@polderlabs/bizar-omp 0.10.0 → 0.12.0

package/dist/core/evidence.js

@@ -1,9 +1,34 @@
 import { createHash } from "node:crypto";
 import { ContractError, StaleEvidenceError } from "./errors.js";
 export const digest = (value) => createHash("sha256").update(value).digest("hex");
+/**
+ * Provenance sources that describe material from a previous session rather than
+ * an observation of the current target tree.
+ *
+ * OMP ships a read-only `archive` eval prelude (`archive.enabled`, on by
+ * default) exposing prompt history, recent projects, past sessions and recaps.
+ * It is genuinely useful context and genuinely useless as proof: a passing
+ * result quoted from last week's session describes a tree that no longer
+ * exists. Snapshots already draw this line ("a snapshot is a recovery hint,
+ * not an archive"); the archive needs the same line at the evidence boundary,
+ * because unlike a snapshot it is *readable as text* and so can be mistaken
+ * for a result.
+ *
+ * Refused rather than flagged: there is no configuration in which a record
+ * with a historical source satisfies acceptance, so a caller cannot opt into
+ * the weaker behaviour by accident.
+ */
+const HISTORICAL_SOURCES = new Set(["archive", "session-history", "prompt-history", "recap", "snapshot"]);
+export function isCurrentTargetObservation(record) {
+    const source = record.provenance.source?.trim().toLowerCase();
+    return source === undefined || !HISTORICAL_SOURCES.has(source);
+}
 export function createEvidence(input) {
     if (!input.id.trim())
         throw new ContractError("Evidence ID is required");
+    if (!isCurrentTargetObservation(input)) {
+        throw new ContractError(`Evidence ${input.id} is sourced from archived or session history (${input.provenance.source}); history describes a past target tree and cannot be recorded as current-target evidence`);
+    }
     return { ...input, recordedAt: new Date().toISOString(), stale: false };
 }
 export function invalidateEvidence(records, targetDigest, changedInputs = []) {
@@ -24,6 +49,7 @@ export function requireFreshEvidence(records, ids, targetDigest, identity = {})
     if (missingIndex !== -1)
         throw new StaleEvidenceError(ids[missingIndex] || "unknown", "required evidence is missing");
     const stale = found.find(record => record.stale || record.targetDigest !== targetDigest || record.result !== "passed"
+        || !isCurrentTargetObservation(record)
         || (identity.candidateId !== undefined && record.candidateId !== identity.candidateId)
         || (identity.candidateTree !== undefined && record.candidateTree !== identity.candidateTree)
         || (identity.checkSpecHash !== undefined && record.checkSpecHash !== identity.checkSpecHash)

package/dist/core/evidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/core/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGhE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEvG,MAAM,UAAU,cAAc,CAAC,KAAmD;IAChF,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACzE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAyB,EAAE,YAAoB,EAAE,aAAa,GAAa,EAAE;IAC9G,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QAC1B,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,uBAAuB,MAAM,CAAC,YAAY,OAAO,YAAY,EAAE,EAAE,CAAC;QAC1J,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC/G,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAyB,EAAE,GAAa,EAAE,YAAoB,EAAE,QAAQ,GAAqG,EAAE;IAClN,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAChG,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACtH,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAO,CAAC,KAAK,IAAI,MAAO,CAAC,YAAY,KAAK,YAAY,IAAI,MAAO,CAAC,MAAM,KAAK,QAAQ;WACnH,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,MAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC;WACpF,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,MAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CAAC;WAC1F,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,MAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CAAC;WAC1F,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,MAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IACjG,IAAI,KAAK;QAAE,MAAM,IAAI,kBAAkB,CAAC,KAAM,CAAC,EAAE,EAAE,gDAAgD,CAAC,CAAC;IACrG,OAAO,KAAyB,CAAC;AACnC,CAAC"}
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/core/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGhE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEvG;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1G,MAAM,UAAU,0BAA0B,CAAC,MAA0C;IACnF,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9D,OAAO,MAAM,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAmD;IAChF,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACzE,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,YAAY,KAAK,CAAC,EAAE,iDAAiD,KAAK,CAAC,UAAU,CAAC,MAAM,2FAA2F,CAAC,CAAC;IACnN,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAyB,EAAE,YAAoB,EAAE,aAAa,GAAa,EAAE;IAC9G,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QAC1B,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,uBAAuB,MAAM,CAAC,YAAY,OAAO,YAAY,EAAE,EAAE,CAAC;QAC1J,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC/G,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAyB,EAAE,GAAa,EAAE,YAAoB,EAAE,QAAQ,GAAqG,EAAE;IAClN,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAChG,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACtH,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAO,CAAC,KAAK,IAAI,MAAO,CAAC,YAAY,KAAK,YAAY,IAAI,MAAO,CAAC,MAAM,KAAK,QAAQ;WACnH,CAAC,0BAA0B,CAAC,MAAO,CAAC;WACpC,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,MAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC;WACpF,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,MAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CAAC;WAC1F,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,MAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CAAC;WAC1F,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,MAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IACjG,IAAI,KAAK;QAAE,MAAM,IAAI,kBAAkB,CAAC,KAAM,CAAC,EAAE,EAAE,gDAAgD,CAAC,CAAC;IACrG,OAAO,KAAyB,CAAC;AACnC,CAAC"}

package/dist/core/policies.d.ts

@@ -13,10 +13,45 @@ import type { ObjectiveContract, RouteDecision, RouteTask, TrustPreset, Workflow
 export declare function workflowTierFor(task: RouteTask, route?: Pick<RouteDecision, "routeClass" | "intent" | "reasons">): WorkflowTier;
 export declare function classifyRoute(task: RouteTask): RouteDecision;
 export declare function objectiveHash(objective: ObjectiveContract): string;
+/**
+ * How a profile may use OMP's read-only `archive` eval prelude.
+ *
+ * `archive.enabled` is OMP's own setting, default on, and Bizar never writes
+ * it: stripping it would be a silent behaviour change to an operator's host.
+ * What Bizar owns is whether a managed dispatch may *rely* on it, and that
+ * answer is per profile rather than global.
+ *
+ * - `interactive` is pass-through: the operator's own session keeps full
+ *   archive context, because removing it would change a capability the
+ *   operator can already turn off themselves.
+ * - `trusted-development` is supported: the same operator, same machine, same
+ *   history the dispatch could read directly.
+ * - The managed and untrusted presets are `context-only`: a managed specialist
+ *   may read archived material as background, but nothing it reads may satisfy
+ *   an acceptance criterion. That separation is enforced where it matters —
+ *   `isCurrentTargetObservation` in `core/evidence.ts` refuses any evidence
+ *   record sourced from an archive — rather than by hiding the tool.
+ */
+export type ArchiveAccess = "pass-through" | "supported" | "context-only";
+export type ArchiveProfile = TrustPreset | "interactive";
+/** Whether archived content may satisfy acceptance for this profile. Never true. */
+export declare const ARCHIVE_IS_NEVER_ACCEPTANCE_EVIDENCE = true;
+export declare function archivePolicy(profile: ArchiveProfile): {
+    profile: ArchiveProfile;
+    access: ArchiveAccess;
+    acceptanceEvidence: "refused";
+    reason: string;
+};
 export declare function trustPolicy(preset: TrustPreset): {
     allowShell: boolean;
     managedIsolation: boolean;
     allowEval: boolean;
     preset: TrustPreset;
+    archive: {
+        profile: ArchiveProfile;
+        access: ArchiveAccess;
+        acceptanceEvidence: "refused";
+        reason: string;
+    };
 };
 //# sourceMappingURL=policies.d.ts.map

package/dist/core/policies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../src/core/policies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAe,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA4BtH;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC,GAAG,YAAY,CAkB/H;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,aAAa,CAqB5D;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,iBAAiB,GAAG,MAAM,CAElE;AAQD,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW;gBANE,OAAO;sBAAoB,OAAO;eAAa,OAAO;;EAMZ"}
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../src/core/policies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAe,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA4BtH;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC,GAAG,YAAY,CAkB/H;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,aAAa,CAqB5D;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,iBAAiB,GAAG,MAAM,CAElE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,WAAW,GAAG,cAAc,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,aAAa,CAAC;AASzD,oFAAoF;AACpF,eAAO,MAAM,oCAAoC,OAAO,CAAC;AAEzD,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG;IACtD,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB,kBAAkB,EAAE,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAQD,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW;gBANE,OAAO;sBAAoB,OAAO;eAAa,OAAO;;;iBAd5F,cAAc;gBACf,aAAa;4BACD,SAAS;gBACrB,MAAM;;EAiB2G"}

package/dist/core/policies.js

@@ -82,10 +82,27 @@ export function classifyRoute(task) {
 export function objectiveHash(objective) {
     return hash(JSON.stringify(objective));
 }
+const archiveAccess = {
+    interactive: "pass-through",
+    "trusted-development": "supported",
+    "restricted-managed": "context-only",
+    "untrusted-repository": "context-only",
+};
+/** Whether archived content may satisfy acceptance for this profile. Never true. */
+export const ARCHIVE_IS_NEVER_ACCEPTANCE_EVIDENCE = true;
+export function archivePolicy(profile) {
+    const access = archiveAccess[profile];
+    return {
+        profile,
+        access,
+        acceptanceEvidence: "refused",
+        reason: `OMP's archive prelude is read-only ${access} history. It describes past sessions and prompt history, never the current target tree, so evidence recorded from it is refused (see core/evidence.ts isCurrentTargetObservation).`,
+    };
+}
 const presets = {
     "trusted-development": { allowShell: true, managedIsolation: false, allowEval: true },
     "restricted-managed": { allowShell: true, managedIsolation: true, allowEval: false },
     "untrusted-repository": { allowShell: false, managedIsolation: true, allowEval: false },
 };
-export function trustPolicy(preset) { return { preset, ...presets[preset] }; }
+export function trustPolicy(preset) { return { preset, ...presets[preset], archive: archivePolicy(preset) }; }
 //# sourceMappingURL=policies.js.map

package/dist/core/policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/core/policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEjF,MAAM,WAAW,GAAyC;IACxD,CAAC,qDAAqD,EAAE,qBAAqB,EAAE,WAAW,CAAC;IAC3F,CAAC,uEAAuE,EAAE,mBAAmB,EAAE,UAAU,CAAC;IAC1G,CAAC,oEAAoE,EAAE,0BAA0B,EAAE,cAAc,CAAC;IAClH,CAAC,+GAA+G,EAAE,kBAAkB,EAAE,WAAW,CAAC;CACnJ,CAAC;AAEF,MAAM,cAAc,GAAG,mGAAmG,CAAC;AAC3H,MAAM,cAAc,GAAG,sFAAsF,CAAC;AAE9G;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,0NAA0N,CAAC;AAExP;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,uFAAuF,CAAC;AAEpH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,IAAe,EAAE,KAAgE;IAC/G,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IACxE,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IACxE,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEvF,6DAA6D;IAC7D,IAAI,MAAM,CAAC,qBAAqB;QAAE,OAAO,MAAM,CAAC;IAChD,IAAI,aAAa,IAAI,CAAC,UAAU,IAAI,KAAK,EAAE,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC;IAChF,IAAI,YAAY;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACnJ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAe;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7F,MAAM,UAAU,GAA4B,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAmC,CAAC;IACvJ,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAgB,QAAQ,IAAI,SAAS,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,QAAQ,cAAc,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,MAAM,GAAG,cAAc,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IAC5F,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1J,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC;IACpH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,IAAI,UAAU,IAAI,MAAM,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;AACzO,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA4B;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,OAAO,GAAgG;IAC3G,qBAAqB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE;IACrF,oBAAoB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;IACpF,sBAAsB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;CACxF,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,MAAmB,IAAI,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/core/policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEjF,MAAM,WAAW,GAAyC;IACxD,CAAC,qDAAqD,EAAE,qBAAqB,EAAE,WAAW,CAAC;IAC3F,CAAC,uEAAuE,EAAE,mBAAmB,EAAE,UAAU,CAAC;IAC1G,CAAC,oEAAoE,EAAE,0BAA0B,EAAE,cAAc,CAAC;IAClH,CAAC,+GAA+G,EAAE,kBAAkB,EAAE,WAAW,CAAC;CACnJ,CAAC;AAEF,MAAM,cAAc,GAAG,mGAAmG,CAAC;AAC3H,MAAM,cAAc,GAAG,sFAAsF,CAAC;AAE9G;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,0NAA0N,CAAC;AAExP;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,uFAAuF,CAAC;AAEpH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,IAAe,EAAE,KAAgE;IAC/G,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IACxE,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IACxE,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEvF,6DAA6D;IAC7D,IAAI,MAAM,CAAC,qBAAqB;QAAE,OAAO,MAAM,CAAC;IAChD,IAAI,aAAa,IAAI,CAAC,UAAU,IAAI,KAAK,EAAE,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC;IAChF,IAAI,YAAY;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACnJ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAe;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7F,MAAM,UAAU,GAA4B,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAmC,CAAC;IACvJ,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAgB,QAAQ,IAAI,SAAS,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,QAAQ,cAAc,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,MAAM,GAAG,cAAc,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IAC5F,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1J,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC;IACpH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,IAAI,UAAU,IAAI,MAAM,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;AACzO,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA4B;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AACzC,CAAC;AAwBD,MAAM,aAAa,GAA0C;IAC3D,WAAW,EAAE,cAAc;IAC3B,qBAAqB,EAAE,WAAW;IAClC,oBAAoB,EAAE,cAAc;IACpC,sBAAsB,EAAE,cAAc;CACvC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,IAAI,CAAC;AAEzD,MAAM,UAAU,aAAa,CAAC,OAAuB;IAMnD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO;QACL,OAAO;QACP,MAAM;QACN,kBAAkB,EAAE,SAAS;QAC7B,MAAM,EAAE,sCAAsC,MAAM,oLAAoL;KACzO,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAgG;IAC3G,qBAAqB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE;IACrF,oBAAoB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;IACpF,sBAAsB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;CACxF,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,MAAmB,IAAI,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC"}

package/dist/extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AA2DA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAOrE,UAAU,cAAc;IACtB,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACzC,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACpD,mBAAmB,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5D;AAED,UAAU,aAAa;IACrB,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;IAC1B,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,OAAO,CAAC,IAAI,cAAc,GAAG,SAAS,CAAC;IACvC,MAAM,CAAC,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAC;CACxC;AAED,UAAU,UAAU;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE;QAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC7G,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,cAAc,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,OAAO,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAChL,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,IAAI,CAAC;CACnB;AAED,UAAU,SAAS,CAAC,CAAC;IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAAC,QAAQ,IAAI,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;CAAE;AACtF,UAAU,MAAM;IACd,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,SAAS,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,KAAK,CAAC,CAAC,SAAS,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5H,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;SAAG,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;KAAE,CAAC,CAAC;CACzG;AAED;;;;GAIG;AACH,UAAU,yBAAyB;IACjC,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAChC;AAED,UAAU,KAAK;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IACnC,eAAe,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC7E,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACpI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC;IAClG,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClI;AAgYD,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,EAAE,EAAE,KAAK,QAszB/C"}
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AA+DA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAOrE,UAAU,cAAc;IACtB,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACzC,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACpD,mBAAmB,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5D;AAED,UAAU,aAAa;IACrB,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;IAC1B,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,OAAO,CAAC,IAAI,cAAc,GAAG,SAAS,CAAC;IACvC,MAAM,CAAC,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAC;CACxC;AAED,UAAU,UAAU;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE;QAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC7G,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,cAAc,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,OAAO,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAChL,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,IAAI,CAAC;CACnB;AAED,UAAU,SAAS,CAAC,CAAC;IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAAC,QAAQ,IAAI,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;CAAE;AACtF,UAAU,MAAM;IACd,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,SAAS,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,KAAK,CAAC,CAAC,SAAS,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5H,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;SAAG,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;KAAE,CAAC,CAAC;CACzG;AAED;;;;GAIG;AACH,UAAU,yBAAyB;IACjC,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAChC;AAED,UAAU,KAAK;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IACnC,eAAe,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC7E,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACpI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC;IAClG,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClI;AA+aD,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,EAAE,EAAE,KAAK,QAyzB/C"}

package/dist/extension.js

@@ -37,7 +37,7 @@ import { readJournalSessionId } from "./omp/session-ownership.js";
 import { clearOmbHostGeneration, rebindOmbHostGeneration } from "./omp/tmux.js";
 import { createSessionTitleController, resolveSessionTitleLabel } from "./omp/terminal-title.js";
 import { bindSession } from "./omp/lifecycle.js";
-import { BIZAR_MODEL_ROLE_AGENT_PROMPT, BIZAR_MODEL_ROLE_TOOL, BIZAR_MODEL_ROLES, buildAgentEvaluationRequest, clipOperatorNotice, commitRolePlan, diffCatalog, formatCatalogDelta, formatRoleAssignmentPlan, planBizarModelRoles, planFromRecommendations, recordOf, reviewRoleRecommendations, roleAssignmentRoute, snapshotCatalog, isOpaqueOmniRouteCombo, omniRouteFailureGuidance, } from "./omp/model-role-assignment.js";
+import { BIZAR_MODEL_ROLE_AGENT_PROMPT, BIZAR_MODEL_ROLE_TOOL, BIZAR_MODEL_ROLES, buildAgentEvaluationRequest, catalogDigestOf, clipOperatorNotice, commitRolePlan, diffCatalog, formatCatalogDelta, formatRoleAssignmentPlan, mappingDigest, mintRoleAssignmentGrant, planBizarModelRoles, planFromRecommendations, recordOf, reviewRoleRecommendations, roleAssignmentRoute, ROLE_GRANT_TTL_MS, snapshotCatalog, isOpaqueOmniRouteCombo, omniRouteFailureGuidance, } from "./omp/model-role-assignment.js";
 import { AGENT_ROLES } from "./omp/model-roles.js";
 import { loadOmbSettings, recordCatalogObservation } from "./omp/omb-settings.js";
 import { isRunPhaseActive } from "./core/types.js";
@@ -285,6 +285,8 @@ async function runModelRoleCommand(pi, args, ctx, routeResponses = new Map()) {
     if (words.includes("health"))
         return modelRoleHealth(pi, ctx, routeResponses);
     const previewRequested = words.includes("preview") || words.includes("dry-run") || words.includes("--dry-run");
+    // Preview is checked before anything else, so it stays read-only and mints no
+    // write authority regardless of what else was asked for.
     if (previewRequested)
         return previewModelRoles(ctx);
     // OMP 18.2.6 exposes the authenticated catalog directly, but an extension
@@ -317,19 +319,38 @@ async function runModelRoleCommand(pi, args, ctx, routeResponses = new Map()) {
     const recorded = recordCatalogObservation(snapshot);
     const observationNote = recorded.ok ? "" : `\nCatalog observation not recorded: ${recorded.reason}`;
     if (route.kind === "local-plan") {
+        // The operator's own command is the authority on this route; no model is in
+        // the loop, so there is no authorization to mint.
         return `${commitRolePlan({
             settings: route.settings,
             resolve: selector => ctx.models?.resolve?.(selector),
             plan: baseline,
             delta,
             source: "deterministic scoring; native request handoff unavailable",
+            models: route.models,
+            authorization: { operatorCommand: true },
         })}${observationNote}`;
     }
+    // A013: the agent route is the only one a model can complete, so this is the
+    // only route that needs an explicit operator authorization. It is minted
+    // here, bound to this session and to the catalog and mapping the operator just
+    // reviewed, and echoed to the agent so it is the only thing that can write.
+    const sessionId = mainSessionId(ctx);
+    if (!sessionId) {
+        throw new ContractError("Model-role authorization requires an identified OMP main session; the agent route is refused rather than handed a distribution with no operator authority.");
+    }
+    const currentRoles = recordOf(route.settings.get("modelRoles"));
+    const token = mintRoleAssignmentGrant({
+        sessionId,
+        catalogDigest: catalogDigestOf(route.models),
+        mappingDigest: mappingDigest(currentRoles),
+    });
     route.send(buildAgentEvaluationRequest({
         models: route.models,
-        currentRoles: recordOf(route.settings.get("modelRoles")),
+        currentRoles,
         baseline,
         delta,
+        authorization: token,
     }));
     const assigned = baseline.assignments.map(({ role, selector }) => `${role}=${selector}`).join(", ");
     const unresolved = baseline.unavailable.length > 0
@@ -341,8 +362,8 @@ async function runModelRoleCommand(pi, args, ctx, routeResponses = new Map()) {
     const leftUnchanged = unchanged.length > 0 ? ` Left unchanged until the decision lands: ${unchanged.join(", ")}.` : "";
     return [
         formatCatalogDelta(delta),
-        `Re-evaluated ${Object.keys(BIZAR_MODEL_ROLES).length} Bizar roles against ${route.models.length} live models, including roles that already hold a value.`,
-        `The distribution request was sent for evaluation and will be persisted through ${BIZAR_MODEL_ROLE_TOOL}. Deterministic baseline: ${assigned}.${unresolved}${leftUnchanged}`,
+        `Authorized one ${BIZAR_MODEL_ROLE_TOOL} call for this session, covering ${Object.keys(BIZAR_MODEL_ROLES).length} Bizar roles, for ${ROLE_GRANT_TTL_MS / 60000} minutes. The agent holds the single-use token and may not apply anything else, in another session, or after it expires.`,
+        `Re-evaluated ${Object.keys(BIZAR_MODEL_ROLES).length} Bizar roles against ${route.models.length} live models, including roles that already hold a value. Deterministic baseline: ${assigned}.${unresolved}${leftUnchanged}`,
     ].join("\n") + observationNote;
 }
 const runVerificationWithSignal = runVerification;
@@ -376,6 +397,29 @@ function appendUserIdentityInvariant(systemPrompt) {
  * Universal Bizar OMP invariants injected into every session (main and task children).
  */
 const BIZAR_INVARIANTS = "BizarHarness OMP is installed. Use the native bizar-omp skill for Bizar's ownership boundaries, adaptive workflow tiers, workflow/evidence tools, model-role command, and omp-versus-omb launcher contract. Focused work is direct with targeted proof; bounded work uses a lightweight Bizar workflow with acceptance and targeted checks; full work uses planning, isolation, evidence, review, and serialized integration. The native OMP Advisor is off by default for OMB performance and may provide passive independent review when the operator enables it; incorporate useful concerns without creating a second orchestration runtime. Before acting on a todo that asks to commit or push, check the working tree and upstream Git state. When `git status --short` is empty and `git rev-parse HEAD` matches the relevant upstream branch, complete the satisfied commit/push todo items with the native todo tool and continue; do not create a duplicate commit, push, or prompt for either action. If a task or spawn fails immediately with `No model selected`, OMP could not resolve a model for the session; the brief is never the cause and retrying cannot help. You have no tool that selects a model, so do not retry, do not try another route, and do not ask the user to restate the task. Report it once, name `No model selected`, and stop; the operator resolves it with `/model` or by restoring the provider key. Bizar defines semantic roles only and never overrides the operator model choice.";
+/**
+ * Archive scoping, stated to the model rather than enforced by hiding a tool.
+ *
+ * OMP's read-only `archive` prelude (prompt history, recent projects, past
+ * sessions, recaps) stays available in every profile — it is the operator's
+ * setting and this extension does not rewrite it. What the model must know is
+ * that reading it produces context, never proof: Bizar refuses any evidence
+ * record sourced from an archive, so a result quoted out of last week's
+ * transcript cannot satisfy a criterion however confident it reads.
+ */
+const ARCHIVE_SCOPING_INVARIANT = "OMP's read-only `archive` prelude (prompt history, recent projects, past sessions, recaps) is available but is context, never evidence: it describes past sessions, not the current target tree. Use it to recover earlier work when asked. Never cite archived output as proof that a check passed, and never record it through `bizar_verify` or `bizar_candidate_verify` — evidence sourced from an archive is refused at acceptance.";
+function appendArchiveScoping(systemPrompt) {
+    if (typeof systemPrompt === "string") {
+        return systemPrompt.includes(ARCHIVE_SCOPING_INVARIANT) ? systemPrompt : `${systemPrompt}\n\n${ARCHIVE_SCOPING_INVARIANT}`;
+    }
+    if (Array.isArray(systemPrompt)) {
+        const prompts = systemPrompt.map(String);
+        return prompts.some(prompt => prompt.includes(ARCHIVE_SCOPING_INVARIANT))
+            ? prompts
+            : [...prompts, ARCHIVE_SCOPING_INVARIANT];
+    }
+    return [ARCHIVE_SCOPING_INVARIANT];
+}
 /**
  * Orchestrator-only role assertion and delegation guidance. Applied only after an
  * operator explicitly activates the main orchestrator role via `bizar_apply_main_orchestrator_role`.
@@ -637,9 +681,9 @@ export default function bizarExtension(pi) {
         const systemPrompt = paramsOf(event).systemPrompt;
         const active = orchestratorSessionId !== undefined && orchestratorSessionId === sessionId;
         return {
-            systemPrompt: appendUserIdentityInvariant(active
+            systemPrompt: appendUserIdentityInvariant(appendArchiveScoping(active
                 ? applyOrchestratorPolicy(appendBizarInvariant(systemPrompt))
-                : appendBizarInvariant(removeOrchestratorPolicy(systemPrompt))),
+                : appendBizarInvariant(removeOrchestratorPolicy(systemPrompt)))),
         };
     });
     pi.on("agent_end", (event, ctx) => {
@@ -1283,14 +1327,15 @@ export default function bizarExtension(pi) {
         },
     });
     pi.registerTool({
-        name: "bizar_capabilities", label: "Bizar Native Capabilities", description: "Report native qualification honestly; registration is not end-to-end managed qualification.",
+        name: "bizar_capabilities", label: "Bizar Native Capabilities", description: "Report native qualification honestly; registration is not end-to-end managed qualification. Also reports each packaged specialist's requested/active/unavailable tool roster against the qualified OMP, plus any drift between OMP's built-in registry and Bizar's reviewed profiles.",
         parameters: pi.zod.object({}),
         async execute() { return result(capabilityReport({ extensionLoaded: true })); },
     });
     pi.registerTool({
         name: BIZAR_MODEL_ROLE_TOOL, label: "Bizar Apply Model Roles",
-        description: "Validate a proposed Bizar model-role distribution against the live OMP catalog and persist it atomically; the whole mapping is refused when any selector is not a resolvable catalog entry, and a selector that only differs in casing is stored under the catalog's spelling.",
+        description: "Validate a proposed Bizar model-role distribution against the live OMP catalog and persist it atomically. Requires the single-use authorization token /bizar-models issues for this session: a missing, forged, expired, replayed, cross-session, or stale token writes nothing. The whole mapping is refused when any selector is not a resolvable catalog entry, and a selector that only differs in casing is stored under the catalog's spelling.",
         parameters: pi.zod.object({
+            authorization: pi.zod.string().optional(),
             assignment: pi.zod.array(pi.zod.object({
                 role: pi.zod.string(),
                 selector: pi.zod.string(),
@@ -1321,6 +1366,8 @@ export default function bizarExtension(pi) {
                     plan: planFromRecommendations(review, host.models),
                     delta: diffCatalog(loadOmbSettings().modelCatalog, snapshot),
                     source: "catalog-evaluated distribution",
+                    models: host.models,
+                    authorization: { token: paramsOf(raw).authorization, sessionId: mainSessionId(ctx) },
                 });
                 // A recommendation that only differed in casing is stored under the
                 // catalog's own spelling; the repair is reported so the persisted mapping