@provos/ironcurtain 0.1.0

package/dist/pipeline/annotate.d.ts

@@ -0,0 +1,9 @@
+/**
+ * CLI entry point for `ironcurtain annotate-tools`.
+ *
+ * Connects to MCP servers, classifies tool arguments via LLM, and writes
+ * the tool-annotations.json artifact. This is a developer task that only
+ * needs to run when MCP servers, their tools, or the argument role
+ * registry change.
+ */
+export declare function main(): Promise<void>;

package/dist/pipeline/annotate.js

@@ -0,0 +1,136 @@
+/**
+ * CLI entry point for `ironcurtain annotate-tools`.
+ *
+ * Connects to MCP servers, classifies tool arguments via LLM, and writes
+ * the tool-annotations.json artifact. This is a developer task that only
+ * needs to run when MCP servers, their tools, or the argument role
+ * registry change.
+ */
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import chalk from 'chalk';
+import { computeHash, createPipelineLlm, loadExistingArtifact, loadPipelineConfig, showCached, writeArtifact, withSpinner, } from './pipeline-shared.js';
+import { annotateTools, buildAnnotationPrompt, validateAnnotationsHeuristic } from './tool-annotator.js';
+async function connectAndDiscoverTools(mcpServers) {
+    const { result } = await withSpinner('[1/2] Connecting to MCP servers', async (spinner) => {
+        const connections = new Map();
+        let totalTools = 0;
+        for (const [serverName, config] of Object.entries(mcpServers)) {
+            spinner.text = `[1/2] Connecting to MCP server: ${serverName}...`;
+            const transport = new StdioClientTransport({
+                command: config.command,
+                args: config.args,
+                env: config.env
+                    ? { ...process.env, ...config.env }
+                    : undefined,
+                stderr: 'pipe',
+            });
+            // Drain piped stderr to prevent backpressure (logs are discarded)
+            if (transport.stderr) {
+                transport.stderr.on('data', () => { });
+            }
+            const client = new Client({ name: 'ironcurtain-annotator', version: '0.1.0' });
+            await client.connect(transport);
+            const toolsResult = await client.listTools();
+            totalTools += toolsResult.tools.length;
+            connections.set(serverName, { client, tools: toolsResult.tools });
+        }
+        return { connections, totalTools };
+    }, (r, elapsed) => `[1/2] Found ${r.totalTools} tools (${elapsed.toFixed(1)}s)`);
+    return result.connections;
+}
+function computeAnnotationHash(serverName, tools) {
+    return computeHash(serverName, JSON.stringify(tools), buildAnnotationPrompt(serverName, tools));
+}
+async function annotateServerTools(serverName, tools, existingAnnotations, llm) {
+    const inputHash = computeAnnotationHash(serverName, tools);
+    const stepText = `[2/2] Annotating tools for ${serverName}`;
+    // Check cache: skip LLM call if inputs haven't changed
+    const cached = existingAnnotations?.servers[serverName];
+    if (cached && cached.inputHash === inputHash) {
+        showCached(stepText);
+        return { annotations: cached.tools, inputHash };
+    }
+    const { result } = await withSpinner(stepText, async (spinner) => {
+        const annotations = await annotateTools(serverName, tools, llm, (msg) => { spinner.text = `${stepText} — ${msg}`; });
+        const validation = validateAnnotationsHeuristic(tools, annotations);
+        if (!validation.valid) {
+            for (const w of validation.warnings) {
+                spinner.text = `${stepText} — WARNING: ${w}`;
+            }
+        }
+        return annotations;
+    }, (annotations, elapsed) => `${stepText}: ${annotations.length} tools annotated (${elapsed.toFixed(1)}s)`);
+    return { annotations: result, inputHash };
+}
+// ---------------------------------------------------------------------------
+// Artifact Construction & Output
+// ---------------------------------------------------------------------------
+function buildAnnotationsArtifact(annotationResults) {
+    const servers = {};
+    for (const [serverName, result] of annotationResults) {
+        servers[serverName] = {
+            inputHash: result.inputHash,
+            tools: result.annotations,
+        };
+    }
+    return { generatedAt: new Date().toISOString(), servers };
+}
+// ---------------------------------------------------------------------------
+// MCP Client Cleanup
+// ---------------------------------------------------------------------------
+async function disconnectAll(connections) {
+    for (const conn of connections.values()) {
+        try {
+            await conn.client.close();
+        }
+        catch {
+            // Ignore cleanup errors
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+export async function main() {
+    const config = loadPipelineConfig();
+    console.error(chalk.bold('Tool Annotation Pipeline'));
+    console.error(chalk.bold('========================'));
+    console.error(`Output: ${chalk.dim(config.generatedDir + '/')}`);
+    console.error('');
+    const { model: llm, logContext, logPath } = await createPipelineLlm(config.generatedDir, 'annotate');
+    const connections = await connectAndDiscoverTools(config.mcpServers);
+    try {
+        const existingAnnotations = loadExistingArtifact(config.generatedDir, 'tool-annotations.json', config.packageGeneratedDir);
+        const annotationResults = new Map();
+        for (const [serverName, conn] of connections) {
+            logContext.stepName = `annotate-${serverName}`;
+            const result = await annotateServerTools(serverName, conn.tools, existingAnnotations, llm);
+            annotationResults.set(serverName, result);
+        }
+        const toolAnnotationsFile = buildAnnotationsArtifact(annotationResults);
+        writeArtifact(config.generatedDir, 'tool-annotations.json', toolAnnotationsFile);
+        const totalTools = [...annotationResults.values()]
+            .reduce((sum, r) => sum + r.annotations.length, 0);
+        console.error('');
+        console.error(`  Tools annotated: ${totalTools}`);
+        console.error(`  Artifact written to: ${chalk.dim(config.generatedDir + '/tool-annotations.json')}`);
+        console.error(`  LLM interaction log: ${chalk.dim(logPath)}`);
+        console.error('');
+        console.error(chalk.green.bold('Tool annotation successful!'));
+    }
+    finally {
+        await disconnectAll(connections);
+    }
+}
+// Only run when executed directly (not when imported by cli.ts)
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    await import('dotenv/config');
+    main().catch((err) => {
+        console.error(chalk.red.bold('Tool annotation failed:'), err);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=annotate.js.map

package/dist/pipeline/annotate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotate.js","sourceRoot":"","sources":["../../src/pipeline/annotate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAYzG,KAAK,UAAU,uBAAuB,CACpC,UAA2C;IAE3C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAClC,iCAAiC,EACjC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;QACxD,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,IAAI,GAAG,mCAAmC,UAAU,KAAK,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;gBACzC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,EAAE,MAAM,CAAC,GAAG;oBACb,CAAC,CAAC,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE;oBAC/D,CAAC,CAAC,SAAS;gBACb,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,kEAAkE;YAClE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gBACrB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/E,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAEhC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,UAAU,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;YAEvC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACrC,CAAC,EACD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,UAAU,WAAW,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC;IAEF,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAWD,SAAS,qBAAqB,CAC5B,UAAkB,EAClB,KAAgC;IAEhC,OAAO,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,UAAkB,EAClB,KAAgC,EAChC,mBAAoD,EACpD,GAAkB;IAElB,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,8BAA8B,UAAU,EAAE,CAAC;IAE5D,uDAAuD;IACvD,MAAM,MAAM,GAAG,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7C,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAClC,QAAQ,EACR,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAC5D,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CACpD,CAAC;QAEF,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,eAAe,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,EACD,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CACvB,GAAG,QAAQ,KAAK,WAAW,CAAC,MAAM,qBAAqB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAChF,CAAC;IAEF,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,wBAAwB,CAC/B,iBAAgD;IAEhD,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACrD,OAAO,CAAC,UAAU,CAAC,GAAG;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,WAAW;SAC1B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,KAAK,UAAU,aAAa,CAAC,WAA0C;IACrE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CACjE,MAAM,CAAC,YAAY,EAAE,UAAU,CAChC,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAErE,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,oBAAoB,CAC9C,MAAM,CAAC,YAAY,EAAE,uBAAuB,EAAE,MAAM,CAAC,mBAAmB,CACzE,CAAC;QAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA4B,CAAC;QAC9D,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YAC7C,UAAU,CAAC,QAAQ,GAAG,YAAY,UAAU,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAC3F,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;QACxE,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;QAEjF,MAAM,UAAU,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC;aAC/C,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/pipeline/compile.d.ts

@@ -0,0 +1,23 @@
+/**
+ * CLI entry point for `ironcurtain compile-policy`.
+ *
+ * Orchestrates the policy compilation pipeline (stages 1-3):
+ *   1. Compile constitution into declarative rules via LLM
+ *   2. Generate test scenarios via LLM
+ *   3. Verify compiled policy against real engine + LLM judge
+ *
+ * Requires tool-annotations.json to exist on disk. Run
+ * `npm run annotate-tools` first to generate it.
+ */
+import type { CompiledRule } from './types.js';
+/**
+ * Resolves all `paths.within` values in compiled rules to their real
+ * filesystem paths, following symlinks. This ensures that symlinked
+ * directories (e.g., ~/Downloads -> /mnt/c/.../Downloads on WSL) are
+ * resolved to their canonical form so that runtime path comparisons
+ * match correctly.
+ *
+ * Falls back to path.resolve() if the path does not exist on disk.
+ */
+export declare function resolveRulePaths(rules: CompiledRule[]): CompiledRule[];
+export declare function main(): Promise<void>;

package/dist/pipeline/compile.js

@@ -0,0 +1,386 @@
+/**
+ * CLI entry point for `ironcurtain compile-policy`.
+ *
+ * Orchestrates the policy compilation pipeline (stages 1-3):
+ *   1. Compile constitution into declarative rules via LLM
+ *   2. Generate test scenarios via LLM
+ *   3. Verify compiled policy against real engine + LLM judge
+ *
+ * Requires tool-annotations.json to exist on disk. Run
+ * `npm run annotate-tools` first to generate it.
+ */
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import chalk from 'chalk';
+import { PolicyEngine } from '../trusted-process/policy-engine.js';
+import { resolveRealPath } from '../types/argument-roles.js';
+import { buildCompilerPrompt, compileConstitution, validateCompiledRules } from './constitution-compiler.js';
+import { getHandwrittenScenarios } from './handwritten-scenarios.js';
+import { computeHash, createPipelineLlm, loadExistingArtifact, loadPipelineConfig, showCached, writeArtifact, withSpinner, } from './pipeline-shared.js';
+import { applyScenarioCorrections, extractScenarioCorrections, filterStructuralConflicts, verifyPolicy, } from './policy-verifier.js';
+import { buildGeneratorPrompt, generateScenarios } from './scenario-generator.js';
+// ---------------------------------------------------------------------------
+// Content-Hash Caching (compile-specific)
+// ---------------------------------------------------------------------------
+function computePolicyHash(constitutionText, allAnnotations, protectedPaths) {
+    const prompt = buildCompilerPrompt(constitutionText, allAnnotations, {
+        protectedPaths,
+    });
+    return computeHash(constitutionText, JSON.stringify(allAnnotations), prompt);
+}
+function computeScenariosHash(constitutionText, annotations, handwrittenScenarios, sandboxDirectory, protectedPaths, permittedDirectories) {
+    const prompt = buildGeneratorPrompt(constitutionText, annotations, sandboxDirectory, protectedPaths, permittedDirectories);
+    return computeHash(prompt, constitutionText, JSON.stringify(annotations), JSON.stringify(handwrittenScenarios), JSON.stringify({ sandboxDirectory }), JSON.stringify(protectedPaths), JSON.stringify(permittedDirectories));
+}
+function extractPermittedDirectories(rules) {
+    const dirs = new Set();
+    for (const rule of rules) {
+        if (rule.if.paths?.within) {
+            dirs.add(rule.if.paths.within);
+        }
+    }
+    return [...dirs].sort();
+}
+function collectProbeScenarios(result) {
+    return result.rounds.flatMap(round => round.newScenarios);
+}
+/**
+ * Filters scenarios against structural invariants and logs any discarded ones.
+ * Returns the valid scenarios and the full list of discarded scenarios.
+ */
+function filterAndLogStructuralConflicts(engine, scenarios, label = 'Discarded scenario (structural conflict)') {
+    const { valid, discarded } = filterStructuralConflicts(engine, scenarios);
+    for (const d of discarded) {
+        const prefix = d.scenario.source === 'handwritten'
+            ? chalk.yellow('Warning: handwritten scenario conflicts with structural invariant:')
+            : chalk.dim(`${label}:`);
+        console.error(`  ${prefix} "${d.scenario.description}" — ${d.rule} always returns ${d.actual}`);
+    }
+    return { valid, discarded };
+}
+// ---------------------------------------------------------------------------
+// Path Resolution (post-LLM normalization)
+// ---------------------------------------------------------------------------
+/**
+ * Resolves all `paths.within` values in compiled rules to their real
+ * filesystem paths, following symlinks. This ensures that symlinked
+ * directories (e.g., ~/Downloads -> /mnt/c/.../Downloads on WSL) are
+ * resolved to their canonical form so that runtime path comparisons
+ * match correctly.
+ *
+ * Falls back to path.resolve() if the path does not exist on disk.
+ */
+export function resolveRulePaths(rules) {
+    return rules.map(rule => {
+        if (!rule.if.paths?.within)
+            return rule;
+        const resolved = resolveRealPath(rule.if.paths.within);
+        if (resolved === rule.if.paths.within)
+            return rule;
+        return {
+            ...rule,
+            if: {
+                ...rule.if,
+                paths: { ...rule.if.paths, within: resolved },
+            },
+        };
+    });
+}
+async function compilePolicyRules(constitutionText, annotations, protectedPaths, existingPolicy, llm) {
+    const inputHash = computePolicyHash(constitutionText, annotations, protectedPaths);
+    const stepText = '[1/3] Compiling constitution';
+    // Check cache: skip LLM call if inputs haven't changed.
+    // Still resolve paths in case symlink targets changed since last run.
+    if (existingPolicy && existingPolicy.inputHash === inputHash) {
+        showCached(stepText);
+        return { rules: resolveRulePaths(existingPolicy.rules), inputHash };
+    }
+    const { result: compiledRules } = await withSpinner(stepText, async (spinner) => {
+        const rules = resolveRulePaths(await compileConstitution(constitutionText, annotations, { protectedPaths }, llm, undefined, (msg) => { spinner.text = `${stepText} — ${msg}`; }));
+        validateRulesOrThrow(rules);
+        return rules;
+    }, (rules, elapsed) => `${stepText}: ${rules.length} rules compiled (${elapsed.toFixed(1)}s)`);
+    return { rules: compiledRules, inputHash };
+}
+class RuleValidationError extends Error {
+    errors;
+    constructor(errors) {
+        super('Compiled rule validation failed');
+        this.errors = errors;
+        this.name = 'RuleValidationError';
+    }
+}
+function validateRulesOrThrow(rules) {
+    const ruleValidation = validateCompiledRules(rules);
+    if (ruleValidation.warnings.length > 0) {
+        for (const w of ruleValidation.warnings) {
+            console.error(`  ${chalk.yellow('Warning:')} ${w}`);
+        }
+    }
+    if (!ruleValidation.valid) {
+        throw new RuleValidationError(ruleValidation.errors);
+    }
+}
+async function compilePolicyRulesWithRepair(constitutionText, annotations, protectedPaths, baseInputHash, repairContext, llm, onProgress) {
+    const compiledRules = resolveRulePaths(await compileConstitution(constitutionText, annotations, { protectedPaths }, llm, repairContext, onProgress));
+    validateRulesOrThrow(compiledRules);
+    return { rules: compiledRules, inputHash: `${baseInputHash}-repair` };
+}
+// ---------------------------------------------------------------------------
+// Artifact Construction (pure data transformation)
+// ---------------------------------------------------------------------------
+function buildPolicyArtifact(constitutionHash, compilationResult) {
+    return {
+        generatedAt: new Date().toISOString(),
+        constitutionHash,
+        inputHash: compilationResult.inputHash,
+        rules: compilationResult.rules,
+    };
+}
+async function generateTestScenarios(constitutionText, annotations, allowedDirectory, protectedPaths, permittedDirectories, existingScenarios, llm) {
+    const handwrittenScenarios = getHandwrittenScenarios(allowedDirectory);
+    const inputHash = computeScenariosHash(constitutionText, annotations, handwrittenScenarios, allowedDirectory, protectedPaths, permittedDirectories);
+    const stepText = '[2/3] Generating test scenarios';
+    // Check cache: skip LLM call if inputs haven't changed
+    if (existingScenarios && existingScenarios.inputHash === inputHash) {
+        showCached(stepText);
+        return { scenarios: existingScenarios.scenarios, inputHash };
+    }
+    const { result: scenarios } = await withSpinner(stepText, async (spinner) => {
+        return await generateScenarios(constitutionText, annotations, handwrittenScenarios, allowedDirectory, protectedPaths, llm, permittedDirectories, (msg) => { spinner.text = `${stepText} — ${msg}`; });
+    }, (scenarios, elapsed) => {
+        const generatedCount = scenarios.length - handwrittenScenarios.length;
+        return `${stepText}: ${scenarios.length} scenarios (${handwrittenScenarios.length} handwritten + ${generatedCount} generated) (${elapsed.toFixed(1)}s)`;
+    });
+    return { scenarios, inputHash };
+}
+// ---------------------------------------------------------------------------
+// Policy Verification (LLM step)
+// ---------------------------------------------------------------------------
+async function verifyCompiledPolicy(constitutionText, compiledPolicyFile, toolAnnotationsFile, protectedPaths, scenarios, llm, allowedDirectory, maxRounds = 3, verbose = true, onProgress) {
+    const result = await verifyPolicy(constitutionText, compiledPolicyFile, toolAnnotationsFile, protectedPaths, scenarios, llm, maxRounds, allowedDirectory, onProgress);
+    if (!result.pass) {
+        if (verbose) {
+            console.error('');
+            console.error(chalk.red('Verification FAILED:'));
+            console.error(result.summary);
+            console.error('');
+            for (const f of result.failedScenarios) {
+                console.error(`  ${chalk.red('FAIL:')} ${f.scenario.description}`);
+                console.error(`    Expected: ${f.scenario.expectedDecision}, Got: ${f.actualDecision} (rule: ${f.matchingRule})`);
+            }
+        }
+        else {
+            console.error(`  ${result.failedScenarios.length} scenario(s) failed.`);
+        }
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Artifact Output
+// ---------------------------------------------------------------------------
+function writeScenariosArtifact(generatedDir, constitutionHash, scenarioResult) {
+    const scenariosFile = {
+        generatedAt: new Date().toISOString(),
+        constitutionHash,
+        inputHash: scenarioResult.inputHash,
+        scenarios: scenarioResult.scenarios,
+    };
+    writeArtifact(generatedDir, 'test-scenarios.json', scenariosFile);
+}
+function writePolicyArtifact(generatedDir, compiledPolicyFile) {
+    writeArtifact(generatedDir, 'compiled-policy.json', compiledPolicyFile);
+}
+// ---------------------------------------------------------------------------
+// Main Pipeline
+// ---------------------------------------------------------------------------
+export async function main() {
+    const config = loadPipelineConfig();
+    // Load tool annotations from disk (produced by `npm run annotate-tools`)
+    const toolAnnotationsFile = loadExistingArtifact(config.generatedDir, 'tool-annotations.json', config.packageGeneratedDir);
+    if (!toolAnnotationsFile) {
+        console.error(chalk.red.bold("Error: tool-annotations.json not found. Run 'npm run annotate-tools' first to generate tool annotations."));
+        process.exit(1);
+    }
+    // Flatten annotations from all servers
+    const allAnnotations = Object.values(toolAnnotationsFile.servers)
+        .flatMap(server => server.tools);
+    console.error(chalk.bold('Policy Compilation Pipeline'));
+    console.error(chalk.bold('==========================='));
+    console.error(`Constitution: ${chalk.dim(config.constitutionPath)}`);
+    console.error(`Sandbox:      ${chalk.dim(config.allowedDirectory)}`);
+    console.error(`Output:       ${chalk.dim(config.generatedDir + '/')}`);
+    console.error(`Annotations:  ${chalk.dim(`${allAnnotations.length} tools from ${Object.keys(toolAnnotationsFile.servers).length} server(s)`)}`);
+    console.error('');
+    const { model: llm, logContext, logPath } = await createPipelineLlm(config.generatedDir, 'unknown');
+    // Load existing artifacts for cache comparison
+    const existingPolicy = loadExistingArtifact(config.generatedDir, 'compiled-policy.json', config.packageGeneratedDir);
+    const existingScenarios = loadExistingArtifact(config.generatedDir, 'test-scenarios.json', config.packageGeneratedDir);
+    // Compile constitution into policy rules (LLM-cacheable)
+    logContext.stepName = 'compile-constitution';
+    let compilationResult = await compilePolicyRules(config.constitutionText, allAnnotations, config.protectedPaths, existingPolicy, llm);
+    // Build and write policy artifact immediately so it's available for
+    // inspection even if verification fails, and cached for next run.
+    let compiledPolicyFile = buildPolicyArtifact(config.constitutionHash, compilationResult);
+    writePolicyArtifact(config.generatedDir, compiledPolicyFile);
+    // Extract permitted directories from compiled rules for scenario generation
+    const permittedDirectories = extractPermittedDirectories(compilationResult.rules);
+    // Generate test scenarios (LLM-cacheable)
+    logContext.stepName = 'generate-scenarios';
+    const scenarioResult = await generateTestScenarios(config.constitutionText, allAnnotations, config.allowedDirectory, config.protectedPaths, permittedDirectories, existingScenarios, llm);
+    // Write scenarios to disk immediately so they're available for
+    // inspection even if verification fails, and cached for next run.
+    writeScenariosArtifact(config.generatedDir, config.constitutionHash, scenarioResult);
+    // Filter out scenarios that conflict with structural invariants
+    const filterEngine = new PolicyEngine(compiledPolicyFile, toolAnnotationsFile, config.protectedPaths, config.allowedDirectory);
+    const { valid: initialValid, discarded: discardedScenarios } = filterAndLogStructuralConflicts(filterEngine, scenarioResult.scenarios, 'Discarded scenario (structural conflict)');
+    let filteredScenarios = initialValid;
+    // Verify compiled policy against scenarios (full depth)
+    logContext.stepName = 'verify-policy';
+    const { result: verificationResultInitial } = await withSpinner('[3/3] Verifying policy', async (spinner) => {
+        return await verifyCompiledPolicy(config.constitutionText, compiledPolicyFile, toolAnnotationsFile, config.protectedPaths, filteredScenarios, llm, config.allowedDirectory, 3, true, (msg) => { spinner.text = `[3/3] Verifying policy — ${msg}`; });
+    }, (r, elapsed) => r.pass
+        ? `[3/3] Verified policy: ${r.rounds.length} round(s) (${elapsed.toFixed(1)}s)`
+        : `[3/3] Verification completed with failures (${elapsed.toFixed(1)}s)`);
+    let verificationResult = verificationResultInitial;
+    // Collect probe scenarios from verifier across all attempts, filtering
+    // out any that conflict with structural invariants
+    const { valid: filteredInitialProbes } = filterAndLogStructuralConflicts(filterEngine, collectProbeScenarios(verificationResult), 'Discarded probe (structural conflict)');
+    const accumulatedProbes = filteredInitialProbes;
+    // Dual-channel compile-verify-repair loop (up to 2 repair attempts)
+    // The judge attributes each failure to 'rule', 'scenario', or 'both':
+    //   - scenario-blamed: patch the test expectation
+    //   - rule-blamed: recompile rules with failure feedback
+    //   - both: patch scenario AND recompile
+    const MAX_REPAIRS = 2;
+    let repairAttempts = 0;
+    let scenarioCorrectionsApplied = 0;
+    if (!verificationResult.pass) {
+        const baseInputHash = compilationResult.inputHash;
+        for (let attempt = 1; attempt <= MAX_REPAIRS; attempt++) {
+            console.error('');
+            // Gather judge analysis and attributions from the most recent verification
+            const lastRound = verificationResult.rounds[verificationResult.rounds.length - 1];
+            const judgeAnalysis = lastRound?.llmAnalysis ?? verificationResult.summary;
+            const attributedFailures = lastRound?.attributedFailures ?? [];
+            // Split failures into scenario corrections and rule-blamed failures
+            const allScenarios = [...scenarioResult.scenarios, ...accumulatedProbes];
+            const { corrections, handwrittenWarnings } = extractScenarioCorrections(attributedFailures, allScenarios);
+            for (const warning of handwrittenWarnings) {
+                console.error(`  ${chalk.yellow('Warning:')} ${warning}`);
+            }
+            // Apply scenario corrections (patch expectations on generated scenarios)
+            if (corrections.length > 0) {
+                scenarioResult.scenarios = applyScenarioCorrections(scenarioResult.scenarios, corrections);
+                const correctedProbes = applyScenarioCorrections(accumulatedProbes, corrections);
+                accumulatedProbes.splice(0, accumulatedProbes.length, ...correctedProbes);
+                scenarioCorrectionsApplied += corrections.length;
+                console.error(`  ${chalk.dim(`Corrected ${corrections.length} scenario expectation(s)`)}`);
+                // Re-filter after corrections (a corrected expected decision might
+                // now match a structural invariant result, making it valid)
+                ({ valid: filteredScenarios } = filterAndLogStructuralConflicts(filterEngine, scenarioResult.scenarios));
+            }
+            // Determine which failures need rule recompilation:
+            // - no attribution or blamed on 'rule'/'both' (conservative default)
+            // - handwritten scenarios blamed on 'scenario' (reclassified as rule issues)
+            const allRuleBlamedFailures = verificationResult.failedScenarios.filter(f => {
+                const attr = attributedFailures.find(a => a.scenarioDescription === f.scenario.description);
+                if (!attr || attr.blame.kind === 'rule' || attr.blame.kind === 'both')
+                    return true;
+                return handwrittenWarnings.some(w => w.includes(f.scenario.description));
+            });
+            if (allRuleBlamedFailures.length > 0) {
+                // Recompile with failure feedback (always calls LLM, no cache)
+                const repairContext = {
+                    previousRules: compilationResult.rules,
+                    failedScenarios: allRuleBlamedFailures,
+                    judgeAnalysis,
+                    attemptNumber: attempt,
+                };
+                logContext.stepName = `repair-compile-${attempt}`;
+                const repairCompileText = `Repair ${attempt}/${MAX_REPAIRS}: Recompiling`;
+                const { result: repairCompileResult } = await withSpinner(repairCompileText, async (spinner) => {
+                    return await compilePolicyRulesWithRepair(config.constitutionText, allAnnotations, config.protectedPaths, baseInputHash, repairContext, llm, (msg) => { spinner.text = `${repairCompileText} — ${msg}`; });
+                }, (r, elapsed) => `Repair ${attempt}/${MAX_REPAIRS}: Recompiled ${r.rules.length} rules (${elapsed.toFixed(1)}s)`);
+                compilationResult = repairCompileResult;
+                // Write updated policy artifact
+                compiledPolicyFile = buildPolicyArtifact(config.constitutionHash, compilationResult);
+                writePolicyArtifact(config.generatedDir, compiledPolicyFile);
+            }
+            else {
+                console.error(`  ${chalk.dim('No rule-blamed failures — skipping recompilation')}`);
+            }
+            // Verify with reduced depth, using base scenarios + accumulated probes
+            logContext.stepName = `repair-verify-${attempt}`;
+            const repairScenarios = [...filteredScenarios, ...accumulatedProbes];
+            const repairVerifyText = `Repair ${attempt}/${MAX_REPAIRS}: Verifying`;
+            const { result: repairVerifyResult } = await withSpinner(repairVerifyText, async (spinner) => {
+                return await verifyCompiledPolicy(config.constitutionText, compiledPolicyFile, toolAnnotationsFile, config.protectedPaths, repairScenarios, llm, config.allowedDirectory, 1, false, (msg) => { spinner.text = `${repairVerifyText} — ${msg}`; });
+            }, (r, elapsed) => r.pass
+                ? `Repair ${attempt}/${MAX_REPAIRS}: Verified (${elapsed.toFixed(1)}s)`
+                : `Repair ${attempt}/${MAX_REPAIRS}: ${r.failedScenarios.length} failure(s) (${elapsed.toFixed(1)}s)`);
+            verificationResult = repairVerifyResult;
+            // Accumulate any new probe scenarios, filtering structural conflicts
+            const { valid: validRepairProbes } = filterAndLogStructuralConflicts(filterEngine, collectProbeScenarios(verificationResult), 'Discarded probe (structural conflict)');
+            accumulatedProbes.push(...validRepairProbes);
+            repairAttempts = attempt;
+            if (verificationResult.pass) {
+                // Run final full verification with all accumulated scenarios
+                logContext.stepName = 'final-verify';
+                const finalScenarios = [...filteredScenarios, ...accumulatedProbes];
+                const { result: finalVerifyResult } = await withSpinner('Final full verification', async (spinner) => {
+                    return await verifyCompiledPolicy(config.constitutionText, compiledPolicyFile, toolAnnotationsFile, config.protectedPaths, finalScenarios, llm, config.allowedDirectory, 3, true, (msg) => { spinner.text = `Final full verification — ${msg}`; });
+                }, (r, elapsed) => r.pass
+                    ? `Final full verification: passed (${elapsed.toFixed(1)}s)`
+                    : `Final full verification: ${r.failedScenarios.length} failure(s) (${elapsed.toFixed(1)}s)`);
+                verificationResult = finalVerifyResult;
+                // Accumulate any new probes from final verification, filtering structural conflicts
+                const { valid: validFinalProbes } = filterAndLogStructuralConflicts(filterEngine, collectProbeScenarios(verificationResult), 'Discarded probe (structural conflict)');
+                accumulatedProbes.push(...validFinalProbes);
+                break;
+            }
+        }
+    }
+    // Deduplicate accumulated probes by description
+    const seenDescriptions = new Set(scenarioResult.scenarios.map(s => s.description));
+    const uniqueProbes = accumulatedProbes.filter(s => {
+        if (seenDescriptions.has(s.description))
+            return false;
+        seenDescriptions.add(s.description);
+        return true;
+    });
+    const totalScenariosTested = filteredScenarios.length + uniqueProbes.length;
+    console.error('');
+    console.error(`  Rules: ${compilationResult.rules.length}`);
+    console.error(`  Scenarios tested: ${totalScenariosTested}`);
+    if (discardedScenarios.length > 0) {
+        console.error(`  Scenarios discarded (structural conflicts): ${discardedScenarios.length}`);
+    }
+    if (uniqueProbes.length > 0) {
+        console.error(`  Probe scenarios accumulated: ${uniqueProbes.length}`);
+    }
+    if (repairAttempts > 0) {
+        console.error(`  Repair attempts: ${repairAttempts}`);
+    }
+    if (scenarioCorrectionsApplied > 0) {
+        console.error(`  Scenario corrections: ${scenarioCorrectionsApplied}`);
+    }
+    console.error(`  Artifacts written to: ${chalk.dim(config.generatedDir + '/')}`);
+    console.error(`  LLM interaction log: ${chalk.dim(logPath)}`);
+    if (!verificationResult.pass) {
+        console.error('');
+        console.error(chalk.red.bold('Verification FAILED — artifacts written but policy may need review.'));
+        process.exit(1);
+    }
+    console.error('');
+    console.error(chalk.green.bold('Policy compilation successful!'));
+}
+// Only run when executed directly (not when imported by cli.ts or tests)
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    await import('dotenv/config');
+    main().catch((err) => {
+        console.error(chalk.red.bold('Policy compilation failed:'), err);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=compile.js.map

package/dist/pipeline/compile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile.js","sourceRoot":"","sources":["../../src/pipeline/compile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,YAAY,GAEb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAYlF,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,SAAS,iBAAiB,CACxB,gBAAwB,EACxB,cAAgC,EAChC,cAAwB;IAExB,MAAM,MAAM,GAAG,mBAAmB,CAAC,gBAAgB,EAAE,cAAc,EAAE;QACnE,cAAc;KACf,CAAC,CAAC;IACH,OAAO,WAAW,CAChB,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAC9B,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,gBAAwB,EACxB,WAA6B,EAC7B,oBAAoC,EACpC,gBAAwB,EACxB,cAAwB,EACxB,oBAA8B;IAE9B,MAAM,MAAM,GAAG,oBAAoB,CACjC,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,oBAAoB,CACrB,CAAC;IACF,OAAO,WAAW,CAChB,MAAM,EACN,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC3B,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAC9B,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAqB;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA0B;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,SAAS,+BAA+B,CACtC,MAAoB,EACpB,SAAyB,EACzB,QAAgB,0CAA0C;IAE1D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,aAAa;YAChD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,oEAAoE,CAAC;YACpF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,OAAO,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC;QAExC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEnD,OAAO;YACL,GAAG,IAAI;YACP,EAAE,EAAE;gBACF,GAAG,IAAI,CAAC,EAAE;gBACV,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;aAC9C;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAWD,KAAK,UAAU,kBAAkB,CAC/B,gBAAwB,EACxB,WAA6B,EAC7B,cAAwB,EACxB,cAA8C,EAC9C,GAAkB;IAElB,MAAM,SAAS,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,8BAA8B,CAAC;IAEhD,wDAAwD;IACxD,sEAAsE;IACtE,IAAI,cAAc,IAAI,cAAc,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7D,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,WAAW,CACjD,QAAQ,EACR,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,mBAAmB,CACtD,gBAAgB,EAChB,WAAW,EACX,EAAE,cAAc,EAAE,EAClB,GAAG,EACH,SAAS,EACT,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CACpD,CAAC,CAAC;QACH,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC,EACD,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CACjB,GAAG,QAAQ,KAAK,KAAK,CAAC,MAAM,oBAAoB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACzE,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,mBAAoB,SAAQ,KAAK;IACT;IAA5B,YAA4B,MAAgB;QAC1C,KAAK,CAAC,iCAAiC,CAAC,CAAC;QADf,WAAM,GAAN,MAAM,CAAU;QAE1C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,KAAqB;IACjD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;YACxC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,mBAAmB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,gBAAwB,EACxB,WAA6B,EAC7B,cAAwB,EACxB,aAAqB,EACrB,aAA4B,EAC5B,GAAkB,EAClB,UAAsC;IAEtC,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,mBAAmB,CAC9D,gBAAgB,EAChB,WAAW,EACX,EAAE,cAAc,EAAE,EAClB,GAAG,EACH,aAAa,EACb,UAAU,CACX,CAAC,CAAC;IACH,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAEpC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,aAAa,SAAS,EAAE,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,SAAS,mBAAmB,CAC1B,gBAAwB,EACxB,iBAAoC;IAEpC,OAAO;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,gBAAgB;QAChB,SAAS,EAAE,iBAAiB,CAAC,SAAS;QACtC,KAAK,EAAE,iBAAiB,CAAC,KAAK;KAC/B,CAAC;AACJ,CAAC;AAWD,KAAK,UAAU,qBAAqB,CAClC,gBAAwB,EACxB,WAA6B,EAC7B,gBAAwB,EACxB,cAAwB,EACxB,oBAA8B,EAC9B,iBAAgD,EAChD,GAAkB;IAElB,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,oBAAoB,CACpC,gBAAgB,EAChB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,oBAAoB,CACrB,CAAC;IAEF,MAAM,QAAQ,GAAG,iCAAiC,CAAC;IAEnD,uDAAuD;IACvD,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,EAAE,SAAS,EAAE,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAC7C,QAAQ,EACR,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,OAAO,MAAM,iBAAiB,CAC5B,gBAAgB,EAChB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,GAAG,EACH,oBAAoB,EACpB,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CACpD,CAAC;IACJ,CAAC,EACD,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE;QACrB,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC;QACtE,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC,MAAM,eAAe,oBAAoB,CAAC,MAAM,kBAAkB,cAAc,gBAAgB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1J,CAAC,CACF,CAAC;IAEF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,KAAK,UAAU,oBAAoB,CACjC,gBAAwB,EACxB,kBAAsC,EACtC,mBAAwC,EACxC,cAAwB,EACxB,SAAyB,EACzB,GAAkB,EAClB,gBAAyB,EACzB,YAAoB,CAAC,EACrB,UAAmB,IAAI,EACvB,UAAsC;IAEtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,SAAS,EACT,GAAG,EACH,SAAS,EACT,gBAAgB,EAChB,UAAU,CACX,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBACvC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;gBACnE,OAAO,CAAC,KAAK,CACX,iBAAiB,CAAC,CAAC,QAAQ,CAAC,gBAAgB,UAAU,CAAC,CAAC,cAAc,WAAW,CAAC,CAAC,YAAY,GAAG,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,eAAe,CAAC,MAAM,sBAAsB,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,YAAoB,EACpB,gBAAwB,EACxB,cAA8B;IAE9B,MAAM,aAAa,GAAsB;QACvC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,gBAAgB;QAChB,SAAS,EAAE,cAAc,CAAC,SAAS;QACnC,SAAS,EAAE,cAAc,CAAC,SAAS;KACpC,CAAC;IACF,aAAa,CAAC,YAAY,EAAE,qBAAqB,EAAE,aAAa,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,mBAAmB,CAC1B,YAAoB,EACpB,kBAAsC;IAEtC,aAAa,CAAC,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,yEAAyE;IACzE,MAAM,mBAAmB,GAAG,oBAAoB,CAC9C,MAAM,CAAC,YAAY,EAAE,uBAAuB,EAAE,MAAM,CAAC,mBAAmB,CACzE,CAAC;IACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAC1B,0GAA0G,CAC3G,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,uCAAuC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC;SAC9D,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,MAAM,eAAe,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;IAChJ,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CACjE,MAAM,CAAC,YAAY,EAAE,SAAS,CAC/B,CAAC;IAEF,+CAA+C;IAC/C,MAAM,cAAc,GAAG,oBAAoB,CAAqB,MAAM,CAAC,YAAY,EAAE,sBAAsB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzI,MAAM,iBAAiB,GAAG,oBAAoB,CAAoB,MAAM,CAAC,YAAY,EAAE,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE1I,yDAAyD;IACzD,UAAU,CAAC,QAAQ,GAAG,sBAAsB,CAAC;IAC7C,IAAI,iBAAiB,GAAG,MAAM,kBAAkB,CAC9C,MAAM,CAAC,gBAAgB,EACvB,cAAc,EACd,MAAM,CAAC,cAAc,EACrB,cAAc,EACd,GAAG,CACJ,CAAC;IAEF,oEAAoE;IACpE,kEAAkE;IAClE,IAAI,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IACzF,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IAE7D,4EAA4E;IAC5E,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAElF,0CAA0C;IAC1C,UAAU,CAAC,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAChD,MAAM,CAAC,gBAAgB,EACvB,cAAc,EACd,MAAM,CAAC,gBAAgB,EACvB,MAAM,CAAC,cAAc,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,GAAG,CACJ,CAAC;IAEF,+DAA+D;IAC/D,kEAAkE;IAClE,sBAAsB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAErF,gEAAgE;IAChE,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/H,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,+BAA+B,CAC5F,YAAY,EAAE,cAAc,CAAC,SAAS,EAAE,0CAA0C,CACnF,CAAC;IACF,IAAI,iBAAiB,GAAG,YAAY,CAAC;IAErC,wDAAwD;IACxD,UAAU,CAAC,QAAQ,GAAG,eAAe,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,WAAW,CAC7D,wBAAwB,EACxB,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,OAAO,MAAM,oBAAoB,CAC/B,MAAM,CAAC,gBAAgB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,MAAM,CAAC,cAAc,EACrB,iBAAiB,EACjB,GAAG,EACH,MAAM,CAAC,gBAAgB,EACvB,CAAC,EACD,IAAI,EACJ,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,4BAA4B,GAAG,EAAE,CAAC,CAAC,CAAC,CAC/D,CAAC;IACJ,CAAC,EACD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;QACpB,CAAC,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,MAAM,cAAc,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC/E,CAAC,CAAC,+CAA+C,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC1E,CAAC;IACF,IAAI,kBAAkB,GAAG,yBAAyB,CAAC;IAEnD,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,EAAE,KAAK,EAAE,qBAAqB,EAAE,GAAG,+BAA+B,CACtE,YAAY,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,EAAE,uCAAuC,CACjG,CAAC;IACF,MAAM,iBAAiB,GAAmB,qBAAqB,CAAC;IAEhE,oEAAoE;IACpE,sEAAsE;IACtE,kDAAkD;IAClD,yDAAyD;IACzD,yCAAyC;IACzC,MAAM,WAAW,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,0BAA0B,GAAG,CAAC,CAAC;IAEnC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,iBAAiB,CAAC,SAAS,CAAC;QAElD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAElB,2EAA2E;YAC3E,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAClF,MAAM,aAAa,GAAG,SAAS,EAAE,WAAW,IAAI,kBAAkB,CAAC,OAAO,CAAC;YAC3E,MAAM,kBAAkB,GAAG,SAAS,EAAE,kBAAkB,IAAI,EAAE,CAAC;YAE/D,oEAAoE;YACpE,MAAM,YAAY,GAAG,CAAC,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,iBAAiB,CAAC,CAAC;YACzE,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,0BAA0B,CACrE,kBAAkB,EAClB,YAAY,CACb,CAAC;YAEF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC1C,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,yEAAyE;YACzE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,cAAc,CAAC,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC3F,MAAM,eAAe,GAAG,wBAAwB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBACjF,iBAAiB,CAAC,MAAM,CAAC,CAAC,EAAE,iBAAiB,CAAC,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC;gBAC1E,0BAA0B,IAAI,WAAW,CAAC,MAAM,CAAC;gBACjD,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,aAAa,WAAW,CAAC,MAAM,0BAA0B,CAAC,EAAE,CAAC,CAAC;gBAE3F,mEAAmE;gBACnE,4DAA4D;gBAC5D,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,+BAA+B,CAAC,YAAY,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;YAC3G,CAAC;YAED,oDAAoD;YACpD,qEAAqE;YACrE,6EAA6E;YAC7E,MAAM,qBAAqB,GAAG,kBAAkB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBAC1E,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC5F,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC;gBACnF,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3E,CAAC,CAAC,CAAC;YAEH,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,+DAA+D;gBAC/D,MAAM,aAAa,GAAkB;oBACnC,aAAa,EAAE,iBAAiB,CAAC,KAAK;oBACtC,eAAe,EAAE,qBAAqB;oBACtC,aAAa;oBACb,aAAa,EAAE,OAAO;iBACvB,CAAC;gBAEF,UAAU,CAAC,QAAQ,GAAG,kBAAkB,OAAO,EAAE,CAAC;gBAClD,MAAM,iBAAiB,GAAG,UAAU,OAAO,IAAI,WAAW,eAAe,CAAC;gBAC1E,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,WAAW,CACvD,iBAAiB,EACjB,KAAK,EAAE,OAAO,EAAE,EAAE;oBAChB,OAAO,MAAM,4BAA4B,CACvC,MAAM,CAAC,gBAAgB,EACvB,cAAc,EACd,MAAM,CAAC,cAAc,EACrB,aAAa,EACb,aAAa,EACb,GAAG,EACH,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,GAAG,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAC7D,CAAC;gBACJ,CAAC,EACD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CACb,UAAU,OAAO,IAAI,WAAW,gBAAgB,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAClG,CAAC;gBACF,iBAAiB,GAAG,mBAAmB,CAAC;gBAExC,gCAAgC;gBAChC,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;gBACrF,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YAED,uEAAuE;YACvE,UAAU,CAAC,QAAQ,GAAG,iBAAiB,OAAO,EAAE,CAAC;YACjD,MAAM,eAAe,GAAG,CAAC,GAAG,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,CAAC;YACrE,MAAM,gBAAgB,GAAG,UAAU,OAAO,IAAI,WAAW,aAAa,CAAC;YACvE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,WAAW,CACtD,gBAAgB,EAChB,KAAK,EAAE,OAAO,EAAE,EAAE;gBAChB,OAAO,MAAM,oBAAoB,CAC/B,MAAM,CAAC,gBAAgB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,MAAM,CAAC,cAAc,EACrB,eAAe,EACf,GAAG,EACH,MAAM,CAAC,gBAAgB,EACvB,CAAC,EACD,KAAK,EACL,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,GAAG,gBAAgB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAC5D,CAAC;YACJ,CAAC,EACD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;gBACpB,CAAC,CAAC,UAAU,OAAO,IAAI,WAAW,eAAe,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;gBACvE,CAAC,CAAC,UAAU,OAAO,IAAI,WAAW,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,gBAAgB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACxG,CAAC;YACF,kBAAkB,GAAG,kBAAkB,CAAC;YAExC,qEAAqE;YACrE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,+BAA+B,CAClE,YAAY,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,EAAE,uCAAuC,CACjG,CAAC;YACF,iBAAiB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC;YAE7C,cAAc,GAAG,OAAO,CAAC;YAEzB,IAAI,kBAAkB,CAAC,IAAI,EAAE,CAAC;gBAC5B,6DAA6D;gBAC7D,UAAU,CAAC,QAAQ,GAAG,cAAc,CAAC;gBACrC,MAAM,cAAc,GAAG,CAAC,GAAG,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,CAAC;gBACpE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,WAAW,CACrD,yBAAyB,EACzB,KAAK,EAAE,OAAO,EAAE,EAAE;oBAChB,OAAO,MAAM,oBAAoB,CAC/B,MAAM,CAAC,gBAAgB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,MAAM,CAAC,cAAc,EACrB,cAAc,EACd,GAAG,EACH,MAAM,CAAC,gBAAgB,EACvB,CAAC,EACD,IAAI,EACJ,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,6BAA6B,GAAG,EAAE,CAAC,CAAC,CAAC,CAChE,CAAC;gBACJ,CAAC,EACD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;oBACpB,CAAC,CAAC,oCAAoC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;oBAC5D,CAAC,CAAC,4BAA4B,CAAC,CAAC,eAAe,CAAC,MAAM,gBAAgB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC/F,CAAC;gBACF,kBAAkB,GAAG,iBAAiB,CAAC;gBAEvC,oFAAoF;gBACpF,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,+BAA+B,CACjE,YAAY,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,EAAE,uCAAuC,CACjG,CAAC;gBACF,iBAAiB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;gBAC5C,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAChD,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAE5E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,YAAY,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,KAAK,CAAC,uBAAuB,oBAAoB,EAAE,CAAC,CAAC;IAC7D,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,iDAAiD,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,kCAAkC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,0BAA0B,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,2BAA2B,0BAA0B,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,2BAA2B,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAE9D,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC,CAAC;QACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,yEAAyE;AACzE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/pipeline/constitution-compiler.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Constitution Compiler -- LLM-driven compilation of English-language
+ * constitution principles into enforceable declarative policy rules.
+ *
+ * The compiler takes the constitution text, tool annotations, and system
+ * config (concrete directory paths) and produces an ordered rule chain
+ * that faithfully implements the non-structural principles.
+ */
+import type { LanguageModel } from 'ai';
+import type { ToolAnnotation, CompiledRule, RepairContext } from './types.js';
+export interface CompilerConfig {
+    protectedPaths: string[];
+}
+export declare function buildCompilerPrompt(constitutionText: string, annotations: ToolAnnotation[], config: CompilerConfig): string;
+export declare function buildRepairPrompt(basePrompt: string, repairContext: RepairContext): string;
+export declare function compileConstitution(constitutionText: string, annotations: ToolAnnotation[], config: CompilerConfig, llm: LanguageModel, repairContext?: RepairContext, onProgress?: (message: string) => void): Promise<CompiledRule[]>;
+export interface RuleValidationResult {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+}
+export declare function validateCompiledRules(rules: CompiledRule[]): RuleValidationResult;