAAM,GAAG,GAAG,EAAE,IAAI,UAAU,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,SAAS;gBACZ,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBAC5B,MAAM;YACR,KAAK,MAAM;gBACT,CAAC,CAAC,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBAC3E,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;oBAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;;oBACjD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBACjC,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChE,MAAM;YACR,KAAK,OAAO,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,MAAM,CAAE,CAAC,CAAC,IAAwC,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;gBAChF,MAAM,IAAI,GAAG,MAAM,CAAE,CAAC,CAAC,IAA0C,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;gBAClF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;gBACnB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;oBAClB,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC;gBACzB,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,OAAO;gBACV,IAAI,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACvB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC9B,CAAC;gBACD,MAAM;YACR,KAAK,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,CAAC,MAAM,KAAK,oBAAoB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBAChD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;gBACD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;oBAChC,MAAM,CAAC,GAAG,CAAC,CAAC,IAEC,CAAC;oBACd,IAAI,CAAC,EAAE,OAAO;wBACZ,CAAC,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;oBAChF,qEAAqE;oBACrE,IAAI,CAAC,EAAE,OAAO;wBAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;oBACtC,IAAI,CAAC,EAAE,aAAa;wBAAE,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC;gBAC1D,CAAC;gBACD,oEAAoE;gBACpE,kEAAkE;gBAClE,iEAAiE;gBACjE,oEAAoE;gBACpE,8CAA8C;gBAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;oBAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAiE,CAAC;oBAC9E,CAAC,CAAC,QAAQ,GAAG,CAAC,EAAE,QAAQ,CAAC;oBACzB,CAAC,CAAC,mBAAmB,GAAG,CAAC,EAAE,aAAa,IAAI,CAAC,CAAC;gBAChD,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;2DAS2D;AAC3D,MAAM,UAAU,kBAAkB,CAAC,CAAa;IAC9C,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,GAAG,CAAC,CAAC,QAAQ,GAAG,OAAO,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACnC,IAAI,EAAE;SACN,OAAO,EAAE,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;IACjE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAa,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAe,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,+EAA+E;AAC/E,kEAAkE;AAClE,kBAAkB;AAClB,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC;AACxD,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AACzE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,WAAW,CAAC,CAAW;IACrC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;IAC3B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACxG,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9F,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,OAAO,IAAI,KAAM,CAAC,CAAC,IAAwC,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC;QAC/F,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvD,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C;YACE,OAAO,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,CAAC,GAAG,GAAG,EAAU,EAAE;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC,CAAC"}

package/dist/src/orgrt/role-sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-sandbox.d.ts","sourceRoot":"","sources":["../../../src/orgrt/role-sandbox.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC,OAAO,EACL,KAAK,QAAQ,EAKd,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD;6EAC6E;AAC7E,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,mBAAmB,CAmBrB;AAoFD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,QAAQ,EACf,GAAG,EAAE,iBAAiB,GAAG,SAAS,EAClC,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,EAC5F,cAAc,EAAE,OAAO,GACtB,kBAAkB,CAoDpB;AAmBD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CAAE,CA4G3E;AAQD;yCACyC;AACzC,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,YAAY,GAAE,mBAA2C,GACxD;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA6C1C"}
+{"version":3,"file":"role-sandbox.d.ts","sourceRoot":"","sources":["../../../src/orgrt/role-sandbox.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EACL,KAAK,QAAQ,EAKd,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD;6EAC6E;AAC7E,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,mBAAmB,CAmBrB;AAqDD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,QAAQ,EACf,GAAG,EAAE,iBAAiB,GAAG,SAAS,EAClC,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,EAC5F,cAAc,EAAE,OAAO,GACtB,kBAAkB,CAoDpB;AAmBD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CAAE,CA4G3E;AAQD;yCACyC;AACzC,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,YAAY,GAAE,mBAA2C,GACxD;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA6C1C"}