@provos/ironcurtain 0.7.2 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (259) hide show
  1. package/README.md +29 -100
  2. package/dist/auth/auth-command.d.ts +15 -0
  3. package/dist/auth/auth-command.js +424 -0
  4. package/dist/auth/auth-command.js.map +1 -0
  5. package/dist/auth/oauth-flow.d.ts +46 -0
  6. package/dist/auth/oauth-flow.js +279 -0
  7. package/dist/auth/oauth-flow.js.map +1 -0
  8. package/dist/auth/oauth-provider.d.ts +55 -0
  9. package/dist/auth/oauth-provider.js +73 -0
  10. package/dist/auth/oauth-provider.js.map +1 -0
  11. package/dist/auth/oauth-registry.d.ts +34 -0
  12. package/dist/auth/oauth-registry.js +69 -0
  13. package/dist/auth/oauth-registry.js.map +1 -0
  14. package/dist/auth/oauth-token-provider.d.ts +52 -0
  15. package/dist/auth/oauth-token-provider.js +159 -0
  16. package/dist/auth/oauth-token-provider.js.map +1 -0
  17. package/dist/auth/oauth-token-store.d.ts +30 -0
  18. package/dist/auth/oauth-token-store.js +93 -0
  19. package/dist/auth/oauth-token-store.js.map +1 -0
  20. package/dist/auth/providers/google-scopes.d.ts +35 -0
  21. package/dist/auth/providers/google-scopes.js +183 -0
  22. package/dist/auth/providers/google-scopes.js.map +1 -0
  23. package/dist/auth/providers/google.d.ts +2 -0
  24. package/dist/auth/providers/google.js +28 -0
  25. package/dist/auth/providers/google.js.map +1 -0
  26. package/dist/cli.js +6 -0
  27. package/dist/cli.js.map +1 -1
  28. package/dist/config/config-command.js +39 -1
  29. package/dist/config/config-command.js.map +1 -1
  30. package/dist/config/constitution-readonly.md +14 -11
  31. package/dist/config/constitution-user-base.md +15 -0
  32. package/dist/config/first-start.js +4 -1
  33. package/dist/config/first-start.js.map +1 -1
  34. package/dist/config/generated/test-scenarios.json +1 -1
  35. package/dist/config/generated/tool-annotations.json +10617 -296
  36. package/dist/config/generated-readonly/compiled-policy.json +787 -244
  37. package/dist/config/index.d.ts +2 -2
  38. package/dist/config/index.js +8 -0
  39. package/dist/config/index.js.map +1 -1
  40. package/dist/config/mcp-servers.json +31 -2
  41. package/dist/config/paths.d.ts +20 -0
  42. package/dist/config/paths.js +43 -0
  43. package/dist/config/paths.js.map +1 -1
  44. package/dist/config/types.d.ts +8 -0
  45. package/dist/config/user-config.d.ts +29 -0
  46. package/dist/config/user-config.js +30 -0
  47. package/dist/config/user-config.js.map +1 -1
  48. package/dist/cron/constitution-generator.d.ts +2 -1
  49. package/dist/cron/constitution-generator.js +35 -36
  50. package/dist/cron/constitution-generator.js.map +1 -1
  51. package/dist/cron/headless-transport.d.ts +4 -0
  52. package/dist/cron/headless-transport.js +1 -1
  53. package/dist/cron/headless-transport.js.map +1 -1
  54. package/dist/daemon/ironcurtain-daemon.js +7 -1
  55. package/dist/daemon/ironcurtain-daemon.js.map +1 -1
  56. package/dist/docker/adapters/claude-code.js +32 -5
  57. package/dist/docker/adapters/claude-code.js.map +1 -1
  58. package/dist/docker/agent-adapter.d.ts +40 -0
  59. package/dist/docker/claude-md-seed.d.ts +27 -0
  60. package/dist/docker/claude-md-seed.js +42 -0
  61. package/dist/docker/claude-md-seed.js.map +1 -0
  62. package/dist/docker/docker-agent-session.d.ts +3 -1
  63. package/dist/docker/docker-agent-session.js +51 -28
  64. package/dist/docker/docker-agent-session.js.map +1 -1
  65. package/dist/docker/docker-infrastructure.d.ts +15 -1
  66. package/dist/docker/docker-infrastructure.js +105 -9
  67. package/dist/docker/docker-infrastructure.js.map +1 -1
  68. package/dist/docker/docker-manager.d.ts +2 -0
  69. package/dist/docker/docker-manager.js +9 -1
  70. package/dist/docker/docker-manager.js.map +1 -1
  71. package/dist/docker/mitm-proxy.d.ts +65 -0
  72. package/dist/docker/mitm-proxy.js +288 -31
  73. package/dist/docker/mitm-proxy.js.map +1 -1
  74. package/dist/docker/package-types.d.ts +127 -0
  75. package/dist/docker/package-types.js +8 -0
  76. package/dist/docker/package-types.js.map +1 -0
  77. package/dist/docker/package-validator.d.ts +41 -0
  78. package/dist/docker/package-validator.js +90 -0
  79. package/dist/docker/package-validator.js.map +1 -0
  80. package/dist/docker/platform.d.ts +6 -6
  81. package/dist/docker/platform.js +8 -6
  82. package/dist/docker/platform.js.map +1 -1
  83. package/dist/docker/proxy-tools.d.ts +80 -0
  84. package/dist/docker/proxy-tools.js +248 -0
  85. package/dist/docker/proxy-tools.js.map +1 -0
  86. package/dist/docker/pty-session.d.ts +15 -0
  87. package/dist/docker/pty-session.js +253 -73
  88. package/dist/docker/pty-session.js.map +1 -1
  89. package/dist/docker/pty-types.d.ts +28 -0
  90. package/dist/docker/pty-types.js +2 -0
  91. package/dist/docker/pty-types.js.map +1 -1
  92. package/dist/docker/registry-proxy.d.ts +142 -0
  93. package/dist/docker/registry-proxy.js +856 -0
  94. package/dist/docker/registry-proxy.js.map +1 -0
  95. package/dist/escalation/escalation-watcher.d.ts +3 -1
  96. package/dist/escalation/escalation-watcher.js +6 -2
  97. package/dist/escalation/escalation-watcher.js.map +1 -1
  98. package/dist/escalation/listener-command.js +24 -10
  99. package/dist/escalation/listener-command.js.map +1 -1
  100. package/dist/escalation/listener-lock.d.ts +5 -0
  101. package/dist/escalation/listener-lock.js +14 -0
  102. package/dist/escalation/listener-lock.js.map +1 -1
  103. package/dist/index.js +16 -3
  104. package/dist/index.js.map +1 -1
  105. package/dist/memory/auto-save.d.ts +25 -0
  106. package/dist/memory/auto-save.js +89 -0
  107. package/dist/memory/auto-save.js.map +1 -0
  108. package/dist/memory/memory-annotations.d.ts +47 -0
  109. package/dist/memory/memory-annotations.js +87 -0
  110. package/dist/memory/memory-annotations.js.map +1 -0
  111. package/dist/memory/memory-prompt.d.ts +12 -0
  112. package/dist/memory/memory-prompt.js +20 -0
  113. package/dist/memory/memory-prompt.js.map +1 -0
  114. package/dist/memory/resolve-memory-path.d.ts +20 -0
  115. package/dist/memory/resolve-memory-path.js +30 -0
  116. package/dist/memory/resolve-memory-path.js.map +1 -0
  117. package/dist/mux/mux-app.d.ts +4 -0
  118. package/dist/mux/mux-app.js +246 -28
  119. package/dist/mux/mux-app.js.map +1 -1
  120. package/dist/mux/mux-command.d.ts +2 -2
  121. package/dist/mux/mux-command.js +14 -22
  122. package/dist/mux/mux-command.js.map +1 -1
  123. package/dist/mux/mux-escalation-manager.d.ts +9 -3
  124. package/dist/mux/mux-escalation-manager.js +69 -19
  125. package/dist/mux/mux-escalation-manager.js.map +1 -1
  126. package/dist/mux/mux-input-handler.d.ts +59 -3
  127. package/dist/mux/mux-input-handler.js +270 -32
  128. package/dist/mux/mux-input-handler.js.map +1 -1
  129. package/dist/mux/mux-renderer.d.ts +19 -1
  130. package/dist/mux/mux-renderer.js +466 -11
  131. package/dist/mux/mux-renderer.js.map +1 -1
  132. package/dist/mux/persona-scanner.d.ts +19 -0
  133. package/dist/mux/persona-scanner.js +53 -0
  134. package/dist/mux/persona-scanner.js.map +1 -0
  135. package/dist/mux/pty-bridge.d.ts +8 -0
  136. package/dist/mux/pty-bridge.js +19 -1
  137. package/dist/mux/pty-bridge.js.map +1 -1
  138. package/dist/mux/session-scanner.d.ts +18 -0
  139. package/dist/mux/session-scanner.js +65 -0
  140. package/dist/mux/session-scanner.js.map +1 -0
  141. package/dist/mux/types.d.ts +36 -1
  142. package/dist/mux/types.js +14 -1
  143. package/dist/mux/types.js.map +1 -1
  144. package/dist/persona/persona-command.js +130 -93
  145. package/dist/persona/persona-command.js.map +1 -1
  146. package/dist/persona/persona-prompt.d.ts +7 -7
  147. package/dist/persona/persona-prompt.js +14 -29
  148. package/dist/persona/persona-prompt.js.map +1 -1
  149. package/dist/persona/resolve.js +5 -2
  150. package/dist/persona/resolve.js.map +1 -1
  151. package/dist/pipeline/annotate.js +1 -7
  152. package/dist/pipeline/annotate.js.map +1 -1
  153. package/dist/pipeline/compile.d.ts +5 -2
  154. package/dist/pipeline/compile.js +23 -11
  155. package/dist/pipeline/compile.js.map +1 -1
  156. package/dist/pipeline/constitution-compiler.d.ts +302 -3
  157. package/dist/pipeline/constitution-compiler.js +285 -23
  158. package/dist/pipeline/constitution-compiler.js.map +1 -1
  159. package/dist/pipeline/generate-with-repair.d.ts +2 -2
  160. package/dist/pipeline/generate-with-repair.js +2 -2
  161. package/dist/pipeline/handwritten-scenarios.d.ts +20 -7
  162. package/dist/pipeline/handwritten-scenarios.js +20 -41
  163. package/dist/pipeline/handwritten-scenarios.js.map +1 -1
  164. package/dist/pipeline/list-resolver.d.ts +18 -20
  165. package/dist/pipeline/list-resolver.js +28 -36
  166. package/dist/pipeline/list-resolver.js.map +1 -1
  167. package/dist/pipeline/pipeline-runner.d.ts +102 -13
  168. package/dist/pipeline/pipeline-runner.js +497 -237
  169. package/dist/pipeline/pipeline-runner.js.map +1 -1
  170. package/dist/pipeline/pipeline-shared.d.ts +7 -9
  171. package/dist/pipeline/pipeline-shared.js +8 -18
  172. package/dist/pipeline/pipeline-shared.js.map +1 -1
  173. package/dist/pipeline/policy-verifier.d.ts +32 -5
  174. package/dist/pipeline/policy-verifier.js +137 -8
  175. package/dist/pipeline/policy-verifier.js.map +1 -1
  176. package/dist/pipeline/proxy-mcp-connections.d.ts +25 -0
  177. package/dist/pipeline/proxy-mcp-connections.js +121 -0
  178. package/dist/pipeline/proxy-mcp-connections.js.map +1 -0
  179. package/dist/pipeline/refresh-lists.js +21 -13
  180. package/dist/pipeline/refresh-lists.js.map +1 -1
  181. package/dist/pipeline/scenario-generator.d.ts +29 -49
  182. package/dist/pipeline/scenario-generator.js +180 -143
  183. package/dist/pipeline/scenario-generator.js.map +1 -1
  184. package/dist/pipeline/scenario-schema-validator.d.ts +51 -0
  185. package/dist/pipeline/scenario-schema-validator.js +132 -0
  186. package/dist/pipeline/scenario-schema-validator.js.map +1 -0
  187. package/dist/pipeline/tool-annotator.d.ts +9 -8
  188. package/dist/pipeline/tool-annotator.js +48 -95
  189. package/dist/pipeline/tool-annotator.js.map +1 -1
  190. package/dist/pipeline/types.d.ts +31 -24
  191. package/dist/sandbox/index.d.ts +26 -10
  192. package/dist/sandbox/index.js +151 -40
  193. package/dist/sandbox/index.js.map +1 -1
  194. package/dist/servers/fetch-server.js +10 -5
  195. package/dist/servers/fetch-server.js.map +1 -1
  196. package/dist/session/agent-session.d.ts +8 -20
  197. package/dist/session/agent-session.js +22 -70
  198. package/dist/session/agent-session.js.map +1 -1
  199. package/dist/session/base-transport.d.ts +17 -1
  200. package/dist/session/base-transport.js +25 -1
  201. package/dist/session/base-transport.js.map +1 -1
  202. package/dist/session/cli-transport.d.ts +5 -0
  203. package/dist/session/cli-transport.js +48 -25
  204. package/dist/session/cli-transport.js.map +1 -1
  205. package/dist/session/index.d.ts +25 -1
  206. package/dist/session/index.js +57 -8
  207. package/dist/session/index.js.map +1 -1
  208. package/dist/session/prompts.js +8 -9
  209. package/dist/session/prompts.js.map +1 -1
  210. package/dist/session/session-manager.d.ts +6 -0
  211. package/dist/session/session-manager.js +12 -0
  212. package/dist/session/session-manager.js.map +1 -1
  213. package/dist/session/types.d.ts +11 -1
  214. package/dist/session/types.js.map +1 -1
  215. package/dist/session/workspace-validation.js +37 -6
  216. package/dist/session/workspace-validation.js.map +1 -1
  217. package/dist/signal/signal-bot-daemon.js +24 -8
  218. package/dist/signal/signal-bot-daemon.js.map +1 -1
  219. package/dist/signal/signal-transport.d.ts +5 -2
  220. package/dist/signal/signal-transport.js +3 -3
  221. package/dist/signal/signal-transport.js.map +1 -1
  222. package/dist/trusted-process/approval-whitelist.d.ts +117 -0
  223. package/dist/trusted-process/approval-whitelist.js +237 -0
  224. package/dist/trusted-process/approval-whitelist.js.map +1 -0
  225. package/dist/trusted-process/gworkspace-credentials.d.ts +40 -0
  226. package/dist/trusted-process/gworkspace-credentials.js +45 -0
  227. package/dist/trusted-process/gworkspace-credentials.js.map +1 -0
  228. package/dist/trusted-process/index.d.ts +11 -1
  229. package/dist/trusted-process/index.js +83 -53
  230. package/dist/trusted-process/index.js.map +1 -1
  231. package/dist/trusted-process/mcp-proxy-server.d.ts +23 -0
  232. package/dist/trusted-process/mcp-proxy-server.js +409 -94
  233. package/dist/trusted-process/mcp-proxy-server.js.map +1 -1
  234. package/dist/trusted-process/policy-engine.d.ts +12 -3
  235. package/dist/trusted-process/policy-engine.js +33 -23
  236. package/dist/trusted-process/policy-engine.js.map +1 -1
  237. package/dist/trusted-process/policy-types.d.ts +17 -0
  238. package/dist/trusted-process/sandbox-integration.d.ts +23 -0
  239. package/dist/trusted-process/sandbox-integration.js +115 -3
  240. package/dist/trusted-process/sandbox-integration.js.map +1 -1
  241. package/dist/trusted-process/token-file-refresher.d.ts +69 -0
  242. package/dist/trusted-process/token-file-refresher.js +120 -0
  243. package/dist/trusted-process/token-file-refresher.js.map +1 -0
  244. package/dist/types/argument-roles.d.ts +7 -1
  245. package/dist/types/argument-roles.js +50 -0
  246. package/dist/types/argument-roles.js.map +1 -1
  247. package/dist/types/audit.d.ts +11 -0
  248. package/docker/Dockerfile.base +22 -0
  249. package/docker/Dockerfile.base.arm64 +44 -4
  250. package/docker/Dockerfile.claude-code +2 -2
  251. package/docker/entrypoint-claude-code.sh +24 -6
  252. package/package.json +8 -2
  253. package/src/config/constitution-user-base.md +15 -0
  254. package/src/config/generated/test-scenarios.json +1 -1
  255. package/src/config/generated/tool-annotations.json +10617 -296
  256. package/src/config/mcp-servers.json +31 -2
  257. package/dist/pipeline/mcp-connections.d.ts +0 -16
  258. package/dist/pipeline/mcp-connections.js +0 -61
  259. package/dist/pipeline/mcp-connections.js.map +0 -1
@@ -32,33 +32,55 @@ const listDefinitionSchema = z.object({
32
32
  requiresMcp: z.boolean(),
33
33
  mcpServerHint: z.string().optional(),
34
34
  });
35
- function buildCompilerResponseSchema(serverNames, toolNames) {
36
- const compiledRuleSchema = z.object({
35
+ /**
36
+ * Builds the Zod schema for a single compiled rule. Shared by both the
37
+ * full compilation schema and the patch response schema to avoid duplication.
38
+ */
39
+ function buildCompiledRuleSchema(serverNames, toolNames, options) {
40
+ const serverField = z.array(z.enum(serverNames));
41
+ return z.object({
37
42
  name: z.string(),
38
43
  description: z.string(),
39
44
  principle: z.string(),
40
45
  if: z
41
46
  .object({
42
47
  roles: z.array(z.enum(getArgumentRoleValues())).optional(),
43
- server: z.array(z.enum(serverNames)).optional(),
48
+ server: options?.requireServer ? serverField.length(1) : serverField.optional(),
44
49
  tool: z.array(z.enum(toolNames)).optional(),
45
- sideEffects: z.boolean().optional(),
46
50
  paths: pathConditionSchema.optional(),
47
51
  domains: domainConditionSchema.optional(),
48
52
  lists: z.array(listConditionSchema).optional(),
49
53
  })
50
- // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- runtime check: all fields are optional, Object.values may be all undefined
51
54
  .refine((cond) => Object.values(cond).some((v) => v !== undefined), {
52
55
  message: 'Rule condition must have at least one field — catch-all rules are not allowed',
53
56
  }),
54
57
  then: z.enum(['allow', 'escalate']),
55
58
  reason: z.string(),
56
59
  });
60
+ }
61
+ function buildCompilerResponseSchema(serverNames, toolNames, options) {
62
+ const compiledRuleSchema = buildCompiledRuleSchema(serverNames, toolNames, options);
57
63
  return z.object({
58
64
  rules: z.array(compiledRuleSchema),
59
65
  listDefinitions: z.array(listDefinitionSchema).optional().default([]),
60
66
  });
61
67
  }
68
+ /**
69
+ * Formats the server scope section for per-server compilation prompts.
70
+ * When serverScope is provided, appends a directive telling the LLM to emit
71
+ * rules only for that server with required server conditions.
72
+ */
73
+ function formatServerScopeSection(serverScope) {
74
+ if (!serverScope)
75
+ return '';
76
+ return `
77
+ ## Server Scope
78
+
79
+ You are compiling rules for the "${serverScope}" server ONLY.
80
+ Every rule you emit MUST include "server": ["${serverScope}"] in the "if" condition.
81
+ Do NOT emit rules for other servers or tools not listed in the annotations above.
82
+ `;
83
+ }
62
84
  /**
63
85
  * Formats handwritten scenarios as ground truth constraints for the compiler LLM.
64
86
  */
@@ -80,7 +102,7 @@ ${lines.join('\n\n')}
80
102
  }
81
103
  /**
82
104
  * Formats tool annotations into a multi-line summary for LLM system prompts.
83
- * Each entry shows server/tool name, comment, side-effects flag, and per-argument roles.
105
+ * Each entry shows server/tool name, comment, and per-argument roles.
84
106
  * Used by both the constitution compiler and task-policy compiler prompts.
85
107
  */
86
108
  export function formatAnnotationsSummary(annotations) {
@@ -89,16 +111,11 @@ export function formatAnnotationsSummary(annotations) {
89
111
  const argsDesc = Object.entries(a.args)
90
112
  .map(([name, roles]) => ` ${name}: [${roles.join(', ')}]`)
91
113
  .join('\n');
92
- return ` ${a.serverName}/${a.toolName}: ${a.comment}, sideEffects=${a.sideEffects}\n args:\n${argsDesc || ' (none)'}`;
114
+ return ` ${a.serverName}/${a.toolName}: ${a.comment}\n args:\n${argsDesc || ' (none)'}`;
93
115
  })
94
116
  .join('\n');
95
117
  }
96
- /**
97
- * Builds the stable system prompt portion for the compiler.
98
- * Contains: role preamble, constitution, annotations, structural invariants, and instructions.
99
- * This is the cacheable part — it stays the same across repair rounds.
100
- */
101
- export function buildCompilerSystemPrompt(constitutionText, annotations, config, handwrittenScenarios) {
118
+ export function buildCompilerSystemPrompt(constitutionText, annotations, config, handwrittenScenarios, promptOptions) {
102
119
  const annotationsSummary = formatAnnotationsSummary(annotations);
103
120
  return `You are compiling a security policy from a constitution document into enforceable declarative rules.
104
121
 
@@ -119,7 +136,8 @@ The following checks are hardcoded and evaluated BEFORE compiled rules:
119
136
  1. **Protected paths** -- any read, write, or delete targeting these paths is automatically denied:
120
137
  ${config.protectedPaths.map((p) => `- ${p}`).join('\n')}
121
138
 
122
- 2. **Sandbox containment** -- any tool call where ALL paths are within the sandbox directory is automatically allowed. Do NOT generate rules for sandbox-internal operations; the engine handles this at runtime with the dynamically configured sandbox path.
139
+ 2. **Sandbox containment** -- the sandbox directory is \`${config.allowedDirectory ?? '(configured at runtime)'}\`. Any tool call where ALL sandbox-safe path-role arguments are within the sandbox is automatically allowed by the engine, and those roles are structurally resolved (compiled rules are not evaluated for them). Do NOT generate \`paths.within\` rules for filesystem tools targeting the sandbox -- that behavior is structural.
140
+ URL-category roles (e.g., \`git-remote-url\`) are NOT structurally resolved. To control git and other networked operations, constrain them primarily via \`domains\` conditions on their URL roles (for example, using \`domains.allowed\` patterns on \`git-remote-url\`), rather than relying on \`paths.within\` for sandbox paths.
123
141
 
124
142
  3. **Default deny** -- if no compiled rule matches, the engine denies the operation.
125
143
  You do NOT need catch-all deny or escalate rules; uncovered operations are
@@ -135,7 +153,6 @@ Produce an ORDERED list of policy rules (first match wins). Each rule has:
135
153
  - "roles": array of argument roles to match. The rule fires if the tool has ANY argument with ANY of these roles. Use this for blanket rules (e.g., deny all tools with delete-path arguments). Omit = any tool.
136
154
  - "server": array of server names (omit = any server)
137
155
  - "tool": array of specific tool names (omit = any matching tool)
138
- - "sideEffects": match on the tool's sideEffects annotation (omit = don't filter)
139
156
  - "paths": path condition with "roles" (which argument roles to extract paths from) and "within" (concrete absolute directory). Rule fires only if ALL extracted paths are within that directory. If zero paths are extracted (tool has no matching path arguments), the condition is NOT satisfied and the rule does NOT match. This implicitly requires matching roles, so top-level "roles" is redundant when "paths" is present.
140
157
  - "domains": domain condition with "roles" (which URL argument roles to extract domains from) and "allowed" (list of allowed domain patterns, e.g. ["github.com", "*.github.com"]). Rule fires only if ALL extracted domains match an allowed pattern. Supports exact match, "*.example.com" prefix wildcards, and "*" (any domain). If zero URLs are extracted, the condition is NOT satisfied and the rule does NOT match. For git-remote-url roles, use hostname/owner/repo patterns for specific repos (e.g., "github.com/provos/ironcurtain") or hostname-only for any repo on that host (e.g., "github.com"). Matching is hierarchical: a hostname-only pattern matches any repo on that host.
141
158
  - "then": the policy decision:
@@ -177,17 +194,21 @@ delete-history), it is a **multi-mode tool** — its behavior depends on how it
177
194
  At runtime, the engine resolves which roles are active based on the actual arguments.
178
195
 
179
196
  For multi-mode tools:
180
- - If the roles are distinct (e.g., read-path vs write-history), you CAN scope rules
181
- using the "roles" condition. Example: {"tool": ["X"], "roles": ["read-path"]} allows
182
- read-only calls; mutation calls fall to default-deny because their write/delete roles
183
- have no matching rule.
197
+ - If the roles are distinct (e.g., read-path vs write-history), you MUST scope allow
198
+ rules using the "roles" condition. Example: {"tool": ["X"], "roles": ["read-path"]}
199
+ allows read-only calls; mutation calls fall to default-deny because their write/delete
200
+ roles have no matching rule.
201
+ - NEVER create an unconditional allow rule (without "roles") for a multi-mode tool.
202
+ An unconditional allow fires during mutation-role evaluation too, making it impossible
203
+ for any escalate or deny to take effect. Always include "roles": ["read-path"] on
204
+ allow rules for tools that also have mutation roles.
184
205
  - If all modes share the same roles (e.g., a tool always has both read-path and
185
206
  write-path regardless of operation), role scoping cannot distinguish modes. Choose
186
207
  one disposition for the entire tool — prefer escalate if the constitution restricts
187
208
  mutations.
188
209
 
189
210
  Be concise in descriptions and reasons -- one sentence each.
190
- ${formatGroundTruthSection(handwrittenScenarios)}
211
+ ${formatServerScopeSection(promptOptions?.serverScope)}${formatGroundTruthSection(handwrittenScenarios)}
191
212
  ## Dynamic Lists
192
213
 
193
214
  When the constitution references a CATEGORY of things (e.g., "major news sites",
@@ -295,16 +316,20 @@ const INITIAL_COMPILE_MESSAGE = 'Compile the constitution into policy rules foll
295
316
  export class ConstitutionCompilerSession {
296
317
  systemPrompt;
297
318
  model;
319
+ serverNames;
320
+ toolNames;
298
321
  schema;
299
322
  history = [];
300
323
  schemaHint;
324
+ schemaOptions;
301
325
  turns = 0;
302
326
  constructor(options) {
303
327
  this.systemPrompt = options.system;
304
328
  this.model = options.model;
305
- const serverNames = [...new Set(options.annotations.map((a) => a.serverName))];
306
- const toolNames = [...new Set(options.annotations.map((a) => a.toolName))];
307
- this.schema = buildCompilerResponseSchema(serverNames, toolNames);
329
+ this.schemaOptions = options.schemaOptions;
330
+ this.serverNames = [...new Set(options.annotations.map((a) => a.serverName))];
331
+ this.toolNames = [...new Set(options.annotations.map((a) => a.toolName))];
332
+ this.schema = buildCompilerResponseSchema(this.serverNames, this.toolNames, options.schemaOptions);
308
333
  this.schemaHint = schemaToPromptHint(this.schema);
309
334
  }
310
335
  /**
@@ -384,11 +409,248 @@ export class ConstitutionCompilerSession {
384
409
  return { ok: false, error: error instanceof Error ? error.message : String(error) };
385
410
  }
386
411
  }
412
+ /**
413
+ * Point-fix repair: sends patch instructions instead of requesting a full
414
+ * recompilation. The LLM returns a small set of update/add/delete operations
415
+ * that are mechanically applied to the existing rules, avoiding oscillation.
416
+ *
417
+ * Falls back to full recompile if the patch cannot be applied.
418
+ */
419
+ async repairPointFix(existingRules, repairContext, existingListDefinitions = [], onProgress) {
420
+ const existingRuleNames = existingRules.map((r) => r.name);
421
+ if (existingRuleNames.length === 0) {
422
+ return this.recompile(repairContext, onProgress);
423
+ }
424
+ const { serverNames, toolNames } = this;
425
+ const patchSchema = buildPatchResponseSchema(serverNames, toolNames, existingRuleNames, this.schemaOptions);
426
+ const patchSchemaHint = schemaToPromptHint(patchSchema);
427
+ const userMessage = buildPointFixRepairInstructions(existingRules, repairContext) + patchSchemaHint;
428
+ this.history.push({ role: 'user', content: userMessage });
429
+ onProgress?.('Point-fix repair...');
430
+ const result = await generateText({
431
+ model: this.model,
432
+ system: this.systemPrompt,
433
+ messages: this.history,
434
+ maxOutputTokens: DEFAULT_MAX_TOKENS,
435
+ });
436
+ const firstAttempt = tryParsePatch(result.text, patchSchema);
437
+ if (firstAttempt.ok) {
438
+ const applyResult = applyRulePatch(existingRules, firstAttempt.value.operations);
439
+ if (applyResult.ok) {
440
+ this.history.push({ role: 'assistant', content: result.text });
441
+ this.turns++;
442
+ return {
443
+ rules: applyResult.rules,
444
+ listDefinitions: mergeListDefinitions(existingListDefinitions, firstAttempt.value.listDefinitions),
445
+ };
446
+ }
447
+ // Patch apply failed -- fall back to full recompile
448
+ onProgress?.('Patch apply failed, falling back to full recompile...');
449
+ this.history.pop(); // remove the point-fix user message
450
+ return this.recompile(repairContext, onProgress);
451
+ }
452
+ // First parse failed -- attempt one schema repair retry
453
+ onProgress?.('Patch schema repair 1/1...');
454
+ const retryResult = await generateText({
455
+ model: this.model,
456
+ system: this.systemPrompt,
457
+ messages: [
458
+ ...this.history,
459
+ { role: 'assistant', content: result.text },
460
+ {
461
+ role: 'user',
462
+ content: `Your response failed schema validation:\n${firstAttempt.error}\n\nPlease fix the errors and return valid JSON matching the patch schema.`,
463
+ },
464
+ ],
465
+ maxOutputTokens: DEFAULT_MAX_TOKENS,
466
+ });
467
+ const retryParsed = tryParsePatch(retryResult.text, patchSchema);
468
+ if (retryParsed.ok) {
469
+ const applyResult = applyRulePatch(existingRules, retryParsed.value.operations);
470
+ if (applyResult.ok) {
471
+ this.history.push({ role: 'assistant', content: retryResult.text });
472
+ this.turns++;
473
+ return {
474
+ rules: applyResult.rules,
475
+ listDefinitions: mergeListDefinitions(existingListDefinitions, retryParsed.value.listDefinitions),
476
+ };
477
+ }
478
+ }
479
+ // All patch attempts failed -- fall back to full recompile
480
+ onProgress?.('Patch failed, falling back to full recompile...');
481
+ this.history.pop(); // remove the point-fix user message
482
+ return this.recompile(repairContext, onProgress);
483
+ }
387
484
  parseOutput(text) {
388
485
  const parsed = parseJsonWithSchema(text, this.schema);
389
486
  return { rules: parsed.rules, listDefinitions: parsed.listDefinitions };
390
487
  }
391
488
  }
489
+ // ---------------------------------------------------------------------------
490
+ // Point-Fix Repair -- patch-based rule repair
491
+ // ---------------------------------------------------------------------------
492
+ /**
493
+ * Builds the Zod schema for patch responses. Reuses the same compiled rule
494
+ * field schemas as the full compilation schema, but wraps them in a
495
+ * discriminated union of update/add/delete operations.
496
+ */
497
+ export function buildPatchResponseSchema(serverNames, toolNames, existingRuleNames, options) {
498
+ const compiledRuleSchema = buildCompiledRuleSchema(serverNames, toolNames, options);
499
+ const updateOp = z
500
+ .object({
501
+ op: z.literal('update'),
502
+ ruleName: z.enum(existingRuleNames),
503
+ rule: compiledRuleSchema,
504
+ })
505
+ .superRefine((value, ctx) => {
506
+ if (value.rule.name !== value.ruleName) {
507
+ ctx.addIssue({
508
+ code: 'custom',
509
+ message: `rule.name "${value.rule.name}" must match ruleName "${value.ruleName}" (use delete+add to rename)`,
510
+ path: ['rule', 'name'],
511
+ });
512
+ }
513
+ });
514
+ const addOp = z.object({
515
+ op: z.literal('add'),
516
+ afterRule: z.enum(existingRuleNames).optional(),
517
+ rule: compiledRuleSchema,
518
+ });
519
+ const deleteOp = z.object({
520
+ op: z.literal('delete'),
521
+ ruleName: z.enum(existingRuleNames),
522
+ });
523
+ return z.object({
524
+ reasoning: z.string(),
525
+ operations: z.array(z.discriminatedUnion('op', [updateOp, addOp, deleteOp])),
526
+ listDefinitions: z.array(listDefinitionSchema).optional(),
527
+ });
528
+ }
529
+ /**
530
+ * Builds the user prompt for point-fix repair. Shows the existing rules in
531
+ * a compact numbered format, failed scenarios, and judge analysis. Instructs
532
+ * the LLM to emit a minimal patch rather than a full rule set.
533
+ */
534
+ export function buildPointFixRepairInstructions(existingRules, repairContext) {
535
+ const rulesText = existingRules
536
+ .map((r, i) => {
537
+ const conditions = Object.entries(r.if)
538
+ .filter(([, v]) => v !== undefined)
539
+ .map(([k, v]) => `${k}: ${JSON.stringify(v)}`)
540
+ .join(', ');
541
+ return `${i + 1}. "${r.name}" — if { ${conditions} } → ${r.then} (${r.reason})`;
542
+ })
543
+ .join('\n');
544
+ const failuresText = formatFailedResults(repairContext.failedScenarios);
545
+ let existingListsText = '';
546
+ if (repairContext.existingListDefinitions && repairContext.existingListDefinitions.length > 0) {
547
+ const listLines = repairContext.existingListDefinitions.map((d) => `- @${d.name} (type: ${d.type})`).join('\n');
548
+ existingListsText = `
549
+ ### Available Dynamic Lists
550
+
551
+ These lists are already defined and will be preserved automatically. You may reference them in rules using @list-name. You may add NEW list definitions in your response if your fix requires them, but do NOT redefine existing lists.
552
+
553
+ ${listLines}
554
+ `;
555
+ }
556
+ return `## POINT-FIX REPAIR (attempt ${repairContext.attemptNumber})
557
+
558
+ Your previous rules failed verification. You must fix the failures by emitting a PATCH — a minimal set of update, add, or delete operations.
559
+
560
+ ### Current Rules
561
+
562
+ ${rulesText}
563
+
564
+ ### Failed Scenarios
565
+
566
+ ${failuresText}
567
+
568
+ ### Judge Analysis
569
+
570
+ ${repairContext.judgeAnalysis}
571
+ ${existingListsText}${formatGroundTruthSection(repairContext.handwrittenScenarios)}
572
+ ### Instructions
573
+
574
+ 1. Only modify rules that are DIRECTLY responsible for the failures. Do NOT touch passing rules.
575
+ 2. Use "update" to replace a rule by name, "add" to insert a new rule (optionally after an existing rule), or "delete" to remove a rule.
576
+ 3. Operations are applied sequentially: an "add" after a rule that was "delete"d earlier in the same patch will fail.
577
+ 4. Return a patch object with "reasoning", "operations", and optionally "listDefinitions" (only for NEW lists — existing lists are preserved automatically).
578
+ 5. Keep the patch as small as possible — fewer operations means less risk of breaking passing rules.`;
579
+ }
580
+ /**
581
+ * Mechanically applies patch operations to an existing rule list.
582
+ * Operations are applied sequentially in order. Returns the new rule list
583
+ * or an error if an operation references a nonexistent rule.
584
+ */
585
+ export function applyRulePatch(existingRules, operations) {
586
+ const rules = [...existingRules];
587
+ for (const op of operations) {
588
+ switch (op.op) {
589
+ case 'update': {
590
+ const idx = rules.findIndex((r) => r.name === op.ruleName);
591
+ if (idx === -1) {
592
+ return { ok: false, error: `Cannot update rule "${op.ruleName}": not found` };
593
+ }
594
+ if (op.rule.name !== op.ruleName) {
595
+ return {
596
+ ok: false,
597
+ error: `Cannot update rule "${op.ruleName}": rule.name "${op.rule.name}" does not match ruleName (use delete+add to rename)`,
598
+ };
599
+ }
600
+ rules[idx] = op.rule;
601
+ break;
602
+ }
603
+ case 'add': {
604
+ if (rules.some((r) => r.name === op.rule.name)) {
605
+ return { ok: false, error: `Cannot add rule "${op.rule.name}": a rule with that name already exists` };
606
+ }
607
+ if (op.afterRule !== undefined) {
608
+ const idx = rules.findIndex((r) => r.name === op.afterRule);
609
+ if (idx === -1) {
610
+ return { ok: false, error: `Cannot add after rule "${op.afterRule}": not found` };
611
+ }
612
+ rules.splice(idx + 1, 0, op.rule);
613
+ }
614
+ else {
615
+ // No afterRule specified -- prepend
616
+ rules.unshift(op.rule);
617
+ }
618
+ break;
619
+ }
620
+ case 'delete': {
621
+ const idx = rules.findIndex((r) => r.name === op.ruleName);
622
+ if (idx === -1) {
623
+ return { ok: false, error: `Cannot delete rule "${op.ruleName}": not found` };
624
+ }
625
+ rules.splice(idx, 1);
626
+ break;
627
+ }
628
+ }
629
+ }
630
+ return { ok: true, rules };
631
+ }
632
+ /**
633
+ * Merges existing list definitions with new ones from a patch.
634
+ * Existing lists are always preserved; new lists (by name) are appended.
635
+ * Duplicates (same name as an existing list) are silently ignored.
636
+ */
637
+ export function mergeListDefinitions(existing, patchLists) {
638
+ if (!patchLists || patchLists.length === 0)
639
+ return existing;
640
+ const existingNames = new Set(existing.map((d) => d.name));
641
+ const newLists = patchLists.filter((d) => !existingNames.has(d.name));
642
+ return [...existing, ...newLists];
643
+ }
644
+ /** Attempts to parse LLM text as a RulePatch, returning a discriminated result. */
645
+ function tryParsePatch(text, schema) {
646
+ try {
647
+ const parsed = parseJsonWithSchema(text, schema);
648
+ return { ok: true, value: parsed };
649
+ }
650
+ catch (error) {
651
+ return { ok: false, error: error instanceof Error ? error.message : String(error) };
652
+ }
653
+ }
392
654
  export function validateCompiledRules(rules, listDefinitions = []) {
393
655
  const errors = [];
394
656
  const warnings = [];
@@ -1 +1 @@
1
- {"version":3,"file":"constitution-compiler.js","sourceRoot":"","sources":["../../src/pipeline/constitution-compiler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAW3D,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAAC,WAAkC,EAAE,SAAgC;IACvG,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;QAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,EAAE,EAAE,CAAC;aACF,MAAM,CAAC;YACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC1D,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC3C,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACnC,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACrC,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;YACzC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;SAC/C,CAAC;YACF,qJAAqJ;aACpJ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE;YAClE,OAAO,EAAE,+EAA+E;SACzF,CAAC;QACJ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAClC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KACtE,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,SAA0B;IAC1D,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,QAAQ,GAAG,CAAC,CAAC,gBAAgB,KAAK,WAAW,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC1G,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,QAAQ,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IAC3I,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;EAMP,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;CACnB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAA6B;IACpE,OAAO,WAAW;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,iBAAiB,CAAC,CAAC,WAAW,gBAAgB,QAAQ,IAAI,YAAY,EAAE,CAAC;IAC/H,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,gBAAwB,EACxB,WAA6B,EAC7B,MAAsB,EACtB,oBAAqC;IAErC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAEjE,OAAO;;;;EAIP,gBAAgB;;;;;;EAMhB,kBAAkB;;;;;;;EAOlB,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsErD,wBAAwB,CAAC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qFA6BqC,CAAC;AACtF,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,aAA4B;IAClE,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAExE,IAAI,iBAAiB,GAAG,EAAE,CAAC;IAC3B,IAAI,aAAa,CAAC,uBAAuB,IAAI,aAAa,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9F,MAAM,SAAS,GAAG,aAAa,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChH,iBAAiB,GAAG;;;;;;;EAOtB,SAAS;CACV,CAAC;IACA,CAAC;IAED,OAAO,mCAAmC,aAAa,CAAC,aAAa;;;;;;EAMrE,YAAY;;;;EAIZ,aAAa,CAAC,aAAa;EAC3B,iBAAiB;;;;;;;EAOjB,wBAAwB,CAAC,aAAa,CAAC,oBAAoB,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,gBAAwB,EACxB,WAA6B,EAC7B,MAAsB,EACtB,GAAkB,EAClB,aAA6B,EAC7B,UAAsC,EACtC,MAAoC;IAEpC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAA0B,CAAC;IAChG,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAA0B,CAAC;IAC5F,MAAM,MAAM,GAAG,2BAA2B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAEnE,MAAM,eAAe,GAAG,MAAM,IAAI,yBAAyB,CAAC,gBAAgB,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,aAAa;QAC1B,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC;QACxC,CAAC,CAAC,8EAA8E,CAAC;IAEnF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAChD,KAAK,EAAE,GAAG;QACV,MAAM;QACN,MAAM,EAAE,eAAe;QACvB,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,uBAAuB,GAAG,8EAA8E,CAAC;AAE/G;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,2BAA2B;IACrB,YAAY,CAA8B;IAC1C,KAAK,CAAgB;IACrB,MAAM,CAAiD;IACvD,OAAO,GAA2D,EAAE,CAAC;IACrE,UAAU,CAAS;IAC5B,KAAK,GAAG,CAAC,CAAC;IAElB,YAAY,OAAqG;QAC/G,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAE3B,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAA0B,CAAC;QACxG,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAA0B,CAAC;QACpG,IAAI,CAAC,MAAM,GAAG,2BAA2B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,UAAsC;QAClD,OAAO,IAAI,CAAC,YAAY,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,aAA4B,EAAE,UAAsC;QAClF,OAAO,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/E,CAAC;IAED,oDAAoD;IACpD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,UAAsC;QACpF,iEAAiE;QACjE,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE7C,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,eAAe,EAAE,kBAAkB;SACpC,CAAC,CAAC;QAEH,yDAAyD;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,KAAK,CAAC;QAC5B,CAAC;QAED,yDAAyD;QACzD,iEAAiE;QACjE,4DAA4D;QAC5D,UAAU,EAAE,CAAC,sBAAsB,CAAC,CAAC;QAErC,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,QAAQ,EAAE;gBACR,GAAG,IAAI,CAAC,OAAO;gBACf,EAAE,IAAI,EAAE,WAAoB,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;gBACpD;oBACE,IAAI,EAAE,MAAe;oBACrB,OAAO,EAAE,4CAA4C,YAAY,CAAC,KAAK,sEAAsE;iBAC9I;aACF;YACD,eAAe,EAAE,kBAAkB;SACpC,CAAC,CAAC;QAEH,6DAA6D;QAC7D,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,6CAA6C;YACjE,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC;IAED,sEAAsE;IAC9D,QAAQ,CAAC,IAAY;QAC3B,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,IAAY;QAC9B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;IAC1E,CAAC;CACF;AAYD,MAAM,UAAU,qBAAqB,CACnC,KAAqB,EACrB,kBAAoC,EAAE;IAEtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE,mEAAmE;IACnE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,2BAA2B;QAC3B,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACjC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,oBAAoB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACvC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,oBAAoB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;YAED,sCAAsC;YACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,kDAAkD,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACzC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,oBAAoB,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzC,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,0DAA0D,CAAC,CAAC;YAC9F,CAAC;YAED,oDAAoD;YACpD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAChC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,OAAO,QAAQ,qDAAqD,CAAC,CAAC;oBACtG,CAAC;yBAAM,CAAC;wBACN,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;wBAClC,mEAAmE;wBACnE,qEAAqE;wBACrE,iDAAiD;wBACjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;4BAC/B,MAAM,CAAC,IAAI,CACT,SAAS,IAAI,CAAC,IAAI,OAAO,QAAQ,qCAAqC,OAAO,CAAC,IAAI,4DAA4D,CAC/I,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACrC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBAClC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,oBAAoB,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;oBACtF,CAAC;gBACH,CAAC;gBAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAChC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;wBAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;4BACb,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,OAAO,QAAQ,qDAAqD,CAAC,CAAC;wBACtG,CAAC;6BAAM,CAAC;4BACN,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;4BAElC,+DAA+D;4BAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gCAC/B,MAAM,CAAC,IAAI,CACT,SAAS,IAAI,CAAC,IAAI,OAAO,QAAQ,qEAAqE,CACvG,CAAC;4BACJ,CAAC;4BAED,kDAAkD;4BAClD,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;gCACxC,MAAM,CAAC,IAAI,CACT,SAAS,IAAI,CAAC,IAAI,yBAAyB,QAAQ,CAAC,SAAS,qBAAqB,QAAQ,eAAe,OAAO,CAAC,IAAI,GAAG,CACzH,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QACjD,IACE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/B,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;YAChC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;YAClC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACpC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAClC,CAAC;YACD,MAAM,CAAC,IAAI,CACT,SAAS,IAAI,CAAC,IAAI,uFAAuF,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,IAAI,iCAAiC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"constitution-compiler.js","sourceRoot":"","sources":["../../src/pipeline/constitution-compiler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAUnC,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAY3D,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAaH;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,WAAkC,EAClC,SAAgC,EAChC,OAA+B;IAE/B,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,EAAE,EAAE,CAAC;aACF,MAAM,CAAC;YACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC1D,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE;YAC/E,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC3C,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACrC,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;YACzC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;SAC/C,CAAC;aACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE;YAClE,OAAO,EAAE,+EAA+E;SACzF,CAAC;QACJ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,2BAA2B,CAClC,WAAkC,EAClC,SAAgC,EAChC,OAA+B;IAE/B,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEpF,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAClC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KACtE,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,WAAoB;IACpD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAE5B,OAAO;;;mCAG0B,WAAW;+CACC,WAAW;;CAEzD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,SAA0B;IAC1D,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,QAAQ,GAAG,CAAC,CAAC,gBAAgB,KAAK,WAAW,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC1G,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,QAAQ,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IAC3I,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;EAMP,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;CACnB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAA6B;IACpE,OAAO,WAAW;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,gBAAgB,QAAQ,IAAI,YAAY,EAAE,CAAC;IACjG,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAmBD,MAAM,UAAU,yBAAyB,CACvC,gBAAwB,EACxB,WAA6B,EAC7B,MAAsB,EACtB,oBAAqC,EACrC,aAAqC;IAErC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAEjE,OAAO;;;;EAIP,gBAAgB;;;;;;EAMhB,kBAAkB;;;;;;;EAOlB,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;2DAEI,MAAM,CAAC,gBAAgB,IAAI,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwE7G,wBAAwB,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,wBAAwB,CAAC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qFA6BlB,CAAC;AACtF,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,aAA4B;IAClE,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAExE,IAAI,iBAAiB,GAAG,EAAE,CAAC;IAC3B,IAAI,aAAa,CAAC,uBAAuB,IAAI,aAAa,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9F,MAAM,SAAS,GAAG,aAAa,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChH,iBAAiB,GAAG;;;;;;;EAOtB,SAAS;CACV,CAAC;IACA,CAAC;IAED,OAAO,mCAAmC,aAAa,CAAC,aAAa;;;;;;EAMrE,YAAY;;;;EAIZ,aAAa,CAAC,aAAa;EAC3B,iBAAiB;;;;;;;EAOjB,wBAAwB,CAAC,aAAa,CAAC,oBAAoB,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,gBAAwB,EACxB,WAA6B,EAC7B,MAAsB,EACtB,GAAkB,EAClB,aAA6B,EAC7B,UAAsC,EACtC,MAAoC;IAEpC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAA0B,CAAC;IAChG,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAA0B,CAAC;IAC5F,MAAM,MAAM,GAAG,2BAA2B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAEnE,MAAM,eAAe,GAAG,MAAM,IAAI,yBAAyB,CAAC,gBAAgB,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,aAAa;QAC1B,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC;QACxC,CAAC,CAAC,8EAA8E,CAAC;IAEnF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAChD,KAAK,EAAE,GAAG;QACV,MAAM;QACN,MAAM,EAAE,eAAe;QACvB,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,uBAAuB,GAAG,8EAA8E,CAAC;AAE/G;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,2BAA2B;IACrB,YAAY,CAA8B;IAC1C,KAAK,CAAgB;IACrB,WAAW,CAAwB;IACnC,SAAS,CAAwB;IACjC,MAAM,CAAiD;IACvD,OAAO,GAA2D,EAAE,CAAC;IACrE,UAAU,CAAS;IACnB,aAAa,CAAyB;IAC/C,KAAK,GAAG,CAAC,CAAC;IAElB,YAAY,OAKX;QACC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAE3C,IAAI,CAAC,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAA0B,CAAC;QACvG,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAA0B,CAAC;QACnG,IAAI,CAAC,MAAM,GAAG,2BAA2B,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACnG,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,UAAsC;QAClD,OAAO,IAAI,CAAC,YAAY,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,aAA4B,EAAE,UAAsC;QAClF,OAAO,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/E,CAAC;IAED,oDAAoD;IACpD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,UAAsC;QACpF,iEAAiE;QACjE,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE7C,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,eAAe,EAAE,kBAAkB;SACpC,CAAC,CAAC;QAEH,yDAAyD;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,KAAK,CAAC;QAC5B,CAAC;QAED,yDAAyD;QACzD,iEAAiE;QACjE,4DAA4D;QAC5D,UAAU,EAAE,CAAC,sBAAsB,CAAC,CAAC;QAErC,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,QAAQ,EAAE;gBACR,GAAG,IAAI,CAAC,OAAO;gBACf,EAAE,IAAI,EAAE,WAAoB,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;gBACpD;oBACE,IAAI,EAAE,MAAe;oBACrB,OAAO,EAAE,4CAA4C,YAAY,CAAC,KAAK,sEAAsE;iBAC9I;aACF;YACD,eAAe,EAAE,kBAAkB;SACpC,CAAC,CAAC;QAEH,6DAA6D;QAC7D,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,6CAA6C;YACjE,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC;IAED,sEAAsE;IAC9D,QAAQ,CAAC,IAAY;QAC3B,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAClB,aAA6B,EAC7B,aAA4B,EAC5B,0BAA4C,EAAE,EAC9C,UAAsC;QAEtC,MAAM,iBAAiB,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAExC,MAAM,WAAW,GAAG,wBAAwB,CAC1C,WAAW,EACX,SAAS,EACT,iBAA0C,EAC1C,IAAI,CAAC,aAAa,CACnB,CAAC;QACF,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,+BAA+B,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG,eAAe,CAAC;QACpG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAE1D,UAAU,EAAE,CAAC,qBAAqB,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,eAAe,EAAE,kBAAkB;SACpC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC7D,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,cAAc,CAAC,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjF,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;gBACnB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO;oBACL,KAAK,EAAE,WAAW,CAAC,KAAK;oBACxB,eAAe,EAAE,oBAAoB,CAAC,uBAAuB,EAAE,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC;iBACnG,CAAC;YACJ,CAAC;YACD,oDAAoD;YACpD,UAAU,EAAE,CAAC,uDAAuD,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,oCAAoC;YACxD,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACnD,CAAC;QAED,wDAAwD;QACxD,UAAU,EAAE,CAAC,4BAA4B,CAAC,CAAC;QAE3C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,QAAQ,EAAE;gBACR,GAAG,IAAI,CAAC,OAAO;gBACf,EAAE,IAAI,EAAE,WAAoB,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;gBACpD;oBACE,IAAI,EAAE,MAAe;oBACrB,OAAO,EAAE,4CAA4C,YAAY,CAAC,KAAK,4EAA4E;iBACpJ;aACF;YACD,eAAe,EAAE,kBAAkB;SACpC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjE,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,WAAW,GAAG,cAAc,CAAC,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChF,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;gBACnB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;gBACpE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO;oBACL,KAAK,EAAE,WAAW,CAAC,KAAK;oBACxB,eAAe,EAAE,oBAAoB,CAAC,uBAAuB,EAAE,WAAW,CAAC,KAAK,CAAC,eAAe,CAAC;iBAClG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,UAAU,EAAE,CAAC,iDAAiD,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,oCAAoC;QACxD,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACnD,CAAC;IAEO,WAAW,CAAC,IAAY;QAC9B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;IAC1E,CAAC;CACF;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAkC,EAClC,SAAgC,EAChC,iBAAwC,EACxC,OAA+B;IAE/B,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEpF,MAAM,QAAQ,GAAG,CAAC;SACf,MAAM,CAAC;QACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACnC,IAAI,EAAE,kBAAkB;KACzB,CAAC;SACD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,0BAA0B,KAAK,CAAC,QAAQ,8BAA8B;gBAC5G,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACL,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;QAC/C,IAAI,EAAE,kBAAkB;KACzB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;QACxB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;KACpC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5E,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,aAA6B,EAAE,aAA4B;IACzG,MAAM,SAAS,GAAG,aAAa;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACZ,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,YAAY,UAAU,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;IAClF,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAExE,IAAI,iBAAiB,GAAG,EAAE,CAAC;IAC3B,IAAI,aAAa,CAAC,uBAAuB,IAAI,aAAa,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9F,MAAM,SAAS,GAAG,aAAa,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChH,iBAAiB,GAAG;;;;;EAKtB,SAAS;CACV,CAAC;IACA,CAAC;IAED,OAAO,gCAAgC,aAAa,CAAC,aAAa;;;;;;EAMlE,SAAS;;;;EAIT,YAAY;;;;EAIZ,aAAa,CAAC,aAAa;EAC3B,iBAAiB,GAAG,wBAAwB,CAAC,aAAa,CAAC,oBAAoB,CAAC;;;;;;;qGAOmB,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,aAA6B,EAC7B,UAAyB;IAEzB,MAAM,KAAK,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IAEjC,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;YACd,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAC3D,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,QAAQ,cAAc,EAAE,CAAC;gBAChF,CAAC;gBACD,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;oBACjC,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,uBAAuB,EAAE,CAAC,QAAQ,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,sDAAsD;qBAC7H,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;gBACrB,MAAM;YACR,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,IAAI,CAAC,IAAI,yCAAyC,EAAE,CAAC;gBACzG,CAAC;gBACD,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC5D,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;wBACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,SAAS,cAAc,EAAE,CAAC;oBACpF,CAAC;oBACD,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBACpC,CAAC;qBAAM,CAAC;oBACN,oCAAoC;oBACpC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAC3D,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,QAAQ,cAAc,EAAE,CAAC;gBAChF,CAAC;gBACD,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA0B,EAC1B,UAAwC;IAExC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CACpB,IAAY,EACZ,MAAmD;IAEnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAmB,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAYD,MAAM,UAAU,qBAAqB,CACnC,KAAqB,EACrB,kBAAoC,EAAE;IAEtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE,mEAAmE;IACnE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,2BAA2B;QAC3B,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACjC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,oBAAoB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACvC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,oBAAoB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;YAED,sCAAsC;YACtC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,kDAAkD,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACzC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,oBAAoB,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzC,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,0DAA0D,CAAC,CAAC;YAC9F,CAAC;YAED,oDAAoD;YACpD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAChC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,OAAO,QAAQ,qDAAqD,CAAC,CAAC;oBACtG,CAAC;yBAAM,CAAC;wBACN,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;wBAClC,mEAAmE;wBACnE,qEAAqE;wBACrE,iDAAiD;wBACjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;4BAC/B,MAAM,CAAC,IAAI,CACT,SAAS,IAAI,CAAC,IAAI,OAAO,QAAQ,qCAAqC,OAAO,CAAC,IAAI,4DAA4D,CAC/I,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACrC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBAClC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,oBAAoB,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;oBACtF,CAAC;gBACH,CAAC;gBAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAChC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;wBAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;4BACb,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,OAAO,QAAQ,qDAAqD,CAAC,CAAC;wBACtG,CAAC;6BAAM,CAAC;4BACN,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;4BAElC,+DAA+D;4BAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gCAC/B,MAAM,CAAC,IAAI,CACT,SAAS,IAAI,CAAC,IAAI,OAAO,QAAQ,qEAAqE,CACvG,CAAC;4BACJ,CAAC;4BAED,kDAAkD;4BAClD,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;gCACxC,MAAM,CAAC,IAAI,CACT,SAAS,IAAI,CAAC,IAAI,yBAAyB,QAAQ,CAAC,SAAS,qBAAqB,QAAQ,eAAe,OAAO,CAAC,IAAI,GAAG,CACzH,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QACjD,IACE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/B,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;YAChC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;YAClC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACpC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAClC,CAAC;YACD,MAAM,CAAC,IAAI,CACT,SAAS,IAAI,CAAC,IAAI,uFAAuF,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,IAAI,iCAAiC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC"}
@@ -24,8 +24,8 @@ export declare function extractJson(text: string): string;
24
24
  * Extracts and validates JSON from LLM text output against a Zod schema.
25
25
  * Handles markdown fences, surrounding prose, and schema validation.
26
26
  *
27
- * Exported for use by ScenarioGeneratorSession which manages its own
28
- * message history but needs the same extraction+validation logic.
27
+ * Exported for reuse by callers that manage their own message history
28
+ * but need the same extraction+validation logic.
29
29
  */
30
30
  export declare function parseJsonWithSchema<T extends z.ZodType>(text: string, schema: T): z.infer<T>;
31
31
  interface GenerateObjectWithRepairOptions<T extends z.ZodType> {
@@ -49,8 +49,8 @@ export function extractJson(text) {
49
49
  * Extracts and validates JSON from LLM text output against a Zod schema.
50
50
  * Handles markdown fences, surrounding prose, and schema validation.
51
51
  *
52
- * Exported for use by ScenarioGeneratorSession which manages its own
53
- * message history but needs the same extraction+validation logic.
52
+ * Exported for reuse by callers that manage their own message history
53
+ * but need the same extraction+validation logic.
54
54
  */
55
55
  export function parseJsonWithSchema(text, schema) {
56
56
  const json = JSON.parse(extractJson(text));
@@ -1,13 +1,26 @@
1
1
  /**
2
- * Mandatory handwritten test scenarios derived from existing policy engine tests.
2
+ * Mandatory handwritten test scenarios for the policy compilation pipeline.
3
3
  *
4
- * These provide human-authored ground truth that the verifier always checks,
5
- * mitigating circular reasoning where the compiler and scenario generator
6
- * share the same blind spots.
4
+ * These are fed to the LLM compiler as ground-truth constraints that the
5
+ * compiled rules MUST satisfy, and are verified after every compilation.
7
6
  *
8
- * Kept minimal: only universal invariants that any reasonable constitution
9
- * should satisfy. Constitution-dependent scenarios (git rules, fetch rules,
10
- * read/write escalation) are left to the LLM scenario generator.
7
+ * ╔═══════════════════════════════════════════════════════════════════╗
8
+ * ║ ONLY universal, constitution-independent invariants belong here.
9
+ * ║ ║
10
+ * ║ These scenarios constrain what the LLM compiler can produce. ║
11
+ * ║ Adding server-specific or constitution-dependent scenarios ║
12
+ * ║ (e.g., "git push must escalate", "Gmail send must escalate") ║
13
+ * ║ will CONFLICT with user constitutions that make different ║
14
+ * ║ choices for those servers. ║
15
+ * ║ ║
16
+ * ║ Server-specific policy tests belong in policy-engine.test.ts, ║
17
+ * ║ where they validate the current compiled policy without ║
18
+ * ║ constraining what the compiler can generate. ║
19
+ * ╚═══════════════════════════════════════════════════════════════════╝
20
+ *
21
+ * Current invariants:
22
+ * 1. Filesystem sandbox containment — writes/deletes outside the
23
+ * sandbox must never be allowed regardless of constitution.
11
24
  */
12
25
  import type { TestScenario } from './types.js';
13
26
  export declare function getHandwrittenScenarios(sandboxDir: string): TestScenario[];
@@ -1,13 +1,26 @@
1
1
  /**
2
- * Mandatory handwritten test scenarios derived from existing policy engine tests.
2
+ * Mandatory handwritten test scenarios for the policy compilation pipeline.
3
3
  *
4
- * These provide human-authored ground truth that the verifier always checks,
5
- * mitigating circular reasoning where the compiler and scenario generator
6
- * share the same blind spots.
4
+ * These are fed to the LLM compiler as ground-truth constraints that the
5
+ * compiled rules MUST satisfy, and are verified after every compilation.
7
6
  *
8
- * Kept minimal: only universal invariants that any reasonable constitution
9
- * should satisfy. Constitution-dependent scenarios (git rules, fetch rules,
10
- * read/write escalation) are left to the LLM scenario generator.
7
+ * ╔═══════════════════════════════════════════════════════════════════╗
8
+ * ║ ONLY universal, constitution-independent invariants belong here.
9
+ * ║ ║
10
+ * ║ These scenarios constrain what the LLM compiler can produce. ║
11
+ * ║ Adding server-specific or constitution-dependent scenarios ║
12
+ * ║ (e.g., "git push must escalate", "Gmail send must escalate") ║
13
+ * ║ will CONFLICT with user constitutions that make different ║
14
+ * ║ choices for those servers. ║
15
+ * ║ ║
16
+ * ║ Server-specific policy tests belong in policy-engine.test.ts, ║
17
+ * ║ where they validate the current compiled policy without ║
18
+ * ║ constraining what the compiler can generate. ║
19
+ * ╚═══════════════════════════════════════════════════════════════════╝
20
+ *
21
+ * Current invariants:
22
+ * 1. Filesystem sandbox containment — writes/deletes outside the
23
+ * sandbox must never be allowed regardless of constitution.
11
24
  */
12
25
  export function getHandwrittenScenarios(sandboxDir) {
13
26
  return [
@@ -35,40 +48,6 @@ export function getHandwrittenScenarios(sandboxDir) {
35
48
  reasoning: 'Writes outside permitted areas must not be allowed without human intervention.',
36
49
  source: 'handwritten',
37
50
  },
38
- // ── GitHub scenarios ──────────────────────────────────────────────
39
- {
40
- description: 'List GitHub issues -- allowed (read-only)',
41
- request: {
42
- serverName: 'github',
43
- toolName: 'list_issues',
44
- arguments: { owner: 'octocat', repo: 'hello-world' },
45
- },
46
- expectedDecision: 'allow',
47
- reasoning: 'Read-only GitHub operations are safe and should be allowed without escalation.',
48
- source: 'handwritten',
49
- },
50
- {
51
- description: 'Create pull request on GitHub -- not allowed (mutation)',
52
- request: {
53
- serverName: 'github',
54
- toolName: 'create_pull_request',
55
- arguments: { owner: 'octocat', repo: 'hello-world', title: 'Fix bug', head: 'fix-branch', base: 'main' },
56
- },
57
- expectedDecision: 'not-allow',
58
- reasoning: 'Creating a pull request is a mutation that requires human approval.',
59
- source: 'handwritten',
60
- },
61
- {
62
- description: 'Unknown tool on GitHub server -- not allowed (structural invariant)',
63
- request: {
64
- serverName: 'github',
65
- toolName: 'completely_unknown_tool',
66
- arguments: {},
67
- },
68
- expectedDecision: 'not-allow',
69
- reasoning: 'Unknown tools are denied by the structural invariant.',
70
- source: 'handwritten',
71
- },
72
51
  ];
73
52
  }
74
53
  //# sourceMappingURL=handwritten-scenarios.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"handwritten-scenarios.js","sourceRoot":"","sources":["../../src/pipeline/handwritten-scenarios.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,OAAO;QACL,gFAAgF;QAChF;YACE,WAAW,EAAE,0DAA0D;YACvE,OAAO,EAAE;gBACP,UAAU,EAAE,YAAY;gBACxB,QAAQ,EAAE,WAAW;gBACrB,SAAS,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,UAAU,gBAAgB,EAAE;aACxF;YACD,gBAAgB,EAAE,WAAW;YAC7B,SAAS,EACP,+HAA+H;YACjI,MAAM,EAAE,aAAa;SACtB;QAED,mEAAmE;QACnE;YACE,WAAW,EAAE,2CAA2C;YACxD,OAAO,EAAE;gBACP,UAAU,EAAE,YAAY;gBACxB,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE;aACvD;YACD,gBAAgB,EAAE,WAAW;YAC7B,SAAS,EAAE,gFAAgF;YAC3F,MAAM,EAAE,aAAa;SACtB;QAED,qEAAqE;QACrE;YACE,WAAW,EAAE,2CAA2C;YACxD,OAAO,EAAE;gBACP,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,aAAa;gBACvB,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;aACrD;YACD,gBAAgB,EAAE,OAAO;YACzB,SAAS,EAAE,gFAAgF;YAC3F,MAAM,EAAE,aAAa;SACtB;QACD;YACE,WAAW,EAAE,yDAAyD;YACtE,OAAO,EAAE;gBACP,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,qBAAqB;gBAC/B,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE;aACzG;YACD,gBAAgB,EAAE,WAAW;YAC7B,SAAS,EAAE,qEAAqE;YAChF,MAAM,EAAE,aAAa;SACtB;QACD;YACE,WAAW,EAAE,qEAAqE;YAClF,OAAO,EAAE;gBACP,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,yBAAyB;gBACnC,SAAS,EAAE,EAAE;aACd;YACD,gBAAgB,EAAE,WAAW;YAC7B,SAAS,EAAE,uDAAuD;YAClE,MAAM,EAAE,aAAa;SACtB;KACF,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"handwritten-scenarios.js","sourceRoot":"","sources":["../../src/pipeline/handwritten-scenarios.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,OAAO;QACL,gFAAgF;QAChF;YACE,WAAW,EAAE,0DAA0D;YACvE,OAAO,EAAE;gBACP,UAAU,EAAE,YAAY;gBACxB,QAAQ,EAAE,WAAW;gBACrB,SAAS,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,UAAU,gBAAgB,EAAE;aACxF;YACD,gBAAgB,EAAE,WAAW;YAC7B,SAAS,EACP,+HAA+H;YACjI,MAAM,EAAE,aAAa;SACtB;QAED,mEAAmE;QACnE;YACE,WAAW,EAAE,2CAA2C;YACxD,OAAO,EAAE;gBACP,UAAU,EAAE,YAAY;gBACxB,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE;aACvD;YACD,gBAAgB,EAAE,WAAW;YAC7B,SAAS,EAAE,gFAAgF;YAC3F,MAAM,EAAE,aAAa;SACtB;KACF,CAAC;AACJ,CAAC"}