@orygn/opa-mcp 0.3.0 → 0.5.0

package/dist/lib/rego-verify-engine.js

@@ -3,7 +3,7 @@ import { inferTypes } from './rego-type-inferencer.js';
 import { createInputVars, encodeRule } from './rego-smt-encoder.js';
 import { extractCounterexample, formatCounterexample, } from './rego-counterexample.js';
 import { describeProperty } from './rego-property-parser.js';
-import { getZ3 } from './rego-z3.js';
+import { getZ3, withZ3Lock } from './rego-z3.js';
 // Monotonically increasing counter used to generate a unique prefix for all
 // Z3 constant names within each runVerify call. This prevents sort conflicts
 // when the same input path is inferred with different sorts across calls
@@ -59,98 +59,130 @@ export async function runVerify(ast, property, signal) {
             warnings.push(conflict.reason);
         }
         signal?.throwIfAborted();
-        const Z3 = await getZ3();
-        signal?.throwIfAborted();
-        const callId = `v${_verifyCallCounter++}`;
-        const inputVars = createInputVars(Z3, walked.inputPaths, typeResult.sorts, callId);
-        const ctx = { Z3, inputVars, sorts: typeResult.sorts, callId };
-        const encoded = encodeRule(targetClauses, ctx);
-        warnings.push(...encoded.warnings);
-        // Z3's high-level Solver and Model objects use FinalizationRegistry internally
-        // (solver_dec_ref / model_dec_ref) so they are cleaned up when GC'd.
-        // We avoid holding a reference to the Model beyond extractCounterexample so
-        // it becomes eligible for GC as soon as the call returns, reducing WASM heap
-        // pressure under high call volume.
-        const solver = new Z3.Solver();
-        // Set timeout to prevent hanging on complex policies
-        solver.set('timeout', SOLVER_TIMEOUT_MS);
-        switch (property.kind) {
-            case 'always_true':
-                // Prove rule is always true: check if NOT(rule) is satisfiable.
-                // SAT → counterexample (input where rule is false)
-                // UNSAT → proven always true
-                solver.add(Z3.Not(encoded.formula));
-                break;
-            case 'never_true':
-                // Prove rule is never true: check if rule IS satisfiable.
-                // SAT → counterexample (input where rule fires, violating "never")
-                // UNSAT → proven never true
-                solver.add(encoded.formula);
-                break;
-            case 'satisfiable':
-                // Check if any input satisfies the rule.
-                // SAT → witness found (not a bug, just a satisfying input)
-                // UNSAT → rule is vacuously false / dead code
-                solver.add(encoded.formula);
-                break;
-        }
-        signal?.throwIfAborted();
-        const solverResult = await solver.check();
-        if (solverResult === 'unknown') {
-            return inconclusive(property, `Z3 solver returned "unknown" (timeout or resource limit reached after ${SOLVER_TIMEOUT_MS}ms). The policy may be too complex for automated verification.`, unsupportedInRule, warnings);
-        }
-        if (solverResult === 'unsat') {
+        // Everything below touches the shared Z3 Context, which is one
+        // single-threaded WASM heap. Concurrent MCP tool calls must not overlap
+        // here: two solves interleaving on that heap degraded verdicts to
+        // inconclusive and crashed the WASM allocator. The lock also makes the
+        // callId counter race-free.
+        return await withZ3Lock(async () => {
+            const Z3 = await getZ3();
+            signal?.throwIfAborted();
+            const callId = `v${_verifyCallCounter++}`;
+            const { vars: inputVars, presence: presenceVars } = createInputVars(Z3, walked.inputPaths, typeResult.sorts, callId);
+            const ctx = { Z3, inputVars, presenceVars, sorts: typeResult.sorts, callId };
+            // The rule's default participates in "is it true", so it must reach the
+            // encoder. Consulting it only when there were no clauses at all is what made
+            // `default allow := true` plus a guard clause verify as never-true.
+            const encoded = encodeRule(targetClauses, ctx, walked.defaults.get(property.ruleName));
+            warnings.push(...encoded.warnings);
+            if (encoded.unencodable) {
+                return inconclusive(property, `Rule "${property.ruleName}" contains a value or operand the encoder cannot represent (for example a null literal). Verification is inconclusive rather than guessed.`, unsupportedInRule, warnings);
+            }
+            // Z3's high-level Solver and Model objects use FinalizationRegistry internally
+            // (solver_dec_ref / model_dec_ref) so they are cleaned up when GC'd.
+            // We avoid holding a reference to the Model beyond extractCounterexample so
+            // it becomes eligible for GC as soon as the call returns, reducing WASM heap
+            // pressure under high call volume.
+            const solver = new Z3.Solver();
+            // Set timeout to prevent hanging on complex policies
+            solver.set('timeout', SOLVER_TIMEOUT_MS);
+            switch (property.kind) {
+                case 'always_true':
+                    // Prove rule is always true: check if NOT(rule) is satisfiable.
+                    // SAT → counterexample (input where rule is false)
+                    // UNSAT → proven always true
+                    solver.add(Z3.Not(encoded.formula));
+                    break;
+                case 'never_true':
+                    // Prove rule is never true: check if rule IS satisfiable.
+                    // SAT → counterexample (input where rule fires, violating "never")
+                    // UNSAT → proven never true
+                    solver.add(encoded.formula);
+                    break;
+                case 'satisfiable':
+                    // Check if any input satisfies the rule.
+                    // SAT → witness found (not a bug, just a satisfying input)
+                    // UNSAT → rule is vacuously false / dead code
+                    solver.add(encoded.formula);
+                    break;
+            }
+            signal?.throwIfAborted();
+            let solverResult = await solver.check();
+            // Prefer a witness in which every field the rule reads is PRESENT.
+            //
+            // With absence modelled, Z3 will happily satisfy NOT(rule) by omitting a
+            // field, which is sound but unhelpful: "it fails when the input is empty"
+            // is rarely the case a reviewer is chasing. Re-ask with presence forced and
+            // keep that model when one exists, otherwise fall back to the original.
+            // Soundness is unaffected either way, since both are real models.
+            if (solverResult === 'sat' && presenceVars.size > 0) {
+                solver.push();
+                for (const present of presenceVars.values())
+                    solver.add(present);
+                const withPresence = await solver.check();
+                if (withPresence === 'sat') {
+                    solverResult = withPresence;
+                }
+                else {
+                    solver.pop();
+                }
+            }
+            if (solverResult === 'unknown') {
+                return inconclusive(property, `Z3 solver returned "unknown" (timeout or resource limit reached after ${SOLVER_TIMEOUT_MS}ms). The policy may be too complex for automated verification.`, unsupportedInRule, warnings);
+            }
+            if (solverResult === 'unsat') {
+                if (property.kind === 'satisfiable') {
+                    // No satisfying input exists -- rule is dead code or has contradictory conditions.
+                    return {
+                        verdict: 'unsatisfiable',
+                        property: describeProperty(property),
+                        rule: property.ruleName,
+                        unsupportedConstructs: unsupportedInRule,
+                        warnings,
+                        message: `UNSATISFIABLE: No input can make "${property.ruleName}" true. The rule may be dead code or have contradictory conditions.`,
+                    };
+                }
+                // For always_true / never_true: UNSAT on the negation = property proven
+                return {
+                    verdict: 'proven',
+                    property: describeProperty(property),
+                    rule: property.ruleName,
+                    unsupportedConstructs: unsupportedInRule,
+                    warnings,
+                    message: `PROVEN: ${describeProperty(property)}.`,
+                };
+            }
+            // SAT: pass solver.model() inline so the Model object is not kept alive
+            // beyond extractCounterexample -- it becomes GC-eligible immediately after.
+            const ce = extractCounterexample(solver.model(), inputVars, typeResult.sorts, presenceVars);
+            const ceFormatted = formatCounterexample(ce);
             if (property.kind === 'satisfiable') {
-                // No satisfying input exists -- rule is dead code or has contradictory conditions.
                 return {
-                    verdict: 'unsatisfiable',
+                    verdict: 'proven',
                     property: describeProperty(property),
                     rule: property.ruleName,
+                    counterexample: ce,
+                    counterexampleFormatted: ceFormatted,
                     unsupportedConstructs: unsupportedInRule,
                     warnings,
-                    message: `UNSATISFIABLE: No input can make "${property.ruleName}" true. The rule may be dead code or have contradictory conditions.`,
+                    message: `SATISFIABLE: Found an input that makes "${property.ruleName}" true.\n\nWitness input:\n${ceFormatted}`,
                 };
             }
-            // For always_true / never_true: UNSAT on the negation = property proven
+            // always_true / never_true: SAT means we found a violation
+            const ceLabel = property.kind === 'always_true'
+                ? 'input where rule is FALSE'
+                : 'input where rule is TRUE (violates "never")';
             return {
-                verdict: 'proven',
-                property: describeProperty(property),
-                rule: property.ruleName,
-                unsupportedConstructs: unsupportedInRule,
-                warnings,
-                message: `PROVEN: ${describeProperty(property)}.`,
-            };
-        }
-        // SAT: pass solver.model() inline so the Model object is not kept alive
-        // beyond extractCounterexample -- it becomes GC-eligible immediately after.
-        const ce = extractCounterexample(solver.model(), inputVars, typeResult.sorts);
-        const ceFormatted = formatCounterexample(ce);
-        if (property.kind === 'satisfiable') {
-            return {
-                verdict: 'proven',
+                verdict: 'counterexample',
                 property: describeProperty(property),
                 rule: property.ruleName,
                 counterexample: ce,
                 counterexampleFormatted: ceFormatted,
                 unsupportedConstructs: unsupportedInRule,
                 warnings,
-                message: `SATISFIABLE: Found an input that makes "${property.ruleName}" true.\n\nWitness input:\n${ceFormatted}`,
+                message: `COUNTEREXAMPLE: Property does NOT hold. Found ${ceLabel}:\n\n${ceFormatted}`,
             };
-        }
-        // always_true / never_true: SAT means we found a violation
-        const ceLabel = property.kind === 'always_true'
-            ? 'input where rule is FALSE'
-            : 'input where rule is TRUE (violates "never")';
-        return {
-            verdict: 'counterexample',
-            property: describeProperty(property),
-            rule: property.ruleName,
-            counterexample: ce,
-            counterexampleFormatted: ceFormatted,
-            unsupportedConstructs: unsupportedInRule,
-            warnings,
-            message: `COUNTEREXAMPLE: Property does NOT hold. Found ${ceLabel}:\n\n${ceFormatted}`,
-        };
+        });
     }
     catch (e) {
         // A cancellation must propagate as a cancellation, not be masked as a

package/dist/lib/rego-verify-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"rego-verify-engine.js","sourceRoot":"","sources":["../../src/lib/rego-verify-engine.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAuB,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAErC,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,qBAAqB;AACrB,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAe3B,6CAA6C;AAC7C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAc,EACd,QAAwB,EACxB,MAAoB;IAEpB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE1D,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAU,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;gBAAE,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACxD,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAC9C,CAAC;IAEF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,gFAAgF;QAChF,mEAAmE;QACnE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,oBAAoB,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,YAAY,CACjB,QAAQ,EACR,SAAS,QAAQ,CAAC,QAAQ,qCAAqC,EAC/D,iBAAiB,EACjB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,MAAM,uBAAuB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CACpD,CAAC;IACF,IAAI,uBAAuB,EAAE,CAAC;QAC5B,OAAO,YAAY,CACjB,QAAQ,EACR,SAAS,QAAQ,CAAC,QAAQ,sKAAsK,EAChM,iBAAiB,EACjB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,oBAAoB;IACpB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7E,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,CAAC;QAEzB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAEzB,MAAM,EAAE,cAAc,EAAE,CAAC;QAEzB,MAAM,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEnC,+EAA+E;QAC/E,qEAAqE;QACrE,4EAA4E;QAC5E,6EAA6E;QAC7E,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QAE/B,qDAAqD;QACrD,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAEzC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,aAAa;gBAChB,gEAAgE;gBAChE,mDAAmD;gBACnD,6BAA6B;gBAC7B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACpC,MAAM;YACR,KAAK,YAAY;gBACf,0DAA0D;gBAC1D,mEAAmE;gBACnE,4BAA4B;gBAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,aAAa;gBAChB,yCAAyC;gBACzC,2DAA2D;gBAC3D,8CAA8C;gBAC9C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC5B,MAAM;QACV,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,CAAC;QAEzB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAE1C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,YAAY,CACjB,QAAQ,EACR,yEAAyE,iBAAiB,gEAAgE,EAC1J,iBAAiB,EACjB,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;YAC7B,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACpC,mFAAmF;gBACnF,OAAO;oBACL,OAAO,EAAE,eAAe;oBACxB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;oBACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;oBACvB,qBAAqB,EAAE,iBAAiB;oBACxC,QAAQ;oBACR,OAAO,EAAE,qCAAqC,QAAQ,CAAC,QAAQ,qEAAqE;iBACrI,CAAC;YACJ,CAAC;YACD,wEAAwE;YACxE,OAAO;gBACL,OAAO,EAAE,QAAQ;gBACjB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;gBACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;gBACvB,qBAAqB,EAAE,iBAAiB;gBACxC,QAAQ;gBACR,OAAO,EAAE,WAAW,gBAAgB,CAAC,QAAQ,CAAC,GAAG;aAClD,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,EAAE,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,WAAW,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAE7C,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,QAAQ;gBACjB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;gBACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;gBACvB,cAAc,EAAE,EAAE;gBAClB,uBAAuB,EAAE,WAAW;gBACpC,qBAAqB,EAAE,iBAAiB;gBACxC,QAAQ;gBACR,OAAO,EAAE,2CAA2C,QAAQ,CAAC,QAAQ,8BAA8B,WAAW,EAAE;aACjH,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,KAAK,aAAa;YAC7B,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,6CAA6C,CAAC;QAEpD,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;YACvB,cAAc,EAAE,EAAE;YAClB,uBAAuB,EAAE,WAAW;YACpC,qBAAqB,EAAE,iBAAiB;YACxC,QAAQ;YACR,OAAO,EAAE,iDAAiD,OAAO,QAAQ,WAAW,EAAE;SACvF,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,sEAAsE;QACtE,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO,YAAY,CACjB,QAAQ,EACR,cAAc;YACZ,CAAC,CAAC,8JAA8J;YAChK,CAAC,CAAC,kFAAkF,EACtF;YACE,GAAG,iBAAiB;YACpB;gBACE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;gBAClE,WAAW,EAAE,MAAM;aACpB;SACF,EACD,QAAQ,CACT,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,QAAwB,EACxB,MAAc,EACd,qBAA4E,EAC5E,QAAkB;IAElB,OAAO;QACL,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;QACvB,qBAAqB;QACrB,QAAQ;QACR,OAAO,EAAE,iBAAiB,MAAM,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,QAAwB,EACxB,YAAqB,EACrB,qBAA4E,EAC5E,QAAkB;IAElB,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAE/B,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,aAAa;YAChB,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,IAAI;oBACV,qBAAqB;oBACrB,QAAQ;oBACR,OAAO,EAAE,WAAW,IAAI,WAAW,IAAI,2DAA2D;iBACnG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,gBAAgB;gBACzB,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,IAAI;gBACV,cAAc,EAAE,YAAY;gBAC5B,uBAAuB,EAAE,cAAc;gBACvC,qBAAqB;gBACrB,QAAQ;gBACR,OAAO,EAAE,yBAAyB,IAAI,2GAA2G;aAClJ,CAAC;QAEJ,KAAK,YAAY;YACf,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,IAAI;oBACV,qBAAqB;oBACrB,QAAQ;oBACR,OAAO,EAAE,WAAW,IAAI,WAAW,IAAI,2DAA2D;iBACnG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,gBAAgB;gBACzB,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,IAAI;gBACV,cAAc,EAAE,YAAY;gBAC5B,uBAAuB,EAAE,cAAc;gBACvC,qBAAqB;gBACrB,QAAQ;gBACR,OAAO,EAAE,yBAAyB,IAAI,0GAA0G;aACjJ,CAAC;QAEJ,KAAK,aAAa;YAChB,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,IAAI;oBACV,cAAc,EAAE,YAAY;oBAC5B,uBAAuB,EAAE,cAAc;oBACvC,qBAAqB;oBACrB,QAAQ;oBACR,OAAO,EAAE,sBAAsB,IAAI,kEAAkE;iBACtG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,IAAI;gBACV,qBAAqB;gBACrB,QAAQ;gBACR,OAAO,EAAE,wBAAwB,IAAI,sEAAsE;aAC5G,CAAC;IACN,CAAC;AACH,CAAC"}
+{"version":3,"file":"rego-verify-engine.js","sourceRoot":"","sources":["../../src/lib/rego-verify-engine.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAuB,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEjD,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,qBAAqB;AACrB,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAe3B,6CAA6C;AAC7C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAc,EACd,QAAwB,EACxB,MAAoB;IAEpB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE1D,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAU,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;gBAAE,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACxD,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAC9C,CAAC;IAEF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,gFAAgF;QAChF,mEAAmE;QACnE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,oBAAoB,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,YAAY,CACjB,QAAQ,EACR,SAAS,QAAQ,CAAC,QAAQ,qCAAqC,EAC/D,iBAAiB,EACjB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,MAAM,uBAAuB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CACpD,CAAC;IACF,IAAI,uBAAuB,EAAE,CAAC;QAC5B,OAAO,YAAY,CACjB,QAAQ,EACR,SAAS,QAAQ,CAAC,QAAQ,sKAAsK,EAChM,iBAAiB,EACjB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,oBAAoB;IACpB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7E,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,CAAC;QAEzB,+DAA+D;QAC/D,wEAAwE;QACxE,kEAAkE;QAClE,uEAAuE;QACvE,4BAA4B;QAC5B,OAAO,MAAM,UAAU,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;YAEzB,MAAM,EAAE,cAAc,EAAE,CAAC;YAEzB,MAAM,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;YAC1C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,eAAe,CACjE,EAAE,EACF,MAAM,CAAC,UAAU,EACjB,UAAU,CAAC,KAAK,EAChB,MAAM,CACP,CAAC;YACF,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7E,wEAAwE;YACxE,6EAA6E;YAC7E,oEAAoE;YACpE,MAAM,OAAO,GAAG,UAAU,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvF,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAEnC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxB,OAAO,YAAY,CACjB,QAAQ,EACR,SAAS,QAAQ,CAAC,QAAQ,4IAA4I,EACtK,iBAAiB,EACjB,QAAQ,CACT,CAAC;YACJ,CAAC;YAED,+EAA+E;YAC/E,qEAAqE;YACrE,4EAA4E;YAC5E,6EAA6E;YAC7E,mCAAmC;YACnC,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YAE/B,qDAAqD;YACrD,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAEzC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,aAAa;oBAChB,gEAAgE;oBAChE,mDAAmD;oBACnD,6BAA6B;oBAC7B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBACpC,MAAM;gBACR,KAAK,YAAY;oBACf,0DAA0D;oBAC1D,mEAAmE;oBACnE,4BAA4B;oBAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC5B,MAAM;gBACR,KAAK,aAAa;oBAChB,yCAAyC;oBACzC,2DAA2D;oBAC3D,8CAA8C;oBAC9C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC5B,MAAM;YACV,CAAC;YAED,MAAM,EAAE,cAAc,EAAE,CAAC;YAEzB,IAAI,YAAY,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAExC,mEAAmE;YACnE,EAAE;YACF,yEAAyE;YACzE,0EAA0E;YAC1E,4EAA4E;YAC5E,wEAAwE;YACxE,kEAAkE;YAClE,IAAI,YAAY,KAAK,KAAK,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,EAAE,CAAC;gBACd,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE;oBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACjE,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC1C,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;oBAC3B,YAAY,GAAG,YAAY,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,GAAG,EAAE,CAAC;gBACf,CAAC;YACH,CAAC;YAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,YAAY,CACjB,QAAQ,EACR,yEAAyE,iBAAiB,gEAAgE,EAC1J,iBAAiB,EACjB,QAAQ,CACT,CAAC;YACJ,CAAC;YAED,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;gBAC7B,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;oBACpC,mFAAmF;oBACnF,OAAO;wBACL,OAAO,EAAE,eAAe;wBACxB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;wBACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;wBACvB,qBAAqB,EAAE,iBAAiB;wBACxC,QAAQ;wBACR,OAAO,EAAE,qCAAqC,QAAQ,CAAC,QAAQ,qEAAqE;qBACrI,CAAC;gBACJ,CAAC;gBACD,wEAAwE;gBACxE,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;oBACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;oBACvB,qBAAqB,EAAE,iBAAiB;oBACxC,QAAQ;oBACR,OAAO,EAAE,WAAW,gBAAgB,CAAC,QAAQ,CAAC,GAAG;iBAClD,CAAC;YACJ,CAAC;YAED,wEAAwE;YACxE,4EAA4E;YAC5E,MAAM,EAAE,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAC5F,MAAM,WAAW,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;YAE7C,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACpC,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;oBACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;oBACvB,cAAc,EAAE,EAAE;oBAClB,uBAAuB,EAAE,WAAW;oBACpC,qBAAqB,EAAE,iBAAiB;oBACxC,QAAQ;oBACR,OAAO,EAAE,2CAA2C,QAAQ,CAAC,QAAQ,8BAA8B,WAAW,EAAE;iBACjH,CAAC;YACJ,CAAC;YAED,2DAA2D;YAC3D,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC7B,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,6CAA6C,CAAC;YAEpD,OAAO;gBACL,OAAO,EAAE,gBAAgB;gBACzB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;gBACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;gBACvB,cAAc,EAAE,EAAE;gBAClB,uBAAuB,EAAE,WAAW;gBACpC,qBAAqB,EAAE,iBAAiB;gBACxC,QAAQ;gBACR,OAAO,EAAE,iDAAiD,OAAO,QAAQ,WAAW,EAAE;aACvF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,sEAAsE;QACtE,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO,YAAY,CACjB,QAAQ,EACR,cAAc;YACZ,CAAC,CAAC,8JAA8J;YAChK,CAAC,CAAC,kFAAkF,EACtF;YACE,GAAG,iBAAiB;YACpB;gBACE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;gBAClE,WAAW,EAAE,MAAM;aACpB;SACF,EACD,QAAQ,CACT,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,QAAwB,EACxB,MAAc,EACd,qBAA4E,EAC5E,QAAkB;IAElB,OAAO;QACL,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;QACvB,qBAAqB;QACrB,QAAQ;QACR,OAAO,EAAE,iBAAiB,MAAM,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,QAAwB,EACxB,YAAqB,EACrB,qBAA4E,EAC5E,QAAkB;IAElB,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAE/B,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,aAAa;YAChB,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,IAAI;oBACV,qBAAqB;oBACrB,QAAQ;oBACR,OAAO,EAAE,WAAW,IAAI,WAAW,IAAI,2DAA2D;iBACnG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,gBAAgB;gBACzB,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,IAAI;gBACV,cAAc,EAAE,YAAY;gBAC5B,uBAAuB,EAAE,cAAc;gBACvC,qBAAqB;gBACrB,QAAQ;gBACR,OAAO,EAAE,yBAAyB,IAAI,2GAA2G;aAClJ,CAAC;QAEJ,KAAK,YAAY;YACf,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,IAAI;oBACV,qBAAqB;oBACrB,QAAQ;oBACR,OAAO,EAAE,WAAW,IAAI,WAAW,IAAI,2DAA2D;iBACnG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,gBAAgB;gBACzB,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,IAAI;gBACV,cAAc,EAAE,YAAY;gBAC5B,uBAAuB,EAAE,cAAc;gBACvC,qBAAqB;gBACrB,QAAQ;gBACR,OAAO,EAAE,yBAAyB,IAAI,0GAA0G;aACjJ,CAAC;QAEJ,KAAK,aAAa;YAChB,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,IAAI;oBACV,cAAc,EAAE,YAAY;oBAC5B,uBAAuB,EAAE,cAAc;oBACvC,qBAAqB;oBACrB,QAAQ;oBACR,OAAO,EAAE,sBAAsB,IAAI,kEAAkE;iBACtG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,IAAI;gBACV,qBAAqB;gBACrB,QAAQ;gBACR,OAAO,EAAE,wBAAwB,IAAI,sEAAsE;aAC5G,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/lib/rego-z3.d.ts

@@ -5,6 +5,16 @@ export type Z3Context = ReturnType<Awaited<ReturnType<typeof Z3Init>>['Context']
  * Safe to call from concurrent async paths.
  */
 export declare function getZ3(): Promise<Z3Context>;
+/**
+ * Run `fn` with exclusive access to the shared Z3 Context.
+ *
+ * Serializes rather than parallelizes: an MCP client is free to issue several
+ * rego_verify calls at once, and letting them into the WASM heap together
+ * crashes it. Solve times are in the tens of milliseconds, so queueing is
+ * cheaper than the alternative of one Context per call, which would re-pay the
+ * WASM init cost every time.
+ */
+export declare function withZ3Lock<T>(fn: () => Promise<T>): Promise<T>;
 /**
  * Reset the singleton - intended for test teardown only.
  * Do NOT call in production paths; re-init is expensive.

package/dist/lib/rego-z3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rego-z3.d.ts","sourceRoot":"","sources":["../../src/lib/rego-z3.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,WAAW,CAAC;AAKhD,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAKlF;;;GAGG;AACH,wBAAsB,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,CAKhD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC"}
+{"version":3,"file":"rego-z3.d.ts","sourceRoot":"","sources":["../../src/lib/rego-z3.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,WAAW,CAAC;AAKhD,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAKlF;;;GAGG;AACH,wBAAsB,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,CAKhD;AASD;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAapE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC"}

package/dist/lib/rego-z3.js

@@ -5,6 +5,13 @@
  * initialized once per process. Concurrent calls safely await the
  * same promise. Each verification call creates its own fresh Solver
  * from the shared Context, so contexts never accumulate stale state.
+ *
+ * A fresh Solver is NOT enough to make concurrent verification safe. The whole
+ * Context lives in one single-threaded WASM heap, and `check()` is async, so two
+ * overlapping solves interleave on that heap and corrupt each other: observed
+ * symptoms were verdicts degrading to `inconclusive` and an allocator crash
+ * inside the WASM module. Everything touching the Context must therefore run
+ * under `withZ3Lock`.
  */
 import { init } from 'z3-solver';
 // Module-level singleton
@@ -19,11 +26,42 @@ export async function getZ3() {
     }
     return z3InitPromise;
 }
+/**
+ * Tail of the queue of pending Z3 critical sections. Each acquirer waits on the
+ * current tail and installs its own completion as the new tail, so sections run
+ * in call order with no overlap.
+ */
+let z3LockTail = Promise.resolve();
+/**
+ * Run `fn` with exclusive access to the shared Z3 Context.
+ *
+ * Serializes rather than parallelizes: an MCP client is free to issue several
+ * rego_verify calls at once, and letting them into the WASM heap together
+ * crashes it. Solve times are in the tens of milliseconds, so queueing is
+ * cheaper than the alternative of one Context per call, which would re-pay the
+ * WASM init cost every time.
+ */
+export async function withZ3Lock(fn) {
+    let release;
+    const mine = new Promise((resolve) => {
+        release = resolve;
+    });
+    const predecessor = z3LockTail;
+    z3LockTail = predecessor.then(() => mine);
+    await predecessor;
+    try {
+        return await fn();
+    }
+    finally {
+        release();
+    }
+}
 /**
  * Reset the singleton - intended for test teardown only.
  * Do NOT call in production paths; re-init is expensive.
  */
 export function resetZ3ForTesting() {
     z3InitPromise = null;
+    z3LockTail = Promise.resolve();
 }
 //# sourceMappingURL=rego-z3.js.map

package/dist/lib/rego-z3.js.map

@@ -1 +1 @@
-{"version":3,"file":"rego-z3.js","sourceRoot":"","sources":["../../src/lib/rego-z3.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,yBAAyB;AACzB,IAAI,aAAa,GAA4B,IAAI,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,aAAa,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,aAAmC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC"}
+{"version":3,"file":"rego-z3.js","sourceRoot":"","sources":["../../src/lib/rego-z3.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,yBAAyB;AACzB,IAAI,aAAa,GAA4B,IAAI,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,aAAa,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,aAAmC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,IAAI,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,EAAoB;IACtD,IAAI,OAAoB,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,OAAO,GAAG,OAAO,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,UAAU,CAAC;IAC/B,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,CAAC;IAClB,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,aAAa,GAAG,IAAI,CAAC;IACrB,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;AACjC,CAAC"}

package/dist/lib/security.d.ts

@@ -7,6 +7,14 @@ export interface PathValidationResult {
 /**
  * Resolve `inputPath` and confirm it is contained within at least one
  * `allowedRoots` entry. Returns the resolved absolute path on success.
+ *
+ * Two checks, both of which must pass. The first is syntactic: `..` segments
+ * are collapsed without touching the disk and the result must sit under a
+ * root as written. The second follows the filesystem: the path's real
+ * location, including the part of it that does not exist yet, must sit under
+ * a root's real location. A link is still followed at read or write time by
+ * the tool that receives the path, so the check is against the layout at the
+ * moment of validation.
  */
 export declare function validatePath(inputPath: string, allowedRoots: string[], options?: {
     mustExist?: boolean;

package/dist/lib/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,oBAAoB,CAwGtB;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjD"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;CAC7B;AA6ED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,oBAAoB,CAsGtB;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjD"}

package/dist/lib/security.js

@@ -5,12 +5,90 @@
  * `validatePath` to prevent reading or writing outside the
  * agreed-upon roots.
  */
-import { existsSync, realpathSync, statSync } from 'node:fs';
-import { isAbsolute, resolve, sep } from 'node:path';
+import { lstatSync, realpathSync, statSync } from 'node:fs';
+import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path';
 import { err } from './errors.js';
+const WINDOWS = process.platform === 'win32';
+/**
+ * Canonical form of an existing path: every link resolved, and on Windows
+ * 8.3 short names expanded and on-disk casing restored. The JavaScript
+ * `realpathSync` resolves links but leaves short names and casing alone, so
+ * two spellings of one directory could compare unequal.
+ */
+function canonical(p) {
+    return realpathSync.native(p);
+}
+/** Does `p` fall under at least one of `roots`? */
+function isUnderRoots(p, roots, caseInsensitive) {
+    const fold = (s) => (caseInsensitive ? s.toLowerCase() : s);
+    const candidate = fold(p);
+    return roots.some((root) => {
+        const r = fold(root);
+        const rootWithSep = r.endsWith(sep) ? r : r + sep;
+        return candidate === r || candidate.startsWith(rootWithSep);
+    });
+}
+/**
+ * Where a path really leads, whether or not it exists yet.
+ *
+ * Walks up from `p` to the nearest entry that exists, resolves that entry's
+ * real location, and re-attaches the segments below it. A write to `p` lands
+ * under that real location, so that is what has to be checked against the
+ * roots. Checking only paths that already exist left every not-yet-created
+ * write target unchecked, and a junction or symlink inside a root could point
+ * it anywhere.
+ *
+ * An entry that exists only as a link to something that does not exist (a
+ * dangling link) is reported on its own: a write through it would create the
+ * target wherever the link points.
+ */
+function realLocation(p) {
+    const below = [];
+    let cur = p;
+    for (;;) {
+        let entry;
+        try {
+            entry = lstatSync(cur);
+        }
+        catch (e) {
+            const code = e.code;
+            if (code === 'ENOENT' || code === 'ENOTDIR') {
+                const parent = dirname(cur);
+                if (parent === cur)
+                    return { kind: 'unresolvable', reason: 'no existing ancestor' };
+                below.unshift(basename(cur));
+                cur = parent;
+                continue;
+            }
+            return { kind: 'unresolvable', reason: code ?? String(e) };
+        }
+        let real;
+        try {
+            real = canonical(cur);
+        }
+        catch (e) {
+            if (entry.isSymbolicLink())
+                return { kind: 'dangling', link: cur };
+            return { kind: 'unresolvable', reason: e.code ?? String(e) };
+        }
+        return {
+            kind: 'real',
+            path: below.length === 0 ? real : join(real, ...below),
+            exists: below.length === 0,
+        };
+    }
+}
 /**
  * Resolve `inputPath` and confirm it is contained within at least one
  * `allowedRoots` entry. Returns the resolved absolute path on success.
+ *
+ * Two checks, both of which must pass. The first is syntactic: `..` segments
+ * are collapsed without touching the disk and the result must sit under a
+ * root as written. The second follows the filesystem: the path's real
+ * location, including the part of it that does not exist yet, must sit under
+ * a root's real location. A link is still followed at read or write time by
+ * the tool that receives the path, so the check is against the layout at the
+ * moment of validation.
  */
 export function validatePath(inputPath, allowedRoots, options = {}) {
     if (typeof inputPath !== 'string' || inputPath.length === 0) {
@@ -28,24 +106,42 @@ export function validatePath(inputPath, allowedRoots, options = {}) {
         };
     }
     const resolved = isAbsolute(inputPath) ? resolve(inputPath) : resolve(process.cwd(), inputPath);
-    // Helper: confirm p falls under at least one of the provided root strings.
-    const isUnderRoots = (p, roots) => roots.some((root) => {
-        const rootWithSep = root.endsWith(sep) ? root : root + sep;
-        return p === root || p.startsWith(rootWithSep);
-    });
-    // Phase 1: syntactic traversal check. path.resolve() collapses `..`
-    // segments without I/O, so this catches plain traversal attacks cheaply.
     const resolvedRoots = allowedRoots.map((r) => resolve(r));
-    if (!isUnderRoots(resolved, resolvedRoots)) {
+    const outsideHint = 'Set OPA_MCP_ALLOWED_PATHS to a comma-separated list of directories, or use a path under the current allowed roots.';
+    // Phase 1: syntactic containment, cheap and free of I/O. It is not the
+    // decision on its own: a root spelled through a link (macOS /var, a Windows
+    // short name, a junction) and a path spelled through the target land in the
+    // same real place and must be accepted. It settles which message an
+    // escaping path gets. Windows compares without regard to case.
+    const syntacticallyInside = isUnderRoots(resolved, resolvedRoots, WINDOWS);
+    const outsideRoots = () => err('PATH_NOT_ALLOWED', `Path is outside allowed roots: ${inputPath}`, {
+        hint: outsideHint,
+        details: { resolved, allowedRoots },
+    });
+    // Phase 2: real location. This is the decision.
+    const location = realLocation(resolved);
+    if (location.kind === 'dangling') {
+        return {
+            ok: false,
+            error: err('PATH_NOT_ALLOWED', `Path goes through a link whose target does not exist: ${inputPath}`, {
+                hint: 'A write through a dangling link would create its target wherever the link points. Remove the link or use a path that does not go through it.',
+                details: { resolved, link: location.link },
+            }),
+        };
+    }
+    if (location.kind === 'unresolvable') {
+        if (!syntacticallyInside)
+            return { ok: false, error: outsideRoots() };
         return {
             ok: false,
-            error: err('PATH_NOT_ALLOWED', `Path is outside allowed roots: ${inputPath}`, {
-                hint: 'Set OPA_MCP_ALLOWED_PATHS to a comma-separated list of directories, or use a path under the current allowed roots.',
-                details: { resolved, allowedRoots },
+            error: err('PATH_NOT_FOUND', `Path could not be fully resolved: ${inputPath}`, {
+                details: { resolved, reason: location.reason },
             }),
         };
     }
-    if (options.mustExist && !existsSync(resolved)) {
+    if (options.mustExist && !location.exists) {
+        if (!syntacticallyInside)
+            return { ok: false, error: outsideRoots() };
         return {
             ok: false,
             error: err('PATH_NOT_FOUND', `Path does not exist: ${inputPath}`, {
@@ -53,51 +149,31 @@ export function validatePath(inputPath, allowedRoots, options = {}) {
             }),
         };
     }
-    // Phase 2: symlink resolution. path.resolve() is purely syntactic and
-    // does not follow symlinks. A symlink inside an allowed root can point
-    // arbitrarily outside. For any path that exists on disk, resolve the
-    // real target and re-validate against the real allowed-root locations.
-    //
-    // We validate via realpath but return `resolved` (the syntactic path)
-    // for backward compatibility across OSes where system directories are
-    // themselves symlinks (e.g. macOS /var -> /private/var). Callers pass
-    // the returned path to OPA/regal; the OS follows any remaining symlinks
-    // at read time, which is safe because we have verified the real target.
-    if (existsSync(resolved)) {
-        let realPath;
+    // A root that is itself a link, or spelled with a short name, compares
+    // correctly only in canonical form. A root that does not exist stays as
+    // written; nothing under it can resolve to it anyway.
+    const realRoots = resolvedRoots.map((r) => {
         try {
-            realPath = realpathSync(resolved);
+            return canonical(r);
         }
         catch {
-            // Rare race: path removed between existsSync and realpathSync, or
-            // insufficient permissions to read the symlink chain. Fail closed.
-            return {
-                ok: false,
-                error: err('PATH_NOT_FOUND', `Path could not be fully resolved: ${inputPath}`, {
-                    details: { resolved },
-                }),
-            };
-        }
-        // Also realpath the roots themselves so that a root that is a symlink
-        // compares correctly against the realpath of the input.
-        const realRoots = resolvedRoots.map((r) => {
-            try {
-                return existsSync(r) ? realpathSync(r) : r;
-            }
-            catch {
-                return r;
-            }
-        });
-        if (!isUnderRoots(realPath, realRoots)) {
-            return {
-                ok: false,
-                error: err('PATH_NOT_ALLOWED', `Path resolves outside allowed roots via symlink: ${inputPath}`, {
-                    hint: 'Set OPA_MCP_ALLOWED_PATHS to a comma-separated list of directories, or use a path under the current allowed roots.',
-                    details: { resolved, realPath, allowedRoots },
-                }),
-            };
+            return r;
         }
+    });
+    if (!isUnderRoots(location.path, realRoots, false)) {
+        if (!syntacticallyInside)
+            return { ok: false, error: outsideRoots() };
+        return {
+            ok: false,
+            error: err('PATH_NOT_ALLOWED', `Path resolves outside allowed roots via a link: ${inputPath}`, {
+                hint: outsideHint,
+                details: { resolved, realPath: location.path, allowedRoots },
+            }),
+        };
     }
+    // The syntactic path is returned, not the canonical one: on macOS the
+    // system temp directory is itself a link, and tools compare and report
+    // paths as the caller spelled them.
     return { ok: true, resolved };
 }
 /** Convenience: returns true if the path is a directory (after validation). */

package/dist/lib/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AASlC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,YAAsB,EACtB,UAAmC,EAAE;IAErC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CAAC,eAAe,EAAE,iCAAiC,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CACR,kBAAkB,EAClB,uEAAuE,EACvE;gBACE,IAAI,EAAE,kGAAkG;aACzG,CACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IAEhG,2EAA2E;IAC3E,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,KAAe,EAAW,EAAE,CAC3D,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;QAC3D,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEL,oEAAoE;IACpE,yEAAyE;IACzE,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CAAC,kBAAkB,EAAE,kCAAkC,SAAS,EAAE,EAAE;gBAC5E,IAAI,EAAE,oHAAoH;gBAC1H,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;aACpC,CAAC;SACH,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,wBAAwB,SAAS,EAAE,EAAE;gBAChE,OAAO,EAAE,EAAE,QAAQ,EAAE;aACtB,CAAC;SACH,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,EAAE;IACF,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,mEAAmE;YACnE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,qCAAqC,SAAS,EAAE,EAAE;oBAC7E,OAAO,EAAE,EAAE,QAAQ,EAAE;iBACtB,CAAC;aACH,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACxC,IAAI,CAAC;gBACH,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,CAAC;YACX,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,CACR,kBAAkB,EAClB,oDAAoD,SAAS,EAAE,EAC/D;oBACE,IAAI,EAAE,oHAAoH;oBAC1H,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE;iBAC9C,CACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE9E,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AASlC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAE7C;;;;;GAKG;AACH,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,mDAAmD;AACnD,SAAS,YAAY,CAAC,CAAS,EAAE,KAAe,EAAE,eAAwB;IACxE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QAClD,OAAO,SAAS,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC;AAOD;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,SAAS,CAAC;QACR,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;YAC/C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,MAAM,KAAK,GAAG;oBAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;gBACpF,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7B,GAAG,GAAG,MAAM,CAAC;gBACb,SAAS;YACX,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAG,CAA2B,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC;YACtD,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC;SAC3B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,YAAsB,EACtB,UAAmC,EAAE;IAErC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CAAC,eAAe,EAAE,iCAAiC,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CACR,kBAAkB,EAClB,uEAAuE,EACvE;gBACE,IAAI,EAAE,kGAAkG;aACzG,CACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GACf,oHAAoH,CAAC;IAEvH,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,oEAAoE;IACpE,+DAA+D;IAC/D,MAAM,mBAAmB,GAAG,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,GAAG,CAAC,kBAAkB,EAAE,kCAAkC,SAAS,EAAE,EAAE;QACrE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;KACpC,CAAC,CAAC;IAEL,gDAAgD;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CACR,kBAAkB,EAClB,yDAAyD,SAAS,EAAE,EACpE;gBACE,IAAI,EAAE,8IAA8I;gBACpJ,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;aAC3C,CACF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,mBAAmB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;QACtE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,qCAAqC,SAAS,EAAE,EAAE;gBAC7E,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;aAC/C,CAAC;SACH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1C,IAAI,CAAC,mBAAmB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;QACtE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CAAC,gBAAgB,EAAE,wBAAwB,SAAS,EAAE,EAAE;gBAChE,OAAO,EAAE,EAAE,QAAQ,EAAE;aACtB,CAAC;SACH,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,sDAAsD;IACtD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC;YACH,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,mBAAmB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;QACtE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CACR,kBAAkB,EAClB,mDAAmD,SAAS,EAAE,EAC9D;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE;aAC7D,CACF;SACF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,oCAAoC;IACpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}